Back to results
US 2018/0294958 A1Published application
Encryption control in optical networks without data loss
AssigneeFujitsu Limited
InventorsMuhammad Sakhi Sarwar, Erik Charles Stewart, Junichi Sugiyama, Abirami Sathyamoorthy, Swati Mittal
Life of this patent
Estimating the term…
Abstract
Methods and systems for encryption control in optical networks without data loss enable various transitions related to encryption of an ODU data payload. A transition from unencrypted data payload to encrypted data payload is performed without data loss or dropping of OTN frames. A transition from encrypted data payload to unencrypted data payload is performed without data loss or dropping of OTN frames. A rotation of the encryption key to another encryption key is also performed without data loss or dropping of OTN frames.
Claims20
A method for encryption in optical transport networks, the method comprising:
- receiving, at a transmitter and a receiver, provisioning instructions for provisioning an optical path between a first port at the transmitter and a second port at the receiver in an optical transport network (OTN);
- establishing a communication channel between the first port to the second port;
- receiving, at the transmitter and at the receiver, first encryption instructions to encrypt a data payload in OTN frames transmitted from the first port to the second port;
- using the communication channel, establishing a Transport Layer Security (TLS) connection to generate and share a first encryption key usable to encrypt the data payload;
- locally storing the first encryption key at the transmitter and at the receiver;
- responsive to receiving the first encryption instructions and after locally storing the first encryption key, determining, at the transmitter, a final unencrypted OTN frame for transmission from the first port to the second port, wherein the data payload in the final unencrypted OTN frame is not encrypted;
- prior to transmission of the final unencrypted OTN frame, setting, at the transmitter, first overhead encryption bits in the final unencrypted OTN frame, the first overhead encryption bits including:
- a set_encryption bit=1, a deprovision_encryption bit=0, and an encryption key (EK) bit=0;
- transmitting, from the first port to the second port, the final unencrypted OTN frame with the first overhead encryption bits;
- and
- upon receiving the final unencrypted OTN frame at the receiver, interpreting the first overhead encryption bits in the final unencrypted OTN frame to indicate activating decryption of the data payload in subsequent OTN frames using the first encryption key.
8 more elements
An optical transport network (OTN), comprising:
- an optical path provisioned between a first port at a transmitter and a second port at a receiver included in the OTN, wherein the transmitter and the receiver are enabled for:
- receiving, at the transmitter and the receiver, provisioning instructions for provisioning the optical path;
- establishing a communication channel between the first port to the second port;
- receiving, at the transmitter and at the receiver, first encryption instructions to encrypt a data payload in OTN frames transmitted from the first port to the second port;
- using the communication channel, establishing a Transport Layer Security (TLS) connection to generate and share a first encryption key usable to encrypt the data payload;
- locally storing the first encryption key at the transmitter and at the receiver;
- responsive to receiving the first encryption instructions and after locally storing the first encryption key, determining, at the transmitter, a final unencrypted OTN frame for transmission from the first port to the second port, wherein the data payload in the final unencrypted OTN frame is not encrypted;
- prior to transmission of the final unencrypted OTN frame, setting, at the transmitter, first overhead encryption bits in the final unencrypted OTN frame, the first overhead encryption bits including:
- a set_encryption bit=1, a deprovision_encryption bit=0, and an encryption key (EK) bit=0;
- transmitting, from the first port to the second port, the final unencrypted OTN frame with the first overhead encryption bits;
- and
- upon receiving the final unencrypted OTN frame at the receiver, interpreting the first overhead encryption bits in the final unencrypted OTN frame to indicate activating decryption of the data payload in subsequent OTN frames using the first encryption key.
9 more elements
Dependencies are inferred from the claim text.