pl-1000te crypto gbe,10g, 40g eth, 4g/8g/10/16g fc

PACKETLIGHTPACKETLIGHT ENCRYPTIONENCRYPTION

SOLUTIONSOLUTION

PACKETLIGHTPACKETLIGHT ENCRYPTIONENCRYPTION

SOLUTIONSOLUTION

PL-1000TE CryptoGbE,10G, 40G Eth,

4G/8G/10/16G FC

The RAD GroupThe RAD GroupNo. of employees = 4,500

Group sales in 2014= $1.2 billion

Hi-end Adaptersfor Servers Established: 1987*

CWDM and DWDM SolutionsEstablished: 2000

Network TestSolutions Established: 1991*

Integrated Application Delivery Established: 1997*

Group Distributor in Israel and Worldwide System IntegratorEstablished: 1975

Sub-6GHz Wireless BackhaulEstablished: 1997

Industrial Communication SolutionsEstablished: 2009

DDOS Protection SolutionsEstablished: 2012

Wireless Mobile BackhaulEstablished: 1996*

*Publicly Traded Companies

The Service AssuredSolutions CompanyEstablished: 1981

Coordinated StrategyShared Sales Channels

Joint Development & Technology

• Established in year 2000• PacketLight develops state of the art CWDM &

DWDM and OTN layer products For transport of data, storage, voice and video applications All our products are Green technology with low power

consumption compliant with international standards• Design & Manufacturing in Israel• Thousands of installations worldwide• Member of the RAD group

About PacketLightAbout PacketLight

The PacketLight DifferentiatorsThe PacketLight Differentiators

4

Building Agile CWDM, DWDM InfrastructureBuilding Agile CWDM, DWDM Infrastructure

5

6

Building WDM + OTN Based Metro/Access networks Building WDM + OTN Based Metro/Access networks

3rd Party OTNInfrastructure

OTU2/OTU4

7

PacketLight Product PortfolioPacketLight Product PortfolioPL-1000TE-Crypto: 8 x 1G-10G services

PL-1000RO: WSS ROADM PL-300: Passive Solutions

7

PL-1000EM: 10 x GbE Muxponder

PL-1000: 4 x 10G Services

PL-1000IL: Optical Amplifiers

Tra

nsp

on

de

rs

PL-1000TN- 6 x 8G/10G OTN Services

PL-2000- Up to 16 any service Muxponder

PL-1000GM/GT- 100G Muxponder/Transponder

OT

N S

olu

tio

ns

Mu

xpo

nd

ers

PL-400: 8 x Sub 10G Services

Infr

astr

uct

ure

PL-1000T: 100G Transponder

8

Comprehensive Feature SetComprehensive Feature Set

RemoteManagement

ROADMs

Up to 96WLMux/Demux

ProtectionSingle or

Dual Fiber

Optical Amplifiers

MuxpondersFamily

3R

Bidirectional 3R

Performance Monitoring

NMSSNMP

NetworkDiagnostics

CWDM /DWDM & OTN

NetworkProtocols

Multi Chassis Scalability

Multiple TopologySupport

Layer 1Encryption

Firewall

• It is not so difficult to tap fiber optics, ,many “youtubes” videos show how simple it is

• Government have initiated new sets of laws and guideline to protect essential and financial infrastructures

• Hackers and cyber attacks are posing strategic treats to any enterprise

Encryption Essential and Awareness Is Growing Encryption Essential and Awareness Is Growing

9

• Encryption on all the data passing over the fiber, no room for omissions

• Transparent, maintaining full bandwidth of the traffic • Beneficial for low latency applications• Covering the physical fiber tapping detection• Interface to existing DWDM infrastructure and Telco

OTN networks • No need to change or upgrade the Layer-2/3

switch/routers

Benefit of Layer-1 EncryptionBenefit of Layer-1 Encryption

10

Fiber Security Layers Fiber Security Layers

11

Physical LayerPhysical Layer

Data PlaneData Plane

Management PlaneManagement Plane

Layer-1 Transparent full bandwidth Encryption GCM-AES-256 (Advanced Encryption Standard) Diffie Hellman Key exchange Authentication using SHA-256

SNMPv3 Radius Management Firewall HTTPS Secure Shell

Optical power monitoring per service Automatic detection of fiber tapping

Encryption throughput Encryption throughput

12

PL-1000TE-Crypto FeaturesPL-1000TE-Crypto Features

13

• 8 full Bi-Directional 3R Multi type/rate Transponders• 8 independent encryption AES-256 machines and keys exchange per service• Fully compliant with FIPS 140-2 Level 2 and NSA Suite B• Flexible, user configurable Multirate Interfaces support for:

• Data: GbE, 10GbE, 40GbE LAN• Storage: 4G/8G/10G/16G FC

• Performance Monitoring on all interfaces• Data flow transparent, Ultra Low latency • Optional 1+1 optical facility protection using Optical Switch• Integrated passive optics (Mux/DeMux), optical amplifiers (EDFAs)• Pay as you grow architecture (Pluggable SFP+s)• Dual redundant pluggable AC/DC PSU and FAN unit

“1U Data and Storage Layer-1 Encryption solution”

PL-1000TE-Crypto Encryption Solution DescriptionPL-1000TE-Crypto Encryption Solution Description• Support 8 independent bi-directional encryption/decryption machines• Each encryption/decryption machine can be configured to a different service

rate/type and has its own key exchange and pre shared secret• Conforms with known Encryption standards :

GCM-AES-256 (Advanced Encryption Standard) Diffie Hellman Key exchange FIPS 140-2 Security Level 2 Suite B CNSSP-15 Cryptography

• Encryption supports: Confidentiality Data integrity Authentication

• Support user configurable services: – 1G/10G/40G Ethernet– 4G/8G/10G/16G FC

• Low latency < 20 µsec for encrypted 10G ETH• Support secured key distribution• 8 optical transponder, optional Mux/DeMux, optical amp and OSW

Encryption Mechanism PL-1000TEEncryption Mechanism PL-1000TE

14

PL-1000TE Encryption FunctionalityPL-1000TE Encryption Functionality

15

Requirement Function Algorithm FIPS 140-2 Suite B

Cryptographic Algorithm

Encryption Algorithm

GCM-AES-256 FIPS 197 and SP800-38D Yes

Key Management Key Establishment Elliptic Curve Cryptography Cofactor Diffie-

Hellman (ECC CDH) with a Pre-Shared Secret SP 800-56A Yes

Key Message Authentication

Message digest with a Pre Shared Key Secure Hash Algorithm 2 (SHA-256) FIPS 180-4 Yes

Self Tests Integrity testsOn power up check digestion for software encryption modules and run test vectors with known answers (KAT)

Yes N/A

Random Number Generator

Used for keys generation

True Random (TRNG) with FDK-100, and Deterministic random bit generator (DRBG) SP800-90 N/A

Access Control Authentication Role Based, User/Password authentication Yes N/A

Physical security Tamper evidence Yes

EMI/EMC FCC Part 15 Class A Yes N/A

Services Supported Services GbE, 10GbE, 40GbE 4G-FC, 8G-FC, 10G-FC, 16G-FC N/A N/A

• The mapping of the encrypted services is done according to the following table:

• The bit rate of the encrypted 64b/66b service is the same as the client rate• The Diffie-Hellman key exchange is done in-band to the encrypted signal

Mapping of the Encrypted ServicesMapping of the Encrypted Services

16

Service Client Rate Uplink Rate Encrypted Signal Rate

Encrypted 10GbE 10.3125G 10.3125G 10GbE

Encrypted 1GbE 1.25G 2.125G 2GFC

Encrypted 4G FC 4.25G 10.3125G 10GbE

Encrypted 8G FC 8.5G 10.3125G 10GbE

Encrypted 10G FC 10.51875G 10.51875G 10GFC

Encrypted 16G FC 14.025G 14.025G 16GFC

Encrypted 40GbE 4x 10.3125G 4x 10.3125G 4x 10GbE

• Secured fiber network infrastructure for: Gov and data center connectivity Banks, Credit card companies and other financial institutes Cloud providers and ISP backbone Utilities and essential infrastructure

• Feeder of encrypted services to existing Optical Transport Networks (OTN)

• Managed encrypted wavelength services offered by service providers

• Internal data center secured connectivity

PL-1000TE-Crypto Applications PL-1000TE-Crypto Applications

17

8 Encrypted Services Agnostic To Switch Vendor8 Encrypted Services Agnostic To Switch Vendor

Encrypted Services

PL-1000TE Crypto

Switch/Router Vendor agnostic1G/10G/40G Eth, 4G/8G/10G/16G FC

Encrypted Services

PL-1000TE Crypto

Switch/Router Vendor agnostic1G/10G/40G Eth, 4G/8G/10G/16G FC

Secured Fiber Network Infrastructure Secured Fiber Network Infrastructure

EncryptionManaged by customer

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2

TX RX TX RX TX RX TX RX

RX TX RX TX RX TX RX TX

2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink

UplinkRX TX PL-1000GT!

TX RX

MIN

PWRLINK

10/100G OTN Backbone

(OTU2/OTU4)

Encrypted Services Over OTN Backbone OTU2/OTU4Encrypted Services Over OTN Backbone OTU2/OTU4

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2



2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink


TX RX

MIN

PWRLINK

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2



2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink


TX RX

MIN

PWRLINK

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2



2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink


TX RX

MIN

PWRLINK

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2



2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink


TX RX

MIN

PWRLINK

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2



2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink


TX RX

MIN

PWRLINK

3rd Party OTNInfrastructure

10G Encryption Over Standard 100G OTU4 Uplink10G Encryption Over Standard 100G OTU4 Uplink

21

Using 10G Encrypted uplinks in to 100G OTU4 uplink

FAN UNITALARM

CONTROL

PL-1000GT

MAJOR MINORCRITICAL

COM-1

DCDC

TX RX

RX TX

MNG2



2 3 4 5 7 8 9 10 MNG11 6

TX RX

TX RX

RX TX RX TX

LINK 1

RX TX RX TX

ACTLINKETH

UPLINK PSU1 PSU1

FAN UNIT

ACT

Link 1 MAJCRT

ETH

ALARM

CONTROL

TX RX

MNG2



4 5 6 7 9 10 11 12 MNG13 8

RX TX

2

TX RX

RX TX RX TX100G/ADM

E1 Uplink


TX RX

MIN

PWRLINK

PWR

PL400TX RX

RX TX

TX RX TX RX TX RX TX RX TX RX TX RX TX RX TX RX

MUX DEMUX 1 MUX DEMUX 2 COM1

COM2

FAN UNITALARM

CONTROL

RX TX RX TX RX TX RX TX RX TX RX TX RX TX RX TX

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16LINK MNG2MNG1

ACT

MAJOR MINORCRITICAL COM1 COM2

LINKOPR MAS

TX RX

TX RX

PROT ETH

AC PSUDC PSU

10G LAN 8G FC

Dark Fiber/OTU4

22

10G LAN 8G FC

Dark Fiber/OTU2

Using 10G Encrypted uplinks in to 10G OTU2 uplink

10G Encryption Over Standard 10G OTU2 Uplink10G Encryption Over Standard 10G OTU2 Uplink

23

FAN UNIT

LINK ACTETH

MAJOR MINORCRITICAL

ALARM

CONTROL

TX RX

RX TX

MNG2

TX RX

Link 1PWR

TX RX TX RX TX RX TX RX TX RX

RX TX RX TX RX TX RX TX RX TX RX TX

2 3 4 5 7 8 9 10 MNG11 6

TX RX

Link 2

0

TX RXTX RX TX RX

RX TX RX TX

11 12 13 14 15 16

BITS PROT

AC PSUDC PSU

PL-2000

HD

-SD

I

3G

HD

-SD

I

GbE

ST

M-1

ST

M-1

ST

M-1

ST

M-1

ST

M-1

6S

TM

-1

unus

ed

unus

ed

unus

ed

unus

ed

unus

ed

unus

ed

unus

ed

2x 10G Uplinks

Service Type Selection Service Type Selection

Encryption ConfigurationEncryption Configuration

25

Crypto Officer FunctionalityCrypto Officer Functionality

26

• The Crypto Officer is a single built-in user 'crypto' that is not manageable by the Admin user.

• Only the Crypto Officer is allowed to change its own password (default: 'crypto')

• Only the Crypto Officer has an access to the Encryption tab with the pre-shared-secret information, and the Key Exchange Period.

• In all other terms the behavior of the Crypto Officer user is like a Read-Only user for the GUI and CLI purposes.

• The Crypto Officer user can logged in to the device remotely via the Web-GUI over HTTP/HTTPS. The Crypto Officer user is not available via SNMPv3

• To prevent Admin changing the service type from encrypted to non-encrypted, the Crypto Officer has the option to lock the encrypted service.

• For locked encrypted service, the admin user can not change the service type. In addition, if there is at least one locked service, the admin is not allowed to: restore-to-factory-defaults, load a previously saved configuration file, switch between SW loads

• Built-in Firewall allows blocking of any selected IP address or protocol/s.

Firewall Firewall

27

PL-1000TE Management SecurityPL-1000TE Management Security

28

• HTTPS – Secured HTTP

• Support SNMPv3

• SSH - Secured Shell (telnet)

• PL-1000TE supports RADIUS for centralized user management• Up to two RADIUS servers are supported for protection

RADIUSRADIUS

29

Thank you!Thank you!Thank you!Thank you!

www.packetlight.com

• AES- Advances Encryption Standard• Asymmetric Encryption- for Key Exchange, protocols

SSH, VPN, Web• Symmetric Encryption- for Data• FIPS197-Federal Information Processing Standard• Testing protocol to make sure implementation is

correct• AES-256 the strongest encryption Random Number

Generator RNG

AES BackgroundAES Background

32

• The Advanced Encryption Standard (AES) is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001.

• AES has been adopted by the U.S. government and is now used worldwide. It supersedes the Data Encryption Standard (DES), which was published in 1977.

• For AES, NIST selected three members of the family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits.

• The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data.

• PL-1000TE is using the stronger version AES with key of 256 bits.

Advanced Encryption Standard (AES)Advanced Encryption Standard (AES)

33

• Data Plane Encryption Key Exchange Power-up tests Optical Power Drop detection Crypto Officer Optical Power Monitoring for tap detection

• Management Plane Role based User/Password Authentication Protocols: HTTPS/SHA/SNMPv3 Firewall RADIUS

PL-1000TE Security FeaturesPL-1000TE Security Features

34

• Galois/Counter Mode (GCM) is a mode of operation for symmetric key cryptographic block ciphers.

• It is an authenticated encryption algorithm designed to provide both data authenticity (integrity) and confidentiality.

• GCM is defined for block ciphers with a block size of 128 bits.

• PL-1000TEis using GCM with message integrity code (MIC) of 128 bits.

Galois Counter Mode (GCM)Galois Counter Mode (GCM)

36

• DH ECDH protocol compliant with SP 800-56A• Secure Hash Algorithm 2 (SHA-256) message digest• Protection for a Man-In-The-Middle attack with 256 bits (64 bytes) Pre-Shared-

Secret• Configurable Key-Exchange period with granularity of 1 minute. • The pre-shared secret consists of hexadecimal numbers

Diffie-Hellman Key ExchangeDiffie-Hellman Key Exchange

37

1. Alice and Bob agree to use a prime number p = 23 and base g = 5 (which is a primitive root modulo 23).

2. Alice chooses a secret integer a = 6, then sends Bob A = g^a mod p A = 5⁶ mod 23 = 8

3. Bob chooses a secret integer b = 15, then sends Alice B = g^b mod p B = 5¹⁵ mod 23 = 19

4. Alice computes s = B^a mod p1. s = 19⁶ mod 23 = 2

• Bob computes s = A^b mod p1. s = 8¹⁵ mod 23 = 2

1. Alice and Bob now share a secret (the number 2)

DH AlgorithmDH Algorithm

38

1. it is easy to compute the hash value for any given message

2. it is infeasible to generate a message from its hash3. it is infeasible to modify a message without

changing the hash4. it is infeasible to find two different messages with

the same hash.

• The PL-1000TE is using the SHA-256 hash function to authenticate the DH messages, and to compute the digest of the cryptographic modules for the power up tests

• The SHA function takes the pre-shared secret to digest the Diffie-Hellman protocol messages.

• This way the peer side can ensure that the Diffie-Hellman message was not sent by someone else and prevent the Man-In-The-Middle attack.

Cryptographic Hash Function Cryptographic Hash Function

39

• A cryptographic hash function is a hash function which is considered practically impossible to invert, that is, to recreate the input data from its hash value alone.

• The input data is often called the message, and the hash value is often called the message digest or simply the digest.

• The ideal cryptographic hash function has four main properties:

• A cryptographic module perform power-up self-tests and conditional self-tests to ensure that the module is functioning properly.

• Power-up self-tests are performed when the cryptographic module is powered up (including integrity tests, KAT, etc).

• Conditional self-tests are performed when an applicable security function or operation is invoked.

• If a cryptographic module fails a self-test, the module must enter an error state and output an error indicator via the status output interface.

• The cryptographic module shall not perform any cryptographic operations while in an error state.

• All data output via the data output interface shall be inhibited when an error state exists.

Self TestsSelf Tests

40

• The Crypto-Officer is a single built-in user crypto that is not manageable by the Admin user.

• Only the Crypto Officer is allowed to change its own password (default: crypto)• The Crypto Officer has an access to the Encryption tab with the pre-shared-secret

information, and the Key Exchange Period.• In all other terms the behavior of the Crypto Officer user is like a Read-Only user for

the GUI and CLI purposes.• The Crypto Officer user is not available via SNMPv3.• The Crypto Officer user can reach a box remotely via the Web-GUI over

HTTP/HTTPS only• To prevent Admin changing the service type from encrypted to non-encrypted, the

Crypto Officer has the option to lock the encrypted service.• For locked encrypted service, the admin user can not change the service type. In

addition, if there is at least one locked service, the admin is not allowed to: restore-to-factory-defaults, load a previously saved configuration file, switch between SW loads

Crypto OfficerCrypto Officer

41

• Interfaces OSC – 2x 100M/1000M optical interface LAN – RJ45 Serial – RS232

• Protocols HTTP/HTTPS Telnet/SSH SNMPv1/SNMPv2c/SNMPv3 Syslog RADIUS TFTP/FTP

/*/ secured protocols

Management Interfaces and ProtocolsManagement Interfaces and Protocols

42

• Conformance to EMI/EMC requirements EMI: Electromagnetic Interference

• Does the module interfere with other equipment?• EMI is caused by undesirable radiated electromagnetic fields or conducted voltages

and currents. EMC: Electromagnetic Compatibility

• Does other equipment interfere with the module?• EMC is the ability of electrical or electronic equipment/systems to function in the

intended operating environment without causing or experiencing performance degradation due to unintentional EMI.

• For Levels 1 and 2, an FCC part 15 class A certification is required• Tamper Evidence – required for Security Level 2

• PL-1000TE has FCC part 15 class A certification • PL-1000TE is using special labels on the box screws for tamper evidence

Hardware SecurityHardware Security

43

Optical Power Drop DetectionOptical Power Drop Detection

• An event is created if the optical power is dropped by more than 2 dB• The event can be used to detect tapping attempts to the fiber

44 © 2015 Coriant. All rights reserved.

Additional Cryptography TermsAdditional Cryptography Terms

• NIST - USA National Institute of Standards and Technology• NSA – USA National Security Agency• FIPS 140-2 – NIST Federal Information Processing Standards security requirements for cryptography modules rev. 2 • Suite B – a subset of the cryptographic algorithms covered by FIPS 140-2, recommended by the NSA• Encryption - the process of encoding messages or information in such a way that only authorized parties can read • Data Authentication - provides a way to check that the message has not been altered• Peer Authentication - provides a way to make sure that you are talking to a trusted other side, not an adversary• Symmetric Key - the same key is used for encryption and decryption• Key stream – Key + IV• IV - Initialization vector (also called “salt”, “nonce”) used to ensure uniqueness of the key stream• CTR – a block cipher mode of operation that uses incrementing IV counter for the key stream source• GCM - Galois Counter Mode uses CTR mode for encryption, and Galois multiplication for data authentication • MIC - Message Integrity Code used for authentication• KAT - Known Answer Test self-tests that are performed during power up self tests• DRBG - Deterministic Random Bit Generator used to generate a sequence of random numbers based on a TRNG.• TRNG – True Random Number Generator based on a pure source of entropy (“noise”)• DES - Data Encryption Standard• AES - Advanced Encryption Standard (also referenced as Rijndael)

45

pl-1000te crypto gbe,10g, 40g eth, 4g/8g/10/16g fc

Documents

g servicespl

g services pl

g transponder

g services infrastructurepl

physical fiber

dwdm solutionsestablished

encryption throughput

fiber optics