# US 2019/0173856 A1 · Flexible ethernet encryption systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173856 A1 - Document ID: US20190173856A1 - Status: Published application - Kind: A1 - Application number: 16/255,926 - Filed: 2019-01-24 - Published: 2019-06-06 - Earliest claimed: 2015-12-11 - Assignees: Ciena Corporation - Applicants: Ciena Corporation - Inventors: Sebastien Gareau; Timothy L. Norman; Marc W. Leclair; Michael Watford - Web page: https://patentgrep.com/patent/US20190173856A1 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04J 3/1652: {Optical Transport Network [OTN]} - H04L 1/0002: {by adapting the transmission rate} - H04L 1/0061: {Error detection codes} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04J 3/1658: {carrying packets or ATM cells; (H04J3/1664 takes precedence for payloads with different packet types)} - H04J 2203/0085: Support of Ethernet - H04J 2203/0089: Multiplexing, e.g. coding, scrambling, SONET - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04J: MULTIPLEX COMMUNICATION (transmission in general H04B; peculiar to transmission of digital information H04L5/00; systems for the simultaneous or sequential transmission of more than one television signal H04N7/08; in exchanges H04Q11/00; stereophonic systems H04S) ## Abstract Systems and methods for Physical Coding Sublayer (PCS) encryption implemented by a first network element communicatively coupled to a second network element include encrypting a Flexible Ethernet (FlexE) signal based on a first encryption key with encryption applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer and a FlexE shim layer; switching to a second encryption key at a predetermined point in the FlexE signal; and encrypting the FlexE signal with the second encryption key subsequent to the switching. ## Claims ### Claim 1 A method for Physical Coding Sublayer (PCS) encryption implemented by a first network element communicatively coupled to a second network element, the method comprising: encrypting a Flexible Ethernet (FlexE) signal based on a first encryption key with encryption applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer and a FlexE shim layer; switching to a second encryption key at a predetermined point in the FlexE signal; and encrypting the FlexE signal with the second encryption key subsequent to the switching. ### Claim 2 (depends on 1) The method of claim 1, wherein the predetermined point in the FlexE signal is a multiframe boundary in FlexE overhead. ### Claim 3 (depends on 1) The method of claim 1, further comprising utilizing an encryption messaging channel in FlexE overhead to coordinate the switching. ### Claim 4 (depends on 3) The method of claim 3, further comprising utilizing the encryption messaging channel to establish the first encryption key and the second encryption key. ### Claim 5 (depends on 3) The method of claim 3, wherein the encryption messaging channel utilizes one or more of reserved bytes in the FlexE overhead and a management channel. ### Claim 6 (depends on 3) The method of claim 3, wherein the encryption messaging channel utilizes a FlexE client or PCS stream with a designed Operational code. ### Claim 7 (depends on 1) The method of claim 1, wherein the encryption is applied to the 64b/66b bit stream with one of (i) only data blocks encrypted and (ii) data blocks encrypted along with one or more control blocks comprising a start of packet and an end of packet. ### Claim 8 (depends on 1) The method of claim 1, wherein the encryption utilizes one or more of Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM). ### Claim 9 An apparatus for Physical Coding Sublayer (PCS) encryption implemented at a first network element communicatively coupled to a second network element, the apparatus comprising: circuitry configured to encrypt a Flexible Ethernet (FlexE) signal based on a first encryption key with encryption applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer and a FlexE shim layer; circuitry configured to switch to a second encryption key at a predetermined point in the FlexE signal; and circuitry configured to encrypt the FlexE signal with the second encryption key subsequent to the switch to the second encryption key. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the predetermined point in the FlexE signal is a multiframe boundary in FlexE overhead. ### Claim 11 (depends on 9) The apparatus of claim 9, further comprising circuitry configured to utilize an encryption messaging channel in FlexE overhead to coordinate the switch to the second encryption key. ### Claim 12 (depends on 11) The apparatus of claim 11, further comprising circuitry configured to utilize the encryption messaging channel to establish the first encryption key and the second encryption key. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the encryption messaging channel utilizes one or more of reserved bytes in the FlexE overhead and a management channel. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the encryption messaging channel utilizes a FlexE client or PCS stream with a designed Operational code. ### Claim 15 (depends on 9) The apparatus of claim 9, wherein the encryption is applied to the 64b/66b bit stream with one of (i) only data blocks encrypted and (ii) data blocks encrypted along with one or more control blocks comprising a start of packet and an end of packet. ### Claim 16 (depends on 9) The apparatus of claim 9, wherein the encryption utilizes one or more of Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM). ### Claim 17 A network configured for Physical Coding Sublayer (PCS) encryption, the network comprising: a first network element; and a second network element communicatively coupled to the first network element, wherein the first network element is configured to encrypt a Flexible Ethernet (FlexE) signal based on a first encryption key with encryption applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer and a FlexE shim layer; switch to a second encryption key at a predetermined point in the FlexE signal; and encrypt the FlexE signal with the second encryption key subsequent to the switch to the second encryption key. ### Claim 18 (depends on 17) The network of claim 17, wherein the predetermined point in the FlexE signal is a multiframe boundary in FlexE overhead. ### Claim 19 (depends on 17) The network of claim 17, wherein an encryption messaging channel in FlexE overhead is used to coordinate the switch to the second encryption key. ### Claim 20 (depends on 17) The network of claim 17, wherein the encryption utilizes one or more of Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM).