Towards a Security Architecture for IP-Based Optical Transmission Systems

摘要

Optical cross-connect systems with several terabits of switching capacity are critical components of today's communication networks. Because of their central role within the telecommunication infrastructure, along with their remote management capabilities, high-capacity network nodes are potential targets of attacks. Built upon proprietary hardware and software components in the past, such systems increasingly make use of standard technology today. The Linux operating system has become a widely-used standard for embedded communication controllers, and similarly the Internet Protocol is widely used for both internal and external data exchange. In this paper, we establish a threat model for transmission network nodes employing these open source technologies. Based upon functional models of such systems, we then introduce security requirements for functional components and their communication with respect to that threat model, thereby forming a security architecture for transmission systems. We further propose security zones to strictly segregate sensitive internal communication from external traffic.