MILCOM 2004 - 2004 IEEE Military Communications Conference

OPTICAL NETWORK SECURITY: TECHNICAL ANALYSIS OF FIBER TAPPING

MECHANISMS AND METHODS FOR DETECTION & PREVENTION
BY
Keith Shaneman & Dr. Stuart Gray
Coming Inc.
Coming, New York

ABSTRACT over data networks. In order to mitigate this threat and

Increasing emphasis 5n reliable datu transmission for comply with TEMPEST regulations, the Committee on
homeland security and network-centric operations National Security Systems has established specific
makes secure communications a critical component of physical installation guidelines to protect sensitive
national security. Whilefiber optic cables are immune to information from being compromised intentionally or
typical EMURFI issues associated with TEMPEST- unintentionalLy through CE. Since copper cables are
related compromising emanations, it is possible to very susceptible to electromagnetic and radio-frequency
successfilly intercept an optical signal if risk areas are interference, they must be installed maintaining strict
not understood and if detection and/or prevention separation guidelines by classification, and be encased
mechanisms are not actively integrated into network by electro-magnetic tubing (EMT) to control CEs and
management practices. provide physical deterrence and protection from
intruders,
There clre several ways to 'tap' into an optical fiber
including fiber bending, splitting, evanescent coupling, In contrast, fiber optical cables are not susceptible to
scattering, and V-grooves. Many of these techniques electromagnetic and radio-frequency interference and
would require the use of cumbersome and sophisticated produce no compromising emanations since the signal
equipment to alter the physical characteristics of the being transmitted is optical instead of electrical.
fiber in the field with a significant risk of damaging or However, depending on the installation and regional
breaking the fiber and having the optical intercept be threat-level, often fiber optic cables are still installed
detected by the end user. Out of all the techniques, the inside of EMT to provide greater physical deterrence and
bentfiber tup is the most easily deployed to couple light protection of the secure infrastructure.
out of the fiber with minimal risk of damage or
FIBER TAPPING OVERVLEW
detection. This paper will focus on quaatifuing the bend
loss required to successfully tap a signal propagating in While fiber optic cables are exponentially more secure
a single mode fiber and analyzing the properties of the than comparable copper cables, it is still possible to
bend that could be used to detect that a bent fiber tap is intercept the optical signals being transmitted across a
occurring. network. However, all forms of fiber tapping and
optical intercepts involve accessing the fibers contained
Understanding the mechanisms used fur fiber-tapping
within an optical cable. In order to understand the
provides greater insight into ways io actively detect
various methods to intercept optical signals, it is
unauthorized optical intercepts or compromised network
important to first understand how optical fiber and cable
security. Enhanced monitoring techniques enable the
is constructed.
detection and localization of fiber taps. These
techniques include optical amplifiers with embedded Optical fiber contains two
tamper detection features and enhanced optical time primary components: the core
domain reflectometer applications for localization of and cladding. The core of the
suspected tupping events. These monitoring techniques optical fiber is the area in
will be reviewed with detailed analysis of each method's which light is carried from Core
effectiveness in detecting bent fiber taps and cost- one end of the network to the
efectiveness for integration into optical networks. other. The cladding protects
the core of the fiber, and creates a boundary layer along
SECURITY OF OPTICAL FIBER
the outer edge of the core that allows the light to reflect
For decades, Compromising Emanations (CE) of copper inside of the core - resulting in very little loss or
cabIing and equipment has been a major threat to the attenuation as the optical signal is transmitted over long
secure transmission of National Security Information

02004 IEEE
0-7803-8847-X/04/$20.00 71 1
distances and creating a condition called ‘Total Internal The goal of an intruder would be to use the minimum
Reflection.’ bend loss required to tap a discernable data signal
without inteipting the optical signal in its entirety or
In order for an optical signal to be tapped or intercepted, damaging the fiber (both of which would create an
the core of the fiber carrying the traffic must be
Interruption of Signal alarm fiom the connecting switch
compromised or ‘tapped.’ In order to access the core of
and result in Security services being dispatched.). If an
a fiber, an intruder must first physically access the fibers
optimal fiber bend tap is achieved, the signal
within the optical cable.
degradation will be minimal and only detectable through
on-going network monitoring and testing.
2) Optical Splitting: An optical splitter works very
much in the same manner as a coax splitter for
‘R televisions - it ‘splits’ a single optical signal into two
identical signals. However, in order for the device to be
installed, the target fiber must be cut and both ends
spIiced onto the optical splitter. Once the fibers are
accessed within the cable, the splicing of the fibers onto
the optical splitter could take as little 2-3 minutes
Figure 1. Optical Cable Cross-section
depending on the splicing method used.
The figure above depicts a standard indoor, dielectric
cable with 24-fibers. In order to access the fibers, an
intruder would have to either access a terminated end of
the cable where the fibers are exposed (usually inside of
a Controlled Access Area and/or Red Equipment Area)
or gain mid-span access to the cable. While accessing
the terminated ends of a fiber would be preferred, this is
also the area with the highest degree of security and Figure 3. Installation of an Optical Splitter
personnel scrutiny; so mid-span access to a cable is a
The biggest drawback to using an optical splitter is that
more likely threat. To perform a mid-span access, the
the installation of such it device will cause an
intruder would first have to cut through and strip away at
intemption of service which should result in a security
least 12-24” of the outer jacket in order to have enough response exposing the sytem breach, The loss of the
room to access the individual fibers in the center of the splitter will not necessarily be high. If the splitter is
cable. Once the individual fibers are accessed, an
installed in a part of the system where the optical power
intruder has several options in which to intercept or ‘tap’ in the fiber is relatively high it may only be necessary to
the optical signal. These methods include (1) Fiber
tap a few percent of the signal with less than 1 dB loss.
bending, (2) Optical Splitting, (3) Evanescent Coupling, A lossless splitter could be used to over come this loss if
(4) V-Groove Cut, and ( 5 ) Optical Scattering.
desired but then the optical splitter requires a source of
1) Fiber Bending: A fiber bend loss tap is the easiest power-making it even more noticeable during visual
tapping method to implement in the field. It involves inspections.
stripping an individual fiber down to the cladding and
bending it to compromise the Total Internal Reflection 3) Evanescent Coupling: Very similar to the Optical
and allowing a fraction of the optical signal to be Splitter method, Evanescent Coupling utilizes the same
coupled out. The power of the tapped signal will depend process without requiring the target fiber to be cut and
upon the radius (R) and angle (e) of the bend. field-constructs a 1x2 optical splitter rather than using a
pre-manufactured device. By polishing the cladding
P F p d EQlill very close to the fiber core on both the target and capture
fibers, it reduces the reflectivity of the core-cladding
boundary and allows a portion of the optical signal to be
captured by the tap fiber. While this approach appears to
have significant advantages over the Optical Splitter
method (i.e. no system interruption, no external splitter
device, etc.), it is extremely difficult to implement in a
Figure 2. Fiber Bend Tap Mechanics
field environment and still results in a noticeable optical
loss (1-2dl3). An optical fiber is smaller than a human

712
hair and the core size of singlemode fiber is less than an core. The grating then reflects a portion of the optical
eighth of a human hair-making it almost impossible to signal out of the target fiber into a capture fiber.
achieve the precision required in the field without
sophisticated and cumbersome equipment and a great
deal of uninterrupted time to install the tap,

Figure 6. Scattering through a Fiber Bragg Grating

The benefit of the Scattering approach is that it does not
require cutting into a fiber (such as in a V-Groove tap).
4) V-Groove Cut: In this method, a V-groove is cut in However, this method requires the most precision
the cladding of the optical fiber close to the core. The V- equipment of any and is the most difficult to implement
groove is cut so that the angle between the signal in a field environment without detection.
propagating in the fiber and the face of the V-groove is
greater than the critical angle for total internal reflection. Note: Each of the methods discussed above depict a
When this condition is met the fraction of the signal specific method for tapping into an optical signal. What
traveling in the cladding and overlapping with the V- has not been discussed, however, is how that signal is
groove undergoes total internal reflection and is coupled then routed out of the facility or captured locally for
out through the side of the fiber. interpretation and analysis by the enemy. Several
scenarios are feasible, but are very specific to the
installation in question and are ourside the scope of this
paper.
DETECTION OF OPTICAL INTERCEPTS
By understanding the various methods an enemy could
Ctadding use to compromise the integrity of a secure optical
intensior
network, it is easier to plan and implement network
I profile . architectures, infrastructure, and processes to prevent
andor detect such intrusions. All of the fiber tap
methods listed above would result in some measurabk
change that could be detected using standard optical test
1 Tapped light
equipment. An optical test set, which measures optical
Figure 5 . V-Groove Cut Cross-Section attenuation (&), and an Optical Time Domain
Reflectometer, which measures reflective and non-
Once again, a precision cut required in the fiber as well reflective ‘events’ in an optical circuit, are very effective
as the subsequent polishing would require precision tools for network testing and monitoring. The remainder
equipment and a great deal of uninterrupted time to of this paper will focus on (1) the capabilities of each of
install such a tap. However, this method could result in these tools, ( 2 ) their ability to detect each of the various
very little optical loss and would be very difficult to fiber tap methods discussed, and ( 3 ) the various methods
detect. Finally, since this process requires actually in which they could be integrated into a optical network
cutting into (but not breaking) an optical fiber, it is also architecture to facilitate periodic network testing.
the riskiest method for achieving a fiber tap in the field.
Optical Tester: Optical Testers have been used since the
5) Scdering: The use of a Fiber Bragg Grating to early deployment of fiber optic networks to measure the
achieve a fiber tap is the most advanced field technique amount of attenuation (a) or optical loss of the
discussed, and also the most difficult to detect via network. Optical testers consist of an optical source,
periodic network testing and monitoring. This process which generates a very precise amount of optical signal
requires the use of an Excimer W Laser to create an at various wavelengths, and an optical meter, which is
overlapping and interfering field of W rays that calibrated for precise measurement of the optical signal
subsequently ‘etches’ a Bragg Grating onto the fiber

713
received. By knowing the amount of optical signal
inserted into a network and the amount received on the TESTING EFFECTIVENESS VS. FIEER TAPS
other end, it is possible to derive the optical loss of the
segment as depicted below: Since the Optical Test Set and the OTDR perform very
differently, they each have varying degrees of
effectiveness in detecting and preventing optical
intercepts. The chart below provides a relative depiction
of each tools’ effectiveness in identifying the various
fiber tap methods discussed. The Optical Tester
provides fairly good detection capabilities for those fiber
T m d w Patch P e l PdChPMd Tra~aawr tap methods that are ‘easy’ to implement in the field.
2 f However, it is relatively weak in detecting the more
lntcrconwdQ&h Pard advanced fiber taps. The OTDR, however, provides
Figure 7. Calculating Optical Loss (dB) strong-to-moderate detection capabilities across the
By recording the various attenuation readings for each board because of its ability to identify discrete loss
individual fiber tested over time, it is possible to track points, possibly corresponding to a tap, along a fiber
network degradation and identify any discrepancies that link. Finally, specialized OTDRs, such as Brillouin-
may be indicative of optical network intercepts (i.e. fiber OTDR and polarization-OTDR, are available which test
for birefringence, stress and other optical deformities
W>*
caused by all forms of fiber taps. The specialized
Opticul Time Domain Reflectometer (OTDR): An OTDRs provided the best detection capability across all
OTDR acts very similar to radar in that it sends out very fiber tap methods.
precise and measured pulses of light at various
wavelengths and then measures the amount of time it
takes to receive the signal back and the intensity of the Effrdkenem uf Optical T e t Equipment for the
returning signal. By tracking both the time and intensity Oetedion L Prwvention of Fiber Taps

of the returning signal, the OTDR is able to ‘trace’ the

entire length of the optical circuit-showing all splices, High

connectors, and potentia1 intercepts in the trace window.

Another key function of an OTDR is its ability to
identify the distance to any cable cut or intercept- Medium
which greatly enhances security response times to
potential network intrusions. When combined with GIS-
based information, this function becomes increasingly Lnr
powerful in its ability to hone in on potential security
breaches and high-risk areas.
An example of an OTDR trace is shown. By testing and
storing the traces from an OTDR, end users have the .Figure 9. Detection Effectiveness of Test Equipment
ability to monitor changes in network circuits and
identify any potential optical intercepts.
LAB EXPERIMENT: MEASURING IMPACT OF
OPTICAL CABLE TYPE ON ABILITY TO
DETECT FIBER TAPS
In addition to the various types of OTDR equipment that
offer varying degrees of effectiveness in detecting fiber
taps, there are also different cable designs that could
enhance the detection of fiber taps as well. Optical cable
types can be broken down into three primary catagories:
loose-tube, tight-buffered, or ribbon construction.
Loose-tube cables are comprised of a circular
arrangement of individual buffer tubes - each containing
up to twelve 250um optical fibers. This composition is
Figure 8. Sample OTDR Trace typically found in OSP deployments and is also

714
predominantly used by Department of Defense and tight-buffered cable designs provided any advantage for
Federal agencies in their LAN/WAN deployments. network security or monitoring. In fact, the only
significant attenuation change that was detected during
the experiment for loose-tube cables was when a
technician mistakenly crimped the buffer tube he was
trying to access fibers in.
I Mid-Span Fiber Fiber I
Loose-Tube Cable None LOW None
Tight-Buffered Cable None None None
Figure 10: Loose-Tube Cable Design Ribbon Cable None High None
Figure 13: Fiber-Tap Experiment Results
Tight-buffered cables are comprised of a circular
arrangement of individual 900um buffered fibers. This Because ribbon cables encapsulate 12 individual optical
composition is predominatly used by Department of fibers inside a ribbon matrix, the ribbon matrix must be
Defense and fecderal agencies in LAN deployments - removed prior to an individual fiber being accessed in
mostly inside of buildings. preparation for a fiber tap. It is during the removal of
the ribbon matrix that a significant attenuation change
can be detected as noted by the OTDR trace overlay
----
O U M

WCPPMFam
shown below:

ma--

Figure 11: Tight-buffered Cable Design

Ribbon cables are comprised of a single or multiple
‘stacks’ of ribbons - which are comprised of 12 optical
fibers encapsulated at precise intervals in a ribbon
matrix. Ribbon cables are used heavily by telco and
CATV companies for OSP deployments to (1) reduce
deployment cost and compIexity, and (2) accelerate
network restoration activities. To date, ribbon cables
Figure 14: OTDR Truce of Ribbon Cable during Fiber Tup Eqeriment
have not been widely used by the Department of Defense
despite wide-scale deployment in the commercial sector. The top line (orange) on the trace shows the baseline
trace of the ribbon cable prior to the experiment
beginning. The bottom line (yellow) shows the 2.2dB
attenuation change that was detected when the technician
tried to separate an individual fiber out of the ribbon
matrix using a ribbon splitter tool.
In comparison, the chart below shows the undetectable
change in attenuation that was measured while accessing
Figure 12: Ribbon CabIe Design a single fiber in a loose-tube cable:
In order to evaluate the impact that cable design has on
fiber tap dectectability, a side-by-side experiment was
conducted on each cable type. The experiment used a
standard OTDR to quantify any attenuation change that
could be detected on singlemode fiber at 1550nm while
(I) a mid-span sheath access was performed on each
cable, (2) an individual fiber was accessed from within a
buffer tube or ribbon matrix, and (3) the fiber was
stripped in preparation for a fiber tap.
As the chart below depicts, the only cable design that
provided any enhanced detectability of suspect fiber tap
Figure 15: OTDR Truce of Loose-Tube Cuble during Fiber Tup Expenhenr
activity was the ribbon cable. Neither the loose-tube or

715
As a resuIt of this experiment, it is clcar that ribbon into the network architecture and combined with an
cables offer a significant advantage over other cable optical switch to allow a single set of test equipment to
designs when it comes to enhancing network security be connected to multiple optical circuits in the facility.
andlor monitoring for unautorized cable access and Due to the increased equipment requirements and the
installation of fiber taps. need for an optical switch, the Automated Monitoring
approach is very costly-but is the onIy approach that
NETWORK INTEGRATION OF DETECTION &
can automatically monitor network performance and
PREVENTION CAPABILITIES
highlight any potential optical intercepts / fiber taps.
The different optical test equipment options can be UnfortunateIy, many equipment vendors have bundled
integrated into any network architecture. The only this capability with other capabilities that may be
questions that have to be addressed are how intrusive of extraneous to the management of secure optical
testing are end users willing to tolerate and how much networks.
the resulting solution will cost. There are two main
The highest level of security can only be achieved by
categories of network testing and monitoring: passive
continuous monitoring of the network. This could be
testing and automated monitoring.
achieved by propagating several wavelength channels
Passive Testing: Passive testing is the most cost- dedicated to monitoring the security of a system
effective method of documenting, testing, and alongside data carrying channels in a way analagous to
monitoring secure networks for degradation of service the optical supervisory channels ( O X ) in DWDM
and possible optical intercepts. This method also systems. For example, the loss of the bent fiber tap
provides a degree of protection directly corresponding to described above exhibits a strong wavelength
the amount of personnel resources dedicated to testing dependence. The power ratio of two well separated
optical networks using an OTDR or Optical Test Set. wavelengths propagating in the fiber would change
Passive testing is performed by having a stand-alone dramatically if a bent fiber tap was suddenly placed in
OTDR andor Optical Test Set to periodically test and the link. Continuous monitoring of this ratio would
document the optical circuits running between and immediately show that a tap was occuring and could
through secure facilities. Because this testing utilizes instruct the netwrk management system to shut down the
stand-alone equipment, it offers the most cost-effective link or re-route the data.
protection with varying degrees of transparency to
network operations. Passive testing has normally been CONCLUSION
viewed as very intrusive to network operations in that it While fiber optics are exponentially more secure than
required each network circuit to be dark and copper cables, there are still ways that enemies can tap
disconnected from the switch in order to facilitate into and intercept classified infomation traveling across
testing. While this approach is still valid today, it does optical networks. A majority of fiber tapping methods
create a great deal of complexity that has to be managed require some degree of access to an optical fiber’s core
and is not recommended. A better approach to Passive which is challenging if not impossible to discretely
Testing is the integration of passive test points into Red accomplish in the field. Regardless of the method used,
and Black . Equipment -areas. .These test . points are fiber taps and optical intercepts can be detected by using
continuously linked to the optical circuits and provide standard optical test equipment such as an OTDR or
ready access to the lit circuits without disrupting service Optical Test Set. Detection of fiber taps can also be
or requiring the circuit to be disconnected from the greatly enhanced by the use of ribbon cables instead of
switch. By utilizing different wavelengths for testing, an loose-tibe or tight-buffered cables. Depending on the
OTDR or Optical test Set can test a fiber while it is stiIl threat level or degree of protection desired, network
in operation. This alleviates the concern with taking a monitoring and testing can either be either passive using
network down for testing and enables Network testing stand-alone test equipment or automated using an
and Monitoring to be more random and not as forecasted integrated network monitoring capability. Regardless of
or predictable. the approach taken, network monitoring and testing has
to be an integral component of network management to
Automated Monitoring: To achieve a more proactive prevent and detect optical intercepts before they result in
and automated approach to Network Testing and the compromise of National Security Information .
Monitoring, test equipment can be directly integrated

716