Securing virtual lane physical layers
A data stream with a given data rate is distributed into a plurality of virtual lanes or streams, each with a lower data rate than the data stream. Virtual lanes permit the use of lower cost electronics at the optical-electrical conversion points. Security information is generated that includes a unique initialization vector. The security information is distributed or allocated across some or all of the of the virtual data streams in a virtual lane alignment marker in a portion of the alignment marker used to maintain direct current (DC) transmission balance, but that otherwise does not provide useful information.
1. A method comprising:
distributing line encoded data blocks of a first data stream across a plurality of second data streams at a transmitting device such that the second data streams can be processed at a lower data rate than a data rate associated with the first data stream;
encrypting a fixed amount of data in each of the second data streams to obtain a plurality of corresponding encrypted blocks in each of the second data streams;
generating a plurality of synchronization markers for each of the second data streams configured with information to allow synchronization of the plurality of encrypted blocks at a receiving device;
generating cryptographic information that allows decryption of the plurality of encrypted blocks at the receiving device;
dividing the cryptographic information into a plurality of portions;
inserting each portion of the cryptographic information into one of the plurality of synchronization markers, wherein the portions of cryptographic information are inserted into synchronization markers corresponding to at least two of the plurality of second data streams; and
inserting one or more of the plurality of synchronization markers into each of the second data streams in preparation for transmission.
2. The method of claim 1 , wherein generating the cryptographic information includes generating one or more of an initialization vector, starting variable, a number only used once (nonce) and block cypher initialization number.
3. The method of claim 1 , wherein generating the plurality of synchronization markers includes generating synchronization markers comprising Institute of Electrical and Electronics Engineer (IEEE) 802.3 based Physical Coding Sublayer (PCS) lane markers comprising a lane identifier.
4. The method of claim 1 , wherein the first data stream is configured for transport at optical data rates and the second data streams are configured for processing at the lower data rate by electrical components.
5. The method of claim 1 , wherein generating the cryptographic information includes generating information configured to decrypt the encrypted blocks that were encrypted according the Internet Protocol Security (IPsec) protocol suite.
6. The method of claim 1 , wherein generating the plurality of synchronization markers includes generating synchronization markers comprising information configured to provide direct current (DC) balance including the portions of the cryptographic information when transmitted over physical transmission media.
7. The method of claim 1 , further comprising distributing security information for decrypting the encrypted blocks at the receiving device across the one or more synchronization markers added to each of the second data streams.
8. An apparatus, comprising:
a memory;
a processor coupled to the memory, and configured to:
distribute line encoded data blocks of a first data stream across a plurality of second data streams at a transmitting device such that the second data streams can be processed at a lower data rate than a data rate associated with the first data stream;
encrypt a fixed amount of data in each of the second data streams to obtain a plurality of corresponding encrypted blocks in each of the second data streams;
generate a plurality of synchronization markers for each of the second data streams configured with information to allow synchronization of the plurality of encrypted blocks at a receiving device;
generate cryptographic information that allows decryption of the plurality of encrypted blocks at the receiving device;
divide the cryptographic information into a plurality of portions;
insert each portion of the cryptographic information into one of the plurality of synchronization markers, wherein the portions of cryptographic information are inserted into synchronization markers corresponding to at least two of the plurality of second data streams; and
insert one or more of the plurality of synchronization markers into each of the second data streams in preparation for transmission.
9. The apparatus of claim 8 , wherein the processor is configured to generate cryptographic information comprising one or more of an initialization vector, starting variable, a number only used once (nonce) and block cypher initialization number.
10. The apparatus of claim 8 , wherein the processor is configured to generate synchronization markers comprising Institute of Electrical and Electronics Engineer (IEEE) 802.3 based Physical Coding Sublayer (PCS) lane markers comprising a lane identifier.
11. The apparatus of claim 8 , wherein the first data stream is configured for transport at optical data rates and the second data streams are configured for processing at the lower data rate by electrical components.
12. The apparatus of claim 8 , wherein the processor is configured to generate cryptographic information comprising information configured to decrypt the encrypted blocks that were encrypted according the Internet Protocol Security (IPsec) protocol suite.
13. The apparatus of claim 8 , wherein the processor is configured to generate synchronization markers comprising information configured to provide direct current (DC) balance including the portions of the cryptographic information when transmitted over physical transmission media.
14. The apparatus of claim 8 , wherein the processor is further configured to distribute security information for decrypting the encrypted blocks at the receiving device across the one or more synchronization markers added to each of the second data streams.
15. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
distribute line encoded data blocks of a first data stream across a plurality of second data streams at a transmitting device such that the second data streams can be processed at a lower data rate than a data rate associated with the first data stream;
encrypt a fixed amount of data in each of the second data streams to obtain a plurality of corresponding encrypted blocks in each of the second data streams;
generate a plurality of synchronization markers for each of the second data streams configured with information to allow synchronization of the plurality of encrypted blocks at a receiving device;
generate cryptographic information that allows decryption of the plurality of encrypted blocks at the receiving device;
divide the cryptographic information into a plurality of portions;
insert each portion of the cryptographic information into one of the plurality of synchronization markers, wherein the portions of cryptographic information are inserted into synchronization markers corresponding to at least two of the plurality of second data streams; and
insert one or more of the plurality of synchronization markers into each of the second data streams in preparation for transmission.
16. The computer readable storage media of claim 15 , wherein the instructions operable to generate the cryptographic information comprise instructions operable to generate one or more of an initialization vector, starting variable, a number only used once (nonce) and block cypher initialization number.
17. The computer readable storage media of claim 15 , wherein the instructions operable to generate the plurality of synchronization markers comprise instructions operable to generate synchronization markers comprising Institute of Electrical and Electronics Engineer (IEEE) 802.3 based Physical Coding Sublayer (PCS) lane markers comprising a lane identifier.
18. The computer readable storage media of claim 15 , wherein the instructions operable to generate the plurality of synchronization markers comprise instructions operable to generate synchronization markers comprising information configured to provide direct current (DC) balance including the portions of the cryptographic information when transmitted over physical transmission media.
19. The computer readable storage media of claim 15 , wherein the instructions operable to generate the cryptographic information comprise instructions operable to generate information configured to decrypt the encrypted blocks that were encrypted according the Internet Protocol Security (IPsec) protocol suite.
20. The computer readable storage media of claim 15 , further comprising instructions operable to distribute security information for decrypting the encrypted blocks at the receiving device across the one or more synchronization markers added to each of the second data streams.