RU2301497C1 - Method for detecting access to optical signal during transmission along fiber-optic lines - Google Patents

Abstract

FIELD: method for detecting unsanctioned access to optical signal, methods for protecting information from leakage through optical channel in case of attempt of reading the optical signal from side surface of optical fiber, may be used as algorithm for software of protection system controller.

SUBSTANCE: invention features creation of at least two additional operation cycles, analogical to the first cycle, control values of which are the current deviations for next cycle, in case if current signal value exceeds threshold value in any cycle of operation, operation cycle is started anew, in second and following operation cycles the time set by timer is adjusted after operation starts.

EFFECT: increased probability of access attempt detection, lower probability of false alarm, increased observation time, decreased lag of protection system activation.

2 dwg

Description

A method for detecting access to an optical signal relates to means of protecting information from leakage through the optical channel in the event of an attempt to remove the optical signal from the side surface of the optical fiber and can be used as an algorithm for the protection system controller software.

There is a method of detecting a signal during unauthorized access to information during FOL transmission (RF Patent No. 2251810. “Method for detecting the slow output of optical radiation through the side surface of a fiber-optic communication line” dated January 20, 2003, published BI No. 13 of May 10, 2005 g.).

The method consists in the fact that simultaneously with the periodic comparison of the control signal with the previous value (one or more), the algebraic sum of the deviations of the same signal from the control level, obtained by processing a large number of previous samples and set for a long time, is calculated. With a slow power take-off of the optical signal through the lateral surface, the sum value will be negative and increase all the time with each count. Ultimately, the amount reaches the set value corresponding to the alarm. Slow operational changes in the parameters are random and alternating in nature, therefore, in this case, the amount will fluctuate around zero and will not be able to reach the set value. By establishing a new benchmark, the amount is reset. Thus, very slow parameter degradation due to aging of the components of the fiber optic transmission system is taken into account.

The disadvantages of the proposed method are:

1) limiting the maximum observation time to the period for which the control level is set;

2) the high inertia of the reaction of the protection system to an attempt to output an optical signal, which is due to the long time to calculate the sum;

3) a high probability of a false response of the protection system in the relaxation mode (after turning on the power), since at this time a rapid change in the value of the control signal occurs due to a change in the thermal conditions of the components of the fiber-optic system;

4) a low probability of detecting access attempts if the output of the optical signal begins before changing the control level.

The technical problem to be solved is the creation of a method with an increased probability of detecting access attempts.

The technical result is to reduce the likelihood of a false positive, increase the monitoring time and reduce the inertia of the response of the protection system.

This technical result is achieved by the method of detecting access to an optical signal transmitted via a fiber optic line, which consists in receiving optical signals from the line, detecting, amplifying, integrating and analog-to-digital converting the obtained analog electrical signals, comparing the current signal value in digital form with the control value of the signal, which is the previous value of the signal and the formation of the first cycle of work, consisting of summing the deviations of the current values of the signal l from the control value, taking into account the sign for the time specified by the timer, and storing the total deviation value in the memory, comparing the current total deviation value for the period specified by the timer with the recorded "total deviation value, which is the previous total deviation value or reference signal, forming alarm in the event that the difference between the current value of the signal in digital form and the control value of the signal exceeds the set value in absolute value or in the case of a decrease in the current total value of the signal deviation relative to the reference deviation value by an amount greater than the threshold value, moreover, the threshold signal value at predetermined time intervals is adjusted taking into account changes in the current signal value. The formation of an additional at least two work cycles similar to the first cycle, the control values of which are the current deviations for the next cycle, is new if the current signal value of the threshold value is exceeded in any work cycle, the work cycle starts again, in the second and subsequent work cycles the time set by the timer is adjusted after the start of operation.

Figure 1 presents a diagram of an algorithm for detecting an access signal:

1 - amplitude discriminator;

2 - time discriminator;

3 - an adder of instantaneous values;

4 - a divider of the sum of input signals;

5 - clock generator;

6 - adder;

7 - the sum divider is cyclic;

8 - random access memory;

9 - subtractor;

10 is a device for comparing amplitudes;

11 - adder;

12 is a device for comparing amounts;

13 - control comparison device;

14 - light indicator;

15 - alarm adder;

16 - counter of the second cycle;

17 - counter of the last cycle.

Figure 2 presents the timing diagrams of one of the cycles. Designations on a figure:

y (t) is the input analog signal;

Δt is the control time;

T is the duration of the cycle (observation time);

li is the cycle number;

Ao is the threshold that determines the start of calculating the sum of deviations;

y1 (t), y2 (t) - input signals with access signals of various amplitudes and durations;

Фn - ALARM signal generation threshold for a given cycle.

The inventive method is implemented by a device, a functional diagram of which is shown in figure 1. The circuit consists of three and / or more identical, access signal allocation cycles entering one into another, and an initial training cycle. The initial training cycle forms the initial input signal and the duration of the second and subsequent cycles at the initial stage of work. The scheme works as follows.

The input analog signal y (t) is converted into digital signals using an amplitude discriminator 1 and a time discriminator 2 in accordance with the requirements of the Kotelnikov theorem. The sampling frequency is set by the clock 5. The resulting digital signal Y _{j is} fed to the input of the adder instantaneous values 3, which produces a sequential summation of samples. After adding J samples and dividing the resulting amount by J using the input signal divider 4, we obtain the average sample value Y _k , which is a digital signal of the protection system. All of the above operations are preparatory and are intended to eliminate the influence of impulse noise. The execution time of these operations determines the inertia of the reaction of the protection system to violation and the control time.

The first calculation cycle is as follows. Initially, the deviation from the average sample value is calculated. To do this, K samples are summed using the adder 6, after which a divisor 7 by K divides the sum of samples Y _k . Thus, the average sample value Y _i for the time period of the first cycle is calculated. The resulting value is stored in RAM 8 and is deducted from the current values of Y _k during the next period of time of the first cycle.

Subtraction is carried out by the subtractor 9. The obtained deviation ΔY _k goes to the indicator light 14 and is compared with the maximum permissible deviation A _m using the comparison device 13. If the maximum permissible deviation is exceeded, the ALARM signal is generated, which goes to the alarm adder 15. If ΔY deviation _to less than the maximum permissible deviation, but greater than the threshold value A _o, the amplitude comparing device 10 generates a control signal which enables calculation of the sum of deviations in the cycle time for the adder 11. When this change is prohibited values Y _i. Thus, the beginning of the cycle and, accordingly, the observation time are always at the beginning of the access signal.

In the calculation process, at monitoring intervals, the comparator 12 compares the sum Ф _к with the set threshold value Ф _n . In the case when Ф _к exceeds Ф _n , an ALARM signal is generated, which is fed to the alarm adder 15.

The initial signal for the next step is the average sample value calculated in the previous cycle. The second and subsequent cycles work similarly. Accordingly, the observation time of each subsequent cycle is increased in comparison with the previous one. All highlighted ALARMS are sent to the alarm totalizer.

To reduce the likelihood of false positives after turning on the power, the algorithm works with shortened cycles of the second and subsequent stages. To do this, with the help of counters 16 and 17, a smooth increase in the number of averagings is made in the corresponding cycles (K 'and K "values).

Thus, the algorithm allows you to detect access signals with a duration from zero to a time equal to the duration of the last cycle if the signal reaches the set threshold value. The response time to the access signal of large amplitude is equal to the control time for each stage.

Figure 2 presents the timing diagrams of one of the cycles. The inertia of the response to the violation will depend on the length of the observation time, the slew rate and the amplitude of the access signal. The observation time for the first cycle can be chosen so that the inertia of the reaction to violations does not exceed a predetermined value.

To test the developed protection method, an algorithm was implemented according to the proposed functional scheme for three cycles.

The method is implemented as a program of the PIC16C717 microcontroller under the name "Security information fiber optical communication - SIFOCXX.

Tests of the program as an integrated information security tool for FOBOS series transceivers confirmed the correctness of the calculated parameters: response inertia of 0.165 s, maximum observation time of 12 hours, average time between false responses of at least 10 ⁴ hours, the probability of detecting an access signal of maximum stealth not less than 0.99, which is confirmed by calculations and test results.

Claims (1)

A method for detecting access to an optical signal transmitted via a fiber optic line, which consists in receiving optical signals from a line, detecting, amplifying, integrating and analog-to-digital converting the received analog electrical signals, comparing the current signal value in digital form with a control signal value, which is the previous value of the signal and the formation of the first cycle of work, consisting of summing the deviations of the current signal values from the control value, taking into account the sign during the time specified by the timer and storing the total value of the deviations in the storage device, comparing the current total value of the deviations for the period specified by the timer with the recorded total value of the deviations, which is the previous total value of the deviations or the reference signal, the formation of an alarm if the difference is the current value signal in digital form and the control value of the signal exceeded the specified value in absolute value or in the case of a decrease in the current total the signal deviation values relative to the deviation reference value are greater than the threshold value, and the signal threshold value is adjusted at predetermined time intervals taking into account changes in the current signal value, characterized in that at least two operation cycles similar to the first cycle are additionally generated, control values which are the current deviations for the next cycle, in case the current value of the threshold signal is exceeded in any operation cycle, the operation cycle begins It is again, in the second and subsequent cycles of operation, the time set by the timer is adjusted after the start of operation.

Images