Constellation-masked secure communication technique for OFDM-PON

Bo Liu; Lijia Zhang; Xiangjun Xin; Jianjun Yu

doi:10.1364/OE.20.025161

1. Introduction

Passive optical network (PON) has become an interesting solution for next generation fiber to the home (FTTH) access system [1–4]. Due to the rapid growth of the demand on broadband service, evolution towards 40G PON is recently received wide attention around the world. For access network beyond 40 + Gb/s rate, the optical orthogonal frequency division multiplexing (OFDM) system cannot only increase the access rate in a cost-effective manner, but also much more immune to the chromatic dispersion (CD) and polarization mode dispersion [5–8]. Furthermore, it allows far more flexible and fine-grained bandwidth allocation for huge subscribers. Due to the huge increase of subscribers and flexibility, the attractiveness of optical OFDM system has increased the demand for better security in PON access.

Typically, the data encryption is performed at the higher layers of the PON access system. However, it is a risky way to build security on top of an insecure foundation as many motivated research groups revealed [9–11]. Ideally, countermeasures against attacker should be implemented at each layer of the network stacks in order to get robust security. Physical layer encryption can offer a number of advantages over encryption at higher layers, and most notably, that it can intrinsically act as transparent encryption for different data types, while easy to integrate with traditional upper layers encryption techniques [12,13]. Moreover, the physical flexible allocation and excellent digital signal processing characteristics of OFDM signal ensure a convenient operation for physical layer security.

Some efforts have been put on physical layer security in PON, in which optical code division multiplexing (OCDM) is most widely investigated [10,14–16]. However, the code length of OCDM technology is limited by the corresponding optical device and it is not suitable for optical OFDM signal of high peak-to-average power ratio (PAPR). Recently, we have proposed a physical secure strategy for OFDM-PON using chaos scrambling for OFDM subcarriers or time slot [17,18]. It provides a secure solution of OFDM-PON through scrambling OFDM subcarriers.

In this paper, we have proposed and experimentally demonstrated a novel constellation-masked secure communication technique for optical OFDM-PON. Compared with our previous work, the computing complexity of the proposed method can be obviously reduced. Utilizing the feature of parallel subcarriers, the constellation masking is executed both on each subcarrier and among different subcarriers, which is performed by the mask factors. For inter-subcarrier masking, the mask factor of h^th subcarrier is obtained from j^th subcarrier, where h and j are two indexes of OFDM subcarriers. The two-step masking realizes a nonlinear mapping between plaintext and ciphertext. It is difficult to reconstruct the probability model and obtain the secure key through geometric forecasting methods. The encryption is executed on symbol-level and can be applied in high-speed access network. In the experiment, a 15.54 Gb/s constellation-masked 32QAM-OFDM transmission is successfully achieved. This technique doesn’t compromise neither the spectral efficiency of conventional OFDM nor the data throughput.

2. Principle

The schematic diagram of the proposed method is shown in Fig. 1 . After serial-to-parallel (S/P) transform, the QAM mapped symbols are sent for constellation masking. The mask factors include two parts: one is for constellation masking on each subcarrier, and the other is for masking among different subcarriers. In our proposed scheme, we employ an improved Arnold mapping as the parameter function to generate the mask factors, which is represented by

{\begin{cases} x_{n + 1} = x_{n} + y_{n} + r_{x} |_{\mod 1} \\ y_{n + 1} = x_{n} + 2 y_{n} + r_{y} |_{\mod ​ ​ 1} \end{cases}, x_{n} \in [0, 1), y_{n} \in [0, 1)

Here n denotes the n^th iteration, x_n and y_n are the n^th values iterated from Eq. (1), x₀ and y₀ can be arbitrary value between 0 and 1, r_x and r_y are two random numbers, and |_{mod 1} is modulo 1 operation. The Arnold mapping owns a characteristic of repeatedly folding/stretching in a limited area, which means that it has a more complicated phase space and larger Lyapunov exponent. These features ensure the Arnold mapping high-sensitive randomness and suitable for secure system [19]. However, the mapping would go into fixed values when (x_n, y_n) = (0, 0). Thus we employ two constant values r_x and r_y to improve the iteration and key space. In Eq. (1), x_n is used for masking on each subcarrier, and y_n is used for masking among different subcarriers through interleaving.

Fig. 1 Schematic diagram of the proposed method for secure OFDM-PON (S/P: serial to parallel; IFFT: inverse fast Fourier transform).

Download Full Size | PDF

We assume that the number of parallel constellation symbols is N and C_k (k = 1,…, N) is the constellation symbols on the k^th OFDM subcarrier. Because the maximum length of the masking is N, we define the sequences of x_n and y_n as {x_k} $_{k = 1}^{N}$ and {y_k} $_{k = 1}^{N}$ for simplify. First, C_k is masked by a masking factor σ_k, which can be expressed as

C'_{k} = C_{k} \cdot e^{j σ_{k}}, 1 \leq k \leq N

σ_{k} = \frac{\log (k + 1) \cdot x_{k}}{\log N} \times 2 π

With {x_k}

_{k = 1}^{N}

and Eq. (2), the constellation symbols on the k^th subcarrier are masked with a random phase angle. There log(k + 1)/logN acts as weighting coefficient. Larger number of N will lead to more fine-grained weighting coefficient. Then C’_k would go through inter-subcarriers constellation masking with {y_k}

_{k = 1}^{N}

. The inter-subcarriers masking can enhance the unpredictable nature of masking and significantly increase the strength of the secure key. The mask factor of inter-subcarriers masking is obtained from the original QAM symbols. To enhance the variability of masking, we employ an interleave length defined as Q. In Eq. (1) we have y_k∈[0, 1), so we divided the interval [0, 1) into Q sub-intervals, which is defined as

f (q) \in [\frac{q - 1}{Q}, \frac{q}{Q}), q = 1, 2, ..., Q

Here Q is an integer and Q determines the masking granularity and can vary from 1 to N, which depends on the requirement of the ONU. If y_k belongs to some sub-interval [q-1/Q, q/Q), the q^th OFDM subcarrier will be used for masking symbol of k^th OFDM subcarrier, which is presented as

C "_{k} = C'_{k} \cdot A r g (C_{q})

where Arg(•) represents the angle of the symbol. Because the values of (x_n, y_n) obey uniform distribution in the area of [0, 1) х [0, 1) and the mapping results are unpredictable parameters, the inter-subcarriers masking operation would randomly choose q^th subcarrier to mask the k^th subcarrier. The range of the chosen subcarrier depends on the value of Q. Larger value of Q can lead to more secure masking.

The double constellation masking can expand the control parameters and effectively avoid mapping reconstruction when a period of continuous plaintext and ciphertext are intercepted by the illegal ONU. The constellation-masked OFDM signal can be expressed as

\begin{array}{l} s_{t} = \sum_{k = 1}^{N} C "_{k} \times \exp [j 2 π f_{k} \frac{(n - 1) T_{s}}{N}] \\ = \sum_{k = 1}^{N} C'_{k} \cdot {A r g (C_{q}) |}_{q \in [1, Q]} \times \exp [j 2 π f_{k} \frac{(n - 1) T_{s}}{N}] \end{array}

Here f_k is the k^th OFDM subcarrier and f_k = (k-1)/T_s.

In order to enhance the secure key strength, r_x and r_y in Eq. (1) are refreshed to dynamically update the mask factors, and the update time is integer times of OFDM symbol length which defined as t. Here we rewrite r_x and r_y as r_x,t and r_y,t respectively, and the initial values with t = 0 are pre-shared at the OLT and ONU. The refreshed values can be obtained by

{\begin{cases} r_{x, t + 1} = {[r_{x, t} + \cos (\sum_{k = 1}^{N} x_{k})] |}_{\mod 1} \\ r_{y, t + 1} = {[r_{y, t} + \cos (\sum_{k = 1}^{N} y_{k})] |}_{\mod 1} \end{cases}

When the system update the mask factors, r_{x,t + 1} and r_{y,t + 1} are used to iterate the new sequences with Eq. (1). It is determined by the previous r_x and r_y as well as the previous sequences {x_k}

_{k = 1}^{N}

and {y_k}

_{k = 1}^{N}

, which ensure a strengthened key for the system. The secure key is consisting of initial values, interleave length and the update time. At the ONU, the encrypted data is recovered with application of the inverse operation. In our proposed scheme, the constellation masking is executed once and it can be extended to more times according to the system requirement.

3. Experiment and results

We verify our proposed method by experiment and the details of experimental setup are illustrated in Fig. 2 , which includes two regular ONUs and one illegal ONU. At the OLT, the encrypted OFDM stream is generated through DSP processing offline. Firstly, the pseudo random binary sequence (PRBS) with word length of 2¹¹-1 is mapped into 32QAM symbols. Then it would experience the constellation masking. In the experiment, the number of parallel symbols is N = 256. The initial values of (x₀, y₀) and (r_x,0, r_y,0) are pre-shared between the OLT and ONU. The pre-sharing is realized as follows: when an ONU is authorized by the OLT, it will randomly generate a key named KEY1 and send to OLT. After receiving KEY1, OLT would send the pre-shared information named KEY2 to the ONU, which is encrypted with KEY1. Then the ONU/RRU will use KEY2 as the communication key. ONU-1 and ONU-2 adopt different interleave lengths and inter-subcarrier masking constant. After constellation masking, the data symbols performs OFDM modulation as regular OFDM signal. Pilots are inserted every 32 subcarriers, and the cyclic prefix and guard interval length are both 1/16 length of OFDM symbols. An IFFT size of 280 is chosen for data carrying OFDM symbols as well as pilots and guard interval band. In our experiment, the OFDM signal is digitally up-converted to produce a real signal and uploaded into arbitrary waveform generator (AWG71222B) with 10Gs/s sample rate to produce electrical signal waveform. The electrical spectrum of constellation-masked 32QAM-OFDM signal is shown in Fig. 3(a) , where we can get a data rate of 15.54 Gb/s with 3.4 GHz bandwidth. The encryption scheme doesn’t cause any change in the power density. Figure 3 also shows the constellation before and after masking in back-to-back (b2b) case, where all the 32QAM symbols are masked with same masking factors and Q = 128. After constellation unmasking, the symbols are correctly recovered with the dedicated secure key. For the illegal ONU, it looks like a signal totally ruined by the phase noise if no aware of the mask factors as shown in Fig. 3(e). Eavesdropping from illegal ONU can be eliminated at the physical layer. A commercial CW laser at 1552.15 nm is employed as the light source, and the output OFDM signal is directly modulated onto the optical carrier through a Mach-Zehnder modulator (MZM) working in the linear area at 1.7V with half-wave voltage of 3.5V. Then the optical signal is sent into the 25km single mode fiber link after amplified by a commercial EDFA. The transmitted optical power is sent at 2 dBm.

Fig. 2 Details of experimental setup (MZM: Mach-Zehnder modulator; PSC: power splitter/combiner).

Download Full Size | PDF

Fig. 3 (a) electrical spectrum of OFDM signal; (b) 32QAM before constellation masking, electrical b-2-b; (c) 32QAM after constellation masking, electrical b-2-b; (d) 32QAM after constellation unmasking, electrical b-2-b; (e)32QAM with wrong unmasking, electrical b-2-b.

Download Full Size | PDF

After transmission, the signal is split by a 1:4 power splitter/combiner (PSC) and then sent to the ONU side. A commercial photodiode (PD) with a bandwidth of 10 GHz is adopted for O/E conversion. A real-time oscilloscope (TDS) with a sampling rate of 20 GS/s is used for analog-to-digital conversion (ADC). The flow of the offline DSP stages is as follows: 1) synchronization and frequency offset estimation; 2) channel estimation; and 3) constellation unmasking.

In this scheme, the ciphertext is the masked symbols on OFDM subcarriers. Compared with our previous work, the computational complexity of ciphertext generation is reduced because there is no need to traversal the whole domain of [0, 1). In this scheme, the computational complexity equals N, where N is the number of OFDM subcarriers. For the previous method, the Logistic iteration will continue until transverse all the sub-domains to generate the scrambling matrix, which lead to a computational complexity of 3 × N. Thus the complexity is only 1/3 of the previous method. The total computational complexity is consisting of two parts: one is generation of ciphertext, and the other is OFDM modulation, which is realized by IFFT. Because the complexity of IFFT is Nхlog(N), 1/(1 + log(N)) of total computational complexity is consumed by ciphertext generation. In our experiment, we have N = 256 and this percentage is about 29% considering the pilots and guard interval band.

For a good encryption system, the key space should be large enough to resist the exhaustive attack. In our propose scheme, where double-precision float value is used, the secure key can be written as (x₀, y₀, r_x,0, r_y,0, Q, t). The key space would be 6.675 × Q × 10⁹⁴, where Q is an arbitrary integer less than N. In the experiment, we have N = 256 and the exhaustive trial will be 1.71 × 10⁹⁷ for the illegal ONU. The trial number of the previous method is 3 × 10²¹⁵, which is mainly due to the larger complexity. The fastest computing speed is about 2.5 × 10¹³/s [20] and it will even take about 2.2 × 10⁷⁸ years to try the possible keys of constellation-masked technology, which is impossible to decrypt it.

The generation of mask factor is very sensitive to the initial secure key and a tiny change would lead to a totally different mask factors. Figure 4 illustrates the change of iteration sequences {x_n} $_{1}^{64}$ and {y_n} $_{1}^{64}$ under slightly different tested keys. The parameters of tested keys are the same except x₀, and the difference Δx₀ = 0. 00000000000001. We can see that both {x_n} and {y_n} sequences using the two tested key show no similarity at all during the two iterations, and the proposed scheme is highly sensitive to the key. Thus there are enough secure keys allocate to the ONUs in OFDM-PON.

Fig. 4 The iteration sequences of {x_n} $_{1}^{64}$ and {y_n} $_{1}^{64}$ under slightly different tested keys (blue line: x₀ = 0.54776634284971; red line: x₀ = 0.54776634284972).

Download Full Size | PDF

Figure 5 illustrates the measured bit error ratio (BER) with and without constellation masking. In the experiment, the two regular ONUs occupy different time slots and we adopt Q = 128, t = 1.19ms. We can see that with dedicated secure key, the information can be correctly recovered at the ONU side and the power penalty is about 0.4 dB at BER of 10⁻³ after transmission for both ONU-1 and ONU-2. The BER curves for mutual decryption between the two ONUs are also shown in Fig. 5, where the BER is about 0.5 for both ONUs. The corresponding constellation maps are shown as insets in Fig. 5. We also compare the BER performance with our previous chaos scrambling method, which is also shown in Fig. 5. For the previous method, the BER with wrong key is around 0.4 instead of maximum value of 0.5, which is mainly due to the limitation of the scrambling size.

Fig. 5 The measured BER curves for regular ONUs.

Download Full Size | PDF

Figure 4 has demonstrated that tiny difference in Eq. (1) would lead to a totally different mask factors. There we evaluate the performance of illegal ONU with different mask factors and interleave length. The measured BER curves of the illegal ONU with different trying keys are shown in Fig. 6 . The red curve is the demodulation result with different mask factor. It is clear that the illegal ONU has a BER of 0.5, which means that it can’t demodulate the useful data intended for the regular ONU. The black curve is the demodulation result when the secure key is same with regular ONU except the interleave length Q. We can see that the BER drops a little when Q is near 128. When Q is near 128, the number of sub-intervals from Eq. (3) is close to the regular ONU, which increase the probability of chosen subcarriers. However, it still maintains a BER beyond 0.49 and the information cannot be obtained by the illegal ONU.

Fig. 6 The measured BER of the illegal ONU.

Download Full Size | PDF

4. Conclusion

This paper proposed and experimentally demonstrated a novel constellation-masked secure communication technique in application of OFDM-PON. It provides a dynamic constellation masking from single subcarrier to multiple subcarriers. The interleave length and update time can increase the security level and scalability. Constellation-masked encryption can be easily integrated in OFDM-PON. A 15.54 Gb/s constellation-masked 32QAM-OFDM downstream signal is successfully demonstrated in the experiment. The high key sensitivity, enough key space, scalable granularity and dynamic key update ensure a secure communication while reduces the computational complexity of ciphertext generation by 66%. The experiment results suggest an effective solution for the physical secure communication in OFDM-PON.

Acknowledgment

The financial supports from National Basic Research Program with No. 2010CB328300, National High Technology 863 Program with No.2012AA011300, National International Technology Cooperation with No.2012DFG12110 and National NSFC with No. 60932004, 61077050, 61077014, 61205066, 61275074 are gratefully acknowledged. The project is also supported by the Fundamental Research Funds for the Central Universities with No. 2012RC0311.

References and links

1. S. Jain, F. Effenberger, A. Szabo, and A. Zhishan Feng, “Forcucci, Wei Guo, Yuanqiu Luo, R. Mapes, Yixin Zhang, and V. O’Byrne, “The XG-PON system: cost effective 10Gb/s access,” J. Lightwave Technol. 29(4), 403–409 (2011).

2. J. Chen, L. Wosinska, C. Machuca, and M. Jaeger, “Cost vs. reliability performance study of fiber access network architectures,” IEEE Commun. Mag. 48(2), 56–65 (2010). [CrossRef]

3. S. Jain, F. Effenberger, A. Szabo, A. Zhishan Feng, A. Forcucci, R. Wei Guo, R. Yuanqiu Luo, Mapes, Yixin Zhang, and V. O’Byrne, “The world’s first XG-PON field trial,” J. Lightwave Technol. 29(4), 524–528 (2011). [CrossRef]

4. D. Qian, N. Cvijetic, J. Hu, and T. Wang, “108 Gb/s OFDMA-PON with polarization multiplexing and direct detection,” J. Lightwave Technol. 28(4), 484–493 (2010). [CrossRef]

5. N. Cvijetic, “OFDM for next-generation optical access networks,” J. Lightwave Technol. 30(4), 384–398 (2012). [CrossRef]

6. H.-Y. Chen, C. C. Wei, D.-Z. Hsu, M. C. Yuang, J. Chen, Y.-M. Lin, P.-L. Tien, S. S. W. Lee, S.-H. Lin, W.-Y. Li, C.-H. Hsu, and J.-L. Shih, “A 40-Gb/s OFDM PON system based on 10-GHz EAM and 10-GHz direct-detection PIN,” Photon.Technol. Lett. 24(1), 85–87 (2012). [CrossRef]

7. J. L. Wei, A. Hamié, R. P. Gidding, E. Hugues-Salas, X. Zheng, S. Mansoor, and J. M. Tang, “Adaptively modulated optical OFDM modems utilizing RSOAs as intensity modulators in IMDD SMF transmission systems,” Opt. Express 18(8), 8556–8573 (2010). [CrossRef] [PubMed]

8. W. Shieh, “OFDM for flexible high-speed optical networks,” J. Lightwave Technol. 29(10), 1560–1577 (2011). [CrossRef]

9. S. Etemad, A. Agarwal, T. Banwell, G. D. Crescenzo, J. Jackel, R. Menendez, and P. Toliver, “An overlay photonic layer security approach scalable to 100 Gb/s,” IEEE Commun. Mag. 46(8), 32–39 (2008). [CrossRef]

10. G. Cincotti, V. Sacchieri, G. Manzacca, N. Kataoka, N. Wada, N. Nakagawa, and K. Kitayama, “Physical layer security: All-optical cryptography in access networks,” in Proc. ICTON’08, paper.We.A4.2 (2008).

11. M. Hossen, K.-D. Kim, and Y. Park, “Synchronized latency secured MAC protocol for PON based large sensor network”, in Proc. ICACT’10, 1528–1532(2010).

12. M. P. Fok, Z. Wang, Y. Deng, and P. R. Prucnal, “Optical layer security in fiber-optic networks,” IEEE Trans. Inf. Forensics Security 6(3), 725–736 (2011). [CrossRef]

13. A. Harris, D. R. Jones, K. H. Horbatuck, and A. Sierra, “A novel wavelength hopping passive optical network (WH-PON) for provision of enhanced physical security,” J. Opt. Comm. Netw. 4(3), 289–295 (2012). [CrossRef]

14. I. Choi, R. J. Young, and P. D. Townsend, “Quantum key distribution on a 10Gb/s WDM-PON,” Opt. Express 18(9), 9600–9612 (2010). [CrossRef] [PubMed]

15. P. R. Prucnal, M. P. Fok, Y. Deng, and Z. Wang, “Physical layer security in fiber-optic networks using optical signal processing,” in Proc. ACP’09, China, paper.76321M–10 (2009).

16. G. Cincotti, N. Wada, and K. Kitayama, “Secure optical bit- and block-cipher transmission using a single multiport encoder/decoder,” in Proc. OFC’08, USA, paper.JThA93 (2008).

17. L. Zhang, X. Xin, B. Liu, and J. Yu, “Physical-enhanced secure strategy in an OFDM-PON,” Opt. Express 20(3), 2255–2265 (2012). [CrossRef] [PubMed]

18. L. Zhang, X. Xin, B. Liu, and X. Yin, “Physical secure enhancement in optical OFDMA-PON based on two-dimentional scrambling,” in Proc. ECOC’12, paper.P6.01(2012).

19. C. E. Shannon, “Communication theory of secrecy systems,” Bell Syst. Tech. J. 28, 656–715 (1949).

20. M. Christopher, “And the world's fastest supercomputer in 2012 Is - technology review,” website: http://www.technologyreview.com/view/421600/and-the-worlds-fastest-supercomputer-in-2012-is/

Constellation-masked secure communication technique for OFDM-PON

Abstract

1. Introduction

2. Principle

3. Experiment and results

4. Conclusion

Acknowledgment

References and links

Cited By

Figures (6)

Equations (7)

Optics Express