To address credential cloning and limited auditability in passive optical networks (PONs), we present a simulation-based proof of concept for access authentication that integrates distance-conditioned bit-error-rate (BER) fingerprinting with a permissioned blockchain.A BER-distance reference template is constructed under registered link conditions.During authentication, normalized deviations between real-time pre-forward-error-correction BER and registered references serve as channel fingerprints for physical-layer authentication, while an adaptive threshold, calibrated on simulated legitimate observations, assesses physical-path consistency.Nonce-bound signed measurement evidence supports auditable authorization through practical Byzantine fault tolerance consensus.On an independent simulated test set, the validation-selected threshold yields a false rejection rate of 0.493% and a false acceptance rate of 0.019%; the uncertainty-scaled, relative, and absolute BER-deviation measures yield area under the curve values of 0.99999, 0.99990, and 0.90524, respectively.The results support feasibility under the modeled conditions; hardware validation remains necessary, and compensation attacks limit BER-based discrimination.
To determine whether the physical fiber carrying an optical service has been substituted, rerouted, or spoofed, we propose a physical-layer authentication method based on multi-wavelength chromatic dispersion (CD) fingerprints. Link-specific variations in refractive-index profile, geometry, residual stress, and local microstructure produce repeatable differences in cumulative CD across multiple wavelengths. The proposed method estimates CD at N C-band wavelengths and applies reference-based standardization using statistics obtained during legitimate-link enrollment, followed by Euclidean-distance matching against templates stored in a secure template database (STDB). For a 100-km G.652D link, the calibrated decision threshold is ε = 0.3071. Receiver operating characteristic (ROC) analysis yields area under the curve (AUC) values of 0.992125, 0.999685, and 0.999999 for substitution, baseline spoofing, and rerouting attacks, respectively. Under common temperature changes from −15 to 15 °C and end-to-end spatial temperature variations from 0 to 30 °C, the legitimate-link false rejection rate (FRR) remains approximately 0.58–1.65%. Additional analyses evaluate the effects of fingerprint dimension, signal-to-noise ratio (SNR), fiber length, and practical CD-estimation impairments. The method can reuse CD-estimation functions in coherent-receiver digital signal processing (DSP), providing a complementary physical-layer link-authentication mechanism for optical networks.
Physical layer authentication is an important way to ensure the security of optical communication network. We hereby propose a scheme to realize it by measuring the variation of the bit error rate (BER) on both sides of communication. In this scheme, the legitimacy of the receiver is identified by analyzing the BER variation of the optical fiber loop based on the short-term correlation of the channels. We then simulate a 16 PSK optical transmission system with intensity modulation direct detection-orthogonal frequency division multiplexing (IMDD-OFDM). The authentication effect is analyzed in the case of disturbance and beam split, as well as replacement of optical fiber channels caused by eavesdropper (Eve). The results show that this scheme is sensitive to the three kinds of attacks. A high probability of detection (PD) and a low false alarm rate (FAR) can be obtained. The experimental results show that with the increase of the frequency test, PD and FAR tend to be stable, and the authentication effect is better with the accuracy rate 100%.
Quantum computing provides a feasible multi-layered security challenge to classical blockchain networks. Quantum blockchains that rely on quantum key distribution (QKD) to establish secure channels can address this feasible threat. Whereas, there are still architecture limitations to practical security resulted in the measurement devices while implementing the QKD-secured blockchains in physical layer. This paper presents a quantum-classical hybrid architecture in a distributed blockchain to address the connectivity and distance limitations of the blockchain-embedded quantum networks. A decoupled architecture is designed felicitously so that it pairs a linearly scalable measurement-device-independent (MDI) physical layer with a decentralized consensus. It can optimize the complexity of infrastructure from quadratic to linear scaling, ascribed to leveraging the twin-field (TF) QKD protocol with the MDI-structurized star topology. Additionally, the dual-key stratification strategy transforms symmetric information-theoretic security into publicly auditable forward-secret blockchain evidence. This architecture can integrate the exact information-theoretic security (ITS) with distributed consensus mechanisms, allowing the scalable system to overcome the potential rate-loss limits inherent in classical security-weakened blockchains.
Permissioned blockchains authenticate transactions, votes and quorum certificates with computationally secure signatures, and post-quantum replacements inflate consensus traffic by orders of magnitude. Information-theoretic alternatives have required a trusted authority, quantum channels, per-signature interaction, or single-use keys with bounded transfer. We present SILMARILS-MV, a multi-verifier unconditionally secure signature in which a signature is the vector
α=Ae(m) and each verifier holds a secret functional
ci=ΓTλ(xi) derived from virtual anchors
Γ that nobody learns. Against unbounded adversaries corrupting up to
ω verifiers and any signers, and observing every decision, an honest verifier accepts a forged or invalid signature with probability at most
Q/q+1/(q−1), a bound that is tight in its leading term. The scheme is strongly unforgeable, non-repudiable, transferable across unboundedly many hops, and linearly aggregatable. Keys are issued by the validators through perfectly secure MPC for
t<n/3, without broadcast. To scale, we let the committee itself sign: in threshold notarization, finality certificates have constant size
32(ω+1) bytes and per-validator issuance cost no longer depends on
n. Arbiter-verified keys give clients 32-byte signatures, robust redistribution supports membership changes and share refresh, and verifiers can be enrolled retroactively. A certificate verifies in 2.4 microseconds. In an analytic normal-case model at 1000 validators, threshold notarization needs 71 KiB of authentication traffic per validator per block, 22x less than ML-DSA-44 for admitted verifiers. In a Rust HotStuff prototype with 100 validators, SILMARILS-MV commits 2.8x more transactions per second than ML-DSA-44 with 67x less cryptographic CPU, and Monte-Carlo attacks match the bounds.
Fiber-based quantum key distribution (QKD) systems are mature and commercialized, but their integration into existing optical networks is crucial for their widespread use, in particular in passive optical networks (PONs) if end-to-end quantum-secured communications are to be addressed. While discrete-variable QKD coexistence with classical channels is well-studied in point-to-point links, its performance in point-to-multipoint topologies like PONs has received less attention. We thus developed a numerical tool to estimate quantum-available bandwidth and maximum link lengths for QKD systems in single-fiber PON architectures in coexistence with GPON, XG-PON, NG-PON2, and HS-PON standards. The QKD channel performance is obtained by setting thresholds on the quantum bit error rate and the secret key rate, ultimately limited by spontaneous Raman scattering noise and high optical distribution network losses. We perform a comparison between the performance obtained assuming the asymptotic infinite-key generation rate or taking into account actual implementations in the finite-key regime. We evidence that proper design rules can be obtained as a function of both classical and quantum system parameters to support end-to-end quantum security services in existing optical networks.