The point-to-point quantum key distribution (QKD) system is limited by the transmission distance. So, the wide area QKD network with multiple endpoints is the research focus of this study. The relay-node scenario and key relay protocols provide the solutions to the QKD network. The early key relay protocols require the relay nodes to be reliable. Once the relay nodes become compromised, the whole network is insecure. In this paper, we extend the chain structure of the public-XOR(exclusive OR)-key scheme with two endpoints to the complex network with multiple endpoints. The relay nodes in our scheme do not need encryption actions, decryption actions, or storage XOR keys, which simplifies the system compared with other key distribution schemes based on trusted relay nodes. Our scheme not only improves the practical performance and simplifies the system’s complexity, but it also ensures that the security is not reduced. Specifically, we rigorously demonstrate that an eavesdropper can never access the key shared by the users of the network as long as the process of generating XOR keys and destroying the original keys is secure. In addition, we discuss the information leakage of the practical QKD network from the perspective of the unicity distance.
The point-to-point quantum key distribution (QKD) system is limited by the transmission distance. So, the wide area QKD network with multiple endpoints is the research focus of this study. The relay-node scenario and key relay protocols provide the solutions to the QKD network. The early key relay protocols require the relay nodes to be reliable. Once the relay nodes become compromised, the whole network is insecure. In this paper, we extend the chain structure of the public-XOR(exclusive OR)-key scheme with two endpoints to the complex network with multiple endpoints. The relay nodes in our scheme do not need encryption actions, decryption actions, or storage XOR keys, which simplifies the system compared with other key distribution schemes based on trusted relay nodes. Our scheme not only improves the practical performance and simplifies the system’s complexity, but it also ensures that the security is not reduced. Specifically, we rigorously demonstrate that an eavesdropper can never access the key shared by the users of the network as long as the process of generating XOR keys and destroying the original keys is secure. In addition, we discuss the information leakage of the practical QKD network from the perspective of the unicity distance.
Quantum key distribution (QKD) protocols generate a same secret key at two nodes which are at different locations. Such key is used to encrypt and decrypt messages for unconditionally secure communications through a classical channel. Originally, QKD protocols are designed to work between two nodes which are directly connected through a point-to-point quantum channel. Currently, commercial QKD systems have limited range and key rate. To increase key rate and extend range, the key generated by QKD at one end node is relayed hop-by-hop to the other end node through multiple trusted nodes. In a QKD network with multiple pairs of communicating nodes, routing deals with the issue of deciding for each pair, which trusted nodes are used to form a path connecting the end nodes. This paper presents an overview of QKD and highlights the differences between QKD routing as compared to classical routing. The challenges of QKD routing are presented. Existing works dealing with the challenges are surveyed. This paper ends with a discussion on remaining research issues.
Quantum Key Distribution (QKD) has emerged as a promising technology for secure the communication because its security is achieved through the physical laws of quantum mechanics, rather than being based on mathematical problems. In most of the earlier implementations, QKD relied on the direct exchange of the secret keys between two users. Once implemented in a practical system outside of a controlled laboratory setting, QKD experiences complications associated with the limited distances, communication losses, and vulnerabilities to eavesdropping in the multi-user network configurations, compromising its ability to be this third-generation secure communication system. In this work, we show how quantum relay nodes can be implemented as points along a QKD network. The relay nodes provide additional advantages such as extending the communication distances, increasing eavesdropping resistance and allowing for more sophisticated configurations. While relying on theoretical models and experimentally motivated studies, this paper discusses advantages of implementing a relay architecture into a QKD network and highlights technical difficulties that need to be addressed prior to widespread implementation.
There is a need to ensure unconditionally secure communications between different sites of an organization. We use quantum key distribution (QKD) protocol to provide a continuous stream of secret key bits to each communicating pair for message encryption through one-time-pad (OTP) cryptography. Due to long distance between different sites, trusted nodes are used to relay each service key in a hop-by-hop manner from one end node to another end node of a communicating pair. In a QKD network, routes for key relaying can be affected by availability of relay key bits at trusted nodes. Also, relay key allocation among different routes can impact security. We consider the scenario of supporting multiple communicating pairs, where each pair demands delivery of a certain service key rate across the QKD network, and trusted nodes may not have sufficient relay key rates to perform bitwise encryption to protect the service key. Hence, there is a need to allocate the limited relay key bits to meet all service key delivery demands while considering its effects on security. We propose to perform jointly routing and relay key allocation to minimize attack success probability. We have formulated the joint problem as an optimization and further proposed an efficient algorithm to find the optimal solutions. We have evaluated the proposed algorithm to confirm its ability and efficiency in finding optimal routes and relay key allocations. For the specific network topology that we have adopted, results show that the minimum number of required trusted nodes increases linearly when end nodes are added to the system. Furthermore, we can achieve a higher security level by adding more trusted nodes in a QKD network. But increasing the number of trusted nodes beyond the minimum requirement may not continue to reduce significantly the attack success probability.
Quantum key distribution (QKD) networks is expected to provide information-theoretical secured (ITS) communication over long distances. QKD networks based trusted relay architecture are now the most widely used scheme in practice. However, it is an unrealistic assumption that all relays are fully trustable in complex networks. In the past, only a few studies have theoretically analyzed the case of passive eavesdropping attack by dishonest relays and corresponding defense method. However, we have found that active attacks by dishonest relays can be more threatening. With the consideration of passive and active attacks, we treat dishonest relays as Byzantine nodes and analyzes the upper limit of Byzantine nodes that the QKD network can accommodate. In this paper, we propose an ITS Byzantine-fault tolerance (BFT) QKD network scheme to achieve end-to-end key distribution based on point-to-point QKD links. To ensure consistency and provide BFT ability in the QKD network, we design an ITSBFT-consensus protocol for this network scheme. To ensure the information-theoretic security of consensus, we design a temporary signature scheme based on point-to-point QKD link keys. To prevent Byzantine nodes from disrupting the execution process of key distribution, we design an end-to-end key distribution scheme combined with consensus. We theoretically analyze proposed ITSBFT-QKD network scheme from four aspects: QKD key distribution security, temporary signature security, consensus security, and leader election fairness. The simulation result proved the feasibility and demonstrate the performance.
In order to explore the solution of the problems of the short of knowledge and immature theoretical research about large scale,specifically wide-area,quantum key distribution network research,the structure model,the secret key model and the active model of the trusted relaying quantum key distribution network were proposed from the viewpoints of structure,inner secret key relationship and working principle respectively for the trusted relaying quantum key distribution network which is the only real practical one so far.Firstly,from the viewpoint of system theory,the quantum key distribution network was divided into five layers according to the basic principle of key relaying based on the existing structure model.The constitution of each layer and the relationship between them were explained in detail.Secondly,from the viewpoint of information theory,the quantum key distribution network was abstracted as a key information graph according to the key sharing relationship among all nodes and the node and edge were formally defined.Therefore,the secret key information in the five layers quantum key distribution network could be explained by the graph theory in details.Lastly,from the viewpoint of the cybernetics, the key distribution process was resolved into two basic parts of key relationship establishment and secrete key generation,then the works of the quantum key distribution network could be explained by the development of key information graphs.The analysis showed that the proposed quantum key distribution network model can achieve the goal of hierarchical,parallel and pipelining key distribution,and can ensure the security of key distribution,which establishes the foundation for the future theoretical and technology research.
Abstract Secure key distribution is crucial for maintaining communication confidentiality in networks with multiple communicating partners. Asymmetric key algorithms are vulnerable to quantum attacks because of the computational advantage offered by quantum computers, whereas symmetric key algorithms with sufficiently large keys remain comparatively more resistant. Quantum Key Distribution (QKD) has emerged as a promising quantum-secure key distribution technique based on the principles of quantum physics. However, practical QKD networks often rely on relay nodes to extend communication distance, and malicious relay nodes can compromise quantum keys during the relaying process. This study proposes a secure key relaying approach based on Shamir's Secret Sharing to mitigate this vulnerability. The proposed method uses a probabilistic behavioural model to assess relay nodes according to their curiosity and collaboration tendencies. By splitting a quantum key into multiple shares and routing them through paths with minimum compromise risk, the approach reduces exposure to malicious or colluding relay nodes. The proposed algorithm assigns risk to network paths by evaluating node-level curiosity and collaboration potential, determines the appropriate number of shares, and selects secure routing paths to minimise key compromise. The study further analyses the parameters influencing the ideal number of shares for a given network, thereby offering a resilient mechanism for quantum-safe communication in QKD networks with malicious relay nodes.