What Are the Best Secure Optical Transmission Technologies for Preventing Data Recording?
Encryption, key distribution, and tap detection do not prevent a tap from harvesting traffic on a fiber link. A tap diverts a small share of the light, so the link keeps working while a copy of the traffic goes to a recorder. Layer 1 optical encryption, MACsec, IPsec, and post-quantum cryptography keep that recorded copy unreadable today. Photonic Layer Security is the solution to prevent the harvesting of the data. Carmel, our Photonic Layer Security platform, uses physics to transform the optical signal so any attempt to record the data, results in the collection of noise.
Photonic Layer Security (PLS) is the technology designed to prevent data recording on optical links. It changes the light signal itself, so a tap on the fiber captures noise. Every other option protects the contents of a recording, protects the keys, or detects the tap. Layer 1 optical encryption, MACsec, IPsec, and post-quantum cryptography keep a recorded copy unreadable today. But none of them removes the copy, so an attacker can record a copy and store it for later decryption.
How a fiber tap records traffic
A fiber tap copies light without interrupting the link. Access points include street cabinets, manholes, and junction boxes along carrier routes. A clip-on coupler bends the fiber slightly, and a small share of the light leaks out to a receiver. The main signal continues to its destination, so neither end sees an interception or experiences an outage. A simple clip-on coupler can silently harvest traffic from a secure fiber link.
Another method inserts an optical splitter that sends a small percentage of the light to a recorder. This method is especially effective where the fiber can be physically reached, such as at cabinets, junction boxes, and cable landing stations. Attackers who store the copy use a pattern called harvest now, decrypt later (HNDL): decrypting it when technology advances become available.
How Photonic Layer Security prevents the recording
PLS protects the optical signal in order to protect the data inside it. Our researchers describe one implementation in a 2025 Journal of Lightwave Technology paper. The scheme spreads the signal across many wavelengths and applies optical keys that change continuously. It also places the signal below the noise level on the fiber. No raw data remains for offline processing, including processing by quantum computers. The paper demonstrates a 100 Gb/s link over 80 km of standard single-mode fiber. Therefore, a recording of the link will just produce noise.
Carmel runs at 100-400 Gb/s and reaches up to 100 km unamplified. It also works with the optical amplifiers used on longer spans. It installs as a matched pair of units on an existing link. Existing dense wavelength division multiplexing (DWDM) equipment, the gear that carries many signals over one fiber, needs no changes.
Read to find out how photonic layer security differs from optical encryption.
What PLS is built for
PLS is built for wide area network fiber links, where the tap access points described above sit. Traffic inside a building, data on endpoints, and access by insiders with valid credentials are handled by access control, endpoint security, and monitoring, and PLS works alongside these controls. The table below shows what each technology leaves for a tap to record.
Technologies compared
QKD and PQC both target the key exchange. QKD delivers keys using quantum physics, while PQC replaces the key exchange with new mathematical methods. The traffic itself stays recordable under both, and that is the gap PLS addresses.
Wondering how Layer 1 encryption, MACsec, and IPsec differ? What Is Layer 1 Optical Encryption, and How Does It Differ from MACsec and IPsec? breaks it down.
Combining the technologies on one link
Harvest risk depends on how long the data on a link must stay confidential. According to our whitepaper, single-use credentials carry little harvest risk, while intellectual property, medical records, and long-term government contracts carry a lot.
Bringing PLS into your security stack will allow you to to prevent the harvesting of data, while at the same time you can protect the payload with encryption. Complete the post-quantum migration on your regulator's timeline, since PQC protects traffic sent after each system is upgraded. QKD suits short, dedicated links without amplifiers. Treat tap detection as an alarm that complements the effectiveness across layers.
Want to see how Carmel fits your fiber links? Visit CyberRidge to learn more.
FAQs
Q: What is the best technology for preventing data recording on fiber links?
A: Photonic Layer Security (PLS) is the technology designed to prevent recording, because it changes the optical signal so a tap captures noise. Encryption, post-quantum cryptography, and key distribution protect the contents or the keys, but a tap still records a copy. Carmel is our PLS platform for wide area fiber links.
Q: Does Layer 1 optical encryption stop fiber tapping?
A: No. Layer 1 optical encryption makes a tapped copy unreadable without the key, but the tap still records the encrypted signal. Other solutions use AES-256 line-rate encryption. Carmel adds PLS to address the recording step.
Q: Is MACsec enough to protect data on a long-distance fiber link?
A: MACsec encrypts Ethernet frames on each link, and that protects the contents of the traffic. A tap on the fiber still records the encrypted frames. Carmel's PLS prevents that recording on wide area links.
Q: Does quantum key distribution prevent data harvesting?
A: No. QKD protects the delivery of encryption keys, and the payload still travels as conventionally encrypted traffic that a tap can record. NSA does not recommend QKD for securing data in national security systems unless its limitations are overcome. Corning and Telstra describe single-hop QKD distances as often confined to 100 km.
Q: How does Carmel prevent a tap from recording data?
A: Carmel spreads the signal across a wide spectral band (1–2 THz in the C-band) and changes its optical keys continuously. It also places the signal below the noise level on the fiber, so a tap captures noise instead of traffic. We describe the method in a 2025 Journal of Lightwave Technology paper.
Q: Should Layer 1 optical encryption and Carmel be used together?
A: It is possible to use PLS wherever Layer 1 optical encryption is used. Optical encryption protects the payload on Layer 1, and PLS prevents the harvest on Layer 1. Carmel installs as an overlay matched pair with no changes to existing DWDM equipment.
Q: What are the limits of Carmel?
A: Carmel covers wide-area fiber links only, at 100-400 Gb/s and up to 100 km unamplified, with optical amplifiers supporting longer spans. It does not address insiders, endpoint malware, or local networks. It also cannot protect traffic recorded before installation.