arXiv:2604.20376 · IEEE Transactions on Quantum Engineering
Interconnecting Regional QKD Networks: Hybrid Key Delivery Across Quantum Domains
David Barral, Aitor Brazaola-Vicario, Diego Cifrián, Natalia Costas, Gonzalo Blázquez Gil, Ana Fernández Vilas, Iago F. Llovo, Pedro Otero-García, Pablo Pío Rejo, Alejandra Ruíz, Juan Villasuso, Manuel Fernández‐Veiga
QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.
QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.
The global Internet appears to users as a unified, seamless infrastructure, but in reality, it is composed of multiple interconnected networks: separate domains with different management and policies. This unified behavior is made possible by complexity-hiding mechanisms and inter-domain coordination protocols, which are critical components of modern networking. As we approach a paradigm shift driven by quantum technologies, new challenges and opportunities emerge. Quantum information processing enables capabilities that classical systems cannot achieve, including the potential to compromise public key infrastructures that support today’s network security. Quantum key distribution (QKD) offers a promising avenue by implementing a key agreement protocol that is information-theoretically secure against computational attack. However, to fully leverage QKD, networks must be adapted to the unique constraints of quantum communication, integrating both quantum bit transmission and secure key distribution across multiple domains. This paper discusses the interconnection of quantum key distribution networks (QKDNs) and presents a distributed, standards-aligned orchestration mechanism designed to manage QKD networks spanning multiple administrative domains. Our solution builds on existing QKDN standards to facilitate interoperability and practical deployment in heterogeneous environments and has been validated on a heterogeneous multi-domain network comprising three interconnected autonomous domains.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The importance of quantum-key-distribution (QKD) networks is growing rapidly, not only because the underlying QKD protocol is immune against any (known or unknown) attacks but also as these infrastructures can be operated in a hybrid mode, together with emerging quantum safe, or post quantum cryptography (PQC), public key protocols. Hybrid solutions appear to be the most promising remedy against real-world security risks, posed by prospective quantum computers. Simultaneously, telecommunication operators are embracing novel network paradigms, such as software-defined networking (SDN), due to distinct advantages over traditional approaches. SDN-inspired architectures can also be used for QKD and hybrid QKD-PQC networks. These architectures allow a seamless integration of QKD and hybrid QKD-PQC into production networks, significantly increasing the security of the latter. However, there has only been very limited research on optimal strategies for establishing hybrid connectivity across different organizational domains. The present contribution introduces two methods on interconnecting different technological and administrative domains for such networks. The proposed scheme is QKD-vendor independent and relies heavily on standard and open interfaces. It enables a complete end-to-end communication between applications running on nodes in different domains. It can be used for the secure interconnection of different SDN-based telecommunication domains with additional QKD / hybrid protection and has been tested within the Madrid Quantum-Communication Infrastructure.
The European Quantum Communication Infrastructure (EuroQCI) initiative is fostering the deployment of national quantum key distribution (QKD) testbeds across the European Union. In this context, we report on the design, implementation, and evaluation of the Austrian testbed, with a particular focus on advances in key management and applicationlevel integration of QKD. First, we introduce a hybrid key management system (KMS) that combines QKD-derived keys in a decentralized architecture with post-quantum authenticated key exchange, enabling end-to-end hybrid keys while reducing trust assumptions in intermediate nodes. Second, we present three QKD-enabled applications: (i) a secure secret-sharing-based storage system leveraging QKD-protected share distribution, (ii) a QKD-integrated extension of Jitsi employing ETSI GS QKD 014 group keys to reduce overhead in multi-party communication, and (iii) a hybrid QKD/PQC WireGuard-based VPN enabling QKD-secured HSM backup operations without requiring modifications to proprietary HSM protocols. Finally, we describe the deployment of these solutions in a national network comprising a four-node metropolitan testbed and a 200 km long-distance link with trusted nodes, and provide performance measurements for both the network and the hybrid KMS. Together, these results demonstrate the feasibility of integrating QKD into heterogeneous applications and hybrid cryptographic infrastructures.
The increasing reliance on optical communication networks for high-speed data transmission has amplified concerns regarding secure information exchange in the era of quantum computing. Classical cryptographic protocols such as RSA and ECC, though widely deployed, are vulnerable to attacks from large-scale quantum computers executing Shor�s algorithm. Quantum Key Distribution (QKD) has emerged as a revolutionary cryptographic paradigm that leverages the principles of quantum mechanics to enable theoretically unbreakable key exchange. This paper investigates the integration of QKD into optical communication networks, focusing on protocol design, implementation challenges, and potential scalability. Through scenario-based evaluation, the study highlights the trade-offs between quantum security and practical deployment constraints such as channel loss, photon detector efficiency, and key generation rates. Results from simulated models demonstrate that while QKD can achieve provable security in metropolitan-area networks, long-distance transmission requires advanced techniques such as quantum repeaters and trusted nodes. This work concludes that QKD offers a promising pathway toward quantum-safe communication but necessitates advancements in hardware, standardization, and hybrid cryptographic strategies for widespread adoption.