arXiv:2311.12791 · npj Quantum Information

MadQCI: a heterogeneous and scalable SDN-QKD network deployed in production facilities

Vicente Martín, Juan P. Brito, Laura Ortíz, Rubén B. Méndez, Jaime S. Buruaga, Rafael J. Vicente, Alberto Sebastián-Lombraña, David Rincón, F. Pérez, César Sánchez, Momtchil Peev, Hans H. Brunner, Fred Fung, Andreas Poppe, Florian Fröwis, Andrew J. Shields, Robert I. Woodward, Helmut Grießer, S. Roehrich, F. de la Iglesia, Carlos Abellán, Michael Hentschel, José Manuel Rivas-Moscoso, Antonio Pastor, Jesús Folgueira, Diego R. Lopez

Published Sep 2, 2024• 100 citations

arXiv HTML PDF

Abstract

Abstract Current quantum key distribution (QKD) networks focus almost exclusively on transporting secret keys at the highest possible rate. Consequently, they are built as mostly fixed, ad hoc, logically, and physically isolated infrastructures designed to avoid any penalty to the quantum channel. This architecture is neither scalable nor cost-effective and future, real-world deployments will differ considerably. The structure of the MadQCI QKD network presented here is based on disaggregated components and modern paradigms especially designed for flexibility, upgradability, and facilitating the integration of QKD in the security and telecommunications-networks ecosystem. These underlying ideas have been tested by deploying many QKD systems from several manufacturers in a real-world, multi-tenant telecommunications network, installed in production facilities and sharing the infrastructure with commercial traffic. Different technologies have been used in different links to address the variety of situations and needs that arise in real networks, exploring a wide range of possibilities. Finally, a set of realistic use cases has been implemented to demonstrate the validity and performance of the network. The testing took place during a period close to three years, where most of the nodes were continuously active.

DOI: 10.1038/s41534-024-00873-2

Related papers

Benchmarking hybrid quantum-safe cryptography over real-world infrastructures

Jaime S. Buruaga, Juan P. Brito, Vicente Martín

Abstract Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.

EPJ Quantum TechnologyMay 15, 20260 citations

Benchmarking hybrid quantum-safe cryptography over real-world infrastructures

Jaime S. Buruaga, Juan Pedro Brito Méndez, Vicente Martín Ayuso

Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.

May 15, 20260 citations

SDN-Based Hybrid Quantum-Safe Domain Intercommunication Within MadQCI

Rubén B. Méndez, Jaime S. Buruaga, Rafael J. Vicente +9 more

The importance of quantum-key-distribution (QKD) networks is growing rapidly, not only because the underlying QKD protocol is immune against any (known or unknown) attacks but also as these infrastructures can be operated in a hybrid mode, together with emerging quantum safe, or post quantum cryptography (PQC), public key protocols. Hybrid solutions appear to be the most promising remedy against real-world security risks, posed by prospective quantum computers. Simultaneously, telecommunication operators are embracing novel network paradigms, such as software-defined networking (SDN), due to distinct advantages over traditional approaches. SDN-inspired architectures can also be used for QKD and hybrid QKD-PQC networks. These architectures allow a seamless integration of QKD and hybrid QKD-PQC into production networks, significantly increasing the security of the latter. However, there has only been very limited research on optimal strategies for establishing hybrid connectivity across different organizational domains. The present contribution introduces two methods on interconnecting different technological and administrative domains for such networks. The proposed scheme is QKD-vendor independent and relies heavily on standard and open interfaces. It enables a complete end-to-end communication between applications running on nodes in different domains. It can be used for the secure interconnection of different SDN-based telecommunication domains with additional QKD / hybrid protection and has been tested within the Madrid Quantum-Communication Infrastructure.

International Conference on Quantum Communications, Networking, and Computing (QCNC)Jul 1, 20245 citations

Applying QKD to improve next-generation network infrastructures

Vı́ctor López, Antonio Pastor, Diego R. Lopez +2 more

There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.

European Conference on Networks and CommunicationsJun 1, 201922 citations

Enabling Quantum Key Distribution Networks via Software-Defined Networking

Alejandro Aguado, Vı́ctor López, Juan P. Brito +3 more

Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.

International Conference on Optical Network Design and Modeling (ONDM)May 1, 202032 citations

Deploying and validating a metropolitan QKD secure network: architecture and field performance

Claudia De Lazzari, Nicola Biagi, Damiano Giani +15 more

The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.

quant-pharXiv:2607.11727Jul 14, 20260 citations