Open Access
Add to BibSonomy
Abstract
In this paper, a scheme to realize encryption and digital identity authentication at the same time is proposed for enhancing the physical-layer security of point-to-point optical links (PPOL). Exploiting identity code encrypted by the key as authentication information effectively resists passive eavesdropping attacks in fingerprint authentication. The proposed scheme theoretically realizes secure key generation and distribution (SKGD) by phase noise estimation of the optical channel and the generation of identity codes with good randomness and unpredictability by the four-dimensional (4D) hyper-chaotic system. The local laser, erbium doped fiber amplifier (EDFA), and public channel provide the entropy source of uniqueness and randomness to extract symmetric key sequences for legitimate partners. The simulation conducted in a quadrature phase shift keying (QPSK) PPOL system over 100km standard single mode fiber verify successfully that 0.95Gbit/s error-free SKGD. The unpredictability and high sensitivity to the initial value and control parameters of the 4D hyper-chaotic system provide a huge space of ~10125 for identity codes, which is sufficient to resist exhaustive attack. With the proposed scheme, the security level of key and identity can be increased markedly.
© 2023 Optica Publishing Group under the terms of the Optica Open Access Publishing Agreement
1. Introduction
Recently, optical networks have attracted much attention because of their huge-capacity and long-reach advantages. As the core element of optical network composition, the point-to-point optical links (PPOL) have been widely deployed from Ethernet systems to telecommunications backbone infrastructure as well as military communication systems [1]. Optical fiber is vulnerable to unpredictable threats, such as fiber tapping, residual crosstalk, and so on [2]. The methods of eavesdropping, masquerade attacks, and jamming attacks in optical networks [3,4] are constantly evolving and mainly considered to occur at the physical-layer [3,5]. These physical-layer attacks are difficult to detect and locate with information-level means [6] due to the transparency of optical networks, which makes physical-layer security become one of the important research fields.
Unauthorized users may seriously threaten the security performance of the entire system by masquerading [7]. At present, several physical-layer fingerprint authentication schemes have been developed and investigated to use the hardware imperfections of transmitter [8,9] and optical spectrum feature [10,11] as fingerprints to identify malicious optical network units in the passive optical network. However, using manufacturing differences between devices of hardware imperfections to represent different identities results in a smaller fingerprint space. Moreover, a possible issue of these schemes is the problem of passive eavesdropping was not taken into account in the process of fingerprint collection, and cannot assure the security of the fingerprint. Passive eavesdropping and identity spoofing attack by coupling fiber are illustrated in Fig. 1. The unauthorized user may detect the optical spectrum or time-frequency waveform of the legitimate fingerprint at a certain point of the target fiber link by fiber tapping and bending. The fingerprint may be analyzed through extensive simulations with a well-designed system. Then, the identity spoofing attack is realized through the imitation of the authorized user. Another recently emerging approach is to use bit error rate (BER) [12] and signal-to-noise ratio (SNR) [13] for identity authentication. However, both BER and SNR are probability values symbolizing channel impairments. Data over different channels may have the same BER and SNR so that the identity is not unique. On the other hand, hyper-chaos system has greater complex in time and space [14], enabling good randomness, unpredictability and sensitivity to the initial values [15–22] which can remove the possibility of any successful brute force attacks and often used in encryption schemes. At present, hyper-chaos have not been used for identity authentication. Therefore, it is expected to discover a digital authentication scheme adopting identity codes generated by hyper-chaos as fingerprints that make authorized users own unique identities and more fingerprint space. However, the secure encryption transmission of fingerprints in process of authentication also needs to be solved.
Fig. 1. Passive eavesdropping and identity spoofing attack by coupling fiber in fingerprint authentication.
Several physical-layer secure key generation and distribution (SKGD) schemes using unique and random characteristics of optical fiber channels as entropy source of shared key have proposed recently [1,23–29], including phase fluctuation between orthogonal polarization modes (OPMs) in delay interferometer (DI) [23], polarization mode dispersion combined with local optical fibers [1], environmental noise of channels transferred by Mach-Zehnder interferometers (MZIs) to random optical signals [24], dynamic stokes parameters tracked by polarization analyzers [25] and polarization scrambling using digital chaos [26–29]. The aforementioned SKGD schemes require additional devices such as DI, local fibers, MZI, polarization analyzer, or spliced polarization maintaining fibers in the PPOL to track the fluctuation of properties, and their error-free transmission distance is less than 100km. Other optical fiber channel characteristics that can be used as entropy sources in optical channels have not been fully explored. Morever, some studies have been proposed to realize physical-layer encryption simply in the digital signal process (DSP) module of transmitter [30,31]. More recently, we proposed a new method [32], which can use the DSP algorithm of coherent receiving to estimate the phase noise to extract the key and realize simple and secure encryption of the transmitted data.
In this paper, we extend this scheme [32], which only enhances the data security of optical communication, proposing and verifying a physical-layer encryption and authentication scheme for the first time that enhances the security of transmitted data and identity simultaneously. SKGD and digital identity authentication are realized by phase noise estimation in the coherent reception of classical optical communications and identity codes generated by the 4D hyper-chaotic system. By utilizing a more detailed analysis of the uniqueness, randomness, and reciprocity of phase noise distribution in the optical channel, we clarify the feasibility of the scheme that authorized users can use the same phase noise estimation algorithm in DSP and post-processing to share highly correlated random phase noise fluctuations and then extract the same key sequences for symmetric cryptography. Note that except for the channel probing process, all operations are done through DSP, there is no additional device. This leads to the natural compatibility of the proposed scheme for the currently deployed infrastructure, avoiding additional optical components for measurement. A 100km error-free key generation rate (KGR) of 0.95Gbit/s (38% BitRate) SKGD and identity codes space of ${~10^{125}}$ are realized by simulation. The waveform correlation between a legitimate partner and a malicious non-intrusive adversary is about 0. The security of data and identity is guaranteed by the proposed scheme, which is analyzed and verified against laser matching difficulty, phase diagram, amplitude, and sensitivity to initial values and control parameters of the 4D hyper-chaotic system.
2. Principles
In this section, theoretical analysis of the physical-layer secure enhancement scheme is presented, including SKGD based on phase noise estimation, identity code generation based on a 4D hyper-chaotic system, and encryption and authentication scheme based on keys and identity codes. The key and identity code are combined as authentication information to realize encryption and authentication at the same time, effectively resisting eavesdropping attacks and identity spoofing attacks.
2.1 SKGD scheme
The schematic diagram of the proposed SKGD scheme that will be implemented before normal communication is depicted in Fig. 2. SSMF stands for standard single mode fiber. Alice and Bob are two legitimate partners in the PPOL that requires secure communication through symmetric encryption, where the same key sequence shared between them is necessary. They coherently receive the probe signals that have experienced the public channel and estimate the phase noise using the phase estimation algorithm with the same parameters and then obtain a highly correlated phase distribution waveform, which will be analyzed and proved later. After post-processing, including quantization, information reconciliation (IR), and privacy amplification (PA), both legitimate partners obtain the same key sequence finally. It is worth noting that Alice and Bob send channel probe signals in coherence time to ensure that they get similar channel characteristics. Morever, we reasonably assume that Alice, Bob, and Eve have exactly the same priors condition, knowing the DSP parameters and the probe signal.
Due to external mechanical vibration interference, temperature change, and other factors, the laser mirror dithering leads to spontaneous radiation. The phase noise of the laser is generated by single spontaneous radiation with random phases varying with time. In optical fiber communication links, the linewidth of the laser, the inherent jitter of other active devices (IJAD), and amplified spontaneous emission (ASE) noise cause the random phase distribution, which is linear phase noise. After dispersion compensation, adaptive equalization, and frequency offset compensation, the ${n_{th}}$ received symbol ${S_n}$ containing phase noise can be expressed as:
where ${A_n}$ and ${\phi _{s,n}}$ represent the amplitude and phase of the modulation signal of the ${n_{th}}$ symbol respectively. ${N_n}$ represents the additive noise caused by spontaneous emission, which obeys a Gaussian distribution with a mean equaling 0. ${\phi _{l,n}}$ represents the phase noise caused by the laser, which obeys the Wiener process [33]: where ${v_i}$ is an independent Gaussian distributed random variable with a mean equal to 0 and its variance is: where ${\Delta v}$ is the sum of the linewidths of the emitting laser and the local oscillator laser, and ${{\rm {T}}_{\rm {s}}}$ is the symbol period. An important conclusion can be drawn from equations (1) and (2) that the phase noise due to spontaneous emission and lasers is a cumulative process. Generally speaking, in the digital signal processing of coherent optical communication, the phase estimation algorithm will be completed in the last step, and the symbol compensated by the carrier phase estimation will directly enter the judgment [34].Combining the above conclusions, a key distribution scheme is designed based on phase noise estimation as shown in Fig. 2. Two lasers are located at Alice and Bob respectively which are used to modulate the signal and serve as the local oscillator light sources for coherent reception. This ensures that the sum of the phase noise due to the laser linewidth estimated by Alice and Bob $({\phi _{LA}} + {\phi _{LB}})$ is the same. Two EDFAs are located at Alice and Bob which ensure that the sum of their measured phase noise $(\phi _{ASE}^{A'} + \phi _{ASE}^{B'})$ due to the ASE noise of amplifier is the same. In addition, the phase noise estimated by Alice caused by the IJAD on the public channel is also the same as estimated by Bob based on channel reciprocity, denoting as $\phi _{\omega t}^{'}$. Therefore, the channel phase noise measured by Alice and Bob is ${\phi _{LA}} + \phi _{ASE}^{A'} + \phi _{\omega t}^{'} + \phi _{ASE}^{B'} + {\phi _{LB}}$.
Both the amplitude fluctuation of the amplifier through the Kerr nonlinear effect and the nonlinear effect (SPM/XPM/FWM) in the fiber link will generate phase modulation, which is nonlinear phase noise. EDFA at both Alice and Bob make the sum of their measured phase noise due to the Kerr effect of the amplifier the same, denoting as $(\phi _{ASE}^{A''} + \phi _{ASE}^{B''})$. Besides, the phase noise caused by nonlinear effects $(\phi _{\omega t}^{''})$ in the optical fiber links measured by Alice and Bob through the public channel is the same. Therefore, the nonlinear phase noise measured by Alice and Bob is $\phi _{ASE}^{A''} + \phi _{\omega t}^{''} + \phi _{ASE}^{B''}$. In conclusion, legitimate partners measure total phase noise $({\phi _{A/B}})$ is ${\phi _{LA}} + \phi _{ASE}^{A} + \phi _{\omega t} + \phi _{ASE}^{B} + {\phi _{LB}}$, where
These phase noises cause the constellation of signals to rotate and spread along the circumference, taking QPSK (4QAM) and 16QAM signals as examples, as shown in Figs. 3(a) and (c). It can be compensated by DSP to reduce the bit error rate, as shown in Figs. 3(b) and (d). Alice and Bob obtain the phase noise estimation values for extracting the symmetric key during the signal compensation process.
With the emergence of DSP chips, it is possible to use DSP algorithms to compensate for optical signals at the receiver. Algorithms in traditional wireless communications are applied to optical coherent receivers, such as Decision-directed [35] carrier recovery algorithms, which require a higher frequency clock signal than the transmission rate and are more suitable for serial processing due to the presence of feedback. The rate of the optical signal is much higher than that of the wireless signal, so the algorithm with feedback is not suitable for the optical communication system. Common feedforward algorithms include phase estimation algorithms based on the M power and blind phase searching (BPS) without feedback structure, so parallel operations can be performed, which greatly reduces the requirements for DSP processing speed. The phase estimation algorithm based on the M power which utilizes the characteristics of the equal interval of a phase of M-PSK signal was first proposed by Viterbi [36]. The structure is simple and it is only suitable for the M-PSK modulation format. In this letter, Alice and bob use the BPS, to estimate the phase noise of the channel, which applies to any M-QAM modulation format [37,38].
It is worth noting that the BPS algorithm is not suitable for real-time signal processing due to its high computational complexity and unsatisfactory bit error rate when processing high-order QAM signals. However, this paper only hopes that the legitimate party can obtain highly similar phase estimation distribution through the phase noise estimation algorithm with the same control parameters, to extract highly similar key sequences. The low-complexity phase estimation algorithm for high-order QAM signals will not be studied in this paper.
The process of the phase noise estimation is depicted in Fig. 4. First, normalize the coherently received signal, and enter the BPS algorithm to estimate the phase noise value. The main principle of BPS is to rotate the received signal $({R_k})$ B times according to divided blocks, and B is the number of test phases. The value of test phases is
When all the constellation points in each block rotate one test phase each time, the Euclidean distance (ED) from the standard constellation point is calculated.
${[X]_D}$ represents the coordinate of the nearest ideal constellation point from X. To smooth the additive noise generated in the optical fiber transmission, calculate the sum of the EDs of consecutive signals in every block, and one of the test phases B which makes the sum of the EDs minimum is obtained, which is set as the phase estimation value of this block ${\phi _{\rm {b}}}$. This will correspond to the Kth key bit. The BPS algorithm has a 4-quadrant phase ambiguity problem. To prevent the phase noise estimation from jumping, it is necessary to add a phase unwinding module to unwind the phase estimation value. Phase noise is a slowly changing signal relative to the signal rate, and the change of phase noise between adjacent symbols is not significant. Therefore, when the estimated value of the adjacent phase exceeds the reasonable range, this feature can be used to correct the phase and finally obtain the correct estimated value of the phase. In addition, slide a window of length 2L (the length of the block, sometimes less than 2L) to estimate the phase value of the block, a key sequence equal to the number of bits of the received signal can be obtained, wherein the upper boundary of the block before the $(L+1)^{th}$ signal is set as the first signal, and similarly, the lower boundary of the block after the $(K-L)^{th}$ signal is set as the last signal.
Alice and Bob obtain highly similar phase noise distribution waveforms through the above phase estimation process. The following three steps (a-c) of post-processing are required to finally get the same key bits to achieve symmetric encryption. a) Quantization: Mapping distribution curves to binary sequences by quantization. At this time, the key bits of Alice and Bob are inconsistent due to the reciprocity of the channel and the error of quantization. It is necessary to eliminate the inconsistent key bits through b) IR and c) PA.
2.2 4D hyper-chaotic system and the generation of identity codes
To meet the requirements of the proposed identity authentication scheme, prevent fingerprints from being counterfeited, and achieve high-security performance, this paper adopts a digital authentication scheme through the identification of the identity code. It is reasonable for the generation algorithm of the identity code to be registered and set before the device leaves the factory, and the legitimate transceiver device has the same control parameter of the generation algorithm of the identity code. The 4D hyper-chaotic system [39] is used to generate identity codes to avoid identity spoofing attacks, which is written as,
Then the identity code can be obtained according to Eq. (10). The identity code combines with the key bits extracted by estimating channel phase noise to complete encryption and identity authentication at the same time.
2.3 Encryption and authentication system
Figure 5 depicts a flowchart of integrated encryption and authentication scheme based on keys and identity codes. First, Alice and Bob use the 4D hyper-chaotic system with the same control parameters to control the generation rules of the identity code and realize the synchronization of the identity code of the legal party. Two legitimate parties send channel detection signals to each other to measure the phase noise change of the common channel and obtain highly similar phase noise distribution curves. Then, the same key sequence is obtained by post-processing these curves. Alice, as the authorized user, uses the secret key to perform a simple XOR encryption on the identity code and then transmits it to the authenticator Bob. Bob decrypts it using the negotiated key and compares the decrypted result with Bob’s identity code. If the result of the comparison is the same, Alice is judged to be legitimate, otherwise, the service will be rejected. The authentication process proposed in this paper includes the generation and distribution of key and identity codes and information authentication. The combination of key and identity code is expected to solve the security problem that fingerprints are easy to be eavesdropped in the existing optical network physical layer hardware identity fingerprint authentication scheme as shown in Fig. 1.
3. Experiment and discussion
3.1 SKGD model and security analysis
To verify the concept and evaluate the feasibility of our scheme, a simulation model for PPOL phase estimation is designed using VPI as shown in Fig. 6. Alice and Bob send the same QPSK format data (Data) as channel detection signals to each other through the Mach-Zehnder modulator (MZM), local amplifiers and 100km fiber link and then receive them coherently respectively $(Data_A, Data_B)$. Finally, the phase noise is estimated by the DSP module. This module is also responsible for identity code generation (IDG). It is worth noting here that the modulation of the transmitted signal and the coherent reception of the local oscillator light source applies the same laser that the line width of Alice and Bob are ${1\times 10^6}$, ${5\times 10^6}$Hz respectively. To characterize the difference between Eve and legal lasers, the linewidth of Eve’s coherent receiving local oscillator laser is set to ${2\times 10^6}$Hz and the position of Eve is at the midpoint of Alice and Bob’s optical fiber channel. Suppose Eve uses the same BPS algorithm as a legitimate partner. The setting of parameters B, L, the number of blocks N in the quantization process, and the influence of different values on the experimental results will be explained later.
The phase noise distributions measured by Alice and Bob are plotted as shown in Fig. 7. It can be found that the two waveforms of Alice and Bob were very similar with respect to time which implies the feasibility of the shared key generation, and the forward and backward fiber Channels are mutual, suggesting that the value of the phase noise estimate can be shared among legitimate partners and applied to extract highly correlated key bits. To increase the phase noise fluctuation rate and thus KGR, the scrambling mechanism is used by chaotic as shown in Fig. 8. The cross-correlation (CC) between the waveforms of Alice and Bob is quantitatively calculated to confirm the similatity, with a maximum correlation coefficient value of 0.996, as shown in Fig. 9(a). Eve’s waveform was completely different from that of Alice. This was also verified by the correlation coefficient ($\approx 0$) as shown in Fig. 9(b).
Fig. 9. (a) Cross-correlation function between Alice’s and Bob’s waveforms. (b) Cross-correlation function between Alice’s and Eve’s waveforms.
To generate error-free and random secret keys, the following post-processing procedures are applied to extract key bits from key waveforms, including quantization, IR, and PA.
(1)Quantization: As shown in Fig. 10, a block-based quantizer is applied.
The value of L is determined by the product of the laser linewidth and the symbol rate. It is a good choice to set the range of ($6 \sim 10$) [38]. In this paper, the laser linewidth is set to 1-5MHz, which is a larger linewidth setting. At the same time, the larger the value of L, the smaller the KER between Alice and Bob. Considering the relationship between phase tracking speed and calculation amount, set L=10. Generally, in the BPS algorithm, for the QPSK signal, B=32, and for the 16-QAM signal, B=64. We did the following simulation tests to verify this general setting. The value of B increases from 5 to 45 with a step size of 5, and the KER changes between Alice and Bob, and Alice and Eve are measured. The simulation test results are shown in Figs. 11(a) and (b).
Fig. 11. (a) The change of KER between Alice and Bob and between Alice and Eve with the number of test phases B. (b) The change of KER between Alice and Bob and Alice and Eve with the number of blocks N in the quantization process.
The settings of the number of test phase B and the number of blocks in the quantization process N follow the following rules: as much as possible between the KER between Alice and Eve, and the calculation of the carrier phase estimation of the calculation and the quantization process is as small as possible. With the increase of B, the accuracy of the algorithm continues to increase, resulting in the estimation of phase noise estimates more accurately, which will lead to the increase in phase noise difference between Alice and BOB or Alice and Eve, which increases the KER. When B increases to 35, (where L=10, N=4096), Alice and Eve’s KER began to change slowly, almost maintained at 44.5%. We set B = 35 with a smaller calculation amount. At the same time, the general setting of B in the BPS algorithm is verified. Similarly, when N increases to 8192, the KER of Alice and Eve starts to change slowly and almost remains at 47.4%. We choose N=8192, which is less computationally intensive than N=16384. The measured KER is shown in Table 1.
Table 1. KER before IR.
(2)IR: The distributed source coding [40] with BCH code (65535,23213) is deployed to remove the quantization error between Alice’s and Bob’s key bits. It provides a correction capability of 3470 error bits for each codeword. After IR, an error-free KGR of 2.5Gbit/s is realized as shown in Table 2. Alice and Bob’s key consistency rate (KCR) is 100%.
Table 2. KER after IR.
(3)PA: The partial information about the negotiated key sequence may be leaked from negotiated information in exchanged parity checks during the IR. To resist this information leakage, PA [41] is performed by hash function resulting in a reduction of the achievable average KGR to 38%BitRate about 0.95Gbit/s. The maximum value of KGR in our scheme is mainly limited by the PA process and the BitRate.
To evaluate the randomness of the generated key sequence, the National Institute of Standards and Technology (NIST) test suite [42] is employed, where all of the 15 sub-tests were implemented using a key length of 1048576. Each subtest will return a P-value indicating randomness in some aspects. It can be found that all 15 sub-tests had P-values greater than 0.01 (the red line) as shown in Fig. 12, which confirms the excellent randomness of the obtained key sequences in the proposed SKGD scheme.
Compared with existing physical-layer SKGD schemes, without an additional device or longer distribution distance is realized in the proposed scheme, as shown in Table 3.
Table 3. Comparison of SKGD schemes.
Algorithmic complexity analysis: We assume that the number of the transmitted keys is N, and the chaotic sequences are also generated. Algorithmic complexity analysis is shown in Table 4. The others stand for operations other than addition and multiplication such as mod, sqrt, and extract, and each operation will increase N. The algorithm time complexity can be expressed as O(N) when dealing with a large number of keys. In addition, it’s worth noting that since phase noise estimation is an essential step in the coherent reception of optical communication, additional algorithms can be avoided.
Table 4. Algorithms complexity analysis.
Security analysis: (1) Analysis of matching difficulty of laser: When Eve eavesdrop on both sides of the common channel (infinitely close to the legitimate one), that is, the same channel length experienced by Alice or Bob, it is extremely difficult to match the laser to the same parameters. The cross-correlation function of the phase noise fluctuation curves measured by Eve and Bob is tested and their KER when the difference between Eve’s laser linewidth and Bob’s laser linewidth varied from 0.1Hz to 4MHz as shown in Fig. 13.
Fig. 13. Cross-correlation(CC) function of the phase noise fluctuation curves measured by Eve and Bob and their KER when the difference between Eve’s laser linewidth and Bob’s laser linewidth varied from 0.1Hz to 4MHz
It can be found that the correlation index of the phase noise curves measured by Eve and Bob decreases sharply and their BER of them rises sharply when the linewidth difference change from 0.1Hz to 0.1MHz. When the laser linewidth difference increases to 4M, the correlation of the phase noise fluctuation curves of Bob and Eve is close to 0, and their KER is close to 50%, which is equivalent to blind guessing. This phenomenon is enough to prove the difficulty of matching the laser linewidth.
If Eve eavesdrop in the middle of the channel between Alice and Bob, the channel length experienced by the channel sounding signal is different from both Alice and Bob, so the phase noise accumulation is different. At this time, even matching the linewidth of Bob’s laser linewidth, Eve cannot get the same key sequence. Even lasers produced from the same batch in the same factory will not have the same linewidth.
(2)Man-in-the-Middle Attacks: a) Phase noise fluctuations collected in the middle of the channel: The same principle as Eve’s inability to eavesdrop in the middle of the channel, Eve also cannot estimate the phase noise of the link with Alice and Bob respectively in the middle of the link, and then combine them to obtain the overall phase noise distribution. b) Identity spoofing attack. In past research work, upper-layer authentication protocols are usually required to prevent identity spoofing attacks. Some studies proposed extracting identity fingerprints from time-domain signals and spectra for identity authentication. Our scheme can resist eavesdropping attacks and identity spoofing attacks at the same time by combining the key and the identity code. c) Signal injection attack. Eve may attempt to interfere by injecting signals in the middle of the link. However, the phase noise is independent of the signal. And in this case, to ensure safe communication, power monitoring can be used as a means for attack detection in practical SKGD [28].
3.2 Security analysis of identity codes
It can be proven that when the control parameters are set as a=35, b=10, c=80, d=0.5, and r=10, the 4D hyper-chaotic system works in a chaotic state using the Lyapunov exponent. The phase diagrams of the hyper-chaotic system in the chaotic state are illustrated in Fig. 14.
Fig. 14. The phase diagrams of the 4D hyper-chaotic system. (a) Y-X, (b) Z-X, (c) W-X, (d) Z-Y, (e) W-Y, (f) W-Z.
These figures show that the hyper-chaotic system has an unpredictable trajectory in any phase projection. To visualize the randomness of a 4D hyper-chaotic system, the amplitude change of the four state variables X, Y, Z, and W during the iteration is plotted in Fig. 15, showing a perfect uniform distribution. To sum up, randomness, unpredictability, and complexity of hyper-chaotic behavior are further verified.
The generation of identity code is controlled by the initial value and control parameters of the 4D hyper-chaotic system. The high sensitivity to the initial values and control parameters is the basis of authentication security to a certain extent, thus the sensitivity of identity code iteration to the key parameters is tested. The partial results after iteration under different parameters are shown in Fig. 16. We set the initial value ${x_0}$ to 0.000000000000000 and 0.000000000000001 with other parameters keeping the same as shown in Fig. 16(a). Similarly, only change the ${y_0}$, ${z_0}$, ${\omega _0}$, ${a_0}$, ${b_0}$, ${c_0}$, ${d_0}$, ${r_0}$ respectively as shown in Figs. 16(b-i). It is obvious that even if there is only a small difference of ${10^{ - 15}}$ or ${10^{-10}}$ in the key parameter, the identity code after iterations will be completely different. It proves that no effective information can be restored even if the parameter with only a slight difference is used for authentication for illegal attackers. So it provided identity code space is ${({10^{15}})^7}{({10^{10}})^2} = {10^{125}}$, which is sufficient to resist exhaustive attack. The identity code generated by using the randomness, unpredictability, complexity and initial value sensitivity of the chaotic system makes the identity of the legitimate partner difficult to be counterfeited.
Fig. 16. The sensitivity of the identity code generated by the 4D hyper-chaotic system. (a) Only change the initial value ${x_0}$ ($\Delta {x_0} = {10^{-15}}$);(b)Only change the initial value ${y_0}$ ($\Delta {y_0} = {10^{-15}}$);(c)Only change the initial value ${z_0}$ ($\Delta {z_0} = {10^{-15}}$);(d)Only change the initial value ${\omega _0}$ ($\Delta {\omega _0} = {10^{-15}}$);(e)Only change the control parameter a ($\Delta a = {10^{ - 10}}$);(f)Only change the control parameter b ($\Delta b= {10^{ - 15}}$);(g)Only change the control parameter c ($\Delta c = {10^{ - 10}}$);(h)Only change the control parameter d ($\Delta d = {10^{ - 15}}$);(i)Only change the control parameter r ($\Delta r = {10^{ - 10}}$).
4. Conclusions
A physical-layer security enhancement scheme is proposed and fully analyzed that implements encryption and authentication at the same time. The scheme provides theoretically a high level of security against eavesdropping and identity spoofing attacks. In a PPOL, two lasers are located at the Alice and Bob respectively which are used to modulate the signal and serve as the local oscillator light sources for coherent reception that make Alice and Bob use similar phase noise fluctuation in the public channel as a random entropy source to estimate the phase noise using DSP, and complete SKGD finally. Notably, the technology requires no additional tracking or monitoring equipment. Moreover, the 4D hyper-chaotic system is used to generate the identity code which is used as the authentication information after being encrypted by key bits and then complete encryption and authentication in the same fiber channel. A PPOL phase noise estimation simulation model is designed for SKGD and identity code generation which achieves error-free symmetric encryption of 0.95Gbit/s (38% BitRate) and provides a huge identity codes space of ${~10^{125}}$ that removes the possibility of any successful bruteforce attacks. The phase diagram and the change of amplitude of the state variable of the chaotic system prove its randomness, estimation unpredictability, and complexity. Finally, the sensitivity of the initial value and control parameter is verified. Overall, the use of channel characteristics combined with DSP algorithms and digital chaos to realize the integration of encryption and authentication is an enabling technology to enhance the physical layer security of optical networks.
Funding
National Natural Science Foundation of China (61831003, 62021005).
Disclosures
The authors declare no conflicts of interest.
Data availability
Data underlying the results presented in this paper are not publicly available at this time but may be obtained from the authors upon reasonable request.
References
1. I. U. Zaman, A. B. Lopez, M. A. A. Faruque, and O. Boyraz, “Physical layer cryptographic key generation by exploiting pmd of an optical fiber link,” J. Lightwave Technol. 36(24), 5903–5911 (2018). [CrossRef]
2. K. Shaneman and S. Gray, “Optical network security: technical analysis of fiber tapping mechanisms and methods for detection & prevention,” in IEEE MILCOM 2004. Military Communications Conference, 2004., vol. 2 (2004), pp. 711–716 Vol. 2.
3. M. Medard, D. Marquis, R. A. Barry, and S. G. Finn, “Security issues in all-optical networks,” IEEE Network 11(3), 42–48 (1997). [CrossRef]
4. M. Furdek, N. Skorin-Kapov, S. Zsigmond, and L. Wosinska, “Vulnerabilities and security issues in optical networks,” in 2014 16th International Conference on Transparent Optical Networks (ICTON), (IEEE, 2014), pp. 1–4.
5. A. Lazzez, “Notice of violation of ieee publication principles: All-optical networks: Security issues analysis,” J. Opt. Commun. Netw. 7(3), 136–145 (2015). [CrossRef]
6. M. Furdek and N. Skorin-Kapov, “Physical-layer attacks in transparent optical networks, optical communications systems,” Dr. Narottam Das (Ed.) (2012).
7. K. Merchant, S. Revay, G. Stantchev, and B. Nousain, “Deep learning for rf device fingerprinting in cognitive communication networks,” IEEE J. Sel. Top. Signal Process. 12(1), 160–167 (2018). [CrossRef]
8. S. Li, M. Cheng, Y. Chen, C. Fan, L. Deng, M. Zhang, S. Fu, M. Tang, P. P. Shum, and D. Liu, “Enhancing the physical layer security of ofdm-pons with hardware fingerprint authentication: A machine learning approach,” J. Lightwave Technol. 38(12), 3238–3245 (2020). [CrossRef]
9. S. Li, M. Cheng, Y. Chen, L. Deng, M. Zhang, S. Fu, P. Shum, and D. Liu, “Enhancing the security of ofdm-pons with machine learning based device fingerprint identification,” in 45th European Conference on Optical Communication (ECOC2019), (2019), pp. 1–4.
10. Y. Li, N. Hua, J. Li, Z. Zhong, S. Li, C. Zhao, X. Xue, and X. Zheng, “Optical spectrum feature analysis and recognition for optical network security with machine learning,” Opt. Express 27(17), 24808–24827 (2019). [CrossRef]
11. Y. Li, N. Hua, C. Zhao, H. Wang, R. Luo, and X. Zheng, “Real-time rogue onu identification with 1d-cnn-based optical spectrum analysis for secure pon,” in Optical Fiber Communication Conference (OFC) 2019, (Optica Publishing Group, 2019), p. Tu3B.3.
12. X. Wang, Y. Li, Y. Zhao, C. Lei, H. Zhang, and J. Zhang, “Physical layer authentication based on ber measurement of optical fiber channel,” IEEE Access 8, 101812–101823 (2020). [CrossRef]
13. X. Wang and J. Zhang, “A physical layer authentication method based on optical channel dynamic feature snr,” in 2020 Asia Communications and Photonics Conference (ACP) and International Conference on Information Photonics and Optical Communications (IPOC), (2020), pp. 1–3.
14. Z.-l. Zhu, Q. Zhang, H. Yu, and J. Gao, “A new hyper-chaos generated from chen’s system via an external periodic perturbation,” in 2009 International Workshop on Chaos-Fractals Theories and Applications, (IEEE, 2009), pp. 260–266.
15. X. Yang, Z. Shen, X. Hu, and W. Hu, “Physical layer encryption algorithm for chaotic optical ofdm transmission against chosen-plaintext attacks,” in 2016 18th international conference on transparent optical networks (ICTON), (IEEE, 2016), pp. 1–5.
16. L. Liu, X. Tang, X. Jiang, Z. Xu, F. Li, Z. Li, H. Huang, P. Ni, L. Chen, L. Xi, and X. Zhang, “Physical layer encryption scheme based on cellular automata and dna encoding by hyper-chaos in a co-ofdm system,” Opt. Express 29(12), 18976–18987 (2021). [CrossRef]
17. X. Tang, Z. Xu, F. Li, Z. Li, L. Liu, C. Yang, H. Huang, L. Chen, and X. Zhang, “A physical layer security-enhanced scheme in co-ofdm system based on cijs encryption and 3d-lscm chaos,” J. Lightwave Technol. 40, 3567–3575 (2022). [CrossRef]
18. T. Wu, C. Zhang, Y. Chen, M. Cui, H. Huang, Z. Zhang, H. Wen, X. Zhao, and K. Qiu, “Compressive sensing chaotic encryption algorithms for ofdm-pon data transmission,” Opt. Express 29(3), 3669–3684 (2021). [CrossRef]
19. M. Cui, Y. Chen, C. Zhang, X. Liang, T. Wu, S. Liu, H. Wen, and K. Qiu, “Chaotic rna and dna for security ofdm-wdm-pon and dynamic key agreement,” Opt. Express 29(16), 25552–25569 (2021). [CrossRef]
20. Z. Zhang, Y. Luo, C. Zhang, X. Liang, M. Cui, and K. Qiu, “Constellation shaping chaotic encryption scheme with controllable statistical distribution for ofdm-pon,” J. Lightwave Technol. 40(1), 14–23 (2022). [CrossRef]
21. Y. Zhang, N. Jiang, A. Zhao, S. Liu, J. Peng, L. Chen, M. P. Lavery, H. T. Abbas, and K. Qiu, “Security enhancement in coherent ofdm optical transmission with chaotic three-dimensional constellation scrambling,” J. Lightwave Technol. 40(12), 3749–3760 (2022). [CrossRef]
22. Y. Luo, C. Zhang, X. Liang, J. Peng, B. Liu, and K. Qiu, “Secure ofdm-pon using three-dimensional selective probabilistic shaping and chaos,” Opt. Express 30(14), 25339–25355 (2022). [CrossRef]
23. A. A. Hajomer, X. Yang, A. Sultan, and W. Hu, “Key distribution based on phase fluctuation between polarization modes in optical channel,” IEEE Photonics Technol. Lett. 30(8), 704–707 (2018). [CrossRef]
24. C. Huang, P. Y. Ma, E. C. Blow, P. Mittal, and P. R. Prucnal, “Accelerated secure key distribution based on localized and asymmetric fiber interferometers,” Opt. Express 27(22), 32096–32110 (2019). [CrossRef]
25. L. Zhang, A. A. Hajomer, X. Yang, and W. Hu, “Error-free secure key generation and distribution using dynamic stokes parameters,” Opt. Express 27(20), 29207–29216 (2019). [CrossRef]
26. A. A. Hajomer, L. Zhang, X. Yang, and W. Hu, “Accelerated key generation and distribution using polarization scrambling in optical fiber,” Opt. Express 27(24), 35761–35773 (2019). [CrossRef]
27. L. Zhang, A. Hajomer, X. Yang, and W. Hu, “Secure key generation and distribution using polarization dynamics in fiber,” in 2020 22nd International Conference on Transparent Optical Networks (ICTON), (IEEE, 2020), pp. 1–4.
28. A. A. Hajomer, L. Zhang, X. Yang, and W. Hu, “284.8-mb/s physical-layer cryptographic key generation and distribution in fiber networks,” J. Lightwave Technol. 39(6), 1595–1601 (2021). [CrossRef]
29. L. Zhang, A. A. E. Hajomer, W. Hu, and X. Yang, “2.7 gb/s secure key generation and distribution using bidirectional polarization scrambler in fiber,” IEEE Photonics Technol. Lett. 33(6), 289–292 (2021). [CrossRef]
30. L. Jiang, Y. Pan, A. Yi, J. Feng, W. Pan, L. Yi, W. Hu, A. Wang, Y. Wang, Y. Qin, and L. Yan, “Trading off security and practicability to explore high-speed and long-haul chaotic optical communication,” Opt. Express 29(8), 12750–12762 (2021). [CrossRef]
31. L. Zhang, X. Huang, W. Hu, and X. Yang, “Point to multi-point physical-layer key generation and distribution in passive optical networks,” Opt. Lett. 46(13), 3223–3226 (2021). [CrossRef]
32. D. Wang, H. Wang, and Y. Ji, “Physical-layer secure key generation and distribution by estimating phase noise of optical fiber link,” (Shanghai, China, 2021), pp. CIC; COS; IEEE Photonics Society; Optica; SPIE –.
33. S. M. Bilal, A. Carena, C. Fludger, and G. Bosco, “Dual stage cpe for 64-qam optical systems based on a modified qpsk-partitioning algorithm,” IEEE Photonics Technol. Lett. 26(3), 267–270 (2014). [CrossRef]
34. A. P. T. Lau, Y. Gao, Q. Sui, D. Wang, Q. Zhuge, M. H. Morsy-Osman, M. Chagnon, X. Xu, C. Lu, and D. V. Plant, “Advanced dsp techniques enabling high spectral efficiency and flexible transmissions: toward elastic optical networks,” IEEE Signal Process. Mag. 31(2), 82–92 (2014). [CrossRef]
35. T. Pfau, “Carrier recovery algorithms and real-time dsp implementation for coherent receivers,” in Optical Fiber Communication Conference, (Optica Publishing Group, 2014), p. W4K.1.
36. A. J. Viterbi and A. M. Viterbi, “Nonlinear estimation of psk-modulated carrier phase with application to burst digital transmission,” IEEE Trans. Inf. Theory 29(4), 543–551 (1983). [CrossRef]
37. S. T. Le, P. A. Haigh, A. D. Ellis, and S. K. Turitsyn, “Blind phase noise estimation for co-ofdm transmissions,” J. Lightwave Technol. 34(2), 745–753 (2016). [CrossRef]
38. T. Pfau, S. Hoffmann, and R. Noe, “Hardware-efficient coherent digital receiver concept with feedforward carrier recovery for m -qam constellations,” J. Lightwave Technol. 27(8), 989–999 (2009). [CrossRef]
39. L. Tang, Q. Zuo, and W. Cui, “Synchronization scheme using four-dimensional chaotic system for OFDM,” Journal on Communications 31, 73–84 (2010).
40. S. S. Pradhan and K. Ramchandran, “Distributed source coding using syndromes (discus): Design and construction,” IEEE Trans. Inf. Theory 49(3), 626–643 (2003). [CrossRef]
41. U. Maurer and S. Wolf, “Secret-key agreement over unauthenticated public channels. ii. privacy amplification,” IEEE Trans. Inf. Theory 49(4), 839–851 (2003). [CrossRef]
42. A. Rukhin, J. Soto, J. Nechvatal, M. Smid, and E. Barker, “A statistical test suite for random and pseudorandom number generators for cryptographic applications,” Tech. rep., Booz-allen and hamilton inc mclean va (2001).
