System and Method for Establishing Secure Communications Between Transceivers in Undersea Optical Communication Systems

• US 20120263476A1
• Filed: 04/13/2011
• Published: 10/18/2012
• Est. Priority Date: 04/13/2011
• Status: Active Grant

• Current Assignee: SubCom, LLC
• Original Assignee: Tyco Electronics Subsea Communications LLC (TE Connectivity Limited)
• Inventors: Sabet, Sameh A., Liss, Jonathan M.
• Granted Patent: US 8,750,707 B2
• Time in Patent Office: Days
• US Class Current: 398/104
• CPC Class Codes: H04B 10/85 Protection from unauthorised access, e.g. eavesdrop protection
• CPC Class Codes: H04J 14/02 Wavelength-division multiplex systems
• CPC Class Codes: H04J 14/021 Reconfigurable arrangements, e.g. reconfigurable optical add/drop multiplexers [ROADM] or tunable optical add/drop multiplexers [TOADM]
• CPC Class Codes: H04J 14/0212 using optical switches or wavelength selective switches [WSS]
• CPC Class Codes: H04J 14/0273 using optical overhead, e.g. overhead processing
• CPC Class Codes: H04J 14/028 WDM bus architectures
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

In general, a system and method provides secure communications between optical transceivers in an optical communication system. Two or more optical transceivers may be provisioned with one or more passcodes assigned to the transceivers, which may be used to indicate that received data traffic is intended for the transceivers. The transceivers may be configured to format data traffic with a secure version of the passcode in the overhead of the outbound signal and may be configured to determine if an inbound signal includes a secure version of the passcode provisioned in that transceiver. A transceiver may prevent data traffic from being read when the transceiver is not provisioned to receive data traffic with the embedded secure passcode and may insert an alternative maintenance signal (AMS) into an outbound signal in an opposite direction, at least temporarily, until the inbound signal includes the appropriate passcode.

Claims

1. A method for secure communications between optical transceivers in an optical communication system, the method comprising:

formatting data traffic as a plurality of frames in a first optical transceiver, wherein overhead of at least one of the frames includes a secure passcode;

transmitting at least a first optical signal including the data traffic formatted as the plurality of frames from the first optical transceiver;

receiving the first optical signal at a second optical transceiver; and

determining if the second optical transceiver is provisioned to receive data traffic including the secure passcode, and if the second optical transceiver is not provisioned to receive data traffic including the secure passcode, preventing the data traffic from being read from the second optical transceiver at least temporarily.

2. The method of claim 1 further comprising:

transmitting at least a second optical signal from the second optical transceiver; and

receiving the second optical signal at the first optical transceiver.

3. The method of claim 2 wherein, if the second optical transceiver is provisioned to receive data traffic including the secure passcode, the second optical signal includes data traffic.

4. The method of claim 2 wherein, if the second optical transceiver is not provisioned to receive data traffic including the secure passcode, the second optical signal includes an alternative maintenance signal.

5. The method of claim 2 further comprising:

formatting data traffic as a plurality of frames in the second optical transceiver, wherein the second optical signal includes the data traffic formatted as the plurality of frames; and

provisionally causing the second optical signal to include an alternative maintenance signal instead of the data traffic when the second optical transceiver is not provisioned to receive the data traffic including the secure passcode in the first optical signal.

6. The method of claim 2 wherein the second optical signal includes data traffic formatted as a plurality of frames, and wherein the second optical transceiver is configured to include a secure passcode in overhead of at least one of the frames, and further comprising:

determining if the first optical transceiver is provisioned to receive data traffic including the secure passcode, and if the first optical transceiver is not provisioned to receive data traffic including the secure passcode, preventing the data traffic from being read from the first optical transceiver at least temporarily.

7. The method of claim 1 wherein the optical communication system includes an undersea branched optical network, and wherein the first optical signal is transmitted onto an optical path in the undersea branched optical network.

8. The method of claim 7 wherein the first optical signal is redirected to the second optical transceiver by a branching unit in the branched optical network in response to detecting fault in at least a portion of the undersea branched optical network.

9. The method of claim 1 wherein the optical communication system includes a point-to-point undersea optical communication system, and wherein the first optical signal is transmitted onto an optical path in the point-to-point undersea optical communication system.

10. The method of claim 1 wherein the secure passcode includes a hash code obtained by applying a hash function to a passcode assigned to the first optical transceiver.

11. A method for securely receiving data traffic in an undersea optical communication system, the method comprising:

receiving an inbound optical signal at an optical receiver, the inbound optical signal including data traffic formatted as a plurality of frames, wherein overhead of at least one of the frames includes a secure passcode; and

determining if the optical receiver is provisioned to receive data traffic including the secure passcode, and if the optical transceiver is not provisioned to receive data traffic including the secure passcode, preventing the data traffic from being read from the optical receiver at least temporarily.

12. The method of claim 11 further comprising:

transmitting an outbound optical signal from an optical transmitter associated with the optical receiver.

13. The method of claim 12 further comprising:

formatting data traffic as a plurality of frames in the optical transmitter, wherein the outbound optical signal includes the data traffic formatted as the plurality of frames; and

provisionally causing the outbound optical signal to include an alternative maintenance signal instead of the data traffic when the optical receiver is not provisioned to receive the data traffic including the secure passcode in the inbound optical signal.

14. The method of claim 13 wherein the optical transmitter is configured to include a secure passcode in overhead of at least one of the frames of the data traffic or the alternative maintenance signal.

15. The method of claim 12 wherein, if the optical receiver is provisioned to receive data traffic including the secure passcode, the outbound optical signal from the optical transmitter includes data traffic.

16. The method of claim 12 wherein, if the optical receiver is not provisioned to receive data traffic including the secure passcode, the outbound optical signal from the optical transmitter includes an alternative maintenance signal.

17. The method of claim 12 wherein the outbound optical signal includes data traffic formatted as a plurality of frames, and wherein the optical transmitter is provisioned to include a secure passcode in overhead of at least one of the frames.

18. An optical communication system comprising:

at least a first optical transceiver configured to format data traffic as a plurality of frames, to include a secure passcode in overhead of at least one of the frames, and to transmit at least a first optical signal including the data traffic formatted as the plurality of frames from the first optical transceiver;

at least a second optical transceiver configured to receive the first optical signal and to determine if the second transceiver is provisioned to receive data traffic including the secure passcode, and if the second transceiver is not provisioned to receive data traffic including the secure passcode, to prevent the data traffic from being read from the second optical transceiver at least temporarily; and

an optical path coupling the first and second optical transceivers and configured to carry optical signals transmitted between the optical transceivers.

19. The optical communication system of claim 18 further comprising:

at least one branching unit coupled to the optical path between the first and second optical transceivers, wherein the branching unit is configured to direct the first optical signal from the first optical transceiver to the second optical transceiver.

20. The optical communication system of claim 19 wherein the branching unit is configured to direct the first optical signal from the first optical transceiver to the second optical transceiver in response to detecting a fault in at least a portion of the optical path.

21. The optical communication system of claim 18 wherein the optical transceivers include trans-oceanic optical transceivers in a point-to-point optical communication system.

22. An apparatus comprising:

an optical receiver configured to receive an inbound optical signal, the inbound optical signal including data traffic formatted as a plurality of frames, wherein overhead of at least one of the frames includes a secure passcode, and configured to determine if the optical receiver is provisioned to receive data traffic including the secure passcode, and if the optical receiver is not provisioned to receive data traffic including the secure passcode, to prevent the data traffic from being read from the optical receiver at least temporarily.

23. The apparatus of claim 22 further comprising:

an optical transmitter associated with the optical receiver, wherein the optical transmitter is configured to format data traffic as a plurality of frames, to include the secure passcode in overhead of at least one of the frames, and to transmit at least an optical signal including the data traffic formatted as the plurality of frames.

24. A method of establishing secure communications between optical transceivers in an optical communication system, the method comprising:

provisioning at least first and second optical transceivers with matching passcodes, wherein each of the first and second optical transceivers is configured to format data traffic as a plurality of frames, to include a secure version of the passcode in overhead of at least one of the frames, and to transmit at least an optical signal including the data traffic formatted as the plurality of frames, and wherein each of the first and second optical transceivers is configured to receive optical signals and to determine if the respective transceiver is provisioned to receive data traffic including a secure passcode in data frames in the received optical signals, and if the respective transceiver is not provisioned to receive data traffic including the secure passcode, to prevent the data traffic from being read at least temporarily; and

deploying the first and second optical transceivers in the undersea optical communications system.

25. The method of claim 24 wherein the undersea optical communications system is an undersea branched optical network.