RU2551802C2 - Device for protecting optical network from unauthorised probing by optical reflectometry methods - Google Patents

Abstract

FIELD: physics, optics.

SUBSTANCE: protection device is designed to prevent unauthorised probing of protected segments of optical cable systems and networks for various purposes. Controlled neutralisation of probing radiation in an optical cable is carried out by raising the noise level to the information-bearing signal power level or higher using a fibre-optic noise generator. The fibre-optic noise generator is connected in the optical network (1) on a Mach-Zehnder interferometer scheme (1), which is formed by asymmetrically connected two coupling devices (5, 6). One arm of the interferometer includes the fibre-optic noise generator, formed by a fire-optic modulator (7) and a noise generator (8). Power supply (9) and control of the device is carried out on the protected optical network via a channel (10). The protection device (2) is connected to the optical network (1) by detachable or permanent connections (3, 4). The device does not affect light flux in a switched off state and, when turned on, has optical nonreciprocity on noise induced in transmitted signals.

EFFECT: high efficiency of protecting information using optical channel noise masking methods.

13 cl, 7 dwg

Description

The invention relates to the field of technology for protecting confidential information from leakage through optical cable systems and networks of an object of informatization. The device allows you to prevent unauthorized sounding of the optical network by optical reflectometry methods to gain access to information circulating on the object in the form of physical fields, which may be confidential.

The prior art is determined by the fact that fiber-optic technologies are widely used in information transmission systems, for fiber-optic extension of interfaces, in distributed measuring systems and sensors, as well as in safety systems, replacing electronic (copper) cable systems and networks. The widespread use of fiber-optic technologies leads to the problem of ensuring the security of information in protected offices, buildings, campuses. The problem is complicated in connection with the improvement of measuring fiber-optic technology, which is used to ensure the reliability of information transfer and measurement accuracy. One of these devices, widely used for monitoring optical networks and conducting high-precision measurements, is an optical reflectometer.

Optical reflectometry is based on sensing the optical cable with light, which interacts with the fiber substance and forms a backward directed light response. The light response propagating back through the fiber is formed as a result of elastic / inelastic scattering, reflection, and reemission. Moreover, the magnitude of the response increases significantly at optical inhomogeneities and defects, which in turn can be sensitive to external physical fields. The intruder, using the proven technology of optical reflectometry, can gain access to informative signals at the object of informatization.

The simplest methods of protection are optical isolation of the protected segment of the optical network from sounding. What can be used an optical isolator based on the Faraday effect or the conversion of an optical signal into an electrical signal and vice versa into an optical signal in digital networks. These methods completely optically divide the network into unconnected segments, which does not allow authorized control of the entire network and contradicts the technology of fully optical networks.

Techniques for protecting information from optical sounding include methods and devices in which, when a physical field with a noise spectrum is exposed to an optical channel, the signal-to-noise ratio for all transmitted light flux decreases, which does not allow unauthorized sounding of the network. For example, in the patents for the invention RU 2416167 and RU 2416167, H04K 3/00, 04/27/2009, describes a method and device for introducing noise into the optical channel to prevent eavesdropping through optical cable systems. But this technique is not very effective in the case of optical reflectometry of optical networks.

We will discuss the protection scheme using a fiber-optic noise generator with a modulation depth m included between the optical reflectometer and the protected network segment (Fig. 1) in accordance with patents RU2 416167 and RU 2416167, H04K 3/00, 04/27/2009. We introduce the characteristic - noise figure of the protection device

NFD = SNR _in / SNR _out ,

which is determined by the signal-to-noise ratio SNR _in at the input of the device to the signal-to-noise ratio at its output SNR _out . The NFD value indicates how much the protection device increases the noise contribution to the signal. Successful protection is achieved with SNR _out <1. As the best estimate for the input leakage signal, we take SNR _in = 5 then NFD> 5.

The noise figure of the protection device in a direct switching circuit (Fig. 1) depending on the modulation depth is determined

NFD = (1 + m-SNR _in ) / (lm).

As follows from the expression, the direct inclusion of a fiber-optic noise generator into the optical network will only neutralize sounding without a defective network segment with SNR _{in a} little more than 1 and then, only at t more than 10%. At the same time, the noise figure of the device will reach 1.2 for direct light fluxes, which may affect the operation of the optical network.

The use of differential sensing, which consists in comparing the responses of signals from two defects located behind the protection device in the protected segment of the optical network, improves the sensing efficiency. Subtracting the signal powers reduces the contribution of additive noises, and their ratio - multiplicative noises, if the noise for different responses is coherent with each other. Additive and multiplicative noises are coherent with each other if they are formed by one protection device with a noise spectrum band, so that during the delay of one response relative to another the noise signal of the device does not change.

The analysis of the inclusion of the protection device, operating on the principle of reducing the signal-to-noise ratio, shows the low efficiency of this inclusion. The problem to which the claimed invention is directed, is to increase the efficiency of information protection by means of humming the optical channel.

The essence of the invention lies in the fact that the efficiency of a fiber-optic noise generator can be improved by including it in an optical network according to the Mach-Zehnder scheme. The essence of this inclusion is the use of two optical couplers (for example, with a division of 10% -90%), having a counter asymmetric connection between each other, when the output with the smaller branch merges with the output with a large branch. In the case when the parameters of the couplers and splices are identical, and the noise arising from the summation of the separated signals at the output of the interferometer is insignificant, this design does not introduce significant interference into the operation of the optical network. The inclusion of a fiber-optic noise generator into one of the arms makes this design non-reciprocal in terms of noise figure. In fact, subject to the division of k / (1-k) in the couplers, we obtain the noise figure for the direct NFD ₊ and the reverse NFD _{- the} directions of light propagation are not equal to each other

NFD ₊ = (1 + km m SNR _in ) / (1-k m)

and

NFD _- = (1+ (1-k) · m · SNR _in ) / (1- (1 · k) · m). In particular, for k = 0.1, m = 1, and SNR _in = 5, we obtain NFD ₊ ≈1.6 and NFD _- = 45, which completely excludes the very possibility of probing the protected network segment when the generator is turned on with noise, relatively weakly worsens the network parameters. With a decrease in the branch coefficient to k-1%, the noise figure will take the values NFD ₊ ≈1.06 and NFD _- ≈105, which allows us to talk about the complete inaccessibility of sounding. Also, regulation, including remote control, of the modulation depth m of the noise generator at a fixed branch value k allows you to smoothly change NFD over a wide range.

Differential sounding is neutralized by independent incoherent effect in the protection device on responses from separated sections of the optical network. To do this, it is necessary that when passing through the protection device of the response signals that differ in the transit time, the noise values are different. This is achieved by adding to the main spectrum of noise, protecting the informative signal from leakage, a high-frequency spectrum with a band determined by the parameters of the protected network segment. For example, if the length of the protected segment of the optical network is L ₀ and the resolution of the optical reflectometer is ΔL in length, then the additional high-frequency noise should have a band from c (2ΔL ₀ n) ^-1 to c (2ΔLn) ^-1 . In particular, for L ₀ = 1000 m and ΔL = 0.1 m, additional high-frequency noise should occupy the spectrum band from 0.1 MHz to 1000 MHz. If a high-frequency component is added to the noise spectrum, adjacent responses from defects within the protected network segment will have a random connection with each other, which excludes the selection of an informative signal.

The technical result provided by the given set of features is

1. No interference to optical radiation passing through the protection device in the off state;

2. Turning on the protection device allows you to interfere with sounding by optical reflectometry methods, which completely exclude its use without significantly affecting the operation of the optical network;

3. Also, the inclusion of the device allows you to create interference, neutralizing sounding in circuits for the passage of light, in addition to optical reflectometry.

The invention is illustrated by drawings, which depict:

Figure 1. A model of protecting a segment (2) of an optical network (1) with a terminal element (3) against the threat of sensing by an optical reflectometer (5) using a protection device (4) is presented;

Figure 2. The implementation diagram of the protection device (2) is shown, connected to the optical network (1) using connectors (3, 4) and containing taps (5, 6), a modulator (7), a noise generator (8) and a power supply (9) with control over the protected optical network through a coupler (10).

Figure 3. A diagram of the implementation of a symmetrical protection device (2), connected to the optical network (1) using connectors (3, 4), contains couplers (5, 6), modulators (7), a noise generator (8) and a power supply (9) with control over the protected optical network through a coupler (10).

Figure 4. The implementation diagram of the protection device (2) connected to the optical network (1) using the connectors (3, 4) is shown; it contains splitters (5, 6), modulators (7), a noise generator (8) and a power supply unit (9) with control over the protected optical network through a coupler (10).

Figure 5. The implementation diagram of the protection device (2) connected to the optical network (1) using the connectors (3, 4) is shown; it contains an optical isolator (5), a modulator (6), a noise generator (7) and a power supply unit (8).

6. The implementation diagram of a protection device (2) connected to an optical network (1) using connectors (3, 4) and containing taps (5, 6), a light source (7), a light receiver (8), a noise generator (9) is shown and a power supply unit (10) controlled by a protected optical network.

7. The implementation diagram of a protection device (2) connected to the optical network (1) using connectors (3, 4) and containing couplers (5, 6), a modulator (7), a noise generator (8), a control unit (9), and a power supply unit (10) connected to the optical network through a coupler (11).

The operation of the device is illustrated in the following implementation examples.

Example 1

One of the implementations of the device is presented in figure 2. The device is formed by two identical taps (5, 6) with fixed asymmetric division of the flow into the branch channel 10% and into the main channel 90%. The couplers are connected in a counter way - the branch channel is connected to the main channel so that they form a Mach-Zehnder interferometer. A fiber optic modulator (7) of the transmitted light flux is included in one of the arms. The input of the device is a coupler (5), the branch output of which is connected to the modulator. The optical arms of the interferometer are selected identical, so that the division of light at the input does not lead to a change in the flow parameters after combining them at the output. A noise generator (8) is connected to the fiber-optic modulator, together they form a fiber-optic noise generator. The generator generates noise with various types of spectrum - white, pink, brown and others, which have a bandwidth that overlaps the neutralized informative signal. The noise spectrum is expanded due to high-frequency noise, which is determined by the geometry of the protected segment of the optical cable, to exclude the separation of noise from the informative signal by comparing signals from nearby defects. The operation of the device is provided by the power supply (9). The control is carried out by an additional branch (10) from the optical coupler, which allows you to turn on / off the fiber-optic generator, choose the type of noise, noise spectrum and modulation depth.

The protection device is included in the optical network, as shown in figure 1, and protects the segment (2) from the protection device (4) to the terminal device (3). The device is connected to the network (1) using a welded or detachable connection, so that the input connects to the general network, and the output connects to the protected segment. In the normal mode of network operation, the protection device (4) is turned off, information flows through the interferometer without changes, introduced noise, losses and other changes do not affect the network operation. In case of danger of sounding with an OTDR (5), the protection device (4) is turned on with a 100% modulation depth, then all radiation passing along the arm with the modulator will have a noise character. In direct flows to the terminal device (3), the interference will increase by NFD ₊ = (9 / J0 + SNR _in / 9) times, which will not have a significant effect on communication, but for reverse emissions, the interference contribution will increase by NFD - = (10 + 9 SNR _in ) times, i.e. more than 10 times. Thus, the segment of the optical network (2) will be protected from probing by an optical reflectometer (5).

Example 2. A diagram of the implementation of a symmetrical protection device is presented in figure 3. A distinctive feature of this implementation from the device of example 1 is the symmetrical inclusion of fiber-optic modulators (7) in each arm of the interferometer, which leads to a symmetry of the input-output in terms of noise figure. Each modulator turns on independently of each other. The simultaneous inclusion of both modulators leads to a complete noise of the optical channel in both directions and breaks the connection. Turning on only one modulator leads to noise of only one direction of signal propagation. Thus, remote on-off allows you to highlight the direction of protection in the optical network on demand.

Example 3. Another implementation is presented in FIG. 4, in which instead of a coupler two Y-type 1xn splitters are used (in the case shown in FIG. 4 1 × 7), i.e. there is one input and n outputs that are interconnected. The splitters are selected with arbitrary division and are randomly connected to each other so that the oncoming flows make up different fractions of the main stream. The fiber-optic noise generator is attached either to all shoulders or to part of the shoulders (in the case shown in Fig. 4, interference is generated in 3 of 7 arms). This design allows you to achieve greater energy efficiency, i.e. with a smaller modulation depth, greater noise can be achieved in forward and reverse flows. And also, such a division into a large number of streams can give smaller losses on the passage and formation of backward emissions.

Example 4

Another implementation is presented in FIG. 5, in which the division of the flows is not performed, but one optical channel is used, into which a fiber-optic noise generator and an optical isolator are introduced.

For example, an optical insulator based on the Faraday effect with electromagnetic control allows you to turn on and off to regulate its operation. If necessary, authorized sensing isolator is turned off, and when there is a need to protect the segment of the optical network, it is turned on. Combined use of a fiber-optic noise generator with an optical isolator allows achieving maximum efficiency for protection both from sounding based on optical reflectometry - there are no reverse flows when the optical isolator is turned on, or from sounding through the radiation - the probing stream has a noise component that exceeds the contribution of the informative signal leakage when turning on the fiber optic noise generator.

Example 5. Another implementation is presented in Fig.6, in which the protection is based on the introduction of an optical noise signal generated by a light source (7) with a connected noise generator (9), forming a fiber-optic noise generator. In this device, instead of a modulator, a light source (7) is used, which turns on when a control signal or a signal formed by reverse radiation is received at the input of the receiver (8). The optical noise signal from the fiber optic noise generator may be continuous or in the form of a sounding signal with a noise spectrum. A continuous noise signal is used for weak sounding signals when its shape is not solvable. In another case, the noise signal repeats the shape of the probe signal by registering it with a receiver (8), which can be turned on both in the direction for registering back radiation and in the forward direction, i.e. in the same way as the light source.

Example 6

The implementation diagram of the device with the greatest functionality is presented in Fig.7. The device uses a fiber-optic noise generator based on a modulator of transmitted radiation. The optical circuit of the device repeats the circuit of the device of example 1. It differs in the control and power system. In the optical scheme, controlled couplers (5, 6) are used, which allow you to select the division coefficient, and for each coupler it can be different. This allows you to change the direction of the expected threat, i.e. it is possible to cut off the return radiation both on the right and on the left by choice. Changing the division ratio at the output of the protection device allows you to apply modulation with less depth and, therefore, with lower energy costs. For example, at the input, a division of 10% by 90% is established, and at the output 1% by 99%, then for the direct direction the noise figure will be in the order of magnitude of 1.3, and for the reverse direction it will exceed 100 at 100% modulation depth, which reduces the modulation depth and therefore increase the energy efficiency of protection.

Introduction to the device structure of the control unit (9) allows you to apply remote device control over the optical network, which uses the same optical channel as for transmitting information, or you can use your own fiber-optic cable for transmitting control signals. The control unit (9) can perform the functions of monitoring the operation of the device - choose the optimal mode of operation depending on the capacity of the supply battery, select the type used for the noise spectrum. The application of control methods of passing light fluxes in example 2 will allow for adaptive control of the operation of the device.

This implementation of the device allows the use of light fluxes as a source of energy to recharge the device. The device is connected to the optical network using a coupler or a separate cable and light fluxes are transmitted through it, which are recorded and converted into a photocell in the device.

Claims (13)

1. Device for protecting an optical network segment from unauthorized sounding by optical reflectometry methods by increasing the fraction of noise in transmitted light fluxes to values exceeding the informative signal, consisting of a Mach-Zehnder interferometer formed by the oncoming connection of two fiber optic couplers with unequal power division, in wherein the output of a branch of one is connected to the main output of another branch; a fiber-optic noise generator, including a fiber-optic modulator of transmitted light flux with a fixed modulation depth from 0% to 100%, included in one of the arms of the interferometer so that the arms of the interferometer are optically equivalent, and attached to the modulator of the noise generator; an operation control unit and a source for supplying device elements that together form a protection device, the input of which is a coupler, a branch of a fiber optic noise generator is included in the branch channel, and included in the optical network in front of the protected segment of the optical network from the side of the expected threat using a detachable or one-piece connection of inputs and outputs. 2. The protection device according to claim 1, characterized in that in the fiber-optic noise generator, the modulation depth of the fiber-optic modulator is adjustable from 0% to 100%, and the noise generator has a control that allows you to adjust the output parameters and select the type, spectrum of the generated noise. 3. The protection device according to claim 1, characterized in that the fiber-optic noise generator consists of two independent fiber-optic modulators, one in each arm of the Mach-Zehnder interferometer, which are turned on / off together or separately, depending on the direction of the expected threat . 4. The protection device according to claim 1, characterized in that the Mach-Zehnder interferometer is formed by connecting the outputs of two taps with n-branches with arbitrary division so that fiber-optic noise generators are connected to part or to all of the arms of the interferometer, and the other part is connected directly among themselves. 5. The protection device according to claim 1, characterized in that in the Mach-Zehnder interferometer an optical isolator is turned on in the arm with a fiber-optic noise generator, and the other arm is optically broken. 6. The protection device according to claim 1, characterized in that constant additional interference is generated in the arm of the interferometer with a fiber-optic noise generator by using an optical channel with defects in the form of scattering centers, areas with dispersion and other effects that distort the transmitted light fluxes, in addition to fiber optic noise generator. 7. The protection device according to claim 1, characterized in that the Mach-Zehnder interferometer is formed by connecting the outputs of two couplers with n-branches with arbitrary division, in which in addition to the fiber-optic noise generator, in order to generate constant additional interference, optical channel with scattering, dispersion and other effects that distort the passing light fluxes. 8. The protection device according to claim 1, characterized in that the Mach-Zehnder interferometer is formed by connecting couplers with multiplexer properties, in which the radiation spectrum is divided into n-sections with its output for each section and its fiber-optic noise generator, interconnected with corresponding outputs with one spectrum or between sections with disjoint spectra. 9. The protection device according to claim 1, characterized in that in the fiber-optic noise generator with a fiber-optic modulator, a fiber-optic light source is used, which is turned on in the direction of the input and / or output of the protection device, and a fiber-optic receiver that records light flows from the direction of entry and / or exit. 10. The protection device according to claim 1, characterized in that the noise generator, in addition to generating noise that introduces interference in the area of the protected part of the spectrum of informative signals, includes additional noise at higher frequencies. 11. The protection device according to claim 1, characterized in that both couplers have independently adjustable and different in magnitude branch coefficients. 12. The protection device according to claim 1, characterized in that the protection device is controlled remotely via a protected or dedicated optical line using network network protocols or analog signals. 13. The protection device according to claim 1, characterized in that the electric power supply to the elements of the protection device is provided by a replaceable battery or by a built-in battery with recharging from a photoelectric converter connected to a light source via a protected or dedicated optical line, by dividing the information signal along its length waves from the energy flow on its own in the multiplexer.

Images