Quantum computers will change the cryptographic panorama. A technology once believed to lie far away in the future is increasingly closer to real-world applications. Quantum computers will break the algorithms used in our public key infrastructure and in our key exchange protocols, forcing a complete retooling of cryptography as we know it. Quantum key distribution is a physical layer technology immune to quantum or classical computational threats. However, it requires a physical substrate, and optical fiber has been the usual choice. Most of the time, it is used just as a point-to-point link for the exclusive transport of delicate quantum signals. Its integration in a realworld shared network has not been attempted so far. Here we show how the new programmable software network architectures, together with specially designed quantum systems, can be used to produce a network that integrates classical and quantum communications, including management, in a single, production-level infrastructure. The network can also incorporate new quantum- safe algorithms and use the existing security protocols, thus bridging the gap between today's network security and the quantum-safe network of the future. This can be done in an evolutionary way, without zero-day migrations and the corresponding upfront costs. We also present how the technologies have been deployed in practice using a production network.
Quantum computers will change the cryptographic panorama. A technology once believed to lie far away in the future is increasingly closer to real-world applications. Quantum computers will break the algorithms used in our public key infrastructure and in our key exchange protocols, forcing a complete retooling of cryptography as we know it. Quantum key distribution is a physical layer technology immune to quantum or classical computational threats. However, it requires a physical substrate, and optical fiber has been the usual choice. Most of the time, it is used just as a point-to-point link for the exclusive transport of delicate quantum signals. Its integration in a realworld shared network has not been attempted so far. Here we show how the new programmable software network architectures, together with specially designed quantum systems, can be used to produce a network that integrates classical and quantum communications, including management, in a single, production-level infrastructure. The network can also incorporate new quantum- safe algorithms and use the existing security protocols, thus bridging the gap between today's network security and the quantum-safe network of the future. This can be done in an evolutionary way, without zero-day migrations and the corresponding upfront costs. We also present how the technologies have been deployed in practice using a production network.
The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
In an era of unprecedented technological advancement, the rise of quantum computing poses both opportunities and challenges to network security. While quantum computers promise to revolutionize data processing and problem-solving, they also render traditional cryptographic protocols vulnerable, threatening the integrity of current network security systems. Quantum cryptography, particularly quantum key distribution (QKD), emerges as a groundbreaking solution, leveraging the principles of quantum mechanics to ensure unparalleled data security. Unlike classical methods, QKD guarantees secure communication by detecting eavesdropping attempts, as any observation of quantum states disrupts their integrity. This paper explores the pivotal role of quantum cryptography in shaping future network security protocols amidst a landscape of increasing cyber threats. It provides a comprehensive analysis of QKD systems, their integration into existing infrastructure, and their resilience against potential quantum-based attacks. The discussion includes real-world implementations, such as satellite-based QKD networks and fiber-optic quantum communication systems, illustrating their practical viability and scalability. Furthermore, the paper addresses current challenges, including cost, technical complexity, and interoperability with classical networks, offering insights into ongoing research aimed at overcoming these hurdles. As global reliance on digital infrastructure grows, the transition to quantum-resilient security frameworks becomes imperative. Policymakers, industry leaders, and technology developers must collaborate to advance quantum cryptographic technologies and ensure their accessibility. By securing communication channels against both classical and quantum threats, quantum cryptography is positioned to redefine the foundations of network security, paving the way for a more secure and interconnected digital future.
Software-Defined Networking (SDN) is an emerging networking paradigm that decouples the control and data plane in order to enable programmable and flexible networks, optimizing its applications and advancing computer systems. It does so through its architecture, a key part of which is a centralized network management through open interfaces that revolutionizes the way in which networks are designed and makes them more agile and versatile to the evolving needs of modern and future applications services. This also means, however, that there is now a centralized point of attack that is a major vulnerability, threatening the security of the entire network. With such an advanced network paradigm, it requires a security system that will mitigate these risks and warrant long-term security. In attempts to allow secure communications within the network, this research proposes the implementation of Quantum Key Distribution (QKD), leveraging quantum mechanics to secure the network against any computational advancements in the future. QKD is a recent cryptographic system that includes a traditional-computational channel and a physical-quantum channel to generate and distribute keys between parties. It uses the principles of quantum mechanics including entanglement and superposition to ensure that the physical layer cannot be compromised computationally. QKD provides confidentiality and privacy of information and communication. Moreover, it is resistant to technological advancements. The implications of QKD significantly enhance SDN security through its protection against attacks, efficient key distribution, reliable network orchestration, and data integrity, creating an architecture that establishes stable communication channels that are resistant to cyber threats.
Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.
Quantum Key Distribution (QKD) has progressed from a theoretical cryptographic concept to an emerging secure communication infrastructure technology. While early work focused on protocol security and physical-layer feasibility, current research increasingly addresses scalable network deployment, hardware acceleration, and integration with classical communication systems. As QKD expands from point-to-point links to metropolitan, backbone, and hybrid satellite–terrestrial networks, new engineering challenges arise in topology design, entropy generation, real-time key distillation, and multi-vendor interoperability. This survey provides an infrastructure-oriented review of QKD networks, examining architectural models, quantum randomness as a root of trust, FPGA and system-on-chip (SoC) based acceleration techniques, and programmable control-plane integration. Key management system architectures and standardized interfaces are analyzed to highlight their roles in enabling scalable, interoperable deployments. The paper also synthesizes major standardization efforts and deployment initiatives shaping carrier-grade QKD infrastructures. Finally, open engineering challenges, including scalability, control-plane integration, certification harmonization, and hybridization with post-quantum cryptography, are identified, positioning QKD as a foundational component of next-generation secure communication systems.