The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
Quantum Key Distribution (QKD) has progressed from a theoretical cryptographic concept to an emerging secure communication infrastructure technology. While early work focused on protocol security and physical-layer feasibility, current research increasingly addresses scalable network deployment, hardware acceleration, and integration with classical communication systems. As QKD expands from point-to-point links to metropolitan, backbone, and hybrid satellite–terrestrial networks, new engineering challenges arise in topology design, entropy generation, real-time key distillation, and multi-vendor interoperability. This survey provides an infrastructure-oriented review of QKD networks, examining architectural models, quantum randomness as a root of trust, FPGA and system-on-chip (SoC) based acceleration techniques, and programmable control-plane integration. Key management system architectures and standardized interfaces are analyzed to highlight their roles in enabling scalable, interoperable deployments. The paper also synthesizes major standardization efforts and deployment initiatives shaping carrier-grade QKD infrastructures. Finally, open engineering challenges, including scalability, control-plane integration, certification harmonization, and hybridization with post-quantum cryptography, are identified, positioning QKD as a foundational component of next-generation secure communication systems.
Quantum Key Distribution (QKD) constitutes one of the most profound practical applications of quantum mechanics, enabling two parties to exchange cryptographic keys whose security is guaranteed by the fundamental laws of physics rather than the assumed computational hardness of mathematical problems. As quantum computing capabilities continue to advance, classical public-key infrastructure faces an existential threat, rendering QKD a critical component of post-quantum secure communication architectures. This paper presents a comprehensive survey of QKD spanning foundational protocols, rigorous security proofs, hardware implementation challenges, deployment experiences across metropolitan fiber networks, and recent satellite-based experiments. We analyze the BB84, E91, B92, SARG04, continuous-variable, measurement-device-independent (MDI-QKD), and twin-field (TF-QKD) protocols in depth, examining their security assumptions, achievable key rates, and practical limitations. Particular attention is given to side-channel vulnerabilities in realistic implementations, decoy-state methods for mitigating photon-number-splitting attacks, and finite-key security analysis. We review key performance benchmarks from commercial systems and discuss integration with classical network infrastructure. The paper concludes by identifying open challenges in quantum repeater development, satellite QKD scalability, and standardization efforts essential for large-scale deployment.
Quantum computing poses a threat to the standard cryptographic primitives and requires the implementation of quantum-safe designs in the existing network infrastructures. Quantum Key Distribution (QKD) has been used to provide information-theoretic security but its compatibility with high capacity wavelength-division multiplexing (WDM) systems is a challenge to its deployment in metropolitan networks. In this paper, the architectural design and outcomes of a field trial assessing the concept of co-propagation of quantum and classical signals in a dense WDM metro environment are introduced. We discuss and measure the performance of multi-span fibres and measure quantum bit error rates in the presence of highlypower classical loading and the stability of the end-to-end key generation. A hybrid architecture that incorporates both QKD and classical post-quantum solutions is introduced to make them more resilient, optimized in terms of spectrum usage, and scalable to operator-grade services. The experimental findings show that QKD can be smoothly incorporated into the metro networks without affecting throughput and latency, indicating a way forward to practical quantum safe communications to future critical infrastructures.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
A multi-vendor, multi-domain Quantum Key Distribution network comprising 15 nodes across three independently managed domains was deployed and operated during QCI Days 2025 in Athens. The large-scale field trial integrated heterogenous QKD technologies, multi-layer Key Management Systems, and SDN-controlled infrastructures into a unified inter-domain architecture enabling cross-domain key exchange and coordination. The setup combined in-rack domain nodes extended to a 4-node field-deployed metropolitan QKD network segment, providing a realistic operational environment for validating end-to-end functionality. Multiple QKD-enabled services were successfully supported across the federated infrastructure, proving the technical feasibility and viability of scalable QKD deployments in inter-domain settings.
Quantum Key Distribution (QKD) enables information-theoretically secure cryptographic key exchange by exploiting quantum mechanical properties -- photon polarisation, entanglement, and the no-cloning theorem -- to detect any eavesdropping attempt. Scaling QKD from point-to-point laboratory demonstrations to large-scale metropolitan and wide-area networks requires addressing three engineering challenges: photon loss over long fibre distances (limiting practical QKD to ~100-150 km without quantum repeaters), network topology design for multi-party key delivery, and integration of QKD with classical network infrastructure. This paper proposes the Quantum Key Distribution Network Architecture (QKDNA) framework, a systematic evaluation of five QKD protocol families (BB84, E91, MDI-QKD, Twin-Field QKD, and CV-QKD) across four network topology models (star, ring, mesh, and hierarchical trusted-node) on 16 real-world metropolitan network scenarios. QKDNA achieves maximum secure key rate of 18.4 Mbps (Twin-Field QKD, 80 km fibre, mesh topology) and demonstrates scalable QKD delivery to 48 simultaneous users. The framework contributes a Network QKD Deployment Index (NQDI) and quantitative guidance for national quantum network infrastructure planning.