Stateless security filtering of optical data signals: an approach based on code words

Transcription

1 Stateless security filtering of optical data signals: an approach based on code words Maha Sliti, Noureddine Boudriga Communication Networks and Security Research Lab. University of Carthage, Tunisia Abstract In this paper, we propose an optical stateless filtering architecture which allows the traffic filtering at the optical layer. Indeed, each traffic stream will be identified by a unique identifier composed of a set of code words. In the core node, a set of optical filtering rules will be applied to this traffic stream based on its corresponding identifier in order to accept or reject the traffic stream. The stateless filtering process is based on the logical comparison between the received traffic identifier and the optical filtering signal which are composed of a set of code words. The proposed architecture is composed by two main components. The first component is an encoder implemented in the edge node, which generates traffic stream identifiers. And, the second component is the optical stateless filtering module which is implemented in the core node. Index Terms all-optical network, optical stateless filtering, code words, optical traffic identifier, optical logic gates, SOA. I. INTRODUCTION The amount of research being done in the area of optical communications has dramatically increased over the last years. A large proportion of the telecommunications functionalities including switching, flow control, and buffering are nowadays possible to be performed on the optical layer. As a consequence, many applications and services rely on the large bandwidth and high Quality of Service (QoS) provided by optical infrastructures. Due to the sensitivity of the aforementioned applications, more security requirements for optical networks are necessary. Indeed, some optical networks features can be used by an attacker to analyze traffic, eavesdrop, deny service, etc. Several approaches have been proposed in the literature to address the protection of optical networks [1], [2] and [3]. In [4], [5], authors propose filtering functionalities in optical networks. In [4], a filtering approach was developed in the frame of the WISDOM (WIrespeed Security Domains using Optical Monitoring) project which considers algorithms directly at high-speed optical data communication rates. One major drawback of these methods is that they do not take into consideration the specific features of optical networks. They just translate traditional security mechanisms to optical architectures. In [5], the authors propose an optical firewall architecture which filters a new category of attacks against optical networks that aims at exhausting the capabilities of the core nodes. This approach is limited to filtering attacks based on the BHP packets and allows only the BHP DOS attack filtering. In this paper, we propose an all optical stateless filtering architecture which allows the traffic filtering at the optical layer. Indeed, each traffic stream will be identified by a unique identifier composed of a set of code words. In the core node, a set of optical filtering rules will be applied to this traffic stream based on its corresponding identifier in order to accept or reject the traffic stream. The stateless filtering process is based on the logical comparison between the received traffic identifier and the optical filtering signal which are composed of a set of code words. This work improves the idea presented by the authors in [6] which presents a stateless optical filtering approach based on optical code words and considers an electronic security policy. The key contributions with respect to the previously published research are: 1) To the best of our knowledge, our work includes the first study of the stateless filtering process at the optical layer based on optical filtering rules and code words. This allows the filtering process, based on traffic identifiers, to be performed at very high bit rates. 2) The design of the optical stateless filtering architecture is based on optical logic gates AND/XOR which allows greater flexibility and variety in optical filtering rules. 3) Different types of optical filtering rules are considered according to the type of protocols. By optimizing the number of optical filtering rules applied to each traffic stream, the filtering process is more optimized in terms of filtering delay and quality of the transmitted signal. 4) The filtering architecture is built upon components available by current technology. Therefore, the architecture is effectively implementable. The rest of the paper is organized as follows. Section 2 presents the all-optical signal processing. Section 3 describes the mapping between packets and filtering rules. The design of all optical filtering operations is presented in Section 4. The proposed optical stateless firewall architecture is described in Section 5. Simulations and experimental results are given in Section 6. Finally, Section 7 concludes the paper. II. ALL-OPTICAL SIGNAL PROCESSING For optical signal processing and ultra-high-speed telecommunication, all-optical logic operations are required in order to avoid the electronic-optical conversion. All-optical logic gates are indispensable to critical networking functions, such as pattern matching, all-optical switching, signal regeneration, header recognition, pseudorandom number generation, and parity checking. All optical logic gates can be realized 118

2 by nonlinear optical signal materials that enable different light beams to interact. In the literature, many approaches have been proposed to achieve all-optical logic operations, based on the nonlinear effects either in optical fiber or in semiconductor optical amplifier (SOA) [7]. Compared with optical fiber based logic gates, SOAs based logic gates are promising because of their power efficiency and their potential for photonic integration. SOA is characterized by several nonlinearity effects, such as four wave mixing (FWM), crossphase modulation (XPM), and cross-gain modulation (XGM). In order to implement the all optical logic gates, AND and XOR, used to implement the proposed all optical filtering operations, we consider the XGM effect in the SOA. The cross modulation gain (XGM) consists on the gain modulation induced by a control signal that affects the gain of the signal propagating simultaneously in the SOA. A. Basic all-optical signal processing operations In this section, we present some basic operations of alloptical signal processing which are: 1) the all optical matching operation Matchop (S in,r) verifies the matching between two fields in the input optical signals. 2) the all optical greater operation Supop (S in,r) verifies whether a field in the first optical signal is greater than a field in the second optical signal. B. Design of all-optical signal processing operations In this section, we present the design of the proposed all optical filtering operations which is based on the use of all optical logic gates (AND, XOR). 1) Design of all optical logic gates and/xor: a) All optical logic gate AND: The all-optical AND gate structure is designed using two SOAs by considering crossgain modulation (XGM), as illustrated in Figure 1 [8]. With proper manipulation of pump and probe signals, the truth table is verified. Figure 2. Optical XOR gate design. the signal R. The all optical operations Matchop(S in,r) and Supop(S in,r) are achieved by an all-optical N-bit comparator based on SOAs exploiting XGM between two counterpropagating signals [10]. The N-bit all-optical comparator allows the comparison of two signals A and B by computing the functions A > B and A = B. The functiona = B performs the all optical matching operation Matchop(S in,r) and the function A > B performs the all optical greater operation Supop(S in,r). The all optical N-bit comparator [10], illustrated in Figure 3, compares two N-bit signals A and B. The comparison is performed sequentially starting from the Most Significant Bit (MSB). At the output of the XOR gate, a Serial to Parallel Conversion (SPC) is performed. The AND (AND1) is performed between the i th bit of the XOR output and the preceding inverted (i 1) bits. The AND1 output is a sequence of N bits that represents the function A = B. At the AND1 output, whether the input signals A and B match, the N bits are 0. Infact, the XOR output is 0 for each compared bit. Otherwise, the AND1 will be equal to 1 when the first mismatch is found. The AND (AND2), between the AND1 output and the input signal A, performs the function A > B. When the input signals A and B match, AND1 output is 0, consequently A > B is 0. When the first mismatch occurs, AND1 output becomes 1. If the corresponding bit of A is 1, thus A > B is 1. Otherwise, A > B is 0. In the same manner, AND (AND3), between the AND1 output and B, represents the function A < B. Figure 1. Optical AND gate design. b) All optical logic gate XOR: Figure 2 presents the design of the all-optical XOR gate by using cross-gain modulation (XGM). The design [9] does not require additional input beam such as a clock signal or continuous wave light, which is required in other all-optical XOR gates. The alloptical XOR gate structure is designed using two SOAs. With proper manipulation of pump and probe signals, the truth table is verified. 2) Design of all optical operations: The all optical operation Matchop(S in,r) verifies that a field in a signal S in (the received signal) matches a field in a signal R in the optical domain. And, the all optical operation Supop(S in,r) verifies whether a field in the signal S in is greater than a field in Figure 3. Optical comparator design. III. ALL OPTICAL STATELESS FIREWALL ARCHITECTURE The proposed optical stateless filtering architecture, illustrated in Figure 4, allows the data signal filtering at the optical layer. In the edge node, each traffic stream will be identified 119

3 by a unique identifier composed of a set of code words which are a sequence of optical pulses. At the reception of a traffic stream at the core node, a set of optical filtering rules is applied to its corresponding identifier, in order to accept or reject the traffic stream. The proposed architecture is mainly composed by two components. The first component is the traffic identifier generation module which is implemented in the edge node and ensures the mapping between traffic streams and optical code words. And, the second component is the optical stateless filtering module which is implemented in the core node and based on the mapping between optical filtering rules and optical code words. At the reception of the traffic stream composed by the payload, the traffic identifier and the label, these fields are extracted and processed as follows: the payload is stored in an optical virtual memory (VOM) during the filtering delay, based on the label, the traffic identifier will be switched to the corresponding filtering sub-module by using an Optical Switch Gate (OSG). The proposed stateless filtering module implements optical filtering rules based on all optical filtering operations achieved by all optical logic gates AND/XOR. The stateless filtering module is composed of a set of optical filtering rules. Each optical filtering rule is based on one or several optical filtering operations. The payload will be sent to the next node only if it verifies at least a filtering rule. Indeed, we consider a "default deny" optical filtering policy known as where the filtering rules specify only traffics which are authorized to be forwarded by the optical filter. Traffic streams which do not match any configured rule will be denied by default. The stateless filtering module is subdivided to a set of submodules allowing the filtering of different types of protocols depending on the received Label. IV. MAPPING PACKETS AND FILTERING RULES In this section, we explain the traffic identifier generation in the edge node which insures the mapping between traffic streams and optical code words and the mapping between filtering rules and code words in the firewall core node. Indeed, each traffic stream will be identified by a unique identifier composed of a set of code words. In the core node, packets can be accepted or rejected based on their traffic identifiers. In order to perform the proposed filtering process, it is necessary to define a first mapping between traffic streams and traffic identifiers and a second mapping between optical filtering rules and code words. A. Traffic identifier generation A received traffic data <P>, in the edge node, contains a set of fields < F 1,F 2,...,F n > which uniquely identifies the traffic (Source IP address, source port, destination IP address, destination port, type of transport protocol, flag, etc). Therefore, the Traffic Identifier is generated for each traffic data <P> based on the fields < F 1,F 2,...,F n > by proceeding as follows: For each field < F i > formed by a sequence of s bits, a set of 2 s code words are generated and ordered starting from the smallest to the largest code word value. Therefore, if d 1 and d 2 are two different values of the field < F i > with d 1 < d 2, cd 1 and cd 2 are two code words with cd 1 < cd 2, then cd 1 is mapped to d 1 and cd 2 is mapped to d 2. The traffic identifier will be composed by a sequence of code words < cd 1,cd 2,...,cd n > representing the set of fields < F 1,F 2,...,F n > in a predefined order. The code words order in the Traffic Identifier is important and must be respected by the traffic generator module since the same order will be considered by the filtering module in the core node. Therefore, the optical filtering rules consider this order to verify whether a traffic stream matches a rule or not. The generated traffic identifier < cd 1,cd 2,...,cd n > is associated to the beginning of each traffic data <P>: <P><trafficidentifier>. The skilled reader will understand that the traffic identifier will be treated in the optical layer since it is not associated to the Header which requires the conversion of the optical signal into an electronic signal as an intermediate step. This allows the filtering process, based on traffic identifiers, to be performed at very high bit rates. Figure 4. All optical stateless firewall architecture. B. Mapping filtering rules and code words The all optical filtering process insures the access control security service of the traffic streams at the optical layer. The access control service consists in discriminating the traffic streams to be forwarded by the firewall core node according to an all optical security policy. The all optical security policy is formed by a set of filtering rules represented by optical signals generated by the filtering module depending on the protocol to be filtered. 120

4 The proposed all optical filtering process, performed in the firewall core node, is based on the mapping between filtering rules and code words. In this objective, each filtering rule is traduced to one or several optical filtering operations. In the following, we present the main types of all optical filtering rules which traduce the main electronic filtering rules to the optical domain: 1) All optical filtering of a unique field value: We consider the following filtering rule: If field = a then drop. In order to obtain an all optical filtering policy and to perform an all optical filtering process, an optical signal R, containing the code word corresponding to the field value a, is generated based on the same ordered set of code words considered for the traffic identifier generation. In order to verify that a received traffic data matches or not this rule, we define an all optical filtering operation noted Match op (S in,r) which have as inputs : S in (the traffic identifier) and R (the optical generated signal). Therefore, the rule in electronic domain is traduced to the optical layer as follows: if Match op (S in,r) then drop. 2) All optical filtering of interval of values: We consider the following filtering rule: If field > a then drop. The generated optical signal R is composed of the code word corresponding to the field value a. In order to verify that a received traffic data matches or not this rule, we define an all optical filtering operation noted Sup op (S in,r) which have as inputs : S in and R. Therefore, the rule is traduced to the optical domain as follows: if Sup op (S in,r) then drop. 3) All optical filtering of intervals of values: We consider the following filtering rule: If field G then drop with G = [a 1,a 2 ] [a 3,a 4 ]... [a n 1,a n ]. In this case, n optical signals will be generated and each optical signal contains the code word cd i (with 1 < i < n) corresponding to a field value in the range < a 1,a 2,a 3,a 4,...,a n 1,a n >. Therefore, the rule is traduced to the optical domain as follows: if Or ((Sup op (S in,r cd1 ) and Sup op (S in,r cd2 )), (Sup op (S in,r cdn 1 ) and Sup op (S in,r cdn )) ) then drop. V. DESIGN OF ALL OPTICAL FILTERING OPERATIONS The presented all optical filtering rules allowing to perform traffic stream filtering in the optical domain, are based on the presented all optical signal processing operations: All optical matching operation Match op (S in,r) which verifies that a code word in the signal S in matches a code word in the signal R, All optical comparison operation Sup op (S in,r) which verifies that a code word in the signal Sin is greater than a code word in the signal R. With S in and R are two optical signals such as S in corresponds to the received traffic identifier and R is the generated optical signal based on the considered filtering policy. The presented all optical signal processing operations perform the main types of all optical filtering operations: filtering of a unique field value, filtering of an interval of values, filtering of intervals of values. In this section, we present the design of the proposed all optical filtering operations. The traffic identifier signal, extracted from the received payload, is composed of a sequence of code words corresponding to field values. The order of these code words is indispensable since the optical signal R contains the code words to be verified by a filtering rule, by considering the same order of code words. If the generated signal R verifies the code word cd 1 for example and does not verify other code words in the traffic identifier, its structure will be as follows: cd 1, padding 2,...,padding n, where padding i is a sequence of pulses that allows the traffic identifier and the signal R to have the same length. Figure 5 illustrates the all optical filtering process based on the filtering operations Match op (S in,r) and Sup op (S in,r) performed by the N-bit comparator. Therefore, the extracted traffic identifier S in and the rule signal R are compared by the presented all-optical N-bit comparator. Then, the result of the comparison will be passed to a set of optical delay lines (ODLs) in order to delay pulses having as indexes i <= length cd1 to the L+1 index with length cd1 is the length of the cd 1 and L is the length of the signal R. At the output of the set of optical delay lines, a threshold detector detects a pulse in the L + 1 index of the output signal in the case of non matching of the optical signals S in and R. In the contrary case, the threshold detector does not detect a pulse. Figure 5. Optical filtering operation design. VI. SIMULATIONS AND EXPERIMENTAL RESULTS In this section, we evaluate the performance of the proposed stateless filtering approach based on code words. As simulation environment, we have considered Matlab For simulation purpose, we consider: a network connected in an arbitrary topology, each link has a fixed number of wavelengths and link loads are mutually independent. In order to analyze the security efficiency of the proposed filtering approach, as described by Figure 6, we compute the true positive rate in function of the false positive rate. We consider the following parameters: the erroneous load probability, the legitime load probability, the firewall node density in the network (the firewall node number in the network relatively to the total core node number in the network), the number of filtering rules for each firewall node and the filtering delay for each filtering rule. The true positive rate measures the proportion of erroneous packets which are correctly filtered by the firewall node. The false positive rate measures the proportion of legitime packets which are filtered by the firewall node. We consider the Receiver Operating Characteristic (ROC) curve as a tool to assess the performance of the optical layer 121

5 Figure 6. True positive rate in function of false positive rate. Figure 7. Filtering delay in function of firewall node density. filtering mechanism. Indeed, this curve is the plot of the true positive rate in function of the false positive rate. The closer the ROC plot is to the upper left corner, the higher the overall accuracy of the test. The area under the ROC curve (AUC) is a scalar measure. If the AUC is equal to 1, it reflects perfect forecasts. As illustrated in Figure 6, we notice that the true positive rate increases in function of the firewall node density in the network. Thus, the detection of erroneous and legitimate traffic streams can be assured only by nodes that implement the filtering module. The AUC in the case of the highest firewall node density value is greater than the AUC in the case of the lowest firewall node density. Therefore, the variation of the firewall node density in the network have a critical effect on the global performance of the firewall nodes. Furthermore, we analyze the effect of the proposed filtering approach on the global network performances and we fix the following parameters: the firewall node density, the number of filtering rules for each firewall node, the filtering delay for each filtering rule, the delay of one turn of the optical signal in the Virtual Optical Memory (VOM, [11]) and the degradation of the optical signal resulting of one turn in the VOM. The following parameters are assessed: the global delay spent by the traffic data in firewall nodes in function of the firewall node density in the network as illustrated in Figure 7. the global optical signal quality degradation which results from the traffic data delay in the VOM during the filtering process. This degradation depends on the firewall node density in the network as illustrated in Figure 8. In Figure 7, we notice that the global filtering delay increases in function of the firewall node density. Indeed, the traffic data is delayed in the VOM during the filtering delay in each firewall node which increases the global delay in the network. The accumulated delay in the VOM implies the Figure 8. Optical signal degradation in function of firewall node density. degradation of the optical signal quality depending on the number of turns in the VOM. Therefore, the turn number cannot exceed a maximum number of times n to preserve from unacceptable degradation of SNR. The envelope of the signal can experience severe changes with loss of information due to the effect of attenuation and dispersion. The threshold n is evaluated to 120 turns when the standard components are considered [11]. In Figure 8, we notice that the global degradation increases in function of the firewall node density in the network. And, finally, the following parameters are considered: the number of filtering rules for each firewall node, the number of code words filtered by each rule, the delay of one code word filtering and the delay of one turn of the optical signal in the VOM, in order to evaluate the firewall node performance 122

6 by assessing the effect of filtered code word number on the optical signal degradation during the filtering process. Figure 9. Optical signal degradation in function of filtered code word number. In Figure 9, we notice that the optical signal degradation depends on the maximum number of filtered code words by a rule. Indeed, the total delay required to filter several code words implies to delay the traffic data in the VOM which results on the degradation of the optical signal quality depending on the number of turns of the signal in the VOM. Therefore, the number of filtered code words cannot exceed a maximum value because of unacceptable degradation of SNR. The equation 1, established in [11], gives the logarithmic Q factor expression after i turns in the loop, which is deduced from the SNR i, and where B 0 is the optical bandwidth of the photodetector and B c is the electrical bandwidth of the receiver filter. The equation 2, established in [11], gives the SNR expression after i turns in the loop, where P in is the input signal power, SNR SSB is the SSB signal to noise ratio, η SP is the ratio of electrons in higher and lower states, h is the Plank s constant, f is the bandwidth that measures the noise figure and G EDFA is the EDFA gain. B 0 Q i (db) = 20log( SNR i ) (1) B c SNR i = P insnr SSB C i (2) where C i = iη SP hsnr SSB f(g EDFA 1)(2λ 0 λ(i+ 1))+iP in. This limit can be improved by extracting the different code words to be checked by a filtering rule, then check them in parallel instead of serial verification. This solution presents a constraint when extracting the code words from the traffic identifier however it can increase the number of filtered code words by decreasing the signal degradation caused by the number of turns in the VOM. VII. CONCLUSIONS AND PROSPECTS In this work, we have proposed an optical stateless filtering architecture which allows the traffic filtering at the optical layer. Each traffic stream is identified by a unique identifier composed of a set of code words. In the core node, a set of optical filtering rules will be applied to this traffic stream based on its corresponding identifier in order to accept or reject the traffic stream. Our work includes the first study of the stateless filtering process at the optical layer based on optical filtering rules and code words which allows the filtering process to be performed at very high bit rates. Furthermore, the design of the optical stateless filtering architecture is based on optical logic gates AND/XOR which allows greater flexibility and variety in optical filtering rules. The proposed filtering architecture is built upon SOAs in order to implement the all optical logic gates. Therefore, the architecture is effectively implementable. In future works, the proposed stateless filtering architecture will be extended to a stateful filtering architecture based on code words in order to allow the filtering of connection-oriented protocols in addition to non connectionoriented protocols. REFERENCES [1] T. Wu and A. Somani, "Cross-talk attack monitoring and localization in all-optical networks," IEEE/ACM Trans. Networking, vol. 13, no. 6, pp , Dec [2] C. Mas, I. Tomkos, and O. Tonguz, "Failure location algorithm for transparent optical networks," IEEE J. Select. Areas Commun., vol. 23, no. 8, pp , Aug [3] M. Sivakumar, R. K. Shenai, and K. Sivalingam, "A survey of survivabilty techniques for optical WDM networks," in Emerging Optical Network Technologies: Architectures, Protocols and Performance, A. Sivalingam and S. Subramaniam, Eds. New York, USA: Springer Science+Media, Inc., 2005, ch. 3, pp [4] R.J. Manning, R. Giller, X. Yang, R.P. Webb, D. Cotter, "Faster Switching with Semiconductor Optical Amplifiers," Proceedings of the International Conference on Photonics in Switching, pp , Aug [5] M. Sliti, M. Hamdi, N. Boudriga, "A novel optical firewall architecture for burst switched networks," International Conference on Transparent Optical Networks, Munich, Germany, [6] N. Boudriga, M. Sliti, W. Abdallah, "Optical code-based filtering architecture for providing access control to all-optical networks (Invited)," International Conference on Transparent Optical Networks, Coventry, England, [7] A. Rostami, H. Baghban, R. Maram, "Nanostructure Semiconductor Optical Amplifiers: Building Blocks for All-Optical Processing (Engineering Materials)," Springer, ISBN , [8] Kim, S.H. Kim, J.H. Son, C.W. Kim, G. Byun, Y.T. Jhon, Y.M. Lee, S. Woo, D.H., "Implementation of All-Optical Logic and Using Xgm Based on Semiconductor Optical Amplifiers," Optical Internet and Next Generation Network, COIN-NGNCON 2006, 9-13 July [9] V. K. Srivastava and V. Priye, "All optical half adder design using equations governing XGM and FWM effect in semiconductor optical amplifier," Int. J. Appl. Eng. Res. 1(3), (2010). [10] M. Scaffardi, P. Ghelfi, E. Lazzeri, L. Poti, A. Bogoni, "Photonic processing for digital comparison and full addition based on semiconductor optical amplifiers," IEEE J. of Select. Topics in Quantum Electron, 14, 3, 1-8, May/June, [11] S. Batti,. M. Zghal, N. Boudriga, "A New All-Optical Switching Node Including Virtual Memory and Synchronizer," JNW 5(2): (2010). 123