arXiv:2503.21186 · Journal of Optical Communications and Networking
DemoQuanDT: a carrier-grade QKD network
Peter Horoschenkoff, Johanna Henrich, R. Böhn, I. Khan, Jasper Rödiger, Matthias Gunkel, M. Bauch, J. Benda, P. Bläcker, Emanuel Eichhammer, Ulrich Eismann, G. Frenck, Helmut Grießer, W. Jontofsohn, N. Kopshoff, Stefan Röhrich, Fabian Seidl, N. Schark, Emmeran Sollner, D. von Blanckenburg, A. Heinemann, Martin Stiemerling, M. Gärtner
Quantum key distribution networks (QKDNs) enable secure communication even in the age of powerful quantum computers. In the hands of a network operator, which can offer its service to many users, the economic viability of a QKDN increases significantly. The highly challenging operator–user relationship in a large-scale network setting demands additional requirements to ensure carrier-grade operation. Addressing this challenge, this work presents a carrier-grade QKDN architecture, which combines the functional QKDN architecture with the operational perspective of a network operator, ultimately enhancing the economic viability of QKDNs. The focus is on the network and key management aspects of a QKDN while assuming state-of-the-art commercial QKD modules. The presented architecture was rolled out within an in-field demonstrator, connecting the cities of Berlin and Bonn over a link distance of 923 km across Germany. We could show that the proposed network architecture is feasible, integrable, and scalable, making it suitable for deployment in real-world networks. Overall, the presented carrier-grade QKDN architecture promises to serve as a blueprint for network operators providing QKD-based services to their customers.
Quantum key distribution networks (QKDNs) enable secure communication even in the age of powerful quantum computers. In the hands of a network operator, which can offer its service to many users, the economic viability of a QKDN increases significantly. The highly challenging operator–user relationship in a large-scale network setting demands additional requirements to ensure carrier-grade operation. Addressing this challenge, this work presents a carrier-grade QKDN architecture, which combines the functional QKDN architecture with the operational perspective of a network operator, ultimately enhancing the economic viability of QKDNs. The focus is on the network and key management aspects of a QKDN while assuming state-of-the-art commercial QKD modules. The presented architecture was rolled out within an in-field demonstrator, connecting the cities of Berlin and Bonn over a link distance of 923 km across Germany. We could show that the proposed network architecture is feasible, integrable, and scalable, making it suitable for deployment in real-world networks. Overall, the presented carrier-grade QKDN architecture promises to serve as a blueprint for network operators providing QKD-based services to their customers.
Quantum Key Distribution technology is evaluated for carrier-grade provider networks in the Berlin OpenQKD testbed, which is operated by Deutsche Telekom. It includes the investigation of modular architectures, standardized interfaces and layered network structures containing quantum, key management, and application layers as well as hybrid technologies, consisting of Quantum Key Distribution and Post-Quantum Cryptography. The testbed incorporates field-installed wireline fiber links together with wireless radio connections, enabling carrier-grade use cases and proof of concepts under real telecommunication operating environments for various scenarios of layer interworking, vendor agnostic networking, and quantum security for network as well as end-to-end user applications.
Quantum Key Distribution (QKD) has progressed from a theoretical cryptographic concept to an emerging secure communication infrastructure technology. While early work focused on protocol security and physical-layer feasibility, current research increasingly addresses scalable network deployment, hardware acceleration, and integration with classical communication systems. As QKD expands from point-to-point links to metropolitan, backbone, and hybrid satellite–terrestrial networks, new engineering challenges arise in topology design, entropy generation, real-time key distillation, and multi-vendor interoperability. This survey provides an infrastructure-oriented review of QKD networks, examining architectural models, quantum randomness as a root of trust, FPGA and system-on-chip (SoC) based acceleration techniques, and programmable control-plane integration. Key management system architectures and standardized interfaces are analyzed to highlight their roles in enabling scalable, interoperable deployments. The paper also synthesizes major standardization efforts and deployment initiatives shaping carrier-grade QKD infrastructures. Finally, open engineering challenges, including scalability, control-plane integration, certification harmonization, and hybridization with post-quantum cryptography, are identified, positioning QKD as a foundational component of next-generation secure communication systems.
Up to now, Quantum Key Distribution (QKD) Network architectures were confined to relatively small networks. Some theoretical and standardization work was carried out at the framework level but its real-world application is still to be proven. Here, we present a novel architecture for QKD Networks, which is based on the SDN approach, and the components needed to scale to large networks. A well-defined functionality of a minimal set of universal modules allows to define the flow of information among them, and this specifies their interfaces and the architecture. We show that this scheme allows to reuse many already proposed interface definitions requiring just minor adaptation and facilitating the real-world deployment. A QKD Network testbed demonstration following these principles is mentioned. We further elaborate on interfaces needed to scale to very large networks, enabling orchestrations of different types or network monitoring tools. The latter have not been considered in depth up to now, but are needed to support automation and advanced capabilities, multidomain networks, slicing, heterogeneity, resource discovery, etc., which will be necessary to scale to large networks. The dynamicity of the quantum level in this scheme allows a significant reduction of the need of QKD devices on the metropolitan scale, an increased robustness of the service, improving its quality and overall network management, showing that the presented architecture is highly appropriate for telecom operators.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
As a promising quantum application, Quantum Key Distribution (QKD) technology has been rapidly developed from point-to-point communication to a large-scale commercial network. However, considering the cost of QKD components and network infrastructure, building a QKD network is challenged by its expensive capital expenditure, which significantly hinders its future popularization. In this article, we envision an evolution roadmap consisting of three stages for the future development of QKD networks, aiming at achieving a fully integrated network architecture that combines QKD and telecommunications networks. Powered by several critical technologies, such as link multiplexing, miniaturized QKD, and transmission optimization, QKD is foreseen to be integrated into telecommunications networks as an add-on module that can be flexibly deployed. After that, we introduce the integrated network architecture design in detail, and respectively provide four QKD-related function implementations. At last, key technologies that should be concerned and further investigated are also discussed with performance evaluation, which can provide theoretical guidance for both industries and academia. Based on the proposed roadmap and integrated architecture, we believe a scalable, easy-to-use, and affordable QKD service can be brought to current telecommunication networks, and extensively applied by ordinary people while using daily applications.
Similar to the Internet, Quantum Key Distribution (QKD) networks typically have diverse participants, such as users, operators, and infrastructure builders. In order to achieve loose functional coupling, a multi-layer structure is frequently indispensable. Nevertheless, once the architecture of the QKD network is designed, further expansion and modification prove to be extremely challenging. To address this issue, a QKD network architecture based on virtual Quantum Key Distribution (VQKD) is proposed. In this architecture, all devices at both ends that are capable of providing consistent quantum keys are regarded as a pair of quantum key distribution devices. The bottom layer is real QKD, while all other layers are virtual QKD. All real and virtual QKDs provide quantum keys to the upper layers. This network structure is an iterative one, and theoretically, the number of layers in a quantum key distribution network can be infinitely increased based on actual needs. In this paper, we present a practical application case. This case addresses the actual needs of network operators, network service providers, and those involved in user network construction. We have designed a three-layer quantum secure communication network exchange structure that is suitable for network infrastructure developers, network operators, and those involved in user network construction. Network infrastructure developers, network operators, and users can carry out network construction, network operation, and user network construction at different network layers, realizing a loosely coupled hierarchical design of quantum secure communication networks. This model can dynamically increase or decrease the number of quantum network exchange layers based on actual needs, without affecting the network exchange of quantum secure communication networks, demonstrating strong versatility and adaptability.