WO2020135039A1 - Data transmission method, and data transmission system and sending device and receiving device therefor - Google Patents

Abstract

The present disclosure relates to a data transmission method, a sending device for a data transmission system, a receiving device for a data transmission system, a data transmission system, and a computer-readable storage medium. The data transmission method comprises: updating encryption key information according to an interrupt signal; transmitting the updated encryption key information, and updating a key according to the updated encryption key information to obtain an encryption key; and where the number of first multiple frames of transmission data reaches a first pre-set number of frames, encrypting the data by means of the encryption key, and transmitting the data.

Description

Data transmission method, data transmission system and its sending device and receiving device

This disclosure requires the priority of Chinese patent application CN201811646881.9, entitled "Data transmission method, data transmission system and its transmitting device and receiving device", filed on December 29, 2018, the entire contents of which are incorporated herein by reference .

Technical field

The present disclosure relates to the field of communications, and in particular to a data transmission method, a data transmission method, a sending device of a data transmission system, a receiving device of a data transmission system, a data transmission system, and a computer-readable storage medium.

Background technique

With the development of the Internet, in order to strengthen the security of the transmission of sensitive services in the OTN (Optical Transport Network) transmission network, and at the same time adapt to the growing trend of OTN equipment sinking and directly carrying any business, in The overlay encryption function in the OTN transmission equipment has become an inevitable choice for OTN secure transmission solutions. By overlaying the encryption module in the OTN equipment, any services accessed by the customer port of the OTN equipment can be encrypted at the physical layer, and the customer business is encrypted after passing through the encryption module The form is transmitted on the operator's OTN network, and decrypted when the remote end leaves the OTN network to ensure the security of service transmission.

According to the source of the key, OTN encryption is divided into a local key generation method and an independent key device distribution key method. According to the key transmission method, OTN encryption is divided into in-band transmission and out-of-band transmission. According to the key switching method, OTN encryption is divided into fixed key and timing key switching methods.

For the key switching method at regular intervals, the efficiency of key switching affects the security of encryption to a certain extent. The faster the key update, the less likely the encrypted business is to be cracked. During the key update process, the communication channel is managed through security , To transfer information, in the process of switching between the new and old keys, to ensure that no damage to the encrypted business, to achieve lossless key switching.

At present, the key switch is mostly involved in the processing of software periodic polling tasks, and the key switch period is relatively long, usually in the order of seconds.

Summary of the invention

In order to solve the above technical problems, or at least partially solve the above technical problems, the present disclosure provides a transmission device that can shorten the key switching cycle from the second level to the millisecond level, greatly improving the security of service encryption Data transmission method, matching data transmission method for a receiving device, a data transmission system transmission device, a data transmission system reception device, a data transmission system, a computer readable storage medium .

In the first aspect, the present disclosure provides a data transmission method, including: updating encryption key information according to an interrupt signal; transmitting updated encryption key information, and updating the key according to the updated encryption key information to obtain encryption Key; when the number of frames in the first multiframe of the transmitted data reaches the first preset number of frames, the data is encrypted by the encryption key and the data is transmitted.

In a second aspect, the present disclosure provides a data transmission method, including: updating the decryption key information with the received encryption key information according to the interrupt signal, and obtaining the decryption key; at the first multiframe frame of the received data When the number reaches the first preset number of frames, the data is decrypted with the decryption key.

In a third aspect, the present disclosure provides a transmission device for a data transmission system, including: a processor, a memory, and a computer program stored on the memory and executable on the processor, which is implemented when the processor executes the computer program: according to an interrupt signal , Update the encryption key information; transmit the updated encryption key information, and update the key according to the updated encryption key information to obtain the encryption key; the number of frames in the first multiframe of the transmitted data reaches the first preset frame In several cases, the data is encrypted by the encryption key and the data is transmitted.

According to a fourth aspect, the present disclosure provides a receiving device of a data transmission system, including: a processor, a memory, and a computer program stored on the memory and runable on the processor, which is implemented when the processor executes the computer program: according to an interrupt signal , Update the decryption key information with the received encryption key information transmitted by the sending device, and obtain the decryption key; when the number of first multiframe frames of the received data reaches the first preset number of frames, use the decryption key Decrypt the data.

According to a fifth aspect, the present disclosure provides a data transmission system, including: the sending device of the data transmission system according to any one of the above technical solutions; and the receiving of the data transmission system according to any one of the above technical solutions Device; wherein, the sending device of the data transmission system transmits the updated encryption key information to the receiving device of the data transmission system; the receiving device of the transmission system generates an interrupt signal according to the received updated encryption key information.

In a sixth aspect, the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the data transmission method described in any one of the above technical solutions, or the above technology is implemented The encryption method for data transmission according to any one of the solutions.

BRIEF DESCRIPTION

The drawings herein are incorporated into and constitute a part of this specification, show embodiments consistent with this disclosure, and are used together with the specification to explain the principles of this disclosure.

In order to more clearly explain the technical solutions in the embodiments or some cases of the present disclosure, the following will briefly introduce the drawings used in the description of the embodiments or some cases. Obviously, for those of ordinary skill in the art, On the premise of not paying creative labor, other drawings can also be obtained from these drawings.

1 is a flowchart of a data transmission method according to an embodiment of the first aspect of the present disclosure;

2 is a flowchart of another data transmission method provided by an embodiment of the first aspect of the present disclosure;

3 is a flowchart of another data transmission method provided by an embodiment of the first aspect of the present disclosure;

4 is a flowchart of another data transmission method provided by an embodiment of the first aspect of the present disclosure;

5 is a flowchart of a data transmission method according to an embodiment of the second aspect of the present disclosure;

6 is a flowchart of another data transmission method provided by an embodiment of the second aspect of the present disclosure;

7 is a flowchart of another data transmission method according to an embodiment of the second aspect of the present disclosure;

8 is a schematic block diagram of a sending device of a data transmission system according to an embodiment of the third aspect of the present disclosure;

9 is a schematic block diagram of a receiving device of a data transmission system according to an embodiment of the fourth aspect of the present disclosure;

10 is a schematic block diagram of a data transmission system according to an embodiment of the fourth aspect of the present disclosure;

11 is a schematic diagram of an encrypted transmission network of a data transmission system provided by an embodiment of the fifth aspect of the present disclosure;

12 is a schematic diagram of a key application for an encryption device of a data transmission system provided by an embodiment of the fifth aspect of the present disclosure;

13 is an interaction diagram of a sending device and a receiving device in a data transmission system according to an embodiment of the fifth aspect of the present disclosure.

detailed description

To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments It is a part of the embodiments of the present disclosure, but not all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present disclosure.

FIG. 1 is a flowchart of a data transmission method according to an embodiment of the first aspect of the present disclosure.

As shown in FIG. 1, a data transmission method provided by an embodiment of the first aspect of the present disclosure includes: S102: updating encryption key information according to an interrupt signal; S104: transmitting updated encryption key information, and according to the updated The encryption key information updates the key to obtain an encryption key; S106: When the number of first multiframe frames of the transmitted data reaches the first preset number of frames, the data is encrypted by the encryption key and the data is transmitted.

In a data transmission method provided by an embodiment of the first aspect of the present disclosure, the logic device detects the occurrence of a preset event, generates an interrupt signal, and after the transmission device receives the interrupt signal, updates the encryption key information and updates it according to the encryption key information Encryption key, and store the updated encryption key, and transmit the updated encryption key information to the receiving device, so that the receiving device updates the decryption key information according to the updated encryption key information, and transmits encryption When the number of frames of the first multiframe of the data reaches the first preset number of frames, the data is encrypted with the updated encryption key, and the updated encryption key information is transmitted to the receiving device through the reserved overhead. The decryption key generated by the decryption key information decrypts the received encrypted data. This method uses the interruption technology and the key switch based on the number of multi-frame frames of data transmission to achieve the key switch process in frames. The speed of key switching can be increased to the millisecond level, which greatly increases the security of business encryption. Compared with the key switching method using software polling in related technologies, the speed of key switching is greatly improved .

The encryption key information is the encryption key serial number.

2 is a flowchart of another data transmission method provided by an embodiment of the first aspect of the present disclosure;

As shown in FIG. 2, a data transmission method provided by another embodiment of the first aspect of the present disclosure includes: S202: monitoring the number of first multiframe frames for transmitting data; S204: when the number of first multiframe frames reaches a second preset In the case of the number of frames, an interrupt signal is issued; wherein, the second preset number of frames is less than the first preset number of frames; S206: update the encryption key information according to the interrupt signal; S208: transmit the updated encryption key information, and Update the key according to the updated encryption key information to obtain an encryption key; S210: When the number of first multiframe frames of the transmitted data reaches the first preset number of frames, encrypt the data by the encryption key and transmit the data.

According to a data transmission method provided by another embodiment of the first aspect of the present disclosure, during the transmission of encrypted data by the sending device, the logic device monitors the number of first multiframe frames transmitting the encrypted data, and after detecting that the number of first multiframe frames reaches the In the case of two preset frames, an interrupt signal is generated. After receiving the interrupt signal, the sending device updates the encryption key information, updates the encryption key according to the encryption key information, and stores the updated encryption key, and, The updated encryption key information is transmitted to the receiving device, so that the receiving device updates the decryption key information according to the updated encryption key information, and the number of frames in the first multiframe of the transmitted encrypted data reaches the first preset number of frames Next, encrypt the data with the updated encryption key, and transmit the updated encryption key information to the receiving device through the reserved overhead. The receiving device decrypts the received encryption based on the decryption key generated by the updated decryption key information. Data, this method uses the interrupt technology and the number of multi-frame frames based on data transmission to switch the key, which can realize the key switching process in frame units, which can increase the speed of key switching to the millisecond level, which greatly increases To improve the security of service encryption, the key switching speed has been greatly improved compared to the key switching method using software polling in related technologies.

The encryption key information is the encryption key serial number; the second preset number of frames is less than the first preset number of frames.

In one embodiment, the first preset number of frames is equal to the second preset number of frames plus N frames, where the value of N ranges from 2 to 10.

3 is a flowchart of another data transmission method provided by an embodiment of the first aspect of the present disclosure;

As shown in FIG. 3, a data transmission method provided by another embodiment of the first aspect of the present disclosure includes: S302: monitoring the number of first multiframe frames for transmitting data; S304: when the number of first multiframe frames reaches the second preset In the case of the number of frames, an interrupt signal is issued; wherein, the second preset number of frames is less than the first preset number of frames; S306: update the encryption key information according to the interrupt signal; S308: transmit the updated encryption key information, and Generate an encryption key according to the updated encryption key information and the preset key list; S310: When the number of first multiframe frames of the transmitted data reaches the first preset number of frames, encrypt the data with the encryption key and transmit data.

According to a data transmission method provided by another embodiment of the first aspect of the present disclosure, during the transmission of encrypted data by the sending device, the logic device monitors the number of first multiframe frames transmitting the encrypted data, and after detecting that the number of first multiframe frames reaches the In the case of two preset frames, an interrupt signal is generated. After receiving the interrupt signal, the sending device updates the encryption key information, generates an encryption key according to the encryption key information and the preset key list, and stores the newly generated encryption key Key, and transmit the updated encryption key information to the receiving device, so that the receiving device updates the decryption key information according to the updated encryption key information, and reaches the first number of frames in the first multiframe of the transmitted encrypted data In the case of a preset number of frames, data is encrypted with the updated encryption key, and the updated encryption key information is transmitted to the receiving device through the reserved overhead, and the receiving device generates the decryption key based on the updated decryption key information. To decrypt the received encrypted data, this method uses the interrupt technology and the key switch based on the number of multi-frame frames of the data transmission, which can realize the key switching process in units of frames, which can increase the speed of key switching to the millisecond level In addition, the security of service encryption is greatly increased. Compared with the key switching method using software polling in related technologies, the key switching speed is greatly improved.

The encryption key information is the encryption key serial number; the second preset number of frames is less than the first preset number of frames.

In one embodiment, the first preset number of frames is equal to the second preset number of frames plus N frames, where the value of N ranges from 2 to 10.

4 is a flowchart of another data transmission method provided by an embodiment of the first aspect of the present disclosure;

As shown in FIG. 4, a data transmission method provided by another embodiment of the first aspect of the present disclosure includes: S402: monitoring the number of first multiframe frames transmitting data; S404: reaching the second preset number of first multiframe frames In the case of the number of frames, an interrupt signal is issued; wherein, the second preset number of frames is less than the first preset number of frames; S406: add the encryption key serial number and the preset value according to the interrupt signal to obtain the updated Encryption key serial number; S408: transmit the updated encryption key serial number, and generate an encryption key based on the updated encryption key serial number and the preset key list; S410: transmit the first multiframe frame of the data When the number reaches the first preset number of frames, the data is encrypted by the encryption key, and the data is transmitted.

According to a data transmission method provided by another embodiment of the first aspect of the present disclosure, during the transmission of encrypted data by the sending device, the logic device monitors the number of first multiframe frames transmitting the encrypted data, and after detecting that the number of first multiframe frames reaches the In the case of two preset frames, an interrupt signal is generated. After receiving the interrupt signal, the sending device adds the encryption key serial number being applied by adding M to generate a new encryption key serial number, and according to the encryption key The key serial number and the preset key list generate an encryption key, store the newly generated encryption key, and transmit the updated encryption key serial number to the receiving device, so that the receiving device uses the updated encryption key serial number , Update the decryption key serial number, and when the number of frames in the first multiframe of the encrypted data reaches the first preset number of frames, encrypt the data with the updated encryption key and the updated encryption key serial number It is transmitted to the receiving device through the reserved overhead, and the receiving device decrypts the received encrypted data based on the updated decryption key serial number. This method uses the interrupt technology and the key based on the number of multiframe frames for data transmission. The switch can realize the key switching process in units of frames, which can increase the speed of key switching to the millisecond level, thereby greatly increasing the security of business encryption, compared with the key that uses software polling in related technologies. In terms of the switching method, the key switching speed has been greatly improved.

Wherein, M is a preset value, and M can take any value. Further, in an embodiment, the value of M ranges from 1 to 10.

In one embodiment, the first preset number of frames is equal to the second preset number of frames plus N frames, where the value of N ranges from 2 to 10.

5 is a flowchart of a data transmission method according to an embodiment of the second aspect of the present disclosure;

As shown in FIG. 5, a data transmission method provided by an embodiment of the second aspect of the present disclosure includes: S502: update the decryption key information with the received encryption key information according to the interrupt signal, and obtain the decryption key; S504 : When the number of first multi-frame frames of the received data reaches the first preset number of frames, decrypt the data with the decryption key.

In a data transmission method provided by an embodiment of the second aspect of the present disclosure, during the process of receiving encrypted data transmitted by the sending device, the logic device detects the occurrence of a preset event and generates an interrupt signal. After receiving the interrupt signal, the receiving device The encryption key information transmitted by the sending device to update the decryption key information, and update the decryption key according to the decryption key information, when the number of first multiframe frames of the received encrypted data reaches the first preset number of frames, to The updated decryption key decrypts the data. This method uses the interruption technology and the multi-frame frame number based on the data transmission to switch the de-keying. The key switching process can be realized in units of frames, and the speed of key switching can be increased. Up to the millisecond level, which greatly increases the security of business encryption. Compared with the key switching method using software polling in related technologies, the key switching speed is greatly improved.

Among them, the encryption key information is the encryption key serial number, and the decryption key information is the decryption key serial number.

6 is a flowchart of another data transmission method provided by an embodiment of the second aspect of the present disclosure;

As shown in FIG. 6, a data transmission method provided by another embodiment of the second aspect of the present disclosure includes: S602: monitoring whether the decryption key information changes; S604: monitoring continuous reception when the decryption key information changes Whether the second multiframe frame number of the encryption key information reaches the third preset frame number; S606: When the second multiframe frame number reaches the third preset frame number, an interrupt signal is issued; S608: According to the interrupt signal , Update the decryption key information with the received encryption key information, and obtain the decryption key; S610: when the first multi-frame frame number of the received data reaches the first preset frame number, decrypt with the decryption key data.

In a data transmission method provided by another embodiment of the second aspect of the present disclosure, during the process of receiving the encrypted data transmitted by the sending device, the logic device monitors whether the encryption key information transmitted by the sending device has changed. In the case, monitor the number of second multiframe frames received after receiving the changed encryption key information, generate an interrupt signal when the number of second multiframe frames reaches the third preset number of frames, and the receiving device receives the interrupt signal, according to the received The changed encryption key information transmitted by the transmitted sending device, update the decryption key information, and update the decryption key according to the updated decryption key information, the first multiframe frame number of the received encrypted data reaches the first preset In the case of the number of frames, the data is decrypted with the updated decryption key. This method uses the interrupt technology and the multi-frame frame number based on the data transmission to switch the dekeying. The key switching process can be realized in units of frames. The speed of key switching is increased to the millisecond level, which greatly increases the security of service encryption. Compared with the key switching method using software polling in related technologies, the speed of key switching is greatly improved.

Among them, the encryption key information is the encryption key serial number, and the decryption key information is the decryption key serial number.

In one embodiment, the value range of the third preset number of frames is 2 to 10 frames.

7 is a flowchart of another data transmission method according to an embodiment of the second aspect of the present disclosure;

As shown in FIG. 7, a data transmission method provided by another embodiment of the second aspect of the present disclosure includes: S702: monitoring whether the decryption key information changes; S704: monitoring continuous reception when the decryption key information changes Whether the second multiframe frame number of the encryption key information reaches the third preset frame number; S706: when the second multiframe frame number reaches the third preset frame number, an interrupt signal is issued; S708: according to the interrupt signal , Update the decryption key information with the received encryption key information; generate a decryption key based on the updated decryption key information and the preset key list; S710: the first multiframe frame number of the received data reaches the first In the case of a preset number of frames, the data is decrypted with the decryption key.

In a data transmission method provided by another embodiment of the second aspect of the present disclosure, during the process of receiving the encrypted data transmitted by the sending device, the logic device monitors whether the encryption key information transmitted by the sending device has changed. In the case, monitor the number of second multiframe frames received after receiving the changed encryption key information, generate an interrupt signal when the number of second multiframe frames reaches the third preset number of frames, and the receiving device receives the interrupt signal, according to the received The updated encryption key information transmitted to the sending device is updated, the decryption key information is updated, and a new decryption key is generated according to the updated decryption key information and the preset key list, and the first copy of the encrypted data is received When the number of frames reaches the first preset number of frames, the updated decryption key is used to decrypt the data. This method uses the interrupt technology and the number of multi-frame frames based on data transmission to switch the key decryption. The unit key switching process can increase the speed of key switching to milliseconds, which greatly increases the security of business encryption. Compared with the key switching method that uses software polling in related technologies, key switching The speed has been greatly improved.

Among them, the encryption key information is the encryption key serial number, and the decryption key information is the decryption key serial number.

In one embodiment, the value range of the third preset number of frames is 2 to 10 frames.

As shown in FIG. 8, an embodiment of the third aspect of the present disclosure provides a sending device 800 of a data transmission system, including: a processor 802, a memory 804, and a computer program stored on the memory and executable on the processor 802, When the processor 802 executes the computer program, the encryption key information is updated according to the interrupt signal; the updated encryption key information is transmitted, and the key is updated according to the updated encryption key information to obtain the encryption key; When the number of first multi-frame frames reaches the first preset number of frames, the data is encrypted by the encryption key, and the data is transmitted.

In a sending apparatus 800 of a data transmission system provided by an embodiment of the first aspect of the present disclosure, during the transmission of encrypted data by the sending apparatus, the logic device detects the occurrence of a preset event and generates an interrupt signal. After the sending apparatus receives the interrupt signal, Update the encryption key information, update the encryption key according to the encryption key information, and store the updated encryption key, and transmit the updated encryption key information to the receiving device, so that the receiving device can update the encrypted key according to the updated encryption key Key information, update the decryption key information, and encrypt the data with the updated encryption key when the number of the first multi-frame frames of the encrypted data reaches the first preset frame number, and transfer the updated encryption key information It is transmitted to the receiving device through the reserved overhead, and the receiving device decrypts the received encrypted data based on the decrypted key information generated by the updated decryption key information. This method uses the interrupt technology and the number of multiframe frames based on the data transmission to perform the key Switching can realize the key switching process in units of frames, which can increase the speed of key switching to the millisecond level, thereby greatly increasing the security of service encryption, compared with the key switching using software polling in related technologies In terms of methods, the key switching speed has been greatly improved.

In an embodiment of the present disclosure, before updating the encryption key information according to the interrupt signal, the method further includes: monitoring the number of first multiframe frames of the transmitted data; when the number of first multiframe frames reaches the second preset number of frames , An interrupt signal is issued; wherein, the second preset number of frames is less than the first preset number of frames.

In an embodiment of the present disclosure, the key is updated according to the updated encryption key information to obtain the encryption key, specifically: the encryption key is generated according to the updated encryption key information and the preset key list.

In one embodiment of the present disclosure, the encryption key information is an encryption key serial number.

In an embodiment of the present disclosure, the step of updating the encryption key information specifically includes: adding the encryption key serial number to a preset value to obtain the updated encryption key serial number.

As shown in FIG. 9, an embodiment of the fourth aspect of the present disclosure provides a receiving device 900 of a data transmission system: a processor 902, a memory 904, and a computer program stored on the memory 904 and executable on the processor 902, to process When the computer 902 executes the computer program, it realizes: in the process of receiving the encrypted data, according to the interrupt signal, with the received encryption key information transmitted by the sending device, the decryption key information is updated to obtain the decryption key; When the number of multi-frame frames reaches the first preset number of frames, the data is decrypted with the first decryption key.

In a receiving apparatus 900 of a data transmission system provided by an embodiment of the fourth aspect of the present disclosure, during the process in which the receiving apparatus receives the encrypted data transmitted by the sending apparatus, the logic device detects the occurrence of a preset event, generates an interrupt signal, and the receiving apparatus receives After the interrupt signal, the decryption key information is updated according to the received encryption key information transmitted by the sending device, and the decryption key is updated according to the decryption key information. The number of frames in the first multiframe of the received encrypted data reaches the first preset In the case of the number of frames, the data is decrypted with the updated decryption key. This method uses the interrupt technology and the multi-frame frame number based on the data transmission to switch the dekeying. The key switching process can be realized in units of frames. The speed of key switching is increased to the millisecond level, which greatly increases the security of service encryption. Compared with the key switching method using software polling in related technologies, the speed of key switching is greatly improved.

In an embodiment of the present disclosure, it further includes: monitoring whether the decryption key information has changed; based on the situation where the decryption key information has changed, monitoring whether the number of second multiframe frames transmitting the encryption key information continues to the third pre Set the frame number; based on the second multi-frame frame number for the third preset frame number, an interrupt signal is issued.

In an embodiment of the present disclosure, the decryption key information is updated according to the received encryption key information transmitted by the sending device, and the decryption key is obtained as follows: the decryption key information is updated according to the encryption key information transmitted by the sending device; The updated decryption key information and the preset key list generate a decryption key.

In one embodiment of the present disclosure, the encryption key information is an encryption key serial number.

As shown in FIG. 10, an embodiment of the fifth aspect of the present disclosure provides a data transmission system 1000, including: a sending device 800 of the data transmission system as provided in any of the embodiments of the third aspect described above; and the fourth aspect described above The receiving device 900 of the data transmission system of any of the embodiments; wherein, the transmitting device 800 of the data transmission system transmits the updated encryption key information to the receiving device 900 of the data transmission system; the receiving device of the transmission system is based on The received updated encryption key information generates an interrupt signal.

In a data transmission system 1000 provided by an embodiment of the fifth aspect of the present disclosure, during the transmission of encrypted data by the sending device, the logic device detects the occurrence of a preset event, generates an interrupt signal, and after the receiving device receives the interrupt signal, updates the encrypted password Key information, and update the encryption key according to the encryption key information, and store the updated encryption key, and transmit the updated encryption key information to the receiving device, so that the receiving device according to the updated encryption key information, Update the decryption key information, and encrypt the data with the updated encryption key when the number of first multiframe frames of the encrypted data reaches the first preset number of frames, and pass the updated encryption key information through the reserved overhead Transmission to the receiving device, the receiving device decrypts the received encrypted data based on the decryption key generated by the updated decryption key information, and the receiving device receives the encrypted data transmitted by the transmitting device, the logic device detects a preset event Occurs, generates an interrupt signal, and after receiving the interrupt signal, the receiving device updates the decryption key information according to the received encryption key information transmitted by the transmitting device, and updates the decryption key according to the decryption key information. When the number of first multi-frame frames reaches the first preset number of frames, the updated decryption key is used to decrypt the data. This method can be implemented by interrupting the technology and switching the de-keying based on the number of multi-frame frames of data transmission. The frame-based key switching process can increase the speed of key switching to milliseconds, which greatly increases the security of business encryption. Compared with the key switching method that uses software polling in related technologies, The key switching speed has been greatly improved.

In one embodiment, during the transmission of encrypted data by the sending device, the logic device monitors the number of first multiframe frames transmitting the encrypted data, and when it is detected that the number of first multiframe frames reaches the second preset number of frames, Generate an interrupt signal. After receiving the interrupt signal, the sending device adds M to the encryption key serial number being applied to generate a new encryption key serial number, and according to the encryption key serial number and the preset key list Generate an encryption key, store the newly generated encryption key, and transmit the updated encryption key serial number to the receiving device, so that the receiving device updates the decryption key serial number according to the updated encryption key serial number, and When the number of the first multi-frame frames of the encrypted data reaches the first preset number of frames, the data is encrypted with the updated encryption key, and the updated encryption key serial number is transmitted to the receiving device through the reserved overhead to receive The device decrypts the received encrypted data based on the decryption key generated by the updated decryption key serial number. While the receiving device receives the encrypted data transmitted by the sending device, the logic device monitors whether the encrypted key information transmitted by the sending device is Changes, when the encryption key information changes, monitor the number of second multiframe frames received after receiving the changed encryption key information, and generate when the number of second multiframe frames reaches the third preset number of frames Interrupt signal, the receiving device receives the interrupt signal, updates the decryption key information according to the received encrypted key information transmitted by the transmitting device, and generates a new decryption according to the updated decryption key information and the preset key list Key, when the number of frames in the first multiframe of the received encrypted data reaches the first preset number of frames, the data is decrypted with the updated decryption key. This method uses interrupt technology and the number of frames in the multiframe based on data transmission. Decryption key switching can realize the key switching process in units of frames, which can increase the speed of key switching to the millisecond level, thereby greatly increasing the security of business encryption, compared with the use of software polling in related technologies In terms of the key switching method, the key switching speed has been greatly improved. Among them, M is a preset value.

This method uses the interrupt technology and the key switch based on the number of multi-frame frames of data transmission, which can realize the key switch process in frame units, which can increase the speed of key switch to the millisecond level, thereby greatly increasing the business The security of encryption is greatly improved compared to the key switching method using software polling in related technologies.

The data transmission system provided by the present disclosure implements millisecond-level key switching, uses OTN reserved overhead to transfer encryption key information, and uses interrupt signals instead of polling tasks to process the loading of updated encryption keys and decryption keys.

In one embodiment, the following table 1 shows a structure diagram of the reserved overhead. As shown in the following table 1, the reserved overhead can be used for user-defined transmission of information. In one embodiment of the present disclosure, 8 bytes are occupied, and the transmission is used for encryption. Key switching information (encryption key information), where request_id (identity information) is used to ensure that the sending device (encrypting end) and receiving device (decrypting end) use the same id (identity) to apply for the key from the key device, and encrypt the secret The key serial number is used to ensure that the sending device and the receiving device use the same serial number key, bob_apply_key is used to notify the receiving device to apply for the key, and alice_apply_key is used to notify the sending device to reapply for the key. Among them, the transfer and processing speed of key_sn (encryption key serial number) determine the efficiency of key switching.

Table 1

In Table 1 above, 1 to 6 bytes are used to transmit request_id, request_id is the key application id, used to ensure that the sending device and the receiving device use the same request_id to initiate an application to the key device. 7 bytes are reserved bytes, 8 bytes are divided into 4 parts, of which bit 7 is used by the sending device to notify the receiving device to apply for the key, bit 6 is used by the receiving device to notify the receiving device to apply for the key again, bit 5 is The reserved bits, bit4 to bit0, are used to transmit the key sequence number key_sn.

As shown in FIG. 11, the devices involved in the present disclosure are an optical transmission network sending device and its corresponding key device and gateway, an optical transmission network receiving and sending device and its corresponding key device and gateway are off, and the unencrypted client side any (Any) The services are aggregated and encrypted by the optical transmission network transmission equipment of the transmission device and then transmitted on the optical network. The optical transmission network reception and transmission equipment of the reception device decrypts and demaps the unencrypted client-side business. Among them, the key device includes a logic device.

As shown in FIG. 12, the key application process of the encryption device of the present disclosure is described. The steps are as follows: In the first step, the optical transmission network sending device initiates a key application to its key device; in the second step, the optical transmission network sends The device notifies the receiving device of the optical transmission network to apply for a key; in the third step, the key device of the transmitting device of the optical transmission network notifies the key device of the receiving device of the optical transmission network that the key application of the transmitting device of the optical transmission network has been received; fourth Step 5, the optical transmission network receiving device initiates a key application to its key device; fifth step, the optical transmission network receiving device key device receives the key device notification of the optical transmission network sending device and the optical transmission network receiving device's After applying, verify the request_id. If the verification is passed, issue the key to the optical transmission network receiving device. In the sixth step, the key device of the optical transmission network receiving device notifies the optical transmission network that the key device of the sending device can transmit to the optical The network sending device delivers the key; in the seventh step, the key device of the optical transmission network sending device delivers the same key to the optical transmission network sending device, where the key matches the key in the sixth step; Eight steps, for exception handling, when the key device of the optical transmission network receiving device is reset, the key device of the optical transmission network sending device needs to be notified to re-initiate the key application process.

In addition, through the reserved overhead, the information transmission of encryption-related functions between the sending device and the receiving device of the data transmission system is completed. In the key application process shown in FIG. 12, the key device of the optical transmission network sending device sets alice_apply_key to Method 1 notifies the key equipment of the optical transmission network receiving equipment to initiate the key application, and also passes the request_id, which is the key application id. For the key equipment, only the sending device and the receiving device use the same request_id for encryption When the key is applied, the key device will issue the key normally. In the encryption mode of regularly updating the encryption key and the decryption key, the sending device and the receiving device need to keep the same key used at both ends during the key update process. This disclosure guarantees the two by passing the key sequence number, key_sn The end uses the same key.

The present disclosure can realize reading and writing of OTN reservation overhead, and at the same time can obtain the first preset frame number (MFI) and the first multiframe frame number (MFI_CNT) corresponding to the key update period.

As shown in FIG. 13, when the first multi-frame frame number (MFI_CNT) of the sending device reaches the second preset frame number (MFI), the sending device transmits key_sn plus 1 to the receiving device through reserved overhead, and increases key_sn by 1 The corresponding encryption key is loaded into the backup key (the updated encryption key). The FPGA (programmable logic array, which belongs to the logic device) of the receiving device monitors the change of key_sn according to the frame. When the key_sn is increased by 1 and the value is stable, it exceeds When 3 frames (in other embodiments of the present disclosure, may be any number of frames, for example: 4 frames, 6 frames, etc.), the receiving device loads the decryption key corresponding to key_sn plus 1 to the backup key (the updated decryption key Key), after the first multiframe frame number reaches the first preset frame number (MFI), the sending device and the receiving device switch to the backup key in the next multiframe synchronously, the entire switching cycle is 3 multiframe cycles, that is, when When the line-side service is OTU4 (a type of optical conversion unit), the fastest speed of key switching can reach 1ms.

The interaction flow between the sending device and the receiving device in the data transmission system shown in FIG. 13 is as follows: S1302: the sending device monitors the first multiframe frame number; S1304: determines whether the first multiframe frame number reaches the first preset frame number minus 2; In the case that the first multiframe frame number has not reached the first preset frame number minus 2, execute S1302 to continue monitoring the first multiframe frame number, after the first multiframe frame number reaches the first preset frame number minus In the case of 2, execute S1306 and S1310; S1306: generate an interrupt signal to notify the optical transmission network sending device; S1308: configure the backup key to load; S1310: update the key serial number and write the reserved overhead; save the key through the reserved overhead The serial number is transmitted to the receiving device; S1312: the receiving device monitors the key serial number; S1314: determines whether the key serial number has changed; if the key serial number has not changed, execute S1312 to continue monitoring the key serial number, When the key serial number has changed, execute S1316; S1316: determine whether the key serial number has continued to change for three consecutive frames; if the key serial number has not changed for three consecutive frames, execute S1312 to continue monitoring the key Serial number, if the key serial number keeps changing for three consecutive frames, execute S1318; S1318: generate an interrupt signal to notify the optical transmission network receiving device; S1320: configure backup key loading.

In one embodiment, in the implementation process of the present disclosure, based on the normal application of the OTN devices at both ends and the receipt of multiple sets of keys, the application in the optical transmission network sending device of the sending device converts the key switching period configured by the network management into The first preset multiframe MFI is configured to the key device. The key device monitors the overhead data in real time. The overhead data includes the first preset multiframe MFI and the first multiframe frame number MFI_CNT. The condition for the key to switch normally is MFI_CNT= MFI, at the same time load the backup key to the device before switching.

The execution process of the data transmission system provided by the present disclosure is as follows: the first step: the key device of the sending device obtains MFI and monitors MFI_CNT in real time; the second step: judges whether MFI_CNT reaches MFI-2, if it does not reach continue monitoring, if it reaches Skip to the third step; the third step: the MCU (processor) of the sending device receives the interrupt signal, and then adds 1 to key_sn to the optical transmission network receiving device of the receiving device through the reserved overhead; the fourth step: the sending device After detecting the interrupt signal, the application program of the optical transmission network sending device configures the corresponding key after adding key_sn to 1 to the backup key of its key device; Step 5: The receiving device monitors the key_sn in each frame OTN Change, if the key_sn changes (plus 1) after step 3, skip to step 6; Step 6: The key device of the receiving device confirms whether the change of key_sn can be maintained for 3 frames, if the monitoring cannot be continued, if Can jump to the seventh step; the seventh step: the MCU (processor) of the receiving device receives the interrupt signal; the eighth step: the application program of the optical transmission network receiving device of the receiving device increases the key_sn by 1 after detecting the interrupt signal After the corresponding key is configured into the backup key of its key device; Step 9: When the sending device and the receiving device simultaneously detect MFI_CNT=MFI, the sending device and the receiving device simultaneously switch to the backup key in the next multiframe To ensure lossless switching at both ends.

An embodiment of the sixth aspect of the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the data transmission method provided by any one of the above embodiments of the first aspect, or the above The data transmission method provided by any one of the embodiments of the second aspect.

It should be noted that in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these There is any such actual relationship or order between entities or operations. Moreover, the terms "include", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also those not explicitly listed Or other elements that are inherent to this process, method, article, or equipment. Without more restrictions, the element defined by the sentence "include one..." does not exclude that there are other identical elements in the process, method, article or equipment that includes the element.

This method realizes the key switching process in units of frames, which can increase the speed of key switching to the millisecond level, thereby greatly increasing the security of service encryption. Compared with some cases, the above technical solutions provided by the embodiments of the present disclosure have the following advantages: the data transmission method, the data transmission system sending device, the data transmission system receiving device, the data transmission system, and the computer-readable storage provided by the embodiment of the present disclosure Media, through interrupt technology, the sending device receives the interrupt signal, updates the key encryption information, transmits the updated key encryption information to the receiving device, so that the receiving device updates the decryption key according to the updated encryption key information, and the sending device According to the updated key encryption information, the encryption key is updated, and after the first multiframe frame number reaches the first preset frame number, the updated encryption key is used to encrypt the data, thereby realizing frame-based The unit key switching process can increase the speed of key switching to the millisecond level, thereby greatly increasing the security of business encryption.

The above are only the embodiments of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments shown herein, but shall conform to the widest scope consistent with the principles and novel features applied herein.

Claims (10)

A data transmission method, including: According to the interrupt signal, update the encryption key information; Transmitting the updated encryption key information, and updating the key according to the updated encryption key information to obtain an encryption key; When the number of first multiframe frames of the transmitted data reaches the first preset number of frames, the data is encrypted by the encryption key, and the data is transmitted. The data transmission method according to claim 1, wherein before the updating of the encryption key information according to the interrupt signal further comprises: Monitoring the number of the first multiframe frames transmitting the data; When the number of first multiframe frames reaches the second preset number of frames, the interrupt signal is issued; Wherein, the second preset number of frames is smaller than the first preset number of frames. The data transmission method according to claim 1 or 2, wherein the encryption key information is an encryption key serial number. The data transmission method according to claim 3, wherein the step of updating the encryption key information is specifically: Adding the encryption key serial number to a preset value to obtain the updated encryption key serial number. A data transmission method, including: According to the interrupt signal, update the decryption key information with the received encryption key information, and obtain the decryption key; When the number of first multiframe frames receiving the data reaches the first preset number of frames, the data is decrypted with the decryption key. The data transmission method according to claim 5, further comprising: Monitoring whether the decryption key information changes; In the case where the decryption key information changes, monitor whether the number of second multiframe frames that continuously receive the encryption key information reaches the third preset frame number; When the number of second multiframe frames reaches the third preset number of frames, the interrupt signal is issued. A transmission device of a data transmission system, including: A processor, a memory, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it is implemented as follows: According to the interrupt signal, update the encryption key information; Transmitting the updated encryption key information, and updating the key according to the updated encryption key information to obtain an encryption key; When the number of first multiframe frames of the transmitted data reaches the first preset number of frames, the data is encrypted by the encryption key, and the data is transmitted. A receiving device of a data transmission system, including: A processor, a memory, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it is implemented as follows: According to the interruption signal, update the decryption key information with the received encryption key information transmitted by the sending device, and obtain the decryption key; When the number of first multiframe frames receiving the data reaches the first preset number of frames, the data is decrypted with the decryption key. A data transmission system, including: The transmission device of the data transmission system according to claim 7; and The receiving device of the data transmission system according to claim 8; Wherein, the sending device of the data transmission system transmits the updated encryption key information to the receiving device of the data transmission system; The receiving device of the transmission system generates an interrupt signal based on the received updated encryption key information. A computer-readable storage medium on which a computer program is stored, wherein the computer program is executed by a processor to implement the data transmission method according to any one of claims 1 to 4, or 5 or 6. Data transmission method.

Images