Optical Fiber Communication Conference

VPN Service Provisioning via Virtual Router Deployment and Quantum Key Distribution

Alejandro Aguado, Vı́ctor López, Jesús Martínez-Mateo, Momtchil Peev, Diego R. Lopez, Vicente Martín

Published Jan 1, 2018• 7 citations

Abstract

Here we demonstrate, for the first time, VPN services integrated within a virtual router using QKD to perform encryption and authentication. Any management operation is also secured using QKD, providing a whole quantum-safe ecosystem.

DOI: 10.1364/ofc.2018.th2a.32

Related papers

Applying QKD to improve next-generation network infrastructures

Vı́ctor López, Antonio Pastor, Diego R. Lopez +2 more

There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.

European Conference on Networks and CommunicationsJun 1, 201922 citations

VPN Protection with QKD-Derived Keys Using Standard Interfaces

Jaime S. Buruaga, Hans H. Brunner, Fred Fung +6 more

Quantum Key Distribution is a mechanism for obtaining a symmetric key that has been proved to be completely secure against quantum attacks. However, QKD technology is highly dependent on the low level implementation of the vendor. This work proposes the use of QKD-derived key material using high level standard interfaces to transparently protect services based on extending the protection of Virtual Private Networks to possible attacks based on quantum computing.

International Conference on Transparent Optical NetworksJul 2, 20232 citations

Virtual Network Function Deployment and Service Automation to Provide End-to-End Quantum Encryption

Alejandro Aguado, Vı́ctor López, Jesús Martínez-Mateo +3 more

The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.

Journal of Optical Communications and NetworkingMar 28, 201844 citations

Security Provisioning in Quantum Key Distribution-Secured Optical Networks

Shifeng Ding, Chun-Kit Chan

We consider the security of quantum keys and encrypted data in QKD-secured optical networks. A security framework integrating a multi-path multi-protocol (2MP) service provisioning scheme is proposed to enhance network security and reduce network costs.

Asia Communications and Photonics ConferenceNov 4, 20230 citations

100 Gbps Quantum-safe IPsec VPN Tunnels over 46 km Deployed Fiber

Obada Alia, Huang, Albert, Huan Luo +3 more

We demonstrated for the first time quantum-safe high-speed 100 Gbps site-to-site IPsec tunnels secured using Quantum Key Distribution (QKD) technology. The demonstration was conducted between two JPMorgan Chase Data Centers (DCs) in an air-gapped environment over 46 km of deployed telecom fiber across Singapore achieving 45 days of continuous operation. Two different Virtual Private Network (VPN) tunnel configurations were tested: (1) a QKD-secured VPN tunnel configuration with a maximum throughput of 80 Gbps and (2) a multi-VPN tunnel configuration exhibiting 12 QKD-secured VPN tunnels with a throughput of 8.39 Gbps per tunnel resulting in an aggregated throughput of 99.62 Gbps for all tunnels. For the QKD system performance, we achieved an average Secret Key Rate (SKR) of 7.4 kbps (about 29 AES-256 keys per second), an average Quantum Bit Error Rate (QBER) of 0.8% and an average visibility of 98.6%. We utilized the ETSI-QKD-014 REST-based Application Programming Interface (API) to exchange the QKD generated keys between the key management server in the QKD system and the next-generation firewalls in order to encrypt and decrypt the data. The data was encrypted by the quantum-safe keys using the AES-256-GCM cipher suite with a key refresh rate of 120 seconds without affecting the VPN tunnel connectivity and performance

arXiv:2405.04415May 7, 20242 citations

Quantum Key Distribution and Optical Networking

P. Toliver, Thomas E. Chapuran, Robert J. Runser +11 more

Quantum key distribution offers a unique opportunity in securing next-generation optical networks. Recent advances in the integration of QKD within conventional DWDM network environments will be presented along with guidelines for practical system engineering.

Frontiers in OpticsJan 1, 20080 citations