We demonstrated for the first time quantum-safe high-speed 100 Gbps site-to-site IPsec tunnels secured using Quantum Key Distribution (QKD) technology. The demonstration was conducted between two JPMorgan Chase Data Centers (DCs) in an air-gapped environment over 46 km of deployed telecom fiber across Singapore achieving 45 days of continuous operation. Two different Virtual Private Network (VPN) tunnel configurations were tested: (1) a QKD-secured VPN tunnel configuration with a maximum throughput of 80 Gbps and (2) a multi-VPN tunnel configuration exhibiting 12 QKD-secured VPN tunnels with a throughput of 8.39 Gbps per tunnel resulting in an aggregated throughput of 99.62 Gbps for all tunnels. For the QKD system performance, we achieved an average Secret Key Rate (SKR) of 7.4 kbps (about 29 AES-256 keys per second), an average Quantum Bit Error Rate (QBER) of 0.8% and an average visibility of 98.6%. We utilized the ETSI-QKD-014 REST-based Application Programming Interface (API) to exchange the QKD generated keys between the key management server in the QKD system and the next-generation firewalls in order to encrypt and decrypt the data. The data was encrypted by the quantum-safe keys using the AES-256-GCM cipher suite with a key refresh rate of 120 seconds without affecting the VPN tunnel connectivity and performance
We demonstrated for the first time quantum-safe high-speed 100 Gbps site-to-site IPsec tunnels secured using Quantum Key Distribution (QKD) technology. The demonstration was conducted between two JPMorgan Chase Data Centers (DCs) in an air-gapped environment over 46 km of deployed telecom fiber across Singapore achieving 45 days of continuous operation. Two different Virtual Private Network (VPN) tunnel configurations were tested: (1) a QKD-secured VPN tunnel configuration with a maximum throughput of 80 Gbps and (2) a multi-VPN tunnel configuration exhibiting 12 QKD-secured VPN tunnels with a throughput of 8.39 Gbps per tunnel resulting in an aggregated throughput of 99.62 Gbps for all tunnels. For the QKD system performance, we achieved an average Secret Key Rate (SKR) of 7.4 kbps (about 29 AES-256 keys per second), an average Quantum Bit Error Rate (QBER) of 0.8% and an average visibility of 98.6%. We utilized the ETSI-QKD-014 REST-based Application Programming Interface (API) to exchange the QKD generated keys between the key management server in the QKD system and the next-generation firewalls in order to encrypt and decrypt the data. The data was encrypted by the quantum-safe keys using the AES-256-GCM cipher suite with a key refresh rate of 120 seconds without affecting the VPN tunnel connectivity and performance
Security of data transported in telecommunication networks is of primary importance for internet service providers (ISP) as data safety is at the basis of the mutual trust with customers. People were looking for theoretically secure transmission techniques since a long-time to ensure long-term confidentiality of data flows exchanged on these networks. Besides advanced encryption algorithms and the recently proposed post-quantum cryptography (PQC), a physics-based technology using quantum key distribution (QKD) was proposed a long time ago to approach this objective. QKD recently gained a renewed interest with many research programs worldwide supported by public authorities, and some pre-industrial QKD systems delivered to the market. However, some constraints of optical transport networks make sometimes complicated the deployment of such QKD systems in the field, such as the need of a dedicated fiber infrastructure for QKD, or the impossibility for a quantum key to pass through an optical amplifier. In this paper, we report the transmission of a coherent 400-Gbps dual-polarization 16QAM channel that transports QKD-secured 100-GbEthernet data stream with other fifty-four WDM channels at 100-Gbps over 184-km of standard single mode fiber (SSMF) through three QKD links (of 66-km, 50-km and 66-km, respectively) and two trusted nodes. On the two longest sections of the link, the quantum key and WDM signals are propagated on two different fibers, while on the shortest section of 50-km the QKD signal and WDM comb co-propagate on a same fiber. Secret key rates (SKR) and quantum bit error rate (QBER) are measured and reported on each of the three fiber sections. Various analyses are carried out on the co-propagation section of 50-km: the SKR / QBER sensitivity to the optical power of the WDM comb, or to the optical signal-to-noise ratio (OSNR) of the WDM channels co-propagating with the quantum signal is studied. The unique arrangement of the most advanced QKD and WDM technologies reported here constitutes, in our opinion, a world first, and demonstrates that QKD and WDM solutions can coexist in already deployed optical transport networks.
In the evolving landscape of quantum technology, the increasing prominence of quantum computing poses a significant threat to the security of conventional public key infrastructure. Quantum key distribution (QKD), an established quantum technology at a high readiness level, emerges as a viable solution with commercial adoption potential. QKD facilitates the establishment of secure symmetric random bit strings between two geographically separated, trustworthy entities, safeguarding communications from potential eavesdropping. In particular, data centre interconnects can leverage the potential of QKD devices to ensure the secure transmission of critical and sensitive information in preserving the confidentiality, security, and integrity of their stored data. In this article, we present the successful implementation of a QKD field trial within a commercial data centre environment that utilises the existing fibre network infrastructure. The achieved average secret key rate of 2.392 kbps and an average quantum bit error rate of less than 2% demonstrate the commercial feasibility of QKD in real-world scenarios. As a use case study, we demonstrate the secure transfer of files between two data centres through the Quantum-Secured Virtual Private Network, utilising secret keys generated by the QKD devices. %This demonstration marks a significant milestone in the deployment of QKD across Singapore, establishing a foundation for widespread adoption and enhancing the infrastructure for practical, quantum-safe communication in commercial environments.
In the near future, commercially accessible quantum computers are anticipated to revolutionize the world as we know it. These advanced machines are predicted to render traditional cryptographic security measures, deeply ingrained in contemporary communication, obsolete. While symmetric cryptography methods like AES can withstand quantum assaults if key sizes are doubled compared to current standards, asymmetric cryptographic techniques, such as RSA, are vulnerable to compromise. Consequently, there is a pressing need to transition towards post-quantum cryptography (PQC) principles in order to safeguard our privacy effectively. A challenge is to include PQC into existing protocols and thus into the existing communication structure. In this work, we report on the first experimental IPsec tunnel secured by the PQC algorithms Falcon, Dilithium, and Kyber. We deploy our IPsec tunnel in two scenarios. The first scenario represents a high-performance data center environment where many machines are interconnected via high-speed networks. We achieve an IPsec tunnel with an AES-256 GCM encrypted east–west throughput of 100 Gbit/s line rate. The second scenario shows an IPsec tunnel between a wireless NVIDIA Jetson and the cloud that achieves a 0.486 Gbit/s AES-256 GCM encrypted north–south throughput. This case represents a mobile device that communicates securely with applications running in the cloud.
This paper presents a practical solution to the problem of limited bandwidth in Quantum Key Distribution (QKD)- secured communication through using rapidly rekeyed Internet Protocol security (IPsec) links. QKD is a cutting-edge security technology that provides mathematically proven security by using quantum physical effects and information theoretical axioms to generate a guaranteed non-disclosed stream of encryption keys. Although it has been a field of theoretical research for some time, it has only been producing market-ready solutions for a short period of time. The downside of this technology is that its key generation rate is only around 52,000 key bits per second over a distance of 50 km. As this rate limits the data throughput to the same rate, it is substandard for normal modern communications, especially for securely interconnecting networks. IPsec, on the other hand, is a well-known security protocol that uses classical encryption and is capable of exactly creating site-to-site virtual private networks. This paper presents a solution that combines the performance advantages of IPsec with QKD. The combination sacrifices only a small portion of QKD security by using the generated keys a limited number of times instead of just once. As a part of this, the solution answers the question of how many data bits per key bit make sensible upper and lower boundaries to yield high performance while maintaining high security. While previous approaches complement the Internet Key Exchange protocol (IKE), this approach simplifies the implementation with a new key synchronization concept, proposing a lightweight protocol that uses relatively few, slim control messages and sparse acknowledgement. Furthermore, it provides a Linux-based module for the AIT QKD software using the Netlink XFRM Application Programmers Interface to feed the quantum key to the IP***ABSTRACT TRUNCATED TO 1920 CHARS***
Quantum Key Distribution (QKD) is attracting much interest for the distribution of cryptographic keys using single photon signals. Currently QKD is often used to provide secure distribution of cryptographic keys for the encryption of data transmitted using conventional classical communication systems. This paper reports major field trials carried out over several months on the Cambridge UK Quantum Network showing the operation of QKD systems alongside high-speed classical transmission systems encrypted QKD derived with AES keys. Quantum Key transmission at record secure key rates of 3.3Mbps, 3.2Mbps and 2.5Mbps has been achieved over 5km, 9.5km and 10.5km long links respectively with corresponding average Quantum bit error rates (QBER) of 2.9%, 2.4% and 3%. Using a 33km link attached to the network with a loss of 7.5 dB, a secure key rate of 1.4 Mbps is achieved with an average QBER of 3.4%. Under loop back conditions this link provides a 66 km transmission path with a 16dB fibre loss, enabling a field trial using the QKD signals multiplexed with two wavelengths each transmitting 100Gb/s classical data to be carried out. This achieves an average secure key rate of 80.2 kbps and a mean QBER of 6.6%, in line with theoretical predictions. During the trial duration, the statistics of the QBER were found to be Gaussian distributed with a standard deviation of 0.5. The results of the field trial suggest that the system works stably and has considerable potential for applications in metropolitan networks. Further measurements will be reported at the conference.