Addressing optical physical layer security for metropolitan-optimized optical transport network (M-OTN) presents a critical challenge for telecom operators. This paper introduces and experimentally validates a methodology for real-time optical service unit (OSU) optical signal time-domain scrambling integrated with decoy-state quantum key distribution (DS-QKD). The system processes OSU optical signals in real-time utilizing tunable Fabry-Perot cavity (FPC) with dynamically updated and synchronized keys. The DS-QKD system implements the decoy-state BB84 protocol and polarization coding for seed key distribution. The research demonstrates effective end-to-end optical physical layer security for M-OTN (OTU2, 10.709 Gbit/s) data transmission under real-time key update conditions.

Figure 2 illustrates the operational principle of real-time OSU optical signal time-domain random scrambling integrated with the DS-QKD system. The system employs a symmetric encryption architecture, incorporating a DS-QKD transmitter and receiver, with key transmission via DS-QKD. Through the quantum channel, the transmitter communicates a random seed key to the receiver without service data transmission. The DS-QKD system initially transfers the seed key to the local field-programmable gate array (FPGA), which maintains the seed key and establishes a running key pool. The transmitter's FPGA then utilizes a running key from the pool to scramble the input OSU optical signal. Concurrently, it transmits the synchronization marker to the receiver's FPGA through the synchronization channel. Upon receiving the synchronization marker, the receiver’s FPGA employs the corresponding running key from its pool to descramble the received OSU optical signal. FPC facilitates the time-domain scrambling of the OSU optical signal (Fig. 3). Each FPC incorporates an independent temperature control module (TCM), and the scrambling/descrambling controller modifies the FPCs’ parameters using the running key after transmitter-receiver synchronization, specifically adjusting the cavity’s optical thickness for time-domain scrambling/descrambling.

The eye diagrams of the experimental results for OSU optical signal scrambling and descrambling (Fig. 6), with Fig. 6(a) and Fig. 6(b) showing the original and scrambled signals, respectively. The scrambled signal differs substantially from the original 10.709 Gbit/s non-return-to-zero (NRZ) signal due to the FPC array's bit overlapping scrambling. This confirms the scrambler’s effectiveness in disrupting the temporal position relationship between bits, rendering the OSU optical signal undigitizable. The unperturbed eye diagrams are shown in Fig. 6(c) and Fig. 6(d), respectively. Figure 7 illustrates the system’s running key performance, while Fig. 8 shows the bit error rate (BER) performance of the OSU signal after backhaul (B2B). These results confirm the effective enhancement of optical physical layer security.

This research presents and experimentally validates an OSU optical physical layer security protection method utilizing real-time optical signal time-domain scrambling. DS-QKD provides the seed key, enabling running key generation between the transmitter and receiver. System performance testing confirms that only authorized users employing the synchronous scrambler/de-scrambler and correct running key can successfully recover OSU data. Without the synchronization running key, eavesdroppers cannot extract the OSU optical signal’s digital features. The proposed method enhances M-OTN security by implementing protection in the optical domain, supplementing traditional electrical domain encryption algorithms.