To determine whether the physical fiber carrying an optical service has been substituted, rerouted, or spoofed, we propose a physical-layer authentication method based on multi-wavelength chromatic dispersion (CD) fingerprints. Link-specific variations in refractive-index profile, geometry, residual stress, and local microstructure produce repeatable differences in cumulative CD across multiple wavelengths. The proposed method estimates CD at N C-band wavelengths and applies reference-based standardization using statistics obtained during legitimate-link enrollment, followed by Euclidean-distance matching against templates stored in a secure template database (STDB). For a 100-km G.652D link, the calibrated decision threshold is ε = 0.3071. Receiver operating characteristic (ROC) analysis yields area under the curve (AUC) values of 0.992125, 0.999685, and 0.999999 for substitution, baseline spoofing, and rerouting attacks, respectively. Under common temperature changes from −15 to 15 °C and end-to-end spatial temperature variations from 0 to 30 °C, the legitimate-link false rejection rate (FRR) remains approximately 0.58–1.65%. Additional analyses evaluate the effects of fingerprint dimension, signal-to-noise ratio (SNR), fiber length, and practical CD-estimation impairments. The method can reuse CD-estimation functions in coherent-receiver digital signal processing (DSP), providing a complementary physical-layer link-authentication mechanism for optical networks.
To determine whether the physical fiber carrying an optical service has been substituted, rerouted, or spoofed, we propose a physical-layer authentication method based on multi-wavelength chromatic dispersion (CD) fingerprints. Link-specific variations in refractive-index profile, geometry, residual stress, and local microstructure produce repeatable differences in cumulative CD across multiple wavelengths. The proposed method estimates CD at N C-band wavelengths and applies reference-based standardization using statistics obtained during legitimate-link enrollment, followed by Euclidean-distance matching against templates stored in a secure template database (STDB). For a 100-km G.652D link, the calibrated decision threshold is ε = 0.3071. Receiver operating characteristic (ROC) analysis yields area under the curve (AUC) values of 0.992125, 0.999685, and 0.999999 for substitution, baseline spoofing, and rerouting attacks, respectively. Under common temperature changes from −15 to 15 °C and end-to-end spatial temperature variations from 0 to 30 °C, the legitimate-link false rejection rate (FRR) remains approximately 0.58–1.65%. Additional analyses evaluate the effects of fingerprint dimension, signal-to-noise ratio (SNR), fiber length, and practical CD-estimation impairments. The method can reuse CD-estimation functions in coherent-receiver digital signal processing (DSP), providing a complementary physical-layer link-authentication mechanism for optical networks.
To address credential cloning and limited auditability in passive optical networks (PONs), we present a simulation-based proof of concept for access authentication that integrates distance-conditioned bit-error-rate (BER) fingerprinting with a permissioned blockchain.A BER-distance reference template is constructed under registered link conditions.During authentication, normalized deviations between real-time pre-forward-error-correction BER and registered references serve as channel fingerprints for physical-layer authentication, while an adaptive threshold, calibrated on simulated legitimate observations, assesses physical-path consistency.Nonce-bound signed measurement evidence supports auditable authorization through practical Byzantine fault tolerance consensus.On an independent simulated test set, the validation-selected threshold yields a false rejection rate of 0.493% and a false acceptance rate of 0.019%; the uncertainty-scaled, relative, and absolute BER-deviation measures yield area under the curve values of 0.99999, 0.99990, and 0.90524, respectively.The results support feasibility under the modeled conditions; hardware validation remains necessary, and compensation attacks limit BER-based discrimination.
Security in optical communications has been recently a concern due primarily of the vast amount and the sensitivity of information that a single fiber carries. It is generally accepted that data security is encrypted by the end-user and that the optical network is not easy to tap as it was with wired networks. However, the sophistication of eavesdroppers has increased and if an optical link is accessed, then the encryption code of data can be broken with the use of supercomputers. In addition to data eavesdropping, eavesdroppers may access the link for malicious attacks, or for transmitting erroneous data by mimicking a source. Therefore, it is important that the receiver has the means and intelligence to recognize the signature of the source and the optical channel so that when the link is tapped, the receiver recognizes it and it alerts the network management or it triggers a data rerouting process. In fact, an optical channel, including source, fiber and optical components, has its own optical parameters that constitute a signature. These parameters are the result of linear and non-linear phenomena that affect the quality characteristics of the optical signal and which can not be mimicked. Therefore, the understanding of optical parameters that define the optical channel signature is very critical. In this paper we provide an analysis of the factors affecting the signal quality and thus they constitute the signature of the optical channel, we model the optical channel and demonstrate via simulations that small parametric variation affect the signature of the channel. As a result, monitoring the signal parameters leads to source and channel authentication whereas detecting the parametric variability of channel deducts channel degradation or tapping.
Network security has traditionally been limited to network access and network administration, whereas data security is left to end clients where text is encrypted and decrypted. In the last decade, there has been a rapid increase in bandwidth demand mainly due to the explosion of the Internet and mobile telephony. The explosive bandwidth has been comfortably met with optical networks having many optical channels multiplexed in the same fiber, known as wavelength division multiplexing,. Data rate exceeding 1 Tbps within a fiber implies that there are tributaries that carry sensitive and proprietary data. Although data are encrypted by the end client, there is no assurance that, if captured by an eavesdropper, they may not be decrypted. Therefore, three new requirements emerge; monitor the optical link integrity, detect if an optical channel is compromised by tapping the fiber, and adopt a countermeasure strategy. One way to accomplish this is to monitor the channel performance parameters for changes in real-time. In this paper, we analyze key performance parameters of the optical signal, we describe how these parameters impact the channel performance. In addition, we develop a method to estimate in real-time the bit error rate and signal to noise ratio, and how these can be used to detect fiber intrusion. Finally, we develop a countermeasure protocol that we believe outsmarts the eavesdropper.
A novel digital signal processing (DSP)-based scheme for physical layer security in coherent optical communication systems is proposed and numerically investigated. The optical layer signal encryption is accomplished by two dispersive elements and one phase modulator (PM) driven by a DSP-generated encryption key, whilst signal decryption uses similar components but with inverted dispersion values and security keys. A critical aspect of the DSP-based physical layer security is that the security keys, driving the PMs to hide/recover the data signals, must be highly unpredictable and noise-like, thus orthogonal frequency division multiplexing (OFDM) signals are employed as they possess these characteristics, they can also be easily generated and cover a suitably wide range of unique keys. Numerical simulations are conducted to determine optimum system parameters for achieving a high level of security, the key parameters requiring optimization are the dispersion of the dispersive elements and the bandwidth of the security keys. Using these determined optimum parameters, in-depth investigations are undertaken of encryption/decryption induced transmission performance penalties, sensitives to various parameter offsets and operation over various transmission distances. To observe any data signal dependencies, various performance metrics are investigated for different combinations of modulation formats (DQPSK and 16QAM) and baud rates (40 Gbaud and 100 Gbaud) for the transmitted data signals. The proposed DSP-based physical layer security scheme is shown to have the potential to achieve, in a low-cost and highly effective manner, a high level of physical layer security with acceptable performance penalties for existing coherent optical communication systems.
Chromatic dispersion critically impacts the performance of numerous applications ranging from telecommunication links to ultrafast optics and nonlinear devices, yet fast and precise measurements are challenging, especially for short length-dispersion products. We present a fully fiber-integrated nonlinear Sagnac interferometer that exploits cascaded second-order processes to generate frequency-anticorrelated idler light and achieve odd-order dispersion cancellation without active stabilization. The measurement is intrinsically self-referenced, as the dispersion-induced phase is extracted from the interference between counter-propagating nonlinear processes within the same Sagnac loop, eliminating the need for an external reference arm or prior calibration. Operating entirely at telecom wavelengths and read out on a standard optical spectrum analyzer, the device produces instantaneous, high-visibility fringes and calibration-free spectra using dual-port normalization. We demonstrate chromatic dispersion measurements on fiber samples ranging from 25 cm to 4 km, spanning short fiber segments to long-haul links. This architecture combines self-stability, broadband compatibility, and rapid acquisition, offering a practical metrology tool for both research and industry.
We introduce a technique to generate and read the digital signature of the networks, channels, and optical devices that possess the fiber-optic pigtails to enhance physical layer security (PLS). Attributing a signature to the networks or devices eases the identification and authentication of networks and systems thus reducing their vulnerability to physical and digital attacks. The signatures are generated using an optical physical unclonable function (OPUF). Considering that OPUFs are established as the most potent anti-counterfeiting tool, the created signatures are robust against malicious attacks such as tampering and cyber attacks. We investigate Rayleigh backscattering signal (RBS) as a strong OPUF to generate reliable signatures. Contrary to other OPUFs that must be fabricated, the RBS-based OPUF is an inherent feature of fibers and can be easily obtained using optical frequency domain reflectometry (OFDR). We evaluate the security of the generated signatures in terms of their robustness against prediction and cloning. We demonstrate the robustness of signatures against digital and physical attacks confirming the unpredictability and unclonability features of the generated signatures. We explore signature cyber security by considering the random structure of the produced signatures. To demonstrate signature reproducibility through repeated measurements, we simulate the signature of a system by adding a random Gaussian white noise to the signal. This model is proposed to address services including security, authentication, identification, and monitoring.