arXiv:1909.04409 · Journal of Lightwave Technology
End-to-End Quantum Secured Inter-Domain 5G Service Orchestration Over Dynamically Switched Flex-Grid Optical Networks Enabled by a q-ROADM
Rui Wang, Qibing Wang, George Theodore Kanellos, Reza Nejabati, Dimitra Simeonidou, Rodrigo S. Tessinari, Emilio Hugues-Salas, Anderson Bravalheri, Navdeep Uniyal, Abubakar S. Muqaddas, Rafael S. Guimaraes, Thierno Diallo, Shadi Moazzeni
Dynamic and flexible optical networking combined with virtualization and softwarisation enabled by network function virtualization (NFV) and software defined networking (SDN) are the key technology enablers for supporting the dynamicity, bandwidth, and latency requirements of emerging 5G network services. To achieve the end-to-end connectivity objective of 5G, network services (NSes) must be often deployed transparently over multiple administrative and technological domains. Such scenario often presents security risks since a typical NS11Network service is a combination of multiple virtual and physical network functions created to realise a desired network functionality. may comprise a chain of network functions, each executed in different remote locations, and tampering within the network infrastructure may compromise their communication. To avoid such threats, quantum key distribution (QKD) has been identified and proposed as a future-proof method immune to any algorithmic cryptanalysis based on fundamental quantum-physics mechanisms to distribute symmetric keys. The maturity of QKD has enabled the research and development of quantum networks with gradual coexistence with classical optical networks using carrier-grade telecom equipment. This makes the QKD technology a suitable candidate for security of distributed and virtualised network services. In this article, for the first time, we propose a dynamic quantum-secured optical network for supporting network services that are dynamically created by chaining virtual network functions (VNFs)22Hardware network functions when implemented in software and deployed as VMs or containers are called VNFs. over multiple network domains. This work includes a new flex-grid quantum-switched reconfigurable optical add drop multiplexer (q-ROADM), extensions to SDN-enabled optical control plane, and extensions to NFV orchestration to achieve quantum-aware, on-demand chaining of VNFs. The experimental results verify the capability of routing quantum and classical data channels both individually and dynamically over shared fibre links. Moreover, quantum secured chaining of VNFs in 5G networks is experimentally demonstrated via interconnecting four autonomous 5G islands simultaneously through the q-ROADM with eight optical channels using the 5GUK Exchange orchestration platform. The experimental scenarios and results confirm the benefit of the proposed data plane architecture and control/management plane framework.
Dynamic and flexible optical networking combined with virtualization and softwarisation enabled by network function virtualization (NFV) and software defined networking (SDN) are the key technology enablers for supporting the dynamicity, bandwidth, and latency requirements of emerging 5G network services. To achieve the end-to-end connectivity objective of 5G, network services (NSes) must be often deployed transparently over multiple administrative and technological domains. Such scenario often presents security risks since a typical NS11Network service is a combination of multiple virtual and physical network functions created to realise a desired network functionality. may comprise a chain of network functions, each executed in different remote locations, and tampering within the network infrastructure may compromise their communication. To avoid such threats, quantum key distribution (QKD) has been identified and proposed as a future-proof method immune to any algorithmic cryptanalysis based on fundamental quantum-physics mechanisms to distribute symmetric keys. The maturity of QKD has enabled the research and development of quantum networks with gradual coexistence with classical optical networks using carrier-grade telecom equipment. This makes the QKD technology a suitable candidate for security of distributed and virtualised network services. In this article, for the first time, we propose a dynamic quantum-secured optical network for supporting network services that are dynamically created by chaining virtual network functions (VNFs)22Hardware network functions when implemented in software and deployed as VMs or containers are called VNFs. over multiple network domains. This work includes a new flex-grid quantum-switched reconfigurable optical add drop multiplexer (q-ROADM), extensions to SDN-enabled optical control plane, and extensions to NFV orchestration to achieve quantum-aware, on-demand chaining of VNFs. The experimental results verify the capability of routing quantum and classical data channels both individually and dynamically over shared fibre links. Moreover, quantum secured chaining of VNFs in 5G networks is experimentally demonstrated via interconnecting four autonomous 5G islands simultaneously through the q-ROADM with eight optical channels using the 5GUK Exchange orchestration platform. The experimental scenarios and results confirm the benefit of the proposed data plane architecture and control/management plane framework.
Quantum key distribution (QKD) is a state-of-the-art method of generating cryptographic keys by exchanging single photons. Measurements on the photons are constrained by the laws of quantum mechanics, and it is from this that the keys derive their security. Current public key encryption relies on mathematical problems that cannot be solved efficiently using present-day technologies; however, it is vulnerable to computational advances. In contrast QKD generates truly random keys secured against computational advances and more general attacks when implemented properly. On the other hand, networks are moving towards a process of softwarization with the main objective to reduce cost in both, the deployment and in the network maintenance. This process replaces traditional network functionalities (or even full network instances) typically performed in network devices to be located as software distributed across commodity data centers. Within this context, network function virtualization (NFV) is a new concept in which operations of current proprietary hardware appliances are decoupled and run as software instances. However, the security of NFV still needs to be addressed prior to deployment in the real world. In particular, virtual network function (VNF) distribution across data centers is a risk for network operators, as an eavesdropper could compromise not just virtualized services, but the whole infrastructure. We demonstrate, for the first time, a secure architectural solution for VNF distribution, combining NFV orchestration and QKD technology by scheduling an optical network using SDN. A time-shared approach is designed and presented as a cost-effective solution for practical deployment, showing the performance of different quantum links in a distributed environment.
Quantum key distribution (QKD) is a state-of-the-art method of generating cryptographic keys by exchanging single photons. Measurements on the photons are constrained by the laws of quantum mechanics, and it is from this that the keys derive their security. Current public key encryption relies on mathematical problems that cannot be solved efficiently using present-day technologies; however, it is vulnerable to computational advances. In contrast QKD generates truly random keys secured against computational advances and more general attacks when implemented properly. On the other hand, networks are moving towards a process of softwarization with the main objective to reduce cost in both, the deployment and in the network maintenance. This process replaces traditional network functionalities (or even full network instances) typically performed in network devices to be located as software distributed across commodity data centers. Within this context, network function virtualization (NFV) is a new concept in which operations of current proprietary hardware appliances are decoupled and run as software instances. However, the security of NFV still needs to be addressed prior to deployment in the real world. In particular, virtual network function (VNF) distribution across data centers is a risk for network operators, as an eavesdropper could compromise not just virtualized services, but the whole infrastructure. We demonstrate, for the first time, a secure architectural solution for VNF distribution, combining NFV orchestration and QKD technology by scheduling an optical network using SDN. A time-shared approach is designed and presented as a cost-effective solution for practical deployment, showing the performance of different quantum links in a distributed environment.
The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.
Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.
There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.
Quantum key distribution (QKD) provides future-proof security for data communications over optical networks. Currently, sophisticated QKD systems are developed and the scale of QKD-secured optical networks (QKD-ONs) becomes larger. Given the complex network conditions and dynamic end-to-end security services in QKD-ONs, autonomic management and control becomes a promising paradigm to support end-to-end quality-of-service (QoS) assurance in an efficient and stable way without requiring human intervention. Hence, to enable and utilize the autonomic functionalities over QKD-ONs for realizing the end-to-end QoS assurance becomes a challenge. This work enhances the software defined networking (SDN) technique to tackle this challenge because SDN can add programmability and flexibility for QKD-ON's management and control. A new architecture of SDN-based QKD-ONs supporting autonomic end-to-end QoS assurance is designed, where a knowledge engine with autonomic control loops is developed in the SDN controller. We present the autonomic end-to-end QoS assurance procedure, and the cross-layer collaborative QoS assurance (CLC-QA) strategy for implementing the autonomic functionalities in the network level over QKD-ONs. We also establish an experimental testbed of SDN-based QKD-ONs supporting autonomic end-to-end QoS assurance, and perform the numerical simulation to verify our proposed approaches. Experimental results demonstrate that our presented approaches can achieve the millisecond-level overall latency of 337 ms and 618 ms, during the first and second autonomic adjustment without human intervention in case of the autonomic QoS protection. Moreover, the CLC-QA strategy is evaluated under different traffic loads by being compared with the baseline strategy without cross-layer collaboration. It can improve 22.5% protection success ratio and save 5.7% average key consumption.