WO2022217993A1 - 一种加密数据的传输方法及相关设备 - Google Patents

一种加密数据的传输方法及相关设备 Download PDF

Info

Publication number
WO2022217993A1
WO2022217993A1 PCT/CN2022/071704 CN2022071704W WO2022217993A1 WO 2022217993 A1 WO2022217993 A1 WO 2022217993A1 CN 2022071704 W CN2022071704 W CN 2022071704W WO 2022217993 A1 WO2022217993 A1 WO 2022217993A1
Authority
WO
WIPO (PCT)
Prior art keywords
encrypted data
data frames
encryption
encrypted
information
Prior art date
Application number
PCT/CN2022/071704
Other languages
English (en)
French (fr)
Inventor
苏伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22787225.6A priority Critical patent/EP4311166A1/en
Publication of WO2022217993A1 publication Critical patent/WO2022217993A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of optical transmission, and in particular, to a method for transmitting encrypted data and related equipment.
  • OTN Optical Transport Network
  • FlexO Flexible Optical Transport Network
  • one FlexO frame is regarded as one encryption period.
  • the data in the payload area of the FlexO frame is encrypted, and the encrypted data is still placed in the payload area of the FlexO frame.
  • Encryption information and authentication information are placed in the overhead area of the FlexO frame.
  • the encryption method based on the fixed period of the FlexO frame needs to add encryption information and authentication information in each FlexO frame. This implementation method has poor flexibility and is difficult to apply to the transmission requirements of various types of services.
  • the present application provides a method for transmitting encrypted data. This method is performed by the sender device.
  • N first encrypted data frames are encrypted according to the first encryption information to obtain N first encrypted data frames.
  • each first data frame is used to carry data of the first service, and N is an integer greater than or equal to 1.
  • perform authentication processing on the first encrypted information and the N first encrypted data frames to obtain the first authentication information.
  • a first encryption overhead frame for carrying the first encryption information and the first authentication information is generated.
  • N first encrypted data frames and first encrypted overhead frames are sent.
  • an encryption overhead frame specially used for carrying encryption information and authentication information is constructed, and there is no need to add encryption information and authentication information in each data frame, and the implementation method is more flexible.
  • the method further includes: encrypting the M first data frames according to the second encryption information to obtain M second encrypted data frames .
  • M is an integer greater than or equal to 1, and M is different from N.
  • the second authentication information is obtained by performing authentication processing on the second encrypted information and the M second encrypted data frames.
  • a second encryption overhead frame for carrying the second encryption information and the second authentication information is generated.
  • the method further comprises: The method includes: generating a third encryption overhead frame for carrying the second encryption information and the first authentication information. Send N first data frames and third encrypted overhead frames.
  • the encryption overhead frame in this critical encryption period is different from neither the above-mentioned first encryption overhead frame nor the above-mentioned second encryption overhead frame. Specifically, the critical encryption period still belongs to the encryption period N, but a third encryption overhead frame needs to be inserted after the N first encrypted data frames.
  • the second encryption information needs to be sent to the receiving end device in advance to notify the receiving end device that the encryption period is to change from N to M, so that the receiving end device can receive the second encrypted data Decryption can be performed in real time according to the second encrypted information after the frame.
  • the method further includes: encrypting the K second data frames according to the third encryption information to obtain K third encrypted data frames.
  • the second data frame is used to carry data of the second service, K is an integer greater than or equal to 1, and K is different from N.
  • a fourth encryption overhead frame for carrying the third encryption information and the third authentication information is generated, and K third encryption data frames and fourth encryption overhead frames are sent. That is to say, in addition to encrypting and sending data of the first service, the sending end device can also encrypt and send data of other services at the same time. Since different services have different degrees of sensitivity to time delay, different encryption periods can be used for encryption for different service types, which enhances the scalability of the scheme.
  • the first encryption information and the first authentication information are located in the payload area of the first encryption overhead frame. Since the payload area in the first encrypted overhead frame has a larger space and does not carry service data, it is more convenient to carry the first encrypted information and the first authentication information.
  • the first data frame is the same size as the first encryption overhead frame. That is, the first encryption overhead frame may adopt the same frame structure as the first data frame, which is convenient for unifying the standard.
  • the first encryption information includes but is not limited to frame count (Frame Number, FN), key indication (Key Index, KI), cipher suite type (Cipher Suite Type, CST), key interactive communication Channel (Key Exchange Communication Channel, KCC), type of the first encryption overhead frame, encryption period N, etc.
  • the first authentication information includes but is not limited to an authentication tag (Authentication Tag, AT). The present application provides specific content included in the first encryption information and the first authentication information, which improves the practicability of the solution.
  • encrypting the N first data frames according to the first encryption information to obtain the N first encrypted data frames includes: encrypting the payloads in the N first data frames according to the first encryption information Obtain N first encrypted data frames.
  • the payload and the overhead in the N first data frames are encrypted according to the first encryption information to obtain the N first encrypted data frames.
  • the encryption of the data frame is not limited to the encryption of the payload data, and may also be encrypted together with part or all of the overhead, which enriches the implementation of this solution.
  • the first data frame is an Optical Service Unit (Optical Service Unit, OSU) frame, which is mainly used in a transmission scenario of small-granularity services.
  • OSU Optical Service Unit
  • the present application provides a method for transmitting encrypted data.
  • This method is performed by the sender device.
  • N data frames are encrypted according to the first encryption information to obtain N first encrypted data frames.
  • N is an integer greater than 1.
  • perform authentication processing on the first encrypted information and the N first encrypted data frames to obtain the first authentication information.
  • at least one of the N first encrypted data frames includes a first field, and the first field is used to carry the first encryption information and the first authentication information.
  • N first encrypted data frames are sent.
  • multiple data frames can be encrypted, and the encrypted multiple encrypted data frames can be used as a whole to carry the first encryption information and the first authentication information, and there is no need to add encryption information and authentication to each data frame. information, the implementation is more flexible.
  • the method further includes: encrypting the M data frames according to the second encryption information to obtain M second encrypted data frames.
  • M is an integer greater than or equal to 1, and M is different from N.
  • the second authentication information is obtained by performing authentication processing on the second encrypted information and the M second encrypted data frames.
  • at least one second encrypted data frame among the M second encrypted data frames includes a second field, and the second field is used to carry the second encrypted information and the second authentication information.
  • the first encrypted data frame among the N first encrypted data frames may carry the first encrypted information and the first authentication information.
  • the first encryption information and the first authentication information are located in the start field of the payload area in the start encrypted data frame.
  • the first encrypted data frame of the N first encrypted data frames may carry the first encryption information
  • the last encrypted data frame of the N first encrypted data frames may carry the first authentication information.
  • the first encryption information is located in the start field of the payload area in the start encrypted data frame
  • the first authentication information is located in the end field of the payload area in the last encrypted data frame.
  • one subfield may be reserved in each first encrypted data frame, and N subfields are used to carry the first encryption information and the first authentication information.
  • the subfield in each first encrypted data frame is located at the start field of its payload area.
  • At least one bit may be reserved in a fixed position of the overhead area in each first encrypted data frame, and then all reserved bits in the N first encrypted data frames may be used to carry the first bit. encrypted information and first authentication information.
  • the present application provides a method for transmitting encrypted data.
  • the method is executed by the receiver device.
  • the N first encrypted data frames and the first encrypted overhead frames sent by the sending end device are received.
  • the N first encrypted data frames are obtained by encrypting the N first data frames according to the first encryption information by the sending end device.
  • N is an integer greater than or equal to 1, and each first data frame is used to carry data of the first service.
  • the first encrypted overhead frame is used to carry the first encrypted information and the first authentication information, and the first authentication information is obtained by performing authentication processing on the first encrypted information and the N first encrypted data frames by the transmitting end device.
  • the authentication information is obtained by performing authentication processing on the received first encrypted information and the N first encrypted data frames. Further, the locally generated authentication information is matched with the received first authentication information. If the first authentication information is successfully matched, the N first encrypted data frames are decrypted according to the first encrypted information to obtain N first data frames.
  • the method further includes: receiving M second encrypted data frames and the second encrypted data frames sent by the sending end device Overhead frame.
  • the M second encrypted data frames are obtained by encrypting the M first data frames by the transmitting end device according to the second encryption information.
  • M is an integer greater than or equal to 1, and M is different from N.
  • the second encryption overhead frame is used to carry the second encryption information and the second authentication information.
  • the second authentication information is obtained by performing authentication processing on the second encrypted information and the M second encrypted data frames by the sending end device. If the second authentication information is successfully matched, the M second encrypted data frames are decrypted according to the second encryption information to obtain M first data frames.
  • the method further includes: receiving a third encrypted overhead frame, where the third encrypted overhead frame is used to carry the second encrypted information and the first authentication information.
  • an embodiment of the present application provides a sending end device.
  • the transmitter device includes: a processor, a memory, and a transceiver.
  • the processor, the memory, and the transceiver are connected to each other through a line, and the processor invokes the program code in the memory to execute the encrypted data transmission shown in any one of the embodiments of the first aspect and the second aspect. method.
  • an embodiment of the present application provides a receiving end device.
  • the receiving end includes: a processor, a memory and a transceiver.
  • the processor, the memory, and the transceiver are connected to each other through a line, and the processor invokes the program code in the memory to execute the encrypted data transmission method shown in any one of the embodiments of the third aspect.
  • an embodiment of the present application provides a communication system, including the transmitting end device shown in the fourth aspect above and the receiving end device shown in the fifth aspect above.
  • an embodiment of the present invention provides a digital processing chip.
  • the digital processing chip includes a processor and a memory, and the memory and the processor are interconnected by wires. Instructions are stored in the memory, and the processor is configured to execute the method for transmitting encrypted data according to any one of the embodiments of the first aspect to the third aspect.
  • an embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, wherein, when the computer program is executed by hardware, any one of the first to third aspects can be implemented some or all of the steps of a method.
  • the encryption period can be flexibly set according to the type of service.
  • an encryption overhead frame may be inserted.
  • the encryption overhead frame is dedicated to carrying encryption information and authentication information. That is, the N data frames and one encryption overhead frame constitute an encryption block. Since the value of N can be changed according to the type of the service and is not a fixed value, it is convenient to meet the transmission requirements of various types of services.
  • the present application constructs an encryption overhead frame specially used to carry encryption information and authentication information, without adding encryption information and authentication information in each data frame, and the implementation is more flexible.
  • FIG. 1 is a schematic diagram of a first embodiment of a method for transmitting encrypted data in an embodiment of the application
  • FIG. 2 is a schematic structural diagram of an OSU frame in an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of an encrypted overhead frame in an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a second embodiment of a method for transmitting encrypted data in an embodiment of the present application
  • Fig. 6 (a) is the first schematic diagram of carrying encrypted information and authentication information by encrypted data frame
  • Figure 6 (b) is a second schematic diagram of carrying encrypted information and authentication information through an encrypted data frame
  • Fig. 6 (c) is the third schematic diagram of carrying encrypted information and authentication information through encrypted data frame
  • FIG. 7 is a schematic diagram of a third embodiment of a method for transmitting encrypted data in an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a possible transmitting end device
  • FIG. 9 is a schematic structural diagram of a possible receiving end device
  • FIG. 10 is a schematic structural diagram of a communication system provided by this application.
  • Embodiments of the present application provide a method and related equipment for transmitting encrypted data.
  • the present application constructs an encryption overhead frame specially used to carry encryption information and authentication information, without adding encryption information and authentication information in each data frame, and the implementation is more flexible.
  • first and second in the description and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, rather than limiting a specific sequence or sequence. It is to be understood that the above terms are interchangeable under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those described herein.
  • the term “comprising” and any variations thereof are intended to cover non-exclusive inclusion.
  • a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units expressly listed, but may include steps or units not expressly listed or for such process, method, product or Other steps or units inherent to the device.
  • the sending end device encrypts the data frame to be sent according to the preset encryption information to obtain the encrypted data frame. After that, the sender device will also perform authentication processing on the encrypted information and the encrypted data frame to obtain the authentication information. Furthermore, the sending end device needs to send the encrypted data frame, encrypted information and authentication information to the receiving end device.
  • the receiving end device first performs authentication processing on the received encrypted data frame and preset encrypted information to obtain authentication information. After that, the receiving end device matches the locally generated authentication information with the received authentication information. If the matching is successful, the receiving end device further decrypts the encrypted data frame according to the encrypted information to obtain the original data frame.
  • the sending end device in addition to sending encrypted data frames to the receiving end device, the sending end device also needs to send encrypted information and authentication information to the receiving end device in a certain way.
  • a FlexO frame a current method is to use a FlexO frame as an encryption period.
  • the encryption information and authentication information are placed in the overhead area of the FlexO frame and transmitted together with the FlexO frame.
  • the encryption method based on the fixed period of the FlexO frame needs to add encryption information and authentication information in each FlexO frame, and this implementation method is less flexible. For example, according to different types of services, some services are sensitive to delay, and some services are not sensitive to delay.
  • the present application provides a method for transmitting encrypted data, which is more flexible in implementation and is suitable for the transmission requirements of various types of services.
  • the sender device also has the function of receiving data
  • the receiver device also has the function of sending data.
  • the sending end device is used as one end for encrypting data
  • the receiving end device is used as one end for data decryption.
  • FIG. 1 is a schematic diagram of a first embodiment of a method for transmitting encrypted data in an embodiment of the present application.
  • the transmission method of encrypted data includes the following steps.
  • the sending end device and the receiving end device may pre-agreed the encryption information to be used. Specifically, the transmitting end device encrypts N first data frames according to the agreed first encryption information to obtain N first encrypted data frames. Wherein, N is an integer greater than or equal to 1.
  • Each first data frame is used to carry data of the first service.
  • the first data frame used in this application may be an OSU frame, an optical payload unit k (Optical Payload Unit k, OPUk) frame, an optical data unit k (Optical Data Unit k, ODUk) frame or an optical transmission frame Unit k (Optical Transport Unit k, OTUk) frame and other OTN frames.
  • the OSU frame may also have other naming manners, for example, it may also be called a Flexible Optical Service Unit (Flexible Optical Service Unit, OSUflex) frame, which is not specifically limited here.
  • OSUflex Flexible Optical Service Unit
  • the following description mainly takes the OSU frame carrying small-granularity services as an example.
  • FIG. 2 is a schematic structural diagram of an OSU frame in an embodiment of the present application.
  • the OSU frame includes an overhead area and a payload area.
  • the payload area is used to carry service data.
  • the overhead area includes general overhead, mapping overhead and 8-bit cyclic redundancy check (Cyclic Redundancy Check-8bits, CRC8).
  • CRC8 Cyclic Redundancy Check-8bits
  • the general overhead can be further subdivided into version number, tributary port number (Tributary Port Number, TPN), continuity check, frame type (Frame Type, FT), reservation overhead, tandem connection monitoring 1 (Tandem Connection Monitoring, TCM), Tandem Connection Monitoring 2, and Path Monitoring (PM).
  • the mapping overhead includes mapping information generated when mapping client services to the OSU payload area, for example, the client service data volume and client service clock information used to indicate the OSU payload area mapping. It should be understood that the format of the overhead area in the OSU frame shown in FIG. 2 above is just an example, and other formats may also exist in practical applications, which are not specifically limited here.
  • the sending end device may only encrypt the payload data of the OSU frame.
  • the transmitting end device may also encrypt the payload data and all or part of the overhead of the OSU frame, for example, the transmitting end device encrypts the payload data and mapping overhead of the OSU frame.
  • the above encryption information includes, but is not limited to, FN, KI, CST, KCC, the type of the first encryption overhead frame, the encryption period N, and the like.
  • the encryption period N means that the transmitting end device performs encryption with N first data frames as a period.
  • the transmitting end device After the transmitting end device encrypts the N first data frames to obtain the N first encrypted data frames, it further performs authentication processing on the first encrypted information and the N first encrypted data frames to obtain the first authentication information.
  • the sending end device may perform authentication processing on the N first encrypted data frames and all the information in the first encrypted information.
  • the sending end device may also perform authentication processing on the N first encrypted data frames and part of the information in the first encrypted information.
  • part of the information in the first encrypted information may be other encrypted information except KCC.
  • the first authentication information includes but is not limited to AT.
  • the sending end device needs to insert a first encrypted overhead frame after the N first encrypted data frames.
  • the first encryption overhead frame is used to carry the first encryption information and the first authentication information.
  • the N first encrypted data frames and one first encrypted overhead frame may be called an encrypted block.
  • the encrypted overhead frame may also have other naming manners, for example, it may also be called an overhead encrypted frame, etc., which is not specifically limited here.
  • the size of the first encrypted overhead frame is the same as that of the first encrypted data frame. That is to say, the first encrypted overhead frame may adopt the same frame format as the first encrypted data frame, except that the first encrypted overhead frame is specially used to carry the first encrypted information and the first authentication information.
  • both the first encryption information and the first authentication information may be placed in the payload area of the first encryption overhead frame.
  • both the first encryption information and the first authentication information may also be placed in the overhead area of the first encryption overhead frame.
  • the first encrypted information and the first authentication information may be separated and placed in the payload area and the overhead area of the first encrypted overhead frame, respectively, and the specific method of the splitting is not specifically limited here.
  • the first encryption overhead frame is described below by still taking the structure of the OSU frame as an example.
  • FIG. 3 is a schematic structural diagram of an encrypted overhead frame in an embodiment of the present application.
  • the type of the first encryption overhead frame in the first encryption information may be indicated by a frame type (Frame Type, FT), or may also be indicated by Operation Administration and Maintenance-Frame Type (Operation Administration and Maintenance-Frame Type). , OAM-FT) to indicate.
  • the encryption period N in the first encryption information is also placed in the overhead area of the first encryption overhead frame.
  • Other information in the first encrypted information and the first authentication information may be placed in the payload area of the first encrypted overhead frame.
  • the first encryption overhead frame shown in FIG. 3 above is only an example, and in practical applications, there may be other ways to place the first encryption information and the first authentication information in the first encryption overhead frame. Do limit.
  • the transmitting end device After the transmitting end device generates the first encrypted overhead frame, the transmitting end device sends the N first encrypted data frames and the first encrypted overhead frame to the receiving end device. It should be understood that, taking the first encrypted data frame being an OSU frame as an example, the transmitting end device may map the N first encrypted data frames and the first encrypted overhead frame to the payload area of the OPUk frame. Wherein, each first encrypted data frame or first encrypted overhead frame occupies a payload block in one OPUk frame. Furthermore, the sending end device can also map the OPUk frame to a container with a higher rate such as an OTUk frame or a FlexO frame for sending.
  • a container with a higher rate such as an OTUk frame or a FlexO frame for sending.
  • the sensitivity of the first service to the delay may change with time, so the value of the encryption period N may also change with time.
  • the first service is a low-latency service
  • the value of N is small
  • the frequency of inserting the first encryption overhead frame into the first encrypted data frame is high.
  • the first service may become a service with normal delay, the value of N will become larger, and the frequency of inserting the first encryption overhead frame into the first encrypted data frame will become lower. That is to say, the encryption period corresponding to the low-latency service is shorter, and the encryption period corresponding to the normal-latency service is longer.
  • the scheme is further introduced below by taking the encryption period from N to M as an example.
  • the transmitting end device encrypts the M first data frames according to the second encryption information to obtain M second encrypted data frames, where M is an integer greater than or equal to 1, and M and N are different.
  • the transmitting end device performs authentication processing on the second encrypted information and the M second encrypted data frames to obtain the second authentication information.
  • the sending end device generates a second encryption overhead frame for carrying the second encryption information and the second authentication information.
  • the sending end device sends M second encrypted data frames and second encrypted overhead frames to the receiving end device.
  • the implementation manner in which the encryption period is M is similar to the implementation manner in which the encryption period is N. For details, reference may be made to the relevant descriptions of the foregoing steps 101 to 104, which will not be introduced here.
  • FIG. 4 is a schematic diagram of an encryption period changing from N to M in an embodiment of the present application.
  • the encryption period N is inserted into the first encryption overhead frame according to the ratio of 1:1
  • the encryption period M is inserted into the second encryption overhead frame according to the ratio of 3:1.
  • the encryption overhead frame in this critical encryption period is different from neither the above-mentioned first encryption overhead frame nor the above-mentioned second encryption overhead frame.
  • the critical encryption period still belongs to the encryption period N, but a third encryption overhead frame needs to be inserted after the N first encrypted data frames.
  • the third encryption overhead frame is used to carry the second encryption information and the first authentication information.
  • the second encryption information needs to be sent to the receiving end device in advance to notify the receiving end device that the encryption period is to change from N to M, so that the receiving end device can receive the second encrypted data
  • Decryption can be performed in real time according to the second encrypted information after the frame.
  • the receiving end device may know that the M second encrypted data frames and the second encrypted overhead frames after the third encrypted overhead frame are a new encryption period.
  • the sender device may also construct an initial encryption overhead frame and send it to the receiver device.
  • the authentication information in the initial encrypted overhead frame may be generated based on invalid data, for example, the authentication information is all 0 bits or a certain pattern.
  • the sending end device may also encrypt and send data of other services at the same time. Since different services have different degrees of sensitivity to delay, different encryption periods can be used for encryption for different service types. For example, the sending end device encrypts K second data frames to obtain K third encrypted data frames. The second data frame is used to carry data of the second service, K is an integer greater than or equal to 1, and K is different from N. Afterwards, the sending end device performs authentication processing on the third encrypted information and the K third encrypted data frames to obtain third authentication information. Further, the sending end device generates a fourth encrypted overhead frame for carrying the third encrypted information and the third authentication information, and sends K third encrypted data frames and fourth encrypted overhead frames.
  • the implementation manner in which the encryption period is K is similar to the implementation manner in which the encryption period is N.
  • the encrypted first service and the second service may be mixed and mapped to the payload area of the OPUk frame for transmission. It should be noted that, if different types of services have the same degree of sensitivity to delay, the same encryption period may also be used for encryption for different service types.
  • the encryption period can be flexibly set according to the type of service.
  • an encryption overhead frame may be inserted.
  • the encryption overhead frame is dedicated to carrying encryption information and authentication information. That is, the N data frames and one encryption overhead frame constitute an encryption block. Since the value of N can be changed according to the type of the service and is not a fixed value, it is convenient to meet the transmission requirements of various types of services.
  • the present application constructs an encryption overhead frame specially used to carry encryption information and authentication information, without adding encryption information and authentication information in each data frame, and the implementation is more flexible.
  • FIG. 5 is a schematic diagram of a second embodiment of a method for transmitting encrypted data in an embodiment of the present application.
  • the transmission method of encrypted data includes the following steps.
  • step 501 is similar to step 101 in the above-mentioned embodiment shown in FIG. 1 , and details are not repeated here.
  • the difference is that the value of N should be greater than 1, that is, the sender device needs to encrypt multiple data frames each time.
  • the transmitting end device does not need to construct a first encryption overhead frame specially used to carry the first encryption information and the first authentication information.
  • the first encrypted information and the first authentication information are carried through N first encrypted data frames.
  • at least one of the N first encrypted data frames includes a first field, where the first field is used to carry the first encryption information and the first authentication information.
  • the first implementation is a first implementation:
  • At least one bit may be reserved in a fixed position of the overhead area in each first encrypted data frame, and the first encrypted information and the first authentication information may be carried by all reserved bits in the N first encrypted data frames.
  • a space of 1 bit for the overhead field may be reserved in each OSU frame. If 256 OSU frames are used as an encryption period, the first encryption information and the first authentication information can be carried by the reserved 256 bits.
  • the following table 1 provides a possible allocation method, and in practical applications, it can also be flexibly allocated according to other methods, which is not specifically limited here.
  • Ordering of OSU Frames information carried Frames 1 to 128 AT Frames 129 to 192 FN Frames 193 to 194 KI Frames 195 to 200 CST Frames 201 to 208 KCC Frames 209 to 216 N Frames 217 to 256 reserve
  • Figure 6(a) is a first schematic diagram of carrying encrypted information and authentication information through an encrypted data frame.
  • the first encrypted data frame among the N first encrypted data frames may carry the first encrypted information and the first authentication information.
  • the first encryption information and the first authentication information are located in the start field of the payload area in the start encrypted data frame.
  • Figure 6(b) is a second schematic diagram of carrying encrypted information and authentication information through an encrypted data frame.
  • the first encrypted data frame in the N first encrypted data frames may carry the first encryption information
  • the last encrypted data frame in the N first encrypted data frames may carry the first authentication information .
  • the first encryption information is located in the start field of the payload area in the start encrypted data frame
  • the first authentication information is located in the end field of the payload area in the last encrypted data frame.
  • FIG. 6(c) is a third schematic diagram of carrying encrypted information and authentication information through an encrypted data frame. As shown in FIG. 6( c ), one subfield may be reserved in each first encrypted data frame, and N subfields may be used to carry the first encryption information and the first authentication information. Wherein, the subfield in each first encrypted data frame is located at the start field of its payload area.
  • the value of the above encryption period N is not fixed.
  • the size of the encryption period N can also be changed as the service is sensitive to time delay.
  • different encryption periods N can be used for different services.
  • FIG. 7 is a schematic diagram of a third embodiment of a method for transmitting encrypted data in an embodiment of the present application.
  • the transmission method of encrypted data includes the following steps.
  • step 702. Match the first authentication information sent by the sending end device, and determine whether the matching is successful, and if yes, perform step 703.
  • the receiving end device may parse out the first encryption information and the first authentication information from the first encryption overhead frame. In addition, the receiving end device will also perform authentication processing on the received first encrypted information and the N first encrypted data frames to obtain authentication information. Further, the receiving end device matches the locally generated authentication information with the received first authentication information, and if the matching is successful, it means that the authentication is passed.
  • the receiving end device determines that the first authentication information is successfully matched, it can then decrypt the N first encrypted data frames according to the first encryption information to obtain N first data frames before encryption. It should be noted that if the receiving end device parses the updated encrypted information (for example, the N value in the encrypted information changes) and the unupdated authentication information in a certain encryption cycle, it can know that the encryption cycle will change in the future. . Specifically, it can be changed from any encryption period after the current encryption period. For example, the change may start in the first encryption period after the current encryption period, or the change may also start in the fifth encryption period after the current encryption period, which is not specifically limited here.
  • the receiving end device still uses the unupdated encryption information for decryption for the current encryption period, and uses the updated encryption information for decryption for the updated encryption period. It should be understood that no matter how the encryption period changes, the processing methods of the receiving end device according to the encryption information and the authentication information are similar. For details, please refer to the description of step 701 to step 703 .
  • FIG. 7 is an embodiment of a receiving end device corresponding to the above-mentioned embodiment shown in FIG. 1 .
  • the processing flow of the receiving end device is similar to steps 701 to 703 in the above embodiment shown in FIG. 7 , and details are not repeated here.
  • the method for transmitting encrypted data provided by the present application is described above.
  • the sending end device and the receiving end device provided by this application are described below.
  • FIG. 8 is a schematic structural diagram of a possible transmitting end device.
  • the sending end device includes a processor 801 , a memory 802 and a transceiver 803 .
  • the processor 801, the memory 802 and the transceiver 803 are interconnected by wires.
  • the memory 802 is used for storing program instructions and data.
  • the processor 801 is configured to perform the operations of steps 101 to 103 in the above embodiment shown in FIG. 1
  • the transceiver 803 is configured to perform the operations of step 104 in the above embodiment shown in FIG. 1 .
  • the processor 801 is configured to perform the operations of step 501 and step 502 in the above-mentioned embodiment shown in FIG. 5
  • the transceiver 803 is configured to perform the operation of step 503 in the above-mentioned embodiment shown in FIG. 5 . .
  • FIG. 9 is a schematic structural diagram of a possible receiving end device.
  • the receiving end device includes a processor 901 , a memory 902 and a transceiver 903 .
  • the processor 901, the memory 902 and the transceiver 903 are interconnected by wires.
  • the memory 902 is used for storing program instructions and data.
  • the processor 901 is configured to perform the operations of step 702 and step 703 in the above-mentioned embodiment shown in FIG. 7
  • the transceiver 903 is configured to perform the operation of step 701 in the above-mentioned embodiment shown in FIG. 7 .
  • the processors shown in FIG. 8 and FIG. 9 above may adopt a general-purpose central processing unit (Central Processing Unit, CPU), a general-purpose processor, a digital signal processor (digital signal processor, DSP), a dedicated integrated Circuit (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • the memories shown in Figures 8 and 9 above may store operating systems and other applications.
  • program codes for implementing the technical solutions provided by the embodiments of the present application are stored in a memory and executed by a processor.
  • a memory may be included within the processor.
  • the processor and memory are two separate structures.
  • FIG. 10 is a schematic structural diagram of a communication system provided by this application.
  • the communication system includes a transmitter device 1001 and a receiver device 1002 .
  • the sending end device 1001 is configured to execute part or all of the steps of any one of the methods in the above-mentioned embodiments shown in FIG. 1 and FIG. 5 .
  • the receiving end device 1002 is configured to execute part or all of the steps of any one of the methods in the foregoing embodiment shown in FIG. 7 .
  • the embodiments of the present application also provide a digital processing chip.
  • the digital processing chip can be applied to the above-mentioned sending end device, and can also be applied to the above-mentioned receiving end device.
  • the digital processing chip integrates circuits and one or more interfaces for realizing the functions of the above-mentioned processor.
  • the digital processing chip can perform the method steps of any one or more of the foregoing embodiments.
  • no memory is integrated in the digital processing chip, it can be connected with an external memory through an interface.
  • the digital processing chip implements the actions performed by the optical transmission device in the above embodiments according to the program codes stored in the external memory.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state drives), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种加密数据的传输方法及相关设备，构造了一个专门用于承载加密信息和认证信息的加密开销帧，无需在每个数据帧中添加加密信息和认证信息，实现方式更灵活。申请实施例方法包括：发送端设备根据第一加密信息对N个第一数据帧进行加密得到N个第一加密数据帧。其中，N为大于或等于1的整数，每个第一数据帧用于承载第一业务的数据。之后，发送端设备对第一加密信息和N个第一加密数据帧进行认证处理得到第一认证信息。接下来，发送端设备生成第一加密开销帧。其中，第一加密开销帧用于承载第一加密信息和第一认证信息。进而，发送端设备发送N个第一加密数据帧和第一加密开销帧。

Description

一种加密数据的传输方法及相关设备
本申请要求于2021年4月16日提交中国国家知识产权局、申请号202110412944.X、申请名称为“一种加密数据的传输方法及相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及光传送领域，尤其涉及一种加密数据的传输方法及相关设备。
背景技术
随着光传送网络(Optical Transport Network，OTN)的发展，业务传送的安全性也越来越得到重视，加密正成为OTN技术需要考虑的技术特性。目前已有的主要是针对灵活光传送网(Flexible Optical Transport Network，FlexO)帧的加密技术。
具体地，将一个FlexO帧作为一个加密周期。对FlexO帧中净荷区的数据进行加密，加密后的数据仍放置在FlexO帧的净荷区。加密信息和认证信息放置在FlexO帧的开销区。然而，基于FlexO帧的固定周期进行加密的方式需要在每个FlexO帧中添加加密信息和认证信息，这种实现方式的灵活性较差，难以适用于各种类型业务的传送需求。
发明内容
第一方面，本申请提供了一种加密数据的传输方法。该方法由发送端设备执行。首先，根据第一加密信息对N个第一数据帧进行加密得到N个第一加密数据帧。其中，每个第一数据帧用于承载第一业务的数据，N为大于或等于1的整数。之后，对第一加密信息和N个第一加密数据帧进行认证处理得到第一认证信息。接下来，生成用于承载第一加密信息和第一认证信息的第一加密开销帧。进而，发送N个第一加密数据帧和第一加密开销帧。通过上述方式，构造了一个专门用于承载加密信息和认证信息的加密开销帧，无需在每个数据帧中添加加密信息和认证信息，实现方式更灵活。
在一些可能的实施方式中，发送N个第一加密数据帧和第一加密开销帧之后，方法还包括：根据第二加密信息对M个第一数据帧进行加密得到M个第二加密数据帧。M为大于或等于1的整数，M与N不同。对第二加密信息和M个第二加密数据帧进行认证处理得到第二认证信息。生成用于承载第二加密信息和第二认证信息的第二加密开销帧。发送M个第二加密数据帧和第二加密开销帧。通过上述方式，对于同一种业务来说，加密周期的大小也是会发生变化的。也就是说，根据当前的实际需求，N的取值是可以变化的，进一步提高了本方案的灵活性。
在一些可能的实施方式中，发送N个第一加密数据帧和第一加密开销帧之后，根据第二加密信息对M个第一数据帧进行加密得到M个第二加密数据帧之前，方法还包括：生成用于承载第二加密信息和第一认证信息第三加密开销帧。发送N个第一数据帧和第三加密开销帧。 应理解，在从加密周期N变为加密周期M之间会有一个临界的加密周期。在该临界的加密周期中的加密开销帧既不同于上述的第一加密开销帧，也不同于上述的第二加密开销帧。具体地，该临界的加密周期仍然属于加密周期N，但是在N个第一加密数据帧之后需要插入一个第三加密开销帧。也就是说，加密周期从N变化到M之前，需要提前将第二加密信息发送至接收端设备，以通知接收端设备加密周期要从N变化到M，便于接收端设备收到第二加密数据帧后可以实时根据第二加密信息进行解密。
在一些可能的实施方式中，方法还包括：根据第三加密信息对K个第二数据帧进行加密得到K个第三加密数据帧。其中，第二数据帧用于承载第二业务的数据，K为大于或等于1的整数，并且K与N不同。之后，对第三加密信息和K个第三加密数据帧进行认证处理得到第三认证信息。进而，生成用于承载第三加密信息和第三认证信息的第四加密开销帧，并发送K个第三加密数据帧和第四加密开销帧。也就是说，发送端设备除了对第一业务的数据进行加密发送外，还可以同时对其他业务的数据进行加密发送。由于不同业务对时延的敏感程度不同，因此针对不同的业务类型，可以采用不同加密周期进行加密，增强了本方案的扩展性。
在一些可能的实施方式中，第一加密信息和第一认证信息位于第一加密开销帧的净荷区。由于第一加密开销帧中净荷区的空间更大且不用承载业务数据，更便于携带第一加密信息和第一认证信息。
在一些可能的实施方式中，第一数据帧与第一加密开销帧的大小相同。即第一加密开销帧可以采用与第一数据帧相同的帧结构，便于统一标准。
在一些可能的实施方式中，第一加密信息包括但不限于帧计数(Frame Number，FN)、秘钥指示(Key Index，KI)、加密套件类型(Cipher Suite Type，CST)、秘钥交互通信通道(Key exchange Communication Channel，KCC)、第一加密开销帧的类型以及加密周期N等。第一认证信息包括但不限于认证标签(Authentication Tag，AT)。本申请提供了第一加密信息和第一认证信息所包含的具体内容，提高了方案的实用性。
在一些可能的实施方式中，根据第一加密信息对N个第一数据帧进行加密得到N个第一加密数据帧包括：根据第一加密信息对N个第一数据帧中的净荷进行加密得到N个第一加密数据帧。或者，根据第一加密信息对N个第一数据帧中的净荷和开销进行加密得到N个第一加密数据帧。在该实施方式中，对数据帧进行加密并不限于对净荷数据进行加密，还可以连同部分或全部开销进行加密，丰富了本方案的实施方式。
在一些可能的实施方式中，第一数据帧为光业务单元(Optical Service Unit，OSU)帧，主要应用于小颗粒业务的传输场景中。
第一方面，本申请提供了一种加密数据的传输方法。该方法由发送端设备执行。首先，根据第一加密信息对N个数据帧进行加密得到N个第一加密数据帧。N为大于1的整数。之后，对第一加密信息和N个第一加密数据帧进行认证处理得到第一认证信息。其中，N个第一加密数据帧中的至少一个第一加密数据帧包括第一字段，第一字段用于承载第一加密信息和第一认证信息。进而，发送N个第一加密数据帧。通过上述方式，可以对多个数据帧进行加密，并将加密后的多个加密数据帧作为一个整体来携带第一加密信息和第一认证信息，无需在每个数据帧中添加加密信息和认证信息，实现方式更灵活。
在一些可能的实施方式中，发送N个第一加密数据帧之后，方法还包括：根据第二加密信息对M个数据帧进行加密得到M个第二加密数据帧。M为大于或等于1的整数，M与N不同。对第二加密信息和M个第二加密数据帧进行认证处理得到第二认证信息。其中，M个第二加密数据帧中的至少一个第二加密数据帧包括第二字段，第二字段用于承载第二加密信息和第二认证信息。发送M个第二加密数据帧。通过上述方式，可以根据实际需求灵活地配置加密周期的大小，进一步提高了本方案的灵活性。
在一些可能的实施方式中，可以在N个第一加密数据帧中的起始加密数据帧携带第一加密信息和第一认证信息。其中，第一加密信息和第一认证信息位于该起始加密数据帧中净荷区的起始字段。
在一些可能的实施方式中，可以在N个第一加密数据帧中的起始加密数据帧携带第一加密信息，在N个第一加密数据帧中的末尾加密数据帧携带第一认证信息。其中，第一加密信息位于该起始加密数据帧中净荷区的起始字段，第一认证信息位于该末尾加密数据帧中净荷区的末尾字段。
在一些可能的实施方式中，可以在每个第一加密数据帧中预留一个子字段，通过N个子字段来携带第一加密信息和第一认证信息。其中，每个第一加密数据帧中的子字段位于其净荷区的起始字段。
在一些可能的实施方式中，可以在每个第一加密数据帧中开销区的固定位置预留至少一个比特位，进而通过N个第一加密数据帧中所有预留的比特位来承载第一加密信息和第一认证信息。
第三方面，本申请提供了一种加密数据的传输方法。该方法由接收端设备执行。首先，接收发送端设备发送的N个第一加密数据帧和第一加密开销帧。其中，N个第一加密数据帧由发送端设备根据第一加密信息对N个第一数据帧进行加密得到。N为大于或等于1的整数，每个第一数据帧用于承载第一业务的数据。第一加密开销帧用于承载第一加密信息和第一认证信息，第一认证信息由发送端设备对第一加密信息和N个第一加密数据帧进行认证处理得到。之后，对接收到第一加密信息和N个第一加密数据帧进行认证处理得到认证信息。进而，对本地生成的认证信息与接收到的第一认证信息进行匹配。若第一认证信息匹配成功，则根据第一加密信息对N个第一加密数据帧进行解密得到N个第一数据帧。
在一些可能的实施方式中，接收发送端设备发送的N个第一加密数据帧和第一加密开销帧之后，方法还包括：接收发送端设备发送的M个第二加密数据帧和第二加密开销帧。M个第二加密数据帧由发送端设备根据第二加密信息对M个第一数据帧进行加密得到。M为大于或等于1的整数，M与N不同。第二加密开销帧用于承载第二加密信息和第二认证信息。第二认证信息由发送端设备对第二加密信息和M个第二加密数据帧进行认证处理得到。若第二认证信息匹配成功，则根据第二加密信息对M个第二加密数据帧进行解密得到M个第一数据帧。
在一些可能的实施方式中，接收发送端设备发送的N个第一加密数据帧和第一加密开销帧之后，接收发送端设备发送的M个第二加密数据帧和第二加密开销帧之前，方法还包括：接收第三加密开销帧，第三加密开销帧用于承载第二加密信息和第一认证信息。
第四方面，本申请实施例提供了一种发送端设备。发送端设备包括：处理器、存储器以 及收发器。其中，该处理器、该存储器以及该收发器通过线路互相连接，该处理器调用该存储器中的程序代码用于执行上述第一方面和第二方面中任一实施方式所示的加密数据的传输方法。
第五方面，本申请实施例提供了一种接收端设备。接收端包括：处理器、存储器以及收发器。其中，该处理器、该存储器以及该收发器通过线路互相连接，该处理器调用该存储器中的程序代码用于执行上述第三方面中任一实施方式所示的加密数据的传输方法。
第六方面，本申请实施例提供了一种通信系统，包括上述第四方面所示的发送端设备和上述第五方面所示的接收端设备。
第七方面，本发明实施例提供了一种数字处理芯片。数字处理芯片包括处理器和存储器，存储器和处理器通过线路相互连接。存储器中存储有指令，处理器用于执行如上述第一方面至第三方面任一实施方式所示的加密数据的传输方法。
第八方面，本申请实施例提供了一种计算机可读存储介质，计算机可读存储介质存储有计算机程序，其中，计算机程序被硬件执行时能够实现上述第一方面至第三方面中的任意一种方法的部分或全部步骤。
本申请实施例中，可以根据业务的类型灵活地设置加密周期。具体地，在对N个数据帧中的数据加密后，可以插入一个加密开销帧。该加密开销帧专用于承载加密信息和认证信息。也就是说，这N个数据帧和一个加密开销帧构成一个加密块。由于N的取值是可以根据业务的类型而变化的，并不是固定值，便于满足各种类型业务的传送需求。此外，本申请构造了一个专门用于承载加密信息和认证信息的加密开销帧，无需在每个数据帧中添加加密信息和认证信息，实现方式更灵活。
附图说明
图1为本申请实施例中加密数据的传输方法的第一个实施例示意图；
图2为本申请实施例中OSU帧的一种结构示意图；
图3为本申请实施例中加密开销帧的一种结构示意图；
图4为本申请实施例中加密周期从N变化到M的示意图；
图5为本申请实施例中加密数据的传输方法的第二个实施例示意图；
图6(a)为通过加密数据帧携带加密信息和认证信息的第一种示意图；
图6(b)为通过加密数据帧携带加密信息和认证信息的第二种示意图；
图6(c)为通过加密数据帧携带加密信息和认证信息的第三种示意图；
图7为本申请实施例中加密数据的传输方法的第三个实施例示意图；
图8为一种可能的发送端设备的结构示意图；
图9为一种可能的接收端设备的结构示意图；
图10为本申请提供的一种通信系统的结构示意图。
具体实施方式
本申请实施例提供了一种加密数据的传输方法及相关设备。本申请构造了一个专门用于 承载加密信息和认证信息的加密开销帧，无需在每个数据帧中添加加密信息和认证信息，实现方式更灵活。需要说明的是，本申请说明书和权利要求书及上述附图中的术语“第一”和“第二”等用于区别类似的对象，而非限定特定的顺序或先后次序。应该理解，上述术语在适当情况下可以互换，以便在本申请描述的实施例能够以除了在本申请描述的内容以外的顺序实施。此外，术语“包括”以及其任何变形，意图在于覆盖不排他的包含。例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请主要应用于OTN中的数据加密场景。发送端设备根据预设的加密信息对待发送的数据帧进行加密得到加密数据帧。之后，发送端设备还将对加密信息和加密数据帧进行认证处理得到认证信息。进而，发送端设备需要将加密数据帧、加密信息以及认证信息都发送至接收端设备。接收端设备首先对接收到的加密数据帧和预设的加密信息进行认证处理得到认证信息。之后，接收端设备将本地生成的认证信息与接收到的认证信息进行匹配。如果匹配成功，则接收端设备进一步根据加密信息对加密数据帧进行解密以得到原始的数据帧。
通过上述描述可知，发送端设备除了向接收端设备发送加密数据帧，还需要通过一定的方式将加密信息和认证信息发送至接收端设备。以FlexO帧为例，目前的一种方式是将一个FlexO帧作为一个加密周期。将加密信息和认证信息放置在FlexO帧的开销区，随FlexO帧一起传输。但是，基于FlexO帧的固定周期进行加密的方式需要在每个FlexO帧中添加加密信息和认证信息，这种实现方式的灵活性较差。例如，根据业务类型的不同，有些业务对时延敏感，还有些业务对时延不敏感。对于那些时延相对不敏感的业务，没必要以每个数据帧为固定周期进行加密，以多个数据帧为周期进行加密更合适，可以降低实现的代价。为此，本申请提供了一种加密数据的传输方法，实现方式更灵活，适用于各种类型业务的传送需求。
应理解，上述发送端设备和接收端设备是基于数据流向来定义的，并不是对其功能的限定。发送端设备也具有接收数据的功能，接收端设备也具有发送数据的功能。为了便于描述，下面统一用发送端设备作为对数据加密的一端，用接收端设备作为对数据解密的一端。
图1为本申请实施例中加密数据的传输方法的第一个实施例示意图。在该示例中，加密数据的传输方法包括如下步骤。
101、根据第一加密信息对N个第一数据帧进行加密得到N个第一加密数据帧。
本实施例中，发送端设备和接收端设备可以预先约定好需要使用的加密信息。具体地，发送端设备根据约定好的第一加密信息对N个第一数据帧进行加密得到N个第一加密数据帧。其中，N为大于或等于1的整数。每个第一数据帧用于承载第一业务的数据。需要说明的是，本申请所采用的第一数据帧可以是OSU帧、光净荷单元k(Optical Payload Unit k，OPUk)帧、光数据单元k(Optical Data Unit k，ODUk)帧或光传输单元k(Optical Transport Unit k，OTUk)帧等OTN帧。应理解，OSU帧还可以有其他的命名方式，例如，还可以称之为灵活光业务单元(Flexible Optical Service Unit，OSUflex)帧，具体此处不做限定。下面主要以承载小颗粒业务的OSU帧为例进行介绍。
图2为本申请实施例中OSU帧的一种结构示意图。如图2所示，该OSU帧包括开销区和净荷区。净荷区用于承载业务数据。开销区包括通用开销、映射开销和8比特循环冗余校验(Cyclic Redundancy Check–8bits，CRC8)。其中，通用开销进一步可以细分为版本号、 支路端口号(Tributary Port Number，TPN)、连续性校验、帧类型(Frame Type，FT)、保留开销、串联连接监视1(Tandem Connection Monitoring，TCM)、串联连接监视2和路径监视(Path Monitoring，PM)。映射开销包括映射客户业务到OSU净荷区时生成的映射信息，例如，用于指示OSU净荷区映射的客户业务数据量和客户业务时钟信息等。应理解，上述图2所示OSU帧中开销区的格式只是一个示例，在实际应用中还可以有其他的格式，具体此处不做限定。
可选地，发送端设备可以只对OSU帧的净荷数据进行加密。或者，发送端设备也可以对OSU帧的净荷数据以及全部或部分开销进行加密，例如，发送端设备对OSU帧的净荷数据和映射开销进行加密。
需要说明的是，上述的加密信息包括但不限于FN、KI、CST、KCC、第一加密开销帧的类型以及加密周期N等。其中，加密周期N就表示发送端设备以N个第一数据帧为一个周期进行加密。
102、对第一加密信息和N个第一加密数据帧进行认证处理得到第一认证信息。
发送端设备对N个第一数据帧进行加密得到N个第一加密数据帧后，将进一步对第一加密信息和N个第一加密数据帧进行认证处理得到第一认证信息。具体地，发送端设备可以对N个第一加密数据帧和第一加密信息中的全部信息进行认证处理。或者，发送端设备也可以对N个第一加密数据帧和第一加密信息中的部分信息进行认证处理，例如，第一加密信息中的部分信息可以是除了KCC之外的其他加密信息。需要说明的是，第一认证信息包括但不限于AT。
103、生成第一加密开销帧。
本实施例中，发送端设备需要在N个第一加密数据帧后插入一个第一加密开销帧。该第一加密开销帧用于承载第一加密信息和第一认证信息。其中，N个第一加密数据帧与一个第一加密开销帧可以称之为一个加密块。应理解，加密开销帧还可以有其他的命名方式，例如，还可以称之为开销加密帧等，具体此处不做限定。在一种可能的实施方式中，该第一加密开销帧与第一加密数据帧的大小相同。也就是说，第一加密开销帧可以采用与第一加密数据帧相同的帧格式，只是第一加密开销帧专门用于承载第一加密信息和第一认证信息。
优选地，可以将第一加密信息和第一认证信息都放置在第一加密开销帧的净荷区。除此之外，也可以将第一加密信息和第一认证信息都放置在第一加密开销帧的开销区。又或者，第一加密信息和第一认证信息可以拆分开分别放置在第一加密开销帧的净荷区和开销区，具体按照什么方式进行拆分，具体此处不做限定。下面仍以OSU帧的结构为例对第一加密开销帧进行介绍。
图3为本申请实施例中加密开销帧的一种结构示意图。如图3所示，第一加密信息中第一加密开销帧的类型可以通过帧类型(Frame Type，FT)来指示，或者，也可以通过操作管理维护-帧类型(Operation Administration and Maintenance-Frame Type，OAM-FT)来指示。第一加密信息中的加密周期N也放置在第一加密开销帧的开销区。第一加密信息中的其他信息以及第一认证信息可以放置在第一加密开销帧的净荷区。应理解，上述图3所示的第一加密开销帧只是一个示例，在实际应用中还可以有其他的方式在第一加密开销帧中放置第一加密信息和第一认证信息，具体此处不做限定。
104、发送N个第一加密数据帧和第一加密开销帧。
在发送端设备生成第一加密开销帧之后，发送端设备将N个第一加密数据帧和第一加密开销帧发送至接收端设备。应理解，以第一加密数据帧是OSU帧为例，发送端设备可以将N个第一加密数据帧和第一加密开销帧映射到OPUk帧的净荷区。其中，每个第一加密数据帧或第一加密开销帧占用一个OPUk帧中的净荷块。进而，发送端设备还可以将OPUk帧映射到OTUk帧或者FlexO帧等速率更高的容器中进行发送。
需要说明的是，对于当前传输的第一业务来说，该第一业务对时延的敏感程度可能会随着时间发生变化，因此加密周期N的取值也可能会随着发生变化。例如，在当前加密周期N的时段，第一业务为低时延业务，N的取值较小，在第一加密数据帧中插入第一加密开销帧的频率较高。接下来第一业务可能会变为普通时延的业务，N的取值会变大，在第一加密数据帧中插入第一加密开销帧的频率变低。也就是说，低时延业务对应的加密周期较短，普通时延业务对应的加密周期较长。下面以加密周期从N变成M为例对本方案进行进一步介绍。
具体地，发送端设备根据第二加密信息对M个第一数据帧进行加密得到M个第二加密数据帧，其中，M为大于或等于1的整数，且M与N不同。之后，发送端设备对第二加密信息和M个第二加密数据帧进行认证处理得到第二认证信息。接下来，发送端设备生成用于承载第二加密信息和第二认证信息的第二加密开销帧。进而，发送端设备向接收端设备发送M个第二加密数据帧和第二加密开销帧。应理解，加密周期为M的实现方式与上述加密周期为N的实现方式类似，具体可以参照上述步骤101-步骤104的相关描述，此处不再展开介绍。
图4为本申请实施例中加密周期从N变化到M的示意图。如图4所示，加密周期N按照1：1的比例插入第一加密开销帧，加密周期M按照3：1的比例插入第二加密开销帧。在从加密周期N变为加密周期M之间会有一个临界的加密周期。在该临界的加密周期中的加密开销帧既不同于上述的第一加密开销帧，也不同于上述的第二加密开销帧。具体地，该临界的加密周期仍然属于加密周期N，但是在N个第一加密数据帧之后需要插入一个第三加密开销帧。该第三加密开销帧用于承载第二加密信息和第一认证信息。也就是说，加密周期从N变化到M之前，需要提前将第二加密信息发送至接收端设备，以通知接收端设备加密周期要从N变化到M，便于接收端设备收到第二加密数据帧后可以实时根据第二加密信息进行解密。接收端设备就可以知道该第三加密开销帧之后的M个第二加密数据帧和第二加密开销帧为一个新的加密周期。同理，在加密周期N正式开始之前的初始化阶段，发送端设备也可以先构造一个初始的加密开销帧发送至接收端设备。该初始的加密开销帧中的认证信息可以基于无效数据生成，例如认证信息全是0比特或是某种特定图案等。
需要说明的是，发送端设备除了对第一业务的数据进行加密发送外，还可以同时对其他业务的数据进行加密发送。由于不同业务对时延的敏感程度不同，因此针对不同的业务类型，可以采用不同加密周期进行加密。例如，发送端设备对K个第二数据帧进行加密得到K个第三加密数据帧。其中，第二数据帧用于承载第二业务的数据，K为大于或等于1的整数，并且K与N不同。之后，发送端设备对第三加密信息和K个第三加密数据帧进行认证处理得到第三认证信息。进而，发送端设备生成用于承载第三加密信息和第三认证信息的第四加密开销帧，并发送K个第三加密数据帧和第四加密开销帧。应理解，加密周期为K的实现方式与上述加密周期为N的实现方式类似，具体可以参照上述步骤101-步骤104的相关描述，此处 不再展开介绍。进一步，加密后的第一业务和第二业务，可以混合映射到OPUk帧的净荷区进行发送。需要说明的是，如果不同类型的业务对时延的敏感程度相同，针对不同的业务类型，也可以采用相同的加密周期进行加密。
本申请实施例中，可以根据业务的类型灵活地设置加密周期。具体地，在对N个数据帧中的数据加密后，可以插入一个加密开销帧。该加密开销帧专用于承载加密信息和认证信息。也就是说，这N个数据帧和一个加密开销帧构成一个加密块。由于N的取值是可以根据业务的类型而变化的，并不是固定值，便于满足各种类型业务的传送需求。此外，本申请构造了一个专门用于承载加密信息和认证信息的加密开销帧，无需在每个数据帧中添加加密信息和认证信息，实现方式更灵活。
下面对本申请提供的另一种加密数据的传输方法进行介绍。图5为本申请实施例中加密数据的传输方法的第二个实施例示意图。在该示例中，加密数据的传输方法包括如下步骤。
501、根据第一加密信息对N个数据帧进行加密得到N个第一加密数据帧。
本实施例中，步骤501与上述图1所示实施例中的步骤101类似，具体此处不再赘述。其中的区别在于，N的取值应当大于1，即发送端设备每次需要对多个数据帧进行加密。
502、对第一加密信息和N个第一加密数据帧进行认证处理得到第一认证信息。
不同于上述图1所示的实施例，本实施例中发送端设备不需要构造专门用于承载第一加密信息和第一认证信息的第一加密开销帧。而是通过N个第一加密数据帧来携带第一加密信息和第一认证信息。具体地，N个第一加密数据帧中地至少一个第一加密数据帧包括第一字段，该第一字段用于承载第一加密信息和第一认证信息。下面介绍几种可能的实施方式，应理解，在实际应用中采用的实施方式包括但不限于以下列举的几种。
第一种实施方式：
可以在每个第一加密数据帧中开销区的固定位置预留至少一个比特位，进而通过N个第一加密数据帧中所有预留的比特位来承载第一加密信息和第一认证信息。以上述图2所示的OSU帧为例，可以在每个OSU帧中保留开销字段预留1比特的空间。如果以256个OSU帧为一个加密周期，那么就可以通过预留的256个比特位来承载第一加密信息和第一认证信息。下表1提供了一种可能的分配方式，在实际应用中也可以按照其他的方式来灵活分配，具体此处不做限定。
表1
OSU帧的排序 承载的信息
第1到128帧 AT
第129到192帧 FN
第193到194帧 KI
第195到200帧 CST
第201到208帧 KCC
第209到216帧 N
第217到256帧 保留
第二种实施方式：
图6(a)为通过加密数据帧携带加密信息和认证信息的第一种示意图。如图6(a)所示，可以在N个第一加密数据帧中的起始加密数据帧携带第一加密信息和第一认证信息。其中，第一加密信息和第一认证信息位于该起始加密数据帧中净荷区的起始字段。
第三种实施方式：
图6(b)为通过加密数据帧携带加密信息和认证信息的第二种示意图。如图6(b)所示，可以在N个第一加密数据帧中的起始加密数据帧携带第一加密信息，在N个第一加密数据帧中的末尾加密数据帧携带第一认证信息。其中，第一加密信息位于该起始加密数据帧中净荷区的起始字段，第一认证信息位于该末尾加密数据帧中净荷区的末尾字段。
第四种实施方式：
图6(c)为通过加密数据帧携带加密信息和认证信息的第三种示意图。如图6(c)所示，可以在每个第一加密数据帧中预留一个子字段，通过N个子字段来携带第一加密信息和第一认证信息。其中，每个第一加密数据帧中的子字段位于其净荷区的起始字段。
需要说明的是，上述加密周期N的取值并非是固定不变的。对于同一业务来说，随着该业务对时延敏感程度的变化，也可以改变加密周期N的大小。对于不同业务来说，由于不同业务对时延敏感程度也不同，那么不同业务可以采用不同的加密周期N。
503、发送N个第一加密数据帧。
上面介绍了发送端设备对加密数据进行传输的方式，下面介绍接收端设备收到加密数据后的处理流程。图7为本申请实施例中加密数据的传输方法的第三个实施例示意图。在该示例中，加密数据的传输方法包括如下步骤。
701、接收发送端设备发送的N个第一加密数据帧和第一加密开销帧。
本实施例中，关于第一加密数据帧和第一加密开销帧的介绍可以参考上述图1所示实施例的相关描述，此处不再赘述。
702、对发送端设备发送的第一认证信息进行匹配，并判断是否匹配成功，若是，则执行步骤703。
接收端设备可以从第一加密开销帧中解析出第一加密信息和第一认证信息。并且，接收端设备还将对接收到的第一加密信息和N个第一加密数据帧进行认证处理得到认证信息。进而，接收端设备对本地生成的认证信息和接收到的第一认证信息进行匹配，如果匹配成功，就说明认证通过了。
703、根据第一加密信息对N个第一加密数据帧进行解密得到N个第一数据帧。
若接收端设备判断第一认证信息匹配成功，进而就可以根据第一加密信息对N个第一加密数据帧进行解密得到加密前的N个第一数据帧。需要说明的是，如果接收端设备在某一个加密周期解析出了更新后的加密信息(例如加密信息中的N值发生变化)和未更新的认证信息，就可以知道之后的加密周期将发生变化。具体可以是从当前加密周期之后的任意一个加密周期开始变化。例如，可以在当前加密周期后的第一个加密周期开始变化，或者，也可以在当前加密周期后的第五个加密周期开始变化，具体此处不做限定。接收端设备对于当前的加密周期仍然采用未更新的加密信息进行解密，对于更新后的加密周期将采用更新后的加密信息进行解密。应理解，无论加密周期如何变化，接收端设备根据加密信息和认证信息的处理方式都是类似的，具体可以参照步骤701-步骤703的描述。
需要说明的是，上述图7所示实施例是与上述图1所示实施例对应的接收端设备的实施例。至于上述图5所示实施例对应的接收端设备的实施例，其接收端设备处理流程与上述图7所示实施例的步骤步骤701-步骤703类似，此处不再赘述。
上面描述了本申请提供的加密数据的传输方法。下面介绍本申请提供的发送端设备和接收端设备。
图8为一种可能的发送端设备的结构示意图。该发送端设备包括处理器801、存储器802和收发器803。该处理器801、存储器802和收发器803通过线路相互连接。其中，存储器802用于存储程序指令和数据。在一种可能的实施方式中，处理器801用于执行上述图1所示实施例中步骤101-步骤103的操作，收发器803用于执行上述图1所示实施例中步骤104的操作。在另一种可能的实施方式中，处理器801用于执行上述图5所示实施例中步骤501和步骤502的操作，收发器803用于执行上述图5所示实施例中步骤503的操作。
图9为一种可能的接收端设备的结构示意图。该接收端设备包括处理器901、存储器902和收发器903。该处理器901、存储器902和收发器903通过线路相互连接。其中，存储器902用于存储程序指令和数据。在一种可能的实施方式中，处理器901用于执行上述图7所示实施例中步骤702和步骤703的操作，收发器903用于执行上述图7所示实施例中步骤701的操作。
需要说明的是，上述图8和图9中所示的处理器可以采用通用的中央处理器(Central Processing Unit，CPU)，通用处理器、数字信号处理器(digital signal processor,DSP)、专用集成电路(application specific integrated circuit,ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。上述图8和图9中所示的存储器可以存储操作系统和其他应用程序。在通过软件或者固件来实现本申请实施例提供的技术方案时，用于实现本申请实施例提供的技术方案的程序代码保存在存储器中，并由处理器来执行。在一实施例中，处理器内部可以包括存储器。在另一实施例中，处理器和存储器是两个独立的结构。
图10为本申请提供的一种通信系统的结构示意图。该通信系统包括发送端设备1001和接收端设备1002。其中，发送端设备1001用于执行上述图1和图5所示实施例中任意一种方法的部分或全部步骤。接收端设备1002用于执行上述图7所示实施例中任意一种方法的部分或全部步骤。
本申请实施例还提供一种数字处理芯片。该数字处理芯片可以应用于上述的发送端设备，也可以应用于上述的接收端设备。该数字处理芯片中集成了用于实现上述处理器的功能的电路和一个或者多个接口。当该数字处理芯片中集成了存储器时，该数字处理芯片可以完成前述实施例中的任一个或多个实施例的方法步骤。当该数字处理芯片中未集成存储器时，可以通过接口与外置的存储器连接。该数字处理芯片根据外置的存储器中存储的程序代码来实现上述实施例中光传输设备执行的动作。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中， 上述提到的存储介质可以是只读存储器，随机接入存储器等。上述的这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
当使用软件实现时，上述实施例描述的方法步骤可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘)等。

Claims (21)

  1. 一种加密数据的传输方法，其特征在于，包括：
    根据第一加密信息对N个第一数据帧进行加密得到N个第一加密数据帧，所述N为大于或等于1的整数，每个所述第一数据帧用于承载第一业务的数据；
    对所述第一加密信息和所述N个第一加密数据帧进行认证处理得到第一认证信息；
    生成第一加密开销帧，所述第一加密开销帧用于承载所述第一加密信息和所述第一认证信息；
    发送所述N个第一加密数据帧和所述第一加密开销帧。
  2. 根据权利要求1所述的方法，其特征在于，发送所述N个第一加密数据帧和所述第一加密开销帧之后，所述方法还包括：
    根据第二加密信息对M个所述第一数据帧进行加密得到M个第二加密数据帧，所述M为大于或等于1的整数，所述M与所述N不同；
    对所述第二加密信息和所述M个第二加密数据帧进行认证处理得到第二认证信息；
    生成第二加密开销帧，所述第二加密开销帧用于承载所述第二加密信息和所述第二认证信息；
    发送所述M个第二加密数据帧和所述第二加密开销帧。
  3. 根据权利要求2所述的方法，其特征在于，发送所述N个第一加密数据帧和所述第一加密开销帧之后，根据第二加密信息对M个所述第一数据帧进行加密得到M个第二加密数据帧之前，所述方法还包括：
    生成第三加密开销帧，所述第三加密开销帧用于承载所述第二加密信息和所述第一认证信息；
    发送所述N个第一加密数据帧和所述第三加密开销帧。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述方法还包括：
    根据第三加密信息对K个第二数据帧进行加密得到K个第三加密数据帧，所述K为大于或等于1的整数，所述K与所述N不同，每个所述第二数据帧用于承载第二业务的数据；
    对所述第三加密信息和所述K个第三加密数据帧进行认证处理得到第三认证信息；
    生成第四加密开销帧，所述第四加密开销帧用于承载所述第三加密信息和所述第三认证信息；
    发送所述K个第三加密数据帧和所述第四加密开销帧。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第一加密信息和所述第一认证信息位于所述第一加密开销帧的净荷区。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一数据帧与第一加密开销帧的大小相同。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一加密信息包括所述第一加密开销帧的类型、帧计数FN、秘钥指示KI、加密套件类型CST、秘钥交互通信通道KCC和所述N的值，所述第一认证信息包括认证标签AT。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，根据第一加密信息对N个第 一数据帧进行加密得到N个第一加密数据帧包括：
    根据所述第一加密信息对所述N个第一数据帧中的净荷进行加密得到所述N个第一加密数据帧；或者，
    根据所述第一加密信息对所述N个第一数据帧中的净荷和开销进行加密得到所述N个第一加密数据帧。
  9. 根据权利要求1至8中任一项所述的方法，其特征在于，所述第一数据帧为光业务单元OSU帧。
  10. 一种加密数据的传输方法，其特征在于，包括：
    根据第一加密信息对N个数据帧进行加密得到N个第一加密数据帧，所述N为大于1的整数；
    对所述第一加密信息和所述N个第一加密数据帧进行认证处理得到第一认证信息，其中，所述N个第一加密数据帧中的至少一个第一加密数据帧包括第一字段，所述第一字段用于承载所述第一加密信息和所述第一认证信息；
    发送所述N个第一加密数据帧。
  11. 根据权利要求10所述的方法，其特征在于，发送所述N个第一加密数据帧之后，所述方法还包括：
    根据第二加密信息对M个所述数据帧进行加密得到M个第二加密数据帧，所述M为大于或等于1的整数，所述M与所述N不同；
    对所述第二加密信息和所述M个第二加密数据帧进行认证处理得到第二认证信息，其中，所述M个第二加密数据帧中的至少一个第二加密数据帧包括第二字段，所述第二字段用于承载所述第二加密信息和所述第二认证信息；
    发送所述M个第二加密数据帧。
  12. 根据权利要求10或11所述的方法，其特征在于，所述N个第一加密数据帧中的目标加密数据帧包括所述第一字段，所述目标加密数据帧位于所述N个第一加密数据帧的起始位置，所述第一字段为所述目标加密数据帧中净荷区的起始字段。
  13. 根据权利要求10或11所述的方法，其特征在于，所述N个第一加密数据帧包括起始加密数据帧和末尾加密数据帧，所述起始加密数据帧位于所述N个第一加密数据帧的起始位置，所述末尾加密数据帧位于所述N个第一加密数据帧的末尾位置，所述目标字段包括加密字段和认证字段，所述加密字段用于承载所述第一加密信息，所述认证字段用于承载所述第一认证信息，所述加密字段为所述起始加密数据帧中净荷区的起始字段，所述认证字段为所述末尾加密数据帧中净荷区的末尾字段。
  14. 根据权利要求10或11所述的方法，其特征在于，所述第一字段包括N个子字段，每个所述第一加密数据帧包括一个所述子字段，每个所述子字段为每个所述第一加密数据帧中净荷区的起始字段，所述N个子字段用于承载所述第一加密信息和所述第一认证信息。
  15. 根据权利要求10或11所述的方法，其特征在于，所述第一字段包括N个子字段，每个所述第一加密数据帧包括一个所述子字段，每个所述子字段为每个所述第一加密数据帧中开销区的字段，所述N个子字段用于承载所述第一加密信息和所述第一认证信息。
  16. 一种加密数据的传输方法，其特征在于，包括：
    接收发送端设备发送的N个第一加密数据帧和第一加密开销帧，所述N个第一加密数据帧由所述发送端设备根据第一加密信息对N个第一数据帧进行加密得到，所述N为大于或等于1的整数，每个所述第一数据帧用于承载第一业务的数据，所述第一加密开销帧用于承载所述第一加密信息和第一认证信息，所述第一认证信息由所述发送端设备对所述第一加密信息和所述N个第一加密数据帧进行认证处理得到；
    若所述第一认证信息匹配成功，则根据所述第一加密信息对所述N个第一加密数据帧进行解密得到所述N个第一数据帧。
  17. 根据权利要求16所述的方法，其特征在于，接收发送端设备发送的N个第一加密数据帧和第一加密开销帧之后，所述方法还包括：
    接收发送端设备发送的M个第二加密数据帧和第二加密开销帧，所述M个第二加密数据帧由所述发送端设备根据第二加密信息对M个第一数据帧进行加密得到，所述M为大于或等于1的整数，所述M与所述N不同，所述第二加密开销帧用于承载所述第二加密信息和第二认证信息，所述第二认证信息由所述发送端设备对所述第二加密信息和所述M个第二加密数据帧进行认证处理得到；
    若所述第二认证信息匹配成功，则根据所述第二加密信息对所述M个第二加密数据帧进行解密得到所述M个第一数据帧。
  18. 根据权利要求17所述的方法，其特征在于，接收发送端设备发送的N个第一加密数据帧和第一加密开销帧之后，接收发送端设备发送的M个第二加密数据帧和第二加密开销帧之前，所述方法还包括：
    接收第三加密开销帧，所述第三加密开销帧用于承载所述第二加密信息和所述第一认证信息。
  19. 一种发送端设备，其特征在于，包括：处理器、存储器以及收发器，所述处理器、所述存储器以及所述收发器通过线路互相连接，所述存储器中存储有指令；
    所述处理器用于通过调用所述存储器中存储的指令执行如权利要求1至15中任一项所述的方法。
  20. 一种接收端设备，其特征在于，包括：处理器、存储器以及收发器，所述处理器、所述存储器以及所述收发器通过线路互相连接，所述存储器中存储有指令；
    所述处理器用于通过调用所述存储器中存储的指令执行如权利要求16至18中任一项所述的方法。
  21. 一种通信系统，其特征在于，包括如权利要求19所述的发送端设备和如权利要求20所述的接收端设备。
PCT/CN2022/071704 2021-04-16 2022-01-13 一种加密数据的传输方法及相关设备 WO2022217993A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22787225.6A EP4311166A1 (en) 2021-04-16 2022-01-13 Transmission method for encrypted data and related device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110412944.XA CN115225296B (zh) 2021-04-16 2021-04-16 一种加密数据的传输方法及相关设备
CN202110412944.X 2021-04-16

Publications (1)

Publication Number Publication Date
WO2022217993A1 true WO2022217993A1 (zh) 2022-10-20

Family

ID=83605591

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/071704 WO2022217993A1 (zh) 2021-04-16 2022-01-13 一种加密数据的传输方法及相关设备

Country Status (3)

Country Link
EP (1) EP4311166A1 (zh)
CN (1) CN115225296B (zh)
WO (1) WO2022217993A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150098569A1 (en) * 2013-10-04 2015-04-09 Texas Instruments Incorporated Power Line Communication (PLC) Network Nodes Using Cipher Then Segment Security
US20160301669A1 (en) * 2015-04-08 2016-10-13 Microsemi Storage Solutions (U.S.), Inc. Method and system for encrypting/decrypting payload content of an otn frame
CN107809759A (zh) * 2016-09-09 2018-03-16 中兴通讯股份有限公司 一种数据传输方法及装置
CN107846685A (zh) * 2017-11-16 2018-03-27 北京小米移动软件有限公司 配置信息的传输方法、装置及系统、存储介质
CN108075883A (zh) * 2016-11-11 2018-05-25 华为技术有限公司 一种加密、解密的方法及设备
CN111435934A (zh) * 2019-01-10 2020-07-21 恩智浦有限公司 用于超宽带测距中的数据帧传输的密钥导出方案

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100715679B1 (ko) * 2005-12-05 2007-05-09 한국전자통신연구원 인증 암호화를 통해 보안 전송을 가능하게 하는 ｇｐｏｎ시스템 및 그 인증 암호화 방법
US8942379B2 (en) * 2012-10-17 2015-01-27 Cisco Technology, Inc. Timeslot encryption in an optical transport network
US10182039B2 (en) * 2016-02-04 2019-01-15 Cisco Technology, Inc. Encrypted and authenticated data frame

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150098569A1 (en) * 2013-10-04 2015-04-09 Texas Instruments Incorporated Power Line Communication (PLC) Network Nodes Using Cipher Then Segment Security
US20160301669A1 (en) * 2015-04-08 2016-10-13 Microsemi Storage Solutions (U.S.), Inc. Method and system for encrypting/decrypting payload content of an otn frame
CN107809759A (zh) * 2016-09-09 2018-03-16 中兴通讯股份有限公司 一种数据传输方法及装置
CN108075883A (zh) * 2016-11-11 2018-05-25 华为技术有限公司 一种加密、解密的方法及设备
CN107846685A (zh) * 2017-11-16 2018-03-27 北京小米移动软件有限公司 配置信息的传输方法、装置及系统、存储介质
CN111435934A (zh) * 2019-01-10 2020-07-21 恩智浦有限公司 用于超宽带测距中的数据帧传输的密钥导出方案

Also Published As

Publication number Publication date
CN115225296A (zh) 2022-10-21
EP4311166A1 (en) 2024-01-24
CN115225296B (zh) 2024-04-12

Similar Documents

Publication Publication Date Title
US8837742B2 (en) Dynamic synchronization of distributed keys for encryption and decryption of network communications
US8379847B2 (en) Data and control encryption
US9344278B2 (en) Secure data transfer using random ordering and random block sizing
US10402172B1 (en) Multi-source entropy and randomness aggregation and distribution network
US20170054697A1 (en) Method and system for efficient encryption, transmission, and decryption of video data
US10826876B1 (en) Obscuring network traffic characteristics
EP3157225A1 (en) Encrypted ccnx
US10937339B2 (en) Digital cryptosystem with re-derivable hybrid keys
US20080279371A1 (en) Methods of encrypting and decrypting data and bus system using the methods
US11201729B2 (en) Devices and methods for enabling portable secure communication using random cipher pad cryptography by enabling communications to be passed to the device from a host, encrypted and/or decrypted, and passed back to the host
CN110620762A (zh) 基于rdma的数据传输方法、网卡、服务器及介质
US10339323B2 (en) Group license encryption and decryption
US20140281536A1 (en) Secured embedded data encryption systems
CN110381046A (zh) 一种gnss数据的加密传输方法
WO2022217993A1 (zh) 一种加密数据的传输方法及相关设备
CN116094789A (zh) 基于动态算法选择的第三方加密云服务系统及其服务方法
CN113169862B (zh) 信息处理方法、终端设备及网络系统
CN111602127B (zh) 数据管理装置、数据管理方法和计算机能读取的存储介质
CN107770018B (zh) 用于串行通信系统的通信方法及设备
JP6697355B2 (ja) 送信機、通信システム、送信方法及びプログラム
CN113038306B (zh) 光网络安全通信方法、装置、电子设备及介质
WO2023077445A1 (zh) 股权激励系统中的数据处理的方法和装置
KR102025619B1 (ko) 대용량 패킷 암호화 장치 및 이를 이용하는 패킷 통신 장치
JP2017060083A (ja) 通信装置および暗号通信方法
CN115412240A (zh) 数据传输方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22787225

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022787225

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022787225

Country of ref document: EP

Effective date: 20231019

NENP Non-entry into the national phase

Ref country code: DE