SECURITY MONITORING FOR OPTICAL NETWORK

• US 20150135319A1
• Filed: 06/11/2012
• Published: 05/14/2015
• Est. Priority Date: 06/11/2012
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Costantini, Matteo, Magri, Roberto
• Granted Patent: US 9,553,881 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04B 10/85 Protection from unauthorised access, e.g. eavesdrop protection
• CPC Class Codes: H04J 14/0204 Broadcast and select arrangements, e.g. with an optical splitter at the input before adding or dropping
• CPC Class Codes: H04J 14/0209 Multi-stage arrangements, e.g. by cascading multiplexers or demultiplexers
• CPC Class Codes: H04J 14/0212 using optical switches or wavelength selective switches [WSS]
• CPC Class Codes: H04J 14/0227 Operation, administration, maintenance or provisioning [OAMP] of WDM networks, e.g. media access, routing or wavelength allocation
• CPC Class Codes: H04J 14/04 Mode multiplex systems
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04Q 11/0062 Network aspects
• CPC Class Codes: H04Q 2011/0079 Operation or maintenance aspects
• CPC Class Codes: H04Q 2011/0083 Testing; Monitoring

Abstract

Apparatus for an optical communications network has optical paths for optical traffic, and optical ports, one of which is an unused output port. A security monitoring system has a blocking part coupled removably to the unused output port to occupy it to prevent unauthorised access. An optical detector can detect optical signals passing through the unused output port to the blocking part, and there is alarm circuitry configured to output an alarm signal based on the detecting of the optical signals. This monitoring can help make the node more secure from interference or from eavesdropping. By blocking the port, the monitoring can be independent of the type of signals on the optical paths. The system can be passive or active, and does not require a change in the installed node configuration and so can be added easily to existing infrastructure.

Claims

1. An apparatus for an optical communications network, the apparatus comprising:

at least two optical paths for optical traffic to or from other nodes, the optical paths having respective optical ports, wherein at least one of the optical ports is configured as an unused output port, available for future use for optical traffic, and

a security monitoring system for detecting unauthorised access, the system comprising;

a blocking part coupled removably to the unused output port to occupy the unused output port so as to exclude any other part from using the unused output port to gain unauthorised access to the optical path of the unused output port;

an optical detector coupled to the blocking part and configured to detect optical signals passing through the unused output port; and

alarm circuitry configured to output an alarm signal indicative that the unused output port has been accessed based on the detecting of the optical signals by the optical detector.

2. The apparatus of claim 1, wherein the alarm circuitry is configured to output the alarm signal if a break in the optical signals is sensed.

3. The apparatus of claim 1, comprising at least one of an optical splitter having an output coupled to the unused output port, and a wavelength demultiplexer having an output coupled to the unused output port.

4. The apparatus of claim 1, wherein:

the at least one unused output port comprises an optical connector, and

the blocking part has a corresponding connector suitable to mate with the optical connector to couple the optical path of the unused output port with the optical detector.

5. The apparatus of claim 1, wherein the monitoring system has a communications part for sending the alarm signal to a network management part of the network.

6. The apparatus of claim 1, wherein the alarm circuitry has a latching circuit configured to maintain a persistent indication of a temporary detection of tampering, and a reset circuit for resetting the latching circuit according to an external signal.

7. A security monitoring system for coupling to an unused output port of an optical path of apparatus of an optical network, the apparatus having at least two optical paths for optical traffic to or from other nodes, the optical paths having respective optical ports, wherein at least one of the optical ports is configured as an unused output port, available for future use for optical traffic, the security monitoring system being for detecting unauthorised access and comprising:

a blocking part for coupling with the unused output port so as to occupy the unused output port;

an optical detector coupled to the blocking part and configured to detect optical signals passing through the unused output port; and

alarm circuitry configured to output an alarm signal indicative that the unused output port has been accessed, based on the detecting of the optical signals by the optical detector.

8. The security monitoring system of claim 7, wherein the alarm circuitry is configured to output the alarm signal if a break in the optical signals is sensed.

9. The security monitoring system of claim 7, comprising a communications part for sending the alarm signal to a network management part of the network.

10. The security monitoring system of claim 7, wherein the alarm circuitry has a latching circuit configured to maintain a persistent indication of a temporary detection of tampering, and a reset circuit for resetting the latching circuit according to an external signal.

11. The security monitoring system of claim 7, comprising two or more blocking parts, for two or more respective unused output ports and wherein the alarm circuitry is configured to output an alarm signal indicating which of the two or more unused output ports has been accessed.

12. The security monitoring system of claim 7, comprising two or more blocking parts, for two or more respective unused output ports and wherein the alarm circuitry is configured to combine outputs of the optical detectors to output a common alarm signal if access to any of the two or more unused output ports is detected.

13. A method of monitoring security of an optical path to detect unauthorised access to the optical path in an apparatus of an optical network, the apparatus having at least two optical paths for optical traffic to or from other nodes, the optical paths having respective optical ports, wherein at least one of the optical ports is configured as an unused output port, available for future use for optical traffic, the method comprising:

blocking the at least one unused output port so as to exclude any other part from using the unused output port to gain unauthorised access to the optical path of the unused port;

detecting optical signals on the optical path of the unused output port; and

outputting an alarm signal indicating whether access has occurred based on the detecting of the optical signals by the optical detector.

14. The method of claim 13 comprising:

sensing if a break in the optical signals is detected, and outputting the alarm signal according to the sensing.

15. The method of claim 13, comprising:

sending the alarm signal to a network management part of the network.

16. A method of installing a security monitoring system to upgrade apparatus of an optical communications network, the apparatus having at least two optical paths for optical traffic to or from other parts of the network, and having two or more optical ports, wherein at least one of the optical ports is configured as an unused output port, available for future use for optical traffic, and the security monitoring system is for detecting unauthorised access and has a blocking part suitable to couple removably to the at least one unused output port to occupy the unused output port so as to exclude any other part from using the unused output port to gain unauthorised access to the optical path of the unused output port, an optical detector coupled to the blocking part and configured to detect optical signals passing through the unused output port, and alarm circuitry configured to output an alarm signal indicative that the unused output port has been accessed based on the detecting of the optical signals by the optical detector, the method of installing the security monitoring system comprising:

coupling the blocking part of the security monitoring system to the unused output port; and

providing a communication path for the circuitry of the security monitoring system to communicate the indication to a network management system of the network.