1. Introduction

Transmission security (TRANSEC) [1] plays a vital role in today’s fiber-optical networks in safeguarding information transfer at the physical layer of the network and preventing hostile interception and exploitation by unauthorized eavesdroppers. TRANSEC implemented by spread spectrum (SS) techniques [2, 3] is efficient in achieving low probability of interception and detection of transmitted signal due to the noise-like and low power density nature of the spread signal, and thus is used extensively in military radio communications. The use of unique TRANSEC keys to spread and despread signals in SS systems additionally made CDMA modulation format possible in RF wireless networks [4] resulting in high spectral efficiency and security. Recently, considerable progress has been made to explore the possibility of an advanced optical network based on OCDMA [5, 6] with the vision of applying advantages and developments of SS RF communications to optical communications, and providing enhanced communication security, higher spectral efficiency, and simplified and decentralized network control in the next generation photonic networks.

 

Fig. 1 Secure transmission over public fiber-optical communication network (Broadcast Star topology) Encryption of secure signal is performed at the physical layer by OCDMA encoder [3].

Download Full Size | PDF

With the objective of bolstering communication security, we previously proposed a method [3] (See Fig. 1) for performing secure transmission over a public fiber-optical network by overlaying an independent secure channel to an existing network. Such secure channel is designed to employ same spectrum as the public network, and is optically encoded and time spread at the physical layer by OCDMA encoding techniques [3] resulting in signals having average power below the noise floor in the fiber. This approach provides an extra depth of security namely steganography [1] by concealing the secure transmission in the network and preventing hostile detection by eavesdropper. It was demonstrated [3] that “direct” eavesdropping attempts such as analysis of spectrum, monitoring of signal power and statistical analysis of power fluctuations do not allow the detection of the secure signal in the proposed system. However, more efficient eavesdropping strategies that take advantage of the study of correlation [7, 8] have been recently suggested.

In the present work, we demonstrate the robustness of our proposed approach to eavesdropping strategy that is based on the autocorrelation of the signal tapped from the network. We show that under proper configuration, secure transmission will remain hidden and undetected by eavesdropper.

Furthermore, we develop a quantitative analysis to illustrate that even in the case when secure transmission is known to take place, our proposed approach is robust to a “brute force” code search attack executed by an eavesdropper. We show that the presence of the public network severely hinders and disrupts eavesdropper’s efficiency in obtaining secure data.

Also, we introduce the concept of effective key length and apply it to analyzing the security of the proposed approach. The effective key length metric is useful in evaluating the degree of confidentiality inherent in the proposed secure transmissions.

2. Intensity autocorrelation

Autocorrelation analysis is a useful tool in detecting regularly repeating signals, which have been buried under noise. For a low power noise-like secure CDMA signal embedded in the public network [3], an eavesdropper who has access to the public network can perform an intensity autocorrelation on signals tapped from the network, and uncover autocorrelation peaks which appear periodically at interval corresponding to the bit period of secure channel. Such peaks reveal the presence of active secure transmission and hence compromise the built-in steganographic security. Once secure communication is discovered to take place, an eavesdropper can isolate a part of the signal corresponding to the identified secure bit period and cross correlate it with the tapped signal to determine the secure bits transmitted (assuming bit by bit encoding code is fixed for particular user). However, as we demonstrate below such strategy is severely impaired by the presence of the public channel.

 

Fig. 2 Intensity autocorrelation for a) secure signal and noise only, b) public signal and noise only, c) public signal, secure signal and noise. Simulations are performed where flat top band-limited pulses of bandwidth W (Sinc pulse profile in time domain) are used in both the public network and secure channel. The simulation parameters (see Appendix) are given by: P_s / P_p = 3, W = 0.6 rad /ps, C = 128 chips, T_s= 1320 ps, T_p = 60 ps and N_add / P_p = 0.01.

Download Full Size | PDF

 

Fig. 3 a) Autocorrelation for composite signal obtain in simulations (red) and using analytical theory (blue) where P_s / P_p = 15, C=128 chips, T_s = 1320 ps and N_add / P_p = 0.01. b) Autocorrelation comparison before (blue) and after (green) secure signal is applied to the public network (with the public signal and noise). Secure signal uses a spreading factor C=2048 chips, T_s = 21420 ps, P_s / P_p = 15 and N_add / P_p = 0.01. (See Appendix)

Download Full Size | PDF

Figure 2(a) shows the autocorrelation when only the secure signal is transmitted under the noise floor in the network. The secure signal is modulated with M-ary (M=2) codes and operated at 758 Mb/s [3]. Although the time spread noise-like secure signal is hidden under the noise, an autocorrelation peak is observed to occur at a time delay of 1320 ps corresponding to the bit period of the secure signal. Note that the observation of an autocorrelation peak would inevitably allow the eavesdropper to detect the presence of secure transmission, which is basis for efficient autocorrelation attack against OCDMA based systems.

Shown in Fig. 2(b) is the autocorrelation when only the public signal and noise is present in the network. The public signal is an on-off keying signal operating at a bit rate of 16.7 Gb/s. Autocorrelation peaks matched to an integral number of the bit period (60 ps) of public signal are displayed. The fluctuations experienced by the autocorrelation peaks are due to the presence of noise in the network.

However, the situation changes dramatically as shown in Fig. 2(c) when the public signal is simultaneously present in the network while secure transmission takes place. Notice that no significant autocorrelation peak can be observed at a lag time of 1320 ps (corresponding to the secure bit interval) and as a result secure transmission remains well undetected. Efficient secure channel hiding in this case can be achieved when the periods of both public and secure channels commensurate and the fluctuation in the peak magnitudes due to noise is large enough to mask over that from the secure channel.

Although the autocorrelation peak caused by the secure channel is safely concealed in the situation above, it is possible that an apparent peak can occur in the case when (e.g. in an effort to improve BER performance) an overly high peak power is used in the secure channel, as illustrated in Fig. 3(a). However, even in such conditions the security vulnerability can be minimized and readily removed by the use of higher time spreading in the secure channel as the average energy occupied per public user bit interval is reduced. This argument is illustrated in Fig. 3(b) where we apply a higher spreading factor to the secure signal while maintaining the same high peak power ratio used in Fig. 3(a). Shown in Fig. 3(b) are the autocorrelations (Blue) before and (Green) after the secure channel is applied to the public network. Both plots follow closely to one another and as a result this clearly demonstrates the hidden secure channel is well protected from the autocorrelation attack. Using the theory developed in [3] (see also section 3) and the autocorrelation expression (Eq. 3), one can compute the required data rate (which relates to the amount of time spreading used) for the secure channel. We note that for a large time spreading the BER performance of both channels and the communication privacy of the secure channel will improve at the expense of lower operating bit rate for secure user.

The stealth characteristic of the secure channel can always be adequately protected given that sufficient large time spreading can be attained. While the OOK modulation in the public signal might potentially allow an eavesdropper to extract useful information for time intervals when public signal transmits a bit zero, the secure stealth channel will remain hidden as the communication takes place under the noise floor of the system. Furthermore, due to the random access time between the two channels and M-ary modulation (M=2) of the secure signal where a different code is assigned for a bit zero and bit one (See [3]) so they have distinct noise-like waveforms, the reconstruction of the secure signal (both its amplitude and phase) over a full period is severely inhibited. This will not allow an efficient cross-correlation attack (which is the most efficient method of the recovery of the information transmitted under the noise floor).

We now provide the analytical framework that will allow us to analyze the performance of the proposed system. We first define the ensemble average of the intensity autocorrelation R_ff(τ) of the signal f(t) as

where τ specifies the value of delay, Γ is the length of the stream of signal and f(t) represents the signal intensity tapped from the public network and is given by

where s(t), p(t) and n(t) represent the signal amplitude of secure channel, public channel and additive white Gaussian noise respectively. Substitution of Eq. (2) into Eq. (1) and expansion of <f(t)f(t-τ) > yields

where <n(t) n(t-τ)*> = 0 when τ ≠ 0 for uncorrelated noise.

The first three terms in Eq. (3) relate to the intensity autocorrelation of the secure signal, public signal and noise respectively. Other terms correspond to the cross-correlation between various intensity signal components. Note that Eq. (3) is applicable for any arbitrary pulse spectrum used in the public and secure channel. In the appendix we derive equations to compute various terms in Eq. (3).

3. Eavesdropper detector

The security advantages of the proposed system however are not limited to its steganographic capability. In the event when the existence of secure transmission a priori known to the eavesdropper, a possible strategy which an eavesdropper can implement to break the security of the system and identify the code, is to use a tunable decoder and look for a possible increase in the opening of the eye diagram by tuning the phase of particular chip to match the correct value in the true phase mask [3]. The larger is the contrast in the eye opening between the “correct” and “wrong” choices of a particular phase, the faster and more efficient would be such a search of the “stealth” systems.

We would like to point out that the presence of the public network drastically inhibits and slows down an eavesdropper’s ability to obtain the code used for encoding. This is because the decoded bit performance increases very slowly with respect to the percentage of correctly tuned code. As a result, the method of obtaining the secure code by iterative code tuning is very inefficient, as eavesdropper can’t see significant eye opening to justify and decide on the correct code.

In this section we develop an analytical description to demonstrate the robustness of our proposed transmission against such eavesdropping strategy. We evaluate the eavesdropper’s BER/SNR performance of the proposed system using the standard Q-factor [9] versus the fidelity of the eavesdropper decoder, defined by ∏ the percentage of correct code chips present in an imperfect decoder. The Q-factor is defined by

where (I _∏, σ_∏) and (I ₀, σ₀) denote the mean and standard deviation of the detected intensity from the network using a decoding phase mask that contains the fraction of ∏ of the correct phase chips, and no correct phase chips respectively.

Shown in Fig. 4 is the dependence of the Q-factor on the ∏ parameter, comparing the Q-factor of the secure channel with and without the presence of the public network. (Note excellent agreement of the analytical results with numerical simulations.) As clearly seen from the plot, the Q-factor is generally smaller when the public network is present due to increase in effective noise seen by the eavesdropper with an imperfect decoder. As low Q-factors imply a low probability of detecting the correct bit, this effectively translates into enhancement in security. Note that the rate of increase of the Q-factor (lower red curve) is much slower in the presence of the public network, making it difficult to achieve a large eye opening - especially in the case when ∏ is small. This constitutes significant difficulty for an eavesdropper who attempts to use a tunable decoder to determine the correct code for individual phase chip. As an efficient iterative strategy to breaking the code would necessarily rely on the “feedback” from the opening eye diagram (needed to decide whether a correct phase code has been reached to justify a lock down on any specific phase code in a particular chip), the proposed approach enables a significant increase of the confidentially of the secure signal.

 

Fig. 4 The comparison of Q-factor for the secure channel vs. the fraction of correct chips (∏) present in an eavesdropper phase mask with public network (red, lower curve) and without public network (blue, upper curve). Symbols represent the simulation values and curves represent analytical values. The parameters are C=128 chips, T_s = 1320 ps and P_s : P_p = 3, N_add : P_p = 0.01.

Download Full Size | PDF

We now derive the expressions for I _∏ and σ_∏ (note that I ₀ and σ₀ follows when ∏ is set to 0), we first define the signal amplitude after the eavesdropper’s imperfect decoder here onwards referred as ∏-Decoder, which is given by

where s̃(t), p̃(t) and n(t) represent the decoded amplitude of the secure channel, public channel and additive white Gaussian noise respectively. The ensemble averages of the intensity of Eq. (5) and its second moment are given by

Using Eq. (6a) and Eq. (6b), the standard deviation of the decoded intensity can be calculated and is given by

The pair of equations in Eq. (6a) and Eq. (7) are used to compute the Q-factor in Eq. (4). We first consider the decoded secure amplitude taking into account of neighboring contributions, we have

where T_S is the bit period of secure user, θ’s are the random phases between different time frames, $\acute{\psi }$ s∈ {0, 1} depicts the code keying for bit 1 and bit 0 and the signals h̃(t) and k̃(t) represent the decoded bit 1 and bit 0 after the ∏-Decoder where by construction it is devised to decode h̃(t) specifically (when ∏=l h̃(t) is perfectly decoded back to original signal). The ensemble average of the intensity and its square of Eq. (8) are given by

Assuming that flat top band-limited pulse of bandwidth W (Sinc pulse profile in time domain) is employed in both the public network and secure channel, the expression for h̃(t) is given by

where P_s is the initial peak power, C is the number of code chips in the encoding phase mask, Ω = W/C is the bandwidth of a code chip in the phase mask, φ_n∈ [-π, π] is the random phase in different spectral chips and θ_n ∈ {0,1} with a probability of ∏ being 0 and 1-∏ being 1. When θ_n is zero, it describes the case when eavesdropper is able to guess the correct phase code of chip n in the decoding phase mask such that the original phase of the chip is restored from that encoded.

For the intensity ensemble average of Eq. (10) we obtain

Since the ∏-Decoder is tuned to h̃(t), for any ∏ the value of k̃(t) is given by

To calculate the other terms in Eq. (9b), we use the following

where t₁ and t₂ can be substituted accordingly for individual term in Eq. (9b).

For the public signal that has been time spread after the eavesdropper’s decoder, the expressions for the average of its intensity and intensity square are given by

where P_p and T_p represent the initial peak power and bit period of the public signal. We note that for the additive Gaussian amplifier noise, 〈|ñ(t)|²〉 and 〈|ñ(t)|⁴〉 are p_noise and 2P_noise ² respectively. The Q-factor can subsequently be computed by applying Eq. (9a), Eq. (9b), Eq. (11) - Eq. (16) to Eq. (6a) and Eq. (7).

4. Effective key length

In cryptography, the key length (usually measured in bits due to binary keys) provides a measure of the security and number of possible keys that can be used to encrypt secure data. Assuming that the only way for an eavesdropper to decrypt the encrypted data is to discover the unique key, the length of such a key is vital in determining the susceptibility of an exhaustive search attack. The length of a key should be long enough so that it becomes computationally and physically infeasible (due to large key space) for an attacker to break the encrypted data. Note that a large key length is a necessary but not a sufficient condition for a secure system. It is a necessary as since it is generally possible to run through the entire space of keys in what is known as a “brute force” search, the key space therefore should be large enough for the brute force search to take more time than available to the eavesdropper. However a long key length per se is not sufficient for system security, as there may exist an efficient search algorithm that would not rely on exploring the full key space.

In light of this, we construct a comparable quantitative metric that we term the effective key length, to evaluate the level of security for our proposed secure transmission systems. We define the effective key length as the minimum amount of information (calculated using the standard Shannon definition [10]) necessary to define the decoder.

 

Fig. 5 Effective key length vs. C (number of chips in a phase mask) for various values of SNR signal-to-noise ratio.

Download Full Size | PDF

Neglecting nonlinear effects in the communication channel, the signal in the frequency domain can be represented as a frequency chip in an encoding phase mask [3] of C chips, the signal amplitude in frequency domain for a particular chip is given by

where x_ω and n_ω represent the secure signal and noise components respectively, ϕ_x is the original phase of the signal x. Note that for n_ω << x_ω, √〈δϕ²〉 ~ P_n/P_ω, with the corresponding standard deviation √〈δϕ²〉 ~ P_n/P_ω where P_ω and P_n are the power of the signal and noise respectively. If x(t) corresponds to a single “chip” of a signal encoded with phase mask [3] of C chips, so that the corresponding phase can be defined on a interval from [-π , π], the number of different codes for one chip that can be effectively detected in the presence of the noise in the channel, is given by

As there are C independent chips that define the secure signal, for the effective key length we therefore obtain

where SNR is the signal-to-noise ratio in the channel.

The effective key length improves with the increase of the number of chips, as illustrated in Fig. 5 for various values of SNR. In particular, a phase mask of C = 512 chips or more, can translate to an effective key length well above 1000 and effectively allowing the stealth system to reach the level of commercial cryptography.

5. Conclusion

We analyzed the security performance of the recently proposed stealth communications over a public fiber-optical network. We demonstrated the robustness of the secure transmission against intensity autocorrelation attacks where under optimal operating regime; eavesdropper will not be able to discover secure transmission taking place in the public network. We presented analytical theory with simulations and showed the BER/SNR performance represented by the Q-factor as a function of the fidelity in an imperfect decoder used by an eavesdropper. We showed that the use of public networks for secure stealth transmissions can increase the difficulty to perform an iterative code search to break the security of the system as the improvement in Q-factor is severely hindered by the presence of public channel(s). We derived the effective key length metric and compared the level of confidentiality offered by the proposed approach. We showed that for large number of encoding phase chips, security of the proposed system can approach commercial cryptographic level.

Appendix

In this appendix we derive the expressions for the terms in Eq. (3) where a flat top band-limited pulse of bandwidth W (Sinc pulse profile in time domain) is used in both secure and public channels. The signal amplitudes for secure and public user denoted by s(t) and p(t) [3] are given by

where the random Bernoulli variables ψ_u, r∈{0, 1} depicts the code keying and OOK modulation in secure and public channel respectively, θ_r and ϕ_u are the random phases between different time frames, (P_s, T_s, P_p, T_p) represent the initial peak powers and bit period of the secure and public signals, ε∈[-T_p/2,T_p/2 ] is the random time delay between the secure and public signal, the functional form h( ) and k( ) represents the encoded waveforms of bit “1” and bit “0” in the secure channel for M-ary [3] modulation (M=2) and have identical ensemble averages. An example of an encoded waveform h(t) is given by

where φ_n∈[-π, π] is the random phase coded to different spectral chips. C is the number of code chips in the encoding phase mask and Ω = W/C is the bandwidth of a code chip in the phase mask. The ensemble average of the signal intensity for secure user, public user and white Gaussian noise n(t) are

where N_add is the average additive amplifier noise power.

We now consider the individual terms in Eq. (3). The first term corresponds to the intensity autocorrelation of secure signal. By using Eq. (A1) and knowing that h( ) and k( ) have identical ensemble averages, we find

To simplify Eq. (A7), we first define the following functions

When the ensemble averages in Eq. (A7) are computed, we obtain

where the functions A, B and X are specified in Eq. (A8) - Eq. (A10).

The second term in Eq. (3) relates to the intensity autocorrelation of the public signal. When the public signal correlates with itself, ε (the random time delay between public and secure channel) in Eq. (A2) is set to zero as it is redundant and merely shifts time of reference. We therefore obtain

The third term in Eq. (3) relates to the intensity autocorrelation of the additive amplifier noise given by

where the noise is uncorrelated with exponential distribution of the intensity [3].

The cross correlation terms in Eq. (3) between different signal components can be computed by using Eq. (A4) - Eq. (A6). Yet, the second to last term in Eq. (3) which contain the complex conjugate terms can be evaluated using the following

By using Eq. (A4) - Eq. (A15) and substituting them into Eq. (3) we can compute the ensemble average of the intensity autocorrelation R_ff(τ) for signals tapped from the fiber.