Optical device and data transmission security method for an optical communication network

Abstract

An optical device (100) for an optical communication network, comprising: a coherent optical transceiver (110) having a data transmission mode and an interrogation mode, comprising: optical transmitter apparatus (112) operative in the data transmission mode to transmit a data signal and operative in the interrogation mode to transmit a frequency modulated continuous wave, FMCW, interrogation signal; coherent optical receiver apparatus (114) operative in the data transmission mode to receive and extract data from a data signal, and operative in the interrogation mode to: receive reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network; extract a physical unclonable function, PUF, from a portion of the received reflected light corresponding to an optical fibre of an optical element; and select a portion of the PUF as an identifying signature of the optical element; and control circuitry (120) operative to cause the coherent optical transceiver to switch between the data transmission mode and the interrogation mode.

Description

[0001] iriKom tm Hatent- och registreringsverket

[0002] PCT / SE2024 / 050782 11-09-2024 2024 -09- 1 1

[0003] OPTICAL DEVICE AND DATA TRANSMISSION SECURITY METHOD FOR AN

[0004] OPTICAL COMMUNICATION NETWORK

[0005] TECHNICAL FIELD

[0006] The invention relates to an optical device for an optical communication network. The invention further relates to a data transmission security method for an optical communication network a system, a computer program and a computer program product.

[0007] BACKGROUND

[0008] The rapid growth of global communication networks around the globe requires optimal network security protocols. Each layer of the ooen systems interconnection, OSI, which describes how different layers communicate in a network, contributes to the overall security of the network, which includes secure communication, authentication, identification, and monitoring. Concerning the physical layer, usually, security is not implemented because establishing optimal security protocols at this level is still an open worldwide problem. Although the upper layers are liable to security and confidentiality, implementing a security protocol on the physical layer could significantly enhance the network's security. Potential attacks that target the physical layer include tampering (which introduces fake nodes), jamming (which introduces harmful signals in the network), side-channel attacks (when the adversary gets physical access to the device), physical infrastructure attacks, and eavesdropping. Hence, physical layer security, PLS, is a crucial element that can enhance the overall security of the networks. Innovative approaches and techniques implementing security at the physical layer will play a key role in overall network reliability. Even if a lot of effort has been made towards intrinsically secure technologies, i.e., quantum key distribution, with more mature photonic technologies, new opportunities must be investigated capable of adding security within the physical layer. Among them, optical steganography, optical physical unclonable functions, optical signature via optical unclonable identification are emerging.

[0009] To establish PLS several methods have been proposed and studied. The very first technique based on information theoretic characterizations of secrecy for PLS is the Wyner technique which is defined by the wiretap channel model, as reported by A. D. Wyner, "The wire-tap channel," in The Bell System Technical Journal, vol. 54, no. 8, pp. 1355-1387, Oct. 1975. The Wyner technique limits the information to an eavesdropper by using the channel capacity difference between a target receiver and an eavesdropper, defining positive secrecy capacity only if the target receiver has a better signal-tc -noise ratio (SNR) than the eavesdropper, which makes this technique unsecured. An adversary with high- performance devices can receive higher SNR than the target receiver. The eavesdropper attack may be neutralized, by transmitting the artificial noise to reduce its channel capacity, only if the attacker's position is known.

[0010] PLS techniques based on computational cryptography rely on computational hardness but are vulnerable to digital attacks. For instance, PLS based on asymmetric key cryptography is susceptible to machine learning attacks. Quantum key distribution, QKD, provides intrinsic security, but (i) is not cost- Inkom till Patent- ocn registreringsverket 2024 -09- 1 1

[0011] 2 effective, (ii) is hard to implement, and (iii) relies on user authentication usually performed with classical techniques. Also, PLS based on keys generated by digital signal processing, DSP, is vulnerable to digital attacks. Recently, an approach based on optical steganography was proposed to hide messages below the noise level, however, this technique cannot detect the presence of an eavesdropper and is vulnerable to adversaries who know the technique.

[0012] A technique to generate and read the digital signature of the networks, channels, and optical devices that possess fibre-optic pigtails to enhance PLS has been reported by Nadimi Goki, Pantea, Thomas Teferi Mulugeta, Roberto Caldelli, and Luca Poti, "Optical Systems Identification through Rayleigh Backscattering", Sensors 2023, no. 11 , page 5269. This work reports that attributing a signature to networks or devices eases the identification and authentication of networks and systems thus reducing their vulnerability to physical and digital attacks. The signatures are generated using an optical physical unclonable function, OPUF. This work investigates Rayleigh backscattering signal, RBS, as a strong OPUF to generate reliable signatures and evaluates the security of the generated signatures in terms of their robustness against prediction and cloning.

[0013] SUMMARY

[0014] It is an object to enable improved physical layer security in optical communication networks through improved identification and authentication of optical subsystems.

[0015] A first aspect provides an optical device for an optical communication network, the optical device comprising a coherent optical transceiver and control circuitry. The coherent optical transceiver has a data transmission mode and an interrogation mode. The coherent optical transceiver comprises optical transmitter apparatus and coherent optical receiver apparatus. The optical transmitter apparatus is operative in the data transmission mode to transmit a data signal. The optical transmitter apparatus is operative in the interrogation mode to transmit a frequency modulated continuous wave, FMCW, interrogation signal. The coherent optical receiver apparatus is operative in the data transmission mode to receive a data signal and to extract data from the data signal. The coherent optical receiver apparatus is operative in the interrogation mode to receive reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network, extract a physical unclonable function, PUF, from a portion of the received reflected light corresponding to an optical fibre of an optical element within the optical communication network, and select a portion of the PUF as an identifying signature of the optical element. The control circuitry is operative to cause the coherent optical transceiver to switch between the data transmission mode and the interrogation mode.

[0016] This advantageously enables optical identification based PLS within an optical communication network using the same coherent transceiver as is used for data transmission. The optical device may enable optical identification based PLS within a range of network architectures of both classic and quantum optical communication networks. The optical device advantageously does not require synchronization between the device and the optical element being identified, is cost-effective, does not add heavy computational complexity to the transceiver, can recognize the existence of an adversary and Inkom till Patent- ooh registreringsverket

[0017] 2024 -09- 1 1

[0018] 3 its location, and has high robustness against digital and physical attacks even if an adversary knows the optical identification based PLS technique.

[0019] In certain embodiments, the FMCW interrogation signal is transmitted for a specified duration and wherein the PUF is extracted from the reflected light within a specified time range following commencement of arrival of the reflected light at the coherent optical receiver apparatus, wherein the specified time range corresponds to a physical range of a portion of said optical fibre. The PUF may be extracted starting at a random time within the specified time range. The PUF may have a time extension of less than the specified time range. This advantageously enables protection against eavesdropping since even if an eavesdropper is able to collect the signature of an optical element they will not know the exact time it should be sent to the coherent optical receiver.

[0020] In certain embodiments, the coherent optical receiver apparatus is further operative in the interrogation mode to store the identifying signature for the optical element. The identifying signature may be stored within the coherent optical receiver apparatus. Collection and storage of the identifying signature at the coherent optical receiver apparatus may further increase the security of the identifying signature and the PLS of the optical communication network.

[0021] In certain embodiments, the coherent optical receiver apparatus is further operative in the interrogation mode to subsequently compare a said selected portion with a stored identifying signature of an optical element to perform identification of the network element. This may advantageously enable the optical device to perform authentication of an optical element within an optical communication network.

[0022] In certain embodiments, the coherent optical receiver apparatus is operative in the interrogation mode to extract a plurality of PUFs from said portion of the received reflected light and to form the identifying signature from said plurality of PUFs. This may advantageously enable more complex and secure identifying signatures to be formed.

[0023] In certain embodiments, the reflected light is Rayleigh back scattering light. The reflected light may alternatively be Brillouin scattering light.

[0024] In certain embodiments, the optical fibre of an optical element is one of an optical fibre pigtail of a network element or a section of an optical fibre of an optical link. The optical device may therefore be used to obtain identifying signatures of any optical network element with an optical fibre pigtail, such as optical network units, ONU, network nodes, optical switches, optical cross-connects, optical multiplexers, and to obtain identifying signatures of optical links.

[0025] In certain embodiments, the FMCW interrogation signal has a duration in a range 1 microseconds to 10 microseconds, such as 2 microseconds to 6 microseconds. This may advantageously enable the optical device to operate in the interrogation mode for short periods of time, thus not interrupting data transmission for a significant period of time.

[0026] In certain embodiments, the FMCW interrogation signal has a frequency sweep rate of 1 THz / s.

[0027] In certain embodiments, the optical transmitter apparatus comprises a laser and an optical modulator. The laser is operative to generate a continuous wave, CW, laser signal. The optical modulator is operative in the data transmission mode to modulate the CW laser signal with a data modulation to form the data signal. The optical modulator is operative in the interrogation mode to modulate the CW Inkom till Patent- och registreringsverket

[0028] 2024 -09- 1 1

[0029] 4 laser signal with a frequency modulation to form the FMCW interrogation signal. This may advantageously enable the same optical transmitter to additionally generate the FMCW interrogation signal, without changing how it operates for data transmission, so the optical device is compatible with existing optical communication networks.

[0030] In certain embodiments, the coherent optical receiver apparatus comprises a coherent receiver, digital signal processing, DSP, circuitry, a first optical tap, a second optical tap and an optical switch. The first optical tap is provided between the laser and the optical modulator. The first optical tap is configured to split off a portion of the CW laser signal to form a first local oscillator signal, LOi. The second optical tap is provided after the optical modulator. The second optical tap is configured to split off a portion of the FMCW interrogation signal to form a second local oscillator signal, LO2. The optical switch is connected between the first optical tap and the second optical tap and the coherent receiver. The control circuitry is further operative to cause the optical switch to route LO1 to the coherent receiver in the data transmission mode and to cause the optical switch to route LO2 to the coherent receiver in the interrogation mode. This may enable simple, optical based, switching between data transmission and interrogation modes and may advantageously enable the same DSP circuitry to obtain both data and identifying signatures.

[0031] In certain embodiments, the identifying signature is stored within the DSP circuitry.

[0032] In certain embodiments, the communication network is one of a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

[0033] In certain embodiments, the optical device is one of a network element, an optical network unit, ONU, an optical cross-connect, a communication network node, an optical multiplexer / demultiplexer or an optical switch.

[0034] Corresponding embodiments and advantages apply to the data transmission security method for an optical communication network described below.

[0035] A second aspect provides a data transmission security method for an optical communication network. The method comprises, by a coherent optical transceiver operating in an interrogation mode: transmitting a frequency modulated continuous wave, FMCW, interrogation signal; receiving reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network; extracting a physical unclonable function, PUF, from a portion of the received reflected light corresponding to an optical fibre of an optical element within the optical communication network; and selecting a portion of the PUF as an identifying signature of the optical element. The method further comprises, by a coherent optical transceiver operating in a data transmission mode: transmitting a data signal; and receiving a data signal and extracting data from the data signal. The method further comprises changing between operating in the interrogation mode and operating in the data transmission mode.

[0036] A third aspect provides a computer programme, comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the data transmission security method for an optical communication network.

[0037] A fourth aspect provides computer program product which comprises a computer readable storage medium on which the computer program is stored. Inkom till Patent- och registreringsverket

[0038] 2024 -09- 1 1

[0039] 5

[0040] A fifth aspect provides a system comprising a first optical device for an optical communication network, a second said optical device and an optical link connecting the first optical device and the second optical device.

[0041] Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings.

[0042] BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a block diagram illustrating an embodiment of an optical device for an optical communication network;

[0044] Figure 2 is a block diagram illustrating control circuitry of an embodiment of an optical device for an optical communication network;

[0045] Figure 3 is a plot of Intensity (I) as a function of Time (t) of a reflected signal received at the optical device of Figure 1 ;

[0046] Figures 4 and 5 are block diagrams illustrating optical transceivers of embodiments of an optical device for an optical communication network;

[0047] Figure 6 is a block diagram illustrating operation of the optical device of Figure 1 with an optical element of an optical communication network;

[0048] Figure 7 A is a block diagram illustrating operation of two optical devices comprising the optical transceivers of Figure 3;

[0049] Figure 7B is a block diagram illustrating operation of two optical devices comprising the optical transceivers of Figure 4;

[0050] Figure 8 is block diagrams of application scenarios of the optical device of Figure 1 ;

[0051] Figure 9 is a schematic illustration of the optical device in use in an optical communication network; and Figure 10 is flowcharts illustrating embodiments of a method data transmission security method for an optical communication network.

[0052] DETAILED DESCRIPTION

[0053] The same reference numbers are used for corresponding features in different embodiments.

[0054] The present disclosure provides an optical device and method for implementing optical identification, Ol, for communication security, authentication, identification, and monitoring, both in optical links (point-point connections) and optical networks. Ol exploits the inherent characteristics of optical subsystems to produce a fingerprint, or signature, to be used for security purposes at the physical layer of a communication network. The Ol allows one sub-system of the network to identify another sub-system or an optical within the network. The present disclosure enables the use of Ol for mutual authentication and identification of different transceivers, TRXs, of the network, for both standard TRX (i.e. with input and output fibers) and bidirectional, BiDi, TRX (i.e. with a single input / output fibre).

[0055] A candidate for the optical signature is Rayleigh backscattering pattern, RBP, which is the back- scattered light due to the imperfections in optical fibre, such as the TRX's fiber pigtail or an optical fibre of an optical link, when stimulated by light. In this case, a TRX A can read the signature of a TRX B, its Inkom till Patent- och registreringsverke

[0056] 2024 -09- 1 1

[0057] 6

[0058] RBP, using coherent optical frequency domain reflectometry, C-OFDR. Another candidate for the optical signature is Brillouin scattering, which is the back-scattered light due to nonlinearity in optical fibre.

[0059] The beam light propagating in the optical link will continuously produce Rayleigh backscattering along the length of the fibre due to presence of impurities and inhomogeneities that are the typical of the specific physical link. In C-OFDR the Rayleigh backscattering light is mixed with a reference light beam and is detected. The detected reflected light is a function of the beat frequency f between the reference light beam and the Rayleigh backscattering light which is expressed as f= 2LnV / c, where n is the refraction index, V is the frequency sweep rate, L is the position of the reflection point and c is the speed of light.

[0060] An optical identifying signature, or ‘fingerprint’, is collected by the optical transceiver that is based on coherent light detection, at a specific time that is selected randomly by the DSP within a response time frame. The optical transceiver transmits an optical interrogation signal and receives a reflected signal comprising Rayleigh backscattering light from the optical link. The signature is a portion of the reflected signal, collected in a window that corresponds to a position range in the optical link corresponding to an optical fibre span, which may be a fibre pigtail of an optical element or a section of optical fibre of the optical link.

[0061] A potential eavesdropper may steal the signature but will not be able to send it to the transmitter at the correct time frame and the corresponding position range, that is known at the transceiver DSP only.

[0062] The present disclosure provides a device and method for the set-up of a secured communication using an unclonable optical function that can be implemented on coherent transceivers exploiting the existing digital signal processing with reasonable modification to the current hardware.

[0063] The present disclosure provides a new approach to PLS based on optical link materials physical features, defined by physical unclonable functions, PUFs, in which a physical device provides unique output for a given input. The method is based on challenge-response protocol. Thus, any stimulus (called the ‘challenge’) maps a unique result (called the ‘response’) and provides a challenge-response pair. The security of the device and method relies on the intrinsic unclonability of the PUF and, therefore, can overcome disadvantages of computational cryptography.

[0064] Referring to Figure 1 , an embodiment provides an optical device 100 for an optical communication network. The optical device comprises a coherent optical transceiver, TRx, 110 and control circuitry 120.

[0065] The coherent optical transceiver comprises optical transmitter apparatus, Tx, 112 and coherent optical receiver apparatus, Rx, 114 which are connected to an input / output optical fibre pigtail 116 via an optical circulator 118. It will be understood that other optical arrangements are possible to connect the optical transmitter apparatus and the coherent optical receiver apparatus to one or more input / output optical fibre / s.

[0066] The coherent optical transceiver 110 has a data transmission mode and an interrogation mode.

[0067] The optical transmitter apparatus 112 is operative in the data transmission mode to transmit a data signal and the optical transmitter apparatus is operative in the interrogation mode to transmit a frequency modulated continuous wave, FMCW, interrogation signal. Inkom till Patent- octi registreringsverkel

[0068] 2024 -09- 1 1

[0069] 7

[0070] The coherent optical receiver apparatus 114 is operative in the data transmission mode to receive a data signal and to extract data from the data signal.

[0071] The coherent optical receiver apparatus 114 is operative in the interrogation mode to:

[0072] - receive reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network;

[0073] - extract a physical unclonable function, PUF, from a portion of the received reflected light corresponding to an optical fibre of an optical element within the optical communication network; and

[0074] - select a portion of the PUF as an identifying signature of the optical element.

[0075] The control circuitry 120 is operative to cause the coherent optical transceiver to switch between the data transmission mode and the interrogation mode.

[0076] The optical fibre may be an optical fibre pigtail of a network element or may be a section of an optical fibre of an optical link.

[0077] The communication network may be a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

[0078] In certain embodiments, the collection of the reflected light is operated by sending a frequency modulated signal, so to operate a coherent optical frequency domain reflectometry that can be implemented at the coherent optical receiver apparatus 114. The typical duration of the signal is few microseconds, and the frequency sweep rate V may be 1 THz / s. The FMCW signal may be generated by a DSP of the optical transmitter apparatus 112. The reflected light is delivered to the coherent optical receiver apparatus. A DSP of the coherent optical receiver apparatus may store a portion, PUF_1 , of the reflected light, collected at a random time t_PUF that corresponds to a distance in the fiber and a time window of extension T that is based on a distance window, for example 0.2cm. The time-length and frequency-length relationships are known and depend on known parameters of the fiber as T(T) = 2Ln(T) / c and f(T)- 2Ln(T)V / c, where L is the length, n is the refraction index, V if the frequency sweep rate, and c is the speed of light. After signature collection, PUF_1 will be used as digital signature of the optical element. The DSP at the coherent optical receiver apparatus 114 will always compare the fraction of signal collected at time t_PUF in the range t1-t2 of arrival of the reflected signal. Then, an eavesdropper that would collect the signature PUF_1 , would not be able to know the exact time it should be sent to the receiver. Additionally, if the eavesdropper tried to tap the reflected light, this would not be the same as the reflected light received at the coherent optical transceiver 110 that sent the FMCW interrogation signal; the function is not cloneable since it depends on the physical characteristics of the optical network.

[0079] In certain embodiments, the optical device 100 is one of a network element, an optical network unit, ONU, an optical cross-connect, a communication network node, an optical multiplexer / demultiplexer or an optical switch. Examples of communication network nodes include, but are not limited to, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR NodeBs (gNBs)), 3rd Generation Partnership Project (3GPP) network nodes "'wm tmPatent_Qchregistreringsverkei

[0080] 2024 -09- 1 1

[0081] 8

[0082] (e.g., 4thGeneration base stations, 5thgeneration base stations, 6thgeneration base stations), non-3GPP access points, open radio access network (O-RAN) nodes or components of an O-RAN node.

[0083] Referring to Figure 2, in an embodiment the control circuitry / controller 120 comprises an interface circuitry 122, a processing circuitry / processor 124, and computer program product / computer readable storage medium 126 in the form of a memory 128. The memory comprises instructions 130 which when performed by the processor cause the coherent optical transceiver to switch between the data transmission mode and the interrogation mode.

[0084] In certain embodiments, the FMCW interrogation signal is transmitted for a specified duration and the PUF is extracted from the reflected light within a specified time range following commencement of arrival of the reflected light at the coherent optical receiver apparatus. The specified time range corresponds to a physical range of a portion of the optical fibre.

[0085] The optical device 100 may be configured to obtain identifying signatures of different optical elements within an optical network, at different distances from the device 100, by configuring the specified time range to correspond to different physical ranges to respective portions of optical fibre from which the identifying signatures for those optical elements are to be collected.

[0086] The PUF may be extracted starting at a random time within the specified time range. The PUF may have a time extension of less than the specified time range.

[0087] The FMCW interrogation signal may have a duration in a range 1 ps to 10 ps, such as 2 ps to 6 ps. The FMCW interrogation signal may have a frequency modulation spanning from 1 MHz to 2MHz and a frequency sweep rate of 1 THz / s.

[0088] The FMCW interrogation signal will generate a response (‘reflected light') that depends on the physical features of the optical link to the optical element, the resulting reflected light is received at the coherent optical receiver apparatus 114 of the optical device 100. The reflected light may be Raileigh Back Scattering or Brillouin Scattering.

[0089] Figure 3 shows an example of Rayleigh back scattering light 150 within a specified time range, t1-t2, from commencement of arrival of the reflected light at the coherent optical receiver apparatus 114. The PUF is extracted starting at a random time, t_PUF, within the time range t1-t2 over a time window 152 of extension T. The length of the collection time window T may depend on a desired sampling rate / precision.

[0090] In certain embodiments, the coherent optical receiver apparatus 114 is operative, in the interrogation mode, to extract a plurality of PUFs from the portion of the received reflected light and to form the identifying signature from the plurality of PUFs. For example, referring to Figure 3, the coherent optical receiver apparatus would extract a plurality of PUFs each starting at a different random time within the time range t1-t2 and each having a time window extension T.

[0091] In certain embodiments, the coherent optical receiver apparatus 114 is further operative, in the interrogation mode, to store the identifying signature for the optical element. The identifying signature may be stored within the coherent optical receiver apparatus itself.

[0092] In certain embodiments, the coherent optical receiver apparatus 114 is further operative, in the interrogation mode, to subsequently compare a selected portion of received reflected light with a stored ii irw / iii 11 « t-**-*-" registreringsverk&

[0093] 2024 -09- 1 1

[0094] 9 identifying signature of an optical element to perform identification of the network element. In use therefore, the coherent optical receiver apparatus 114 is operated in the interrogation mode at a first time to obtain and store an identifying signature of an optical elements and is operated again in the interrogation mode at a second, later time to compare a portion of received reflected light with the stored identifying signature, the portion of received reflected light that is selected starting at the same time and having same time window extension within the same time range t1-t2 as the stored identifying signature; if it is the same optical element at the same location within the network the selected portion of the received reflected light will match the stored identifying signature, thus authenticating / identifying the optical element.

[0095] Referring to Figure 4, another embodiment provides an optical device for an optical communication network comprising a two-fibre coherent optical transceiver, TRx, 210 and control circuitry 120, as described above.

[0096] The TRx 210 comprises optical transmitter apparatus 220 and coherent optical receiver apparatus 240. The TRx 210 has a data transmission mode and an interrogation mode.

[0097] The optical transmitter apparatus is operative in the data transmission mode to transmit a data signal and the optical transmitter apparatus is operative in the interrogation mode to transmit a frequency modulated continuous wave, FMCW, interrogation signal.

[0098] The optical transmitter apparatus 220 comprises a laser 222, an optical modulator 224, such as a Mach-Zehnder modulator, MZM, digital signal processing, DSP, circuitry 226 and digital to analogue converter, DAC, circuitry 228.

[0099] The optical modulator 224 is connected to an input / output fibre 116 by an optical circulator 230.

[0100] The laser is operative to generate a continuous wave, CW, laser signal. The optical modulator 224 is operative in the data transmission mode to modulate the CW laser signal with a data modulation to form the data signal and the optical modulator is operative in the interrogation mode to modulate the CW laser signal with a frequency modulation to form the FMCW interrogation signal.

[0101] The DSP 226 is operative, in the data transmission mode, to generate a digital data signal which is converted by the DAC into an analogue data modulation signal for driving the optical modulator. The analogue data modulation signal drives the optical modulator to modulate the CW laser signal with the data modulation to form the optical data signal. The DSP 226 is operative, in the interrogation mode, to generate a digital frequency modulation signal which is converted by the DAC into an analogue frequency modulation signal for driving the optical modulator. The analogue frequency modulation signal drives the optical modulator to modulate the CW laser signal with the frequency modulation to form the FMCW interrogation signal.

[0102] The FMCW interrogation signal will generate a response (‘reflected light') that depends on the physical features of the optical link to the optical element. The coherent optical receiver apparatus 240 is configured to receive Raileigh Back Scattering reflected light.

[0103] The coherent optical receiver apparatus 240 comprises a coherent receiver, C-Rx, 242, digital signal processing, DSP, circuitry 244, a first optical tap 246, a second optical tap 248 and an optical Inkom till Patent- och registreringsverkei

[0104] 2024 -09- 1 1

[0105] 10 switch 250. The C-Rx is connected to the input / output fibre 216 via the optical circulator 230 and to an input fibre 218.

[0106] The first optical tap 246 is provided between the laser 222 and the optical modulator 224. The first optical tap is configured to split off a portion of the CW laser signal output from the laser to form a first local oscillator signal, LO1 .

[0107] The second optical tap 248 is provided after the optical modulator 224. The second optical tap is configured to split off a portion of light output from the optical modulator. When the TRX 210 is operating in the interrogation mode, this means that the second optical tap splits of a portion of the FMCW interrogation signal to form a second local oscillator signal, LO2.

[0108] The optical switch 250 is connected on an input side to the first optical tap and to the second optical tap and the optical switch is connected on an output side to the C-Rx. The control circuitry 120 is operative to cause the optical switch to route LO1 to the C-Rx in the data transmission mode and to cause the optical switch to route LO2 to the C-Rx in the interrogation mode.

[0109] The C-Rx 242 is operative, in the data transmission mode, to receive an optical data signal from the input port 218, mix the optical data signal with LO1 and to perform coherent optical detection of the optical data signal. The DSP 244 is operative, in the data transmission mode, to extract data from the coherently detected data signal output from the C-Rx.

[0110] The C-Rx 242 is operative, in the interrogation mode, to receive reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network, the reflected light is received via the input / output port 216 and the circulator 230.

[0111] The C-Rx is operative, in the interrogation mode, to mix the reflected light with LO2 and to perform coherent optical detection of the reflected light. The DSP 244 is operative, in the interrogation mode, to extract a physical unclonable function, PUF, from a portion of the coherently detected reflected light output from the C-Rx; the portion corresponding to an optical fibre of an optical element within the optical communication network. The DSP 244 is further operative, in the interrogation mode, to select a portion of the PUF as an identifying signature of the optical element.

[0112] The optical fibre may be an optical fibre pigtail of a network element or may be a section of an optical fibre of an optical link.

[0113] The communication network may be a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

[0114] In certain embodiments, the FMCW interrogation signal is transmitted for a specified duration and the PUF is extracted from the reflected light within a specified time range following commencement of arrival of the reflected light at the coherent optical receiver apparatus. The specified time range corresponds to a physical range of a portion of the optical fibre.

[0115] The optical device 100 may be configured to obtain identifying signatures of different optical elements within an optical network, at different distances from the device 100, by configuring the specified time range to correspond to different physical ranges to respective portions of optical fibre from which the identifying signatures for those optical elements are to be collected. ii IIMJI I I mi aieric- ocn registreringsverket

[0116] 2024 -09- 1 1

[0117] 11

[0118] The PUF may be extracted starting at a random time within the specified time range. The PUF may have a time extension of less than the specified time range.

[0119] The FMCW interrogation signal may have a duration in a range 1 ps to 10 ps, such as 2 ps to 6 ps. The FMCW interrogation signal may have a frequency modulation spanning from 1 Hz to 2MHz and a frequency sweep rate of 1 THz / s.

[0120] In certain embodiments, the DSP 244 is operative, in the interrogation mode, to extract a plurality of PUFs from the portion of the coherently detected reflected light output from the C-Rx and to form the identifying signature from the plurality of PUFs, as described above with reference to Figure 3.

[0121] In certain embodiments, the coherent optical receiver apparatus 240 is further operative, in the interrogation mode, to store the identifying signature for the optical element. The identifying signature may be stored within the DSP 244.

[0122] In certain embodiments, the DSP 244 is further operative, in the interrogation mode, to subsequently compare a selected portion of received reflected light with a stored identifying signature of an optical element to perform identification of the network element.

[0123] Referring to Figure 5, another embodiment provides an optical device for an optical communication network comprising a single-fibre (bi-directional, Bi-Di) coherent optical transceiver, TRx, 310 and control circuitry 120, as described above.

[0124] The TRx 310 comprises optical transmitter apparatus 220 and coherent optical receiver apparatus 240, as described above.

[0125] In this embodiment, a single input / output fibre 316 is provided for outputting the FMCW interrogation signal and for receiving both reflected light and data signals. The optical modulator 224 is connected to the input / output fibre by the optical circulator 230 and the C-Rx 242 is also connected to the input / output fibre by the optical circulator 230.

[0126] As illustrated in Figure 6, the optical device 100 may be used for physical layer security. The optical device 100 obtains reflected light from a physical characteristic of an optical element 400 and extracts an identifying digital signature 404. The identifying digital signature is compared with a set 402, 404, 406, 408 of public signatures to perform a security validation process.

[0127] Figure 7(a) illustrates mutual identification and authentication between two optical devices 100 comprising two-fibre coherent optical transceivers 210, as described above. Each coherent optical transceiver, TRX A and TRX B, obtains reflected light from the other and the DSP 244 compares a selected portion of received reflected light with a stored identifying signature of the other optical element to perform identification of the network element.

[0128] Figure 7(b) illustrates PLS mutual identification and authentication between two optical devices 100 comprising single fibre, Bi-Di, coherent optical transceivers 310, as described above.

[0129] Figure 8 a) - d) illustrates a number of systems 800 in which an optical device 100 as described above may be used for PLS identification and authentication within an optical network 850, as illustrated in Figure 9: a) optical element identification across an unamplified link 806: an optical device 100 comprising a single-fibre, BiDi, coherent optical transceiver, TRX1 , 310 may be used for identification of an optical II ir\ I I I III I I CU "'- > registreringsverkei 2021 -09- 1 1

[0130] 12 element 400, such as another coherent optical transceiver, TRX2, 310, to which it is connected across an unamplified optical link. TRX1 transmits the FMCW interrogation signal and measures the reflected light of the fibre optic pigtail 802 of TRX2. b) Link identification: an optical device 100 comprising a single-fiber, BiDi, coherent optical transceiver, TRX1 , 310 may be used to identify a fibre link 806 between itself and an optical element 400, by transmitting an FMCW interrogation signal into the fibre and obtaining an identifying signature from a portion of the reflected light corresponding to the location of a section 804 of the fibre link. c) optical element identification across an amplified bidirectional link: an optical device 100 comprising a two-fibre coherent optical transceiver, TRX1 , 210 may be used to identify an optical element 400, such as a Bi-Di coherent optical transceiver, TRX2, 310, across a two-fibre optical link 806 including optical amplifiers. The two-fibre coherent optical transceiver, TRX1 , 210 enables use of different fibres to transmit the FMCW interrogation signal and to receive the reflected light. TRX1 transmits the FMCW interrogation signal, C-RX 242 detects reflected light from the fibre pigtail 802 of TRX2, transmitted through amplifiers toward TRX1. A circulator connects the fibre pigtail of TRX2 to the two optical fibres and directs the reflected light into the proper optical fibre to send it to the C-RX 242. d) optical element identification across multiple optical links 806: an optical device 100 comprising a two-fibre coherent optical transceiver, TRX1 , 210 may be used to identify an optical element, 400, such as an optical cross-connect, OXC, by its pigtail 802 utilizing different paths to transmit the FMCW interrogation signal and to receive the reflected light.

[0131] The optical communication network 850 may, for example, be one of a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

[0132] An embodiment provides a data transmission security method 500 for an optical communication network, comprising the steps illustrated in Figure 10.

[0133] The method comprises, by a coherent optical transceiver operating in an interrogation mode:

[0134] - transmitting 502 a frequency modulated continuous wave, FMCW, interrogation signal;

[0135] - receiving 504 reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network;

[0136] - extracting 506 a physical unclonable function, PUF, from a portion of the received reflected light corresponding to an optical fibre of an optical element within the optical communication network; and

[0137] - selecting 508 a portion of the PUF as an identifying signature of the optical element;

[0138] The method additionally comprises, by coherent optical transceiver operating in a data transmission mode:

[0139] - transmitting 510 a data signal; and

[0140] - receiving 512 a data signal and extracting data from the data signal.

[0141] The method additionally comprises changing between operating 520 in the interrogation mode and operating 522 in the data transmission mode. Inkom till Patent- och registreringsverkei

[0142] 2024 -09- 1 1

[0143] 13

[0144] In certain embodiments, the FMCW interrogation signal is transmitted for a specified duration. The PUF is extracted from the reflected light within a specified time range following commencement of arrival of the reflected light at the coherent optical receiver apparatus. The specified time range corresponds to a physical range of a portion of said optical fibre.

[0145] In certain embodiments, the PUF is extracted starting at a random time within the specified time range. The PUF may have a time extension of less than the specified time range.

[0146] In certain embodiments, the method further comprises storing the identifying signature for the optical element. The identifying signature may be stored within a coherent optical receiver apparatus of the coherent optical transceiver.

[0147] In certain embodiments, the method further comprises, in the interrogation mode, subsequently comparing a said selected portion with a stored identifying signature of an optical element to perform identification of the network element.

[0148] In certain embodiments, the method comprises, in the interrogation mode, extracting a plurality of PUFs from said portion of the received reflected light and forming the identifying signature from said plurality of PUFs.

[0149] In certain embodiments, the reflected light is Rayleigh back scattering light.

[0150] In certain embodiments, the optical fibre of an optical element is one of an optical fibre pigtail of a network element or a section of an optical fibre of an optical link.

[0151] In certain embodiments, the FMCW interrogation signal has a duration in a range 1 ps to 10 ps, such as 2 ps to 6 ps.

[0152] In certain embodiments, the FMCW interrogation signal has a frequency sweep rate of 1 THz / s.

[0153] In certain embodiments, transmitting the FMCW interrogation signal and transmitting the data signal comprises generating a continuous wave, CW, laser signal, modulating the CW laser signal with a frequency modulation to form the FMCW interrogation signal, and modulating the CW laser signal with a data modulation to form the data signal.

[0154] In certain embodiments, the method further comprises splitting off a portion of the CW laser signal to form a first local oscillator signal, LOi, and splitting off a portion of the FMCW interrogation signal to form a second local oscillator signal, LO2. Extracting data from the data signal comprises performing coherent detection on the data signal by combining LO1 with the received data signal. Extracting a PUF from a portion of the received reflected light comprises performing coherent detection on the received reflected light by combining LO2 with the received reflected light.

[0155] In certain embodiments, the communication network is one of a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

[0156] An embodiment provides a computer programme, comprising instructions 130 which, when executed on at least one processor 124, cause the at least one processor to carry out the data transmission security method 500.

[0157] An embodiment provides a program product 132 which comprises a computer readable storage medium on which the computer program is stored.

Claims

PCT / SE2024 / 050782 Inkom till Patent- och11-09-2024 registreringsverke*2024 -09- 1 114CLAIMS1 . An optical device (100) for an optical communication network (850), the optical device comprising: a coherent optical transceiver (110, 210, 310) having a data transmission mode and an interrogation mode, the coherent optical transceiver comprising: optical transmitter apparatus (112, 220) operative in the data transmission mode to transmit a data signal and operative in the interrogation mode to transmit a frequency modulated continuous wave, FMCW, interrogation signal; coherent optical receiver apparatus (114, 240) operative in the data transmission mode to receive a data signal and to extract data from the data signal, and operative in the interrogation mode to: receive reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre (802, 804, 806) of the optical communication network; extract a physical unclonable function, PDF, from a portion of the received reflected light corresponding to an optical fibre (802, 804) of an optical element (400, 806) within the optical communication network; and select a portion of the PUF as an identifying signature of the optical element; and control circuitry (120) operative to cause the coherent optical transceiver to switch between the data transmission mode and the interrogation mode.

2. The optical device of claim 1 , wherein the FMCW interrogation signal is transmitted for a specified duration and wherein the PUF is extracted from the reflected light within a specified time range following commencement of arrival of the reflected light at the coherent optical receiver apparatus, wherein the specified time range corresponds to a physical range of a portion of said optical fibre.

3. The optical device of claim 2, wherein the PUF is extracted starting at a random time within the specified time range.

4. The optical device of any one of claim 2 or claim 3, wherein the PUF has a time extension of less than the specified time range.

5. The optical device of any one of claims 1 to 4, wherein the coherent optical receiver apparatus (114) is further operative in the interrogation mode to store the identifying signature for the optical element.

6. The optical device of claim 5, wherein the identifying signature is stored within the coherent optical receiver apparatus.PCT / SE2024 / 050782 Inkom till Pc tent- och11-09-2024 registreringsverkei2024 -09- 1 1157. The optical device of any one of claim 5 or claim 6, wherein the coherent optical receiver apparatus (114) is further operative in the interrogation mode to subsequently compare a said selected portion with a stored identifying signature of an optical element to perform identification of the network element.

8. The optical device of any one of claims 1 to 7, wherein the coherent optical receiver apparatus (114) is operative in the interrogation mode to extract a plurality of PUFs from said portion of the received reflected light and to form the identifying signature from said plurality of PUFs.

9. The optical device of any one of claims 1 to 8, wherein the reflected light is Rayleigh back scattering light.

10. The optical device of any one of claims 1 to 9, wherein the optical fibre of an optical element is one of an optical fibre pigtail of a network element or a section of an optical fibre of an optical link.11 . The optical device of any one of claims 1 to 10, wherein the FMCW interrogation signal has a duration in a range 1 microseconds to 10 microseconds, such as 2 microseconds to 6 microseconds.

12. The optical device of any one of claims 1 to 11 , wherein the FMCW interrogation signal has a frequency sweep rate of 1 THz / s.

13. The optical device of any one of claims 1 to 12, wherein the optical transmitter apparatus (220) comprises: a laser (222) operative to generate a continuous wave, CW, laser signal; and an optical modulator (224) operative in the data transmission mode to modulate the CW laser signal with a data modulation to form the data signal and operative in the interrogation mode to modulate the CW laser signal with a frequency modulation to form the FMCW interrogation signal.

14. The optical device of claim 13, wherein the coherent optical receiver apparatus (240) comprises: a coherent receiver (242); digital signal processing, DSP, circuitry (244); a first optical tap (246), provided between the laser and the optical modulator, configured to split off a portion of the CW laser signal to form a first local oscillator signal, LOi; a second optical tap (248), provided after the optical modulator, configured to split off a portion of the FMCW interrogation signal to form a second local oscillator signal, LO2; and an optical switch (250) connected between the first optical tap and the second optical tap and the coherent receiver, wherein the control circuitry is furtherii ir\wi 1 1 LI I i rdiui i i- UGI iPCT / SE2024 / 05078211-09-2024 registreringsverke2024 -09- 1 116 operative to cause the optical switch to route LOi to the coherent receiver in the data transmission mode and to cause the optical switch to route LO2 to the coherent receiver in the interrogation mode.

15. The optical device of claim 14 and claim 6, wherein the identifying signature is stored within the DSP circuitry (244).

16. The optical device of any one of claims 1 to 15, wherein the communication network is one of a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

17. A data transmission security method (500) for an optical communication network, the method comprising: by a coherent optical transceiver operating in an interrogation mode: transmitting (502) a frequency modulated continuous wave, FMCW, interrogation signal; receiving (504) reflected light originating from a physical interaction of the FMCW interrogation signal with optical fibre of the optical communication network; extracting (506) a physical unclonable function, PUF, from a portion of the received reflected light corresponding to an optical fibre of an optical element within the optical communication network; and selecting (508) a portion of the PUF as an identifying signature of the optical element; by a coherent optical transceiver operating in a data transmission mode: transmitting (510) a data signal; and receiving (512) a data signal and extracting data from the data signal; and changing between operating (520) in the interrogation mode and operating (522) in the data transmission mode.

18. The method of claim 17, wherein the FMCW interrogation signal is transmitted for a specified duration and wherein the PUF is extracted from the reflected light within a specified time range following commencement of arrival of the reflected light at the coherent optical receiver apparatus, wherein the specified time range corresponds to a physical range of a portion of said optical fibre.

19. The method of claim 18, wherein the PUF is extracted starting at a random time within the specified time range.

20. The method of any one of claim 18 or claim 19, wherein the PUF has a time extension of less than the specified time range.21 . The method of any one of claims 17 to 20, further comprising storing the identifying signature for the optical element.PCT / SE2024 / 050782 registreringsverke11-09-20242024 -09- 1 11722. The method of claim 21 , wherein the identifying signature is stored within a coherent optical receiver apparatus of the coherent optical transceiver.

23. The method of any one of claim 21 or claim 22, further comprising, in the interrogation mode, subsequently comparing a said selected portion with a stored identifying signature of an optical element to perform identification of the network element.

24. The method of any one of claims 17 to 23, comprising, in the interrogation mode, extracting a plurality of PUFs from said portion of the received reflected light and forming the identifying signature from said plurality of PUFs.

25. The method of any one of claims 17 to 24, wherein the reflected light is Rayleigh back scattering light.

26. The method of any one of claims 17 to 25, wherein the optical fibre of an optical element is one of an optical fibre pigtail of a network element or a section of an optical fibre of an optical link.

27. The method of any one of claims 17 to 26, wherein the FMCW interrogation signal has a duration in a range 1 ms to 10 ms, such as 2 ms to 6 ms.

28. The method of any one of claims 17 to 27, wherein the FMCW interrogation signal has a frequency sweep rate of 1 THz / s.

29. The method of any one of claims 17 to 28, wherein transmitting the FMCW interrogation signal and transmitting the data signal comprises: generating a continuous wave, CW, laser signal; modulating the CW laser signal with a frequency modulation to form the FMCW interrogation signal; and modulating the CW laser signal with a data modulation to form the data signal.

30. The method of claim 29, further comprising: splitting off a portion of the CW laser signal to form a first local oscillator signal, LOi; and splitting off a portion of the FMCW interrogation signal to form a second local oscillator signal, LO2; and wherein extracting data from the data signal comprises performing coherent detection on the data signal by combining LO1 with the received data signal and wherein extracting a PUF from a portion of the received reflected light comprises performing coherent detection on the received reflected light by combining LO2 with the received reflected light.PCT / SE2024 / 050782 Inkom till Patent- och 11-09-2024 registreringsverket2024 -09" 1 11831 . The method of any one of claims 17 to 30, wherein the communication network is one of a data centre network or a passive optical network or a dense wavelength division multiplexing, DWDM, optical network or a metro network.

32. A computer programme, comprising instructions (130) which, when executed on at least one processor, cause the at least one processor to carry out the method according to any one of claims 17 to 31 .

33. A computer program product (132) which comprises a computer readable storage medium on which a computer program according to claim 32 is stored.

34. A system (800) comprising: a first optical device (100) according to any one of claims 1 to 16; a second optical device (100) according to any one of claims 1 to 16; and an optical link (806) connecting the first optical device and the second optical device.

Images