Secure and attested all-photonics network

A method, comprising:

• providing, in a data communication network, a plurality of network nodes coupled together via optical links, each network node including a reflectometry analyzer configured to provide a characterization of physical properties of the optical links coupled to the associated network node, wherein for each optical link the characterization by the associated reflectometry analyzer provides a unique fingerprint of the physical properties of the particular optical link;
• and
• determining, by a network controller of the data communication network, a network path between a first network node and a second network node, wherein the network path traverses a first optical link;
• receiving a first fingerprint for the first optical link from a first reflectometry analyzer;
• defining a signature for the path, the signature including the first fingerprint;
• receiving a second fingerprint for the first optical link from the first reflectometry analyzer, the second fingerprint being different from the first fingerprint;
• and
• determining that the network path is not secure based upon the difference between the first fingerprint and the second fingerprint.

A data communication network, comprising:

• a plurality of network nodes coupled together via optical links, each network node including a reflectometry analyzer configured to provide a characterization of physical properties of the optical links coupled to the associated network node, wherein for each particular optical link, the characterization by the associated reflectometry analyzer provides a unique fingerprint of the physical properties of the particular optical link;
• and
• a network controller configured to:
• determine a network path between a first network node and a second network node, wherein the network path traverses a first optical link and a second optical link;
• receive a first fingerprint for the first optical link from a first reflectometry analyzer and a second fingerprint for the second optical link from a second reflectometry analyzer;
• define a signature for the path, the signature including the first fingerprint and the second fingerprint;
• receive a third fingerprint for the first optical link from the first reflectometry analyzer, the third fingerprint being different from the first fingerprint;
• determine that a difference between the first fingerprint and the third fingerprint indicates that a third optical link has been substituted for the first optical link in the path;
• determine that the network path is not secure in response to determining that the third optical link has been substituted for the first optical link in the path;
• determine that the difference between the first fingerprint and the third fingerprint indicates that a particular physical property of the first optical link has changed;
• and
• determine that the network path is secure based upon the determination that the particular physical property of the first optical link has changed.