A method of providing secure communication over end-to-end data paths in a packet network, wherein the packet network is a timed deterministic packet network comprising a plurality of packet engines (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) that perform packet handling, the method comprising: performing, by a plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224), at least one cyber security function, wherein each cipher engine of the plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224) is respectively associated with a respective packet engine of the plurality of packet engines (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) and provided separately from the respective packet engine, wherein at least some of the cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224) are respectively provided between a respective packet engine (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) of an endpoint node of the packet network and a network facing port of the endpoint node, or between the respective packet engine (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) of the endpoint node and a first transit node connected to the endpoint node; and centrally controlling, by a cipher engine and key manager, CEKM, the plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224), wherein the CEKM receives information relating to a data flow topology of an end-to-end data path from a centralized packet flow path manager, PFPM, for configuring the plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224). performing, by a plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224), at least one cyber security function, wherein each cipher engine of the plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224) is respectively associated with a respective packet engine of the plurality of packet engines (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) and provided separately from the respective packet engine, wherein at least some of the cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224) are respectively provided between a respective packet engine (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) of an endpoint node of the packet network and a network facing port of the endpoint node, or between the respective packet engine (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) of the endpoint node and a first transit node connected to the endpoint node; and between a respective packet engine (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) of an endpoint node of the packet network and a network facing port of the endpoint node, or between the respective packet engine (12, 22, 32; 61-64; 141, 142; 161, 162; 211-214) of the endpoint node and a first transit node connected to the endpoint node; and centrally controlling, by a cipher engine and key manager, CEKM, the plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224), wherein the CEKM receives information relating to a data flow topology of an end-to-end data path from a centralized packet flow path manager, PFPM, for configuring the plurality of cipher engines (14, 24, 43; 71-74; 143-146; 163-166; 221-224).