Granted Patent B2

US 7,349,537 · App. 11/078,923 · Granted Mar 25, 2008

Abstract

Claims (114)

1. A method for decrypting downstream data in an Ethernet passive optical network (EPON), comprising:

receiving a data frame which is encrypted based on a remote input block and a session key, wherein the remote input block is constructed based on a remote cipher counter and a remote block counter;

adjusting a local cipher counter based on a received checksum located in a preamble of the data frame, wherein the local cipher counter is synchronized with the remote cipher counter;

truncating the local cipher counter by discarding n least significant bits thereof, wherein n is equal to 5, wherein the untruncated local cipher counter is more than 5 bits long, and wherein a portion of the untruncated local cipher counter is identical to a local multi-point control protocol (MPCP) counter;

constructing a local input block based on the truncated cipher counter and a local block counter for the received data frame; and

decrypting the data frame based on the local input block and the session key.

2. The method of claim 1 , wherein the checksum is a cyclic redundancy checksum (CRC); and

wherein adjusting the local cipher counter involves:

computing a cyclic redundancy checksum (CRC) for the received data frame;

comparing the computed CRC with the received CRC attached to the received data frame;

if the computed CRC is equal to the received CRC, setting an expected value of the (n−1)th bit of the local cipher counter to “1;” and

if the computed CRC is the inversion of the received CRC, setting the expected value of the (n−1)th bit of the local cipher counter to “0.”

3. The method of claim 2 ,

wherein if the (n−1)th bit of the local cipher counter is not equal to the expected value thereof, and

if the decimal value of the least significant n bits of the untruncated local cipher counter is greater than or equal to 2 (n−1) ,

adjusting the local cipher counter involves incrementing the (n+1)th bit of the local cipher counter by one and performing necessary carry-overs; and

wherein if the (n−1)th bit of the local cipher counter is not equal to the expected value thereof, and

if the decimal value of the least significant n bits of the untruncated local cipher counter is less than 2 (n−1) ,

adjusting the local cipher counter involves decrementing the (n+1)th bit of the local cipher counter by one and performing necessary carry-overs.

4. The method of claim 1 ,

wherein the untruncated local cipher counter is 48-bit long;

the least significant 32 bits of the untruncated local cipher counter is identical to the local MPCP counter;

wherein the method further comprises incrementing the 48-bit long untruncated local cipher counter every 16 ns; and

wherein constructing the local input block involves:

concatenating the truncated local cipher counter with a block counter to obtain a 50-bit value, wherein the block counter is 7-bit long and is reset to zero for every data frame; and

duplicating the 50-bit value to fill a 128-bit space for the local input block starting from the least significant bit.

5. The method of claim 4 , wherein decrypting the received data frame involves:

encrypting the local input block with the session key based on the Advanced Encryption Standard (AES) to obtain a local output block; and

performing an exclusive OR (XOR) operation on a 128-bit block within the received data frame and the local output block to obtain a 128-bit block of unencrypted data, wherein the 128-bit block corresponds to the block counter.

6. The method of claim 4 , further comprising:

receiving the 16 most significant bits of the remote cipher counter which is 48-bit long; and

concatenating the local MPCP counter with the received 16 bits to obtain the 48-bit local cipher counter, thereby synchronizing the local cipher counter with the remote cipher counter.

7. A method for encrypting downstream data from an OLT to an ONU in an EPON, comprising:

receiving an unencrypted data frame;

modifying a checksum located in a preamble of the data frame based on a cipher counter, wherein n is equal to 5,

truncating the cipher counter by discarding n least significant bits thereof, wherein the untruncated local cipher counter is more than 5 bits long, and wherein a portion of the untruncated local cipher counter is identical to a local multi-point control protocol (MPCP) counter;

constructing an input block based on the truncated cipher counter and a block counter for the data frame; and

encrypting the data frame based on the input block and a session key.

8. The method of claim 7 , wherein modifying the checksum for the data frame involves:

setting the checksum to be a CRC for the data frame if the (n+1)th bit of the cipher counter is equal to “1;” and

setting the checksum to be the inversion of the CRC for the data frame if the (n+1)th bit of the cipher counter is equal to “0.”

9. The method of claim 7 , wherein the untrucated cipher counter is 48-bit long;

the lower 32 bits of the untruncated cipher counter is identical to the local MPCP counter;

wherein the method further comprises incrementing the 48-bit long untruncated cipher counter every 16 ns; and

wherein constructing the input block involves:

concatenating the truncated cipher counter with a block counter to obtain a 50-bit value, wherein the block counter is 7-bit long and reset to zero for every data frame; and

duplicating the 50-bit value to fill a 128-bit space for the input block starting from the least significant bit.

10. The method of claim 9 , wherein encrypting the data frame involves:

encrypting the input block with the session key based on AES to obtain an output block; and

performing an exclusive OR (XOR) operation on a 128-bit block within the data frame and the output block to obtain a 128-bit block of encrypted data for the data frame, wherein the 128-bit block corresponds to the block counter.

11. The method of claim 9 , further comprising sending the 16 most significant bits of the cipher counter to a optical network unit (ONU), so that the ONU's cipher counter can be synchronized.

12. The method of claim 9 , wherein incrementing the 48-bit long untruncated cipher counter involves:

incrementing the MPCP counter every 16 ns;

maintaining a 16-bit cycle counter which is incremented when the MPCP counter rolls over;

maintaining a register for the ONU which contains the value of the cycle counter when an encryption key associated with the ONU is last changed;

obtaining a 16-bit value by subtracting the value in the register from the value of the cycle counter; and

obtaining the 48-bit long cipher counter by concatenating the 16-bit value with the MPCP counter.

13. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for decrypting downstream data in an Ethernet passive optical network (EPON), the method comprising:

receiving a data frame which is encrypted based on a remote input block and a session key, wherein the remote input block is constructed based on a remote cipher counter and a remote block counter;

adjusting a local cipher counter based on a received checksum located in a preamble of the data frame, wherein the local cipher counter is synchronized with the remote cipher counter;

truncating the local cipher counter by discarding n least significant bits thereof, wherein n is equal to 5, wherein the untruncated local cipher counter is more than 5 bits long, and wherein a portion of the untruncated local cipher counter is identical to a local multi-point control protocol (MPCP) counter;

constructing a local input block based on the truncated cipher counter and a local block counter for the received data frame; and

decrypting the data frame based on the local input block and the session key.

14. The computer-readable storage medium of claim 13 , wherein the checksum is a CRC; and

wherein adjusting the local cipher counter involves:

computing a cyclic redundancy checksum (CRC) for the received data frame;

comparing the computed CRC with the received CRC attached to the received data frame;

if the computed CRC is equal to the received CRC, setting an expected value of the (n−1)th bit of the local cipher counter to “1;” and

if the computed CRC is the inversion of the received CRC, setting the expected value of the (n−1)th bit of the local cipher counter to “0.”

15. The computer-readable storage medium of claim 14 ,

wherein if the (n−1)th bit of the local cipher counter is not equal to the expected value thereof, and

if the decimal value of the least significant n bits of the untruncated local cipher counter is greater than or equal to 2 (n−1) ,

adjusting the local cipher counter involves incrementing the (n+1)th bit of the local cipher counter by one and performing necessary carry-overs; and

wherein if the (n−1)th bit of the local cipher counter is not equal to the expected value thereof, and

if the decimal value of the least significant n bits of the untruncated local cipher counter is less than 2 (n−1) ,

adjusting the local cipher counter involves decrementing the (n+1)th bit of the local cipher counter by one and performing necessary carry-overs.

16. The computer-readable storage medium of claim 13 ,

wherein the untruncated local cipher counter is 48-bit long;

the least significant 32 bits of the untruncated local cipher counter is identical to a the local MPCP counter;

wherein the method further comprises incrementing the 48-bit long untruncated local cipher counter every 16 ns; and

wherein constructing the local input block involves:

concatenating the truncated local cipher counter with a block counter to obtain a 50-bit value, wherein the block counter is 7-bit long and is reset to zero for every data frame; and

duplicating the 50-bit value to fill a 128-bit space for the local input block starting from the least significant bit.

17. The computer-readable storage medium of claim 16 , wherein decrypting the received data frame involves:

encrypting the local input block with the session key based on the Advanced Encryption Standard (AES) to obtain a local output block; and

performing an exclusive OR (XOR) operation on a 128-bit block within the received data frame and the local output block to obtain a 128-bit block of unencrypted data, wherein the 128-bit block corresponds to the block counter.

18. The computer-readable storage medium of claim 16 , wherein the method further comprises:

receiving the 16 most significant bits of the remote cipher counter which is 48-bit long; and

concatenating the local MPCP counter with the received 16 bits to obtain the 48-bit local cipher counter, thereby synchronizing the local cipher counter with the remote cipher counter.

19. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for encrypting downstream data in an EPON, the method comprising:

receiving an unencrypted data frame;

modifying a checksum located in a preamble of the data frame based on a cipher counter;

truncating the cipher counter by discarding n least significant bits thereof, wherein n is equal to 5, wherein the untruncated local cipher counter is more than 5 bits long, and wherein a portion of the untruncated local cipher counter is identical to a local multi-point control protocol (MPCP) counter;

constructing an input block based on the truncated cipher counter and a block counter for the data frame; and

encrypting the data frame based on the input block and a session key.

20. The computer-readable storage medium of claim 19 , wherein modifying the checksum for the data frame involves:

setting the checksum to be a CRC for the data frame if the (n+1)th bit of the cipher counter is equal to “1;” and

setting the checksum to be the inversion of the CRC for the data frame if the (n+1)th bit of the cipher counter is equal to “0.”

21. The computer-readable storage medium of claim 19 , wherein the untrucated cipher counter is 48-bit long;

the lower 32 bits of the untruncated cipher counter is identical to the local MPCP counter;

wherein the method further comprises incrementing the 48-bit long untruncated cipher counter every 16 ns; and

wherein constructing the input block involves:

concatenating the truncated cipher counter with a block counter to obtain a 50-bit value, wherein the block counter is 7-bit long and reset to zero for every data frame; and

duplicating the 50-bit value to fill a 128-bit space for the input block starting from the least significant bit.

22. The computer-readable storage medium of claim 21 , wherein encrypting the data frame involves:

encrypting the input block with the session key based on AES to obtain an output block; and

performing an exclusive OR (XOR) operation on a 128-bit block within the data frame and the output block to obtain a 128-bit block of encrypted data for the data frame, wherein the 128-bit block corresponds to the block counter.

23. The computer-readable storage medium of claim 21 , wherein the method further comprises sending the 16 most significant bits of the cipher counter to a optical network unit (ONU), so that the ONU's cipher counter can be synchronized.

24. The computer-readable storage medium of claim 21 , wherein incrementing the 48-bit long untruncated cipher counter involves:

incrementing the MPCP counter every 16 ns;

maintaining a 16-bit cycle counter which is incremented when the MPCP counter rolls over;

maintaining a register for the ONU which contains the value of the cycle counter when an encryption key associated with the ONU is last changed;

obtaining a 16-bit value by subtracting the value in the register from the value of the cycle counter; and

obtaining the 48-bit long cipher counter by concatenating the 16-bit value with the MPCP counter.

Assignments (11)