Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Secure NFV Orchestration over an SDN-Controlled Optical Network with Time-Shared Quantum Key Distribution Resources

Alejandro Aguado, E. Hugues-Salas, Paul Anthony Haigh, Jaume Marhuenda, Alasdair B. Price, Philip Sibson, Jake Kennard, Chris Erven, John Rarity, Mark G. Thompson, Andrew Lord, Reza Nejabati, Dimitra E. Simeonidou

Published Apr 15, 2017• 72 citations
OpenAlex

Abstract

Quantum key distribution (QKD) is a state-of-the-art method of generating cryptographic keys by exchanging single photons. Measurements on the photons are constrained by the laws of quantum mechanics, and it is from this that the keys derive their security. Current public key encryption relies on mathematical problems that cannot be solved efficiently using present-day technologies; however, it is vulnerable to computational advances. In contrast QKD generates truly random keys secured against computational advances and more general attacks when implemented properly. On the other hand, networks are moving towards a process of softwarization with the main objective to reduce cost in both, the deployment and in the network maintenance. This process replaces traditional network functionalities (or even full network instances) typically performed in network devices to be located as software distributed across commodity data centers. Within this context, network function virtualization (NFV) is a new concept in which operations of current proprietary hardware appliances are decoupled and run as software instances. However, the security of NFV still needs to be addressed prior to deployment in the real world. In particular, virtual network function (VNF) distribution across data centers is a risk for network operators, as an eavesdropper could compromise not just virtualized services, but the whole infrastructure. We demonstrate, for the first time, a secure architectural solution for VNF distribution, combining NFV orchestration and QKD technology by scheduling an optical network using SDN. A time-shared approach is designed and presented as a cost-effective solution for practical deployment, showing the performance of different quantum links in a distributed environment.

Related papers

Secure NFV Orchestration Over an SDN-Controlled Optical Network With Time-Shared Quantum Key Distribution Resources

Alejandro Aguado, Emilio Hugues-Salas, Paul Anthony Haigh +10 more

Quantum key distribution (QKD) is a state-of-the-art method of generating cryptographic keys by exchanging single photons. Measurements on the photons are constrained by the laws of quantum mechanics, and it is from this that the keys derive their security. Current public key encryption relies on mathematical problems that cannot be solved efficiently using present-day technologies; however, it is vulnerable to computational advances. In contrast QKD generates truly random keys secured against computational advances and more general attacks when implemented properly. On the other hand, networks are moving towards a process of softwarization with the main objective to reduce cost in both, the deployment and in the network maintenance. This process replaces traditional network functionalities (or even full network instances) typically performed in network devices to be located as software distributed across commodity data centers. Within this context, network function virtualization (NFV) is a new concept in which operations of current proprietary hardware appliances are decoupled and run as software instances. However, the security of NFV still needs to be addressed prior to deployment in the real world. In particular, virtual network function (VNF) distribution across data centers is a risk for network operators, as an eavesdropper could compromise not just virtualized services, but the whole infrastructure. We demonstrate, for the first time, a secure architectural solution for VNF distribution, combining NFV orchestration and QKD technology by scheduling an optical network using SDN. A time-shared approach is designed and presented as a cost-effective solution for practical deployment, showing the performance of different quantum links in a distributed environment.

arXiv:1604.05861•Journal of Lightwave Technology•Dec 30, 2016•89 citations

Hybrid Conventional and Quantum Security for Software Defined and Virtualized Networks

Alejandro Aguado, Vı́ctor López, Jesús Martínez-Mateo +5 more

Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.

Journal of Optical Communications and Networking•Sep 12, 2017•53 citations

End-to-End Quantum Secured Inter-Domain 5G Service Orchestration Over Dynamically Switched Flex-Grid Optical Networks Enabled by a q-ROADM

Rui Wang, Qibing Wang, George Theodore Kanellos +10 more

Dynamic and flexible optical networking combined with virtualization and softwarisation enabled by network function virtualization (NFV) and software defined networking (SDN) are the key technology enablers for supporting the dynamicity, bandwidth, and latency requirements of emerging 5G network services. To achieve the end-to-end connectivity objective of 5G, network services (NSes) must be often deployed transparently over multiple administrative and technological domains. Such scenario often presents security risks since a typical NS11Network service is a combination of multiple virtual and physical network functions created to realise a desired network functionality. may comprise a chain of network functions, each executed in different remote locations, and tampering within the network infrastructure may compromise their communication. To avoid such threats, quantum key distribution (QKD) has been identified and proposed as a future-proof method immune to any algorithmic cryptanalysis based on fundamental quantum-physics mechanisms to distribute symmetric keys. The maturity of QKD has enabled the research and development of quantum networks with gradual coexistence with classical optical networks using carrier-grade telecom equipment. This makes the QKD technology a suitable candidate for security of distributed and virtualised network services. In this article, for the first time, we propose a dynamic quantum-secured optical network for supporting network services that are dynamically created by chaining virtual network functions (VNFs)22Hardware network functions when implemented in software and deployed as VMs or containers are called VNFs. over multiple network domains. This work includes a new flex-grid quantum-switched reconfigurable optical add drop multiplexer (q-ROADM), extensions to SDN-enabled optical control plane, and extensions to NFV orchestration to achieve quantum-aware, on-demand chaining of VNFs. The experimental results verify the capability of routing quantum and classical data channels both individually and dynamically over shared fibre links. Moreover, quantum secured chaining of VNFs in 5G networks is experimentally demonstrated via interconnecting four autonomous 5G islands simultaneously through the q-ROADM with eight optical channels using the 5GUK Exchange orchestration platform. The experimental scenarios and results confirm the benefit of the proposed data plane architecture and control/management plane framework.

arXiv:1909.04409•Journal of Lightwave Technology•Dec 31, 2019•66 citations

First Experimental Demonstration of Secure NFV Orchestration over an SDN-Controlled Optical Network with Time-Shared Quantum Key Distribution

Alejandro Aguado, E. Hugues-Salas, Paul Anthony Haigh +10 more

We demonstrate, for the first time, a secure optical network architecture that combines NFV orchestration and SDN control with quantum key distribution (QKD) technology. A novel time-shared QKD network design is presented as a cost-effective solution for practical networks.

•Mar 1, 2017•0 citations

Virtualizing Quantum Key Distribution Based on Network Function Virtualization

Maryam Saad Jaafar, Ali Kadhim Bermani

Network functions virtualization (NFV) refers to replacing actual network appliances with virtual machines. A virtual machine monitor (VMM) has been used effectively in operating networking software and routing and load-balancing procedures. It is software that allows one computer to run multiple virtual machines (VMs) by sharing its resources virtually. Quantum key distribution (QKD) is a novel security technology that utilizes quantum mechanical principles to perform its functions. These functions include the exchange of a secret key and the provision of absolute protection. One of the unique capabilities QKD possesses, which is not found in other encryption techniques, is the ability to identify the existence of an eavesdropper. To accommodate the ever-increasing demand, service providers must increase their network infrastructure investments. In this study, we create a NFV system to generate a virtual quantum key distribution relay with virtual machines (VMs) and Amazon Web Services (AWS). The results of comparing quantum key distribution in a virtual environment and a traditional environment are as follows: the gain time in the virtual environment was approximately 0.0156 per second, with valid keys, while the traditional environment had a minimum time of 0.0312 per second, and the keys were invalid. The quantum bit error rate (QBER) is lower in NFV than in traditional methods.

International Scientific Conference of Engineering Sciences (ISCES)•May 3, 2023•0 citations

Virtual Network Function Deployment and Service Automation to Provide End-to-End Quantum Encryption

Alejandro Aguado, Vı́ctor López, Jesús Martínez-Mateo +3 more

The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.

Journal of Optical Communications and Networking•Mar 28, 2018•44 citations
Quantum key distribution (QKD) is a state-of-the-art method of generating cryptographic keys by exchanging single photons. Measurements on the photons are constrained by the laws of quantum mechanics, and it is from this that the keys derive their security. Current public key encryption relies on mathematical problems that cannot be solved efficiently using present-day technologies; however, it is vulnerable to computational advances. In contrast QKD generates truly random keys secured against computational advances and more general attacks when implemented properly. On the other hand, networks are moving towards a process of softwarization with the main objective to reduce cost in both, the deployment and in the network maintenance. This process replaces traditional network functionalities (or even full network instances) typically performed in network devices to be located as software distributed across commodity data centers. Within this context, network function virtualization (NFV) is a new concept in which operations of current proprietary hardware appliances are decoupled and run as software instances. However, the security of NFV still needs to be addressed prior to deployment in the real world. In particular, virtual network function (VNF) distribution across data centers is a risk for network operators, as an eavesdropper could compromise not just virtualized services, but the whole infrastructure. We demonstrate, for the first time, a secure architectural solution for VNF distribution, combining NFV orchestration and QKD technology by scheduling an optical network using SDN. A time-shared approach is designed and presented as a cost-effective solution for practical deployment, showing the performance of different quantum links in a distributed environment.
Quantum key distribution (QKD) is a state-of-the-art method of generating cryptographic keys by exchanging single photons. Measurements on the photons are constrained by the laws of quantum mechanics, and it is from this that the keys derive their security. Current public key encryption relies on mathematical problems that cannot be solved efficiently using present-day technologies; however, it is vulnerable to computational advances. In contrast QKD generates truly random keys secured against computational advances and more general attacks when implemented properly. On the other hand, networks are moving towards a process of softwarization with the main objective to reduce cost in both, the deployment and in the network maintenance. This process replaces traditional network functionalities (or even full network instances) typically performed in network devices to be located as software distributed across commodity data centers. Within this context, network function virtualization (NFV) is a new concept in which operations of current proprietary hardware appliances are decoupled and run as software instances. However, the security of NFV still needs to be addressed prior to deployment in the real world. In particular, virtual network function (VNF) distribution across data centers is a risk for network operators, as an eavesdropper could compromise not just virtualized services, but the whole infrastructure. We demonstrate, for the first time, a secure architectural solution for VNF distribution, combining NFV orchestration and QKD technology by scheduling an optical network using SDN. A time-shared approach is designed and presented as a cost-effective solution for practical deployment, showing the performance of different quantum links in a distributed environment.
Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.
Dynamic and flexible optical networking combined with virtualization and softwarisation enabled by network function virtualization (NFV) and software defined networking (SDN) are the key technology enablers for supporting the dynamicity, bandwidth, and latency requirements of emerging 5G network services. To achieve the end-to-end connectivity objective of 5G, network services (NSes) must be often deployed transparently over multiple administrative and technological domains. Such scenario often presents security risks since a typical NS11Network service is a combination of multiple virtual and physical network functions created to realise a desired network functionality. may comprise a chain of network functions, each executed in different remote locations, and tampering within the network infrastructure may compromise their communication. To avoid such threats, quantum key distribution (QKD) has been identified and proposed as a future-proof method immune to any algorithmic cryptanalysis based on fundamental quantum-physics mechanisms to distribute symmetric keys. The maturity of QKD has enabled the research and development of quantum networks with gradual coexistence with classical optical networks using carrier-grade telecom equipment. This makes the QKD technology a suitable candidate for security of distributed and virtualised network services. In this article, for the first time, we propose a dynamic quantum-secured optical network for supporting network services that are dynamically created by chaining virtual network functions (VNFs)22Hardware network functions when implemented in software and deployed as VMs or containers are called VNFs. over multiple network domains. This work includes a new flex-grid quantum-switched reconfigurable optical add drop multiplexer (q-ROADM), extensions to SDN-enabled optical control plane, and extensions to NFV orchestration to achieve quantum-aware, on-demand chaining of VNFs. The experimental results verify the capability of routing quantum and classical data channels both individually and dynamically over shared fibre links. Moreover, quantum secured chaining of VNFs in 5G networks is experimentally demonstrated via interconnecting four autonomous 5G islands simultaneously through the q-ROADM with eight optical channels using the 5GUK Exchange orchestration platform. The experimental scenarios and results confirm the benefit of the proposed data plane architecture and control/management plane framework.
Network functions virtualization (NFV) refers to replacing actual network appliances with virtual machines. A virtual machine monitor (VMM) has been used effectively in operating networking software and routing and load-balancing procedures. It is software that allows one computer to run multiple virtual machines (VMs) by sharing its resources virtually. Quantum key distribution (QKD) is a novel security technology that utilizes quantum mechanical principles to perform its functions. These functions include the exchange of a secret key and the provision of absolute protection. One of the unique capabilities QKD possesses, which is not found in other encryption techniques, is the ability to identify the existence of an eavesdropper. To accommodate the ever-increasing demand, service providers must increase their network infrastructure investments. In this study, we create a NFV system to generate a virtual quantum key distribution relay with virtual machines (VMs) and Amazon Web Services (AWS). The results of comparing quantum key distribution in a virtual environment and a traditional environment are as follows: the gain time in the virtual environment was approximately 0.0156 per second, with valid keys, while the traditional environment had a minimum time of 0.0312 per second, and the keys were invalid. The quantum bit error rate (QBER) is lower in NFV than in traditional methods.
The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.