To the point of security threats against lightpath establishment process in ASON, an efficient secure lightpath establishment protocol is presented. This protocol uses integrated strategy of wavelength reservation, and makes use of digital signature and message feedback security mechanisms to protect the integrity of important object in GMPLS RSVP-TE message and prevent malicious or selfish actions from inner node. In addition, in view of the close coupling character of routing and signaling module in ASON, this protocol adopts PKLSA message of OSPF-TE to distribute nodes public key certificate which the lightpath establishment protocol demanded. Through simulation experiment and analysis, it is proved that this protocol can ensure the security of lightpath establishment,and has better performance than the old RSVP-TE protocol in terms of connection block probability, lightpath connection setup time and message overhead.