Physical Link Intrusion Detection via Optical Delay Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting physical link intrusions in computer networks are costly and cumbersome, and often result in false positives or lack sensitivity, making them inefficient for monitoring and intrusion detection.
Innovation Solution
A method that monitors link delay signatures using one-way link delay measurements obtained through network taps, determining changes that exceed a threshold value to indicate physical link intrusions, allowing for precise detection and notification of potential security breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pressure sensors in pressurized tubes are used to detect physical link intrusions, then intrusion detection capability is provided, but cost and system complexity increase significantly
Solution Approach 1:
The patent replaces the mechanical pressure sensing system with an optical measurement system. Instead of using pressure sensors in pressurized tubes to detect physical intrusions, the invention uses optical time domain reflectometry (OTDR) to measure changes in optical signal characteristics. This substitution eliminates the need for complex mechanical infrastructure while providing continuous, gradient-based intrusion detection capability.
2Reliability
If pressure sensors in pressurized tubes are used to detect physical link intrusions, then intrusion detection capability is provided, but false positives and lack of sensitivity occur
Solution Approach 1:
The patent implements continuous monitoring of optical signal characteristics with feedback mechanisms. The OTDR system continuously measures round-trip time and signal strength, comparing current measurements against baseline values. This feedback approach enables the system to distinguish between normal variations and actual intrusions, reducing false positives while maintaining high detection sensitivity through gradient-based detection of signal changes.
3Reliability
If time domain reflectometer is used on the physical link, then intrusion detection is possible, but cost and operational complexity increase
Solution Approach 1:
The patent implements a self-service monitoring system where the optical network infrastructure itself provides intrusion detection capabilities. The OTDR measurements are performed using existing optical signals already present in the network, eliminating the need for separate active testing equipment. The system automatically monitors and detects intrusions without requiring manual intervention, making operation simple while maintaining reliable detection capability.
Data Source
AI summary
The subject matter described herein relates to method, systems, and computer readable media for detecting physical link intrusions. A method for detecting physical link intrusions includes monitoring a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap. The method also includes determining whether a change in the link delay signature has met or exceeded a threshold value. The method further includes in response to determining that the change in the link delay signature has met or exceeded the threshold value, determining that a physical link intrusion has occurred.