WO2023029783A1 - 一种数据传输方法、设备、可读存储介质和芯片系统 - Google Patents

一种数据传输方法、设备、可读存储介质和芯片系统 Download PDF

Info

Publication number
WO2023029783A1
WO2023029783A1 PCT/CN2022/106421 CN2022106421W WO2023029783A1 WO 2023029783 A1 WO2023029783 A1 WO 2023029783A1 CN 2022106421 W CN2022106421 W CN 2022106421W WO 2023029783 A1 WO2023029783 A1 WO 2023029783A1
Authority
WO
WIPO (PCT)
Prior art keywords
field
bits
information
encryption parameter
information field
Prior art date
Application number
PCT/CN2022/106421
Other languages
English (en)
French (fr)
Inventor
丁力
孙德胜
毕红军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023029783A1 publication Critical patent/WO2023029783A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/06—Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the communication field, and in particular to a data transmission method, device, readable storage medium and chip system.
  • Encryption is an important means to ensure data security, which can effectively prevent private information from being stolen by attackers.
  • OSI Open System Interconnection Reference Model
  • encryption can be divided into two-layer encryption MAC security protocol (media access control security, MACsec) and so on.
  • the encryption algorithm generally uses the standard Advanced Encryption Standard-Calois/Counter Mode (AES-GCM) algorithm.
  • the present application provides a data transmission method, device, readable storage medium and chip system, so as to achieve the purpose of not occupying user service bandwidth for encryption parameters.
  • the present application provides a data transmission method, and the method may be executed by a device at a sending end, for example, may be executed by a first communication device.
  • the first communication device acquires the first ciphertext data stream, and sends the first ciphertext data stream.
  • the first ciphertext data stream includes the first AM and the encrypted first data segment.
  • the first AM is used for data alignment of the first ciphertext data stream.
  • the first AM includes at least one of a first AM locking information field, a first channel identification information field, or a first verification information field. Wherein, at least one of some of the bits in the first AM lock information field, some of the bits in the first channel identification information field, or some or all of the bits in the first verification information field is used to carry: the first data Encryption parameter information for the segment.
  • This application transmits the encryption parameter information through the bits in the first AM in the data stream.
  • This method can be applied to the physical layer of optical modules or network devices, and the transmitted encryption parameters may not occupy user service bandwidth. Moreover, since this scheme encrypts the bit stream of the physical layer, all bits (including source MAC address and destination MAC address) in a user frame will be encrypted, so security can be improved.
  • the first communication device may acquire N ciphertext data streams, N may be 1, N may also be an integer greater than 1, and the first ciphertext data stream is the N ciphertext data stream One ciphertext data stream.
  • the first communication device may send N channels of ciphertext data streams.
  • the first ciphertext data stream includes at least two first AMs and at least two encrypted first data segments.
  • an encrypted first data segment is included between every two first AMs
  • a first AM is included between every two encrypted first data segments. That is to say, the first AM in the embodiment of the present application may appear periodically in the first ciphertext data stream.
  • the encrypted first data segment also periodically appears in the first ciphertext data stream in flow.
  • each AM cycle includes a first AM and an encrypted first data segment.
  • the first AM lock information field carries encryption parameter information
  • some bits in the first AM lock information field are used to carry encryption parameter information
  • another part of bits are used to carry the first ciphertext data AM lock information for the stream.
  • the encryption parameter information can occupy the bits originally used to carry the AM locking information to carry the encryption parameter information, so as to provide a specific implementation manner for transmitting the encryption parameter through the first AM.
  • the receiving end can cooperate with the matching rule proposed in this application to perform AM locking, so as not to affect the AM locking performance as much as possible.
  • the encryption parameter information can occupy the bits originally used to carry the channel identification information to carry the encryption parameter information, so as to provide a specific implementation manner for transmitting the encryption parameter through the first AM.
  • the encryption parameter information may occupy the bits originally used to carry the verification information to carry the encryption parameter information, thereby providing a specific implementation manner for transmitting the encryption parameter through the first AM.
  • the first ciphertext data stream is obtained according to the first plaintext data stream and encryption parameter information.
  • the first plaintext data stream includes the second AM and the unencrypted first data segment.
  • the second AM is used for data alignment of the first plaintext data stream.
  • the second AM lock information field may be used to carry AM lock information of the first plaintext data stream.
  • the second channel identification information field may be used to carry channel identification information of the first plaintext data stream.
  • the second verification information field may be used to carry verification information.
  • the information carried in the second AM lock information field may be the same as the information carried in the first AM lock information field.
  • the first AM lock information field carries encryption parameter information
  • the first AM lock information field includes the first information and the encryption parameter information
  • the second AM lock information field includes the second information.
  • the bit value corresponding to the second information in the second AM lock information field can be divided into two parts, which can be referred to as the first part bit value and the second part bit value, and the first part bit value is the same as the bit value corresponding to the first information, And the bits of the first part of the bit value in the second AM locking information field are correspondingly the same as the bits of the first information in the first AM locking information field.
  • bits of the second part of the bit value in the second AM lock information field are the same as the bits of the encryption parameter information in the first AM lock information field, but the second part of the bit value is the same as the encryption parameter in the first check field
  • the bit values corresponding to the information are different.
  • the first AM lock information field may replace some bits in the second AM lock information field with part of the encryption parameter information or all after get.
  • the first communication device obtains the first AM locking information field after updating the second part of bit values in the second AM locking information field to encryption parameter information.
  • the first AM lock information field of the first AM can be obtained by replacing part of the content of the second AM lock information field of the second AM in the plaintext data stream.
  • the content carried by the first AM lock information field is a protocol value
  • the receiving end can restore the bits carrying the encryption parameters in the first AM lock information field to the corresponding AM lock information in the second AM lock information field. value, so as to minimize the impact on other data processing processes due to the transmission of encrypted parameter information.
  • the information carried in the second verification information field may be the same as the information carried in the first verification information field.
  • the first verification information field carries encryption parameter information
  • the first verification information field includes the third information and the encryption parameter information
  • the second verification information field includes the fourth information.
  • the bit value corresponding to the fourth information in the second verification information field can be divided into two parts, which can be called the third part bit value and the fourth part bit value, and the third part bit value corresponds to the bit value corresponding to the third information are the same, and the bits of the third part of the bit value in the second verification information field are correspondingly the same as the bits of the third information in the first verification information field.
  • the bits of the fourth part of the bit value in the second verification information field are the same as the bits of the encryption parameter information in the first verification information field, but the fourth part of the bit value is the same as the encryption parameter information in the first verification information field.
  • the bit values corresponding to the parameter information are different.
  • the first verification information field may be replaced by part of the bits in the second verification information field with part of the encryption parameter information or all after get.
  • the first communication device obtains the first verification information field after updating the fourth part of the bit values in the second verification information field to encryption parameter information.
  • the first verification information field of the first AM can be obtained by replacing part of the content of the second verification information field of the second AM in the plaintext data stream, so that the encryption parameter information can be transmitted through the first AM A specific implementation manner is provided.
  • the information carried in the second channel identification information field may be the same as the information carried in the first channel identification information field.
  • the first channel identification information field carries encryption parameter information
  • the first channel identification information field includes the fifth information and encryption parameter information
  • the second channel identification information field includes the sixth information.
  • the bit value corresponding to the sixth information in the second channel identification information field can be divided into two parts, which can be called the fifth part bit value and the sixth part bit value, the fifth part bit value and the bit value corresponding to the fifth information The same, and the bits of the fifth part of the bit value in the second channel identification information field are correspondingly the same as the bits of the fifth information in the first channel identification information field.
  • bits of the sixth part of the bit value in the second channel identification information field are the same as the bits of the encryption parameter information in the first channel identification information field, but the sixth part of the bit value is the same as the encryption parameter information in the first channel identification information field.
  • the bit values corresponding to the parameter information are different.
  • the first channel identification information field may replace some bits in the second channel identification information field with part of the encryption parameter information or all after get. For example, it can be understood that the first communication device obtains the first channel identification information field after updating the sixth part of the bit value in the second channel identification information field to the encryption parameter information.
  • the first channel identification information field of the first AM can be obtained, so that the encryption parameter information can be transmitted through the first AM A specific implementation manner is provided.
  • the bits used to carry the encryption parameter information in the first channel identification information field are: some or all of the k1 bits carrying the first preset value in the second channel identification information field bit, k1 is a positive integer.
  • the receiving end can restore the bits carrying encryption parameters in the first channel identification information field to the corresponding preset values in the second channel identification information field, so as to minimize the impact of transmission of encryption parameter information on other data processing processes .
  • the first communication device may also acquire N plaintext data streams.
  • the N plaintext data streams include a first plaintext data stream and a second plaintext data stream.
  • the second plaintext data stream includes the third AM.
  • the third AM includes a third channel identification information field carrying channel identification information of the second plaintext data stream, and the third channel identification information field includes k1 bits carrying the first preset value. It can be seen that the two different channel identification information fields corresponding to the two different plaintext data streams both include a preset value of k1 bits, so that for each plaintext data stream, the first preset The k1 bits of the value are used to carry the encryption parameter information.
  • the value carried by the bit in the third channel identification information field is the same as the value carried by the bit in the second channel identification information field.
  • the same value is carried in the channel identification information field.
  • two different channel identification information fields corresponding to two different plaintext data streams can carry preset values on the same k1 bits, and for each plaintext data stream, the first preset value can be carried
  • the k1 bits of the channel are used to carry the encryption parameter information, and for the receiving end, since the same k1 bits of different channels carry the same preset value, it can be simplified for the receiving end to restore the second AM to the first AM the process of.
  • the bits used to carry the encryption parameter information in the first channel identification information field may be the following bits in the AM code block corresponding to the first channel identification information field Some or all of: 4th bit, 13th bit, 15th bit, 20th bit, 36th bit, 45th bit, 47th bit and 52nd bit bits. It should be noted that the first bit in the AM code block corresponding to the first channel identification information field is called the 0th bit.
  • the information belonging to the encryption parameter information carried by the first AM can be divided into two parts, namely the first part information and the second part information, and the bit value corresponding to the second part information and the first part
  • the bit value corresponding to the information has an inverse relationship. For example, if the bit value corresponding to the second part of information is 1010, then the bit value corresponding to the first part of information is 0101. Based on the first part of information, the first part of information can be reversed to obtain the second part of information. The first part of information can also be obtained by inverting the second part of information based on the second part of information.
  • the second part of information is obtained by inverting the bit value corresponding to the first part of information, or it can be understood that the first part of information is obtained by inverting the bit value corresponding to the second part of information . In this way, it can also effectively resist the impact of link errors on the transmission reliability of encryption parameters.
  • the information belonging to the encryption parameter information carried in the first AM lock information field is divided into two parts, namely the third part information and the fourth part information, and the third part information corresponds to There is an inverse relationship between the bit value of the bit value and the bit value corresponding to the fourth part of information.
  • the fourth part of information is information obtained by inverting the bit value corresponding to the third part of information
  • the third part of information is information obtained by inverting the bit value corresponding to the fourth part of information.
  • the information belonging to the encryption parameter information carried in the first channel identification information field is divided into two parts, namely the fifth part of information and the sixth part of information, and the fifth part of information corresponds to There is an inverse relationship between the bit value of the bit value and the bit value corresponding to the sixth part of information.
  • the fifth part of information is information obtained by inverting the bit value corresponding to the sixth part of information.
  • the sixth part of information is information obtained by inverting the bit value corresponding to the fifth part of information. In this way, 0/1 balance can be guaranteed, and the impact of link errors on the transmission reliability of encryption parameters can be effectively resisted.
  • the information belonging to the encryption parameter information carried in the first verification information field is divided into two parts, namely the seventh part information and the eighth part information, and the seventh part information corresponds to There is an inverse relationship between the bit value of the bit value and the bit value corresponding to the eighth part of information.
  • the seventh part of information is information obtained by inverting the bit value corresponding to the eighth part of information
  • the eighth part of information is information obtained by inverting the bit value corresponding to the seventh part of information.
  • the bits used to carry the encryption parameter information in the first AM lock information field are some of the bits in the following fields: M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field and ⁇ M2 field.
  • the encryption parameter information may be deployed in at least two of the M0 field, the M1 field, the M2 field, the ⁇ M0 field, the ⁇ M1 field, and the ⁇ M2 field at the same time, for example, it may be deployed in the M0 field and the M1 field.
  • the bits used to carry the encryption parameter information in the first AM lock information field may be the first 4 bits of the M0 field and the bits in the first 4 bits of the M0 field.
  • the bits used to carry the encryption parameter information in the first AM lock information field may be the first 4 bits of the M1 field and the bits in the first 4 bits of the M1 field.
  • the bits used to carry the encryption parameter information in the first AM lock information field may be the first 4 bits of the M2 field and the bits in ⁇ the first 4 bits of the M2 field.
  • the bits used to carry the encryption parameter information in the first verification information field are part or all of the bits in the following fields: BIP 3 field, or ⁇ BIP 3 field. Since the value carried by the ⁇ BIP 3 field in the plaintext data stream is the inverse value of the value of the BIP 3 field, the receiving end can restore the other according to the BIP 3 field and ⁇ BIP 3 field that does not carry encryption parameter information. A field that carries encryption parameter information.
  • the bits used to carry the encryption parameter information in the first verification information field are: bits in the first 4 bits of the ⁇ BIP 3 field and bits in the last 4 bits of the ⁇ BIP 3 field. Since the value carried by the BIP 3 field in the plaintext data stream is the inverse value of the value of the BIP 3 field, the receiving end can use the value of the field of the BIP 3 field information in the first AM to convert the The value carried by the ⁇ BIP 3 field is restored to the value carried by the ⁇ BIP 3 field in the second AM, so that the impact of the transmission of encryption parameter information on other data processing processes can be reduced as much as possible.
  • the encryption parameter information includes an initialization vector IV and a key identifier.
  • the two parameters are two parameters in the encryption parameter information, and the receiving end can determine the encryption key according to the two parameters, and then can decrypt the encrypted data based on the encryption key.
  • the encryption parameter information includes: error correction information of the encryption parameter information. In this way, it can effectively resist the impact of link errors on the transmission reliability of encryption parameters.
  • the error correction information of the encryption parameter information may be a Reed-Solomon type error correction code-forward error correction (Reed-Solomon forward error correction, RS-FEC) code.
  • the RS-FEC code has better performance in dealing with burst errors.
  • the error correction information of the encrypted parameter information may also be a BCH code, and the BCH code is taken from the abbreviation of Bose, Ray-Chaudhuri and Hocquenghem.
  • the encryption parameter information further includes: multiframe start identification information, where the multiframe start identification information is used to indicate a start bit of a multiframe carrying the encryption parameter information. In this way, the receiving end can recognize the multiframe start bit corresponding to the encryption parameter information.
  • the encryption parameter information further includes: multiframe lock state identification information, and the multiframe lock state identification information is used to indicate whether the multiframe of the sending end and/or the receiving end is locked. In this way, the receiving end can recognize the locked state of the multiframe of the sending end and/or the receiving end.
  • the transmission rate of the first ciphertext data stream is one of the following: 100 Gbps, 50 Gbps, or 25 Gbps.
  • the RS-FEC code in the Ethernet architecture may also be included in the first ciphertext data stream, so that the receiving end can understand the plaintext data corresponding to the first ciphertext data stream Error correction is performed on the information in the stream, so that it can effectively resist the impact of link errors on the transmission reliability of encryption parameters.
  • the embodiment of the present application provides a data transmission method, and the method may be executed by a device at a receiving end, for example, may be executed by a second communication device.
  • the second communication device acquires the first ciphertext data stream.
  • the second communication device decrypts the encrypted first data segment according to the encryption parameter information carried by the first AM in the first ciphertext data stream to obtain the first plaintext data stream.
  • the first ciphertext data flow includes the first AM and the encrypted first data segment; the first AM is used for data alignment of the first ciphertext data flow; the first AM includes the first AM lock information field, the first channel identification At least one of the information field or the first check information field; wherein, some bits in the first AM lock information field, some bits in the first channel identification information field, or part of the first check information field Or at least one of all the bits is used to carry: encryption parameter information of the first data segment;
  • This application transmits the encryption parameter information through the bits in the first AM in the data stream.
  • This method can be applied to the physical layer of optical modules or network devices, and the transmitted encryption parameters may not occupy user service bandwidth. Moreover, since this scheme encrypts the bit stream of the physical layer, all bits (including source MAC address and destination MAC address) in a user frame will be encrypted, so security can be improved.
  • the second communication device performs AM locking on the first ciphertext data stream according to at least k2 consecutive first AMs in the first ciphertext data stream, and the at least k2
  • the first continuous AM satisfies the preset rule; k2 is an integer greater than 1.
  • the first AM among the at least k2 first AMs satisfying the preset rule includes: the information carried by some bits in the first AM lock information field of the first AM includes part or all of the encryption parameter information : There are at most k3 nibble (nibble) mismatches between the information carried in the first AM lock information field except the encryption parameter information and the preset AM lock information; k3 is a positive integer.
  • the value of k3 is 1. Because in the existing standard, when 48 bits of AM locking information are used for AM locking, at most 3 nibble mismatches need to be required. In the embodiment of the present application, it is considered that some bits (such as 8 bits, equivalent to 2 nibbles) in the first AM lock information field carry encryption parameter information, then the value of k3 can be set to be less than 3, such as the value of k3 The value is 1. In this way, the performance of locking according to the first AM locking information field can be guaranteed as much as possible.
  • part or all of the bits in the first AM lock information field may be used to carry the AM lock information of the first ciphertext data stream.
  • Part or all of the bits in the first channel identification information field may be used to carry channel identification information of the first ciphertext data stream.
  • Part or all of the bits in the first check information field may carry check information.
  • the first ciphertext data stream is obtained according to the first plaintext data stream and encryption parameter information; the first plaintext data stream includes the second AM and the unencrypted first data segment; the second AM Data alignment for the first plaintext data stream.
  • the second communication device decrypts the encrypted first data segment according to the encryption parameter information carried by the first AM in the first ciphertext data stream to obtain the unencrypted data segment in the first plaintext data stream. first data segment.
  • the second communication device may also process the first AM to obtain the second AM in the first plaintext data stream. Because the second communication device restores the first AM to the second AM in the plaintext data stream, the impact on other data processing processes due to the transmission of encryption parameter information can be reduced as much as possible.
  • the second communication device may also determine the channel identification information of the first plaintext data stream according to the second AM . In this way, the accuracy of identifying the channel identification information can be improved, thereby minimizing the influence of the transmission encryption parameter information on the identification process of the channel identification information.
  • the second AM may include at least one of a second AM locking information field, a second channel identification information field, or a second verification information field.
  • the second AM lock information field may be used to carry AM lock information of the first plaintext data stream.
  • the second channel identification information field may be used to carry channel identification information of the first plaintext data stream.
  • the second verification information field may be used to carry verification information.
  • the first AM lock information field may be obtained by replacing some bits in the second AM lock information field with part or all of the encryption parameter information.
  • the first channel identification information field may be obtained by replacing some bits in the second channel identification information field with some or all of the encryption parameter information.
  • the first verification information field is obtained by replacing part of the bits in the second verification information field with part or all of the encryption parameter information.
  • the AM locking information carried in the first AM locking information field is a preset value specified in the protocol
  • the second communication device may use the first The information on the bits used to carry the encryption parameter information in the AM lock information field is restored to the second preset value. Therefore, the impact on other data processing processes due to the transmission of encryption parameter information can be reduced as much as possible.
  • the second communication The device may restore the information on the bits used to carry the encryption parameter information in the first channel identification information field to the first preset value. Therefore, the impact on other data processing processes due to the transmission of encryption parameter information can be reduced as much as possible.
  • the second communication device may restore the information on the bits used to carry the encryption parameter information in the first verification information field to the first verification information carried in the first verification information field according to the first verification information
  • the information after the bit value corresponding to the verification information is reversed. Therefore, the impact on other data processing processes due to the transmission of encryption parameter information can be reduced as much as possible.
  • the bits used to carry the encryption parameter information in the first channel identification information field are: part of the k1 bits carrying k1 first preset values in the second channel identification information field Or all bits, k1 is a positive integer.
  • the second communication device may acquire N ciphertext data streams, and the N ciphertext data streams include a first ciphertext data stream and a second ciphertext data stream; wherein, the second ciphertext data
  • the stream includes a fourth AM and an encrypted second data segment; the fourth AM is used for data alignment of the second ciphertext data stream, and the fourth AM carries encryption parameter information of the second data segment.
  • the encryption parameter information carried by the fourth AM in the second ciphertext data stream the second data segment in the second ciphertext data stream is decrypted to obtain an unencrypted second data segment in the second plaintext data stream.
  • Process the fourth AM to obtain a third AM in the second plaintext data stream;
  • the third AM includes a third channel identification information field carrying channel identification information of the second plaintext data stream, and the third channel identification information field includes Carry k1 bits of the first preset value.
  • the value carried by the bit in the third channel identification information field is the same as the value carried by the bit in the second channel identification information field.
  • the bits used to carry the encryption parameter information in the first channel identification information field are some or all of the following bits in the AM code block corresponding to the first channel identification information field: the fourth bit, 13th bit, 15th bit, 20th bit, 36th bit, 45th bit, 47th bit, and 52nd bit.
  • the fourth bit 13th bit, 15th bit, 20th bit, 36th bit, 45th bit, 47th bit, and 52nd bit.
  • the encryption parameter information carried by the first AM is divided into two parts, namely the first part of information and the second part of information, and the second part of information is information obtained by reversing the bit value corresponding to the first part of information.
  • the information belonging to the encryption parameter information carried in the first AM lock information field can be divided into two parts, namely the third part of information and the fourth part of information, and the fourth part of information is obtained by The information obtained by inverting the bit value corresponding to the third part of information.
  • the information belonging to the encryption parameter information carried in the first channel identification information field can be divided into two parts, namely the fifth part of information and the sixth part of information, and the sixth part of information is based on the bit value corresponding to the fifth part of information Reverse the obtained information.
  • the information belonging to the encryption parameter information carried in the first verification information field can be divided into two parts, which are the seventh part information and the eighth part information, and the eighth part information is obtained through the bit value corresponding to the seventh part information Reverse the obtained information.
  • the bits used to carry the encryption parameter information in the first AM lock information field are some of the bits in the following fields: M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field and ⁇ M2 field.
  • the bits used to carry the encryption parameter information in the first AM lock information field are one of the following: the first 4 bits of the M0 field, and the bits in the first 4 bits of the M0 field ; the first 4 bits of the M1 field, and bits in the first 4 bits of the ⁇ M1 field; or, the first 4 bits of the M2 field, and bits in the first 4 bits of the ⁇ M2 field.
  • the bits used to carry the encryption parameter information in the first AM lock information field are one of the following: the first 4 bits of the M0 field, and the bits in the first 4 bits of the M0 field ; the first 4 bits of the M1 field, and bits in the first 4 bits of the ⁇ M1 field; or, the first 4 bits of the M2 field, and bits in the first 4 bits of the ⁇ M2 field.
  • the bits used to carry the encryption parameter information in the first verification information field are part or all of the bits in the following fields: BIP 3 field, or ⁇ BIP 3 field.
  • the bits used to carry the encryption parameter information in the first verification information field are: bits in the first 4 bits of the ⁇ BIP 3 field and bits in the last 4 bits of the ⁇ BIP 3 field.
  • the encryption parameter information includes an initialization vector IV and a key identifier.
  • the encryption parameter information includes: error correction information of the encryption parameter information.
  • the error correction information of the encryption parameter information includes: RS-FEC code and/or BCH code.
  • the error correction information of the encrypted parameter information performs error correction on other information in the encrypted parameter information. In this way, it can effectively resist the impact of link errors on the transmission reliability of encryption parameters.
  • a communication device including a communication unit and a processing unit.
  • the communication device may be the above-mentioned first communication device, or may be the above-mentioned second communication device.
  • the communication device may implement any one of the above first aspect to the second aspect, and any implementation manner of any one aspect.
  • the communication unit is used to perform functions related to transmission and reception.
  • the communication unit includes a receiving unit and a sending unit.
  • the communication device is a communication chip
  • the processing unit may be one or more processors or processor cores
  • the communication unit may be an input/output circuit or port of the communication chip.
  • the communication unit may be a transmitter and a receiver, or the communication unit may be a transmitter and a receiver.
  • the communication device further includes various modules that can be used to implement any one of the foregoing first aspect to the second aspect, and any implementation manner of any one aspect.
  • a communication device including a processor and a memory.
  • the communication device may be the above-mentioned first communication device, or may be the above-mentioned second communication device.
  • a transceiver is also included, the memory is used to store computer programs or instructions, the processor is used to call and run the computer programs or instructions from the memory, and when the processor executes the computer programs or instructions in the memory, the The communication device implements any one of the above first aspect to the second aspect, and any implementation manner of any one aspect.
  • processors there are one or more processors, and one or more memories.
  • the memory may be integrated with the processor, or the memory may be separated from the processor.
  • the transceiver may include a transmitter (transmitter) and a receiver (receiver).
  • a communication device including a processor.
  • the communication device may be the above-mentioned first communication device, or may be the above-mentioned second communication device.
  • the processor is coupled with the memory, and can be used to execute any one of the first aspect to the second aspect, and any implementation manner of any one aspect.
  • the communication device may be the above-mentioned first communication device, or may be the above-mentioned second communication device.
  • the communication device further includes a memory.
  • the communication device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication interface may be a transceiver, or an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pipe feet or related circuits, etc.
  • a processor may also be embodied as processing circuitry or logic circuitry.
  • the communication interface may be a transceiver, or an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the communication interface may be an input/output interface, an interface circuit, an output circuit, an input circuit, a pipe feet or related circuits, etc.
  • a processor may also be embodied as processing circuitry or logic circuitry.
  • a system includes the above-mentioned first communication device and the second communication device.
  • a computer program product includes: a computer program (also referred to as code, or an instruction), which, when the computer program is executed, causes the computer to execute any of the above first to second aspects.
  • a computer program also referred to as code, or an instruction
  • a computer-readable storage medium stores a computer program (also referred to as code, or an instruction) which, when run on a computer, causes the computer to perform the above-mentioned first to second aspects.
  • a computer program also referred to as code, or an instruction
  • a chip system may include a processor.
  • the processor is coupled with the memory, and may be used to implement any one of the first aspect to the second aspect above, and any implementation manner of any one aspect.
  • the chip system further includes a memory.
  • Memory used to store computer programs (also called code, or instructions).
  • the processor is configured to call and run a computer program from the memory, so that the device installed with the system-on-a-chip executes any one of the first aspect to the second aspect, and any implementation manner of any one aspect.
  • a processing device including: an interface circuit and a processing circuit.
  • Interface circuitry may include input circuitry and output circuitry.
  • the processing circuit is used to receive signals through the input circuit and transmit signals through the output circuit, so that any one of the first aspect to the second aspect and any implementation manner of any one aspect are realized.
  • the above-mentioned processing device may be a chip
  • the input circuit may be an input pin
  • the output circuit may be an output pin
  • the processing circuit may be a transistor, a gate circuit, a flip-flop, and various logic circuits.
  • the input signal received by the input circuit may be received and input by, for example but not limited to, the receiver
  • the output signal of the output circuit may be, for example but not limited to, output to the transmitter and transmitted by the transmitter
  • the circuit may be the same circuit, which is used as an input circuit and an output circuit respectively at different times.
  • the present application does not limit the specific implementation manners of the processor and various circuits.
  • the communication device may be a part of the first communication device, such as an integrated circuit product such as a system chip or a communication chip.
  • the interface circuit may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip or chip system.
  • the processing circuitry may be logic circuitry on the chip.
  • the communication device may be a part of the second communication device, such as an integrated circuit product such as a system chip or a communication chip.
  • the interface circuit may be an input/output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip or chip system.
  • the processing circuitry may be logic circuitry on the chip.
  • Fig. 1 is a kind of data structure schematic diagram of two-layer encryption
  • FIG. 2a is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 2b is a schematic diagram of another system architecture provided by the embodiment of the present application.
  • Figure 2c is an OSI reference model architecture
  • FIG. 2d is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 2e is a schematic diagram of a data processing flow at a sending end and a receiving end provided in an embodiment of the present application;
  • Figure 3a is a schematic diagram of the format of an AM code block provided by the embodiment of the present application.
  • Figure 3b is a schematic diagram of the AM format of each logical channel in 100Gbps provided by the embodiment of the present application.
  • FIG. 3c is a schematic diagram of the AM format of FEC channel 0 in 100Gbps provided by the embodiment of the present application;
  • Figure 3d is a schematic diagram of the AM format of each logical channel in 50Gbps provided by the embodiment of the present application.
  • FIG. 3e is a schematic diagram of the AM format of FEC channel 0 in 50Gbps provided by the embodiment of the present application;
  • FIG. 3f is a schematic diagram of the AM format of a logical channel in 25Gbps provided by the embodiment of the present application.
  • FIG. 3g is a schematic diagram of the AM format of another logical channel in 25Gbps provided by the embodiment of the present application.
  • FIG. 4a is a schematic flow chart of a data transmission method provided by an embodiment of the present application.
  • Fig. 4b is a schematic flowchart of another data transmission method provided by the embodiment of the present application.
  • FIG. 5a is a schematic diagram of bits that can be used to carry encryption parameter information in the AM of FIG. 3c provided by the embodiment of the present application;
  • Fig. 5b is a schematic structural diagram of a multiframe of encryption parameter information carried in the first ciphertext data stream provided by the embodiment of the present application;
  • FIG. 6 is a schematic flowchart of another data transmission method provided by the embodiment of the present application.
  • FIG. 7a is a schematic diagram illustrating the average time of losing lock and the average time of locking in four cases provided by the embodiment of the present application;
  • Figure 7b is a diagram showing the effect of the bit error rate after the error correction of the RS-FEC code of the Ethernet architecture under the case b0 and the case b1 (25Gbps) transmission rate provided by the embodiment of the present application;
  • Fig. 7c is a diagram showing the effect of the bit error rate after error correction of the RS-FEC code of the Ethernet architecture under the case b0 and case b2 (50Gbps) transmission rate provided by the embodiment of the present application;
  • Figure 7d is a diagram showing the effect of the bit error rate after the error correction of the RS-FEC code of the Ethernet architecture under the case b0 and the case b3 (100Gbps) transmission rate provided by the embodiment of the present application;
  • FIG. 8 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of another communication device provided in an embodiment of the present application.
  • Fig. 1 exemplarily shows a schematic diagram of a data structure of two-layer encryption.
  • the encryption side uses a separate key (Key) and An Initialization Vector (IV) for encryption.
  • the encryption side can use the local pre-configured key (Key) and initial vector to encrypt the unencrypted data of a data frame in the figure (unencrypted data can also be called plain data (Plain Data)), and the encrypted The encrypted data can also be called ciphertext data (Encrypted Data).
  • the encryption side In order to prevent data from being tampered with by attackers during transmission, the encryption side usually also generates a check value, such as an integrity check value (Integrity Check Value, ICV).
  • ICV Integrity Check Value
  • the encryption side sends a message, it carries ciphertext data, a security tag (SecTAG) and an ICV generated during the encryption process in the message, where the SecTAG includes Key Identification and IV Identification .
  • the decryption side After receiving the data frame, the decryption side decrypts the data frame according to the key corresponding to the key identifier and the IV corresponding to the IV identifier. After decryption, the ciphertext data (Encrypted Data) will become plaintext data (Plain Data). In order to determine whether the data has been tampered with during transmission, the decryption side will calculate an ICV. Only when the ICV is consistent with the ICV carried in the data frame can the decryption be considered valid; otherwise, the decryption is invalid.
  • the implementation level of encryption technology based on protocols such as MACsec is above the MAC layer, and the object of encryption and decryption is each user frame.
  • the method for encrypting each user frame using the encryption technology based on the MACsec protocol at the MAC layer needs to carry encryption parameters in each user frame.
  • an embodiment of the present application provides a data transmission solution, which is used to achieve the purpose of not occupying user service bandwidth for encryption parameters.
  • Fig. 2a exemplarily shows a schematic diagram of a system architecture provided by an embodiment of the present application.
  • the system architecture includes a first communication device and a second communication device. Any one of the first communication device and the second communication device may be a network device, or a chip disposed inside the network device.
  • the device may be a network device supporting an Ethernet interface.
  • the device includes but is not limited to: optical modules, core routers, Internet Protocol Radio Access Network (IPRAN), packet transport network (Packet Transport Network, PTN) box-type or frame-type switch equipment.
  • IPRAN Internet Protocol Radio Access Network
  • PTN Packet Transport Network
  • the optical module may be a module including an optical digital signal processor (oDSP).
  • oDSP optical digital signal processor
  • the first communication device acquires the first ciphertext data stream, and sends the first ciphertext data stream.
  • the first ciphertext data stream may be sent to the second communication device.
  • the first ciphertext data stream includes a first alignment identifier AM and an encrypted first data segment; the first AM is used for data alignment of the first ciphertext data stream.
  • the first AM includes at least one of a first AM locking information field, a first channel identification information field, or a first verification information field.
  • the second communication device obtains the first ciphertext data stream, and decrypts the encrypted first data segment according to the encryption parameter information carried by the first AM in the first ciphertext data stream to obtain the first plaintext data stream.
  • This application transmits the encryption parameter information through the bits in the first AM in the data stream, and does not add additional bits for transmitting the encryption parameter information, so the transmission of the encryption parameter information does not occupy the user service bandwidth, thereby reducing the encryption parameter Occupancy of user bandwidth.
  • the application since the application encrypts and transmits data streams (or called bit streams) in the physical layer, all bits (including source MAC address and destination MAC address) in the Ethernet frame can be encrypted, thereby improving safety.
  • the first communication device may also be called a sending end, an encryption end, a source end, a sending device, a sending side, a sending end side, etc.
  • the second communication device may also be called a receiving end, a decryption end, etc. end, destination end, receiving device, receiving side, receiving end side, etc., are not specifically limited in this embodiment of the present application.
  • for the relevant scheme of the transmitting end refer to the scheme of the first communication device side
  • the scheme of the receiving end refer to the scheme of the second communication device side.
  • FIG. 2 b exemplarily shows another system architecture provided by the embodiment of the present application, where the system architecture includes multiple devices, such as device 1 , device 2 , device 3 and device 4 .
  • the first communication device and the second communication device in FIG. 2a may be any two communication devices in FIG. 2b , for example, may be any two adjacent communication devices in FIG. 2b .
  • the data transmission can be two-way transmission, for example, the data transmission direction can be transmitted from device 1 to device 4 in FIG. 2b, and can also be transmitted from device 4 to device 1.
  • the first communication device is device 1 and the second communication device is device 2 .
  • the first communication device is device 2
  • the second communication device is device 3 .
  • the first communication device is device 3
  • the second communication device is device 4 .
  • device 2 when device 1 sends data to device 2, device 2 can execute the solution on the receiving side, and when device 2 sends data to device 3, device 2 can also execute the solution on the sending side, that is to say, in the embodiment of this application, one A device can implement both the scheme on the sending side and the scheme on the receiving side.
  • the solution on the sending side of the device may refer to the solution on the first communication device side
  • the solution on the receiving side may refer to the solution on the second communication device side.
  • the device 2 is the first communication device and the device 3 is the second communication device.
  • Figure 2c exemplarily shows an OSI reference model architecture, which is a network interconnection model and defines a seven-layer framework for network interconnection, from the bottom layer to the top layer, followed by physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer.
  • OSI reference model architecture which is a network interconnection model and defines a seven-layer framework for network interconnection, from the bottom layer to the top layer, followed by physical layer, data link layer, network layer, transport layer, session layer, presentation layer, and application layer.
  • Ethernet is at the data link layer and physical layer in the OSI reference model.
  • the data link layer includes two sublayers: the logical link control (LLC) sublayer and the medium access control (MAC) sublayer responsible for parsing and assembling Ethernet frames.
  • LLC logical link control
  • MAC medium access control
  • the physical layer may include a physical medium dependent sublayer (physical medium dependent sublayer, PMD) (also referred to as a PMD layer), a physical medium additional sublayer (physical medium attachment sublayer, PMA) (also referred to as PMA layer), forward error correction code (forward error correction, FEC) (also called FEC layer), physical coding sublayer (physical coding sublayer, PCS) (also called PCS layer).
  • PMD physical medium dependent sublayer
  • PMA physical medium additional sublayer
  • FEC forward error correction code
  • PCS physical coding sublayer
  • a reconciliation sublayer reconciliation sublayer, RS
  • RS reconciliation sublayer
  • Fig. 2c also shows a medium connected to the PMD, which may be a cable, a pluggable optical module, or an optical fiber.
  • the MACsec technology is specifically deployed on the MAC sublayer in the data link layer.
  • the encryption object and the decryption object are an Ethernet frame (or user frame).
  • the solution provided by the embodiment of the present application is deployed at the physical layer, and the encryption object and the decryption object can be a data segment of a logical channel.
  • Fig. 2d exemplarily shows a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the solution of the embodiment of the present application can be applied to optical modules that support Ethernet connections.
  • the communication device is used as an optical module for illustration, and Figure 2d shows the possible deployment positions of the solution of the embodiment of the application when it is deployed on the optical module .
  • the optical module can include a bit multiplexer or demultiplexer (BitMux), oDSP, microcontroller unit (micro-controller unit, MCU), and optoelectronic transceiver devices (including transmitters (transmitter, TX )/receiver (receiver, RX).
  • BitMux bit multiplexer or demultiplexer
  • oDSP microcontroller unit
  • MCU microcontroller unit
  • optoelectronic transceiver devices including transmitters (transmitter, TX )/receiver (receiver, RX).
  • the MCU in the optical module can be responsible for configuring the parameters of each functional module.
  • the MCU can be used to configure the initialization parameters required for encryption and decryption in the embodiment of this application, including starting or suspending the encryption and decryption functions, and configuring the key negotiated by the upper layer. and other key information.
  • BitMux mainly completes the conversion of the signal stream of the input channel to the output channel in a bit-interleaved manner.
  • BitMux When BitMux is deployed on the physical layer, it is used to realize the conversion between N logical channels and M physical channels, for example, converting the signal flow of 4 logical channels to 2 physical channels.
  • BitMux When BitMux is deployed in the optical module, it is used to realize the conversion between the signal of M physical channels and the digital signal of K channels, for example, the signal flow of 2 physical channels is converted into 2 digital signals.
  • the communication device architecture in Figure 2d can divide the BitMUX between M physical channels (M is a positive integer) and K channels (K is a positive integer) in the oDSP into two, respectively M:N and N:K Two bitMUX, N is the number of logical channels, N is a positive integer, and then introduce encryption and decryption and corresponding functional modules between the two BitMUX.
  • the encryption-side and/or decryption-side solutions in the embodiment of the present application are introduced between two bitMUXs, and other functional components in the module may not be aware of other functional components in the module.
  • the optical module shown in Figure 2d should be able to implement the receiver scheme.
  • the optical module when the optical module implements the receiving end solution, the optical module can receive the optical signal from device 1 through the optical fiber.
  • the solution implemented by device 2 can refer to the second communication
  • the solution executed by the device 1 may refer to the solution on the first communication device side.
  • the optical signal is processed by the receiver for photoelectric conversion and oDSP algorithm (such as dispersion compensation, etc.), and then the digital signal is output to BitMux.
  • BitMux converts the digital signal output by the oDSP into N logical channel signals, and converts the N logical channel signals into M physical channel signals and transmits them to the electronic chip in the physical layer. It should be noted that the foregoing physical channel signals and logical channel signals are digital signals.
  • the optical module shown in Figure 2d should also be able to implement the transmit-side scheme.
  • BitMux can convert the M physical channel signals input into the optical module into N logical channel signals; and then convert the N logical channel signals into Channel signals are converted into K-channel physical channel signals and input into oDSP digital signals.
  • the oDSP is responsible for implementing algorithmic processing (such as dispersion compensation preprocessing) on the input digital signal, and then processing it by the transmitter in the photoelectric transceiver device and sending it to the device 3 through the optical fiber.
  • the solution executed by device 2 may refer to the solution on the side of the first communication device
  • the solution executed by device 3 may refer to the solution on the side of the second communication device.
  • the PCS layer may have logical channels, which may be called PCS logical channels or PCS channels.
  • the FEC layer may also have logical channels, which may be called FEC logical channels or FEC channels.
  • Figure 2e is illustrated by taking the system architecture with FEC channels at a transmission rate of 100 Gbps as an example.
  • the number of physical channels is 2
  • the number of logical channels at the PCS layer is 20
  • the number of logical channels at the FEC layer is 4.
  • the number of physical channels may also be other values, such as 4, etc., which are not limited in this embodiment of the present application.
  • the sender in Figure 2e receives a series of data streams, which are processed by the MAC layer and the RS layer in turn and enter the PCS layer.
  • the data stream is encoded (encoded) at the PCS layer to obtain a series of code block streams of 64/66B (the code block stream can also be in other encoding forms, here the encoding form of 64/66B is used as an example).
  • block distribution is performed.
  • the series of scrambled code block streams can form 20 code block streams corresponding to 20 PCS channels (also called PCS logical channels) after block distribution, and one PCS channel corresponds to one code block stream .
  • the sending end may perform AM insertion (AM insertion) on the 20 code block streams, so as to periodically insert AM into the code block stream corresponding to each of the 20 PCS channels.
  • AM insertion AM insertion
  • the sending end can input the 20 code block streams to the FEC layer.
  • the sender performs logical channel block alignment (lane block sync), alignment lock (alignment lock), logical channel offset (lane deskew) and logical channel reordering (lane reorder) on the 20 code block streams at the FEC layer,
  • the 20 parallel code block streams are restored to one serial code block stream.
  • AM removal AM removal
  • Transcode Transcode a serial code block stream after removing AM to obtain a serial 256/257B code block stream (the code block stream can also be in other encoding forms, here 256/257B The encoding form is given as an example).
  • AM insertion is performed on the transcoded serial code block stream, so that AM is periodically inserted in the serial code block stream.
  • AM insertion is performed on the transcoded serial code block stream, so that AM is periodically inserted in the serial code block stream.
  • RS encode RS encode
  • symbol distribution symbol distribution
  • the FEC layer at the sending end outputs 4 code block streams corresponding to the 4 FEC channels and enters the PMA. Then, according to the ratio of 4:2 in the PMA, the 4 code block streams corresponding to the 4 FEC channels are converted to 2 physical channels through the built-in bitMux of the PMA, and the code block streams corresponding to the 2 physical channels are obtained. Then the code block streams of the two physical channels are transmitted through the PMD and media in the form of electrical or optical signals.
  • the format of the AM inserted by the sending end at the PCS layer may refer to the format of an AM defined at the PCS layer.
  • the format of the AM inserted by the sending end at the FEC layer refer to the format of an AM defined at the FEC layer.
  • FIG. 3b in the follow-up content exemplarily shows a format diagram of four AMs corresponding to the FEC channel in the system architecture with the FEC channel at a transmission rate of 100 Gbps.
  • the PCS channel can correspond to 20 AMs at a transmission rate of 100 Gbps
  • each AM can be an AM code block, that is, the format of each AM in the 20 AMs corresponding to 20 PCS channels can be found in
  • the structure of the AM code block shown in FIG. 3 a at least one bit has a different value in any two AMs among the 20 AMs corresponding to the 20 PCS channels.
  • the encryption scheme can be specifically implemented by the physical layer chip after obtaining the data streams corresponding to multiple FEC channels through PMA and before recovering the serial stream, or by the optical module (Medium) is implemented during the processing of the received data stream.
  • the receiving end can process the received 2 code block streams corresponding to the 2 physical channels in the PMD, and then input the 2 processed code block streams to the PMA layer, and the PMA layer will follow the The ratio of 2:4 converts the 2 code block streams corresponding to the 2 physical channels to 4 FEC channels, and obtains the 4 bar code block streams corresponding to the 4 FEC channels, and inputs the 4 bar code block streams to the FEC layer.
  • the receiver performs alignment lock, lane deskew, and lane reorder on the 4 barcode block streams corresponding to the 4 FEC channels, so that the 4 channels are parallelized
  • the code block stream is recovered as a serial code block stream.
  • RS decoding RS decode
  • AM removal AM removal
  • Transcoding is performed on a serial stream of code blocks after removing the AM, so as to obtain a serial stream of 64/66B code blocks.
  • the Ethernet architecture itself can have RS-FEC code error correction performance, and the RS-FEC code of the Ethernet architecture can be implemented in the RS decoding (RS decode) step of the FEC layer.
  • the receiving end performs logical channel block alignment (lane block sync), alignment lock (alignment lock), logical channel offset (lane deskew) and logical channel reordering (lane reorder) on the 20 parallel code block streams at the PCS layer, A series of code block streams of 64/66B are obtained.
  • Descrambling and decoding is performed on the one serial code block stream from which the AM has been removed, so as to restore one serial data stream.
  • the receiving end processes the serial data stream sequentially at the RS layer and the MAC layer, so as to restore the original service data stream sent by the sending end.
  • the decryption scheme can be implemented by the physical layer chip after obtaining the data streams corresponding to multiple FEC channels through PMA and before recovering the serial stream, or by the optical module (Medium) is implemented during the processing of the received data stream.
  • N plaintext data streams refer to N unencrypted data streams. Taking one plaintext data stream among the N plaintext data streams as an example for illustration, in order to distinguish, one plaintext data stream among the N plaintext data streams is called the first plaintext data stream, and N is a positive integer.
  • the first plaintext data stream includes at least two AMs and at least one unencrypted data segment.
  • the AM in the first plaintext data stream is called the second AM
  • at least one data segment in the first plaintext data stream is called the first data segment.
  • the unencrypted first data segment may also be referred to as a plaintext data segment, or as a plaintext first data segment.
  • At least two second AMs are used for data alignment of N plaintext data streams.
  • a plaintext data segment may be included between every two second AMs, and a second AM may be included between every two plaintext data segments.
  • the second AM in the first plaintext data stream may be inserted periodically.
  • the second AM of the first plaintext data stream and the unencrypted first data segment may appear periodically.
  • Each period may contain a second AM and a plaintext data segment.
  • N ciphertext data streams refer to N encrypted data streams. Taking one ciphertext data stream among the N ciphertext data streams as an example for illustration, in order to distinguish, one ciphertext data stream among the N ciphertext data streams is called the first ciphertext data stream.
  • the first ciphertext data stream includes at least two AMs and at least one encrypted data segment.
  • the aligned data unit in the first ciphertext data stream is called the first AM.
  • the data segment in the first ciphertext data stream is a data segment to be encrypted, and may also be called a ciphertext data segment.
  • the first ciphertext data stream includes at least two AMs and at least one encrypted data segment.
  • the AM in the first ciphertext data stream is called the first AM
  • at least one encrypted data segment in the first ciphertext data stream is called the encrypted first data segment.
  • the encrypted first data segment may also be referred to as a ciphertext data segment, or as a ciphertext first data segment.
  • At least two first AMs are used for data alignment of the N-path ciphertext data streams.
  • N channels of plaintext data streams are encrypted to obtain N channels of ciphertext data streams.
  • N channels of plaintext data streams are encrypted to obtain N channels of ciphertext data streams.
  • N channels of plaintext data streams are encrypted to obtain N channels of ciphertext data streams.
  • the first plaintext data stream corresponds to the first ciphertext data stream in the N channels of ciphertext data streams.
  • the encrypted first data segment in the first ciphertext data stream can be obtained.
  • the first AM corresponding to the second AM in the first ciphertext data stream can be obtained by processing the second AM in the first plaintext data stream.
  • the processing of the second AM in the first plaintext data stream in this embodiment of the present application may include adding encryption parameter information to the second AM.
  • a logical lane also called a virtual lane, refers to a PCS lane (or called a PCS logical lane) or an FEC lane (or called a FEC logical lane).
  • the logical channel in a system architecture with a transmission rate of 100Gbps and FEC, can be called an FEC channel.
  • the logical channel in a system architecture with a transmission rate of 50Gbps and 25Gbps, can also be called an FEC channel.
  • the logical channel in the 200Gbps/400Gbps standard It may be called a PCS logical channel.
  • the number of FEC channels in the system architecture with FEC channels at a transmission rate of 100 Gbps is 4
  • the number of FEC channels corresponding to 50 Gbps is 2
  • the number of FEC channels corresponding to 25 Gbps is 1.
  • the embodiment of the present application is shown as an example of the logical channel in the system architecture with a transmission rate of 100Gbps and FEC, and the logical channel in the system architecture of 50Gbps and 25Gbps.
  • the subsequent content of the embodiment of the application mentions The logical channel can be understood as an FEC channel.
  • the physical lane may be a PMA lane.
  • a physical channel can carry the data of one or more logical channels. In Ethernets with different rates, the number of physical channels will vary depending on the implementation.
  • the receiving end may align the multiple logical channels based on AM (such as the first AM or the second AM above).
  • the AM in the embodiment of the present application is that the carried information includes one bit or multiple consecutive bits of the data alignment information of the N plaintext data streams.
  • the information carried on an AM may refer to the information carried on bits included in the AM.
  • the IEEE 802.3 specification designs an alignment marker (AM).
  • the AM mentioned in the embodiment of this application can be not only the AM designed for the existing specification, but also can be defined by other specifications or other forms in the future. One bit or more consecutive bits.
  • the sender converts a serial stream into N data streams of N logical channels (such as N FEC channels), where AM is periodically deployed in the data stream of each logical channel (periodically inserted by the sender) (such as the second AM in the first plaintext data stream).
  • N logical channels such as N FEC channels
  • the receiving end acquires the data streams in N logical channels (for example, it may be N ciphertext data streams), and can perform channel locking according to the AM of each logical channel (such as the first AM in the first ciphertext data stream), so that Combine the data streams in the N logical channels to restore the aforementioned serial stream.
  • N logical channels for example, it may be N ciphertext data streams
  • the AM of each logical channel such as the first AM in the first ciphertext data stream
  • AM formats corresponding to different transmission rates may be different.
  • the AM formats stipulated in the standards under 100Gbps, 50Gbps, and 25Gbps are respectively introduced below.
  • the AM may include at least one AM data unit, and the AM data unit may refer to a bit or a series of continuous bits.
  • An AM data unit may be referred to as an AM code block.
  • the format of the AM code block, the AM code block includes: an identification field and a check field.
  • FIG 3a exemplarily shows a schematic diagram of the format of an AM code block.
  • an AM code block may include 8 fields, which are M0 field, M1 field, M2 field, BIP 3 field, ⁇ M0 field, ⁇ M1 field, ⁇ M2 field and ⁇ BIP 3 field. Wherein, each field may include 8 bytes.
  • the information carried by the AM code block can be divided into two categories, namely identification information and verification information.
  • the M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field, and ⁇ M2 field carry identification information
  • the BIP 3 field and ⁇ BIP 3 field carry check information, such as bit interleaved parity check value (bit interleaving parity, BIP).
  • all fields included in an AM code block can be divided into two fields: an identification field and a check field.
  • the identification field of an AM code block may include the M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field and ⁇ M2 field of the AM code block. It should be noted that it can be said that an AM code block includes an identification field. In order to identify more clearly in the figure, an identification field of an AM code block is marked in two parts in the figure, one part is M0 field, M1 field and M2 field, and the other part is ⁇ M0 field, ⁇ M1 field and ⁇ M2 field.
  • the check field of an AM code block may include a BIP 3 field and a ⁇ BIP 3 field. It should be noted that an AM code block can be said to include a check field. In order to identify it more clearly in the figure, a check field of an AM code block is marked in two parts in the figure, one part is BIP 3 field, The other part is the ⁇ BIP 3 field.
  • the AM in each logical channel may include an AM lock information field, a channel identification information field, and a check information field.
  • the AM locking information field may be used to carry AM locking information.
  • the channel identification information field is used to carry the channel identification information of the logical channel.
  • the verification information field is used to carry verification information.
  • Figure 3b exemplarily shows the format of the AM on the logical channel with a transmission rate of 100Gbps, as shown in Figure 3b, N can be 4, 4 logical channels (in the figure, the logical channel is an FEC channel as an example to show) wherein , one AM in FEC channel 0 includes amp_tx_0, amp_tx_4, amp_tx_8, amp_tx_12, and amp_tx_16.
  • One AM in FEC lane 1 includes amp_tx_1, amp_tx_5, amp_tx_9, amp_tx_13, and amp_tx_17.
  • One AM in FEC lane 2 includes amp_tx_2, amp_tx_6, amp_tx_10, amp_tx_14, and amp_tx_18.
  • One AM in FEC lane 3 includes amp_tx_3, amp_tx_7, amp_tx_11, amp_tx_15, and amp_tx_19.
  • Each of amp_tx_0, amp_tx_1, amp_tx_2..., amp_tx_19 in the 4 FEC channels can be an AM code block, and its structure can refer to the AM code block shown in Figure 3a.
  • FIG. 3c exemplarily shows a schematic diagram of the corresponding relationship between amp_tx_0 and amp_tx_1 in AM of FEC channel 0 and AM code blocks. AM will be introduced in conjunction with FIG. 3b and FIG. 3c below.
  • the lock information field in the AM of FEC channel 0 may include the identification field in amp_tx_0. Details are given below.
  • the identification fields in amp_tx_0, amp_tx_1, amp_tx_2, and amp_tx_3 carry the same information, which can be preset values, such as preset AM locking information.
  • the bits in the identification field of amp_tx_0 carry The information is preset AM locking information
  • the information carried by the bits of the identification field of amp_tx_1 is preset AM locking information.
  • the receiving end may perform AM locking based on the information carried in the identification field of the first AM code block of the AM of the FEC channel.
  • AM locking can also be understood as channel locking.
  • an AM can be said to include an AM lock information field.
  • an AM lock information field of an AM is marked in two parts in the figure, and one part is the M0 field in amp_tx_0 , M1 field, and M2 field, and the other part is the ⁇ M0 field, ⁇ M1 field, and ⁇ M2 field in amp_tx_0.
  • the receiving end may divide 6 bytes of the identification field of the first AM code block in the received AM to obtain 12 nibbles.
  • the receiving end determines that there are at least two AMs that match the preset AM locking information, it can be determined that the AM is locked, or that the channel is locked, which can also be understood as determining that the AM is identified.
  • matching the AM with preset AM locking information may include: determining that the first AM code block of the AM satisfies a preset rule.
  • the preset rule may include: matching the 12 nibbles in the first AM code block with the preset AM locking information, and the number of matched nibbles is greater than the preset matching number, or in other words, non-matching The number of nibbles is less than the preset number of mismatches.
  • the preset number of mismatches in the preset rule may be 3.
  • a possible implementation mode is also provided in the follow-up.
  • the receiver can perform AM locking based on the first AM code block.
  • the preset rule in the preset rule can be The number of mismatches can be adjusted, for example, it can be adjusted down to 1. This plan will be described in detail in the following content, and will not be elaborated here.
  • the identification information field of the first AM code block in the AM on the FEC channel with a transmission rate of 100Gbps is called the AM lock information field
  • the information carried by the AM lock information field includes at least AM lock information.
  • the AM locking information field in the first AM in the first ciphertext data stream is called the first AM locking information field
  • the AM locking information field in the second AM in the first plaintext data stream is called It is called the second AM lock information field.
  • the AM lock information field in AM in FEC lane 0 may also include the identification field in amp_tx_16.
  • the AM lock information field in the AM in FEC channel 1 may also include the identification field in amp_tx_17.
  • the AM lock information field in AM in FEC lane 2 may also include the identification field in amp_tx_18.
  • the AM lock information field in AM in FEC lane 3 may also include the identification field in amp_tx_19.
  • the channel identification information field in the AM of FEC channel 0 may include the identification field of at least one of amp_tx_4, amp_tx_8 and amp_tx_12, and Figure 3c shows that the channel identification information field includes the identification field in amp_tx_4 , which will be described in detail below in conjunction with FIG. 3c.
  • the information carried in the 3 identification fields of the 3 AM code blocks in amp_tx_4, amp_tx_8 and amp_tx_12 can be jointly used to indicate the channel identification information of FEC channel 0.
  • the channel identification information field in AM in FEC channel 0 may refer to the three identification fields in the three AM code blocks in amp_tx_4, amp_tx_8 and amp_tx_12.
  • the channel identification information field in AM in FEC channel 1 may refer to the three identification fields in the three AM code blocks in amp_tx_5, amp_tx_9 and amp_tx_13.
  • the channel identification information field in AM in FEC channel 2 may refer to the three identification fields in the three AM code blocks in amp_tx_6, amp_tx_10 and amp_tx_14.
  • the channel identification information field in AM in FEC channel 3 may refer to the three identification fields in the three AM code blocks in amp_tx_7, amp_tx_11 and amp_tx_15.
  • the identification field of an AM code block may include M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field and ⁇ M2 field in FIG. 3a.
  • the channel identification information of any two logical channels is different.
  • the channel identification information of FEC channel 0 (the information carried by all identification fields in amp_tx_4, amp_tx_8 and amp_tx_12) and the channel identification information of FEC channel 1 (the information in amp_tx_5, amp_tx_9 and amp_tx_13) The information carried by all identification fields) has at least one bit with a different value.
  • the channel identification information field in the first AM in the first ciphertext data stream is called the first channel identification information field
  • the channel identification information field in the second AM is called the second channel Identify information fields.
  • the check information field in the AM may include a check field in at least one AM code block included in the AM.
  • the check information field in AM may include the check field in amp_tx_0 as an example.
  • the check information field in the first AM in the first ciphertext data stream is called the first check information field
  • the check information field in the second AM is called the second check information field. verification information field.
  • Figure 3d exemplarily shows the format of the AM on the logical channel with a transmission rate of 50Gbps, as shown in Figure 3d, N can be 2, 2 logical channels, wherein one AM in FEC channel 0 includes amp_tx_0 and amp_tx_2, FEC lane 0 may also include bit 56 and bit 57 of amp_tx_3 (the first bit of amp_tx_3 is referred to as bit 0).
  • One AM in FEC channel 1 includes amp_tx_1 and amp_tx_3.
  • FEC lane 1 includes bits 0 to 55 of amp_tx_3, and bits 58 and 63 of amp_tx_3.
  • FEC channel 0 and FEC channel 1 may also include 1-bit pad (1-bit Pad) respectively, and 4 AM code blocks of one FEC channel have 256 bits.
  • the size of the data part of an RS-FEC code word is 5140 bits, so the AM code block can be made into integer multiples of 257.
  • a 1-bit pad is added to one FEC channel, so that one AM of one FEC channel can be made into an integer multiple of a 257-bit code block.
  • Each of amp_tx_0, amp_tx_1, amp_tx_2 and amp_tx_3 in the 4 FEC channels can be an AM code block, and its structure can refer to the AM code block shown in Figure 3a.
  • FIG. 3e exemplarily shows a schematic diagram of the corresponding relationship between amp_tx_0 and amp_tx_1 in AM of FEC channel 0 and AM code blocks. AM will be introduced in conjunction with FIG. 3d and FIG. 3e below.
  • the lock information field in the AM of FEC channel 0 may include the identification field in amp_tx_0.
  • the lock information field in the AM of FEC lane 1 may include the identification field in amp_tx_1.
  • the identification fields in amp_tx_0 and amp_tx_1 carry the same information, which may be a preset value, such as preset AM locking information.
  • the receiving end may perform AM locking based on the information carried in the identification field of the first AM code block of the AM of the logical channel.
  • the channel identification information field in AM of FEC channel 0 may include the identification field in amp_tx_2.
  • the channel identification information field in AM of FEC channel 1 may include the identification field in amp_tx_3.
  • the channel identification information of any two logical channels is different. For example, there is at least The value of one bit is different.
  • the check information field in the AM may include a check field in at least one AM code block included in the AM.
  • the check information field in AM may include the check field in amp_tx_0 as an example.
  • Figure 3f exemplarily shows the format of AM on a logical channel with a transmission rate of 25Gbps, as shown in Figure 3f, N can be 1, that is, only one logical channel is included, and this logical channel can be called an FEC channel, wherein, One AM of the logical channel includes AM0, AM1, AM2 and AM3.
  • Each of AM0, AM1, AM2 and AM3 may be an AM code block, and its structure may refer to the AM code block shown in FIG. 3a.
  • FIG. 3g exemplarily shows a schematic diagram of the corresponding relationship between AM0 and AM1 in AM and AM code blocks. AM will be introduced in conjunction with FIG. 3f and FIG. 3g below.
  • the lock information field in AM may include the identification field in AMO.
  • the information carried by the identification field in AMO may be a preset value, such as preset AM locking information.
  • the receiving end may perform AM locking based on the information carried in the identification field of the first AM code block (AM0) of the AM of the logical channel.
  • AM0 first AM code block
  • the channel identification information field in AM may include an identification field in at least one of AM1, AM2 and AM3.
  • the channel identification information field includes the identification field in AM1 as an example.
  • the check information field in the AM may include a check field in at least one AM code block included in the AM.
  • the check information field in AM may include the check field in AMO as an example.
  • the encryption parameter information in this embodiment of the application may be deployed in one or more AMs. It can also be understood that the encryption parameter information can be carried in one AM included in one AM cycle, or can be carried in multiple AMs included in multiple AM cycles.
  • the encryption parameter may be used to encrypt the data segment in the AM cycle where the encryption parameter is located.
  • the encryption parameter may be used to encrypt data segments in other AM periods (AM periods other than the AM period in which the encryption parameter is located).
  • the encryption parameters in this embodiment of the present application may include a key identifier and an initialization vector identifier.
  • the key identifier indicates the encryption key used to encrypt the data segment.
  • the initialization vector IV identifier indicates the initialization vector used for encrypting the data segment.
  • FIG. 4a exemplarily shows a schematic flowchart of a data transmission method provided by an embodiment of the present application.
  • the method can be executed by the first communication device and the second communication device or modules or chips in the first communication device and the second communication device.
  • the method includes:
  • the first communication device acquires a first ciphertext data stream.
  • the first ciphertext data stream includes a first alignment identifier AM and an encrypted first data segment; the first AM is used for data alignment of the first ciphertext data stream.
  • the first AM includes at least one of a first AM locking information field, a first channel identification information field, or a first verification information field. Wherein, at least one of some of the bits in the first AM lock information field, some of the bits in the first channel identification information field, or some or all of the bits in the first verification information field is used to carry: the first data Encryption parameter information for the segment.
  • the first communication device sends the first ciphertext data stream to the second communication device.
  • the second communication device acquires the first ciphertext data stream.
  • the second communication device decrypts the encrypted first data segment according to the encryption parameter information carried by the first AM in the first ciphertext data stream, to obtain an unencrypted first data segment in the first plaintext data stream.
  • S405 may also be included:
  • the second communication device processes the first AM in the first ciphertext data stream to obtain the second AM in the first plaintext data stream.
  • the first communication device may obtain N channels of ciphertext data streams, where N is a positive integer.
  • the first communication device may send N channels of ciphertext data streams.
  • the second communication device may acquire N channels of ciphertext data streams.
  • the second communication device may restore N channels of ciphertext data streams to N channels of plaintext data streams.
  • the first ciphertext data stream is one ciphertext data stream among the N ciphertext data streams.
  • the first plaintext data stream is one plaintext data stream in the N plaintext data streams.
  • the first ciphertext data stream corresponds to the first plaintext data stream.
  • each of the N ciphertext data streams may be separately encrypted and decrypted, and there may be no correlation between the encryption parameters of any two ciphertext data streams.
  • N in this embodiment of the present application may be a positive integer greater than 1, and the processing methods of other ciphertext data streams in the N ciphertext data streams may refer to the processing method of the first ciphertext data stream, and details are not repeated here.
  • the present application transmits the encryption parameter information through the bits in the existing alignment data unit in the data stream, and does not add additional bits for transmitting the encryption parameter information, so the transmission of the encryption parameter information does not occupy user service bandwidth.
  • the application encrypts and transmits data streams (or called bit streams) in the physical layer, all bits (including source MAC address and destination MAC address) in the Ethernet frame can be encrypted, thereby improving safety.
  • the encryption parameters of the logical channel can be transmitted separately for each logical channel, that is, the encryption and decryption process of each logical channel is not related, and the encryption of the data stream can be extracted from the data stream transmitted by a logical channel. parameter, and decrypt the data flow of the logical channel.
  • the solution in this embodiment of the present application may basically have no impact on the upper layer MAC.
  • the first communication device may acquire N channels of plaintext data streams. According to the encryption parameters corresponding to the data segments in the N plaintext data streams, N ciphertext data streams are obtained.
  • the first plaintext data stream is one plaintext data stream in the N plaintext data streams.
  • the first ciphertext data stream is one ciphertext data stream corresponding to the first plaintext data stream among the N ciphertext data streams.
  • the first plaintext data stream includes at least two second AMs and at least one unencrypted first data segment. At least two second AMs are used for data alignment of N plaintext data streams.
  • Fig. 4b exemplarily shows a schematic flowchart of another data transmission method provided by the embodiment of the present application.
  • FIG. 4 b it is shown by taking the first communication device as an optical module or a module or unit in the optical module as an example.
  • the first communication device obtains M physical channel signals, and sends the M physical channel signals (physical channel 0 to physical channel M-1 in the figure) through BitMux according to a set ratio such as M:N.
  • the BitMux (A) of the corresponding signal is converted into N logic channel signals (FEC channel 0 to FEC channel (N-1) in the figure).
  • the first communication device searches for the AM in the logical channel, and locks it within a specified interval (different rate Ethernet MAC/PHY, AM interval can be different).
  • the N logical channel signals include plaintext data, and the N logical channel signals may also be referred to as N plaintext data streams.
  • the MCU can encrypt the unencrypted first data segment in the first plaintext data stream to obtain the encrypted data segment in the first ciphertext data stream. first data segment.
  • encryption parameter information may be inserted into the second AM in the first plaintext data stream to obtain the second AM in the first ciphertext data stream.
  • N channels of ciphertext data streams are converted into K channels of digital signals that can be input to oDSP through BitMux(B) in the BitMux.
  • the first communication device may aggregate multiple ciphertext data streams (including encrypted data segments, encryption parameter information, etc.) of multiple PCS channels into one serial code block
  • RS-FEC encoding (RS-FEC Encode) can be performed on the serial code block stream, and then N encrypted signals corresponding to N FEC channels are formed, and N encrypted signals are sent to the second communication device.
  • the receiving end can perform RS-FEC decoding on the received signal, so that RS-FEC can be used to correct bit errors caused by the link.
  • the RS-FEC coding can be understood as the RS-FEC coding of the Ethernet architecture.
  • the encryption parameter information in the embodiment of the present application may also include an RS-FEC code, and the RS-FEC code is used to correct possible code errors in the encryption parameter information.
  • the MCU can configure and update the encryption parameter information required by the encryption module.
  • the encryption parameter information includes encryption key parameters, such as initialization vector IV and key identification.
  • corresponding functional modules such as an AM locking module and an encryption/decryption module may also be deployed in the BitMux of the first communication device.
  • an AM locking module and an encryption/decryption module may be separately deployed for each logical channel.
  • the AM locking module can be used to insert the encryption parameter information into the AM in the plaintext data stream
  • the encryption/decryption module can be used to encrypt the plaintext data stream based on the encryption parameters ( Encryption), to get the ciphertext data stream.
  • the MCU can configure the IV when it is started for the first time, and then the encryption/decryption module automatically updates the IV according to the set rules. MCU configures and modifies the key ID.
  • the AM locking module can be responsible for locking the AM in the logical channel, and use the locked AM to carry the latest encryption parameters.
  • the second AM in the first plaintext data stream can be processed to obtain the first AM in the first ciphertext data stream.
  • the first communication device may lock some of the bits in the second AM information field, some of the bits in the second channel identification information field, or some or all of the bits in the second verification information field of the second AM. At least one of them bears: encryption parameter information of at least one first data segment, so as to obtain the first AM in the first ciphertext data stream.
  • the second AM in the first plaintext data stream and the first AM in the first ciphertext data stream are used as examples for introduction.
  • the first AM is processed by the second AM (for example, in obtained after adding encryption parameter information to the second AM. It can also be said that the first AM corresponds to the second AM.
  • the information carried in the second AM lock information field is the same as the information carried in the first AM lock information field.
  • the information carried in the first AM lock information field is obtained through the second AM lock information field It is obtained after replacing part of the bit-carried information in , with part or all of the encryption parameter information.
  • the first plaintext data stream is the data stream corresponding to FEC channel 0 in FIG. 3 b
  • the structure of the second AM is as shown in FIG. 3 c .
  • the second AM locking information field may be the AM locking information field in FIG. 3c, specifically the identification field in amp_tx_0.
  • the second AM lock information field is used to carry AM lock information of the first plaintext data stream.
  • the first AM locking information field in the first AM obtained by processing the second AM may also be the AM locking information field in FIG. 3 c , specifically, the identification field in amp_tx_0.
  • the bits used to carry the encryption parameter information in the first AM lock information field are some of the bits in the following fields: M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field and ⁇ M2 field.
  • the first AM lock information field may include an identification field in amp_tx_0.
  • the identification field in amp_tx_16 is used for AM locking in a low power consumption scenario, and the first AM locking information field in the embodiment of the present application may not include the identification field in amp_tx_16.
  • the first AM lock information field at a transmission rate of 50 Gbps may include only the identification field in amp_tx_0 (see FIG. 3e ).
  • the encryption parameter information can be carried by the bits originally used to carry the AM locking information in the second AM locking information field.
  • the first communication device can embezzle 8 bits from the first AM locking information field for Carries encrypted parameter information.
  • the receiving end can cooperate with the matching rule proposed in this application to perform AM locking, so as not to affect the AM locking performance as much as possible.
  • the bit used to carry the encryption parameter information in the first AM lock information field is one of the following:
  • Figure 5a exemplarily shows a schematic diagram of bits that can be used to carry encryption parameter information in the AM of Figure 3c.
  • the bits used to carry encryption parameter information in the first AM lock information field are 4 bits, and bits in the first 4 bits of the ⁇ M1 field.
  • the first AM in order to ensure 0/1 balance, for at least two first AMs that carry at least one first data segment in the encryption parameter information part or all of the first AM: the first AM
  • the carried information belonging to the encryption parameter information is divided into two parts, namely the first part of information and the second part of information, and the second part of information is information obtained by reversing the bit value corresponding to the first part of information.
  • the first communication device may carry a part of original encryption parameter information on each of the first AM lock information field, the first channel identification information field, and the first verification information field, and also carry Inverted information of the original encrypted parameter information.
  • the information belonging to the encryption parameter information carried in the first AM lock information field is divided into two parts, namely the third part of information and the fourth part of information, and the fourth part of information is based on the bits corresponding to the third part of information The information obtained by inverting the value.
  • the first 4 bits of the M1 field can be used to carry 4 bits of information in the original encryption parameter information, and the first 4 bits of the ⁇ M1 field can carry the inverse value of the first 4 bits of the M1 field. For example, if the value of the 0th bit in the first 4 bits of the M1 field is 0, then the value of the 0th bit in the first 4 bits of the ⁇ M1 field is 1. For another example, if the value of the 0th bit in the first 4 bits of the M1 field is 1, then the value of the 0th bit in the first 4 bits of the ⁇ M1 field is 0.
  • Figure 5a is just an example.
  • a part of the information of the original encryption parameters can be carried in the M1 field.
  • the first 4 bits and the first 4 bits of the ⁇ M1 field, and then the ⁇ BIP 3 field carries the inverted value of all the bit values of the first 4 bits of the M1 field and the first 4 bits of the ⁇ M1 field.
  • the first 4 bits of the M1 field may carry original encryption parameter information
  • the first 4 bits of the M1 field may carry the inverted value of the first 4 bits of the M1 field.
  • the second communication device when the second communication device is processing the second AM, if some bits in the first AM lock information field carry encryption parameter information, the second communication device may, in S405 , restoring the value of the bit carrying the encryption parameter information in the first AM lock information field to a second preset value.
  • the second preset value is the value carried by the corresponding bits in the second AM locking information field of the second AM corresponding to the first AM (for example, the first 4 bits of the M1 field, and ⁇ the first 4 bits of the M1 field).
  • the second preset value can also be understood as the original value stipulated in the agreement. It can be seen that in the embodiment of the present application, the content of the first AM lock information field can be restored to the original value without identifying the logical channel identifier of the first ciphertext data stream.
  • the second verification information field is used to carry verification information of the first plaintext data stream.
  • the information carried in the second verification information field is the same as the information carried in the first verification information field.
  • the information carried in the first verification information field is obtained through the second verification information field It is obtained after replacing part of the bit-carried information in , with part or all of the encryption parameter information.
  • the first plaintext data stream is the data stream corresponding to FEC channel 0 in FIG. 3 b
  • the structure of the second AM is as shown in FIG. 3 c .
  • the second check information field may be the check information field in FIG. 3c, specifically, it may be the check field in amp_tx_0, and may also include check fields in other AM code blocks.
  • the second check information field is the check field in the first AM code block in the AM as an example.
  • the first check information field in the first AM obtained by processing the second AM may also be the check information field in FIG. 5a , specifically, the check information field in amp_tx_0.
  • the bits used to carry the encryption parameter information in the first verification information field are part or all of the bits in the following fields: BIP 3 field or ⁇ BIP 3 field.
  • the bits used to carry the encryption parameter information in the first verification information field may include bits in the first 4 bits of the ⁇ BIP 3 field and the bits in the last 4 bits of the ⁇ BIP 3 field.
  • the information belonging to the encryption parameter information carried in the first verification information field is divided into two parts, which are the seventh part of information and the eighth part of information, And the eighth part of information is information obtained by inverting the bit value corresponding to the seventh part of information.
  • the first 4 bits of the ⁇ BIP 3 field can be used to carry the 4-bit information in the original encryption parameter information
  • the last 4 bits of the ⁇ BIP 3 field can carry the inverse value of the first 4 bits of the M1 field .
  • the value of the 0th bit in the first 4 bits of the ⁇ BIP 3 field is 0, then the value of the 0th bit in the last 4 bits of the ⁇ BIP 3 field may be 1.
  • the value of the 0th bit in the first 4 bits of the ⁇ BIP 3 field is 1, then the value of the 0th bit in the last 4 bits of the ⁇ BIP 3 field may be 0.
  • Fig. 5a is only an example, and there are many possible implementation manners for specifically placing the information of the original encryption parameters and the information after the inversion of the information of the original encryption parameters.
  • the second communication device may, in S405, set the first The value of the bit carrying the encryption parameter information in the verification information field is restored.
  • the first verification information carried in the first verification information field for example, the information carried in the BIP 3 field is called the first verification information
  • the information used to carry the encryption parameter information in the first verification information field is The information on the bits ( ⁇ 8 bits of the BIP 3 field) is restored to information obtained by inverting the bit value (the 8 bits of the BIP 3 field) corresponding to the first check information.
  • the content of the first verification information field can be restored to the original value without identifying the logical channel identifier of the first ciphertext data stream.
  • the recovery error of the ⁇ BIP 3 field will be caused, and then the error correction performance of the RS-FEC code under the Ethernet architecture will be affected.
  • the probability of bit errors in the BIP 3 field is small, so in the embodiment of the present application, the ⁇ BIP 3 field is used to carry the encryption parameter information, which has little impact on the error correction performance of the RS-FEC code under the Ethernet architecture.
  • the second channel identification information field of the first AM does not carry encryption parameter information, that is, all bits of the first channel identification information field are used to carry the channel identification information of the first ciphertext data stream
  • the second channel identification information field The information carried is the same as the information carried in the first channel identification information field.
  • the information carried in the first channel identification information field is passed to the second channel identification information field It is obtained after replacing part of the bit-carried information in , with part or all of the encryption parameter information.
  • the first plaintext data stream is the data stream corresponding to FEC channel 0 in FIG. 3 b
  • the structure of the second AM is as shown in FIG. 3 c .
  • the second channel identification information field may be the channel identification information field in FIG. 3c, specifically, the identification field in amp_tx_4.
  • the second channel identification information field is used to carry channel identification information of the first plaintext data stream.
  • the first channel identification information field in the first AM obtained by processing the second AM may also be the channel identification information field in FIG. 5a , specifically, the identification field in amp_tx_4.
  • the bits used to carry the encryption parameter information in the first channel identification information field are some of the bits in the following fields: M0 field, M1 field, M2 field, ⁇ M0 field, ⁇ M1 field and ⁇ M2 field.
  • the first channel identification information field may include the identification field in amp_tx_4.
  • the bits used to carry the encryption parameter information in the first channel identification information field are: some or all of the k1 bits in the first channel identification information field.
  • the k1 bits are used to carry k1 preset values.
  • k1 is a positive integer.
  • the default value is a fixed value. In this way, the receiving end can restore the value of the k1 bits embezzled to carry the encrypted parameter information to the preset value according to relevant regulations, thereby reducing the impact on the identification process of the channel identification information.
  • the channel identification information field in the AM of each logical channel includes the k1 preset values. That is, although the channel identification information carried by the channel identification information fields of any two logical channels is different, both of the two channel identification information fields include the k1 preset values.
  • the N plaintext data streams further include a second plaintext data stream, and the second plaintext data stream includes at least two third AMs.
  • the third AM of the at least two third AMs includes a third channel identification information field carrying channel identification information of the second plaintext data stream, and the third channel identification information field includes k1 carrying k1 first preset values Bits.
  • the sequence of the bits carrying the preset value in all the bits of the third channel identification information field is different from the order of the bits carrying the preset value
  • the ordering of all bits in the second channel identification information field is the same. That is to say, the positions of the k1 bits used to carry the k1 first preset values in the channel identification information fields of the two logical channels are the same.
  • the bits used to carry the encryption parameter information in the first channel identification information field are part of the following bits in the AM code block corresponding to the first channel identification information field or all:
  • the 8 bits of the AM code block are the aforementioned k1 bits. It should be stated that the ordering of the above code blocks is named on the premise that the first bit in the AM code block is called the 0th bit.
  • Figure 5a exemplarily shows a schematic diagram of bits in the AM of Figure 3c that can be used to carry encryption parameter information.
  • the bit used to carry encryption parameter information in the first channel identification information field is the AM of amp_tx_4
  • the 4th bit located in the M0 field
  • the 13th bit located in the M1 field
  • the 15th bit located in the M1 field
  • the 20th bit located in the M2 field
  • the 36th bit in the code block bit located in ⁇ M0 field
  • 45th bit located in ⁇ M1 field
  • 47th bit located in ⁇ M1 field
  • 52nd bit located in ⁇ M2 field.
  • amp_tx_4, amp_tx_5, amp_tx_6, and amp_tx_7 have 8 common bits (k1 bits), and the value of these common bits (k1 bits) is 10000111.
  • amp_tx_2 and amp_tx_3 also have 8 common bits (k1 bits), and the value of these common bits (k1 bits) is 01011010.
  • k1 preset values carried by k1 bits in AM are: 10100101.
  • the receiving end can restore the value of the k1 bits of the channel identification information field in the first AM to k1 preset values based on the k1 preset values, so as to avoid other data processing processes at the receiving end, such as avoiding The impact on the RS-FEC code error correction process under the Ethernet architecture.
  • the information belonging to the encryption parameter information carried in the first channel identification information field is divided into two parts, namely the fifth part of information and the sixth part of information, And the sixth part of information is obtained by reversing the bit value corresponding to the fifth part of information.
  • the 4th bit in the AM code block of amp_tx_4 (located in the M0 field) can be used to carry 1-bit information in the original encryption parameter information, and the 36th bit in the AM code block of amp_tx_4 bit (located in the ⁇ M0 field) can carry the inverse value of the value of the 4th bit.
  • the 13th bit in the AM code block of amp_tx_4 (located in the M1 field) can be used to carry 1-bit information in the original encryption parameter information, and the 45th bit in the AM code block of amp_tx_4 (located in the ⁇ M1 field ) can carry the inverse value of the 13th bit.
  • the 15th bit in the AM code block of amp_tx_4 (located in the M1 field) can be used to carry 1 bit of information in the original encryption parameter information, and the 47th bit in the AM code block of amp_tx_4 (located in the ⁇ M1 field ) can carry the inverse value of the 15th bit.
  • the 20th bit in the AM code block of amp_tx_4 (located in the M2 field) can be used to carry the 1-bit information in the original encryption parameter information, and the 52nd bit in the AM code block of amp_tx_4 (located in the ⁇ M2 field ) can carry the inverse value of the 20th bit.
  • Figure 5a is just an example.
  • a part of the information of the original encryption parameters can be carried in M1
  • the first 4 bits of the field and the first 4 bits of the ⁇ M1 field, and then the k1 bits in the first channel identification information field carry the inverted value of all the bit values of the first 4 bits of the M1 field and the first 4 bits of the ⁇ M1 field.
  • the second communication device when the second communication device is processing the second AM, if some bits in the first channel identification information field carry encryption parameter information, the second communication device may in S405 , restoring the value of the bit carrying the encryption parameter information in the first channel identification information field to the first preset value.
  • the first preset value is a value carried by k1 bits in the second channel identification information field of the second AM corresponding to the first AM.
  • the first preset value can also be understood as the original value stipulated by the agreement. It can be seen that in the embodiment of the present application, the content of the first channel identification information field can be restored to the original value without identifying the logical channel identification of the first ciphertext data stream.
  • the above content uses the 100Gbps transmission rate as an example to introduce the distribution of bits used to carry encryption parameter information in AM
  • the distribution of bits used to carry encryption parameter information in AM at other transmission rates can be seen in Figure 5a
  • the bits used to carry encryption parameter information can be distributed on the AM code blocks corresponding to amp_tx_0 and amp_tx_2 (see Figure 3e), wherein, in the transmission rate of 50Gbps, the bits of FEC channel 0
  • the structural form of amp_tx_0 in AM in the ciphertext data stream refer to the structural form of amp_tx_0 in Figure 5a
  • the structural form of amp_tx_2 refer to the structural form of amp_tx_4 in Figure 5a, which will not be repeated here.
  • the bits used to carry encryption parameter information in AM at a transmission rate of 25Gbps can be distributed on the AM code blocks corresponding to AM0 and AM1 (see Figure 3g), where the ciphertext data flow of the logical channel at a transmission rate of 25Gbps
  • AMO in AM in refer to the structural form of amp_tx_0 in FIG. 5 a
  • AM1 refer to the structural form of amp_tx_4 in FIG. 5 a , which will not be repeated here.
  • Fig. 5b exemplarily shows a schematic structural diagram of a multiframe of encryption parameter information carried in the first ciphertext data stream provided by the embodiment of the present application.
  • the first ciphertext data stream includes a plurality of first AM Set, for a first AM set, the first AM set may include L first AMs, where L is a positive integer.
  • 24 bits in each first AM can be used to carry the encryption parameter information, 12 bits of which can carry the original encryption parameter information, and the remaining 12 bits are used to carry the information carried in the first AM.
  • 12 bits of encryption parameter information can be placed in a first AM.
  • the multiframe may include the following items 3 and 5.
  • the multiframe may also include one or more of other items (items other than item 3 and item 5) in the following content:
  • Multiframe start identification information where the multiframe start identification information is used to indicate the start bit of a multiframe carrying encryption parameter information.
  • the value "10" of 2 bits can be used to indicate the start of a multiframe, repeated 6 times, occupying 12 bits, and the remaining 12 bits in the first AM can be the inversion of the value of the occupied 12 bits.
  • the binary value of the first 4 bits of M1 in the first AM used to carry the multiframe start identification information is "1010”
  • the value of the first 4 bits of ⁇ BIP 3 is "1010”
  • the binary value of the first 4 bits of ⁇ BIP 3 is "0101”
  • the value of the last 4 bits of ⁇ BIP 3 is "0101”.
  • the first 4 bits are "1010"
  • the last 4 bits are "0101".
  • the multiframe locking state identification information is used to indicate whether the multiframe of the sending end and/or the receiving end is locked. For example, if the start identification information of two consecutive multiframes matches a predefined pattern (that is, "10"), it indicates that the multiframe is locked. If the start identification information of three consecutive multiframes does not match the predefined pattern (ie "10"), it indicates that the multiframe is not locked.
  • the first communication device may select the first AM next to the first AM carrying the multiframe start identification information, and use 2 bits on the first AM to indicate the locking state of the sending end and/or the receiving multiframe. For example: 01 indicates that the local multiframe is not locked; 11 indicates that the local multiframe is locked and waits for the remote multiframe to be locked; 10 indicates that the local multiframe is locked and the remote multiframe is locked.
  • the first communication device may select the first AM next to the first AM carrying the multiframe start identification information, and use 2 bit values of "10" and "01" on the first AM to represent the key identification. If the key identifier changes from “10” to "01”, or from “01” to "10", it can indicate that a new encryption key will be used in the next multiframe period.
  • AES-GCM Advanced Encryption Standard Galois/Counter Mode
  • the error correction information of encrypted parameter information can be RS-FEC code
  • RS-FEC code can better cope with burst errors, and can effectively resist the impact of link errors on the transmission reliability of encrypted parameters.
  • the error correction information of the encrypted parameter information can be RS-FEC code (RS-FEC(57, 33, 12, 2 ⁇ 8)), which is defined on the finite field GF(2 ⁇ 8), and one symbol is 8 bits, Among them, 33 is the length of the data symbol. By adding 24 check symbols, a code word with a length of 57 symbols is formed, and it can correct any 12 symbols in the code word.
  • the RS-FEC code is used to correct the information in the multiframe of the encrypted parameter information, which can ensure the reliability of the universe year and effectively resist the influence of link errors on the transmission reliability of encrypted parameters.
  • the error correction information of the encrypted parameter information may also be a BCH code, and the BCH code is taken from the abbreviation of Bose, Ray-Chaudhuri and Hocquenghem.
  • the BCH code can better deal with random bit errors, and can effectively resist the influence of link bit errors on the transmission reliability of encryption parameters.
  • the second communication device may obtain the error correction information of the encryption parameter information in the first ciphertext data stream, and modify the encryption parameter information according to the error correction information of the encryption parameter information. other information in the message for error correction. In this way, it can effectively resist the impact of link errors on the transmission reliability of encryption parameters.
  • the encryption parameter information in the embodiment of the present application may not include the integrity check value ICV, thereby reducing the time delay and power consumption overhead caused by calculating the ICV.
  • the encryption parameter information carried in the first AM set may be the encryption parameter information of the first data segment included in the first AM set, or it may be the first data segment included in other first AM sets
  • the encryption parameter information, for example, the encryption parameter information carried in the first AM set is the encryption parameter information of the first data segment included in the next first AM set.
  • FIG. 6 exemplarily shows a schematic flowchart of another data transmission method provided by the embodiment of the present application.
  • the second communication device is shown by taking the second communication device as an optical module or a module or unit in the optical module as an example.
  • the decryption scheme in the embodiment of the present application can be specifically deployed in the BitMux of the optical module, and the MCU can control the process of converting multiple logical channel signals in the BitMux to decrypt the data.
  • the optical signal received by the second communication device is restored to K channels of digital signals through the oDSP, and BitMux(B) in the BitMux can convert the K digital signals into N channels of ciphertext data streams.
  • the second communication device can perform AM search on the N ciphertext data streams respectively, and can perform AM locking within a specified interval (different rate Ethernet MAC/PHY, different AM intervals).
  • the data segment in the ciphertext data flow is decrypted, and the value on the bit that carries the encryption parameter information in the second AM in the ciphertext data flow is restored (such as recovering as the second AM in the plaintext data flow), Obtain N plaintext data streams. Then identify the channel identification information of each plaintext data stream in the N plaintext data streams according to the second AM in the N plaintext data streams.
  • the AM locking module deployed in BitMux can be used to lock N channels of ciphertext data streams
  • the encryption/decryption module deployed in BitMux can be used to decrypt N channels of ciphertext data streams to obtain N channels of plaintext data streams.
  • N channels of plaintext data streams or N channels of logical channel signals (such as FEC channel 0 to FEC channel (N-1) in the figure)
  • BitMux(A) in BitMux can be set according to the ratio M:N, and the N channels Logical channel signals are restored to M physical channel signals (physical channel 0 to physical channel M-1 in the figure).
  • the optical module transmits the signals of the M physical channels to the electrical chip of the physical layer.
  • the second communication device may respectively decrypt and decrypt the N encrypted data streams of the multiple logical channels.
  • Restoring the first AM (reverting the first AM to the second AM), obtains plaintext data streams of N FEC channels.
  • the signals of N FEC channels are aggregated into one serial signal stream, and then RS-FEC decoding (RS-FECDecode) is performed on the one serial signal stream.
  • RS-FECDecode RS-FEC decoding
  • the receiving end can perform RS-FEC decoding on the received signal, so that RS-FEC can be used to correct bit errors caused by the link.
  • the RS-FEC decoding can be understood as the RS-FEC decoding of the Ethernet architecture.
  • the encryption parameter information in the embodiment of the present application may also include an RS-FEC code, and the RS-FEC code is used to correct possible code errors in the encryption parameter information.
  • the second communication device may further perform AM locking on the first ciphertext data stream.
  • the second communication device determines that there are at least k2 consecutive first AMs in the first ciphertext data stream that satisfy the preset rule, then it is determined that the first ciphertext data
  • the stream completes the AM lock; k2 is an integer greater than 1. For example, k2 can take a value of 2.
  • the first AM among the at least k2 first AMs satisfying the preset rule includes: the information carried by some bits in the first AM lock information field of the first AM includes part or all of the encryption parameter information , there are at most k3 nibble (nibble) mismatches between the information carried in the first AM lock information field except the information belonging to the encryption parameter and the preset AM lock information.
  • the value of k3 may be less than 3.
  • the value of k3 is inversely correlated with the number of bits used to carry the encryption parameter information in the first AM lock information field. For example, when the number of bits used to carry the encryption parameter information in the first AM lock information field is 8, the value of k3 is 1.
  • the preset AM locking information in this embodiment of the present application may refer to the information used for AM locking in the AM specified by the protocol, such as the first one of each logical channel in FEC channel 0 to FEC channel 3 shown in Figure 3b Information carried by the AM lock information field in the AM code block.
  • the first AM lock information field in the first plaintext data stream includes 48 bits, it can be divided into 12 nibbles (nibbles), and a matching rule is: when the 12 nibbles (nibbles) match the preset When the number of nibbles (nibbles) that do not match the AM locking information is less than or equal to 3, the AM is considered to match.
  • some bits in the second AM locking information field are used to carry the encryption parameter information, for example, 8 bits are used to carry the encryption parameter information, and the remaining 40 bits are used to carry the AM locking information.
  • the embodiment of the present application proposes An AM matching rule, that is, when there is at most 1 nibble (nibble) mismatch between the information carried in the first AM lock information field except the encryption parameter information and the preset AM lock information , it is considered that AM matches. If two consecutive AMs match, it is considered that AM locking is completed.
  • the first 4 bits of the M1 field and the first 4 bits of the ⁇ M1 field of the first AM lock information field carry encryption parameter information
  • the second communication device can use the first AM in the first AM
  • the bits (40 bits) other than the encryption parameter information in the information carried by the locking information field are compared with the 40 bits of the corresponding positions in the 4 AMs corresponding to the 4 logical channels in Figure 3b, and when it is determined In the information carried by the first AM lock information field, the 40 bits other than the encryption parameter information match the AM of a certain logical channel in Figure 3b, such as the 40 bits of FEC channel 0 (the M0 field of FEC channel
  • the 8 bits of the M1 field, the last 4 bits of the M1 field, the 8 bits of the M2 field, the 8 bits of the ⁇ M0 field, the last 4 bits of the ⁇ M1 field, and the 8 bits of the ⁇ M2 field, a total of 40 bits) are completely consistent (or there is at most 1 nibbles
  • Fig. 7a exemplarily shows schematic diagrams of mean time to loss alignment (MTTLA) and mean time to alignment (MTTA) in five cases, the five cases are respectively:
  • Case a0 all 48 bits of the first AM locking information field are used to carry locking information.
  • the AM matching rule is: when it is determined that the number of nibbles (nibbles) in the first AM locking information field that do not match the preset AM locking information is not greater than 3, then the first AM matching is determined.
  • Case a1 40 bits of the first AM lock information field are used to carry AM lock information, and the remaining 8 bits are used to carry encryption parameter information.
  • the AM matching rule is: when it is determined that the 40-bit AM locking information in the first AM locking information field completely matches the preset AM locking information, then the first AM matching is determined.
  • Case a2 40 bits of the first AM lock information field are used to carry AM lock information, and the remaining 8 bits are used to carry encryption parameter information.
  • the AM matching rule is: when it is determined that the number of nibbles (nibbles) that do not match the preset AM locking information in the 40-bit AM locking information of the first AM locking information field is not greater than 1, then it is determined that the first AM matches.
  • Case a3 40 bits of the first AM lock information field are used to carry AM lock information, and the remaining 8 bits are used to carry encryption parameter information.
  • the rule of AM matching is: when it is determined that the number of nibbles (nibbles) that do not match the preset AM locking information in the 40-bit AM locking information of the first AM locking information field is not greater than 2, then it is determined that the first AM matches.
  • Case a4 40 bits of the first AM lock information field are used to carry AM lock information, and the remaining 8 bits are used to carry encryption parameter information.
  • the AM matching rule is: when it is determined that the number of nibbles (nibbles) that do not match the preset AM locking information in the 40-bit AM locking information of the first AM locking information field is not greater than 3, then it is determined that the first AM matches.
  • Table 1 below exemplarily shows the false locking performance evaluation table, and it can be seen from Table 1 that the case a1 and the case a2 meet the requirements. Based on this, in the embodiment of the present application, the AM matching rule in case a2 can be selected, so that the locking time, lock-out time, and false matching probability of the case a2 can be achieved to be equivalent to the standard matching method.
  • Figure 7b exemplarily shows the effect display diagram of the bit error rate after the error correction of the RS-FEC code of the Ethernet architecture of the case b0 and the case b1 (25Gbps transmission rate), as can be seen from Figure 7b, the post-correction error rate of the two The code rate is equivalent.
  • Figure 7c exemplarily shows the effect of the bit error rate after the error correction of the RS-FEC code of the Ethernet architecture under the situation b0 and the situation b2 (50Gbps transmission rate). The bit error rate is comparable.
  • Figure 7d exemplarily shows the effect of the bit error rate after error correction of the RS-FEC code of the Ethernet architecture under the situation b0 and the situation b3 (100Gbps transmission rate). The bit error rate is comparable.
  • the RS-FEC code of the Ethernet architecture is RS-FEC (528, 514) as an example for simulation.
  • the RS-FEC code of the Ethernet architecture is RS-FEC (544, 514) as an example for simulation.
  • the communication device includes hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software with reference to the units and method steps of each example described in the embodiments disclosed in the present application. Whether a certain function is executed by hardware or computer software drives the hardware depends on the specific application scenario and design constraints of the technical solution.
  • FIG. 8 , FIG. 9 and FIG. 10 are schematic structural diagrams of possible communication devices provided by embodiments of the present application. These communication devices can be used to implement the functions of the first communication device in the above method embodiments, and therefore can also achieve the beneficial effects of the above method embodiments. These communication devices can also be used to implement the functions of the second communication device in the above method embodiments, so the beneficial effects of the above method embodiments can also be realized.
  • the communication device may be the sending device or the first communication device as shown in Fig. 2a, Fig. 2b, Fig. 2c, Fig. 2d and Fig. 2e, or it may also be a communication device applied to the sending device or the first communication device A module (such as a chip) of a device.
  • the communication device may be the receiving end device or the second communication device as shown in Fig. 2a, Fig. 2b, Fig. 2c, Fig. 2d and Fig. 2e, or it may also be a communication device applied to the receiving end device or the second communication device A module (such as a chip) of a device.
  • a communication device 1300 includes a processing unit 1310 and a transceiver unit 1320 .
  • the communication device 1300 is configured to implement the function of the first communication device in the method embodiment shown in FIG. 4a above.
  • the processing unit 1310 is used to execute through the transceiver unit 1320: acquire the first ciphertext data stream, and send the first ciphertext data stream .
  • the first ciphertext data stream includes a first alignment identifier AM and an encrypted first data segment; the first AM is used for data alignment of the first ciphertext data stream.
  • the first AM includes at least one of a first AM locking information field, a first channel identification information field, or a first verification information field. Wherein, at least one of some of the bits in the first AM lock information field, some of the bits in the first channel identification information field, or some or all of the bits in the first verification information field is used to carry: the first data Encryption parameter information for the segment.
  • the field includes k1 bits carrying the first preset value.
  • a communication device 1300 includes a processing unit 1310 and a transceiver unit 1320 .
  • the communication device 1300 is configured to implement the function of the second communication device in the method embodiment shown in FIG. 4a above.
  • the processing unit 1310 is used to perform, through the transceiver unit 1320 , to obtain the first ciphertext data stream.
  • the first ciphertext data stream includes a first alignment identifier AM and an encrypted first data segment.
  • the first AM is used for data alignment of the first ciphertext data stream; the first AM includes at least one of the first AM lock information field, the first channel identification information field, or the first check information field.
  • At least one of some of the bits in the first AM lock information field, some of the bits in the first channel identification information field, or some or all of the bits in the first verification information field is used to carry: the first data Encryption parameter information for the segment.
  • the encrypted first data segment is decrypted to obtain the first plaintext data stream.
  • the processing unit 1310 is also used to execute through the transceiver unit 1320: there are at least k2 consecutive ciphertext data streams in the first ciphertext data stream
  • the first AM satisfies the preset rule, and it is determined that AM locking is completed on the first ciphertext data stream according to at least k2 first AMs; k2 is an integer greater than 1.
  • preset rules reference may be made to the relevant content of the previous method embodiments, which will not be repeated here.
  • the parameter information is used to decrypt the encrypted first data segment to obtain the unencrypted first data segment in the first plaintext data stream.
  • the first AM is processed to obtain the second AM in the first plaintext data stream.
  • the processing unit 1310 is specifically configured to execute through the transceiver unit 1320: determine the channel identifier of the first plaintext data stream according to the second AM information.
  • the processing unit 1310 is specifically configured to perform at least one of the following through the transceiver unit 1320:
  • the information on the bits used to carry the encryption parameter information in the first verification information field is restored to the inversion of the bit value corresponding to the first verification information Information.
  • the communication device 1300 When the communication device 1300 is used to realize the function of the second communication device in the method embodiment shown in FIG. Including a first ciphertext data flow and a second ciphertext data flow; wherein, the second ciphertext data flow includes a fourth AM and an encrypted second data segment; the fourth AM is used for data alignment of the second ciphertext data flow,
  • the fourth AM carries encryption parameter information of the second data segment.
  • the second data segment in the second ciphertext data stream is decrypted to obtain an unencrypted second data segment in the second plaintext data stream.
  • Process the fourth AM to obtain a third AM in the second plaintext data stream;
  • the third AM includes a third channel identification information field carrying channel identification information of the second plaintext data stream, and the third channel identification information field includes Carry k1 bits of the first preset value.
  • processing unit 1310 and the transceiver unit 1320 can be directly obtained by referring to the relevant descriptions in the method embodiment shown in FIG. 4a , and details are not repeated here.
  • the communication device 1400 includes a processing circuit 1410 and an interface circuit 1420 .
  • the processing circuit 1410 and the interface circuit 1420 are coupled to each other.
  • the interface circuit 1420 may be a transceiver or an input-output interface.
  • the communication device 1400 may further include a memory for storing instructions executed by the processing circuit, or storing input data required by the processing circuit 1410 to execute the instructions, or storing data generated after the processing circuit 1410 executes the instructions.
  • the processing circuit 1410 is used to implement the functions of the processing unit 1310
  • the interface circuit 1420 is used to implement the functions of the transceiver unit 1320 .
  • a communication device 1500 includes a processor 1510 and a communication interface 1520 .
  • the processor 1510 and the communication interface 1520 are coupled to each other.
  • the communication interface 1520 may be a transceiver or an input and output interface.
  • the communication device 1500 may further include a memory 1530 for storing instructions executed by the processor 1510 or storing input data required by the processor 1510 to execute the instructions or storing data generated by the processor 1510 after executing the instructions.
  • the processor 1510 is used to implement the functions of the above-mentioned processing unit 1310
  • the communication interface 1520 is used to implement the functions of the above-mentioned transceiver unit 1320 .
  • the processor 1510 is used to execute through the communication interface 1520: acquiring the first ciphertext data stream, and sending the first ciphertext data stream .
  • the first ciphertext data stream includes a first alignment identifier AM and an encrypted first data segment; the first AM is used for data alignment of the first ciphertext data stream.
  • the first AM includes at least one of a first AM locking information field, a first channel identification information field, or a first verification information field. Wherein, at least one of some of the bits in the first AM lock information field, some of the bits in the first channel identification information field, or some or all of the bits in the first verification information field is used to carry: the first data Encryption parameter information for the segment.
  • the processor 1510 is used to execute through the communication interface 1520 : to acquire the first ciphertext data stream.
  • the first ciphertext data stream includes a first alignment identifier AM and an encrypted first data segment.
  • the first AM is used for data alignment of the first ciphertext data stream; the first AM includes at least one of the first AM lock information field, the first channel identification information field, or the first check information field.
  • at least one of some of the bits in the first AM lock information field, some of the bits in the first channel identification information field, or some or all of the bits in the first verification information field is used to carry: the first data Encryption parameter information for the segment.
  • the encrypted first data segment is decrypted to obtain the first plaintext data stream.
  • the communication device chip When the above communication device is a chip applied to the communication device, the communication device chip implements the functions of the communication device in the above method embodiment.
  • the communication device chip receives information from other modules in the communication device (such as a radio frequency module or an antenna), and the information is sent to the communication device by a network device; or, the communication device chip sends information to other modules in the communication device (such as a radio frequency module or antenna) to transmit information, which is sent by the communication device to the network equipment.
  • the processor in the embodiments of the present application can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.
  • a general-purpose processor can be a microprocessor, or any conventional processor.
  • the present application also provides a computer program product, the computer program product including: a computer program or instruction, when the computer program or instruction is run on the computer, the computer is made to execute the computer shown in Figure 4a.
  • a computer program product including: a computer program or instruction, when the computer program or instruction is run on the computer, the computer is made to execute the computer shown in Figure 4a.
  • the present application also provides a computer-readable storage medium, the computer-readable medium stores a program or an instruction, and when the program or instruction is run on a computer, the computer is made to execute the computer shown in Figure 4a.
  • the method of any one of the embodiments is illustrated.
  • the present application further provides a chip system, where the chip system may include a processor.
  • the processor is coupled with the memory, and can be used to execute the method of any one of the embodiments shown in FIG. 4a.
  • the chip system further includes a memory.
  • Memory used to store computer programs (also called code, or instructions).
  • the processor is configured to call and run a computer program from the memory, so that the device installed with the system-on-a-chip executes the method of any one of the embodiments shown in FIG. 4a.
  • the present application further provides a system, which includes the foregoing first communication device and the second communication device.
  • the method steps in the embodiments of the present application may be implemented by means of hardware, or may be implemented by means of a processor executing software instructions.
  • Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory (Random Access Memory, RAM), flash memory (flash), read-only memory (Read-Only Memory, ROM), programmable read-only memory , erasable programmable read-only memory (Erasable Programmable ROM, EPROM), electrically erasable programmable read-only memory, registers, hard disk, solid-state drive (solid-state drive, SSD), mobile hard disk, portable read-only memory ( Compact Disc Read-Only Memory, CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium.
  • the storage medium may also be a component of the processor.
  • the processor and storage medium can be located in the ASIC. Additionally, the ASIC may be located in the communication device. Of course, the processor and the storage medium may also exist in the communication device as discrete components.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • a computer program product consists of one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on the computer, the processes or functions of the embodiments of the present application are executed in whole or in part.
  • the computer can be a general purpose computer, special purpose computer, computer network, network equipment, user equipment, or other programmable apparatus.
  • Computer programs or instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, computer programs or instructions may be Wired or wireless transmission to another website site, computer, server or data center.
  • a computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrating one or more available media. Available media may be magnetic media, such as floppy disks, hard disks, and magnetic tapes; optical media, such as digital video discs; or semiconductor media, such as solid-state hard disks.
  • the computer readable storage medium may be a volatile or a nonvolatile storage medium, or may include both volatile and nonvolatile types of storage media.
  • “plurality” means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the contextual objects are an “or” relationship; in the formulas of this application, the character “/” indicates that the contextual objects are a “division” Relationship.
  • “Including at least one of A, B or C” may mean: including A; including B; including C; including A and B; including A and C; including B and C; including A, B, and C.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种数据传输方法、设备、可读存储介质和芯片系统。本申请中，第一通信装置获取第一密文数据流，并发送第一密文数据流。第一密文数据流包括第一对齐标识AM以及加密的第一数据段。第一AM中第一AM锁定信息字段中的部分比特、第一AM中第一通道标识信息字段中的部分比特，或者，第一AM中第一校验信息字段中的部分或全部比特中的至少一项用于承载第一数据段的加密参数信息。本申请通过数据流中的第一AM中的上述比特位传输加密参数信息，该方法可以应用于光模块或网络设备的物理层，发送的加密参数可以不占用用户业务带宽。

Description

一种数据传输方法、设备、可读存储介质和芯片系统
相关申请的交叉引用
本申请要求在2021年09月03日提交中国专利局、申请号为202111034376.0、申请名称为“一种数据传输方法、设备、可读存储介质和芯片系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种数据传输方法、设备、可读存储介质和芯片系统。
背景技术
金融等专线业务需要安全承载。安全是客户选择专线业务的一个至关重要的考虑因素。加密是保证数据安全的重要手段，可以有效防止私密信息被攻击者窃取。根据加密在开放式系统互联参考模型(Open System Interconnection Reference Model，OSI)的不同层次，加密可以分为二层加密MAC安全协议(media access control security，MACsec)等。加密算法一般使用标准的高级加密标准伽罗华/计数器模式(Advanced Encryption Standard-Calois/Counter Mode，AES-GCM)算法。
而现有的基于MACsec等协议的加密技术的实现层次是在MAC层之上，加密和解密的对象是每一个用户帧。在MAC层使用基于MACsec协议的加密技术对每一用户帧进行加密的方法，需要在每一用户帧内携带加密参数。加密参数占用用户业务带宽较大，代价较大。
发明内容
为了解决上述问题，本申请提供一种数据传输方法、设备、可读存储介质和芯片系统，以达到加密参数可以不占用用户业务带宽的目的。
第一方面，本申请提供一种数据传输方法，该方法可以由发送端的设备来执行，比如可以由第一通信装置执行。第一通信装置获取第一密文数据流，并发送第一密文数据流。其中，第一密文数据流包括第一AM以及加密的第一数据段。第一AM用于第一密文数据流的数据对齐。第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。
本申请通过数据流中的第一AM中的比特位传输加密参数信息，该方法可以应用于光模块或网络设备的物理层，发送的加密参数可以不占用用户业务带宽。并且，由于该方案是对物理层的比特流进行加密，一个用户帧中所有的比特(包括源MAC地址、目的MAC地址)都会被加密，因而可以提升安全性。
在一种可能的实施方式中，第一通信装置可以获取N路密文数据流，N可以为1，N也可以为大于1的整数，第一密文数据流为N路密文数据流中的一路密文数据流。相对应 的，第一通信装置可以发送N路密文数据流。
在一种可能的实施方式中，第一密文数据流包括至少两个第一AM以及加密的至少两个第一数据段。其中，每两个第一AM之间包括一个加密的第一数据段，每两个加密的第一数据段之间包括一个第一AM。也就是说，本申请实施例中的第一AM可以是周期性出现在第一密文数据流中，同样的，也可以理解为加密的第一数据段也是周期性出现在第一密文数据流中。也可以理解为每个AM周期中包括一个第一AM和一个加密的第一数据段。
在一种可能的实施方式中，如果第一AM锁定信息字段承载加密参数信息，则第一AM锁定信息字段中的一部分比特用于承载加密参数信息，另一部分比特用于承载第一密文数据流的AM锁定信息。可以看出，本申请实施例中加密参数信息可以占用原本用于承载AM锁定信息的比特位来承载加密参数信息，从而为通过第一AM传输加密参数提供一种具体的实施方式。进一步，接收端可以配合本申请提出的匹配规则进行AM锁定，从而可以尽量不影响AM的锁定性能。
在一种可能的实施方式中，如果第一通道标识信息字段承载加密参数信息，则第一通道标识信息字段中的一部分比特用于承载加密参数信息，另一部分比特用于承载第一密文数据流的通道标识信息。可以看出，本申请实施例中加密参数信息可以占用原本用于承载通道标识信息的比特位来承载加密参数信息，从而为通过第一AM传输加密参数提供一种具体的实施方式。
在一种可能的实施方式中，如果第一校验信息字段承载加密参数信息，则第一校验信息字段中的一部分比特用于承载加密参数信息，另一部分比特用于承载校验信息。可以看出，本申请实施例中加密参数信息可以占用原本用于承载校验信息的比特位来承载加密参数信息，从而为通过第一AM传输加密参数提供一种具体的实施方式。
在一种可能的实施方式中，第一密文数据流是根据第一明文数据流和加密参数信息得到的。第一明文数据流包括第二AM以及未加密的第一数据段。第二AM用于第一明文数据流的数据对齐。
在一种可能的实施方式中，第二AM锁定信息字段可以用于承载第一明文数据流的AM锁定信息。第二通道标识信息字段可以用于承载第一明文数据流的通道标识信息。第二校验信息字段可以用于承载校验信息。
在一种可能的实施方式中，如果第一AM锁定信息字段没有用于承载加密参数信息，则第二AM锁定信息字段承载的信息可以与第一AM锁定信息字段承载的信息相同。
如果第一AM锁定信息字段承载加密参数信息，则第一AM锁定信息字段包括第一信息和加密参数信息，第二AM锁定信息字段包括第二信息。第二信息在第二AM锁定信息字段中对应的比特值可以划分为两个部分，可以称为第一部分比特值和第二部分比特值，第一部分比特值与第一信息对应的比特值相同，且第一部分比特值在第二AM锁定信息字段中的比特位与第一信息在第一AM锁定信息字段中的比特位对应相同。第二部分比特值在第二AM锁定信息字段中的比特位与加密参数信息在第一AM锁定信息字段中的比特位对应相同，但是第二部分比特值与第一校验字段中的加密参数信息对应的比特值不同。
又一种可能的实施方式中，如果第一AM锁定信息字段承载加密参数信息，则第一AM锁定信息字段可以是通过对第二AM锁定信息字段中的部分比特替换为加密参数信息中的部分或全部后得到的。比如，可以理解为第一通信装置将第二AM锁定信息字段中的第二部分比特值更新为加密参数信息后得到第一AM锁定信息字段。
如此，可以通过对明文数据流中的第二AM的第二AM锁定信息字段的部分内容进行替换，从而得到第一AM的第一AM锁定信息字段。且由于第一AM锁定信息字段承载的内容为协议值，因此，接收端可以将第一AM锁定信息字段中承载加密参数的比特位恢复为第二AM锁定信息字段中对应的AM锁定信息中的值，从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
在一种可能的实施方式中，如果第一校验信息字段没有用于承载加密参数信息，则第二校验信息字段承载的信息可以与第一校验信息字段承载的信息相同。
如果第一校验信息字段承载加密参数信息，则第一校验信息字段包括第三信息和加密参数信息，第二校验信息字段包括第四信息。第四信息在第二校验信息字段中对应的比特值可以划分为两个部分，可以称为第三部分比特值和第四部分比特值，第三部分比特值与第三信息对应的比特值相同，且第三部分比特值在第二校验信息字段中的比特位与第三信息在第一校验信息字段中的比特位对应相同。第四部分比特值在第二校验信息字段中的比特位与加密参数信息在第一校验信息字段中的比特位对应相同，但是第四部分比特值与第一校验信息字段中的加密参数信息对应的比特值不同。
又一种可能的实施方式中，如果第一校验信息字段承载加密参数信息，则第一校验信息字段可以是通过对第二校验信息字段中的部分比特替换为加密参数信息中的部分或全部后得到的。比如，可以理解为第一通信装置将第二校验信息字段中的第四部分比特值更新为加密参数信息后得到第一校验信息字段。
如此，可以通过对明文数据流中的第二AM的第二校验信息字段的部分内容进行替换，从而得到第一AM的第一校验信息字段，从而可以为通过第一AM传输加密参数信息提供了一种具体的实施方式。
在一种可能的实施方式中，如果第一通道标识信息字段没有用于承载加密参数信息，则第二通道标识信息字段承载的信息可以与第一通道标识信息字段承载的信息相同。
如果第一通道标识信息字段承载加密参数信息，则如果第一通道标识信息字段承载加密参数信息，则第一通道标识信息字段包括第五信息和加密参数信息，第二通道标识信息字段包括第六信息。第六信息在第二通道标识信息字段中对应的比特值可以划分为两个部分，可以称为第五部分比特值和第六部分比特值，第五部分比特值与第五信息对应的比特值相同，且第五部分比特值在第二通道标识信息字段中的比特位与第五信息在第一通道标识信息字段中的比特位对应相同。第六部分比特值在第二通道标识信息字段中的比特位与加密参数信息在第一通道标识信息字段中的比特位对应相同，但是第六部分比特值与第一通道标识信息字段中的加密参数信息对应的比特值不同。
又一种可能的实施方式中，如果第一通道标识信息字段承载加密参数信息，则第一通道标识信息字段可以是通过对第二通道标识信息字段中的部分比特替换为加密参数信息中的部分或全部后得到的。比如，可以理解为第一通信装置将第二通道标识信息字段中的第六部分比特值更新为加密参数信息后得到第一通道标识信息字段。
如此，可以通过对明文数据流中的第二AM的第二通道标识信息字段的部分内容进行替换，从而得到第一AM的第一通道标识信息字段，从而可以为通过第一AM传输加密参数信息提供了一种具体的实施方式。
在一种可能的实施方式中，第一通道标识信息字段中用于承载加密参数信息的比特位为：第二通道标识信息字段中承载第一预设值的k1个比特位中的部分或全部比特位，k1 为正整数。如此，接收端可以将第一通道标识信息字段中承载加密参数的比特位恢复为第二通道标识信息字段中对应的预设值，从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
在一种可能的实施方式中，第一通信装置发送第一密文数据流之前，第一通信装置还可以获取N条明文数据流。N条明文数据流包括第一明文数据流和第二明文数据流。第二明文数据流中包括第三AM。第三AM包括承载第二明文数据流的通道标识信息的第三通道标识信息字段，且第三通道标识信息字段中包括承载第一预设值的k1个比特位。可以看出，两个不同的明文数据流对应的两个不同的通道标识信息字段均包括k1个比特位的预设值，如此，针对每个明文数据流，均可以采用承载该第一预设值的k1个比特位来承载加密参数信息。
在一种可能的实施方式中，针对上述承载第一预设值的k1个比特位中的一个比特位，该比特位在第三通道标识信息字段中承载的值，与该比特位在第二通道标识信息字段中承载的值相同。如此，两个不同的明文数据流对应的两个不同的通道标识信息字段可以在相同的k1个比特位上承载预设值，针对每个明文数据流，均可以采用承载该第一预设值的k1个比特位来承载加密参数信息，且对于接收端而言，由于不同的通道的相同的k1个比特位承载相同的预设值，因此可以简化接收端将第二AM恢复为第一AM的过程。
为了与现有标准更加兼容，在一种可能的实施方式中，第一通道标识信息字段中用于承载加密参数信息的比特位可以为第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、第45个比特位、第47个比特位和第52个比特位。需要注意的是，第一通道标识信息字段对应的AM码块中的首个比特位称为第0个比特位。
为了保证0/1均衡性，第一AM承载的属于加密参数信息的信息可以划分为两个部分，分别为第一部分信息和第二部分信息，第二部分信息对应的比特值和所述第一部分信息对应的比特值存在取反关系。举个例子，比如第二部分信息对应的比特值为1010，则第一部分信息对应的比特值为0101。可以以第一部分信息为基准，对第一部分信息取反得到第二部分信息。也可以以第二部分信息为基准，对第二部分信息取反得到第一部分信息。比如，还可以理解为第二部分信息是通过对第一部分信息对应的比特值取反得到的信息，或者，可以理解为第一部分信息是通过对第二部分信息对应的比特值取反得到的信息。如此，也可以有效抵抗链路误码对加密参数传输可靠性的影响。
在一种可能的实施方式中，第一AM锁定信息字段中承载的属于加密参数信息的信息划分为两个部分，分别为第三部分信息和第四部分信息，且所述第三部分信息对应的比特值和所述第四部分信息对应的比特值存在取反关系。比如，第四部分信息是通过对第三部分信息对应的比特值取反得到的信息，再比如，第三部分信息是通过对第四部分信息对应的比特值取反得到的信息。如此，可以保证0/1均衡性，也可以有效抵抗链路误码对加密参数传输可靠性的影响。
在一种可能的实施方式中，第一通道标识信息字段中承载的属于加密参数信息的信息划分为两个部分，分别为第五部分信息和第六部分信息，且所述第五部分信息对应的比特值和所述第六部分信息对应的比特值存在取反关系。比如，第五部分信息是通过对第六部分信息对应的比特值取反得到的信息，再比如，第六部分信息是通过对第五部分信息对应的比特值取反得到的信息。如此，可以保证0/1均衡性，也可以有效抵抗链路误码对加密 参数传输可靠性的影响。
在一种可能的实施方式中，第一校验信息字段中承载的属于加密参数信息的信息划分为两个部分，分别为第七部分信息和第八部分信息，且所述第七部分信息对应的比特值和所述第八部分信息对应的比特值存在取反关系。比如，第七部分信息是通过对第八部分信息对应的比特值取反得到的信息，再比如，第八部分信息是通过对第七部分信息对应的比特值取反得到的信息。如此，可以保证0/1均衡性，也可以有效抵抗链路误码对加密参数传输可靠性的影响。
在一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位为以下字段的比特位中的部分比特位：M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。加密参数信息可以同时部署于M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段中的至少两项，比如可以部署于M0字段和M1字段。
一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位可以为M0字段前4比特，以及～M0字段前4比特中的比特位。又一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位可以为M1字段前4比特，以及～M1字段前4比特中的比特位。又一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位可以为M2字段前4比特，以及～M2字段前4比特中的比特位。如此，接收端可以配合本申请提出的匹配规则进行AM锁定，可以保证根据第一AM锁定信息字段进行锁定的性能。
在一种可能的实施方式中，第一校验信息字段中用于承载加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：BIP 3字段，或～BIP 3字段。由于在明文数据流中～BIP 3字段承载的值为BIP 3字段的值的取反的值，因此，接收端可以依据BIP 3字段和～BIP 3字段中一个未承载加密参数信息的字段恢复另一个承载加密参数信息字段。
在一种可能的实施方式中，第一校验信息字段中用于承载加密参数信息的比特位为：～BIP 3字段前4比特，以及～BIP 3字段后4比特中的比特位。由于在明文数据流中～BIP 3字段承载的值为BIP 3字段的值的取反的值，因此，接收端可以依据第一AM中BIP 3字段息的字段的值，将第一AM中的～BIP 3字段承载的值恢复为第二AM中的～BIP 3字段承载的值，从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
在一种可能的实施方式中，加密参数信息包括初始化向量IV和密钥标识。该两个参数为加密参数信息中的两个参数，根据该两个参数接收端可以确定出加密密钥，进而可以基于加密密钥对加密数据进行解密。
在一种可能的实施方式中，加密参数信息包括：加密参数信息的纠错信息。如此，可以有效抵抗链路误码对加密参数传输可靠性的影响。
加密参数信息的纠错信息可以为里德-所罗门类纠错码-前向纠错(Reed-Solomon forward error correction，RS-FEC)码。RS-FEC码在应对突发误码时性能较好。加密参数信息的纠错信息还可以为BCH码， BCH码取自Bose、Ray-Chaudhuri与Hocquenghem的缩写。
在一种可能的实施方式中，加密参数信息还包括：复帧起始标识信息，复帧起始标识信息用于指示承载加密参数信息的复帧的起始位。如此，可以使接收端识别出加密参数信息对应的复帧起始位。
在一种可能的实施方式中，加密参数信息还包括：复帧锁定状态标识信息，复帧锁定 状态标识信息用于指示发送端和/或接收端的复帧是否锁定。如此，可以使接收端识别出发送端和/或接收端的复帧的锁定状态。
在一种可能的实施方式中，第一密文数据流的传输速率为以下内容中的一项：100Gbps、50Gbps，或25Gbps。其中，第一密文数据流的传输速率为100Gbps时，第一密文数据流中还可以包括以太网架构中的RS-FEC码，以使接收端对第一密文数据流对应的明文数据流中的信息进行纠错，如此，可以有效抵抗链路误码对加密参数传输可靠性的影响。
第二方面，本申请实施例提供一种数据传输方法，该方法可以由接收端的设备来执行，比如可以由第二通信装置执行。第二通信装置获取第一密文数据流。第二通信装置根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流。其中，第一密文数据流包括第一AM以及加密的第一数据段；第一AM用于第一密文数据流的数据对齐；第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项；其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息；
本申请通过数据流中的第一AM中的比特位传输加密参数信息，该方法可以应用于光模块或网络设备的物理层，发送的加密参数可以不占用用户业务带宽。并且，由于该方案是对物理层的比特流进行加密，一个用户帧中所有的比特(包括源MAC地址、目的MAC地址)都会被加密，因而可以提升安全性。
在一种可能的实施方式中，第二通信装置根据所述第一密文数据流中的至少k2个连续的第一AM对所述第一密文数据流完成AM锁定，所述至少k2个连续的第一AM满足预设规则；k2为大于1的整数。其中，至少k2个第一AM中的第一AM满足预设规则包括：在第一AM的第一AM锁定信息字段中的部分比特承载的信息中包括加密参数信息中的部分或全部的情况下：第一AM锁定信息字段承载的信息中除属于加密参数信息之外的信息与预设AM锁定信息之间至多存在k3个nibble(半字节)不匹配；k3为正整数。在一种可能的实施方式中，当第一AM锁定信息字段中用于承载加密参数信息的比特位的数量为8，则k3的值为1。由于现有标准中当AM锁定信息的48个比特用于进行AM锁定的情况下，需要要求至多3个nibble不匹配。而本申请实施例中考虑到将第一AM锁定信息字段中的部分比特(比如8个比特，相当于2个半字节)承载加密参数信息，则可以设置k3的值小于3，比如k3的值为1，如此，可以尽量保证根据第一AM锁定信息字段进行锁定的性能。
在一种可能的实施方式中，第一AM锁定信息字段中的部分或全部比特可以用于承载第一密文数据流的AM锁定信息。第一通道标识信息字段中的部分或全部比特可以用于承载第一密文数据流的通道标识信息。第一校验信息字段中的部分或全部比特可以承载校验信息。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一密文数据流是根据第一明文数据流和加密参数信息得到的；第一明文数据流包括第二AM以及未加密的第一数据段；第二AM用于第一明文数据流的数据对齐。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第二通信装置根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流中未加密的第一数据段。 第二通信装置还可以对第一AM进行处理，得到第一明文数据流中的第二AM。由于第二通信装置将第一AM恢复为明文数据流中的第二AM，从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
在一种可能的实施方式中，第二通信装置对第一AM进行处理，得到第一明文数据流中的第二AM之后，还可以根据第二AM，确定第一明文数据流的通道标识信息。如此，可以提高识别出通道标识信息的准确度，从而尽量降低由于传输加密参数信息对通道标识信息识别过程的影响。
在一种可能的实施方式中，第二AM可以包括第二AM锁定信息字段、第二通道标识信息字段或第二校验信息字段中的至少一项。第二AM锁定信息字段可以用于承载第一明文数据流的AM锁定信息。第二通道标识信息字段可以用于承载第一明文数据流的通道标识信息。第二校验信息字段可以用于承载校验信息。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一AM锁定信息字段可以是：通过对第二AM锁定信息字段中的部分比特替换为加密参数信息中的部分或全部后得到的。第一通道标识信息字段可以是：通过对第二通道标识信息字段中的部分比特替换为加密参数信息中的部分或全部后得到的。第一校验信息字段是：通过对第二校验信息字段中的部分比特替换为加密参数信息中的部分或全部后得到的。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
由于第一AM锁定信息字段承载的AM锁定信息为协议规定的预设值，因此在第一AM锁定信息字段中有部分比特用于承载加密参数信息的情况下，第二通信装置可以将第一AM锁定信息字段中用于承载加密参数信息的比特位上的信息恢复为第二预设值。从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
由于第一通道标识信息字段承载加密参数信息的比特位的原始值为协议规定的预设值，因此在第一通道标识信息字段中有部分比特用于承载加密参数信息的情况下，第二通信装置可以将第一通道标识信息字段中用于承载加密参数信息的比特位上的信息恢复为第一预设值。从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
由于第一校验信息字段承载的值分为两个部分，其中一个部分为另外一个部分的比特值的取反后的值，因此在第一校验信息字段中有部分比特用于承载加密参数信息的情况下，第二通信装置可以根据第一校验信息字段中承载的第一校验信息，将第一校验信息字段中用于承载加密参数信息的比特位上的信息恢复为第一校验信息对应的比特值取反后的信息。从而可以尽量降低由于传输加密参数信息对其他数据处理进程的影响。
在一种可能的实施方式中，第一通道标识信息字段中用于承载加密参数信息的比特位为：第二通道标识信息字段中承载k1个第一预设值的k1个比特位中的部分或全部比特位，k1为正整数。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第二通信装置可以获取N路密文数据流，N路密文数据流包括第一密文数据流和第二密文数据流；其中，第二密文数据流包括第四AM以及加密的第二数据段；第四AM用于第二密文数据流的数据对齐，第四AM承载第二数据段的加密参数信息。根据第二密文数据流中第四AM承载的加密参数信息，对第二密文数据流中的第二数据段进行解密，得到第二明文数据流中未加密的第二数据段。对第四AM进行处理，得到第二明文数据流中的第三AM；第三AM包括承载第二明文数据流的通道标识信息的 第三通道标识信息字段，且第三通道标识信息字段中包括承载第一预设值的k1个比特位。
在一种可能的实施方式中，针对k1个比特位中的比特位，比特位在第三通道标识信息字段中承载的值，与比特位在第二通道标识信息字段中承载的值相同。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一通道标识信息字段中用于承载加密参数信息的比特位为第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、第45个比特位、第47个比特位和第52个比特位。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，针对至少两个第一AM中承载有至少一个加密的第一数据段的加密参数信息中的部分或全部的第一AM：第一AM承载的属于加密参数信息的信息划分为两个部分，分别为第一部分信息和第二部分信息，第二部分信息是通过对第一部分信息对应的比特值取反得到的信息。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一AM锁定信息字段中承载的属于加密参数信息的信息可以划分为两个部分，分别为第三部分信息和第四部分信息，且第四部分信息是通过对第三部分信息对应的比特值取反得到的信息。
第一通道标识信息字段中承载的属于加密参数信息的信息可以划分为两个部分，分别为第五部分信息和第六部分信息，且第六部分信息是通过对第五部分信息对应的比特值取反得到的信息。第一校验信息字段中承载的属于加密参数信息的信息可以划分为两个部分，分别为第七部分信息和第八部分信息，且第八部分信息是通过对第七部分信息对应的比特值取反得到的信息。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位为以下字段的比特位中的部分比特位：M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位为以下内容中的一项：M0字段前4比特，以及～M0字段前4比特中的比特位；M1字段前4比特，以及～M1字段前4比特中的比特位；或，M2字段前4比特，以及～M2字段前4比特中的比特位。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，第一校验信息字段中用于承载加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：BIP 3字段，或～BIP 3字段。
在一种可能的实施方式中，第一校验信息字段中用于承载加密参数信息的比特位为：～BIP 3字段前4比特，以及～BIP 3字段后4比特中的比特位。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，加密参数信息包括初始化向量IV和密钥标识。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，加密参数信息包括：加密参数信息的纠错信息。相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，加密参数信息的纠错信息包括：RS-FEC码和/或BCH码。 相关介绍和有益效果可以参见前述第一方面的相关内容，在此不再赘述。
在一种可能的实施方式中，获取第一密文数据流之后，对加密的第一数据段进行解密之前，还包括：获取第一密文数据流中的加密参数信息的纠错信息；根据加密参数信息的纠错信息，对加密参数信息中的其他信息进行纠错。如此，可以有效抵抗链路误码对加密参数传输可靠性的影响。
第三方面，提供了一种通信装置，包括通信单元和处理单元。该通信装置可以为上述第一通信装置，也可以为上述第二通信装置。该通信装置可以执行上述第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。通信单元用于执行与发送和接收相关的功能。可选地，通信单元包括接收单元和发送单元。在一种设计中，通信装置为通信芯片，处理单元可以是一个或多个处理器或处理器核心，通信单元可以为通信芯片的输入输出电路或者端口。
在另一种设计中，通信单元可以为发射器和接收器，或者通信单元为发射机和接收机。
可选的，通信装置还包括可用于执行上述第一方面至第二方面中任一方面，以及任一方面的任一种实施方式的各个模块。
第四方面，提供了一种通信装置，包括处理器和存储器。该通信装置可以为上述第一通信装置，也可以为上述第二通信装置。可选的，还包括收发器，该存储器用于存储计算机程序或指令，该处理器用于从存储器中调用并运行该计算机程序或指令，当处理器执行存储器中的计算机程序或指令时，使得该通信装置执行上述第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。
可选的，处理器为一个或多个，存储器为一个或多个。
可选的，存储器可以与处理器集成在一起，或者存储器与处理器分离设置。
可选的，收发器中可以包括，发射机(发射器)和接收机(接收器)。
第五方面，提供了一种通信装置，包括处理器。该通信装置可以为上述第一通信装置，也可以为上述第二通信装置。该处理器与存储器耦合，可用于执行第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。该通信装置可以为上述第一通信装置，也可以为上述第二通信装置。可选地，该通信装置还包括存储器。可选地，该通信装置还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信装置为第一通信装置时，通信接口可以是收发器，或，输入/输出接口。可选地，收发器可以为收发电路。可选地，输入/输出接口可以为输入/输出电路。
在又一种实现方式中，当该通信装置为第一通信装置的芯片或芯片系统时，通信接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理器也可以体现为处理电路或逻辑电路。
在一种实现方式中，该通信装置为第二通信装置时，通信接口可以是收发器，或，输入/输出接口。可选地，收发器可以为收发电路。可选地，输入/输出接口可以为输入/输出电路。
在又一种实现方式中，当该通信装置为第二通信装置的芯片或芯片系统时，通信接口 可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理器也可以体现为处理电路或逻辑电路。
第六方面，提供了一种系统，系统包括上述第一通信装置和第二通信装置。
第七方面，提供了一种计算机程序产品，计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当计算机程序被运行时，使得计算机执行上述第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。
第八方面，提供了一种计算机可读存储介质，计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。
第九方面，提供了一种芯片系统，该芯片系统可以包括处理器。该处理器与存储器耦合，可用于执行上述第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。可选地，该芯片系统还包括存储器。存储器，用于存储计算机程序(也可以称为代码，或指令)。处理器，用于从存储器调用并运行计算机程序，使得安装有芯片系统的设备执行第一方面至第二方面中任一方面，以及任一方面的任一种实施方式。
第十方面，提供了一种处理装置，包括：接口电路和处理电路。接口电路可以包括输入电路和输出电路。处理电路用于通过输入电路接收信号，并通过输出电路发射信号，使得第一方面至第二方面中任一方面，以及任一方面的任一种实施方式被实现。
在具体实现过程中，上述处理装置可以为芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请对处理器及各种电路的具体实现方式不做限定。
在又一种实现方式中，通信装置可以是第一通信装置中的部分器件，如系统芯片或通信芯片等集成电路产品。接口电路可以为该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理电路可以为该芯片上的逻辑电路。
在又一种实现方式中，通信装置可以是第二通信装置中的部分器件，如系统芯片或通信芯片等集成电路产品。接口电路可以为该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。处理电路可以为该芯片上的逻辑电路。
附图说明
图1为一种二层加密的数据结构示意图；
图2a为本申请实施例提供的一种系统架构示意图；
图2b为本申请实施例提供的又一种系统架构示意图；
图2c为一种OSI参考模型架构；
图2d为本申请实施例提供的一种通信装置的架构示意图；
图2e为本申请实施例提供的一种发送端和接收端的数据处理流程示意图；
图3a为本申请实施例提供的一个AM码块的格式示意图；
图3b为本申请实施例提供的100Gbps中每个逻辑通道的AM格式示意图；
图3c为本申请实施例提供的100Gbps中FEC通道0的AM格式示意图；
图3d为本申请实施例提供的50Gbps中每个逻辑通道的AM格式示意图；
图3e为本申请实施例提供的50Gbps中FEC通道0的AM格式示意图；
图3f为本申请实施例提供的25Gbps中一种逻辑通道的AM格式示意图；
图3g为本申请实施例提供的25Gbps中另一种逻辑通道的AM格式示意图；
图4a为本申请实施例提供的一种数据传输方法流程示意图；
图4b为本申请实施例提供的又一种数据传输方法流程示意图；
图5a为本申请实施例提供的图3c的AM中可以用于承载加密参数信息的比特位示意图；
图5b为本申请实施例提供的第一密文数据流中承载的加密参数信息的复帧的结构示意图；
图6为本申请实施例提供的又一种数据传输方法流程示意图；
图7a为本申请实施例提供的示例性示出了4种情况下的失锁平均时间和锁定平均时间的示意图；
图7b为本申请实施例提供的情况b0和情况b1(25Gbps)传输速率下以太网架构的RS-FEC码纠错后误码率的效果展示图；
图7c为本申请实施例提供的情况b0和情况b2(50Gbps)传输速率下以太网架构的RS-FEC码纠错后误码率的效果展示图；
图7d为本申请实施例提供的情况b0和情况b3(100Gbps)传输速率下以太网架构的RS-FEC码纠错后误码率的效果展示图；
图8为本申请实施例提供的又一种通信装置的架构示意图；
图9为本申请实施例提供的又一种通信装置的架构示意图；
图10为本申请实施例提供的又一种通信装置的架构示意图。
具体实施方式
下面先结合图1介绍一种加密方案，图1示例性示出了一种二层加密的数据结构示意图，如图1所示，加密侧针对每个数据帧单独用一个密钥(Key)和一个初始向量(Initialization Vector，IV)进行加密。加密侧可以使用本地预先配置的密钥(Key)、初始向量对图中的一个数据帧的未加密的数据(未加密的数据也可以称为明文数据(Plain Data))进行加密，得到加密后的数据，加密后的数据也可以称为密文数据(Encrypted Data)。为了防止数据在传输过程中被攻击者篡改，加密侧通常还会生成一个校验值，例如完整性校验值(Integrity Check Value，ICV)。加密侧发送报文时，在报文中携带密文数据、安全标签(security tag，SecTAG)和加密过程中生成的ICV，其中，SecTAG包含密钥标识(Key Identification)、IV标识(IV Identification)。
解密侧接收到该数据帧后，根据密钥的标识对应的密钥，以及IV的标识对应的IV对该数据帧进行解密。解密后该密文数据(Encrypted Data)将变为明文数据(Plain Data)。为了判断数据在传输过程中是否被篡改，解密侧会计算一个ICV。只有当该ICV与数据帧中携带的ICV一致时才能认为此次解密是有效的，否则此次解密是无效的。
基于MACsec等协议的加密技术的实现层次是在MAC层之上，加密和解密的对象是每一个用户帧。在MAC层使用基于MACsec协议的加密技术对每一用户帧进行加密的方 法，需要在每一用户帧内携带加密参数。当加密参数为至少28字节(IV 12字节，ICV 16字节)，平均帧长64字节时，加密参数占用43％(28/64＝43％)的用户业务带宽，代价较大。基于此，本申请实施例中提供一种数据传输方案，用于达到加密参数可以不占用用户业务带宽的目的。下面结合附图对本申请实施例进行进一步的描述。
图2a示例性示出了本申请实施例提供的一种系统架构示意图，如图2a所示，该系统架构包括第一通信装置和第二通信装置。第一通信装置和第二通信装置中的任一个装置，该装置可以为网络设备，或为设置于网络设备内部的芯片。该装置可以是支持以太网接口的网络设备。该装置包括但不限于：光模块、核心路由器、基于网络协议的无线电接入网(Internet Protocol Radio Access Network，IPRAN)、分组传送网(Packet Transport Network，PTN)盒式或框式交换机设备。光模块比如可以为包括有光数字信号处理芯片(optical digital signal processor，oDSP)的模块。
本申请实施例中第一通信装置获取第一密文数据流，发送第一密文数据流。比如可以向第二通信装置发送第一密文数据流。其中，第一密文数据流包括第一对齐标识AM以及加密的第一数据段；第一AM用于第一密文数据流的数据对齐。第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。第二通信装置获取第一密文数据流，根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流。
本申请通过数据流中的第一AM中的比特位传输加密参数信息，并未额外增加用于传输加密参数信息的比特位，因此加密参数信息的传输未占用用户业务带宽，从而可以减轻加密参数对用户带宽的占用程度。另一方面，由于本申请对物理层中的数据流(或称比特流)进行加密传输，因此以太网帧中所有的比特(包括源MAC地址、目的MAC地址)均可被加密，进而可以提升安全性。
本申请实施例中第一通信装置也可以称为发送端、加密端、源端(source end)、发送设备、发送侧、发送端侧等等，第二通信装置也可以称为接收端、解密端、目的端(destination end)、接收设备、接收侧、接收端侧等等，本申请实施例不做具体限制。本申请实施例中发送端的相关方案可以参考第一通信装置侧的方案，接收端的方案可以参考第二通信装置侧的方案。
图2b示例性示出了本申请实施例提供的又一种系统架构示意图，该系统架构包括多个设备，比如设备1、设备2、设备3和设备4。图2a中的第一通信装置和第二通信装置可以为图2b中的任意两个通信装置，比如可以为图2b中任意两个相邻的通信装置。本申请实施例中数据传输可以为双向传输，比如数据传输方向可以从图2b的设备1传输至设备4，还可以从设备4传输至设备1。以从设备1传输至设备4的方向为例，比如，第一通信装置为设备1，第二通信装置为设备2。再比如，第一通信装置为设备2，第二通信装置为设备3。再比如，第一通信装置为设备3，第二通信装置为设备4。
需要说明的是，设备1向设备2发送数据，设备2可以执行接收侧的方案，当设备2向设备3发送数据，设备2也可以执行发送侧的方案，也就是说本申请实施例中一个设备 可以既执行发送侧的方案，也可以执行接收侧的方案。其中，该设备的发送侧的方案可以参考第一通信装置侧的方案，接收侧的方案可以参考第二通信装置侧的方案。图2b中以第一通信装置为设备2，第二通信装置为设备3为例进行展示。
图2c示例性示出了一种OSI参考模型架构，该OSI参考模型架构是一种网络互连模型，定义了网络互连的七层框架，由底层到高层，依次为物理层、数据链路层、网络层、传输层、会话层、表示层以及应用层。
以太网处于该OSI参考模型中的数据链路层和物理层。如图2c所示，数据链路层包括两个子层：逻辑链路控制(logical link control，LLC)子层和负责解析和组装以太网帧的媒体访问控制(medium access control，MAC)子层。
如图2c所示，物理层可以包括物理媒介相关子层(physical medium dependent sublayer，PMD)(也可以称为PMD层)、物理媒介附加子层(physical medium attachment sublayer，PMA)(也可以称为PMA层)、前向纠错码(forward error correction，FEC)(也可以称为FEC层)、物理编码子层(physical coding sublayer，PCS)(也可以称为PCS层)。PCS层和MAC层之间还包括有协调子层(reconciliation sublayer，RS)(也可以称为RS层)。
图2c还示意出了PMD下连的介质(medium)，该介质可以是电缆、可插拔光模块或光纤等。
需要说明的是，MACsec技术具体部署在数据链路层中MAC子层之上。加密对象和解密对象为一个以太网帧(或称，用户帧)。而本申请实施例提供的方案部署于物理层，加密对象和解密对象可以为一个逻辑通道的一个数据段。
图2d示例性示出了本申请实施例提供的一种通信装置的架构示意图。本申请实施例方案可以应用于支持以太网连接的光模块，图2d中以该通信装置为光模块进行示意，且图2d中示出了本申请实施例方案部署在光模块时可能的部署位置。
如图2d所示，该光模块可以包括比特复用或解复用器(BitMux)，oDSP，微控制器单元(micro-controller unit，MCU)，以及光电收发器件(包括发送器(transmitter，TX)/接收器(receiver，RX)。
其中，光模块内MCU可以负责配置各个功能模块的参数，比如，MCU可用于配置本申请实施例中加密和解密所需的初始化参数，包括启动或暂停加密解密功能、配置上层协商好的密钥等关键信息。
如图2d所示，BitMux主要完成以比特交织方式将输入通道的信号流转换到输出通道。当BitMux部署于物理层，则用于实现N个逻辑通道与M个物理通道之间的转换，例如将4个逻辑通道的信号流转换到2个物理通道。
当BitMux部署于光模块，则用于实现M个物理通道的信号与K路数字信号之间的转换，例如将2个物理通道的信号流转换为2路数字信号。图2d中的通信装置架构可以将M条物理通道(M为正整数)与oDSP内的K条通道(K为正整数)之间的BitMUX一分为二，分别为M:N和N:K两个bitMUX，N为逻辑通道数量，N为正整数，然后在两个BitMUX之间引入加密解密以及相应的功能模块。本申请实施例中在两个bitMUX之间引入本申请实施例中的加密侧和/或解密侧方案，模块内其他功能组件不感知模块内其他功能组件可以不感知。
图2d中所示的光模块应可以执行接收端方案。以该设备为图2a中的设备2为例，当该光模块执行接收端方案，该光模块可以通过光纤接收来自设备1的光信号，该示例中，设备2执行的方案可以参考第二通信装置侧的方案，设备1执行的方案可以参考第一通信装置侧的方案。光信号经由接收器光电转换和oDSP算法处理(例如色散补偿等)，然后将数字信号输出到BitMux。则BitMux将oDSP输出的数字信号转换为N路逻辑通道信号，并将N路逻辑通道信号转换成M路物理通道信号传输到物理层中的电芯片。需要说明的是前述物理通道信号、逻辑通道信号属于数字信号。
图2d中所示的光模块应还可以执行发送端方案。以该设备为图2a中的设备2为例，当该光模块执行发送端方案，BitMux可以将输入到光模块中的M路物理通道信号，转换为N路逻辑通道信号；再将N路逻辑通道信号转换为K路物理通道信号并输入oDSP的数字信号。oDSP负责将输入的数字信号实施算法处理(例如色散补偿预处理)等经光电收发器件中的发送器处理并通过光纤发送给设备3。该示例中，设备2执行的方案可以参考第一通信装置侧的方案，设备3执行的方案可以参考第二通信装置侧的方案。
参考图2e，为本申请实施例提供的一种发送端和接收端的数据处理流程示意图。需要说明的是，本申请实施例中PCS层可以有逻辑通道，可以称为PCS逻辑通道或者称为PCS通道。FEC层也可以有逻辑通道，可以称为FEC逻辑通道或FEC通道。
以100Gbps传输速率下有FEC通道的系统架构为例对图2e进行说明，该示例中以物理通道数量为2、PCS层的逻辑通道数量为20、FEC层的逻辑通道数量为4进行举例。实际应用中，物理通道数量也可以为其他值，比如还可以为4等，本申请实施例不做限制。
图2e的发送端接收到一串数据流，依次经MAC层和RS层处理后进入PCS层。在PCS层对该数据流进行编码(encode)得到64/66B的一串码块流(该码块流也可以为其他编码形式，此处以64/66B的编码形式进行举例)。对该码块流进行加扰(scramble)后，执行块分发。该一串加扰后的码块流经过块分发(block distribution)后可以形成20个PCS通道(也可以称为PCS逻辑通道)对应的20路码块流，其中一个PCS通道对应一路码块流。进一步，发送端可以对该20路码块流执行AM插入(AM insertion)，以便在该20条PCS通道中的每条PCS通道对应的码块流中周期性插入AM。发送端在PCS层将一路串行数据流转换为20个PCS通道对应的20路并行码块流之后，可以将该20路码块流输入至FEC层。
进一步，发送端在FEC层对该20路码块流执行逻辑通道块对齐(lane block sync)、对齐锁定(alignment lock)、逻辑通道偏移(lane deskew)和逻辑通道重新排序(lane reorder)，从而将20路并行码块流恢复为一路串行的码块流。之后从该路串行的码块流执行AM移除(AM removal)，以移除该路串行的码块流中的AM。对移除AM之后的一路串行的码块流进行转码(transcode)，以便得到一路串行的256/257B的码块流(该码块流也可以为其他编码形式，此处以256/257B的编码形式进行举例)。之后对转码后的串行码块流执行AM插入(AM insertion)，以便在该路串行码块流中周期性插入AM。对插入AM的串行码块流执行RS编码(RS encode)和符号分发(symblo distribution)，从而得到4个FEC通道对应的4路并行码块流。
进一步，发送端的FEC层输出4路FEC通道对应的4路码块流进入到PMA。之后在PMA中按照4：2的比例，通过PMA内置的bitMux将4路FEC通道对应的4条码块流转 换到2个物理通道，得到2条物理通道对应的码块流。然后2个物理通道的码块流经过PMD和介质等以电信号或者是光信号的形式被传输出去。
需要说明的是，发送端在PCS层插入的AM的格式可以参考PCS层定义的一个AM的格式。发送端在FEC层插入的AM的格式可以参考FEC层定义的一个AM的格式。后续内容中的图3b示例性示出了100Gbps的传输速率下有FEC通道的系统架构中FEC通道对应的4个AM的格式示意图。一种可能的实施方式中，100Gbps的传输速率下PCS通道可以对应20个AM，其中每个AM可以为一个AM码块，即20个PCS通道对应的20个AM中每个AM的格式可以参见图3a所示的AM码块的结构，20个PCS通道对应的20个AM中的任两个AM中至少存在一个比特的值不同。
如图2e所示，对于发送端来说，加密方案可具体由物理层芯片通过PMA获取到多个FEC通道对应的数据流之后且在恢复出串行流之前的过程中实现，或者由光模块(介质)在处理接收到的数据流的过程中实现。
如图2e所示，接收端可以将接收到的2个物理通道对应的2路码块流在PMD进行处理后，将该2路处理后的码块流输入至PMA层，在PMA层将按照2：4的比例，将2个物理通道对应的2路码块流转换到4个FEC通道，得到4个FEC通道对应的4条码块流，并将该4条码块流输入至FEC层。
进一步，接收端在FEC层对该4路FEC通道对应的4条码块流执行对齐锁定(alignment lock)、逻辑通道偏移(lane deskew)和逻辑通道重新排序(lane reorder)，从而将4路并行码块流恢复为一路串行的码块流。之后可以对该路串行的码块流执行RS解码(RS decode)，以便对误码进行纠正。进一步，对进行RS解码(RS decode)后的一路串行的码块流执行AM移除(AM removal)，以移除该路串行的码块流中的AM。对移除AM之后的一路串行的码块流进行转码(transcode)，以便得到一路串行的64/66B的码块流。对该转码后的一路串行的码块流进行块分发(block distribution)，以便得到20路PCS通道对应的20路码块流，之后执行AM插入(AM insertion)，以便在该20路并行码块流中的每路码块流中周期性地插入AM。并将插入AM的20路并行码块流传输至PCS层进行处理。本申请实施例中后续提到以太网架构本身可以具有RS-FEC码纠错性能，以太网架构的RS-FEC码可以在FEC层的RS解码(RS decode)这个步骤实现。
进一步，接收端在PCS层对20路并行码块流进行逻辑通道块对齐(lane block sync)、对齐锁定(alignment lock)、逻辑通道偏移(lane deskew)和逻辑通道重新排序(lane reorder)，得到64/66B的一串码块流。对该一路串行的码块流执行AM移除(AM removal)，以移除该路串行的码块流中的AM。对该一路串行的且移除了AM的码块流进行解扰(descramble)和解码(decode)，恢复出一路串行的数据流。进一步，接收端将该一路串行的数据流依次进行RS层和MAC层等的处理，以恢复出发送端发出的原始的业务数据流。
如图2e所示，对于接收端来说，解密方案可具体由物理层芯片通过PMA获取到多个FEC通道对应的数据流之后且在恢复出串行流之前的过程中实现，或者由光模块(介质)在处理接收到的数据流的过程中实现。
下面先对本申请实施例中出现的一些概念或概念之间的关系进行解释说明。
(1)明文数据流。
本申请实施例中N路明文数据流指的N路未经加密的数据流。以N路明文数据流中的一路明文数据流为例进行说明，为了区分，将N路明文数据流中的一路明文数据流称为第一明文数据流，N为正整数。
第一明文数据流包括至少两个AM以及至少一个未加密的数据段。为了区分，将第一明文数据流中的AM称为第二AM，将第一明文数据流中的至少一个数据段称为第一数据段。未加密的第一数据段也可以称为明文数据段，或者称为明文第一数据段。至少两个第二AM用于N路明文数据流的数据对齐。
其中，每两个第二AM之间可以包括一个明文数据段，每两个明文数据段之间可以包括一个第二AM。
作为一种实现方法，第一明文数据流内的第二AM可以是周期性插入的。其中，第一明文数据流的第二AM和未加密的第一数据段可以是周期性出现的。每个周期内可以包含一个第二AM和一个明文数据段。
(2)密文数据流。
本申请实施例中，N路密文数据流指的是N路加密的数据流。以N路密文数据流中的一路密文数据流为例进行说明，为了区分，将N路密文数据流中的一路密文数据流称为第一密文数据流。
第一密文数据流包括至少两个AM以及至少一个加密的数据段。为了区分，将第一密文数据流中的对齐数据单元称为第一AM。第一密文数据流中的数据段为进行加密的数据段，也可以称为密文数据段。
第一密文数据流包括至少两个AM以及至少一个加密的数据段。为了区分，将第一密文数据流中的AM称为第一AM，将第一密文数据流中加密的至少一个数据段称为加密的第一数据段。加密的第一数据段也可以称为密文数据段，或者称为密文第一数据段。至少两个第一AM用于N路密文数据流的数据对齐。
(3)明文数据流与密文数据流的关系。
本申请实施例中，对N路明文数据流加密，得到N路密文数据流。N路明文数据流与N路密文数据流一一对应。
以N路明文数据流中的第一明文数据流进行举例说明，第一明文数据流与N路密文数据流中的第一密文数据流对应。对第一明文数据流中的未加密的第一数据段进行加密，即可得到第一密文数据流中加密的第一数据段。对第一明文数据流中的第二AM进行处理，可得到第一密文数据流中的该第二AM对应的第一AM。
本申请实施例中对第一明文数据流中的第二AM进行的处理可以包括在第二AM中增加加密参数信息等操作。
(4)逻辑通道。
本申请实施例中，逻辑通道(logic lane)，也称为虚拟通道，指的是PCS通道(或者称PCS逻辑通道)或FEC通道(或者称FEC逻辑通道)。比如，在传输速率为100Gbps且有FEC的系统架构中逻辑通道可以称为FEC通道，在传输速率为50Gbps和25Gbps的系统架构中逻辑通道也可以称为FEC通道，200Gbps/400Gbps标准中的逻辑通道可以称为PCS逻辑通道。比如在以太网规范中，100Gbps传输速率下有FEC通道的系统架构中的FEC通道个数为4，50Gbps对应的FEC通道个数为2，25Gbps对应的FEC通道个数为1。
需要说明的是，本申请实施例是以在传输速率为100Gbps且有FEC的系统架构中的逻辑通道、50Gbps和25Gbps的系统架构中逻辑通道为例进行展示的，本申请实施例后续内容提到的逻辑通道可以理解为FEC通道。
(5)物理通道。
本申请实施例中，物理通道(physical lane)可以是PMA通道。一个物理通道可以承载一个或多个逻辑通道的数据。在不同速率的以太网中，根据实现的不同，物理通道数也会不同。
(6)第一AM和第二AM。
当数据流在不同的逻辑通道上传输时，接收端可以基于AM(比如上述第一AM或第二AM)对多个逻辑通道进行对齐。本申请实施例的AM为承载的信息包括N路明文数据流的数据对齐的信息的一个比特位或多个连续的比特位。一个AM上承载的信息可以是指该AM包括的比特位上承载的信息。IEEE 802.3规范设计了对齐标识(alignment marker，AM)。本申请实施例中提到的AM除了可以为现有规范设计的AM之外，还可以是未来其他规范或其他形式定义的承载有N路明文数据流的数据对齐的信息的一个比特位或多个连续的比特位。
发送端将一条串行流转换为N个逻辑通道(比如N个FEC通道)的N个数据流，其中，每个逻辑通道的数据流中周期性的部署有AM(发送端周期性插入的)(比如第一明文数据流中的第二AM)。
接收端获取到N个逻辑通道中的数据流(比如可以为N路密文数据流)，可根据各个逻辑通道的AM(比如第一密文数据流中的第一AM)进行通道锁定，以便将N个逻辑通道中的数据流合并还原出前述串行流。
不同传输速率(比如25Gbps、50Gbps或100Gbps等)对应的AM的格式可能不同。下面分别介绍100Gbps、50Gbps、25Gbps下标准规定的AM的格式。
本申请实施例中AM可以包括至少一个AM数据单元，AM数据单元可以是指一个比特位或一串连续的比特位。AM数据单元可称为AM码块。
(6.1)AM码块的格式，AM码块包括：标识字段和校验字段。
图3a示例性示出了一个AM码块的格式示意图，如图3a所示，一个AM码块可以包括8个字段，分别为M0字段、M1字段、M2字段、BIP 3字段、～M0字段、～M1字段、～M2字段和～BIP 3字段。其中，每个字段可以包括8个字节。
如图3a所示，AM码块承载的信息可以分为两大类，分别为标识信息和校验信息。M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段承载的为标识信息，BIP 3字段与～BIP 3字段承载的为校验信息，比如比特交织奇偶校验值(bit interleaving parity，BIP)。
基于此，可以将一个AM码块中包括的所有字段划分为两个字段：标识字段和校验字段。
其中，一个AM码块的标识字段可以包括该AM码块的M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。需要注意的是，可以称一个AM码块包括一个标识字段，图中为了更清楚的进行标识，将一个AM码块的一个标识字段在图中标注为两部分，一部分为M0字段、M1字段和M2字段，另一部分为～M0字段、～M1字段和～M2字段。
一个AM码块的校验字段可以包括BIP 3字段与～BIP 3字段。需要注意的是，可以称一个AM码块包括一个校验字段，图中为了更清楚的进行标识，将一个AM码块的一个校验字段 在图中标注为两部分，一部分为BIP 3字段，另一部分为～BIP 3字段。
(6.2)传输速率为100吉比特每秒(giga bits per second，Gbps)的逻辑通道上的AM。
每个逻辑通道中的AM可以包括AM锁定信息字段、通道标识信息字段和校验信息字段。
其中，AM锁定信息字段可以用于承载AM锁定信息。
通道标识信息字段用于承载逻辑通道的通道标识信息。
校验信息字段用于承载校验信息。
图3b示例性示出了传输速率为100Gbps的逻辑通道上的AM的格式，如图3b所示，N可以为4，4条逻辑通道(图中以逻辑通道为FEC通道为例进行展示)其中，FEC通道0中的一个AM包括amp_tx_0、amp_tx_4、amp_tx_8、amp_tx_12和amp_tx_16。FEC通道1中的一个AM包括amp_tx_1、amp_tx_5、amp_tx_9、amp_tx_13和amp_tx_17。FEC通道2中的一个AM包括amp_tx_2、amp_tx_6、amp_tx_10、amp_tx_14和amp_tx_18。FEC通道3中的一个AM包括amp_tx_3、amp_tx_7、amp_tx_11、amp_tx_15和amp_tx_19。
4条FEC通道中的amp_tx_0、amp_tx_1、amp_tx_2…、amp_tx_19中的每一个可以为一个AM码块，其结构可以参见图3a所示AM码块。图3c中示例性示出了FEC通道0的AM中的amp_tx_0和amp_tx_1与AM码块的对应关系示意图，下面结合图3b和图3c对AM进行介绍。
(6.2.1)传输速率为100Gbps的逻辑通道上的AM中的AM锁定信息字段。
参见图3b和图3c，FEC通道0的AM中的锁定信息字段可以包括amp_tx_0中的标识字段。下面进行详细介绍。
对于4个FEC通道而言，amp_tx_0、amp_tx_1、amp_tx_2和amp_tx_3中的标识字段承载的信息相同，可以为预设值，比如为预设AM锁定信息，举个例子，amp_tx_0的标识字段的比特承载的信息为预设AM锁定信息，amp_tx_1的标识字段的比特承载的信息为预设AM锁定信息。接收端针对每个FEC通道，可以基于FEC通道的AM的第一个AM码块的标识字段承载的信息进行AM锁定。AM锁定也可以理解为通道锁定。
需要注意的是，可以称一个AM包括一个AM锁定信息字段，图3c中为了更清楚的进行标识，将一个AM的一个AM锁定信息字段在图中标注为两部分，一部分为amp_tx_0中的M0字段、M1字段和M2字段，另一部分为amp_tx_0中的～M0字段、～M1字段和～M2字段。
一种可能的实施方式中，接收端可以将接收到的AM中的第一个AM码块的标识字段的6个字节进行划分，得到12个半字节(nibble)。当接收端在确定至少存在两个AM与预设AM锁定信息匹配，则可以确定实现了对AM锁定，或者说实现了通道锁定，也可以理解为确定识别出AM。
其中，针对一个AM，该AM与预设AM锁定信息匹配可以包括：确定该AM的第一个AM码块满足预设规则。其中，预设规则可以包括：将第一个AM码块中的12个半字节与预设AM锁定信息进行匹配，匹配的半字节的数量大于预设的匹配数量，或者说不匹配的半字节的数量小于预设的不匹配数量。一种示例中，接收端基于第二AM码块进行AM锁定时，预设规则中的预设的不匹配数量可以为3。而本申请实施例中在后续还提供一种可能的实施方式中，接收端可以基于第一AM码块进行AM锁定，为了降低AM锁定过程的误码率，可以将预设规则中的预设的不匹配数量进行调整，比如可以调低为1。该方案在后续内容将详细说明，在此先不做阐述。
基于此，本申请中将传输速率为100Gbps的FEC通道上的AM中第一个AM码块的标识 信息字段称为AM锁定信息字段，AM锁定信息字段承载的信息至少包括AM锁定信息。本申请实施例中为了区分，将第一密文数据流中第一AM中的AM锁定信息字段称为第一AM锁定信息字段，将第一明文数据流中第二AM中的AM锁定信息字段称为第二AM锁定信息字段。
需要说明的是，图3b中amp_tx_16、amp_tx_17、amp_tx_18和amp_tx_19中的任两个的标识字段承载的信息也相同，也可以用于承载低功耗下的AM锁定信息。FEC通道0中的AM中的AM锁定信息字段也可以包括amp_tx_16中的标识字段。类似的，FEC通道1中的AM中的AM锁定信息字段也可以包括amp_tx_17中的标识字段。FEC通道2中的AM中的AM锁定信息字段也可以包括amp_tx_18中的标识字段。FEC通道3中的AM中的AM锁定信息字段也可以包括amp_tx_19中的标识字段。
(6.2.2)传输速率为100Gbps的逻辑通道上的AM的通道标识信息字段。
参见图3b和图3c，FEC通道0的AM中的通道标识信息字段可以包括amp_tx_4、amp_tx_8和amp_tx_12中的至少一项的标识字段，图3c中示出了通道标识信息字段包括amp_tx_4中的标识字段的示意，下面结合图3c进行详细介绍。
对于FEC通道0而言，amp_tx_4、amp_tx_8和amp_tx_12中的3个AM码块的3个标识字段中承载的信息可以共同用于指示FEC通道0的通道标识信息。FEC通道0中AM中的通道标识信息字段可以是指amp_tx_4、amp_tx_8和amp_tx_12中的3个AM码块中的3个标识字段。
类似的，FEC通道1中AM中的通道标识信息字段可以是指amp_tx_5、amp_tx_9和amp_tx_13中的3个AM码块中的3个标识字段。FEC通道2中AM中的通道标识信息字段可以是指amp_tx_6、amp_tx_10和amp_tx_14中的3个AM码块中的3个标识字段。FEC通道3中AM中的通道标识信息字段可以是指amp_tx_7、amp_tx_11和amp_tx_15中的3个AM码块中的3个标识字段。其中，一个AM码块的标识字段可以包括图3a中的M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。
任两个逻辑通道的通道标识信息不同，比如FEC通道0的通道标识信息(amp_tx_4、amp_tx_8和amp_tx_12中的所有标识字段承载的信息)与FEC通道1的通道标识信息(amp_tx_5、amp_tx_9和amp_tx_13中的所有标识字段承载的信息)中至少存在一个比特的值不同。
本申请实施例中为了区分，将第一密文数据流中的第一AM中的通道标识信息字段称为第一通道标识信息字段，将第二AM中的通道标识信息字段称为第二通道标识信息字段。
(6.2.3)传输速率为100Gbps的FEC通道上的AM的校验信息字段。
参见图3b和图3c，对于FEC通道0而言，AM中的校验信息字段可以包括AM中包括的至少一个AM码块中的校验字段。图3c中以AM中的校验信息字段可以包括amp_tx_0中的校验字段为例进行展示。
本申请实施例中为了区分，将第一密文数据流中的第一AM中的校验信息字段称为第一校验信息字段，将第二AM中的校验信息字段称为第二校验信息字段。
(6.3)传输速率为50Gbps的FEC通道上的AM的格式。
图3d示例性示出了传输速率为50Gbps的逻辑通道上的AM的格式，如图3d所示，N可以为2，2条逻辑通道，其中，FEC通道0中的一个AM包括amp_tx_0和amp_tx_2，FEC通道0还可以包括amp_tx_3的第56比特和第57比特(amp_tx_3的首比特称为第0比特)。FEC通道1中的一个AM包括amp_tx_1和amp_tx_3。FEC通道1包括amp_tx_3的第0比特至第55比特， 以及amp_tx_3的第58比特和第63比特。
如图3d所示，FEC通道0和FEC通道1还可以分别包括1比特pad(1-bit Pad)，一个FEC通道的4个AM码块有256比特。一个RS-FEC码字数据部分的大小为5140比特，因此AM码块可以凑成257的整数倍。在一个FEC通道中增加1比特pad，从而可以将一个FEC通道的一个AM凑成257比特码块的整数倍。
4条FEC通道中的amp_tx_0、amp_tx_1、amp_tx_2和amp_tx_3中的每一个可以为一个AM码块，其结构可以参见图3a所示AM码块。图3e中示例性示出了FEC通道0的AM中的amp_tx_0和amp_tx_1与AM码块的对应关系示意图，下面结合图3d和图3e对AM进行介绍。
如图3d和图3e所示，FEC通道0的AM中的锁定信息字段可以包括amp_tx_0中的标识字段。FEC通道1的AM中的锁定信息字段可以包括amp_tx_1中的标识字段。对于2个FEC通道而言，amp_tx_0和amp_tx_1中的标识字段承载的信息相同，可以为预设值，比如为预设AM锁定信息。接收端针对每个逻辑通道，可以基于逻辑通道的AM的第一个AM码块的标识字段承载的信息进行AM锁定。进行AM锁定的方式可以参见前述100Gbps的相关描述，在此不再赘述。
如图3d和图3e所示，FEC通道0的AM中的通道标识信息字段可以包括amp_tx_2中的标识字段。FEC通道1的AM中的通道标识信息字段可以包括amp_tx_3中的标识字段。
任两个逻辑通道的通道标识信息不同，比如FEC通道0的通道标识信息(amp_tx_2的所有标识字段承载的信息)与FEC通道1的通道标识信息(amp_tx_3的所有标识字段承载的信息)中至少存在一个比特的值不同。
如图3d和图3e所示，对于FEC通道0而言，AM中的校验信息字段可以包括AM中包括的至少一个AM码块中的校验字段。图3e中以AM中的校验信息字段可以包括amp_tx_0中的校验字段为例进行展示。
(6.4)传输速率为25Gbps的FEC通道上的AM的格式。
图3f示例性示出了传输速率为25Gbps的逻辑通道上的AM的格式，如图3f所示，N可以为1，即仅包括1条逻辑通道，该逻辑通道可以称为FEC通道，其中，该逻辑通道的一个AM包括AM0、AM1、AM2和AM3。
AM0、AM1、AM2和AM3中的每一个可以为一个AM码块，其结构可以参见图3a所示AM码块。图3g中示例性示出了AM中的AM0和AM1与AM码块的对应关系示意图，下面结合图3f和图3g对AM进行介绍。
如图3f和图3g所示，AM中的锁定信息字段可以包括AM0中的标识字段。AM0中的标识字段承载的信息可以为预设值，比如为预设AM锁定信息。接收端针对该一个逻辑通道，可以基于逻辑通道的AM的第一个AM码块(AM0)的标识字段承载的信息进行AM锁定。进行AM锁定的方式可以参见前述100Gbps的相关描述，在此不再赘述。
如图3f和图3g所示，AM中的通道标识信息字段可以包括AM1、AM2和AM3中的至少一项中的标识字段。图3g中以通道标识信息字段包括AM1中的标识字段为例进行展示。
如图3f和图3g所示，AM中的校验信息字段可以包括AM中包括的至少一个AM码块中的校验字段。图3g中以AM中的校验信息字段可以包括AM0中的校验字段为例进行展示。
(7)加密参数。
本申请实施例中加密参数的信息可以部署于一个或多个AM中。也可以理解为加密参数的信息可以承载于一个AM周期内包括的一个AM中，也可以承载于多个AM周期内包 括的多个AM中。
一种可能的实现方法，加密参数可以用于对该加密参数所在的AM周期内的数据段进行加密。又一种可能的实现方法，加密参数可以用于对其他AM周期(除该加密参数所在的AM周期之外的AM周期)内的数据段进行加密。
本申请实施例中的加密参数可以包括密钥标识和初始化向量标识。密钥标识指示对数据段加密所使用的加密密钥。初始化向量IV标识指示对数据段加密所使用的初始化向量。
基于上述内容，图4a示例性示出了本申请实施例提供的一种数据传输方法流程示意图。该方法可以由第一通信装置和第二通信装置或第一通信装置和第二通信装置内的模块或芯片执行，关于第一通信装置和第二通信装置的相关介绍可以参见前述内容，在此不再赘述。如图4a所示，该方法包括：
S401，第一通信装置获取第一密文数据流。
其中，第一密文数据流包括第一对齐标识AM以及加密的第一数据段；第一AM用于第一密文数据流的数据对齐。第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。
S402，第一通信装置向第二通信装置发送第一密文数据流。
S403，第二通信装置获取第一密文数据流。
S404，第二通信装置根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流中未加密的第一数据段。
在S404之后，还可以包括S405：
S405，第二通信装置对第一密文数据流中的第一AM进行处理，得到第一明文数据流中的第二AM。
在S401中，第一通信装置可以获取N路密文数据流，N为正整数。相对应的，在S402中，第一通信装置可以发送N路密文数据流。在S403中，第二通信装置可以获取N路密文数据流。在S404和S405中，第二通信装置可以将N路密文数据流恢复为N路明文数据流。其中，第一密文数据流是N路密文数据流中的一路密文数据流。第一明文数据流是N路明文数据流中的一路明文数据流。第一密文数据流与第一明文数据流对应。本申请实施例中N路密文数据流中的每路密文数据流可以单独进行加解密，任两路密文数据流的加密参数之间可以没有关联。本申请实施例中的N可以为大于1的正整数，N路密文数据流中的其他密文数据流的处理方法可以参见第一密文数据流的处理方法，不再赘述。
本申请通过数据流中已有的对齐数据单元中的比特位传输加密参数信息，并未额外增加用于传输加密参数信息的比特位，因此加密参数信息的传输未占用用户业务带宽。
另一方面，由于本申请对物理层中的数据流(或称比特流)进行加密传输，因此以太网帧中所有的比特(包括源MAC地址、目的MAC地址)均可被加密，进而可以提升安全性。
本申请实施例中可以针对每个逻辑通道单独传输该逻辑通道的加密参数，即各个逻辑通道的加解密过程并无关联，可以单独从一个逻辑通道传输的数据流中提取出该数据流的加密参数，并对该逻辑通道的数据流进行解密。而且由于第二通信装置将第一AM处理， 恢复为第一明文数据流中的第二AM，因此本申请实施例的方案对上层MAC基本可以无影响。
在上述S401中，第一通信装置获取N路密文数据流的一种可能的实施方式中，第一通信装置可以获取N路明文数据流。根据N路明文数据流中数据段对应的加密参数，得到N路密文数据流。
N路明文数据流与N路密文数据流一一对应。第一明文数据流是N路明文数据流中的一路明文数据流。第一密文数据流为第一明文数据流在N路密文数据流中对应的一路密文数据流。第一明文数据流包括至少两个第二AM以及未加密的至少一个第一数据段。至少两个第二AM用于N路明文数据流的数据对齐。
图4b示例性示出了本申请实施例提供的另一种数据传输方法流程示意图。图4b中以第一通信装置为光模块或光模块中的模块或单元为例进行展示。
如图4b所示，第一通信装置获取M路物理通道信号，按照设定的比例如M：N，将M路物理通道信号(如图中物理通道0～物理通道M-1)经由BitMux中的BitMux(A)转换为N路逻辑通道信号(如图中FEC通道0～FEC通道(N-1))。第一通信装置针对每一路逻辑通道分别搜索该逻辑通道内的AM，并在指定间隔(不同速率以太网MAC/PHY，AM间隔可以不同)内锁定。
N路逻辑通道信号包括的是明文数据，N路逻辑通道信号也可以称为N路明文数据流。针对N路明文数据流中的一路明文数据流(比如第一明文数据流)，MCU可以对第一明文数据流中未加密的第一数据段进行加密，得到第一密文数据流中加密的第一数据段。进一步可以在第一明文数据流中的第二AM中插入加密参数信息，得到第一密文数据流中的第二AM。进一步，N路密文数据流经由BitMux中的BitMux(B)转换成可输入到oDSP的K路数字信号。
需要说明的是，在一种可能的实施方式中，第一通信装置可以将多个PCS通道的多路密文数据流(包含加密的数据段、加密参数信息等)聚合为一路串行码块流，之后对该一路串行码块流可以进行RS-FEC编码(RS-FEC Encode)，之后再形成N个FEC通道对应的N路加密信号，并向第二通信装置发送N路加密信号。如此，接收端可以对接收到的信号进行RS-FEC解码，从而可以使用RS-FEC纠正由于链路产生的误码。该RS-FEC编码可以理解为以太网架构的RS-FEC编码。需要注意的是，本申请实施例中的加密参数信息中也可以包括RS-FEC码，该RS-FEC码是为了纠正加密参数信息中可能出现的误码。
本申请实施例中MCU可以配置和更新加密模块所需的加密参数信息。该加密参数信息包括加密关键参数，如初始化向量IV和密钥标识。可选的，也可以在第一通信装置的BitMux中部署相应功能模块如AM锁定模块和加密/解密模块。具体可以针对每个逻辑通道单独部署AM锁定模块和加密/解密模块。其中，针对每个逻辑通道对应的一路明文数据流，AM锁定模块可用于将加密参数信息插入到该明文数据流中的AM，加密/解密模块可用于基于加密参数对该明文数据流进行加密(Encryption)，得到密文数据流。具体的，MCU可在第一次启动时配置IV，后续则由加密/解密模块按照设定的规则自动更新IV。MCU配置以及修改密钥标识。AM锁定模块可以负责锁定逻辑通道中的AM，并使用锁定的AM承载最新的加密参数。
本申请实施例中第一明文数据流中的第二AM通过处理，可以得到第一密文数据流中的第一AM。具体来说，第一通信装置可以在第二AM的第二AM锁定信息字段中的部分比特、第二通道标识信息字段中的部分比特，或者，第二校验信息字段中的部分或全部比特中的至少一项承载：至少一个第一数据段的加密参数信息，进而得到第一密文数据流中的第一AM。也可以理解为第二AM中存在三个字段可以用于承载加密参数信息。下面对该三个字段分别进行介绍。
(1)第二AM锁定信息字段和第一AM锁定信息字段。
本申请实施例中以第一明文数据流中的第二AM和第一密文数据流中的第一AM为例进行介绍，该第一AM是通过对该第二AM进行处理(比如，在该第二AM中加入加密参数信息)后得到的。也可以说第一AM与第二AM对应。
当该第一AM的第一AM锁定信息字段没有承载加密参数信息，则第二AM锁定信息字段承载的信息与第一AM锁定信息字段承载的信息相同。
当该第一AM的第一AM锁定信息字段承载有加密参数信息中的部分或全部，则一种可能的实施方式中，第一AM锁定信息字段承载的信息是通过对第二AM锁定信息字段中的部分比特承载的信息替换为加密参数信息中的部分或全部后得到的。
本申请实施例中第二AM的结构形式可以参见前述图3a至图3g的相关描述，下面以图3b和图3c为例进行介绍。比如第一明文数据流为图3b中的FEC通道0对应的数据流，第二AM的结构形式如图3c所示。
如图3c所示，第二AM锁定信息字段可以为图3c中的AM锁定信息字段，具体为amp_tx_0中的标识字段。第二AM锁定信息字段中用于承载第一明文数据流的AM锁定信息。
通过对该第二AM进行处理得到的第一AM中的第一AM锁定信息字段也可以为图3c中的AM锁定信息字段，具体可以为amp_tx_0中的标识字段。第一AM锁定信息字段中用于承载加密参数信息的比特位为以下字段的比特位中的部分比特位：M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。
如图3c所示，第一AM锁定信息字段可以包括amp_tx_0中的标识字段。amp_tx_16中的标识字段用于低功耗场景下的AM锁定，本申请实施例中第一AM锁定信息字段可以不包括amp_tx_16中的标识字段。类似的，50Gbps传输速率下第一AM锁定信息字段可以包括仅包括amp_tx_0中的标识字段(可以参考图3e)。
本申请实施例中可以通过将第二AM锁定信息字段中原本用于承载AM锁定信息的比特承载加密参数信息，比如第一通信装置可以从第一AM锁定信息字段中挪用8个比特，用于承载加密参数信息。进一步，接收端可以配合本申请提出的匹配规则进行AM锁定，从而可以尽量不影响AM的锁定性能。
一种可能的实施方式中，第一AM锁定信息字段中用于承载加密参数信息的比特位为以下内容中的一项：
M0字段前4比特，以及～M0字段前4比特中的比特位；
M1字段前4比特，以及～M1字段前4比特中的比特位；或，
M2字段前4比特，以及～M2字段前4比特中的比特位。
图5a示例性示出了图3c的AM中可以用于承载加密参数信息的比特位示意图，如图5a所示，第一AM锁定信息字段中用于承载加密参数信息的比特位为M1字段前4比特， 以及～M1字段前4比特中的比特位。
又一种可能的实施方式中，为了保证0/1均衡性，针对至少两个第一AM中承载有至少一个第一数据段的加密参数信息中的部分或全部的第一AM：第一AM承载的属于加密参数信息的信息划分为两个部分，分别为第一部分信息和第二部分信息，第二部分信息是通过对第一部分信息对应的比特值取反得到的信息。
第一部分信息和第二部分信息的分布方式有多种可能。一种可能的实施方式中，第一通信装置可以在第一AM锁定信息字段、第一通道标识信息字段和第一校验信息字段中的每个字段上承载一部分原始的加密参数信息，也承载该原始的加密参数信息的取反后的信息。比如，第一AM锁定信息字段中承载的属于加密参数信息的信息划分为两个部分，分别为第三部分信息和第四部分信息，且第四部分信息是通过对第三部分信息对应的比特值取反得到的信息。
如图5a所示，M1字段前4比特可以用于承载原始的加密参数信息中的4比特信息，而～M1字段前4比特可以承载M1字段前4比特的值取反后的值。比如，M1字段前4比特中第0个比特的值为0，则～M1字段前4比特中的第0个比特的值为1。再比如，比如M1字段前4比特中第0个比特的值为1，则～M1字段前4比特中的第0个比特的值为0。
图5a中仅仅是一种示例，具体放置原始加密参数的信息和原始的加密参数的信息取反后的信息有多种可能的实施方式，比如可以将一部分原始的加密参数的信息承载于M1字段前4比特以及～M1字段前4比特，之后在～BIP 3字段承载M1字段前4比特以及～M1字段前4比特的所有的比特值取反后的值。再比如，可以～M1字段前4比特承载原始的加密参数的信息，而通过M1字段前4比特承载～M1字段前4比特的值的取反后的值。
另一方面，在上述S405中，第二通信装置在对第二AM进行处理的过程中，若第一AM锁定信息字段中的部分比特承载有加密参数信息，则第二通信装置可以在S405中，将第一AM锁定信息字段中承载加密参数信息的比特位的值恢复为第二预设值。第二预设值为该第一AM对应的第二AM的第二AM锁定信息字段中的对应比特位(比如M1字段前4比特，以及～M1字段前4比特)承载的值。第二预设值也可以理解为协议规定的原始值。可以看出，本申请实施例中无需识别出第一密文数据流的逻辑通道标识即可将第一AM锁定信息字段的内容恢复为原始值。
(2)第二校验信息字段和第一校验信息字段。
第二校验信息字段中用于承载第一明文数据流的校验信息。当该第一AM的第一校验信息字段没有承载加密参数信息，则第二校验信息字段承载的信息与第一校验信息字段承载的信息相同。
当该第一AM的第一校验信息字段承载有加密参数信息中的部分或全部，则一种可能的实施方式中，第一校验信息字段承载的信息是通过对第二校验信息字段中的部分比特承载的信息替换为加密参数信息中的部分或全部后得到的。
下面以图3b和图3c为例进行介绍。比如第一明文数据流为图3b中的FEC通道0对应的数据流，第二AM的结构形式如图3c所示。
如图3c所示，第二校验信息字段可以为图3c中的校验信息字段，具体可以为amp_tx_0中的校验字段，也可以包括其他AM码块中的校验字段。为了更容易进行标准化，本申请实施例中以第二校验信息字段为AM中第一个AM码块中的校验字段为例进行展示。
通过对该第二AM进行处理得到的第一AM中的第一校验信息字段也可以为图5a中的校验信息字段，具体可以为amp_tx_0中的校验字段。第一校验信息字段中用于承载加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：BIP 3字段或～BIP 3字段。比如第一校验信息字段中用于承载加密参数信息的比特位可以包括～BIP 3字段前4比特，以及～BIP 3字段后4比特中的比特位。
又一种可能的实施方式中，为了保证0/1均衡性，第一校验信息字段中承载的属于加密参数信息的信息划分为两个部分，分别为第七部分信息和第八部分信息，且第八部分信息是通过对第七部分信息对应的比特值取反得到的信息。
如图5a所示，～BIP 3字段前4比特可以用于承载原始的加密参数信息中的4比特信息，而～BIP 3字段后4比特可以承载M1字段前4比特的值取反后的值。比如，～BIP 3字段前4比特中第0个比特的值为0，则～BIP 3字段后4比特中的第0个比特的值可以为1。再比如，比如～BIP 3字段前4比特中第0个比特的值为1，则～BIP 3字段后4比特中的第0个比特的值可以为0。图5a中仅仅是一种示例，具体放置原始加密参数的信息和原始的加密参数的信息取反后的信息有多种可能的实施方式。
另一方面，在上述S405中，第二通信装置在对第二AM进行处理的过程中，若第一校验信息字段承载有加密参数信息，则第二通信装置可以在S405中，将第一校验信息字段中承载加密参数信息的比特位的值进行恢复。比如，根据第一校验信息字段中承载的第一校验信息(比如将BIP 3字段承载的信息称为第一校验信息)，将第一校验信息字段中用于承载加密参数信息的比特位(～BIP 3字段的8个比特位)上的信息恢复为第一校验信息对应的比特值(BIP 3字段的8个比特位的比特值)取反后的信息。可以看出，本申请实施例中无需识别出第一密文数据流的逻辑通道标识即可将第一校验信息字段的内容恢复为原始值。另一方面，可以看到，只有在BIP 3字段也发生误码的情况下，才会造成～BIP 3字段的恢复错误，继而才会对以太网架构下的RS-FEC码纠错性能造成影响，而BIP 3字段发生误码的概率较小，因此本申请实施例中采用～BIP 3字段承载加密参数信息，对以太网架构下的RS-FEC码纠错性能影响较小。
(3)第二通道标识信息字段和第一通道标识信息字段。
当该第一AM的第一通道标识信息字段没有承载加密参数信息，即该第一通道标识信息字段全部比特都用于承载第一密文数据流的通道标识信息，则第二通道标识信息字段承载的信息与第一通道标识信息字段承载的信息相同。
当该第一AM的第一通道标识信息字段承载有加密参数信息中的部分或全部，则一种可能的实施方式中，第一通道标识信息字段承载的信息是通过对第二通道标识信息字段中的部分比特承载的信息替换为加密参数信息中的部分或全部后得到的。
下面以图3b和图3c为例进行介绍。比如第一明文数据流为图3b中的FEC通道0对应的数据流，第二AM的结构形式如图3c所示。
如图3c所示，第二通道标识信息字段可以为图3c中的通道标识信息字段，具体可以为amp_tx_4中的标识字段。第二通道标识信息字段用于承载第一明文数据流的通道标识信息。
通过对该第二AM进行处理得到的第一AM中的第一通道标识信息字段也可以为图5a中的通道标识信息字段，具体可以为amp_tx_4中的标识字段。第一通道标识信息字段中 用于承载加密参数信息的比特位为以下字段的比特位中的部分比特位：M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。如图3c所示，第一通道标识信息字段可以包括amp_tx_4中的标识字段。
本申请实施例中第一通道标识信息字段中用于承载加密参数信息的比特位为：第一通道标识信息字段中k1个比特位中的部分或全部比特位。该k1个比特用于承载k1个预设值。k1为正整数。该预设值为固定值。如此，接收端可以根据相关规定，将被挪用承载加密参数信息的k1个比特的值恢复为预设值，进而减少对通道标识信息的识别过程的影响。
进一步，当第一通信装置中包括多个逻辑通道时，每个逻辑通道的AM中的通道标识信息字段均包括该k1个预设值。即虽然任两个逻辑通道的通道标识信息字段承载的通道标识信息不同，但是该两个通道标识信息字段中均包括该k1个预设值。举个例子，N路明文数据流还包括第二明文数据流，第二明文数据流中包括至少两个第三AM。至少两个第三AM中的第三AM包括承载第二明文数据流的通道标识信息的第三通道标识信息字段，且第三通道标识信息字段中包括承载k1个第一预设值的k1个比特位。
一种可能的实施方式中，针对k1个预设值中的一个预设值，承载预设值的比特位在第三通道标识信息字段所有比特位中的排序，与承载预设值的比特位在第二通道标识信息字段所有比特位中的排序相同。也就是说，两个逻辑通道的通道标识信息字段中用于承载k1个第一预设值的k1个比特位的位置相同。
为了与标准协议更加兼容，一种可能的实施方式中，第一通道标识信息字段中用于承载加密参数信息的比特位为第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：
第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、第45个比特位、第47个比特位和第52个比特位。
也可以称上述AM码块的8个比特位即为前述k1个比特位。需要声明的是，上述码块的排序是在AM码块中的首个比特位称为第0个比特位的前提下命名的。
图5a示例性示出了图3c的AM中可以用于承载加密参数信息的比特位示意图，如图5a所示，第一通道标识信息字段中用于承载加密参数信息的比特位为amp_tx_4的AM码块中的第4个比特位(位于M0字段)、第13个比特位(位于M1字段)、第15个比特位(位于M1字段)、第20个比特位(位于M2字段)、第36个比特位(位于～M0字段)、第45个比特位(位于～M1字段)、第47个比特位(位于～M1字段)和第52个比特位(位于～M2字段)。
对于100G以太网而言，amp_tx_4、amp_tx_5、amp_tx_6、amp_tx_7具有的8个共同比特(k1个比特位)，这些共同比特(k1个比特位)的值为10000111。对于50G以太网而言，amp_tx_2和amp_tx_3同样具有8个共同比特(k1个比特位)，这些共同比特(k1个比特位)的值为01011010。对于25G以太网而言，AM中的k1个比特位承载的k1个预设值为：10100101。接收端可以基于k1个预设值，将第一AM中的通道标识信息字段的该k1个比特位的值恢复为k1个预设值，以便可以避免对接收端的其他数据处理进程，比如可以避免对以太网架构下的RS-FEC码纠错过程的影响。
又一种可能的实施方式中，为了保证0/1均衡性，第一通道标识信息字段中承载的属于加密参数信息的信息划分为两个部分，分别为第五部分信息和第六部分信息，且第六部分信息是通过对第五部分信息对应的比特值取反得到的信息。
如图5a所示，amp_tx_4的AM码块中的第4个比特位(位于M0字段)可以用于承载原始的加密参数信息中的1比特信息，而amp_tx_4的AM码块中的第36个比特位(位于～M0字段)可以承载第4个比特位的值取反后的值。
amp_tx_4的AM码块中的第13个比特位(位于M1字段)可以用于承载原始的加密参数信息中的1比特信息，而amp_tx_4的AM码块中的第45个比特位(位于～M1字段)可以承载第13个比特位的值取反后的值。
amp_tx_4的AM码块中的第15个比特位(位于M1字段)可以用于承载原始的加密参数信息中的1比特信息，而amp_tx_4的AM码块中的第47个比特位(位于～M1字段)可以承载第15个比特位的值取反后的值。
amp_tx_4的AM码块中的第20个比特位(位于M2字段)可以用于承载原始的加密参数信息中的1比特信息，而amp_tx_4的AM码块中的第52个比特位(位于～M2字段)可以承载第20个比特位的值取反后的值。
图5a中仅仅是一种示例，具体放置原始加密参数的信息和原始的加密参数的信息取反后的信息有多种可能的实施方式中，比如可以将一部分原始的加密参数的信息承载于M1字段前4比特以及～M1字段前4比特，之后在第一通道标识信息字段中的k1个比特承载M1字段前4比特以及～M1字段前4比特的所有的比特值取反后的值。
另一方面，在上述S405中，第二通信装置在对第二AM进行处理的过程中，若第一通道标识信息字段中的部分比特承载有加密参数信息，则第二通信装置可以在S405中，将第一通道标识信息字段中承载加密参数信息的比特位的值恢复为第一预设值。第一预设值为该第一AM对应的第二AM的第二通道标识信息字段中的k1个比特位承载的值。第一预设值也可以理解为协议规定的原始值。可以看出，本申请实施例中无需识别出第一密文数据流的逻辑通道标识即可将第一通道标识信息字段的内容恢复为原始值。
需要说明的是，以上内容以100Gbps传输速率为例介绍AM中用于承载加密参数信息的比特位的分布，其他传输速率的AM中用于承载加密参数信息的比特位的分布情况可以参见图5a，比如50Gbps传输速率中FEC通道0的AM中用于承载加密参数信息的比特位可以分布在amp_tx_0和amp_tx_2对应的AM码块上(请参见图3e)，其中，50Gbps传输速率中FEC通道0的密文数据流中的AM中的amp_tx_0的结构形式可以参见图5a中的amp_tx_0的结构形式，amp_tx_2的结构形式可以参见图5a中的amp_tx_4的结构形式，在此不再赘述。再比如，25Gbps传输速率中AM中用于承载加密参数信息的比特位可以分布在AM0和AM1对应的AM码块上(请参见图3g)，其中，25Gbps传输速率中逻辑通道的密文数据流中的AM中的AM0的结构形式可以参见图5a中的amp_tx_0的结构形式，AM1的结构形式可以参见图5a中的amp_tx_4的结构形式，在此不再赘述。
图5b示例性示出了本申请实施例提供的第一密文数据流中承载的加密参数信息的复帧的结构示意图，如图5b所示，第一密文数据流包括多个第一AM集合，针对一个第一AM集合，该第一AM集合可以包括L个第一AM，L为正整数。图5b所示的例子中，每个第一AM中有24比特可以用于承载加密参数信息，其中有12比特可以承载原始的加密参数信息，而剩余12比特用于承载该第一AM中承载的原始的加密参数信息的比特值的取反的值。基于此，加密参数信息的12个比特可以放置于一个第一AM中。
如图5b所示，该复帧中可以包括以下内容第3项和第5项。一种可能的实施方式中， 该复帧中还可以包括以下内容中的其他项(除第3项和第5项之外的项)中的一项或多项：
(1)复帧起始标识信息，复帧起始标识信息用于指示承载加密参数信息的复帧的起始位。
比如，可以用2个比特取值为“10”表示是复帧开始，重复6次，占用12比特，第一AM中的剩余12比特可以为该占用的12比特的值的取反。比如用于承载复帧起始标识信息的第一AM中的M1的前4比特二进制取值“1010”，～BIP 3的前4比特取值为“1010”；该第一AM中的～M1的前4比特二进制取值“0101”，～BIP 3的后4比特取值为“0101”。该第一AM中的第一通道标识信息字段的k1个比特位中的前4个比特位为“1010”，后4个比特位为“0101”。
(2)复帧锁定状态标识信息，复帧锁定状态标识信息用于指示发送端和/或接收端的复帧是否锁定。比如，连续2个复帧的起始标识信息与预先定义的模式匹配(即“10”)，则表明复帧锁定。如果连续3个复帧的起始标识信息都与预先定义的模式不匹配(即“10”)，则表明复帧未锁定。
第一通信装置可以选用承载复帧起始标识信息的第一AM的下一个第一AM，在该第一AM上用2个比特表示发送端和/或接收复帧锁定状态。比如：01表示本端复帧未锁定；11表示本端复帧锁定等待远端复帧锁定；10表示本端复帧锁定远端复帧锁定。
(3)密钥标识。
第一通信装置可以选用承载复帧起始标识信息的第一AM的下一个第一AM，在该第一AM上用2个比特取值为“10”与“01”表示密钥标识。密钥标识从“10”变换为“01”，或从“01”变化为“10”，则可以表示下一个复帧周期将采用新的加密秘钥。
(4)保留位。
为了与未来的技术兼容，可以留出一定数量的保留位，以便承载其他信息。
(5)初始化向量标识。
本实施例取IV长12个字节，则IV占据8(12*8/12＝8)个AM周期中的8个第一AM。
本申请实施例中对第一数据的加密算法可以有多种，比如可以选择高级加密标准伽罗华/计数器模式(Advanced Encryption Standard Galois/Counter Mode，AES-GCM)。
(6)加密参数信息的纠错信息。
加密参数信息的纠错信息可以为RS-FEC码，RS-FEC码可以较好的应对突发误码，可以有效抵抗链路误码对加密参数传输可靠性的影响。比如，加密参数信息的纠错信息可以RS-FEC码(RS-FEC(57，33，12，2^8))，其定义在有限域GF(2^8)上，一个符号为8比特，其中33为数据符号的长度，通过增加24个校验符号，构成一个长度为57个符号的码字，它可以纠正该码字中任意12个符号。在随机信道模型下，对于2.4e-04误码率，该码字错误概率极低，出错时间满足宇宙年可靠性的要求。因此，通过RS-FEC码对加密参数信息的复帧中的信息进行纠错，可以保证宇宙年的可靠性，可以有效抵抗链路误码对加密参数传输可靠性的影响。
加密参数信息的纠错信息还可以为BCH码， BCH码取自Bose、Ray-Chaudhuri与Hocquenghem的缩写。BCH码可以较好的应对随机误码，可以有效抵抗链路误码对加密参数传输可靠性的影响。
一种可能的实施方式中，在上述S403之后，S404之前，第二通信装置可以获取第一密文数据流中的加密参数信息的纠错信息，根据加密参数信息的纠错信息，对加密参数信 息中的其他信息进行纠错。如此，可以有效抵抗链路误码对加密参数传输可靠性的影响。
由于本申请实施例中在物理层实施加密和解密，AM对齐锁定、以太网架构的RS-FEC解码、扰码、转码以及FCS校验等MAC/PHY内机制可以抵御篡改，故可以不考虑完整性保护，因此本申请实施例中的加密参数信息可以不包括完整性校验值ICV，从而可以减少由于计算ICV所带来的时延与功耗开销。
需要说明的是，第一AM集合中承载的加密参数信息可以是该第一AM集合包括的第一数据段的加密参数的信息，也可以是其他第一AM集合中所包括的第一数据段的加密参数的信息，比如第一AM集合中承载的加密参数信息为下一个第一AM集合中所包括的第一数据段的加密参数的信息。
图6示例性示出了本申请实施例提供的另一种数据传输方法流程示意图。图4b中以第二通信装置为光模块或光模块中的模块或单元为例进行展示。本申请实施例中的解密方案可具体部署在光模块的BitMux中，MCU可控制在BitMux中转换出多路逻辑通道信号的过程中，对数据进行解密。
如图6所示，第二通信装置接收的光信号经由oDSP恢复出K路数字信号，BitMux中的BitMux(B)可以将K数字信号转换出N路密文数据流。之后第二通信装置可以针对N路密文数据流分别进行AM搜索，并可以在指定间隔(不同速率以太网MAC/PHY，AM间隔不同)内进行AM锁定。并对密文数据流中的数据段进行解密，且将密文数据流中第二AM中承载加密参数信息的比特位上的值进行恢复(比如恢复为明文数据流中的第二AM)，得到N路明文数据流。之后根据N路明文数据流中的第二AM识别出N路明文数据流中各路明文数据流的通道标识信息。
比如BitMux中部署的AM锁定模块可以用于锁定N路密文数据流，BitMux中部署的加密/解密模块可以用于对N路密文数据流进行解密(decryption)，得到N路明文数据流。N路明文数据流或称为N路逻辑通道信号(如图中FEC通道0～FEC通道(N-1))，BitMux中的BitMux(A)可以按照设定比例如M：N，将N路逻辑通道信号恢复成M路物理通道信号(如图中物理通道0～物理通道M-1)。进而光模块将M路物理通道信号传输至物理层的电芯片。
需要说明的是，在一种可能的实施方式中，第二通信装置可以从接收到的信号恢复出N路加密信号之后，可以对该多个逻辑通道的N路密文数据流分别进行解密和第一AM的恢复(将第一AM恢复为第二AM)，得到N个FEC通道的明文数据流。将N个FEC通道的信号聚合为一路串行信号流，之后对该一路串行信号流进行RS-FEC解码(RS-FECDecode)。如此，接收端可以对接收到的信号进行RS-FEC解码，从而可以使用RS-FEC纠正由于链路产生的误码。需要注意的是该RS-FEC解码可以理解为以太网架构的RS-FEC解码。需要注意的是，本申请实施例中的加密参数信息中也可以包括RS-FEC码，该RS-FEC码是为了纠正加密参数信息中可能出现的误码。
在上述S403之后，在S404之前，第二通信装置还可以对第一密文数据流进行AM锁定。一种可能的实施方式中，第二通信装置在确定第一密文数据流中存在连续的至少k2个第一AM满足预设规则，则确定根据至少k2个第一AM对第一密文数据流完成AM锁定；k2为大于1的整数。比如k2可以取值为2。
其中，至少k2个第一AM中的第一AM满足预设规则包括：在第一AM的第一AM锁定信息字段中的部分比特承载的信息中包括加密参数信息中的部分或全部的情况下，第一AM锁定信息字段承载的信息中除属于加密参数信息之外的信息与预设AM锁定信息之间至多存在k3个nibble(半字节)不匹配。
其中，k3的值可以小于3。一种可能的实施方式中，k3的值与第一AM锁定信息字段中用于承载加密参数信息的比特位的数量反相关。比如，当第一AM锁定信息字段中用于承载加密参数信息的比特位的数量为8，则k3的值为1。
本申请实施例中预设的AM锁定信息可以是指协议规定的AM中用于进行AM锁定的信息，比如图3b中所示的FEC通道0至FEC通道3中每个逻辑通道的第一个AM码块中AM锁定信息字段承载的信息。
由于第一明文数据流中第一AM锁定信息字段包括48比特，可以划分为12个nibble(半字节)，一种匹配规则是：当该12个nibble(半字节)中与预设的AM锁定信息不匹配的nibble(半字节)数量小于或等于3个时，则认为该AM匹配。而由于本申请实施例中将第二AM锁定信息字段中部分比特用于承载加密参数信息，比如用8比特承载加密参数信息，还剩余40比特承载AM锁定信息，因此，本申请实施例提出了一种AM匹配规则，即当第一AM锁定信息字段承载的信息中除属于加密参数信息之外的信息与预设AM锁定信息之间至多存在1个nibble(半字节)不匹配的情况下，则认为AM匹配。若连续两个AM匹配，则认为完成了AM锁定。
举个例子，比如100Gbps传输速率下，将第一AM锁定信息字段的M1字段的前4比特和～M1字段的前4比特承载加密参数信息，第二通信装置可以将第一AM中第一AM锁定信息字段承载的信息中除属于所述加密参数信息之外的比特(40比特)，与图3b中的4个逻辑通道对应的4个AM中的对应位置的40比特进行比对，当确定第一AM锁定信息字段承载的信息中除属于所述加密参数信息之外的40比特与图3b中的某一个逻辑通道的AM匹配，比如与FEC通道0的40比特(FEC通道0的M0字段的8比特、M1字段的后4比特、M2字段的8比特、～M0字段的8比特、～M1字段的后4比特和～M2字段的8比特，共40比特)完全一致(或至多存在1个nibble不匹配)，则确定该AM满足预设规则，若连续k2个AM满足预设规则，则完成对该AM的锁定。
下面通过仿真结果对本申请实施例进行进一步的描述。图7a示例性示出了5种情况下的失锁平均时间(mean time to loss alignment，MTTLA)和锁定平均时间(mean time to alignment，MTTA)的示意图，该五种情况分别为：
情况a0：第一AM锁定信息字段的48比特全部用于承载锁定信息。AM匹配的规则为：当确定该第一AM锁定信息字段中与预设的AM锁定信息不匹配的nibble(半字节)的数量不大于3时，则确定该第一AM匹配。
情况a1：第一AM锁定信息字段的40比特用于承载AM锁定信息，其余8比特用于承载加密参数信息。AM匹配的规则为：当确定该第一AM锁定信息字段的40比特AM锁定信息中与预设的AM锁定信息完全匹配，则确定该第一AM匹配。
情况a2：第一AM锁定信息字段的40比特用于承载AM锁定信息，其余8比特用于承载加密参数信息。AM匹配的规则为：当确定该第一AM锁定信息字段的40比特AM锁定信息中与预设的AM锁定信息不匹配的nibble(半字节)的数量不大于1时，则确定 该第一AM匹配。
情况a3：第一AM锁定信息字段的40比特用于承载AM锁定信息，其余8比特用于承载加密参数信息。AM匹配的规则为：当确定该第一AM锁定信息字段的40比特AM锁定信息中与预设的AM锁定信息不匹配的nibble(半字节)的数量不大于2时，则确定该第一AM匹配。
情况a4：第一AM锁定信息字段的40比特用于承载AM锁定信息，其余8比特用于承载加密参数信息。AM匹配的规则为：当确定该第一AM锁定信息字段的40比特AM锁定信息中与预设的AM锁定信息不匹配的nibble(半字节)的数量不大于3时，则确定该第一AM匹配。
如图7a所示，当误码率为2×10 -4的情况下，可以看到，失锁时间满足宇宙年要求的为情况a2、情况a3和情况a4以及情况a0。而情况a1不满足要求。而5种情况的锁定时间基本接近。
下述通过表1示例性示出了误锁定性能评估表，通过表1可以看到，情况a1和情况a2满足要求。基于此，本申请实施例中可以选择情况a2中的AM匹配规则，从而可以达到情况a2的锁定时间、失锁时间、误匹配概率与标准的匹配方式相当的效果。
表1误锁定性能评估表
Figure PCTCN2022106421-appb-000001
图7b示例性示出了情况b0和情况b1(25Gbps传输速率)以太网架构的RS-FEC码纠错后误码率的效果展示图，从图7b中可以看出，二者的纠后误码率相当。图7c示例性示出了情况b0和情况b2(50Gbps传输速率)下以太网架构的RS-FEC码纠错后误码率的效果展示图，从图7c中可以看出，二者的纠后误码率相当。图7d示例性示出了情况b0和情况b3(100Gbps传输速率)下以太网架构的RS-FEC码纠错后误码率的效果展示图，从图7d中可以看出，二者的纠后误码率相当。通过图7b至图7d可以看出，本方案由于对用来承载加密参数的AM字段进行了恢复，对以太网架构的RS-FEC码纠错性能影响极小。需要说明的是，在图7b的25Gbps传输速率中是以以太网架构的RS-FEC码为RS-FEC(528，514)为例进行仿真的，在图7c的50Gbps传输速率和图7d的100Gbps传输速率中是以以太网架构的RS-FEC码为RS-FEC(544，514)为例进行仿真的。
可以理解的是，为了实现上述实施例中功能，通信装置包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本申请中所公开的实施例描述的各示例的单元及方法步骤，本申请能够以硬件或硬件和计算机软件相结合的形式来 实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用场景和设计约束条件。
图8、图9和图10为本申请的实施例提供的可能的通信装置的结构示意图。这些通信装置可以用于实现上述方法实施例中第一通信装置的功能，因此也能实现上述方法实施例所具备的有益效果。这些通信装置也可以用于实现上述方法实施例中第二通信装置的功能，因此也能实现上述方法实施例所具备的有益效果。在本申请的实施例中，该通信装置可以是如图2a、图2b图2c、图2d和图2e中的发送端设备或第一通信装置，还可以是应用于发送端设备或第一通信装置的模块(如芯片)。在本申请的实施例中，该通信装置可以是如图2a、图2b图2c、图2d和图2e中的接收端设备或第二通信装置，还可以是应用于接收端设备或第二通信装置的模块(如芯片)。
如图8所示，通信装置1300包括处理单元1310和收发单元1320。通信装置1300用于实现上述图4a所示的方法实施例中第一通信装置的功能。
当通信装置1300用于实现图4a所示的方法实施例中第一通信装置的功能时：处理单元1310用于通过收发单元1320执行：获取第一密文数据流，发送第一密文数据流。其中，第一密文数据流包括第一对齐标识AM以及加密的第一数据段；第一AM用于第一密文数据流的数据对齐。第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。
当通信装置1300用于实现图4a所示的方法实施例中第一通信装置的功能时：处理单元1310还用于通过收发单元1320执行：获取N条明文数据流，N条明文数据流包括第一明文数据流和第二明文数据流；第二明文数据流中包括第三AM；第三AM包括承载第二明文数据流的通道标识信息的第三通道标识信息字段，且第三通道标识信息字段中包括承载第一预设值的k1个比特位。
如图8所示，通信装置1300包括处理单元1310和收发单元1320。通信装置1300用于实现上述图4a所示的方法实施例中第二通信装置的功能。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单元1310用于通过收发单元1320执行：获取第一密文数据流。其中，第一密文数据流包括第一对齐标识AM以及加密的第一数据段。第一AM用于第一密文数据流的数据对齐；第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单元1310还用于通过收发单元1320执行：在第一密文数据流中存在连续的至少k2个第一AM满足预设规则，确定根据至少k2个第一AM对第一密文数据流完成AM锁定；k2为大于1的整数。其中，预设规则可以参见前方法实施例的相关内容，在此不再赘述。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单 元1310具体用于通过收发单元1320执行：根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流中未加密的第一数据段。对第一AM进行处理，得到第一明文数据流中的第二AM。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单元1310具体用于通过收发单元1320执行：根据第二AM，确定第一明文数据流的通道标识信息。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单元1310具体用于通过收发单元1320执行以下内容中的至少一项：
将第一通道标识信息字段中用于承载加密参数信息的比特位上的信息恢复为第一预设值；
将第一AM锁定信息字段中用于承载加密参数信息的比特位上的信息恢复为第二预设值；或，
根据第一校验信息字段中承载的第一校验信息，将第一校验信息字段中用于承载加密参数信息的比特位上的信息恢复为第一校验信息对应的比特值取反后的信息。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单元1310具体用于通过收发单元1320执行：获取N路密文数据流，N路密文数据流包括第一密文数据流和第二密文数据流；其中，第二密文数据流包括第四AM以及加密的第二数据段；第四AM用于第二密文数据流的数据对齐，第四AM承载第二数据段的加密参数信息。根据第二密文数据流中第四AM承载的加密参数信息，对第二密文数据流中的第二数据段进行解密，得到第二明文数据流中未加密的第二数据段。对第四AM进行处理，得到第二明文数据流中的第三AM；第三AM包括承载第二明文数据流的通道标识信息的第三通道标识信息字段，且第三通道标识信息字段中包括承载第一预设值的k1个比特位。
当通信装置1300用于实现图4a所示的方法实施例中第二通信装置的功能时：处理单元1310还用于通过收发单元1320执行：获取第一密文数据流中的加密参数信息的纠错信息。根据加密参数信息的纠错信息，对加密参数信息中的其他信息进行纠错。
有关上述处理单元1310和收发单元1320更详细的描述可以直接参考图4a所示的方法实施例中相关描述直接得到，这里不加赘述。
如图9所示，通信装置1400包括处理电路1410和接口电路1420。处理电路1410和接口电路1420之间相互耦合。可以理解的是，接口电路1420可以为收发器或输入输出接口。可选的，通信装置1400还可以包括存储器，用于存储处理电路执行的指令或存储处理电路1410运行指令所需要的输入数据或存储处理电路1410运行指令后产生的数据。
当通信装置1400用于实现图4a所示的方法时，处理电路1410用于实现上述处理单元1310的功能，接口电路1420用于实现上述收发单元1320的功能。
如图10所示，通信装置1500包括处理器1510和通信接口1520。处理器1510和通信接口1520之间相互耦合。可以理解的是，通信接口1520可以为收发器或输入输出接口。可选的，通信装置1500还可以包括存储器1530，用于存储处理器1510执行的指令或存储处理器1510运行指令所需要的输入数据或存储处理器1510运行指令后产生的数据。
当通信装置1500用于实现图4a所示的方法时，处理器1510用于实现上述处理单元1310的功能，通信接口1520用于实现上述收发单元1320的功能。
当通信装置1500用于实现图4a所示的方法实施例中第一通信装置的功能时：处理器 1510用于通过通信接口1520执行：获取第一密文数据流，发送第一密文数据流。其中，第一密文数据流包括第一对齐标识AM以及加密的第一数据段；第一AM用于第一密文数据流的数据对齐。第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。
当通信装置1500用于实现图4a所示的方法实施例中第二通信装置的功能时：处理器1510用于通过通信接口1520执行：获取第一密文数据流。其中，第一密文数据流包括第一对齐标识AM以及加密的第一数据段。第一AM用于第一密文数据流的数据对齐；第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项。其中，第一AM锁定信息字段中的部分比特、第一通道标识信息字段中的部分比特，或者，第一校验信息字段中的部分或全部比特中的至少一项用于承载：第一数据段的加密参数信息。根据第一密文数据流中第一AM承载的加密参数信息，对加密的第一数据段进行解密，得到第一明文数据流。
当上述通信装置为应用于通信装置的芯片时，该通信装置芯片实现上述方法实施例中通信装置的功能。该通信装置芯片从通信装置中的其它模块(如射频模块或天线)接收信息，该信息是网络设备发送给通信装置的；或者，该通信装置芯片向通信装置中的其它模块(如射频模块或天线)发送信息，该信息是通信装置发送给网络设备的。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其它通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序或指令，当该计算机程序或指令在计算机上运行时，使得该计算机执行图4a所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读存储介质，该计算机可读介质存储有程序或指令，当该程序或指令在计算机上运行时，使得该计算机执行图4a所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种芯片系统，该芯片系统可以包括处理器。该处理器与存储器耦合，可用于执行图4a所示实施例中任意一个实施例的方法。可选地，该芯片系统还包括存储器。存储器，用于存储计算机程序(也可以称为代码，或指令)。处理器，用于从存储器调用并运行计算机程序，使得安装有芯片系统的设备执行图4a所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的第一通信装置和第二通信装置。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存(flash)、只读存储器(Read-Only Memory，ROM)、可编程只读存储器、可擦除可编程只读存储器(Erasable Programmable ROM， EPROM)、电可擦除可编程只读存储器、寄存器、硬盘、固态硬盘(solid-state drive，SSD)、移动硬盘、便携式只读存储器(Compact Disc Read-Only Memory，CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于通信装置中。当然，处理器和存储介质也可以作为分立组件存在于通信装置中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行计算机程序或指令时，全部或部分地执行本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、网络设备、用户设备或者其它可编程装置。计算机程序或指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机程序或指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，数字视频光盘；还可以是半导体介质，例如，固态硬盘。该计算机可读存储介质可以是易失性或非易失性存储介质，或可包括易失性和非易失性两种类型的存储介质。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请中，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。在本申请的文字描述中，字符“/”，一般表示前后关联对象是一种“或”的关系；在本申请的公式中，字符“/”，表示前后关联对象是一种“相除”的关系。“包括A，B或C中的至少一个”可以表示：包括A；包括B；包括C；包括A和B；包括A和C；包括B和C；包括A、B和C。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。

Claims (41)

  1. 一种数据传输方法，其特征在于，包括：
    获取第一密文数据流；
    发送所述第一密文数据流；
    其中，所述第一密文数据流包括第一对齐标识AM以及加密的第一数据段；所述第一AM用于所述第一密文数据流的数据对齐；
    所述第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项；
    其中，所述第一AM锁定信息字段中的部分比特、所述第一通道标识信息字段中的部分比特，或者，所述第一校验信息字段中的部分或全部比特中的至少一项用于承载：所述第一数据段的加密参数信息。
  2. 如权利要求1所述的方法，其特征在于，所述第一密文数据流是根据第一明文数据流和所述加密参数信息得到的；所述第一明文数据流包括第二AM以及未加密的所述第一数据段；所述第二AM用于所述第一明文数据流的数据对齐。
  3. 如权利要求2所述的方法，其特征在于，以下内容中的至少一项被满足：
    所述第一AM锁定信息字段是：通过对所述第二AM的第二AM锁定信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；
    所述第一通道标识信息字段是：通过对所述第二AM的第二通道标识信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；或，
    所述第一校验信息字段是：通过对所述第二AM的第二校验信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的。
  4. 如权利要求3所述的方法，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为：所述第二通道标识信息字段中承载第一预设值的k1个比特位中的部分或全部比特位，所述k1为正整数。
  5. 如权利要求1-4任一项所述的方法，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为所述第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：
    第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、第45个比特位、第47个比特位和第52个比特位。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述第一AM锁定信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分比特位：
    M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。
  7. 如权利要求1-6任一项所述的方法，其特征在于，所述第一校验信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：
    BIP 3字段，或～BIP 3字段。
  8. 如权利要求1-7任一项所述的方法，其特征在于，所述加密参数信息包括：所述加密参数信息的纠错信息。
  9. 一种数据传输方法，其特征在于，包括：
    获取第一密文数据流，其中，所述第一密文数据流包括第一对齐标识AM以及加密的第一数据段；所述第一AM用于所述第一密文数据流的数据对齐；所述第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项；其中，所述第一AM锁定信息字段中的部分比特、所述第一通道标识信息字段中的部分比特，或者，所述第一校验信息字段中的部分或全部比特中的至少一项用于承载：所述第一数据段的加密参数信息；
    根据所述加密参数信息，对加密的所述第一数据段进行解密，得到第一明文数据流。
  10. 如权利要求9所述的方法，其特征在于，所述对加密的所述第一数据段进行解密之前，所述方法还包括：
    根据所述第一密文数据流中的至少k2个连续的第一AM对所述第一密文数据流完成AM锁定，所述至少k2个连续的第一AM满足预设规则；所述k2为大于1的整数；
    其中，所述预设规则包括：
    在所述第一AM的所述第一AM锁定信息字段中的部分比特承载的信息中包括所述加密参数信息中的部分或全部的情况下：所述第一AM锁定信息字段承载的信息中除属于所述加密参数信息之外的信息与预设AM锁定信息之间至多存在k3个nibble(半字节)不匹配；所述k3为正整数。
  11. 如权利要求9或10所述的方法，其特征在于，当所述第一AM锁定信息字段中用于承载所述加密参数信息的比特位的数量为8，则所述k3的值为1。
  12. 如权利要求9-11的任一项所述的方法，其特征在于，所述第一密文数据流是根据第一明文数据流和所述加密参数信息得到的；所述第一明文数据流包括第二AM以及未加密的所述第一数据段；所述第二AM用于所述第一明文数据流的数据对齐。
  13. 如权利要求12所述的方法，其特征在于，所述根据所述加密参数信息，对加密的所述第一数据段进行解密，得到第一明文数据流，包括：
    根据所述第一密文数据流中所述第一AM承载的所述加密参数信息，对加密的所述第一数据段进行解密，得到所述第一明文数据流中未加密的所述第一数据段；
    对所述第一AM进行处理，得到所述第一明文数据流中的所述第二AM。
  14. 如权利要求12或13所述的方法，其特征在于，以下内容中的至少一项被满足：
    所述第一AM锁定信息字段是：通过对所述第二AM的第二AM锁定信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；
    所述第一通道标识信息字段是：通过对所述第二AM的第二通道标识信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；或，
    所述第一校验信息字段是：通过对所述第二AM的第二校验信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的。
  15. 如权利要求14所述的方法，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为：所述第二通道标识信息字段中承载k1个第一预设值的k1个比特位中的部分或全部比特位，所述k1为正整数。
  16. 如权利要求9-15任一项所述的方法，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为所述第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：
    第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、 第45个比特位、第47个比特位和第52个比特位。
  17. 如权利要求9-16任一项所述的方法，其特征在于，所述第一AM锁定信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分比特位：
    M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。
  18. 如权利要求9-17任一项所述的方法，其特征在于，所述第一校验信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：
    BIP 3字段，或～BIP 3字段。
  19. 如权利要求9-18任一项所述的方法，其特征在于，所述加密参数信息包括：所述加密参数信息的纠错信息。
  20. 一种通信装置，其特征在于，包括处理单元和收发单元，所述处理单元通过所述收发单元，用于：
    获取第一密文数据流；
    发送所述第一密文数据流；
    其中，所述第一密文数据流包括第一对齐标识AM以及加密的第一数据段；所述第一AM用于所述第一密文数据流的数据对齐；
    所述第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项；
    其中，所述第一AM锁定信息字段中的部分比特、所述第一通道标识信息字段中的部分比特，或者，所述第一校验信息字段中的部分或全部比特中的至少一项用于承载：所述第一数据段的加密参数信息。
  21. 如权利要求20所述的装置，其特征在于，所述第一密文数据流是根据第一明文数据流和所述加密参数信息得到的；所述第一明文数据流包括第二AM以及未加密的所述第一数据段；所述第二AM用于所述第一明文数据流的数据对齐。
  22. 如权利要求21所述的装置，其特征在于，以下内容中的至少一项被满足：
    所述第一AM锁定信息字段是：通过对所述第二AM的第二AM锁定信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；
    所述第一通道标识信息字段是：通过对所述第二AM的第二通道标识信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；或，
    所述第一校验信息字段是：通过对所述第二AM的第二校验信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的。
  23. 如权利要求22所述的装置，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为：所述第二通道标识信息字段中承载第一预设值的k1个比特位中的部分或全部比特位，所述k1为正整数。
  24. 如权利要求20-23任一项所述的装置，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为所述第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：
    第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、第45个比特位、第47个比特位和第52个比特位。
  25. 如权利要求20-24任一项所述的装置，其特征在于，所述第一AM锁定信息字段中 用于承载所述加密参数信息的比特位为以下字段的比特位中的部分比特位：
    M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。
  26. 如权利要求20-25任一项所述的装置，其特征在于，所述第一校验信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：
    BIP 3字段，或～BIP 3字段。
  27. 如权利要求20-26任一项所述的装置，其特征在于，所述加密参数信息包括：所述加密参数信息的纠错信息。
  28. 一种通信装置，其特征在于，包括处理单元和收发单元，所述处理单元通过所述收发单元，用于：
    获取第一密文数据流，其中，所述第一密文数据流包括第一对齐标识AM以及加密的第一数据段；所述第一AM用于所述第一密文数据流的数据对齐；所述第一AM包括第一AM锁定信息字段、第一通道标识信息字段或第一校验信息字段中的至少一项；其中，所述第一AM锁定信息字段中的部分比特、所述第一通道标识信息字段中的部分比特，或者，所述第一校验信息字段中的部分或全部比特中的至少一项用于承载：所述第一数据段的加密参数信息；
    根据所述加密参数信息，对加密的所述第一数据段进行解密，得到第一明文数据流。
  29. 如权利要求28所述的装置，其特征在于，所述处理单元通过所述收发单元，还用于：
    根据所述第一密文数据流中的至少k2个连续的第一AM对所述第一密文数据流完成AM锁定，所述至少k2个连续的第一AM满足预设规则；所述k2为大于1的整数；
    其中，所述预设规则包括：
    在所述第一AM的所述第一AM锁定信息字段中的部分比特承载的信息中包括所述加密参数信息中的部分或全部的情况下：所述第一AM锁定信息字段承载的信息中除属于所述加密参数信息之外的信息与预设AM锁定信息之间至多存在k3个nibble(半字节)不匹配；所述k3为正整数。
  30. 如权利要求28或29所述的装置，其特征在于，当所述第一AM锁定信息字段中用于承载所述加密参数信息的比特位的数量为8，则所述k3的值为1。
  31. 如权利要求28-30任一项所述的装置，其特征在于，所述第一密文数据流是根据第一明文数据流和所述加密参数信息得到的；所述第一明文数据流包括第二AM以及未加密的所述第一数据段；所述第二AM用于所述第一明文数据流的数据对齐。
  32. 如权利要求31所述的装置，其特征在于，所述处理单元通过所述收发单元，具体用于：
    根据所述第一密文数据流中所述第一AM承载的所述加密参数信息，对加密的所述第一数据段进行解密，得到所述第一明文数据流中未加密的所述第一数据段；
    对所述第一AM进行处理，得到所述第一明文数据流中的所述第二AM。
  33. 如权利要求31或32所述的装置，其特征在于，以下内容中的至少一项被满足：
    所述第一AM锁定信息字段是：通过对所述第二AM的第二AM锁定信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的；
    所述第一通道标识信息字段是：通过对所述第二AM的第二通道标识信息字段中的部 分比特替换为所述加密参数信息中的部分或全部后得到的；或，
    所述第一校验信息字段是：通过对所述第二AM的第二校验信息字段中的部分比特替换为所述加密参数信息中的部分或全部后得到的。
  34. 如权利要求33所述的装置，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为：所述第二通道标识信息字段中承载k1个第一预设值的k1个比特位中的部分或全部比特位，所述k1为正整数。
  35. 如权利要求28-34任一项所述的装置，其特征在于，所述第一通道标识信息字段中用于承载所述加密参数信息的比特位为所述第一通道标识信息字段对应的AM码块中以下比特位中的部分或全部：
    第4个比特位、第13个比特位、第15个比特位、第20个比特位、第36个比特位、第45个比特位、第47个比特位和第52个比特位。
  36. 如权利要求28-35任一项所述的装置，其特征在于，所述第一AM锁定信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分比特位：
    M0字段、M1字段、M2字段、～M0字段、～M1字段和～M2字段。
  37. 如权利要求28-36任一项所述的装置，其特征在于，所述第一校验信息字段中用于承载所述加密参数信息的比特位为以下字段的比特位中的部分或全部比特位：
    BIP 3字段，或～BIP 3字段。
  38. 如权利要求28-37任一项所述的装置，其特征在于，所述加密参数信息包括：所述加密参数信息的纠错信息。
  39. 一种通信装置，其特征在于，所述装置包括与存储器耦合的处理器，
    所述存储器，用于存储计算机程序或指令；
    所述处理器，用于执行存储器中的计算机程序或指令，使得权利要求1-8中任一项所述的方法被执行，或使得权利要求9-19任一项所述的方法被执行。
  40. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令在被计算机调用时，使得利要求1-8任一项所述的方法被执行，或使得权利要求9-19任一项所述的方法被执行。
  41. 一种芯片系统，其特征在于，包括：
    所述通信接口，用于输入和/或输出信令或数据；
    处理器，用于执行计算机可执行程序，使得安装有所述芯片系统的设备执行如利要求1-8任一项所述的方法，或执行如权利要求9-19任一项所述的方法。
PCT/CN2022/106421 2021-09-03 2022-07-19 一种数据传输方法、设备、可读存储介质和芯片系统 WO2023029783A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111034376.0A CN115766047A (zh) 2021-09-03 2021-09-03 一种数据传输方法、设备、可读存储介质和芯片系统
CN202111034376.0 2021-09-03

Publications (1)

Publication Number Publication Date
WO2023029783A1 true WO2023029783A1 (zh) 2023-03-09

Family

ID=85332664

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/106421 WO2023029783A1 (zh) 2021-09-03 2022-07-19 一种数据传输方法、设备、可读存储介质和芯片系统

Country Status (2)

Country Link
CN (1) CN115766047A (zh)
WO (1) WO2023029783A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190097748A1 (en) * 2017-09-22 2019-03-28 Cisco Technology, Inc. Security protection of terabit ethernet pcs layer using alignment markers
US20190215188A1 (en) * 2018-01-11 2019-07-11 Nexvortex, Inc. Cipher Stream Based Secure Packet Communications with Key Stream Transmission over Diverse Paths
CN112685395A (zh) * 2020-12-28 2021-04-20 深圳前海微众银行股份有限公司 纵向联邦统计中的无序数据去重方法、装置、设备及介质
CN113287266A (zh) * 2018-12-28 2021-08-20 华为技术有限公司 一种数据传输的方法、网络芯片以及通信系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190097748A1 (en) * 2017-09-22 2019-03-28 Cisco Technology, Inc. Security protection of terabit ethernet pcs layer using alignment markers
US20190215188A1 (en) * 2018-01-11 2019-07-11 Nexvortex, Inc. Cipher Stream Based Secure Packet Communications with Key Stream Transmission over Diverse Paths
CN113287266A (zh) * 2018-12-28 2021-08-20 华为技术有限公司 一种数据传输的方法、网络芯片以及通信系统
CN112685395A (zh) * 2020-12-28 2021-04-20 深圳前海微众银行股份有限公司 纵向联邦统计中的无序数据去重方法、装置、设备及介质

Also Published As

Publication number Publication date
CN115766047A (zh) 2023-03-07

Similar Documents

Publication Publication Date Title
US10567352B2 (en) Flexible ethernet encryption systems and methods
US10193688B2 (en) Flexible Ethernet encryption systems and methods
US9596075B2 (en) Transparent serial encryption
US9942064B2 (en) Data processing method and apparatus
EP3113502B1 (en) Flexible ethernet systems and methods for switching, oam, multi-service, chip-to-chip interface, time transfer, and encryption
US10182039B2 (en) Encrypted and authenticated data frame
US20160094311A1 (en) Ethernet data processing method, physical layer chip and ethernet equipment
US9246617B2 (en) Reformating a plurality of signals to generate a combined signal comprising a higher data rate than a data rate associated with the plurality of signals
WO2014071640A1 (zh) 以太数据处理的方法和装置
KR20200123412A (ko) 10spe에서 동기식 및 자가-동기식 스크램블링에 의한 페이로드 및 프리앰블의 스크램블링
EP3930221A1 (en) Data transmission method, apparatus and system
WO2019128887A1 (zh) 一种灵活以太网中故障指示方法以及装置
US20230308259A1 (en) Data transmission method, communication apparatus, and communication system
WO2023029783A1 (zh) 一种数据传输方法、设备、可读存储介质和芯片系统
WO2020133237A1 (zh) 一种数据传输的方法、网络芯片以及通信系统
CN114826748B (zh) 基于rtp、udp及ip协议的音视频流数据加密方法和装置
US10574424B2 (en) Transmission bandwidth improvements for DVB-S2X channel bonding
US20220149988A1 (en) Method for Adjusting Transmission Rate, Processor, Network Device, and Network System
CN115766046A (zh) 一种数据传输方法、设备、可读存储介质和芯片系统
WO2021017890A1 (zh) 一种通信方法和通信设备
WO2022116711A1 (zh) 一种数据传输方法、通信装置及通信系统
US20170048023A1 (en) Apparatus to transmit data using different scramble generator polynomials
Daraban et al. Protocol over uart for real-time applications
WO2020063350A1 (zh) 量子密钥分发方法及设备
EP4262093A1 (en) State notification method, optical module, network device, and network system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22862924

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022862924

Country of ref document: EP

Effective date: 20240314

NENP Non-entry into the national phase

Ref country code: DE