Layer 2 Encryption Fortifying data transport

Transcription

1 autumn meeting 2014 Layer 2 Encryption Fortifying data transport Christian Zank n Cube Optics AG n October 2, 2014

2 Need for Encryption? n network intrusions detected every day Cisco 2013 n Data in transport is not protected n Government regulations for public data transport require higher security levels n The growing mass of electronic data in sensible areas, vital to us need protection

3 Optical fiber tapping n Scenario 1 Exploiting carrier maintenance points Site 1 Site 2

4 Optical fiber tapping n Scenario 2 - Exploiting fiber bending properties n 2 n 1 α α α β α:incident angle β:incident angle n 1 &n 2 : refractive index (core and cladding, n 2 < n 1 ) θ:citical angle = arcsin ( n 2 / n 1 ) Condition for total internal re6lection: α > θ Light refracts out of the core when incident angle is smaller than critical angle, β< θ.

5 7 Layers of the OSI Model Host Layers 7 Application Layer - Data Presenation Layer - Data Session Layer - Data Transport Layer - Segments Network Layer - Packets Media Layers Data Link Layer - Frames Physical Layer - Bits To the fiber

6 Encryption Layers Host Layers 7 Application Layer - Data Presenation Layer - Data Session Layer - Data Transport Layer - Segments TLS Encryption Network Layer - Packets IP Sec Encryption Media Layers Data Link Layer - Frames Physical Layer - Bits Layer 2 Encryption To the fiber

7 Overheads 7 Application Layer AH Application Layer Host Layers Presenation Layer Session Layer PH SH AH PH AH Presenation Layer Session Layer Transport Layer TH SH PH AH Transport Layer Network Layer NH TH SH PH AH Network Layer Media Layers Data Link Layer DH NH TH SH PH AH Data Link Layer Physical Layer DH NH TH SH PH AH Physical Layer Fiber or other medium

8 Layer 2 vs. Layer 3 Encryption 100% Layer 2 Throughput Layer 3 0% Big Packet Size Small Layer 2 encryption Hardware processing. Bump in the wire technology -> simple to implement, requiring little or no configuration and maintenance, with minimal network disruption. Operates at almost full wire speed. Adaptable to L2 network topology (point-tomultipoint, multi-mode links). Layer 3 (as data transport encryption) Software processing. Mode : Transport mode -> IP header not encrypted or Tunnel mode-> IP header encrypted. Troughput is protocol (IPv4 / IPv6)dependant.

9 Layer 2 Encryption Mac Head Secure Data CRC

10 Layer 2 Encryption - MacSec Data Integrity or 16 n*16 8 to 16 4 DA SA SecTag Secure Data ICV CRC MAC Addresses MPDU or 8 Ethertype TCI AN SL PN SCI (optional encoding) MSDU MAC Service Data Unit MPDU MACsec Protocol Data Unit ICV Integrity Check Value# MACsec Ethertype is 0x88E5 TCI TAG Control Information (6 bits) AN Association Number (2 bits) SL Short Length (6 bits) length of User Data if < 48 octets, 0 otherwise PN Packet Number replay protection and IV for encryption SCI Secure Channel Identifier identifies Secure Association (SA). In point-to-point links the SCI consists of the Source MAC Address and the Port Identifier and thus the SCI doesn t have to be encoded.

11 Layer 2 Encryption Superiority Low latency the must have for voice, video and real time communication Data center inter-connectivity Preserve integrity of confidential data (financial trading, banking sector) Enormous improvement in transaction speed (financial trading) Safe guard HR data on corporate or governmental level Disaster recovery data replication Corner stone of reliable and secure voice and video transmission Efficient with data of varying origin Complex Network Topologies (multiple leased fiber, services)

12 Layer 2 Encryption - Application Unsecure Network Site 1 Site 2

13 Layer 2 Encryption - Application Encryption Decryption Unsecure Network Site 1 Site 2

14 Conclusion Great demand to encrypt data in optical transmission Higher layer encryption Suffers from higher overhead when used as line encryption (IPSec) Is protocol dependent Risk of software vulnerabilities (TLS) Layer 2 encryption benefits Simple plug-and-play Lowest latency Almost at wire seed Layer 2 encryption enables Secure transmission for real-time application

15 Thank you!

16 Layer 3 Encryption - IP Sec Encryption 100% Throughput 50% Layer 3 Packet OH OH: Overhead 0% Big Packet Size Small Packet overheads depend on: Mode : Transport mode -> IP header not encrypted or Tunnel mode-> IP header encrypted IPv4 and IPv6