Systems, methods, and storage media for detecting a security intrusion of a network device

Patent metadata

Field	Value
Publication number	US-11563530-B2
Application number	US-202117557900-A
Country	US
Kind code	B2
Filing date	Dec 21, 2021
Priority date	Sep 28, 2018
Publication date	Jan 24, 2023
Grant date	Jan 24, 2023

Abstract

Systems, methods, and storage media for detecting a security intrusion of a network device are disclosed. Exemplary implementations may include a method involving, in the network device including a processor, monitor a light signal associated with a security enabled port of the network device; and in response to detecting a change in the light signal, initiate a security alert.

First claim

What is claimed is:

1. A network security device comprising:
a plurality of bi-directional communication ports each comprising an output port and a corresponding input port;
a controller configuring the at least one of the plurality of bi-directional communication ports as a security enabled port, the controller transmitting, to a security monitoring system, an alarm indication in response to detecting a loss of a light signal on the security enabled port; and
a switch device associated with the at least one of the plurality of bi-directional communication ports and transmitting, to the controller, an insertion signal upon a change of state of the switch device in response to an insertion of a cable into the at least one of the plurality of bi-directional communication ports, wherein
transmission of the alarm indication is further in response to receiving, at the controller, the insertion signal from the switch device associated with the security enabled port.

2. The network security device of claim 1 wherein the network device further comprises a photodetector associated with the at least one of the plurality of bi-directional communication ports and transmitting, to the controller, an indicator signal corresponding to a detection of the light signal on the input port.

3. The network security device of claim 2 wherein the photodetector detects a removal of the loopback connector and transmits, in response to the removal of the loopback connector, a loss of signal indicator to the controller.

4. The network security device of claim 2 wherein the network device is a reconfigurable optical add drop multiplexor (ROADM) and the photodetector is a photodiode.

5. The network security device of claim 4 wherein the plurality of bi-directional communication ports are operably associated with a wavelength selectable switch component of the ROADM.

6. The network security device of claim 2 , the network device further comprising:
a common signal bi-directional port comprise a common signal port receiving a common light signal; and
a demultiplexer replicating the common light signal to the output port of each of the plurality of bi-directional communication ports.

7. The network security device of claim 6 , the network device further comprising a light-detecting sensor associated with the common signal bi-directional port and transmitting, to the controller, a common signal indicator signal, wherein the controller further compares the indicator signal corresponding to the detection of the light signal on the input port and the common signal indicator signal.

8. The network security device of claim 1 wherein the at least one of the plurality of bi-directional communication ports is not providing communication with another networking device.

9. A method for detecting a security intrusion of a network device, the method comprising:
monitoring, via a controller, a presence of a light signal on an input portion of a communication port of a plurality of bi-directional communication ports;
configuring, at the controller, the communication port as a security enabled port;
transmitting, via the controller, a security alarm in response to detecting a loss of light signal on the input portion of the communication port; and
transmitting, via a switch device associated with at least one of the plurality of bi-directional communication ports, an insertion signal upon a change of state of the switch device in response to an insertion of a cable into the at least one of the plurality of bi-directional communication ports, wherein
transmission of the security alarm is further in response to receiving, at the controller, the insertion signal from the switch device associated with the security enabled port.

10. The method of claim 9 wherein the networking device is a reconfigurable optical add drop multiplexor (ROADM) network device, the communication port associated with a wavelength selectable switch (WSS) of the ROADM network device.

11. The method of claim 9 wherein the networking device comprises a loopback connector between the output portion of the bi-directional communication port and the corresponding input portion of the communication port to redirect the light signal.

12. The method of claim 9 wherein monitoring the presence of the light signal comprises:
receiving, from a photodetector sensor corresponding to the input portion of the communication port, a light detection signal indicating the presence of the light signal, wherein transmission of the security alarm corresponds to the light detection signal indicating a loss of the light signal on the input portion of communication port.

13. The method of claim 9 further comprising:
configuring, via the controller, a first portion of a plurality of communication ports of the networking device as transmission ports for communication with other networking devices; and
configuring, via the controller, a second portion of the plurality of communication ports of the networking device as security ports, the bi-directional communication ports included in the second portion of the plurality of communication ports, the security ports monitored for a loss of the light signal.

14. The method of claim 13 wherein an input light signal is replicated to each of the plurality of communication ports of the networking device.

Assignees

• Level 3 Communications Llc

Inventors

• Drake Steven E
• Pofahl Morgan M

Classifications

• H04B10/035

  using loopbacks · CPC title

• H04J3/14

  Monitoring arrangements {(for SDH/SONET rings H04J3/085)} · CPC title

• G01R31/31716

  Testing of input or output with loop-back · CPC title

• H04L1/243 Primary

  at the transmitter, using a loop-back · CPC title

• H04B10/85 Primary

  Protection from unauthorised access, e.g. eavesdrop protection · CPC title