Flexible Ethernet encryption systems and methods
Systems and methods for Physical Coding Sublayer (PCS) encryption implemented by a first network element communicatively coupled to a second network element include utilizing an encryption messaging channel to establish an authenticated session and exchanging one or more encryption keys with a second network element; encrypting a signal, based on the one or more encryption keys; and transmitting the encrypted signal to the second network element.
1. A method for Physical Coding Sublayer (PCS) encryption implemented by a first network element communicatively coupled to a second network element, the method comprising:
utilizing an encryption messaging channel in Flexible Ethernet (FlexE) overhead of a FlexE signal to establish an authenticated session and to establish one or more encryption keys with a second network element;
encrypting a signal, based on the one or more encryption keys, wherein the encryption is applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer and a FlexE shim layer; and
transmitting the encrypted signal to the second network element.
2. The method of claim 1 , wherein the encryption messaging channel is utilized for key exchange, authentication, and tags with the second network element.
3. The method of claim 1 , wherein the signal comprises a FlexE shim comprising a plurality of FlexE clients.
4. The method of claim 1 , wherein the signal comprises one of a FlexE client and a generic Ethernet PCS stream onto standard Ethernet PHY.
5. The method of claim 1 , wherein the encryption messaging channel utilizes one or more of reserved bytes in the FlexE overhead and a management channel.
6. The method of claim 1 , wherein the encryption messaging channel utilizes a FlexE client or PCS stream with a designed Operational code.
7. The method of claim 1 , wherein the encryption is applied to a 64b/66b bit stream with one of (i) only data blocks encrypted and (ii) data blocks encrypted along with one or more control blocks comprising a start of packet and an end of packet.
8. The method of claim 1 , wherein the encryption utilizes one or more of Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM).
9. An apparatus for Physical Coding Sublayer (PCS) encryption implemented at a first network element communicatively coupled to a second network element, the apparatus comprising:
circuitry adapted to utilize an encryption messaging channel in Flexible Ethernet (FlexE) overhead of a FlexE signal to establish an authenticated session and to establish one or more encryption keys with a second network element;
circuitry adapted to encrypt a signal, based on the one or more encryption keys, wherein the encryption is applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer and a FlexE shim layer; and
circuitry adapted to transmit the encrypted signal to the second network element.
10. The apparatus of claim 9 , wherein the encryption messaging channel is utilized for key exchange, authentication, and tags with the second network element.
11. The apparatus of claim 9 , wherein the signal comprises a FlexE shim comprising a plurality of FlexE clients.
12. The apparatus of claim 9 , wherein the signal comprises one of a FlexE client and a generic Ethernet PCS stream onto standard Ethernet PHY.
13. The apparatus of claim 9 , wherein the encryption messaging channel utilizes one or more of reserved bytes in the FlexE overhead and a management channel.
14. The apparatus of claim 9 , wherein the encryption messaging channel utilizes a FlexE client or PCS stream with a designed Operational code.
15. The method of claim 1 , wherein the encryption is applied to a 64b/66b bit stream with one of (i) only data blocks encrypted and (ii) data blocks encrypted along with one or more control blocks comprising a start of packet and an end of packet.
16. The apparatus of claim 9 , wherein the encryption utilizes one or more of Advanced Encryption Standard (AES) and Galois/Counter Mode (GCM).
17. A network with Flexible Ethernet (FlexE) encryption, the network comprising:
a first network element; and
a second network element communicatively coupled to the first network element;
wherein the first network element is adapted to
utilize an encryption messaging channel in Flexible Ethernet (FlexE) overhead of a FlexE signal to establish an authenticated session and to establish one or more encryption keys with a second network element,
encrypt the FlexE signal, based on the one or more encryption keys, and
transmit the encrypted signal to the second network element,
wherein the encryption is applied to a 64b/66b bit stream associated with the FlexE signal at one or more of a FlexE client layer, a FlexE shim layer, and a generic Ethernet PCS stream onto standard Ethernet PHY.