Timeslot encryption in an optical transport network

1. A method comprising:

receiving an optical transport network (OTN) frame having an optical channel payload unit divided into a plurality of timeslots;

grouping the timeslots into blocks of timeslots;

selecting two or more blocks of timeslots for encryption, wherein each block of the two or more blocks of timeslots comprises an equal number of timeslots; and

encrypting and authenticating the two or more blocks of timeslots in parallel to generate an encrypted OTN frame in which only certain blocks of timeslots are encrypted.

2. The method of claim 1 , wherein selecting the two or more blocks of timeslots for encryption comprises:

examining a Multiplex Structure Identifier signifying the composition of the blocks to select the two or more blocks of timeslots.

3. The method of claim 1 , further comprising:

encrypting and authenticating each of the two or more blocks of timeslots in parallel with separate encryption/authentication processes.

4. The method of claim 1 , further comprising:

encrypting and authenticating each of the two or more blocks of timeslots using the same encryption key and the same arbitrary number used only once (nonce).

5. The method of claim 1 , wherein each of the two or more blocks of timeslots is associated with an integrity check value, and further comprising:

performing an exclusive-or operation using the integrity check values associated with each of the two or more blocks of timeslots to generate a frame integrity check value.

6. The method of claim 1 , further comprising:

generating an Encapsulating Security Payload (ESP) comprising an ESP header including encryption information and an ESP trailer including authentication information; and

adding the ESP to the encrypted OTN frame.

7. The method of claim 1 , further comprising:

calculating a forward error correction (FEC) code for the encrypted OTN frame; and

adding the FEC to the OTN frame.

8. The method of claim 1 , further comprising:

transmitting the encrypted OTN frame to a receiver; and

at the receiver, decrypting and authenticating each of the two or more blocks of timeslots in parallel with separate decryption/authentication processes.

9. The method of claim 8 , further comprising:

transmitting to the receiver via a general communications channel information that identifies the two or more blocks of timeslots that have been encrypted.

10. An apparatus, comprising:

a memory;

a processor coupled to the memory, and configured to:

obtain an optical transport network (OTN) frame having an optical channel payload unit divided into a plurality of timeslots,

group the timeslots into blocks of timeslots, and

select two or more blocks of timeslots for encryption, wherein each block of the two or more blocks of timeslots comprises an equal number of timeslots; and

a plurality of subsystems configured to encrypt and authenticate the two or more blocks of timeslots in parallel to generate an encrypted OTN frame in which only certain blocks of timeslots are encrypted.

11. The apparatus of claim 10 , wherein the processor is configured to select the two or more blocks of timeslots for encryption by examining a Multiplex Structure Identifier signifying the composition of the blocks to select the two or more blocks of timeslots.

12. The apparatus of claim 10 , wherein the plurality of subsystems comprise a plurality of application specific integrated circuits (ASICs) each configured to encrypt and authenticate one of the two or more blocks of timeslots in parallel.

13. The apparatus of claim 10 , wherein the plurality of subsystems are configured to encrypt and authenticate each of the two or more blocks of timeslots using the same encryption key and the same arbitrary number used only once (nonce).

14. The apparatus of claim 10 , wherein each of the two or more blocks of timeslots is associated with an integrity check value, and wherein the processor is configured to perform an exclusive-or operation using the integrity check values associated with each of the two or more blocks of timeslots to generate a frame integrity check value.

15. The apparatus of claim 10 , wherein the processor is configured to generate an Encapsulating Security Payload (ESP) comprising an ESP header including encryption information and an ESP trailer including authentication information, and to add the ESP to the encrypted OTN frame.

16. The apparatus of claim 10 , wherein the processor is configured to calculate a forward error correction (FEC) code for the encrypted OTN frame and add the FEC to the OTN frame.

17. The apparatus of claim 10 , wherein the processor is configured to transmit the encrypted OTN frame to a receiver and transmit to the receiver via a general communications channel information that identifies the two or more blocks of timeslots that have been encrypted.

18. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

receive an optical transport network (OTN) frame having an optical channel payload unit divided into a plurality of timeslots;

group the timeslots into blocks of timeslots;

select two or more blocks of timeslots for encryption, wherein each block of the two or more blocks of timeslots comprises an equal number of timeslots; and

encrypt and authenticate the two or more blocks of timeslots in parallel to generate an encrypted OTN frame in which only certain blocks of timeslots are encrypted.

19. The non-transitory computer readable storage media of claim 18 , wherein the instructions operable to select the two or more blocks of timeslots for encryption comprise instructions operable to:

examine a Multiplex Structure Identifier signifying the composition of the blocks to select the two or more blocks of timeslots.

20. The non-transitory computer readable storage media of claim 18 , further comprising instructions operable to:

encrypt and authenticate each of the two or more blocks of timeslots in parallel with separate encryption/authentication processes executed by separate application specific integrated circuits (ASICs).

21. The non-transitory computer readable storage media of claim 18 , further comprising instructions operable to:

encrypt and authenticate each of the two or more blocks of timeslots using the same encryption key and the same arbitrary number used only once (nonce).

22. The non-transitory computer readable storage media of claim 18 , wherein each of the two or more blocks of timeslots is associated with an integrity check value, and further comprising instructions operable to:

perform an exclusive-or operation using the integrity check values associated with each of the two or more blocks to generate a frame integrity check value.

23. The non-transitory computer readable storage media of claim 18 , further comprising instructions operable to:

generate an Encapsulating Security Payload (ESP) comprising an ESP header including encryption information and an ESP trailer including authentication information; and

add the ESP to the encrypted OTN frame.

24. The non-transitory computer readable storage media of claim 18 , further comprising instructions operable to:

calculate a forward error correction (FEC) code for the encrypted OTN frame; and

add the FEC to the OTN frame.

25. The non-transitory computer readable storage media of claim 18 , further comprising instructions operable to:

transmit the encrypted OTN frame to a receiver; and

transmit to the receiver via a general communications channel information that identifies the two or more blocks of timeslots that have been encrypted.