Layer 1 encryption: A step forward for government network security
Connecting state and local government leaders
Already in use among a range of private enterprises and service providers today, Layer 1, 100 gigabit/sec encryption can give government network managers the ability to transport enormous volumes of data in the most secure manner possible.
Governments have traditionally been regarded as laggards when it came to adopting technology innovation. But with more and more local, regional and federal agencies adapting to the digital-government model, state-of-the-art information technology solutions and electronic services are becoming the norm. At the core of this vision is an infrastructure that is always accessible, always protected and always delivering peak performance. This makes reliable and secure, high-speed optical networking infrastructure essential to the future operation of government agencies globally.
The security of government and citizen data, in particular, has never been so heavily valued or closely scrutinized. Under the specter of Heartbleed and other international data-security challenges, there has been unprecedented sensitivity to and awareness of data security. Governments are only too aware of how susceptible the data being transported across their infrastructures are to theft and malicious use.
So while data security is of utmost concern to today’s government network managers, in today’s era of big data transport, where speed and volume are key, so is network latency.
To respond to those concerns, an emerging technology for on-the-fly, line-side encryption at Layer 1 for services up to 100 gigabit/sec has been designed specifically for users who are under pressure to transport enormous volumes of data in the most secure manner possible – but without the latency penalties that conventional Layer 2 and 3 approaches often incur.
Already in use among a range of private enterprises and service providers today, the Layer 1, 100 gigabit/sec encryption stands to push the boundaries of high-speed connectivity for government networks too.
Why encryption at Layer 1 makes sense
Encryption is commonly used by governments around the world today, and the Advanced Encryption Standard (AES) with a key size of 256 bits already offers maximum security. But how and where AES 256 encryption is deployed is critical to realizing high degrees of security without taking performance hits that are unacceptable in today’s era of big data transport.
In contrast to commonly deployed systems that apply encryption at Layer 2 or 3, a new approach—purpose-built for the era of big data transport—has emerged. It applies AES 256 with a frequent dynamic key exchange to a 100 gigabit/sec line signal of a wavelength division multiplexing (WDM) card in an optical transport system.
Everything, including the header, checksum and the entire frame of the signal (not only the payload or select bytes in the header) is encrypted so that every bit that is being transported across the government network is ensured maximum protection. No snippets of sensitive data remain unencrypted and nothing is left susceptible to interception, which supports the most comprehensive degree of protection possible for the data.
The Layer 1 approach is agnostic to protocols (Ethernet, Fibre Channel, InfiniBand and/or proprietary), and it also supports a wide variety of data rates up to 100 gigabit/sec. The Layer 1 encryption capability is also standalone, for simple operations. Administration and maintenance can be kept separate from network and encryption management to ensure extremely granular control of who has authorization and the ability to access what data within the government network. Additionally, with a standard line-side signal, the Layer 1 encryption could also be used as a standalone encryption feeder for today’s existing unsecure networks.
Providing encryption in this way, at the lowest network layer, adds little latency to the transmission link. Some applications such as synchronous disk mirroring or server clustering are highly intolerant to latency, and the 100 gigabit/sec networking with Layer 1 encryption adds less than 150 nanoseconds of latency. Higher-layer encryption technologies frequently add significant overhead and multiply the latency of the data stream.
Security has now assumed a place alongside cost, space and power consumption as defining factors when government network managers go to make decisions about connectivity. So the emergence of encryption integrated as part of the data transport over optical networks is an equation-changing development for government network managers with a hypersensitivity to data security issues around the world today.
Uli Schlegel is director, business development -- data center solutions, for ADVA Optical Networking