Much work to date has been done in the identification of physical layer optical network attacks. Our own work has indicated additional attacks against data integrity through various forms of optical coupling. In this paper, we present an analysis of coupling attacks on a fiber optic link. In addition we demonstrate on such form of a coupling attack using standard hardware and allowing injection of additional data onto the fiber. This method introduces minimal power losses that are well below most physical layer intrusion detection sensor thresholds.
Much work to date has been done in the identification of physical layer optical network attacks. Our own work has indicated additional attacks against data integrity through various forms of optical coupling. In this paper, we present an analysis of coupling attacks on a fiber optic link. In addition we demonstrate on such form of a coupling attack using standard hardware and allowing injection of additional data onto the fiber. This method introduces minimal power losses that are well below most physical layer intrusion detection sensor thresholds.
This paper focuses on the analysis of fiber optic line eavesdropping options based on cheap and easy-to-use equipment - for example, the commonly used fiber optic splitters with suitable optical power division ratios. The fiber optic splitter takes a small portion of the optical power sufficient for the eavesdropper to read the data and lets as much signal power as possible pass in the original direction. We attempted to detect the presence of fiber optic splitter-based eavesdropping points on the communication line by using common techniques designated for fiber optic quality measurement and fault detection. The results are summarised in this paper.
Network security concerns have recently been increased due to the vast amount of information that flows in a single fiber. At the application layer, data security relies on end-user encryption algorithms, many of which are known to be vulnerable, and authentication algorithms are not foolproof as the sophistication of eavesdroppers and unauthorized bad actors increases. As a result, the communications link may be attacked by eavesdroppers to access data, to mimic the source, or to cause service denial. To accomplish this however, the transmission link must be compromised. Therefore, if an a priori link and channel signature has been established at the receiver, then an unauthorized intervention is possible to be detected, reported and counteracted. In this paper we provide an analysis of the link and channel parameters that affect the signal performance, which also constitute the identification signature of the optical channel. When the medium is compromised, the channel parameters are affected and thus the channel performance. We also develop a model and we simulate conditions of channel attack
We describe a layer-1-based intrusion detection system for fiber-optic–based networks. Layer-1-based intrusion detection represents a significant elevation in security as it prohibits an adversary from obtaining information in the first place (no cryptanalysis is possible). We describe the experimental setup of the intrusion detection system, which is based on monitoring the behavior of certain attributes of light both in unperturbed and perturbed optical fiber links. The system was tested with optical fiber links of various lengths and types, under different environmental conditions, and under changes in fiber geometry similar to what is experienced during tapping activity. Comparison of the results for perturbed and unperturbed links has shown that the state of polarization is more sensitive to intrusion activity than the degree of polarization or power of the received light. The testing was conducted in a simulated telecommunication network environment that included both underground and aerial links. The links were monitored for intrusion activity. Attempts to tap the link were easily detected with no apparent degradation in the visual quality of the real-time surveillance video.
The physical layer of an optical network is vulnerable to a variety of attacks, including jamming, physical infrastructure attacks, eavesdropping, and interception. As the demand for network capacity grows dramatically, the issue of securing the physical layer of optical network cannot be overlooked. In this survey paper, we discuss the security threats in an optical network as well as present several existing optical techniques to improve the security. In the first part of this paper, we discuss various types of security threats that could appear in the optical layer of an optical network, including jamming, physical infrastructure attacks, eavesdropping, and interception. Intensive research has focused on improving optical network security, in the above specific areas. Real-time processing of the optical signal is essential in order to integrate security functionality at the physical layer while not undermining the true value of optical communications, which is its speed. Optical layer security benefits from the unique properties of optical processing-instantaneous response, broadband operation, electromagnetic immunity, compactness, and low latency. In the second part of this paper, various defenses against the security threats outlined in this paper are discussed, including optical encryption, optical code-division multiple access (CDMA) confidentiality, self-healing survivable optical rings, anti-jamming, and optical steganography.
Initially considered secure against interception, fiber-optic networks were subsequently found susceptible to covert tapping, although such attacks require different coupling mechanisms and components than those used for twisted pair and coaxial cables. Fiber-optic networks carry the majority of data and voice traffic worldwide, including backhaul and fronthaul traffic in 4G and 5G radio networks, connections between data centers, and submarine cable systems. Consequently, physical access to fibers for interception has attracted the attention of intelligence agencies and industrial spies. This vulnerability is facilitated by the fact that single-mode optical fibers (SMFs) used in telecommunication networks have evolved relatively little over the last 40 years. Fibers of substantially different designs—anti-resonant hollow core fibers (HCF) and multi-core fibers (MCF)—made their commercial debut around 2023, and their susceptibility to tapping may differ substantially from that of conventional SMFs. New promising fiber monitoring techniques based on polarization measurements have also been demonstrated recently. While established tapping techniques remain feasible for conventional fibers, new fiber designs and monitoring technologies can make covert interception difficult. This review examines physical fiber tapping techniques and their practical feasibility, with particular emphasis on optical power constraints, introduced loss, detectability, and implementation limitations. It also reviews prevention and monitoring approaches, including optical time-domain reflectometry, received-power monitoring, and state-of-polarization (SOP) monitoring, and provides a prospective engineering assessment of the susceptibility of MCFs and HCFs to physical tapping.
Network security has traditionally been limited to network access and network administration, whereas data security is left to end clients where text is encrypted and decrypted. In the last decade, there has been a rapid increase in bandwidth demand mainly due to the explosion of the Internet and mobile telephony. The explosive bandwidth has been comfortably met with optical networks having many optical channels multiplexed in the same fiber, known as wavelength division multiplexing,. Data rate exceeding 1 Tbps within a fiber implies that there are tributaries that carry sensitive and proprietary data. Although data are encrypted by the end client, there is no assurance that, if captured by an eavesdropper, they may not be decrypted. Therefore, three new requirements emerge; monitor the optical link integrity, detect if an optical channel is compromised by tapping the fiber, and adopt a countermeasure strategy. One way to accomplish this is to monitor the channel performance parameters for changes in real-time. In this paper, we analyze key performance parameters of the optical signal, we describe how these parameters impact the channel performance. In addition, we develop a method to estimate in real-time the bit error rate and signal to noise ratio, and how these can be used to detect fiber intrusion. Finally, we develop a countermeasure protocol that we believe outsmarts the eavesdropper.