ADVA aPNT+™ security enhancements
0 likes776 views
The document outlines the ADVA APNT+ technology, which focuses on enhancing GNSS security and timing accuracy for various networks, including 5G and smart grids. It highlights the importance of resilient Positioning, Navigation, and Timing (PNT) systems to mitigate disruptions that can cause significant economic losses. Various cybersecurity and operational enhancements, including multi-source backup and anti-jam antenna options, are also discussed to bolster the robustness of PNT capabilities.
ADVA aPNT+™ security enhancements
- 1. ADVA aPNT+TM security enhancements New software release provides powerful GNSS security controls
- 2. © 2021 ADVA. All rights reserved. 2 Sync and timing needs by vertical • Higher phase/frequency accuracy to sync IP & legacy networks for efficient use of spectrum • Migration from NTP to PTP timing for higher timestamping accuracy + aPNT+** • Higher PTP timing accuracy distributed to remote PHY devices over IP networks • Consistent NTP/PTP time base to accurately timestamp data in data centers + aPNT+** • Higher data timestamping accuracy to control complex smart grids DER* flows + aPNT+** • Upgrading gov/defense info system & comm networks to higher PTP accuracy + aPNT+** Cable networks Data centers 5G radio access networks Smart grids Government/defense communications Financial trading *Distributed energy resources | **assured positioning, navigation and timing
- 3. © 2021 ADVA. All rights reserved. 3 • $1B/day in economic cost if GPS/GNSS is disrupted • T (timing) is a key enabler of PN (positioning and navigation) capabilities • US Federal Executive Order 13905 on resilient PNT to protect critical infrastructure • US resilient PNT initiatives: - DHS Resilient PNT Conformance Framework (now under IEEE P1952 standardization) - NIST Cybersecurity Framework for PNT Profile • US DHS Resilient Conformance Framework – four resiliency levels: - Level 1: 1 PNT source - Level 2: 2 PNT sources - Level 3: N PNT sources - Level 4: next-gen PNT systems What is resilient PNT and why do we need it?
- 4. © 2021 ADVA. All rights reserved. 4 GNSS vulnerabilities driving PNT disruption PNT cyber threats Jamming RARE GPS/GNSS degradation causes Environmental GPS segment errors Adjacent-band transmitters Spoofing External GPS/GNSS level RARE Cyberattacks GPS/GNSS receiver Core clocks Internal network level Network and PNT device failures Boundary clocks COMMON NTP PTP
- 5. © 2021 ADVA. All rights reserved. 5 Best practice aPNT+ framework with zero-trust PNT sources DHS* PNT resiliency level 0 1 2 3 4 Enhanced 4 2. Diversify with alternative sources 3. Deploy neural software intelligence 1. Augment protection Multi-source backup Multi-level fault- tolerant mitigation Multi-layer Detection Network (PTP/APTS/mgmt) Device (GNSS/Cs/holdover/etc) Receiver (GNSSSB/MB/Mcode/etc) Augmented resilience + robustness + cybersecurity (IEEE P1952 standard) Strategies Antenna/Accessory (GNSS/Mcode/eLoran) *Department of Homeland Security
- 6. © 2021 ADVA. All rights reserved. 6 ADVA aPNT+™ technology for resilient PNT mandate Oscilloquartz intelligent aPNT+TM platform Multi-layer detection + multi-source backup + multi-levelfault-tolerant mitigation Control + visibility + AI/ML assurance + scalability + redundancy GNSS assure Sync manage Sync assure Open interface Dual power Dual hardware Anti-jam antenna GNSS source Cs backup PTP backup Holdover backup Other backup sources PNT cyber threats
- 7. © 2021 ADVA. All rights reserved. 7 Typical sync product deployment with aPNT+™ capabilities Anti-jam antenna option, mitigating jam/spoof from low elevation Extended crystal/rubidium holdover backup PTP backup (APTS) from remote peer GNSS PTP GMs like ePRTC Multiband + multi- constellation GNSS receiver ePRTC – enhanced independent cesium clock backup Intelligent network sync control, visibility & scalability Smart GNSS jam/ spoof detection with Syncjack monitor GPS/ GNSS Anti-jam antenna Cs backup PTP backup Holdover backup Other sources GNSS assure Sync manage Sync assure Open interface Dual power Dual hardware Like eLoran or LEO receiver Redundant, hot swappable PSU 5430/40 product GNSS source
- 8. © 2021 ADVA. All rights reserved. 8 New OSA 54xx features: improved resiliency • Support multiple phase, time and frequency sources • Phase and time sources: SB-GNSS, MB-GNSS, PTP input, PPS+ToD input, IRIG input • Frequency sources: SyncE, CLK, BITS, PTP input, local oscillator • Automatic source validation and selection between validated sources • Automatic switching to backup in case GNSS jamming/spoofing/interface detected Achieving DHS resiliency level 4 New
- 9. © 2021 ADVA. All rights reserved. 9 Anti-jam GNSS antennas • Supports GPS/GLONASS/BEIDOU/GALILEO • Antenna uses 20-30dB rejection at low elevation between 0° - 20° • Antenna gain for satellite signals at high elevation between 45° and 135° • Compatible with existing antenna kits (standard antenna can be replace with AJ- antenna) • Compatible with OSA 540x and OSA 54xx product lines Main characteristics Terrestrial disturbance/spoofing at low elevation is attenuated New Most jamming/spoofing attacks come from the ground (low elevation)
- 10. © 2021 ADVA. All rights reserved. 10 Advanced GNSS spoofing detection • Detects data & range spoofing, time shifts, combined attacks & multiple attack sources • Independent software mechanisms and algorithms to detect spoofing attacks; tested and verified by third parties • Upon detection of GNSS spoofing, an alarm is raised and the OSA 54xx can automatically switch to alternative source • Also helps in detecting and mitigating GNSS segment errors Advanced GNSS protection controls New PNT cyber threats Jamming RARE GPS/GNSS degradation causes Environmental GPS segment errors Adjacent-band transmitters Spoofing
- 11. © 2021 ADVA. All rights reserved. 11 AI-assisted monitoring and fault detection of GNSS receivers GNSS assurance / GNSS firewall Fully integrated with our Ensemble management suite • Collect GNSS health information from OSA 54xx and third-party GNSS receivers • Graphical representation of network-wide status and easy identification of any problems • Real-time and historical data • Utilize ML/AI for automated optimization and security protection of GNSS • Simplifies manual operations in reaction to device-reported synchronization alarms Ensemble Controller GUIs GNSS
- 12. © 2021 ADVA. All rights reserved. 12 Ensemble Sync Director – PTP and Sync Assurance Time and phase quality monitoring and analysis • Leveraging SyncjackTM probing functionality for improved sync assurance • Collecting raw time error data from SyncjackTM probes in large networks, creating long-term history • Exporting TE/TIE data for detailed analysis • On-demand advanced analytics enhancements • MTIE/TDEV calculation • Custom masks Key features • Monitoring clock recovery quality of PTP boundary clocks and PTP slaves • Identifying problems, analyzing bottlenecks • SLA conformance reporting to end customers • Enable customers to offer timing-as-a-service Benefits
- 13. © 2021 ADVA. All rights reserved. 13 Cybersecurity enhancements • Certification management – import of CA approved certificates • Public-key infrastructure (PKI), automatic enrollment of certificates • Password with special characters • Multiple TACACS+ authenticated users on the same privilege level • SSH/SSL SHA-256 key and SSL version updates Security enhancements New Ensemble Controller and Sync Director PKI
- 14. © 2021 ADVA. All rights reserved. 14 Cost-effective sync product family solutions robustly secured Ensemble Sync Director OSA 5422 OSA 541x OSA 3350 optical Cs ePRC+ OSA 5430 NG GM/SSU OSA 5420/21 OSA 5412 3230B Cs magnetic PRC/ePRC accessSyncTM edgeSyncTM edgeSync+TM coreSyncTM OSA 5401 OSA 5405-I/O/MB/P SFP SyncPlug OSA 5440 NG GM/SSU coreSyncTM device/network monitor Front/backhaul Core network O-RAN/edge DC TV studio Defense comm Aviation radars Data center Financial trading 911 center Smart power grids OSAinsideTM SyncModule OSA 5400 TimeCard 11.1.1 release for OSA 5412/20/21/22/30/40
- 15. Additional features in OSA 54xx release 11.1.1
- 16. © 2021 ADVA. All rights reserved. 16 Precisely synchronizing a wide range of applications PTP G.8265.1 PTP/NTP enterprise PTP G.8275.2 PTP G.8275.1 2G/3G/4G/5G FDD DOCSIS 3.1 small cells APTS MIFID II automation 5G/LTE TDD LTE-A small cells PTP broadcast (SMPTE ST-2059-2/AES67) Professional broadcast Power utilities PTP power New
- 17. © 2021 ADVA. All rights reserved. 17 OSA 5412/2x/30/40 are now supporting PTP broadcast profiles Redundant PTP broadcast GM with OSA 54xx Remote Onsite Video processing Video server Video router Packet network Media, control and timing GM IP#1 GM IP#2 Two GM in one 1U Remote Onsite Video processing Video server Video router Packet network Media, control and timing OSA 5412/22 GM IP#1 OSA 5412/22 GM IP#2 OSA 5430/40 PTP PTP PTP Improving sync networks with professional broadcast
- 18. © 2021 ADVA. All rights reserved. 18 OSA 5440 BITSx16R cards output 1:1 protection Carrier grade next-generation SSU OSA 5440 ePRTC , PRTC-A/B, NG SSU , PTP GM • All hardware modules are fully redundant (power, input, output and clock modules) • Up to 160xBITS E1/2.048MHz outputs • Up to 64xBITS protected outputs (1:1 protection) • Hitless switching in case of failure • Up to 48x 1G/10G Ethernet ports • Up to 50x composite clock protected outputs Making BITS at scale redundant New
- 19. © 2021 ADVA. All rights reserved. 19 OSA 54xx now support multiple 100Mbit/s I/F over fiber Optical timing channel (OTC) over 100Mbit/s I/F WDM OTC 100M OSA 5430/40 ePRTC OSA 5430/40 ePRTC PTP Sync-E WDM OTC 100M OSA 5422 BC type C/D OSA 5412/22/30/40 now support BC Type C/D on 100M fiber ports WDM OTC 100M OSA 5412/22/30/40 now support BC Type C/D on 100M fiber ports OSA 5412/22/30/40 now support BC Type C/D on 100M fiber ports OSA 5412/22/30/40 now support BC Type C/D on 100M fiber ports • 100 Mbit/s gray/colored interfaces • Robust transmission for highest availability and best accuracy • High link-loss margins simplify planning Separate timing channel
- 20. Thank you IMPORTANT NOTICE ADVA is the exclusive owner or licensee of the content, material, and information in this presentation. Any reproduction, pub lication or reprint, in whole or in part, is strictly prohibited. The information in this presentation may not be accurate, complete or up to date, and is provided without warranties or repre sentations of any kind, either express or implied. ADVA shall not be responsible for and disclaims any liability for any loss or damages, including without limitation, direct, indirect, incidental, consequential and special damages, alleged to have been caused by or in connection with using a nd/or relying on the information contained in this presentation. Copyright © for the entire content of this presentation: ADVA. www.oscilloquartz.com | info@adva.com