Quantum security over long distances with untrusted relays is largely unfounded and is still an open question for active research. Standard Quantum Key Distribution Network (QKDN) architecture demands full trust in QKD relays, which is too restrictive and limits QKDN applications. We investigate secure secret relaying in QKDNs by relaxing the trust assumptions (if not completely) on the relay. We classify QKD relays into Full Access Trust (FAT), Partial Access Trust (PAT), and No Access Trust (NAT) levels, each reflecting the required trust on the key management system for end-to-end communication. We review and propose QKD key management systems based on these trust levels. We propose a new decentralized key management system and review key management within a centralized topology. These different approaches offer various advantages based on QKDN requirements, granting operational flexibility. We believe this work offers a fresh perspective on the challenge of ensuring secure long-range communications in the future.
Quantum security over long distances with untrusted relays is largely unfounded and is still an open question for active research. Standard Quantum Key Distribution Network (QKDN) architecture demands full trust in QKD relays, which is too restrictive and limits QKDN applications. We investigate secure secret relaying in QKDNs by relaxing the trust assumptions (if not completely) on the relay. We classify QKD relays into Full Access Trust (FAT), Partial Access Trust (PAT), and No Access Trust (NAT) levels, each reflecting the required trust on the key management system for end-to-end communication. We review and propose QKD key management systems based on these trust levels. We propose a new decentralized key management system and review key management within a centralized topology. These different approaches offer various advantages based on QKDN requirements, granting operational flexibility. We believe this work offers a fresh perspective on the challenge of ensuring secure long-range communications in the future.
As a promising application of quantum information technology, Quantum Key Distribution (QKD) can provide information-theoretically secure key exchange for adjacent communication parties. To achieve long-distance secure communication and scale expansion against inherent channel loss, trusted relays, which are assumed to be absolutely secure, are introduced into QKD networks. However, in practice, trusted relays may be compromised by attacks from ubiquitous eavesdroppers even protected by powerful hardware. Thus, how to ensure the security of end-to-end key distribution in partially-trusted relay QKD networks with the coexistence of trusted relays and untrusted relays becomes a challenging but urgent problem to be solved. To address this critical problem, in this article, we design a segment-based multipath key distribution method. The basic idea of the method is to maximize the security of the end-to-end key distribution through the segment-based multipath key distribution. Under the premise of security level requirements, we further propose a flexible key reconstruction scheme to improve the efficiency of key distribution and obtain available secret keys as many as possible. The extensive simulations are conducted and the results reveal that our method significantly outperforms the traditional multipath QKD method in terms of both security and efficiency.
Quantum Key Distribution (QKD) is a promising technology that provides proven unconditional security based on fundamentals of quantum physics, especially for point-to-point communications. It could be applied in large-scale optical networks for long-distance key provisioning mainly by three relaying methods: quantum-repeater-based QKD, trusted-relay-based QKD, and measurement-device-independent QKD (MDI-QKD). However, quantum-repeater-based QKD is still under study because of the immature technologies such as the preliminary quantum memory. The trusted-relay-based QKD is vulnerable since insecurity of non-ideal single-photon sources and detectors cannot be ignored in practical applications. On the other hand, for MDI-QKD, there exists a limitation on its key rate under long-distance communications. According to these limitations, embedding protocols like MDI-QKD into the existing trusted-relay-based QKD secured optical networks (QKD-ON) with usage of untrusted relays is a promising key-provisioning scheme. In this paper, we study such partially-trusted relay scenarios and focus on its routing of keys in different kinds of typical network topologies. A partially-trusted-relay-based QKD method is described, which can allow a pair of optical nodes sharing secret keys under the coexistence of trusted relays and untrusted relays. The secret-key provisioning with collaborative routing (SKP-CR) algorithm is proposed to search for the optimal key-relay routing path. We perform the simulations with different proportion of trusted relays versus untrusted relays, initial secret keys in the quantum key pools (QKPs), and traffic load. The simulations verify that theSKP-CRalgorithm can significantly outperform the conventional trusted-relay-based scheme in terms of key-distribution success rate with an improvement of up to62%with a mesh topology.
Secure communication makes the widespread use of telecommunication networks and services possible. With the constant progress of computing and mathematics, new cryptographic methods are being diligently developed. Quantum Key Distribution (QKD) is a promising technology that provides an Information-Theoretically Secure (ITS) solution to the secret-key agreement problem between two remote parties. QKD networks based on trusted relay nodes are built to provide service to a larger number of parties at arbitrary distances. They function as an add-on technology to traditional networks, generating, managing, distributing, and supplying ITS cryptographic keys. Since key resources are limited, integrating QKD network services into critical infrastructures necessitates effective key management. As a result, this article provides a comprehensive review of key management approaches for trusted-relay QKD networks. They are analyzed to facilitate the identification of potential strategies and accelerate the future development of QKD networks.
Quantum key distribution (QKD) allows the distribution of secret keys for quantum-secure communication between two distant parties, vital in the quantum computing era in order to protect against quantum-enabled attackers. However, overcoming rate-distance limits in QKD and the establishment of quantum key distribution networks necessitate key relaying over trusted nodes. This process may be resource-intensive, consuming a substantial share of the scarce QKD key material to establish end-to-end secret keys. Hence, an efficient scheme for key relaying and the establishment of end-to-end key pools is essential for practical and extended quantum-secured networking. In this paper, we propose and compare two protocols for managing, storing, and distributing secret key material in QKD networks, addressing challenges such as the success rate of key requests, key consumption, and overhead resulting from relaying. We present an innovative, fully decentralized key distribution strategy as an alternative to the traditional hop-by-hop relaying via trusted nodes, where three experiments are considered to evaluate performance metrics under varying key demand. Our results show that the decentralized pre-flooding approach achieves higher success rates as application demands increase. This analysis highlights the strengths of each approach in enhancing QKD network performance, offering valuable insights for developing robust key distribution strategies in different scenarios.
Quantum key distribution (QKD) is a symmetric key exchange mechanism designed to enhance the security of current communication systems. Although QKD provides unconditional security, it also comes with deployment challenges. One challenge is the distance limitation between the transmitter and receiver, which restricts the large-scale adoption of QKD. To overcome this, trusted relays are used as intermediate nodes, allowing QKD to evolve from distance-limited point-to-point connections to unlimited QKD networks (QKDN). With an increasing deployment of QKD and a growing number of applications requesting keys, quality of service (QoS) constraints must be set for efficient key resource management to alleviate the risk of rejecting application requests. In this work, we integrate key delivery delay and maximum requested key size as QoS constraints in a novel key allocation algorithm built on three QKDN layers – quantum, key management and service. Moreover, we design key relaying using quantum key pools and virtual quantum key pools as storage mechanisms. We use static and dynamic weights for relay path computation and evaluate their impact on the proposed key allocation strategies with QoS constraints and find that static weights show a good overall performance for QKDN, while performance with dynamic weights varies based on historical key consumption data.
We investigate Quantum Key Distribution (QKD) relaying models. Firstly, we propose a novel quasi-trusted QKD relaying model. The quasi-trusted relays are defined as follows: (i) being honest enough to correctly follow a given multi-party finite-time communication protocol; (ii) however, being under the monitoring of eavesdroppers. We develop a simple 3-party quasi-trusted model, called Quantum Quasi-Trusted Bridge (QQTB) model, to show that we could securely extend up to two times the limited range of single-photon based QKD schemes. We also develop the Quantum Quasi-Trusted Relay (QQTR) model to show that we could securely distribute QKD keys over arbitrarily long distances. The QQTR model requires EPR pair sources, but does not use entanglement swapping and entanglement purification schemes. Secondly, we show that our quasi-trusted models could be improved to become untrusted models in which the security is not compromised even though attackers have full controls over some relaying nodes. We call our two improved models the Quantum Untrusted Bridge (QUB) and Quantum Untrusted Relay (QUR) ones. The QUB model works on single photons and allows securely extend up to two times the limited QKD range. The QUR model works on entangled photons but does not use entanglement swapping and entanglement purification operations. This model allows securely transmit shared keys over arbitrarily long distances without dramatically decreasing the key rate of the original QKD schemes.