Encryption over WDM links

An ISP client serving a national financial-sector customer needed highly secure encryption between four data centres connected by WDM links built on ADTRAN, Infinera and Huawei equipment. The goal was end-to-end encryption of sensitive data while maintaining low latency and high throughput.

To meet this requirement, we deployed ADTRAN FSP 150-XG118Pro devices. They provide a hardware encryption engine with AES-256 at full line rate (80 Gbit/s) and support MACsec with VLAN bypass, so traffic is encrypted transparently and without performance degradation.

Key aspects of the implementation

Security and cryptography

• AES encryption implemented in FPGA for real-time processing with minimal overhead.
• Built-in hardware security module (HSM) for secure key storage and authentication.
• Authenticated key exchange and tamper-detection mechanisms to prevent unauthorised access.
• Readiness for quantum-safe cryptography, ensuring long-term security.

Network and performance

• Eight 1/10GbE SFP+ ports and two internal 10GbE connections for high-capacity encrypted transmission.
• IEEE 802.1AX link aggregation and ITU-T G.8032 Ethernet ring protection for redundancy and reliability.
• Hardware-based synchronisation (IEEE 1588v2, ITU-T G.826x) for accurate timing, which is crucial for financial transactions.

Operational efficiency and flexibility

• Seamless integration with multi-vendor WDM networks (ADTRAN, Infinera, Huawei).
• Centralised SDN control and automation for streamlined management and rapid service provisioning.
• Temperature-hardened design (−40 °C to +65 °C) and redundant power supplies for high availability in data centres.

Thanks to the flexibility, cryptographic agility and robust key management of the ADTRAN XG118Pro, the solution was designed and implemented successfully. The financial-sector client now benefits from a fully secured, high-performance transmission network that complies with current encryption standards and regulatory requirements.