Key synchronization for end-to-end ODU service encryption

  • Giouroukos P.

Operators consider the optical transport network secure since there is no direct access to the data-plane. However, Wikileaks and Snowden disclosures have proven this assumption wrong. Customers demand data encryption e.g. when interconnecting data centers. One possible solution is to take security measures at the gateway adding costs. Another solution is to encrypt data on OTU/ODU layer, which could raise interworking issues since such solutions might use reserved overhead bytes. However, the ODU path layer allows to setup secure communication channels end-to-end even across operators boundaries. While the optical transport network is standardized neither methods for key ex-change, nor overhead for key transport have been defined. In this paper a standards compliant solution will be presented to overcome these issues. A protocol running between the edge nodes of the optical transport network has been defined, capable to support various key distribution mechanisms (e.g. Diffie-Hellman, PKI) in order to exchange a session key used to encrypt and authenticate the communication between the involved edge nodes. This is a precondition to exchange the keys needed by the ODU encryption engine to encrypt the data stream on the ODU layer. The protocol also supports re-keying, periodically or on request. Essential characteristic of the protocol is the support for a hitless key exchange mechanism of the ODU encryption engine. Traffic interruption caused by protection switching or service preemption is considered by the protocol and adequate measures are implemented.

View Original Article

Recent Publications

August 09, 2017

A Cloud Native Approach to 5G Network Slicing

  • Francini A.
  • Miller R.
  • Sharma S.

5G networks will have to support a set of very diverse and often extreme requirements. Network slicing offers an effective way to unlock the full potential of 5G networks and meet those requirements on a shared network infrastructure. This paper presents a cloud native approach to network slicing. The cloud ...

August 01, 2017

Modeling and simulation of RSOA with a dual-electrode configuration

  • De Valicourt G.
  • Liu Z.
  • Violas M.
  • Wang H.
  • Wu Q.

Based on the physical model of a bulk reflective semiconductor optical amplifier (RSOA) used as a modulator in radio over fiber (RoF) links, the distributions of carrier density, signal photon density, and amplified spontaneous emission photon density are demonstrated. One of limits in the use of RSOA is the lower ...

July 12, 2017

PrivApprox: Privacy-Preserving Stream Analytics

  • Chen R.
  • Christof Fetzer
  • Le D.
  • Martin Beck
  • Pramod Bhatotia
  • Thorsten Strufe

How to preserve users' privacy while supporting high-utility analytics for low-latency stream processing? To answer this question: we describe the design, implementation and evaluation of PRIVAPPROX, a data analytics system for privacy-preserving stream processing. PRIVAPPROX provides three properties: (i) Privacy: zero-knowledge privacy (ezk) guarantees for users, a privacy bound tighter ...