Abstract:
A technique is proposed for performing add/drop operations in an OADM assembly serving an optical network and comprising an add unit and a drop unit. With respect to at least one optical channel assigned to an optical wavelength λ, the OADM assembly is capable of dropping the channel from the network via the drop unit as a first signal, and adding the channel to the network via the add unit as a second signal. According to the technique, the OADM assembly additionally comprises an authentication and control unit ACU for authenticating the at least one optical channel and controlling the OADM assembly. The ACU is authenticates the optical channel by comparing one or more components of the first signal with one or more components of the second signal serving as a reference, and based on the authentication result, makes decisions whether to allow or block the dropping and/or adding of the optical channel.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to optical add drop multiplexers (OADMs). 
       BACKGROUND OF THE INVENTION 
       [0002]    A number of papers, for example Jigesh K. Patel, Sung U. Kim, David H. Su, Suresh Subramaniam, Hyeonig -Ah Choi “ A Framework for Managing Faults and Attacks in WDM Optical Networks ”—supported in lo part by the DAPRA under grant N66001-00-18949 and Shut-Kit Chan, Frank Tong, Lian-Kuan Chen, Dennis Lam “ Demonstration of a Fault - Tolerant WDM add - drop/branching Unit for Long Haul Optical Transmission Systems”. IEEE Photonics Technology Letters,  vol 11, No. 8, August 1999 discuss a problem of managing faults and attacks in WDM optical networks, and a model of a fault-tolerant add-drop branching unit. Such a unit is planned to detect fiber cuts and failures of optical amplifiers. All operations performed in the discussed unit are based on checking and comparing power of the received, added and dropped signals. 
         [0003]    US patent application 2004/0175179 describes a self-adjusting optical add-drop multiplexer (OADM), and optical network using same. The self-adjusting optical add-drop multiplexer monitors the power in a drop signal and attenuates the power in an add signal to match the power in express WDM channels (signals). When used in a fiber network, and more particularly, in a metro network, the deleterious effects of optical amplification are reduced. Power attenuation is also used in an optical switching assembly particularly useful in two-fiber ring network. The optical switching assembly monitors drop channels from the two rings of the network and attenuates the add channel(s) accordingly. An optical switch operates to direct the drop signal from one of the two rings to a receiver in accordance with a control signal based on the monitored drop channels. The self-adjusting optical add-drop multiplexer also monitors the power in the drop signals and issues an alarm if the drop signal is of a power level above or below predetermined levels. 
         [0004]    It should be noted that the above self-adjusting OADM sets a task of adjusting (equalizing) powers of added, dropped and through channels. It does not pay any attention at all to a possibility of penetration, into the optical network, of a signal having a wrong (or non-exact) optical wavelength, or an optical wavelength issued from a foreigner source. 
         [0005]    US published patent application 2004/0109685 A1 describes an OADM comprising a demultiplexer wherein each optical channel is being marked with a pilot tone for channel identification and monitoring. The pilot tones are detected, cleaned from ghost tones, and then re-inserted in the respective optical channels being fed into the multiplexer of the OADM, for multiplexing said optical channels into a WDM output signal. 
         [0006]    The above-mentioned 2004/0109685 A1 is intended for monitoring the presence or absence of different optical channels in the network for purposes of management; it does not consider a task of channel authentication and/or security in optical networks. The problem of authentication of optical channels becomes especially important when optical networks utilize novel reconfigurable OADMs. 
         [0007]    To the best of the Applicant&#39;s knowledge, solutions to such a problem have not been considered in the prior art. 
       SUMMARY OF THE INVENTION 
       [0008]    It is therefore the object of the invention to provide a technological solution enabling more safe and secure operation in optical networks utilizing OADMs (especially reconfigurable or tunable OADMs). 
         [0009]    The above object can be achieved by providing an OADM assembly comprising a drop unit and an add unit for serving an optical network (preferably, a multi-channel WDM optical network), wherein with respect to at least one optical channel assigned to an optical wavelength λ, said OADM assembly being capable of
       dropping said channel from the network via the drop unit as a first signal, and   adding said channel to the network via the add unit as a second signal,
 
the OADM assembly additionally comprising an authentication and control unit ACU for authenticating said at least one optical channel and controlling said OADM assembly,
   said ACU being operative to authenticate said at least one optical channel by comparing one or more components of said first signal with one or more components of said second signal serving as a reference,   the ACU being also operative to allow or block the dropping of said optical channel to a client and/or the adding of said optical channel, based on a result of said authentication.       
 
         [0014]    In the frame of the present patent application, the term authentication of an optical channel should be understood as checking, for example:
       a) whether an optical channel dropped at a specific port of the OADM is indeed the channel which is expected at that specific port of the OADM,   b) whether the signal (the first signal) in the dropped channel comprises specific indications accepted in the network, and the like.       
 
         [0017]    The checking of the dropped channel can be performed by checking whether the signal (first signal) dropped at a port assigned at the OADM for said dropped channel, satisfies one or more specific requirements which are posed in the network and presented in the OADM (with the aid of equipment of its add unit) as one or more components of the second signal which can be produced at least for the purpose of the authentication. 
         [0018]    The proposed OADM further incorporates a new feature of allowing or precluding the drop and/or add operations based on the authentication results obtained at the ACU unit. 
         [0019]    However, there are other conditions, which should preferably be taken into account by the ACU for deciding whether to perform the add/drop operations, for example such conditions may be as follows:
       whether the dropped channel, which has really been dropped, should have to be dropped at the OADM according to information obtained from the Network Management System (NMS);   whether the client submitted a predetermined ID/password to ACU, matching to that stored in the ACU.       
 
         [0022]    It should be kept mind that, in the frame of the present application, the drop operation is to be understood as an operation of supplying information dropped from the OADM to an authorized client. The self- checking OADM and the corresponding method may further enable checking a predetermined key/ID/password submitted by a client to the OADM, and allowing the dropping operation only when this key is approved by the OADM. 
         [0023]    For processing the authentication results and any additional conditions, and for making the decision concerning the add/drop operations, the ACU comprises a control and processing unit CP. 
         [0024]    The most important implementation of such an authentication arrangement is for re-configurable OADMs (ROADM), where the added and the dropped channels can be varied and where the hardware responsible for selecting different channels to be dropped/added is always in a stand-by position. Tunable OADMs can be considered a type of ROADMs. 
         [0025]    The authentication and control unit is preferably capable of continuously monitoring said at least one optical channel. 
         [0026]    The authentication can be based on detecting, by said authentication and control unit ACU, presence or absence of a predetermined modulating tone in the first signal of an optical channel to be dropped and in the second signal of said optical channel to be added, thereby if both the first signal and the second signal comprise the predetermined modulating tone, said optical channel is authenticated. Preferably, the ACU preliminarily applies the predetermined modulating tone(s) to the carrier wavelength λ, thus obtaining the modulated second signal serving the reference. 
         [0027]    For the purpose of the following description:
       1) we will call λd the optical carrier wavelength of an optical channel which has really been dropped at a particular port of the drop unit of said OADM, wherein the optical channel having the optical carrier wavelength λ is expected at said particular port.   2) We will call λa (wherein λa=λ) the optical carrier wavelength of an optical channel technically available to be added via the add unit. It goes without saying that the optical channel having the carrier wavelength λ can be added to the network only when that optical channel is absent at that particular network section, for example when the same optical channel has been just dropped.       
 
         [0030]    In one preferred embodiment, the authentication may comprise comparison of the carrier wavelength λd with the corresponding carrier wavelength λa=λ, (actually, with the expected carrier wavelength λ), by comparing their respective carrier frequencies ω λd  and ω λ ; the authentication and control unit ACU further decides whether to allow the dropping operation and/or the adding operation, based on a result of the comparison. 
         [0031]    In the preferred embodiment,
       the add unit comprises at least one tunable laser TL for adding said at least one optical channel to the WDM optical network,   the ACU of the OADM is capable of selectively altering the carrier frequency ω λa  at the wavelength λa to obtain a control signal with altered frequency ω λa ±ω λif , where λif is a so-called intermediate wavelength being not an accepted wavelength of any optical channel in said network;   the ACU comprising a mixing block for mixing said control signal with said first signal having the carrier frequency ω λd , thereby obtaining a mixed signal;   the ACU further comprising an optical filter capable of detecting energy in the mixed signal at the intermediate frequency ω λif ,   the ACU also comprising a comparator block capable of comparing the energy detected by said filter with a predetermined energy threshold.       
 
         [0037]    Preferably, the comparator block includes an optic to electric (O/E) converter at its input, for converting optical energy detected at the optical fiber into electrical energy to be inputted into said comparator. 
         [0038]    In a further embodiment, the ACU (more particularly, CP of the ACU) should be capable of allowing or not allowing operations of adding/dropping by further taking into account information about expected channels to be dropped/added at specific ports of the OADM, usually provided to the OADM by a Network Management System (NMS). 
         [0039]    In this specific case, the ACU of the OADM assembly is capable of performing:
       a) monitoring a port of the drop unit, assigned to an optical channel having a carrier wavelength λ which is expected according to information from NMS, for detecting presence of any dropped channel;   b) authentication of the optical channel whenever detected, and   c) based on results of the steps a) and b), deciding whether to allow the adding of said optical channel via the add unit to the network and/or the dropping of the optical channel via the drop unit to the client.       
 
         [0043]    There is also provided a method for performing add/drop operations in an OADM assembly serving an optical network (such as a multi-channel WDM optical network) and comprising a drop unit having a number of ports and an add unit, the method comprises performing the following operations within the OADM assembly:
       detecting a first signal dropped from the network at the drop unit at a port assigned to an optical channel having an optical carrier wavelength λ,   providing a second signal having the carrier wavelength λ of said optical channel, said second signal being suitable for adding to the network via the add unit,   performing authentication of said optical channel by comparing one or more components of said first signal with one or more components of said second signal serving as a reference,   allowing or blocking the drop operation of said optical channel to a client and/or the add operation of said optical channel to the network, based on a result of said authentication.       
 
         [0048]    The method preferably comprises continuous or periodic monitoring of said at least one port of the drop unit for detecting said first signal. 
         [0049]    As described above concerning the OADM assembly, the authentication may comprise, for example, checking the fact of presence of a predetermined modulating tone (s) in the first signal; said predetermined modulating tone(s) is/are preliminarily inserted in the second signal to make it suitable for being added to the network. 
         [0050]    Further, the modulating tone can be periodically changed in a preliminarily agreed order (say, a digital code applied to the modulation), which is “known” to nodes originating the traffic in the discussed OADM network (but unknown to an intruder trying to penetrate the network with using false optical channels). 
         [0051]    Preferably, (alternatively or in addition), the authentication step of said optical channel may comprise:
       comparison of a real carrier wavelength λd of the first signal dropped at the drop unit with the carrier wavelength λa of the second signal ready to be added via the add unit, (wherein λa=λ); and   considering the optical channel to be authenticated when said λd is essentially equal to said λa.       
 
         [0054]    Using the above approach, the real carrier wavelength λd of the dropped signal is compared with the expected carrier wavelength λ. It can be performed by comparing their respective carrier frequencies ω λd  and ω λa , (where ω λa =ω 80 ), 
         [0055]    Particularly, the comparison of the wavelengths λa and λd can be performed as follows:
       selectively altering the carrier frequency ω λa  at the wavelength ka to obtain a control signal with altered frequency ω λa ±ω λif , where λif is a so-called intermediate wavelength being not an accepted wavelength of any optical channel in said network;   mixing said control signal with said first signal having the carrier frequency ω λd , thereby obtaining a mixed signal;   detecting energy of the mixed signal at the intermediate frequency ω λif , comparing the energy detected by said filter with a predetermined energy threshold,   if the energy is equal or higher than said threshold, considering that the wavelengths λa and λd are essentially equal (thereby λd is authenticated);   if the energy is lower than said threshold, considering that λd essentially differs from the λa, (thereby λd is not authenticated).       
 
         [0061]    It should be noted that, due to the generally sinusoidal character of the mixed signals, only in case that λb is essentially equal to λa, the filter detects considerable energy at a narrow frequency interval around the intermediate frequency ω λif  corresponding to the wavelength λif. 
         [0062]    Further, the step of allowing or blocking the operation of adding and dropping preferably comprises taking into account information about:
       expected channels to be dropped/added at specific ports of the OADM (usually provided to the OADM by a Network Management System (NMS);   results of authentication , if conducted by checking additional components of the first signal of said optical channel;   checking of ID/password, if presented by a client supposed to receive the first signal from the OADM and checked in said OADM.       
 
         [0066]    More specifically, the method may comprise checking a predetermined ID/password submitted to the OADM assembly by a client supposed to receive said first signal, and allowing the dropping operation to said client only when the ID/password is approved by the OADM. 
         [0067]    The above method and the suitable OADM equipment allows detecting a) internal faults in the OADM assembly, b) faults/degradations of laser sources of the WDM optical network, which transmit signals to the discussed OADM, as well as c) interference of possible foreign/fraudulent sources of optical signals. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0068]    The invention will further be described with reference to the following non-limiting drawings, in which: 
           [0069]      FIG. 1  illustrates one schematic embodiment of the proposed self-checking OADM. 
           [0070]    FIG.  2 —illustrates one exemplary embodiment of the authentication and control unit ACU of the OADM, based on comparing wavelengths of a channel to be dropped and a corresponding channel ready to be added. 
           [0071]    FIG.  3 —illustrates another specific embodiment of the OADM, wherein its Authentication and Control unit ACU is based on detecting an expected modulating tone in an optical signal to be dropped. 
           [0072]      FIGS. 4   a  and  4   b —illustrate exemplary tables presenting the proposed add/drop control mechanism of the self-checking OADM, taking into account instructions obtained at the OADM from a Network Management System (NMS). 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0073]      FIG. 1  illustrates a general scheme of the proposed self-checking OADM assembly  10 . The assembly comprises a drop unit  12  including a plurality of tunable filters (not shown), an add unit  14  coupled to a group  15  of tunable lasers TL 1  . . . TLn, and a proposed authentication and control unit (ACU)  16 . The tunable lasers may form part of the add unit, in this case such an add unit can be implemented as an optical transponder. 
         [0074]    Each of the tunable lasers TL 1 , TL 2 , . . . TLn is respectively associated with a data modulating block  17 ( 1 ),  17 ( 2 ) . . .  17 (n) which can be placed either before switch  25 , or after switch  25 . A Network Management System NMS schematically marked  13  controls the OADM assembly  10  via its ACU  16 . 
         [0075]    In the illustrated diagram, the ACU  16  is adapted to continuously check an optical channel to be dropped, that has a carrier wavelength λ 1   d . The checking procedure is performed as follows:
       a) The Network Management System (EMS)  13  informs the ACU which optical channel is to be dropped and which is to be added (say, λ 1  called λ 1   d  is to be dropped and λ 1  called λ 1   a  is to be added);   b) the signal obtained at the drop unit  12  over the carrier wavelength λ 1   d —i.e., the first signal  18 —is fed to the ACU  16 ;   c) ACU activates the tunable laser TL 1  in the group  15  that serves the add unit  14 , in order to obtain a second signal to be transmitted at the required carrier wavelength λ 1  (called λ 1   a ). The tunable laser TL 1  emits a required carrier wavelength λ 1   a . The emitted wavelength is usually modulated by a data signal at the block  17 ( 1 ). Optionally, the carrier wavelength or the data can be modulated by a predetermined modulating or dithering tone (equipment for that is not shown in this figure). The obtained resulting signal constitutes the so-called second signal  20 . In other words, the second signal may comprise the carrier wavelength only, or the carrier wavelength modulated with a modulating tone and/or a data signal.   d) The obtained second signal is then fed to the ACU  16 , where it is compared with the first signal  18 .       
 
         [0080]    If the two signals coincide (i.e., one or more of their components are substantially equal, depending on a number of conditions preliminarily set)—the channel associated with λ 1   d  is authenticated and the drop operation can be allowed (control arrow  22  to the switch  23 ). We keep in mind that, in the frame of the present application, the drop operation is to be understood as an operation of supplying information dropped from the OADM, to an authorized client. The method and the corresponding self-checking OADM may further ensure checking a predetermined key/password submitted by a client  19  to the OADM (i.e., to its ACU), and allowing the dropping operation only when the key is approved by the OADM. 
         [0081]    If the corresponding add operation is required according to the instruction of NMS  13 , it can also be allowed, though detailed conditions of allowing the add/drop operations will be discussed later on, with reference to  FIG. 4 . 
         [0082]      FIG. 2  shows one preferred embodiment  16 A (shown in dotted lines) of the ACU, which performs comparing a first signal  118  and a second signal  120  from the point of their carrier wavelengths. Several reasons may explain the necessity of checking the wavelength. In a real network and in a real OADM, a port intended for dropping one specific optical channel may apparently be configured (say, by mistake) for dropping a different channel. Another example is any internal fault in the add block of the OADM, which may also cause discrepancy when attempting to check a dropped signal, and will thus allow detecting the presence of an internal fault. A third example is a non-exact carrier wavelength, which may be caused by any fault in the optical network or used by an intruder to penetrate to the network and interfere into its work; such a non-exact wavelength may therefore be detected if properly checked. 
         [0083]    In this drawing, functions of the ACU  16 A are illustrated with respect to one optical channel only, but analogous operations can be simultaneously performed with respect to other optical channels, whenever required: similar ACU assemblies, or a combined ACU can be built to serve multiple optical channels. 
         [0084]    The ACU  16 A comprises a first mixer block  26  coupled with a generator  27  of frequency ω λif , a second mixer block  28 , a narrowband optical filter  30  for detecting frequencies in close proximity to ω λif , an optic to electric (O/E) converter  31 , a comparator  32  and a control processing unit CP  34 . Input ports of CP  34  receive commands from NMS  13 , optionally from a client  36 . Output ports of CP  34  issue internal control instructions in the OADM assembly  10 . Output ports of the CP  34  activate one or more required tunable lasers from the group  15 , and control the drop operation and the add operation of the OADM assembly via the schematically shown switches  23  and  25 , respectively. CP may also report results of the authentication process to the NMS. 
         [0085]    The second signal  120  has the carrier frequency ω λ1a  and optionally carries data added at the modulator  17 ( 1 ). It is mixed (multiplied) at the first mixer block  26  with a signal having frequency ω λif , produced by the generator  27 . The result of the first mixing is a control signal having the altered frequency ω λ1a ±ω λif , which appears at the output of the first mixer block  26 . 
         [0086]    The control signal is further fed to the second optical mixer block  28 , where it is mixed (multiplied) with the first signal  118  arriving from the drop unit  12  at the carrier frequency ω λ1d . 
         [0087]    The result of the second mixing will be called a mixed signal; it is further fed to the fixed optical narrowband filter  30  adjusted to detect signals in the vicinity to the frequency ω λif . 
         [0088]    For simplicity of the description, let us assume that all the signals are sinusoidal. Trigonometric mathematical transformations show that the mixed signal will comprise a detectable component around the above-mentioned frequency only when 
         [0000]      λ1( d )=λ1( a ), i.e., λ1( d )=λ. 
         [0089]    (One example of the calculation will be presented below.) 
         [0090]    Upon converting the signal detected by the optical filter  30  into electric form (by the O/E converter  31 ), the comparator  32  compares energy of the signal with a predetermined threshold Th, and provides the result to the CP block  34 . Based on that, the CP  34  decides whether to confirm authentication of the optical channel to be dropped, and whether to allow the drop and/or add operations taking into account information obtained from the NMS  13  and, optionally, from modules  35  checking the dropped signal according to other parameters, and/or from the client  19 . 
         [0091]    Example of the calculation: 
         [0092]    Let us check, using a specific example, how the proposed two-stage mixing of sinusoidal signals helps performing authentication of an optical channel to be dropped. 
         [0093]    Remember that 
         [0000]      cos(α)cos( 62  )=½[cos(α+β)+cos(α−β)]  (1) 
         [0094]    Let the interacting three signals are as follows:
       A(t)cos (ω λd t)—is a first signal dropped from the drop unit (i.e., it is not obligatory dropped directly to the client) in an optical channel having a carrier wavelength λd and modulated by a function A(t) being data, a modulating tone or the like.   Bcos(ω λ1 t)—is a second signal generated and ready to be added to an optical channel having wavelength λ 1 . In this case, we assume that no data or other modulation is applied to the carrier wavelength λ 1 .   cos(ω λif t)—is a so-called control signal having an intermediate wavelength λif not belonging to any accepted optical channel. The control signal is taken without any coefficient.       
 
         [0098]    1. When a second signal is mixed (multiplied) with the control signal, the following signal is obtained: 
         [0000]        B  cos(ω λ1   t )*cos(ω λif   t );  (2) 
         [0099]    2. When the obtained signal is further mixed (multiplied) with the first signal, the following mixed signal is obtained: 
         [0000]        A ( t ) B  cos(ωλ1 t )*cos(ωλ ift )*cos(ωλ dt )  (3) 
         [0100]    3. By applying the above-mentioned trigonometric transforming equation (1) to the first two “cos” functions in the signal (3), the above expression can be written down as follows: 
         [0000]      ½  A ( t ) B {cos[(ω λ1 −ω λif ) t ]+cos[(ω λ1 +ω λif ) t ]}cos(ω λd   t )  (4) 
         [0101]    To transform the whole expression (4), let us multiply: 
         [0000]      ½  A ( t ) B {cos[(ω λ1 −ω λif ) t ]*cos(ω λd   t )  (4a), and 
         [0000]      ½  A ( t ) B {cos[(ωλ1 +ωλif ) t ]*cos(ω λd   t )  (4b) 
         [0102]    If we apply the trigonometric equation (1) to (4a), we will obtain: 
         [0000]      ¼  A ( t ) B {cos[(ω λd −ω λ1 +ω λif ) t ]+cos[(ω λd +ω λ1 −ω λif ) t ]} 
         [0103]    If we apply the trigonometric equation (1) to (4b), we will obtain: 
         [0000]      ¼  A ( t ) B {cos[(ω λ1 +ω λif +ω λd ) t ]+cos[(ω λ1 +ω λif −ω λd ) t ]} 
         [0104]    4. If now we assume that λ 1 =λd, both the part (4a), and the part (4b) of the signal (4) will look as follows: 
         [0000]      ¼  A ( t ) B {cos(ω λif   t )+cos(2ω λ1 −ω λif ) t}   (4c) 
         [0105]    Therefore, the complete signal (4) will look as follows: 
         [0000]      ½  A ( t ) B {cos(ω λif   t )+cos(2ω λ1 −ω λif ) t}   (4d) 
         [0106]    The above means that if the assumption is true, the first component of the signal (4d) can be detected, with a considerable amplitude ½ A(t)B, by a narrowband filter at the frequency ω λif  (or at the wavelength λ if ). The second component “cos(2ω λ1 −ω λif )t” of the signal (4d) will be spaced, by wavelength and frequency, quite far from the first component and cannot be detected by the narrowband filter of frequency ω λif . Therefore, if λ 1 =λd of the dropped signal, that fact can be confirmed by detecting expected energy at the wavelength λ if . 
         [0107]    The remaining component “cos(2ω λ1 −ω λif )t” will be just filtered out by the narrowband filter. 
         [0108]    5. If, by any mistake or by purpose λd=λ 2  ( i.e., λd is not equal to λ 1 ), the signal (4) will comprise two components, each being as follows: 
         [0000]      ¼  A ( t ) B {cos[(ω λ1 +ω λ2 ) t ]+cos[(ω λ1 +ω λif −ω λ2 ) t ]} 
         [0109]    In such a case, none of the components of signal (4) will be detected by the narrowband filter at the wavelength λ if  (no energy will be detected at the output of the narrowband filter of ω λif ). This fact can serve the evidence that the dropped channel has the wavelength different than that of the channel which is supposed to be added instead of the dropped one. 
         [0110]      FIG. 3  illustrates one alternative embodiment  16 B of the Authentication and Control unit ACU, based on detecting and checking an expected modulating tone(s) in a specific optical signal to be dropped. However, checking the presence/absence of a modulating tone in the optical channel can be performed in addition (and in parallel) to the method of channel authentication shown in  FIG. 2 . Such a combined authentication can be performed by a combined authentication module. More than one such combined modules for checking/authenticating different optical channels can be incorporated in the self-checking OADM. 
         [0111]    A first optical signal  218  to be dropped via the OADM, having the carrier wavelength λ 1   d  (or the carrier frequency ω λ1d ) and supposedly modulated by a predetermined modulation tone(s), is applied to an optic/electric converter  40  illustrated as a light diode. The obtained electrical signal is applied to an electrical tunable filter  42  adjusted to the frequency of the expected predetermined modulation tone(s). 
         [0112]    In the add block of the proposed OADM, the mentioned predetermined modulating tone (modulating frequency) should be preliminarily applied to the carrier wavelength λ 1   a  of the optical channel which is ready for replacing the corresponding dropped channel having the wavelength λ 1   d . It is performed using a modulating frequency (MF) block  44  which can be controlled by NMS, and preferably via the CP  54  of ACU  16 B. To provide a reference for checking the first signal, the modulating frequency is to be extracted from the second signal  220 , using the O/E converter  46  and the tunable electrical filter  48 . Further, for the case of FM modulation, two filtered signals are detected by two respective detectors of the modulation frequency: FM detector  50  and FM detector  52 . Outputs of the detectors  50  and  52  are compared by a comparator (such as a correlator)  53 , and the result of comparison is fed to one of inputs of a control-processing block CP which is marked  54  in this figure. Other inputs of the CP  54  serve for: receiving instructions from NMS or other managing entity (preferably), receiving ID data from a client supposed to obtain the dropped channel (optionally), and may also serve for receiving additional information (optionally), for example concerning other parameters checked in the channel to be dropped (say, its wavelength, as proposed in  FIG. 2 ). 
         [0113]    It should be noted that an additional code may be transmitted over the predetermined modulation tone, for further detecting and identifying at the OADM. The additional code can be applied using modulation techniques other than that of the modulating tone, for example using PSK, etc. 
         [0114]      FIGS. 4   a  and  4   b —illustrate an example of add/drop mechanism (in the table form) for the proposed self-checking OADM; the mechanism is based on monitoring the presence of the optical channel to be dropped and on the result of authentication of that channel and other conditions (though they are not all reflected in the tables, for example confirming the client&#39;s ID). The mechanism is implemented by a Control and Processing unit. One important assumption of the algorithm is that the Network Management System (NMS) is updated about the present status of channels which should exist in the network. Another important assumption is that NMS never requests adding a specific channel to the network link if that channel is considered by the NMS to be already present in that link. In the tables  4   a  and  4   b,  it is assumed that NMS has ordered adding the channel with the wavelength λ 1   a  (either instead of the dropped one λ 1   d , or to the suitable free channel in a WDM link). 
         [0115]      FIG. 4   a  illustrates an example of the add/drop mechanism in the self-checking OADM assembly  10 , where the ACU is based on comparing the carrier wavelengths of a channel to be dropped and of a corresponding channel to be added. One may notice that in cases where the status of the dropped channel according to NMS contradicts to the internally checked presence of a signal in the expected channel (see lines  1 ,  4  of the table  4   a ), the ACU of the OADM states the situation of fault/fraud and does not allow the drop and add operations. 
         [0116]      FIG. 4   b  illustrates a similar table, which can be built when another criterion is checked for authentication of an optical channel to be dropped via the OADM  10 . In this table, the criterion is the presence or absence of a pre-determined modulating tone in the signal of a channel to be dropped, equal to that which is inserted in the signal of the corresponding channel to be added at the OADM. One may note that the table  4   b  is just the table  4   a  where the second column is replaced with analogous information related to the modulating tones (please refer to  FIG. 3 ). However, if the client&#39;s ID/password/key were required to be presented to the ACU(CP) of the OADM for check and then occurred to be incorrect, the dropping operation can never be allowed. 
         [0117]    One should appreciate that other embodiments of the Authentication and Control unit (ACU) of an OADM assembly could be presented and considered part of the invention, the ACU should be capable of comparing a signal created at the add unit of the OADM for a particular optical channel with a signal dropped by the drop unit of the OADM in the same optical channel, and capable of deciding whether to allow dropping of that channel to the client, and/or adding thereof to the network.