Quantum Key Distribution (QKD) offers information-theoretic security by leveraging quantum mechanics, yet the cost and complexity of dedicated hardware and fiber infrastructure have so far limited large-scale deployment and experimentation. In this paper, we introduce Quditto, an automated open-access emulation platform that combines high-fidelity quantum-channel modeling with a standardized key-delivery API, enabling users to interact with the emulated network exactly as they would with real QKD hardware. Quditto modular design supports pluggable protocol implementations, complex key management schemes and detailed channel models, including variable attenuation and decoherence. We validate Quditto by deploying networks of various sizes and demonstrate its flexibility through two proof-of-concept scenarios featuring eavesdropper attacks and heterogeneous channel conditions.
Journal reference
B. Lopez, A. Diaz-Bricio, J. Perez, I. Vidal and F. Valera, "Quditto: Emulating and Orchestrating Distributed QKD Network Deployments," in IEEE Network 2026
Quantum Key Distribution (QKD) offers information-theoretic security by leveraging quantum mechanics, yet the cost and complexity of dedicated hardware and fiber infrastructure have so far limited large-scale deployment and experimentation. In this paper, we introduce Quditto, an automated open-access emulation platform that combines high-fidelity quantum-channel modeling with a standardized key-delivery API, enabling users to interact with the emulated network exactly as they would with real QKD hardware. Quditto modular design supports pluggable protocol implementations, complex key management schemes and detailed channel models, including variable attenuation and decoherence. We validate Quditto by deploying networks of various sizes and demonstrate its flexibility through two proof-of-concept scenarios featuring eavesdropper attacks and heterogeneous channel conditions.
The ongoing transition toward quantum-safe networking has motivated the development of hybrid network architectures integrating Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC). However, the experimental evaluation of hybrid QKD-PQC network architectures remains constrained by the high cost and limited accessibility of quantum hardware, as well as by the limited support for hybrid QKD-PQC networks in existing emulation platforms. Quditto is an open-source emulation platform originally designed for QKD networks that enables cost-effective and reproducible experimentation without requiring dedicated physical quantum infrastructure. Building on this foundation, this work presents Quditto as a hybrid QKD-PQC network emulation platform featuring automated and scalable cloud-native orchestration. The proposed platform introduces four principal contributions: a cloud-native orchestrator enabling fully automated infrastructure deployment across cloud and multi-cluster environments; an optimized provisioning workflow enabling large-scale quantum-safe network emulation; native integration of post-quantum nodes enabling unified emulation of hybrid QKD-PQC networks; and a secure key management module providing persistent and access-controlled storage of cryptographic material. Experimental validation demonstrates sublinear orchestration-time scaling with network size and successful end-to-end hybrid QKD-PQC key establishment on a representative spine-leaf deployment, thereby enabling the systematic evaluation of quantum-safe networking mechanisms in large-scale heterogeneous network environments.
The global Internet appears to users as a unified, seamless infrastructure, but in reality, it is composed of multiple interconnected networks: separate domains with different management and policies. This unified behavior is made possible by complexity-hiding mechanisms and inter-domain coordination protocols, which are critical components of modern networking. As we approach a paradigm shift driven by quantum technologies, new challenges and opportunities emerge. Quantum information processing enables capabilities that classical systems cannot achieve, including the potential to compromise public key infrastructures that support today’s network security. Quantum key distribution (QKD) offers a promising avenue by implementing a key agreement protocol that is information-theoretically secure against computational attack. However, to fully leverage QKD, networks must be adapted to the unique constraints of quantum communication, integrating both quantum bit transmission and secure key distribution across multiple domains. This paper discusses the interconnection of quantum key distribution networks (QKDNs) and presents a distributed, standards-aligned orchestration mechanism designed to manage QKD networks spanning multiple administrative domains. Our solution builds on existing QKDN standards to facilitate interoperability and practical deployment in heterogeneous environments and has been validated on a heterogeneous multi-domain network comprising three interconnected autonomous domains.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
Quantum Key Distribution (QKD) enables secure key exchange by leveraging quantum mechanics to provide theoretically unbreakable security. However, practical deployment of QKD networks is limited due to high costs, lack of interoperability of existing commercial products, and complex physical requirements. To address these challenges, digital twins of QKD networks provide an accessible and adaptable solution for testing and experimentation in emulated environments. This work presents the design of a digital twin model that emulates a QKD network under eavesdropping, allowing for realistic analysis of network behavior in the presence of security threats. As an initial stage, an emulation service of a QKD link with an eavesdropper has been implemented using the NetSquid simulator, offering a practical tool for testing QKD security. This model offers a versatile framework that can be adapted for use in different platforms and applications, providing not only a means to understand this threat and assess countermeasure effectiveness but also a method to analyze how attacks impact exchanged keys and the timing of key distribution.
As the limitations of classical cryptographic systems become increasingly evident in the face of advancing quantum algorithms, Quantum Key Distribution (QKD) emerges as a vital paradigm for securing information in next-generation networks. This paper explores the theoretical foundations and protocol architectures underpinning QKD, including BB84, E91, and newer hybrid approaches designed for scalable integration into existing infrastructures. Performance metrics such as key generation rate, error thresholds, and resistance to various attack models are critically examined across both fiber-optic and free-space implementations. Furthermore, the study delves into real-world deployment challenges—ranging from synchronization errors and quantum channel noise to cost-efficiency and interoperability with classical systems. By offering a comparative analysis and proposing optimization strategies, this work aims to pave the way for robust quantum-secure communication protocols suited for large-scale, heterogeneous network environments.
Quantum technologies promise major advances in different areas. From computation to sensing or telecommunications, quantum implementations could bring significant improvements to these fields, arousing the interest of researchers, companies, and governments. In particular, the deployment of Quantum Key Distribution (QKD) networks, which enable the secure dissemination of cryptographic keys to remote application entities following Quantum Mechanics Principles, appears to be one of the most attractive and relevant use cases. Quantum devices and equipment are still in a development phase, making their availability low and their price high, hindering the deployment of physical QKD networks and, therefore, the research and experimentation activities related to this field. In this context, this paper focuses on providing research stakeholders with an open-access testbed where it is feasible to emulate the deployment of QKD networks, thus enabling the execution of experiments and trials, where even potential network attacks can be analyzed, without the quantum physical equipment requirement, nor compromising the integrity of an already built QKD network. The designed solution allows users to automatically deploy, configure, and run a digital twin environment of a QKD network, offering cost-effectiveness and great flexibility in the study of the integration of quantum communications in the current network infrastructures. This solution is aligned with the European Telecommunications Standard Institute (ETSI) standardized application interface for QKD, and is built upon open-source technologies. The feasibility of this solution has been validated throughout several functional trials carried out in the 5G Telefónica Open Network Innovation Centre (5TONIC), verifying the service performance in terms of speed and discarded qubits when generating the quantum keys.