Non-Measurement Passive Observation Core System with iCID / eCID Fingerprint and Forensic Hash Chain

Abstract

This invention relates to a non-measurable passive monitoring system used in fiber optic, satellite (SATCOM), on-chip photonics, and Ethernet / SCADA communication lines. The technical problem is that reliable identification, intrusion denial, and logging mechanisms cannot be provided solely over existing traffic without the injection of an active test signal or external clock. The invention processes multi-parameter physical layer signals received via passive TAP or equivalent sensors to generate iCID (internal communication ID) and eCID (external communication ID), matches these IDs using hash-based mapping, and records all events in a SHA-256 + RFC3161-based forensic hash chain. It enables rejection of replay / spoof / jamming attacks due to parameter mismatches, self-sync localization in fiber lines, fade / jamming detection in SATCOM via TEC-S4 correlation, jitter-Q-BER chain detection in photonic links, and z-score anomaly detection based on NIC counters in Ethernet lines. The invention can be used in telecommunications, defense, industrial automation, and on-chip data buses for reliable identification, intrusion detection, and forensic verification records.

Description

TARIFF Non-Measurement Passive Observation Core System with iCID / eCID Fingerprint and Forensic Hash Chain 1. Technical Area This invention is used in fiber optics, satellite (SATCOM), photonics on a chip, and Ethernet / SCADA communications. on the lines, without injecting an active test signal or external clock (unmeasured observation) by extracting multi-parameter physical layer signals solely through passive observation Identification (iCID / eCID), denial of replay / spoof / jamming attacks, and forensic hashing. It relates to systems and methods that provide record keeping via a chain. 2. Definition — Non-measurable Observation “Unmeasured observation” refers to existing traffic without an OTDR, pilot signal, or test suite. from low-rate (≤5%, preferably ≤1%) passive TAP or equivalent sensors It is parameter extraction. Measured parameters: Fiber: jitter, attenuation, polarization drift, Δt histogram, dispersion, latency, throughput. SATCOM: PER, jitter variance, SINR, spectral noise, TEC, S4. Photonics: UI-normalized jitter, Q-factor, BER. Ethernet: NIC counters (CRC, frame loss, throughput). 3. State of the Art (Prior Art Analysis) US9535218B1 – Passive TAP Power Measurement: Optical power measurement using passive TAP. Missing Feature: iCID / eCID and forensic hash chain are missing. US9762322B1 – FTTH Monitoring: Optical network monitoring. Missing Element: Δt self-sync and TEC-S4 There is no correlation. US10545245B2, US10826644B2 – Anti-Jamming Methods: In Satellite Communications Interference prevention. Missing element: No TEC-S4 correlation and no hash chain. US20220094450A1 – ML-Based Jamming Detection: Jamming through machine learning Detection. Missing element: TEC / S4 parameters are missing. CN112219360B – Satellite Interference Detection: RF-based interference detection. Missing Feature: There is no PER+jitter combination. US20160246892A1 – On-Chip Optical Monitoring: Monitoring of on-chip optical lines. Missing Factor: No iCID / eCID and tap invariance. US20210029713A1 – Ethernet Anomaly Detection: Anomaly detection on Ethernet lines. Missing element: iCID / eCID and forensic chain are not present. WO2023211668 – Qualified Jamming Detection: Satellite jamming detection algorithms. Missing element: TEC–S4 Δ-correlation is absent. IEEE / Arxiv (2023–2024) – GNSS spoof / jam detection studies. Missing element: self-sync. There is no Δt or hash chain. 4. Summary of the Invention The invention processes parameters received via passive TAP to generate iCID / eCID identifiers. It matches identities based on hash and timestamps events using SHA-256 or an equivalent algorithm. It records to the 35-stamped chain. Fiber Δt self-sync, SATCOM TEC–S4 correlation, photonics. jitter–Q–BER chain and Ethernet z-score anomaly detection mechanisms Replay / spoofing / jamming attacks are rejected. 5. Detailed Explanation Normalization criteria: Z-score (for parameters with low variance and normal distribution) 1 / 4 and Min-Max methods (for wide-range, non-negative parameters) The selection criteria are automatically determined based on the variance, distribution, and range of each parameter. It is done. Normalized parameters are used for statistical integration (weighted mean, correlation). The iCID is generated by processing it with the coefficient and passing it through a hash algorithm. iCID ↔ eCID Matching is done using metadata such as link ID, beam ID, or node ID. The system enables fiber localization using the Δt histogram and TEC–S4 correlation. It distinguishes between fade and jamming, and performs BER estimation using a photonic jitter–Q–BER chain. It implements z-score anomaly detection via Ethernet counters. Threshold values ​​(e.g., Δcorr ≥ 0.65 → fade, ≤0.35 → jamming, BER <15%, Z-score >3σ) within the specification It has been given. Forensic record chain: Events are recorded in an immutable hash chain. JSONL format. or software-based implementations such as RFC3161 timestamps, for example It is explained in the specifications. 6. Experimental / Simulation Results Fiber Δt localization accuracy of ±25 m, 98% success in SATCOM TEC–S4 discrimination, Photonic jitter – Q – BER chain with <15% BER deviation, Ethernet z-score anomaly Accuracy of 95%+ was achieved in detection. 7. Industrial Applicability The invention concerns the security and defense of fiber and satellite lines in telecommunications networks. Jamming / spoofing rejection in communications, anomalies in industrial SCADA / Ethernet networks. It is applicable for detection and reliability control of on-chip optical data buses. 8. Summary The invention provides an additional test signal or clock in fiber, satellite, on-chip photonics, and Ethernet pipelines. Parameters from traffic copies received via passive TAP without injection. by making inferences, it generates iCID / eCID fingerprints and processes this data using a hash algorithm over time. It relates to systems and methods of recording in a stamped chain. The system involves normalization. It processes criteria and parameters on a common scale, and generates iCID after integration. It detects anomalies / jamming and stores the outputs as forensic evidence. 2 / 4

Claims

REQUESTS Non-Measurement Passive Observation Core System with iCID / eCID Fingerprint and Forensic Hash Chain 1. Fiber optics, satellite (SATCOM), on-chip photonics, and Ethernet / SCADA communications. passive operation only, without the injection of an active test signal or external clock into the lines. Physical layer from traffic copies received via TAP or equivalent sensor. parameters (e.g., optical power, jitter, BER, Δt, Q-factor, TEC, S4, z-score) extracts; extracts parameters using z-score or min-max normalization. normalize using methods and apply correlation analysis to line, beam or iCID is derived from this normalized data, which correlates based on link IDs. (internal Communication ID) and eCID (external Communication ID) format Physical layer fingerprint generation; Δt self-sync localization in fiber connections. (See Specification §5, L29-31), TEC–S4 correlation analysis in SATCOM connections. (See Specification §5, L27-29), jitter–Q–BER chain in on-chip photonic junctions. (see Specification §5, L27-29) and z-score anomaly detection in Ethernet networks. iCID / eCID produced using the mechanism (see Specification §5, L29-30). by associating their identities with the relevant link ID and / or beam ID (see Specification §5, L25-27), timestamped as SHA-256 or equivalent as defined in the specification. recording sequentially into a cryptographic hash chain using an algorithm (See Specification §5-6, L33-35) system.

2. In accordance with Claim 1; data obtained from packet arrival statistics on fiber optic lines. Self-sync localization is performed using the obtained Δt histograms, and A system that applies optical path speed correction in distance calculation.

3. In accordance with Claim 1; between the TEC and S4 series measured in satellite communications. By performing correlation analysis, ionospheric values ​​are determined according to predefined threshold values. A system that distinguishes between fade and artificial interference.

4. In accordance with Claim 1; jitter values ​​measured in on-chip photonic data buses. Estimating the Q-factor by normalizing to the UI and then estimating the BER from there. A system that evaluates connection quality by calculation.

5. Depending on Claim 1; NIC counter data in Ethernet or industrial networks. analyzes using a sliding window, applies z-score or equivalent statistical tests, and A system that detects anomalies based on predefined threshold values. 10 20 3 / 5 6. Based on Claim 1; measurements against passive TAP rate changes implementing a tap-invariance mechanism that ensures its stability, and this accuracy in iCID / eCID production and anomaly detection through the mechanism The system that protects.

7. In accordance with Claim 1; raw and / or processed materials associated with the produced iCID / eCID. parameters in RFC3161 compliant time-stamped and immutable hash chain A system that provides forensic traceability by recording data.

8. Alarm triggered by the auditor or supervisor, depending on Request 1. subsequently authorized according to predefined policies and threshold values. As part of the intervention, the affected road was isolated and traffic was diverted to an alternative route. redirection and inclusion of intervention records in the hash chain The system that provides it. 10 4 / 5

Images