The switch back mode, from secondary to primary path, is configurable and can be set to automatic or manual. 4.3 Optical Time Domain Reflectometer (OTDR).
Fiber Optic Network Reliability & Security for NRENs: The Threat and Potential Solutions Brian SAVORY Optelian, 1700 Enterprise Way SE, Marietta, GA 30067-9219, USA Tel: + 001 404 512 9907, Fax: + 001 770 690 9506, Email: brian.savory@optelian.com Abstract As National Research and Education Networks (NRENs) begin to deploy their own fibre networks, network and data reliability and security are important considerations. Whether a network is comprised buried or aerial fibre, damage to fibre plant can wreak havoc to a network. Tapping a fibre-optic cable without being detected, and making sense of the information collected, is not trivial but has certainly been done by intelligence agencies, in the past. Today, it is well within the range of a well-funded hacker. Carriers have a multitude of experience with fibre network outages that the research & education community can learn from. With respect to data security, some enterprises are considering using encryption over all network connections where the physical security of access to the network cannot be guaranteed.This paper examines different levels of network protection and data encryption to meet different organizational requirements and budgets. Obligatory Abstract Elements: Purpose By writing this paper, I hope to provide emerging NRENs with information on how to implement a private fiber network that is both reliable and secure. evaluate business case parameters and practical experience findings involved in making a decision on migrating from using carrier based bandwidth services to building, operating and maintaining a private fiber network. Design I plan to provide information that has been collected from personal research and developed from personal professional experience as well as data gathered from being part of the research and education community for over ten years, both as a member and as a vendor serving the community. Findings It is my intention to provide emerging NRENs with a beginner's cookbook for developing a reliable and secure private fiber network for research and education. Value This paper should provide emerging NRENs with a "lessons learned" document to refer to when implementing a private fiber network. Keywords Fiber Optic Network Reliability, Network Security Page 62 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68 1. Background 1.1 Causes of Fibre Cuts (Lawler, 2011) The most common cause of fibre cuts come from construction companies and excavators that don't call before they dig. Squirrel chews accounted for a whopping 17% Level 3's damages of so far this year. That it is down from 28% just last year and it continues to decrease since they added cable guards to their plant. The next biggest offender would have to be Mother Nature and her extreme weather conditionshurricanes, mud slides and ice storms. Vehicle damage such as cars running into telephone poles and truckers underestimating the height of their rigs is another cause of fibre damage. Phone cables and electrical cables on the same pole can contribute to a fibre outage. A dust storm blew down a pole; stress on the cable pulled down more poles, until 19 poles were lying on the ground. Vandalism accounts for 7% of Level 3's annual outages. People using fibre cable for gun practice. A small plane overshot the runway and clipped a pole that fibre was attached. Ice storm caused limbs fall onto the electric utility primary power which crossed into the communications space.The cable caught on fire in multiple places while suspended in the air and surrounded by ice covered limbs During the clean-up efforts after hurricane Katrina, one of Level 3's field managers was about 2 miles inland when he spotted a three foot long shark in one of the trenches beside their fibre. A landowner unhappy over a right-of-way dispute dug a 2 ft. by 10 ft. trench and cut the fibre and ducts; when field techs got on scene, the landowner was waiting on them with his 12 gauge shotgun. 1.2 Fibre Optic Network Data Vulnerability(Miller, 2007)( Miller, 2006 ) Despite fibre optic networks' reputation for being more secure than standard wiring or airwaves, the truth is that fibre cabling is just as vulnerable to hackers as wired networks using easily obtained commercial hardware and software. In 2000, three main trunk lines of Deutsche Telekom were breached at Frankfurt Airport in Germany. In 2003, an illegal eavesdropping device was discovered hooked into Verizon's optical network; it was believed someone was trying to access the quarterly statement of a mutual fund company prior to its release--information that could have been worth millions. International Page 63 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68 incidents include optical taps found on police networks in the Netherlands and Germany, and on the networks of pharmaceutical giants in the U.K. and France. Those high-profile fibre intrusions offered few details. For the most part, these hacks often go unreported as well as undetected. Tapping into fibre optic cables originally fell into the realm of national intelligence. Take the 2005 christening of the USS Jimmy Carter, a $3.2 billion Seawolf-class submarine specifically retrofitted to conduct "signal intelligence"--military-speak for monitoring communications by tapping into undersea cables. In 2003, John Pescatore, Gartner Vice President, distinguished analyst and a former NSA-trained U.S. Secret Service security engineer, said that while fibre optic cable hacking had been taking place for nearly a decade, avoiding detection and processing the stolen data was much more difficult. Things have changed. "We've seen large increases in the use of encryption over all network paths, including fibre optics--and encryption defeats eavesdropping" said John Pescatore, Vice President, Gartner Inc. The required equipment has become relatively inexpensive and commonplace and an experienced hacker can easily pull off a successful attack. "You can jump on the Internet right now and buy a tap for about $900," says Andy Solterbeck, General Manager of the Data Protection Business Unit at SafeNet, an encryption company that has been experimenting with hacking fibre optic cables. "We've done this in our labs. We've demonstrated this at Interop. We've shown people that this kind of threat exists." 2. Acquiring / owning dark fiber4 A dark fiber network is a privately owned and operated optical fiber network that is run directly by its operator over dark fiber leased or purchased from another supplier, rather than by purchasing bandwidth or leased line capacity from a carrier, thereby avoiding outages caused by carrier circuit grooming Dark fiber networks may be used for private wide-area networking infrastructure or as Internet access infrastructure. Dark fiber networks may be point-to-point, point-to-multipoint, or use self-healing ring or mesh topologies. Because there is no resale of capacity, dark fiber networks can operate using the latest optical protocols using wavelength division multiplexing to add capacity where needed and to provide an upgrade path between technologies without removing the network from service. Many dark fiber metropolitan area or regional networks use relatively inexpensive Gigabit Ethernet equipment over WDM, rather than expensive SONET ring systems. Page 64 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68 Dark fiber networks offer very high price-performance for network users who require high bandwidth for research collaboration, video, wireless or wish to operate their own network for security reasons. 3. Physical layer protection 3.1 Fiber network design The ideal network design features multiple fiber-optic providers connected via dual-entry with self-healing optical network architecture. This redundant connectivity ensures network resiliency. Aerial fibre vs. underground fibre(Markoff, J, 2010) When looking at physical security of fibre optic telecommunications backbones, whether it is contractor errors, animals, vandalism or natural disasters both aerial and underground fibre topologies are subject to outages. It is a common misconception when considering fiber backbone security that underground fiber is more secure than aerial. After all, underground fiber is covered by dirt, asphalt or concrete. In contrast, aerial cable, being suspended in the air, seems an easy target for a weapon, an auto accident or fallen tree limb. However, aerial and underground installations are subject to fiber outages. Yet aerial installations are lower cost and easily allow for alternate cable routes. The security strategy to minimize the disruption is to reroute data from damaged or destroyed fibre optic cables to other fibre optic cables so that networks that remain intact. According to most estimates, aerial construction is as much as 40 to 50 percent less expensive than the underground alternative. The optimal strategy for building a fibre network is the have a hybrid strategy that employs both aerial and underground fibre in order to provide a cost effective reliable fibre plant. 3.2 Diverse fibre routes A major factor in network reliability is to make sure the fibre backbone has redundant fibre routing available. 3.3 Dual fibre entry In order to ensure optimal network reliability and redundancy all buildings, data centres, wireless sites and telecom hubs should have dual entries into the telecom equipment facility. Page 65 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68 4. Monitoring of optical performance 4.1 Optical link monitor (OLM)6 An Optical Link Monitor (OLM) is used for rapid fault isolation, typically in wholesale mobilebackhaul or edgeless service applications, where network operators are not permitted to deploy active equipment at the remote facility, but must monitor the fibre to ensure connectivity and service level agreement adherence. An OLM non-intrusively monitors the quality of up to four fibre optic links. It measures and reports round-trip link loss on the link as well as transmit and receive power levels. It generates alarms when any of these measured values cross preset thresholds, pinpointing the location of a fault without manual intervention. An OLM used in conjunction with loopback module at the remote site is fully passive and temperature hardened. It can loopback up to three monitor signals and is installed in LGX-style mounting hardware. 4.2 Path protection module (PPM)(Carino, C, 2002?) A Path Protection Module (PPM) provides automatic switching between primary and secondary optical paths based on provisionable power thresholds. Optical 1+1 protection is provided by redundant primary and secondary transmit paths. In the receive direction, the optical power levels of the primary and secondary inputs are continuously monitored. The switch back mode, from secondary to primary path, is configurable and can be set to automatic or manual. 4.3 Optical Time Domain Reflectometer (OTDR) A single mode optical time domain reflectometer (OTDR) is a device that can be used for estimating a fiber's length and overall attenuation, including splice and mated-connector losses. It can also be used to locate faults, such as breaks, and to measure optical return loss. An OTDR can be a light weight, compact, hand-held unit that can save and transfer the measurement data to a PC It can also be an embedded OTDR solution as part of WDM system or an OTDR module as part of an optical node shelf. 5. Encryption of transmitted data 5.1 Encryption Primer The are several types of encryption and encryption standards. IP-based data method for protection - MACsec is the IEEE 802.1AE standard for authenticating and encrypting packets between two MACsec-capable devices. The Advanced Encryption Standards (AES) defined by the U.S. National Institute for Standards and Technology (NIST) are the current de facto standards for encryption in enterprise networks. AES-256, with a 256 bit key is most secure. 5.2 Encryption of Transmitted Data Page 66 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68 Data can be encrypted a layer-1, -2, or -3 by using external devices, encrypted pluggables or as part of a WDM system. 5.3 DWDM Transmission with Encryption Several WDM manufactures now offer encryption as an option on the client side inputs of optical transponders. 6. Conclusion With proper physical layer, optical network design and encryption, if required, a private fibre optic network can provide the same or a better level of reliability and security as carrier provided bandwidth. References Carino, Charles(2002?) "Fiber Backbone Security Underground vs. Aerial" Whitepaper Fiber Instrument Sales, Inc. Lawler, Fred (2011) "Beyond Bandwidth" - Level 3 Communications Blog, "The 10 Most Bizarre and Annoying Causes of Fiber Cuts" Markoff, John (2010). "Scientists Strive to Map the Shape-Shifting Net". The New York Times. Miller, Sandra Kay (2007) "Fiber optic network security a necessity" Searchsecurity.techtarget.com Miller, Sandra Kay (2006) "Fiber optic networks vulnerable to attack" Searchsecurity.techtarget.com Optelian Optical Link Monitor Product Bulletin 3014-1100 Rev-02 Optelian Path Protection Module Product Bulletin 3005-9600 Rev-02 Biography Brian Savory is a telecom professional with extensive experience in fibre based transport networks and wireless telecommunications. He has helped research and education (R&E) customers build, operate and maintain private fibre optic networks. Brian currently works for Optelian as Business Development Manager. Brian is actively involved with Internet2, the NREN consortium led by the US research and education community. He currently serves on the Internet2 Network Architecture, Operations and Policy Program Advisory Group (NAOPpag) as well as the Program Committee.Brian worked at Georgia Tech assisting in establishing Southern Light Rail, Inc. (SLR), the R&E regional optical network (RON) in the Southeast, US where he served as SLR's President and Executive Director. SLR operates the Internet 2 connector (SoX) in the Southeast. While at Georgia Tech, Brian facilitated the procurement, implementation and operation of the University of Alabama System RON which connects the University of Alabama campuses and NASA Page 67 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68 Marshall Space Flight Center campus to telecom POPs in Atlanta.One of Brian's most challenging professional projects was his involvement with IEEAF (Internet Educational Equal Access Foundation), USAID (United States Agency for International Development) and RENU (Research and Education Network of Uganda) on the NREN fibre network in Uganda. This project deployed the first phase of a fibre optic network from Entebbe to Kampala.Brian graduated from the Georgia Institute of Technology with a Bachelor of Electrical Engineering degree and earned his MBA from Georgia State University. Page 68 ISSN 2223-7062 Proceedings and report of the 5th UbuntuNet Alliance annual conference, 2012 pp 62-68pdfsam-console (Ver. 2.4.0e) iText 2.1.7 by 1T3XT