In order to tackle the security and privacy problems in optical networks, a novel mesh-based optical security network exploiting double masking (DM) scheme for multipoint confidential communication is proposed and studied theoretically. For each node in the network, a pair of mutually asynchronous vertical-cavity surface-emitting lasers (VCSELs) are required as transceivers, and the delay fiber (DF) is used to set different time delays as network node markers. In this security network, the encryption of the message is implemented on the transmitter of the source node by using the DM scheme, and the encrypted message is transmitted to the receiver of the destination node through the optical network for decryption. Each network node can output its individual chaotic signals separately with different time delay markers. By regulating different internal parameter mismatches, the synchronization characteristics of transceivers in a security network are numerically analyzed by using the cross correlation coefficient. Simulation results show that the chaos synchronization between transceivers enjoys fantastic robustness to mismatched parameters. Meanwhile, the tolerance of the DM scheme to the inherent parameter mismatch is excellent, so it is suitable for constructing secure networks in optical networks. Besides, based on the high quality synchronization with a correlation coefficient of 0.983, the communication performances of the longest path channel are investigated for a given metropolitan area network scale. Two pieces of 10 Gb/s messages can be effectively concealed in the chaos and decoded gratifyingly behind 100 km transmission, and the system has reliable security to resist illegal attacks. Finally, the network performance simulation is conducted for diverse configurations of the mesh-based optical networks. All the results confirmed the chaotic encryption scheme provides a novel way for any two legitimate nodes to establish security keys in optical networks.