Network security has traditionally been limited to network access and network administration, whereas data security is left to end clients where text is encrypted and decrypted. In the last decade, there has been a rapid increase in bandwidth demand mainly due to the explosion of the Internet and mobile telephony. The explosive bandwidth has been comfortably met with optical networks having many optical channels multiplexed in the same fiber, known as wavelength division multiplexing,. Data rate exceeding 1 Tbps within a fiber implies that there are tributaries that carry sensitive and proprietary data. Although data are encrypted by the end client, there is no assurance that, if captured by an eavesdropper, they may not be decrypted. Therefore, three new requirements emerge; monitor the optical link integrity, detect if an optical channel is compromised by tapping the fiber, and adopt a countermeasure strategy. One way to accomplish this is to monitor the channel performance parameters for changes in real-time. In this paper, we analyze key performance parameters of the optical signal, we describe how these parameters impact the channel performance. In addition, we develop a method to estimate in real-time the bit error rate and signal to noise ratio, and how these can be used to detect fiber intrusion. Finally, we develop a countermeasure protocol that we believe outsmarts the eavesdropper.
Network security has traditionally been limited to network access and network administration, whereas data security is left to end clients where text is encrypted and decrypted. In the last decade, there has been a rapid increase in bandwidth demand mainly due to the explosion of the Internet and mobile telephony. The explosive bandwidth has been comfortably met with optical networks having many optical channels multiplexed in the same fiber, known as wavelength division multiplexing,. Data rate exceeding 1 Tbps within a fiber implies that there are tributaries that carry sensitive and proprietary data. Although data are encrypted by the end client, there is no assurance that, if captured by an eavesdropper, they may not be decrypted. Therefore, three new requirements emerge; monitor the optical link integrity, detect if an optical channel is compromised by tapping the fiber, and adopt a countermeasure strategy. One way to accomplish this is to monitor the channel performance parameters for changes in real-time. In this paper, we analyze key performance parameters of the optical signal, we describe how these parameters impact the channel performance. In addition, we develop a method to estimate in real-time the bit error rate and signal to noise ratio, and how these can be used to detect fiber intrusion. Finally, we develop a countermeasure protocol that we believe outsmarts the eavesdropper.
Network security concerns have recently been increased due to the vast amount of information that flows in a single fiber. At the application layer, data security relies on end-user encryption algorithms, many of which are known to be vulnerable, and authentication algorithms are not foolproof as the sophistication of eavesdroppers and unauthorized bad actors increases. As a result, the communications link may be attacked by eavesdroppers to access data, to mimic the source, or to cause service denial. To accomplish this however, the transmission link must be compromised. Therefore, if an a priori link and channel signature has been established at the receiver, then an unauthorized intervention is possible to be detected, reported and counteracted. In this paper we provide an analysis of the link and channel parameters that affect the signal performance, which also constitute the identification signature of the optical channel. When the medium is compromised, the channel parameters are affected and thus the channel performance. We also develop a model and we simulate conditions of channel attack
Security in optical communications has been recently a concern due primarily of the vast amount and the sensitivity of information that a single fiber carries. It is generally accepted that data security is encrypted by the end-user and that the optical network is not easy to tap as it was with wired networks. However, the sophistication of eavesdroppers has increased and if an optical link is accessed, then the encryption code of data can be broken with the use of supercomputers. In addition to data eavesdropping, eavesdroppers may access the link for malicious attacks, or for transmitting erroneous data by mimicking a source. Therefore, it is important that the receiver has the means and intelligence to recognize the signature of the source and the optical channel so that when the link is tapped, the receiver recognizes it and it alerts the network management or it triggers a data rerouting process. In fact, an optical channel, including source, fiber and optical components, has its own optical parameters that constitute a signature. These parameters are the result of linear and non-linear phenomena that affect the quality characteristics of the optical signal and which can not be mimicked. Therefore, the understanding of optical parameters that define the optical channel signature is very critical. In this paper we provide an analysis of the factors affecting the signal quality and thus they constitute the signature of the optical channel, we model the optical channel and demonstrate via simulations that small parametric variation affect the signature of the channel. As a result, monitoring the signal parameters leads to source and channel authentication whereas detecting the parametric variability of channel deducts channel degradation or tapping.
Wavelength Division Multiplexing (WDM) is a photonic technology capable to transport over a single fiber more than a Tbit/s aggregate traffic. Currently, WDM is the only deployed method in transcontinental and transoceanic applications. In the optical network, each fiber link consists of segments, each several kilometers long, the connecting points of which are amenable to tapping. When a small amount of optical signal is extracted from a tap, when the signal is properly amplified it can be monitored by unauthorized personnel thus threatening communications and land-security. Since each WDM channel carries traffic from one customer, it is not difficult for the connoisseur to demultiplex a specific channel, isolate a specific payload and break the encrypted datagram. Therefore, in addition to data encryption, high-speed communications security should also rely on securing the optical links. In this paper, we present a WDM link security method that, even if fiber is tapped, constitutes channel monitoring and information decrypting by an eavesdropper or unauthorized personnel virtually impossible. In addition, we describe the circuit building blocks behind the method that makes eavesdropping impossible.
Optical communication networks transport an enormous aggregate client traffic, a good part of which is highly sensitive. As such, the optical signal in the fiber medium becomes attractive to bad actors in an attempt to tap the fiber or a component on the path in order to eavesdrop, source mimic, or attack to cause service denial. Therefore, it is important that the network has built-in security features to monitor the channel integrity and to also detect if and when unauthorized intervention has taken place. It is also important that the network is intelligent to countermeasure bad actors. Because the integrity of optical channels in are also affected by component degradation, photon-matter interactions and other non-linear phenomena, the network should be able to differentiate between malicious interventions and parametric degradations. In this paper we identify observable performance parameters and predictors, we describe a estimating method for in-line parameter monitoring, we conclusively distinguish between component degradations and intervention of a malicious eavesdropper and we describe countermeasure mechanisms.
Optical communication networks transport an enormous aggregate client traffic, a good part of which is highly sensitive. As such, the optical signal in the fiber medium becomes attractive to bad actors in an attempt to tap the fiber or a component on the path in order to eavesdrop, source mimic, or attack to cause service denial. Therefore, it is important that the network has built-in security features to monitor the channel integrity and to also detect if and when unauthorized intervention has taken place. It is also important that the network is intelligent to countermeasure bad actors. Because the integrity of optical channels in are also affected by component degradation, photon-matter interactions and other non-linear phenomena, the network should be able to differentiate between malicious interventions and parametric degradations. In this paper we identify observable performance parameters and predictors, we describe a estimating method for in-line parameter monitoring, we conclusively distinguish between component degradations and intervention of a malicious eavesdropper and we describe countermeasure mechanisms.
In telecommunication networks and in computer grid networks, a significant ongoing research is in a technology known as wavelength division multiplexing (WDM), which is capable to transport more than 1 Tbps aggregate traffic over a single fiber. However, when massive amounts of information are transported, as in optical networks, there are three issues that stand, cost-efficient ultra-high bandwidth delivery, security of information and data, and security of the network and of the transporting link layer. In optical networks, each fiber link consists of segments, each several kilometers long. Since a single WDM channel carries traffic, there are opportunities for sophisticated eavesdroppers to tap the fiber, copy a channel, isolate a specific payload and attempt to decrypt it if the encryption key is known or it is breakable with a fast computer. Therefore, end-to-end data security should not only rely on the client's encryption method but also on securing the transmission method on the optical link. In this paper, we present a WDM link security methodology that encrypts multiple channels and with multiple keys to render channel monitoring by eavesdroppers virtually impossible. Although our paper presents the applicability of the method on a point-to-point topology, it is applicable to a multilink and edge-to-edge network path.