Optics Express

Multi-tenant secret-key assignment over quantum key distribution networks

Yuan Cao, Yongli Zhao, Rui Lin, Xiaosong Yu, Jie Zhang, Jiajia Chen

Published Jan 28, 2019• 37 citations

Abstract

Quantum key distribution (QKD) networks are promising to progress towards widespread practical deployment over existing fiber infrastructures in the near future. Given the high cost and difficulty of deploying QKD networks, multi-tenancy becomes promising to improve cost efficiency for future QKD networks. In a multi-tenant QKD network, multiple QKD tenants can share the same QKD network infrastructure to obtain secret keys for securing their data transfer. Since the secret-key resources are finite and precious in QKD networks, how to achieve efficient multi-tenant secret-key assignment (MTKA) to satisfy the secret-key demands of multiple QKD tenants over QKD networks becomes a significant problem. In this regard, this study addresses the MTKA problem over QKD networks. A new multi-tenant QKD network architecture is proposed based on software defined networking (SDN) and quantum key pool (QKP) techniques. A secret-key rate sharing scheme is presented and a heuristic algorithm is designed to implement efficient MTKA over QKD networks. A new performance metric, namely matching degree (MD) that reflects the balance between QKD network secret-key resources and QKD tenant requests, is defined and evaluated. Simulation studies indicate that high QKD tenant requests accommodation and efficient secret-key resource usage can be achieved via maximizing the value of MD.

DOI: 10.1364/oe.27.002544

Related papers

Multi-tenant provisioning over software defined networking enabled metropolitan area quantum key distribution networks

Yuan Cao, Yongli Zhao, Xiaosong Yu +1 more

Quantum key distribution (QKD) has potential to provide long-term security for communications across the Internet. As security-hungry applications dramatically rise nowadays, a growing number of QKD networks are promising to be deployed in the immediate future. Nevertheless, a high-security-demand institution (e.g., a bank) needs to pay a high price to deploy its dedicated QKD network, while a cost-effective way of overcoming this challenge is to make multiple tenants share a QKD network. Each tenant represents a high-security-demand institution and can obtain secret keys on demand from the QKD network infrastructure for security purposes. Hence, how to achieve efficient and flexible multi-tenant provisioning over a QKD network becomes a crucial problem. This work introduces software defined networking (SDN) to address this problem. We experimentally demonstrate multi-tenant provisioning (including tenant establishment, adjustment, and deletion) over SDN-enabled metropolitan area QKD networks. A SDN-enabled metropolitan area QKD network architecture is introduced. We present a workflow, protocol extensions, and an on-demand secret-key resource allocation strategy for multi-tenant provisioning, which are all demonstrated by establishing an experimental testbed in the lab. Experimental results verify the effectiveness and flexibility of our SDN-based approaches for multi-tenant provisioning over metropolitan area QKD networks. Moreover, we conduct the simulation and discover the ways of improving the success probability of multi-tenant provisioning over metropolitan area QKD networks.

Journal of the Optical Society of America BJan 14, 201923 citations

Multi-Tenant Provisioning for Quantum Key Distribution Networks With Heuristics and Reinforcement Learning: A Comparative Study

Yuan Cao, Yongli Zhao, Jun Li +3 more

Quantum key distribution (QKD) networks are potential to be widely deployed in the immediate future to provide long-term security for data communications. Given the high price and complexity, multi-tenancy has become a cost-effective pattern for QKD network operations. In this work, we concentrate on addressing the online multi-tenant provisioning (On-MTP) problem for QKD networks, where multiple tenant requests (TRs) arrive dynamically. On-MTP involves scheduling multiple TRs and assigning non-reusable secret keys derived from a QKD network to multiple TRs, where each TR can be regarded as a high-security-demand organization with the dedicated secret-key demand. The quantum key pools (QKPs) are constructed over QKD network infrastructure to improve management efficiency for secret keys. We model the secret-key resources for QKPs and the secret-key demands of TRs using distinct images. To realize efficient On-MTP, we perform a comparative study of heuristics and reinforcement learning (RL) based On-MTP solutions, where three heuristics (i.e., random, fit, and best-fit based On-MTP algorithms) are presented and a RL framework is introduced to realize automatic training of an On-MTP algorithm. The comparative results indicate that with sufficient training iterations the RL-based On-MTP algorithm significantly outperforms the presented heuristics in terms of tenant-request blocking probability and secret-key resource utilization.

IEEE Transactions on Network and Service ManagementJan 7, 202053 citations

SDQaaS: software defined networking for quantum key distribution as a service

Yuan Cao, Yongli Zhao, Jianquan Wang +3 more

Quantum key distribution (QKD) holds the potential of providing long-term integrity and confidentiality for data and communications. Currently, many fiber-based QKD systems have been commercialized and several QKD networks have been deployed. Given the high cost and complexity of QKD network deployment, QKD as a service (QaaS) becomes a promising pattern for future QKD networks. The QaaS concept is that multiple users can apply for QKD services to obtain their required secret-key rates (SKRs) from the same QKD network infrastructure instead of deploying their dedicated QKD networks. Accordingly, how to provide efficient and flexible QaaS for fulfilling the SKR requirements of multiple users over a QKD network infrastructure becomes a new challenge. This study introduces the software defined networking (SDN) technique to overcome this challenge, since SDN can add flexibility together with efficient QKD network management. A new framework of SDN for QaaS (SDQaaS) is proposed, where the QaaS functions are developed in the SDN controller. We present the protocol extension, intercommunication workflow, and routing and SKR assignment strategy for QaaS implementation in the SDQaaS framework. We also establish a SDQaaS experimental testbed and perform the numerical simulation to verify our presented approaches. Experimental results demonstrate that our presented approaches can achieve efficient and flexible QaaS over the QKD network. Moreover, simulation results indicate that the success probability of QKD service requests can be increased via lowering the flexibility of SKR requirements for QKD service creation, sacrificing more cost to produce higher SKR over the QKD network, or gradually reducing SKR requirements with the modification of QKD service.

Optics ExpressFeb 25, 201949 citations

Reinforcement Learning Based Multi-Tenant Secret-Key Assignment for Quantum Key Distribution Networks

Yuan Cao, Yongli Zhao, Jun Li +3 more

We propose a reinforcement learning based online multi-tenant secret-key assignment algorithm for quantum key distribution networks, capable of reducing tenant-request blocking probability more than half compared to the benchmark heuristics.

Optical Fiber Communication ConferenceJan 1, 20199 citations

Designing optimal Quantum Key Distribution Networks based on Time-Division Multiplexing of QKD transceivers: qTDM-QKDN REVISAR

Juan Carlos Hernandez-Hernandez, David Larrabeiti López, María Carmen Calderón Pastor +4 more

Time-sharing of Quantum Key Distribution (QKD) transceivers with the help of optical switches and a central Software-Defined Networking (SDN) controller is a promising technique to better amortize the large investments required to build a Quantum Key Distribution Network (QKDN). In this work, we investigate the implications of introducing Time-Division Multiplexing (TDM) in trusted-relay QKDNs at the wide-area network scale in terms of performance and cost-saving. To this end, we developed both a Mixed Integer Linear Programming (qTDM-MILP) model and a Heuristic Algorithm (qTDM-HA) to solve the allocation of QKD transceivers and network resources for a novel switched QKDN operating scheme: qTDM-QKDN. Our heuristic method provides a close-to-optimal resource planning for the offline problem that computes the minimum number of QKD transceivers and optical switch ports at each node, as well as the number of quantum channels on each link required to satisfy a target set of end-to-end secret-keyrate demands. Moreover, both the model and the heuristic provide the time fractions that each QKD transceiver needs to peer with each neighbor QKD transceiver. We compared our proposed model and heuristic algorithm for cost minimization with non-time sharing QKD transceivers (nTDM) as baseline. The results show that qTDM can achieve substantial cost-savings in the range of 10%-40% compared to nTDM. Furthermore, this work sheds light on the selection of the value for the working cycle T and its influence on network performance.

Mar 1, 20250 citations

KaaS: Key as a Service over Quantum Key Distribution Integrated Optical Networks

Yuan Cao, Yongli Zhao, Jianquan Wang +3 more

In the Internet Age, optical networks are vulnerable to numerous cyberattacks, and conventional key distribution methods suffer from the increased computational power. QKD can distribute information-theoretically secure secret keys between two parties based on the principles of quantum mechanics. Integrating QKD into optical networks can leverage existing fiber infrastructures with wavelength division multiplexing for the practical deployment of secret keys, and accordingly employ the secret keys for optical-layer security enhancement. Then, how to efficiently deploy and employ secret keys over QKD-integrated optical networks are emerging as two challenges. This article proposes a framework of key as a service (KaaS, i.e., providing secret keys as a service in a timely and accurate manner to satisfy the security requirements) to jointly overcome these two challenges. To enable the typical functions (i.e., secret-key deployment and employment) in KaaS, two secret-key virtualization steps, that is, key pool (KP) assembly and virtual key pool (VKP) assembly, are introduced. Also, we illustrate a new QKD-integrated optical network architecture from a holistic view, where the control layer is implemented by software defined networking for efficient network management. A time-shared KP assembly strategy and an on-demand VKP assembly strategy are presented for KaaS implementation. The success probabilities of KP assembly and VKP assembly are defined to evaluate the benefits of KaaS for efficiently deploying and employing secret keys as well as for security enhancement over QKD-integrated optical networks.

IEEE Communications MagazineMar 8, 201971 citations