Quantum Key Distribution (QKD) in optical networks can provide information-theoretic security but is limited by its operability range, thereby requiring repeater nodes for extended coverage. Existing works typically assume that all repeater nodes and their associated key management systems are fully trusted, overlooking the risks posed by software exploits and insider threats. To address this, in this work, we propose a Bayesian fusion-based model to quantify the trustworthiness of each node. We have formulated a reliability-guided Trusted Repeater Node (TRN) selection framework for metro optical networks, where each node is assigned a trust score. We have subsequently mapped this trust score to link weights, which in turn has been used for reliable path computation for TRN selection, using the Dijkstra algorithm. We have also ranked the nodes using a composite score combining eigenvector and betweenness centrality, to capture their topographical relevance in the network. Simulation results on a reference topology demonstrate that the proposed method achieves approximately 8.93% higher path coverage than traditional centrality-based approaches like degree centrality, using the same number (around ten) of TRNs, thereby supporting reliable and resilient TRN selection for QKD-enabled optical networks.
Quantum Key Distribution (QKD) in optical networks can provide information-theoretic security but is limited by its operability range, thereby requiring repeater nodes for extended coverage. Existing works typically assume that all repeater nodes and their associated key management systems are fully trusted, overlooking the risks posed by software exploits and insider threats. To address this, in this work, we propose a Bayesian fusion-based model to quantify the trustworthiness of each node. We have formulated a reliability-guided Trusted Repeater Node (TRN) selection framework for metro optical networks, where each node is assigned a trust score. We have subsequently mapped this trust score to link weights, which in turn has been used for reliable path computation for TRN selection, using the Dijkstra algorithm. We have also ranked the nodes using a composite score combining eigenvector and betweenness centrality, to capture their topographical relevance in the network. Simulation results on a reference topology demonstrate that the proposed method achieves approximately 8.93% higher path coverage than traditional centrality-based approaches like degree centrality, using the same number (around ten) of TRNs, thereby supporting reliable and resilient TRN selection for QKD-enabled optical networks.
Quantum Key Distribution (QKD) provides information-theoretic security, but is limited by distance in optical networks, thereby requiring repeater nodes to extend coverage. Existing works usually assume all repeater nodes and associated Key Management Servers (KMSs) to be Trusted Repeater Nodes (TRNs), while ignoring risks from software exploits and insider threats. In this paper, we propose a reliability-aware TRN placement framework for metro optical networks, which assigns each node a trust score and integrates it into the Dijkstra algorithm via weighted links. We then rank the nodes using a composite score, which is a weighted combination of betweenness centrality and eigenvector centrality to enable a secure and scalable TRN deployment. Simulation results on a reference topology show that our method covers 10.77% more shortest paths compared to traditional metrics like degree centrality, using the same number (around eight) of TRNs, making it suitable for TRN selection to maximize secure connectivity.
In this paper we explore how recent technologies can improve the security of optical networks. In particular, we study how to use quantum key distribution (QKD) in common optical network infrastructures and propose a method to overcome its distance limitations. QKD is the first technology offering information theoretic secret-key distribution that relies only on the fundamental principles of quantum physics. Point-to-point QKD devices have reached a mature industrial state; however, these devices are severely limited in distance, since signals at the quantum level (e.g., single photons) are highly affected by the losses in the communication channel and intermediate devices. To overcome this limitation, intermediate nodes (i.e., repeaters) are used. Both quantum-regime and trusted, classical repeaters have been proposed in the QKD literature, but only the latter can be implemented in practice. As a novelty, we propose here a new QKD network model based on the use of not fully trusted intermediate nodes, referred to as weakly trusted repeaters. This approach forces the attacker to simultaneously break several paths to get access to the exchanged key, thus improving significantly the security of the network. We formalize the model using network codes and provide real scenarios that allow users to exchange secure keys over metropolitan optical networks using only passive components. Moreover, the theoretical framework allows one to extend these scenarios not only to accommodate more complex trust constraints, but also to consider robustness and resiliency constraints on the network.
We study how to use quantum key distribution (QKD) in common optical network infrastructures and propose a method to overcome its distance limitations. QKD is the first technology offering information theoretic secret-key distribution that relies only on the fundamental principles of quantum physics. Point-to-point QKD devices have reached a mature industrial state; however, these devices are severely limited in distance, since signals at the quantum level (e.g. single photons) are highly affected by the losses in the communication channel and intermediate devices. To overcome this limitation, intermediate nodes (i.e. repeaters) are used. Both, quantum-regime and trusted, classical, repeaters have been proposed in the QKD literature, but only the latter can be implemented in practice. As a novelty, we propose here a new QKD network model based on the use of not fully trusted intermediate nodes, referred as weakly trusted repeaters. This approach forces the attacker to simultaneously break several paths to get access to the exchanged key, thus improving significantly the security of the network. We formalize the model using network codes and provide real scenarios that allow users to exchange secure keys over metropolitan optical networks using only passive components.
Quantum Key Distribution (QKD) offers provably secure, information-theoretic key exchange, but in long-distance scenarios without quantum repeaters, Trusted Nodes (TNs) are commonly employed despite introducing critical security risks. We propose a redundant key management method for QKD network that combines Twin Field QKD (TF-QKD) (or Measurement-Device Independent (MDI)-QKD) with a novel key-routing scheme to eliminate the need for truly trusted TNs. Quantum measurements are handled entirely within the network, minimizing end-user hardware requirements. Multiple QKD links connect intermediate nodes such that a successful attack requires the collusion of multiple adversarial nodes, greatly enhancing security over the traditional TN model. In this contribution, we discuss the tradeoff between security, key rates, and distances supported by the new method. Our analysis reveals that the improved redundant key management system may enable true end-to-end connectivity over several thousand kilometers while maintaining high security standards.
Increasing incidents of cyber attacks and evolution of quantum computing poses challenges to secure existing information and communication technologies infrastructure. In recent years, quantum key distribution (QKD) is being extensively researched, and is widely accepted as a promising technology to realize secure networks. Optical fiber networks carry a huge amount of information, and are widely deployed around the world in the backbone terrestrial, submarine, metro, and access networks. Thus, instead of using separate dark fibers for quantum communication, integration of QKD with the existing classical optical networks has been proposed as a cost-efficient solution, however, this integration introduces new research challenges. In this paper, we do a comprehensive survey of the state-of-the-art QKD secured optical networks, which is going to shape communication networks in the coming decades. We elucidate the methods and protocols used in QKD secured optical networks, and describe the process of key establishment. Various methods proposed in the literature to address the networking challenges in QKD secured optical networks, specifically, routing, wavelength and time-slot allocation (RWTA), resiliency, trusted repeater node (TRN) placement, QKD for multicast service, and quantum key recycling are described and compared in detail. This survey begins with the introduction to QKD and its advantages over conventional encryption methods. Thereafter, an overview of QKD is given including quantum bits, basic QKD system, QKD schemes and protocol families along with the detailed description of QKD process based on the Bennett and Brassard-84 (BB84) protocol as it is the most widely used QKD protocol in the literature. QKD system are also prone to some specific types of attacks, hence, we describe the types of quantum hacking attacks on the QKD system along with the methods used to prevent them. Subsequently, the process of point-to-point mechanism of QKD over an optical fiber link is described in detail using the BB84 protocol. Different architectures of QKD secured optical networks are described next. Finally, major findings from this comprehensive survey are summarized with highlighting open issues and challenges in QKD secured optical networks.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.