Act now »

Dark fibre runs through car parks: why Layer 1 encryption is not a luxury

Organisations that lease or own dark fibre often regard that connection as private infrastructure. Their own fibre, their own data, their own management. What is often underestimated, however, is that the physical cable runs through infrastructure that you do not manage, beneath streets, through building service rooms, via multi-storey car parks and cable ducts in the public domain. And anyone with physical access to the fibre has access to the data travelling over it.

How does fibre tapping work?

A fibre-optic cable transmits data in the form of light pulses. You don’t need to cut the cable to intercept that data. By bending the fibre slightly, photons escape from the core. A photodetector positioned at that bend captures that light and can reconstruct the signal.

The attack is passive. No electrical connection is required, there is no signal interference, and in most cases no alarms are triggered within the network. Data communication continues as normal whilst the data is being read.

The physical access required for this is limited. A cable duct in a multi-storey car park, a plant room in an office building or a street cabinet in a public space are, in practice, more accessible than organisations realise.

Where does dark fibre run through?

Dark fibre is laid alongside existing infrastructure. In practice, this means: cable ducts beneath public roads, in shared service rooms within buildings, through multi-storey car parks beneath city centres, and alongside other existing utility lines in tunnels and railway tunnels.

Those routes were determined by what was feasible during construction, not by security considerations. Along a ten-kilometre stretch between two data centres, there are dozens of points where the cable is physically accessible to anyone with the right tools and a bit of time.

What is Layer 1 encryption?

Network communication is protected at various layers of the OSI model. TLS encrypts at the application layer. MACsec operates at Layer 2. IPsec operates at Layer 3. All these methods encrypt the data packet, but the optical signal itself, the light pulses in the fibre, remains unencrypted.

Layer 1 encryption, also known as Optical Layer Encryption (OLE) or Physical Layer Encryption (PLE), encrypts the light signal before it leaves the equipment. The encryption takes place within the transport device itself, at the optical frame level. Whatever travels over the dark fibre is encrypted light from start to finish.

An attacker who taps into the fibre captures encrypted light. Without the key, the signal cannot be reconstructed.

What is the difference compared with encryption at higher layers?

Higher layers protect the data, but not the transport layer itself. Metadata relating to the communication, such as the fact that communication is taking place, the volume of the data streams and the timing pattern, is still visible to anyone who intercepts the signal.

L1 encryption completely obscures the transport layer. There is no discernible structure in the intercepted signal. This also makes it resistant to attacks that seek to decrypt historically intercepted data at a later date, using future computing power, a technique also known as ‘harvest now, decrypt later’.

Latency and performance

A common objection to L1 encryption is its impact on latency. In practice, modern L1 encryption devices add less than one microsecond of latency. For most applications, this is negligible. Encryption and decryption take place in dedicated hardware at line speed, without limiting throughput.

When is L1 encryption relevant?

L1 encryption is relevant for any connection over dark fibre where the confidentiality of the data must not depend solely on the security of higher layers. This applies to connections between data centres, campus connections over leased dark fibre, and interconnections between the sites of organisations that handle sensitive data.

Regulations such as NIS2 and sector-specific standards for financial institutions and healthcare organisations are placing increasing demands on encryption in transit. L1 encryption can form part of a demonstrably secure transport layer.

PacketLight Networks and Smartoptics are examples of vendors that integrate Layer 1 encryption into their optical transport hardware.

Interested in finding out how L1 encryption fits into your dark fibre infrastructure? We’d be happy to help you find a solution.

See also.

Monitoring dark fibre before problems arise: active monitoring with the Adtran ALM

By definition, dark fibre is dark. No signal travels through it, there is no traffic to measure, and a traditional monitoring system detects nothing. Yet fibre-optic cables do degrade: connectors wear out, cables become damaged, and connections weaken due to temperature fluctuations or mechanical stress. If you don’t monitor this, you won’t notice it until the service goes down.
Read article

Dark fibre runs through car parks: why Layer 1 encryption is not a luxury

Organisations that lease or own dark fibre often regard that connection as private infrastructure. Their own fibre, their own data, their own management. What is often underestimated, however, is that the physical cable runs through infrastructure that you do not manage, beneath streets, through building service rooms, via multi-storey car parks and cable ducts in the public domain. And anyone with physical access to the fibre has access to the data travelling over it.
Read article

After VMware: what alternatives are there for edge and remote site infrastructure?

Broadcom’s acquisition of VMware in 2023 was accompanied by significant changes to licensing. Perpetual licenses were discontinued, the product portfolio was reorganized into bundles, and for many organizations, costs rose significantly. This has accelerated the search for alternatives, particularly for environments where VMware has historically been widely used: edge locations and remote sites.
Read article