Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2409.01069 · IEEE Network

The Optical Architecture of a Heterogeneous Quantum Network Deployed in Production Facilities

Alberto Sebastián-Lombraña, Hans H. Brunner, David Rincón, Juan P. Brito, Rubén B. Méndez, Rafael J. Vicente, Jaime S. Buruaga, Laura Ortiz, José Luis Rosales, Chi-Hang Fred Fung, Momtchil Peev, José M. Rivas-Moscoso, Felipe Jiménez, Antonio Pastor, Diego R. López, Jesús Folgueira, César Sánchez, Vicente Martín Ayuso

Published Jan 12, 2026• 3 citations
arXivHTMLPDF

Abstract

Quantum Communications promise advances in cryptography, quantum computing and clock synchronisation, among other emerging applications. However, communication based on quantum phenomena requires an extreme level of isolation from external disturbances, complicating the co-propagation of quantum and classical signals. The challenge is greater when deploying networks that are both heterogeneous (e.g., multiple vendors) and installed in production facilities, given that this type of infrastructure already supports networks loaded with their own requirements. Moreover, to achieve a broad acceptance among network operators, the joint management and operation of quantum and classical resources, compliance with standards, and legal and quality assurance need to be addressed. This article presents solutions to the aforementioned challenges validated in the Madrid quantum network during the implementation of the projects CiViC and OpenQKD. This network was designed to integrate quantum communications in the telecommunications ecosystem by installing quantum-key-distribution modules from multiple providers in production nodes of two different operators. The modules were connected through an optically-switched network with more than 130 km of deployed optical fibre. The tests were done in compliance with strict service level agreements that protected the legacy traffic of the pre-existing classical network. The goal was to ensure full quantum-classical interoperability at all levels, while limiting the modifications to optical transport and encryption and complying with relevant standards. This effort is intended to lay the foundation for large-scale quantum network deployments.

DOI
10.1109/mnet.2025.3645793

Related papers

Deploying and validating a metropolitan QKD secure network: architecture and field performance

Claudia De Lazzari, Nicola Biagi, Damiano Giani +15 more

The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.

quant-pharXiv:2607.11727•Jul 14, 2026•0 citations

MadQCI: a heterogeneous and scalable SDN-QKD network deployed in production facilities

Vicente Martín, Juan P. Brito, Laura Ortíz +23 more

Abstract Current quantum key distribution (QKD) networks focus almost exclusively on transporting secret keys at the highest possible rate. Consequently, they are built as mostly fixed, ad hoc, logically, and physically isolated infrastructures designed to avoid any penalty to the quantum channel. This architecture is neither scalable nor cost-effective and future, real-world deployments will differ considerably. The structure of the MadQCI QKD network presented here is based on disaggregated components and modern paradigms especially designed for flexibility, upgradability, and facilitating the integration of QKD in the security and telecommunications-networks ecosystem. These underlying ideas have been tested by deploying many QKD systems from several manufacturers in a real-world, multi-tenant telecommunications network, installed in production facilities and sharing the infrastructure with commercial traffic. Different technologies have been used in different links to address the variety of situations and needs that arise in real networks, exploring a wide range of possibilities. Finally, a set of realistic use cases has been implemented to demonstrate the validity and performance of the network. The testing took place during a period close to three years, where most of the nodes were continuously active.

arXiv:2311.12791•npj Quantum Information•Sep 2, 2024•100 citations

The Madrid Quantum Network: A Quantum-Classical Integrated Infrastructure

Vicente Martín, Alejandro Aguado, Pedro J. Salas +13 more

We report on the Madrid Quantum Network, designed to demonstrate that a telecommunications network can also host quantum communications in a unified, logical and physical infrastructure. Using new Quantum Key Distribution systems paired with modern networking paradigms, we demonstrate a high technology readiness level of QKD installing the network in production facilities and running relevant use cases.

OSA Advanced Photonics Congress•Jan 1, 2019•17 citations

The Madrid Testbed: QKD SDN Control and Key Management in a Production Network

Vicente Martín, Juan P. Brito, Laura Ortíz +13 more

Software Defined Networking is increasingly seen as one of the best choices to create a Quantum Key Distribution (QKD) Network, especially if the aim is also its integration into a standard telecommunications network. The degree of flexibility afforded by this paradigm allows the creation of a network whose control mechanisms can be made aware simultaneously of the capabilities installed at the classical optical transport level as well as those at the quantum level. This is interesting not only to manage the coexistence between a classical and a quantum network sharing the same infrastructure, but also for future applications beyond QKD. This flexibility is due to a formal separation between the control and data forwarding planes. The logically centralized SDN controller gathers all relevant information monitoring the behavior of the hole network. It can act on the programmable quantum or classical devices opening many possibilities to share a common infrastructure, that can reach even the level of a single fiber strand to manage the signals that go through it in a compatible way. The same controller can use this information to manage the fundamental task of a QKD network, namely the key transport. Here we briefly report on the implementation of the SDN-QKD controller used in the Madrid testbed and its use to allow multi-vendor end-to-end key transport between any two nodes in the network.

International Conference on Transparent Optical Networks•Jul 2, 2023•7 citations

Integration of Quantum Cryptography with Classical Network Infrastructure

Amelia Jensen

Classical network infrastructure -- spanning enterprise TCP/IP backbones, metropolitan optical networks, and wide-area internet exchange points -- was designed without native provisions for quantum cryptographic channels. Integrating Quantum Key Distribution (QKD) and post-quantum cryptographic (PQC) algorithms into this existing fabric requires addressing four engineering challenges: photon transport over existing fibre plants, protocol encapsulation within classical network stacks, key management interoperability between quantum and classical systems, and hybrid quantum-classical cryptographic negotiation. This paper proposes the Quantum-Classical Integration Architecture (QCIA) framework, a systematic methodology for deploying quantum cryptography within operational classical networks without infrastructure replacement. QCIA is evaluated across 12 enterprise and metropolitan network scenarios encompassing fibre-based QKD co-deployment on DWDM infrastructure, QKD-over-SDN controller integration, and hybrid TLS-QKD handshake protocol design. Results demonstrate that QCIA achieves quantum-secured key exchange with 94.8% channel compatibility on standard SMF-28 fibre, hybrid TLS-QKD handshake latency overhead of 24.6 ms, and a Quantum Integration Readiness Score (QIRS) of 0.882 across evaluated scenarios. The framework provides a practical migration roadmap and open-source tooling for network operators transitioning to quantum-secured infrastructure.

Quantum Frontiers Journal•Jul 9, 2025•0 citations

Quantum cryptography networks in support of path verification in service function chains

Alejandro Aguado, Diego R. Lopez, Antonio Pastor +5 more

Quantum key distribution (QKD) is a physical technology that enables the secure generation of bit streams (keys) in two separated locations. This technology is designed to provide a solution for very secure (quantum-safe) key agreement, which is nowadays at risk due to advances in quantum computing. The recent demonstration of a QKD network in the metropolitan area of Madrid shows how these networks can be deployed in current production infrastructure by following existing networking paradigms, such as software-defined networking. In particular, a three-node QKD network is implemented on the metropolitan area network using existing infrastructure and coexisting with other data and control services. On the other hand, telecommunication networks are drastically changing the way services are architectured. Users of the operator’s infrastructure are moving from traditional connectivity services (e.g., virtual private networks) to a set of interconnected network functions, either physical or virtual, in the shape of service function chaining (SFC). However, SFC users do not have a method to validate that the traffic flow is appropriately forwarded across the nodes in the network, a situation that may lead to very critical security breaches (e.g., a security node or a firewall in the chain that is bypassed). This work presents a method for validating ordered proof-of-transit (OPoT) on top of the Madrid Quantum Network. We first provide a general description of the QKD network deployed in Madrid. Then, we describe an existing security protocol for PoT in packet networks, analyzing its issues and vulnerabilities. Finally, this work presents a protocol for alleviating the security breach found in this work and for providing OPoT in SFC. Finally, an example of the real implementation is shown, where nodes being part of the OPoT scheme are provisioned with QKD-derived keys.

Journal of Optical Communications and Networking•Dec 24, 2019•19 citations
Quantum Communications promise advances in cryptography, quantum computing and clock synchronisation, among other emerging applications. However, communication based on quantum phenomena requires an extreme level of isolation from external disturbances, complicating the co-propagation of quantum and classical signals. The challenge is greater when deploying networks that are both heterogeneous (e.g., multiple vendors) and installed in production facilities, given that this type of infrastructure already supports networks loaded with their own requirements. Moreover, to achieve a broad acceptance among network operators, the joint management and operation of quantum and classical resources, compliance with standards, and legal and quality assurance need to be addressed. This article presents solutions to the aforementioned challenges validated in the Madrid quantum network during the implementation of the projects CiViC and OpenQKD. This network was designed to integrate quantum communications in the telecommunications ecosystem by installing quantum-key-distribution modules from multiple providers in production nodes of two different operators. The modules were connected through an optically-switched network with more than 130 km of deployed optical fibre. The tests were done in compliance with strict service level agreements that protected the legacy traffic of the pre-existing classical network. The goal was to ensure full quantum-classical interoperability at all levels, while limiting the modifications to optical transport and encryption and complying with relevant standards. This effort is intended to lay the foundation for large-scale quantum network deployments.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
Abstract Current quantum key distribution (QKD) networks focus almost exclusively on transporting secret keys at the highest possible rate. Consequently, they are built as mostly fixed, ad hoc, logically, and physically isolated infrastructures designed to avoid any penalty to the quantum channel. This architecture is neither scalable nor cost-effective and future, real-world deployments will differ considerably. The structure of the MadQCI QKD network presented here is based on disaggregated components and modern paradigms especially designed for flexibility, upgradability, and facilitating the integration of QKD in the security and telecommunications-networks ecosystem. These underlying ideas have been tested by deploying many QKD systems from several manufacturers in a real-world, multi-tenant telecommunications network, installed in production facilities and sharing the infrastructure with commercial traffic. Different technologies have been used in different links to address the variety of situations and needs that arise in real networks, exploring a wide range of possibilities. Finally, a set of realistic use cases has been implemented to demonstrate the validity and performance of the network. The testing took place during a period close to three years, where most of the nodes were continuously active.
Software Defined Networking is increasingly seen as one of the best choices to create a Quantum Key Distribution (QKD) Network, especially if the aim is also its integration into a standard telecommunications network. The degree of flexibility afforded by this paradigm allows the creation of a network whose control mechanisms can be made aware simultaneously of the capabilities installed at the classical optical transport level as well as those at the quantum level. This is interesting not only to manage the coexistence between a classical and a quantum network sharing the same infrastructure, but also for future applications beyond QKD. This flexibility is due to a formal separation between the control and data forwarding planes. The logically centralized SDN controller gathers all relevant information monitoring the behavior of the hole network. It can act on the programmable quantum or classical devices opening many possibilities to share a common infrastructure, that can reach even the level of a single fiber strand to manage the signals that go through it in a compatible way. The same controller can use this information to manage the fundamental task of a QKD network, namely the key transport. Here we briefly report on the implementation of the SDN-QKD controller used in the Madrid testbed and its use to allow multi-vendor end-to-end key transport between any two nodes in the network.
Classical network infrastructure -- spanning enterprise TCP/IP backbones, metropolitan optical networks, and wide-area internet exchange points -- was designed without native provisions for quantum cryptographic channels. Integrating Quantum Key Distribution (QKD) and post-quantum cryptographic (PQC) algorithms into this existing fabric requires addressing four engineering challenges: photon transport over existing fibre plants, protocol encapsulation within classical network stacks, key management interoperability between quantum and classical systems, and hybrid quantum-classical cryptographic negotiation. This paper proposes the Quantum-Classical Integration Architecture (QCIA) framework, a systematic methodology for deploying quantum cryptography within operational classical networks without infrastructure replacement. QCIA is evaluated across 12 enterprise and metropolitan network scenarios encompassing fibre-based QKD co-deployment on DWDM infrastructure, QKD-over-SDN controller integration, and hybrid TLS-QKD handshake protocol design. Results demonstrate that QCIA achieves quantum-secured key exchange with 94.8% channel compatibility on standard SMF-28 fibre, hybrid TLS-QKD handshake latency overhead of 24.6 ms, and a Quantum Integration Readiness Score (QIRS) of 0.882 across evaluated scenarios. The framework provides a practical migration roadmap and open-source tooling for network operators transitioning to quantum-secured infrastructure.
Quantum key distribution (QKD) is a physical technology that enables the secure generation of bit streams (keys) in two separated locations. This technology is designed to provide a solution for very secure (quantum-safe) key agreement, which is nowadays at risk due to advances in quantum computing. The recent demonstration of a QKD network in the metropolitan area of Madrid shows how these networks can be deployed in current production infrastructure by following existing networking paradigms, such as software-defined networking. In particular, a three-node QKD network is implemented on the metropolitan area network using existing infrastructure and coexisting with other data and control services. On the other hand, telecommunication networks are drastically changing the way services are architectured. Users of the operator’s infrastructure are moving from traditional connectivity services (e.g., virtual private networks) to a set of interconnected network functions, either physical or virtual, in the shape of service function chaining (SFC). However, SFC users do not have a method to validate that the traffic flow is appropriately forwarded across the nodes in the network, a situation that may lead to very critical security breaches (e.g., a security node or a firewall in the chain that is bypassed). This work presents a method for validating ordered proof-of-transit (OPoT) on top of the Madrid Quantum Network. We first provide a general description of the QKD network deployed in Madrid. Then, we describe an existing security protocol for PoT in packet networks, analyzing its issues and vulnerabilities. Finally, this work presents a protocol for alleviating the security breach found in this work and for providing OPoT in SFC. Finally, an example of the real implementation is shown, where nodes being part of the OPoT scheme are provisioned with QKD-derived keys.