What Is Photonic Layer Security, and How Is It Different from Optical Encryption?
Photonic layer security (PLS) protects data in transit by changing the optical signal, so a tap on the fiber captures noise instead of a recordable signal. Optical encryption, also called Layer 1 encryption, encrypts the payload with a cipher and sends it as a standard optical signal that a tap can copy, demodulate, and store. It controls who can read a recorded copy, while PLS controls whether a usable copy can be recorded at all. Both apply to WAN links, the long fiber spans where traffic leaves a controlled network and crosses infrastructure that other parties own. Carmel is the platform we built around PLS, which prevents recording ciphertext in the first place.
Photonic layer security changes the light on the fiber, and optical encryption changes the bits the light carries. Optical encryption leaves a normal optical signal on the fiber, so a tap copies a complete, well-formed stream of ciphertext. PLS reshapes the signal so that what a tap copies has no recoverable structure. The two approaches answer different questions and complement each other on the same network. This article defines the category, shows how a PLS link works, and sets it beside Layer 1 encryption.
Photonic layer security as a category
Photonic layer security is the protection of optical communications by manipulating the light itself, before the signal is converted to an electrical one. A 2008 IEEE Communications Magazine article by Shahab Etemad and colleagues proposed a PLS system based on precise control of the optical phase of closely spaced laser lines, and described it as scalable to 100 Gb/s. A survey in IEEE Transactions on Information Forensics and Security reviewed optical-layer defenses ranging from optical encryption to optical steganography. In a field trial on a deployed multi-core fiber network, an encrypted, stealthy 20 Gb/s coherent transmission at −2 dB OSNR was validated. In the wild, Carmel has been deployed on a 150 km live link and validated over 200 km on a carrier network.
CyberRidge was founded by Prof. Dan Sadot of Ben-Gurion University, and the Journal of Lightwave Technology research from his group became the basis of Carmel. That research is where our approach to PLS comes from. Carmel applies the approach to data in transit on WAN fiber links.
How the light is changed on a PLS link
A PLS transmitter alters the signal before it enters the fiber. It spreads the signal across a much wider band of optical spectrum than a conventional channel uses, shifts the optical phase with a key that changes every fraction of a second, and attenuates the result until the signal sits beneath the noise. The keys are generated in a separate environment and carried inside the light, so no key file is stored on the link for an attacker to steal.
The effect is measured as optical signal-to-noise ratio (OSNR), which describes how far a signal stands above the background noise. A conventional link keeps OSNR high so the receiver can read the signal, and a PLS link drives it low so that no outside observer can. The authorized receiver holds the matching key and reverses the changes in the optical domain. Should a tap record broadband noise, the recording contains no recoverable information.
Curious how Carmel is deployed on a live DWDM network and which topologies it supports? Our deployment article covers point-to-point, ring, and full-network layouts.
Where optical encryption stops and PLS starts
Layer 1 optical encryption encrypts the payload inside an optical transport frame with a cipher such as AES-256, in hardware, at line rate. It protects the full payload, IP and MAC addresses included. Both ends of the optical link must support the same encryption capability. These are real strengths for high-capacity site-to-site links.
The difference shows when a tap copies the link. Under Layer 1 encryption, the fiber carries an ordinary optical signal with a ciphertext payload, so the tap records a complete copy. AES-256 is regarded as quantum-resistant, and the exposure lies in how the keys are established. Some vendors have added post-quantum key establishment. A recorded copy still exists after that upgrade, and its safety depends on the algorithms holding for as long as the data stays sensitive.
PLS protects the transmission, not the encryption. This exclusive focus on the transmission entails that endpoints, data at rest, and authentication still depend on the layers above it.
Wondering why a recorded copy matters years after the recording? We break it down in What Is Harvest Now, Decrypt Later, and How Can Organizations Protect Against It?
Carmel and Layer 1 encryption compared
Carmel works in the optical domain at Layer 1 as an overlay on existing fiber and DWDM equipment. The table clarifies the differences between Layer 1 optical encryption and Photonic Layer Security:
| Feature | Layer 1 Optical Encryption | Photonic Layer Security (Carmel) |
|---|---|---|
| Transmitter action | Encrypts the payload with AES-256 inside an OTN frame | Spreads the signal, shifts its phase with a changing key, and places it beneath noise |
| What is transmitted on the fiber | A standard optical signal carrying ciphertext | Optical noise with no readable structure |
| What a tap records | A complete copy of the ciphertext | Noise, with no recoverable signal |
| Deployment | Matched encryptors at both ends of the link | Matched Carmel appliances over existing fiber and DWDM equipment |
| Post-quantum cryptography | Key establishment can use PQC | Complementary: PQC secures keys, and PLS removes the recording step |
| Where it fits | High-capacity site-to-site WAN links | High-capacity WAN links carrying long-term sensitive data |
Choosing between the two, or running both
Wherever a link uses Layer 1 optical encryption, it should also use PLS. Optical encryption protects the payload on Layer 1, so a recorded copy stays protected only as long as the cipher and key establishment hold. PLS prevents the harvest on Layer 1, so no usable copy can be recorded in the first place. The two do different jobs, and running both closes the gap that encryption alone can’t close. PLS also fits low-latency links, because Carmel adds no processing demands. Carmel operates in the C-band alongside other wavelengths in multi-vendor DWDM systems, so a network can keep its encrypted wavelengths in service and add PLS to the same links.
Have a WAN link carrying data that has to stay confidential for years? Visit CyberRidge to see how Carmel fits an existing DWDM network.
FAQs
Q: Is photonic layer security the same as quantum key distribution?
A: No. Quantum key distribution protects only the keys, so the payload still travels as conventionally encrypted traffic that a tap can record. PLS acts on the transmitted signal, which carries both the payload and the keys. The two are complementary.
Q: Does photonic layer security replace post-quantum cryptography?
A: No. Post-quantum cryptography protects keys against future quantum attacks, and PLS prevents the signal from being recorded in the first place. Carmel is designed to run beneath post-quantum cryptography and other higher-layer protocols.
Q: Does photonic layer security add latency or limit link distance?
A: There is no added processing latency for Carmel, because it processes the signal in-line without queuing or buffering. Carmel supports up to 100 km unamplified and works with EDFA and Raman amplification for longer spans.
Q: Can photonic layer security protect traffic that was recorded before it was installed?
A: No. Carmel protects a link from the point of deployment forward, and traffic already copied off a link stays copied. That is the reason to protect links that carry long-lived data before an interception happens.
Q: Does photonic layer security apply inside a building or only on WAN links?
A: It applies to WAN links. A WAN connects local networks across cities, countries, or continents over fiber that other parties often own, and that exposed path is where data in transit can be tapped. Traffic inside a single building or between personal devices is outside its scope.
Q: How is Carmel deployed?
A: Carmel installs as a matched pair of units, one at each end of a link, over existing fiber and DWDM equipment. Our product documentation puts deployment at weeks. Trekker, our network management system, is optional and adds monitoring across multiple links.