The Berlin OpenQKD Testbed demonstrates the integration of QKD technology into a field installed network infrastructure using a PQC secured key management system and hybrid key exchange protocols to secure communication applications.
This paper introduces several hybrid protocols based on Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) implemented in the OpenQKD testbed Berlin to improve the security of the QKD nodes. Instead of following the ETSI QKD014 standard of a key management system based on classical security, i.e., RSA authentication and ECC encryption, we implemented a quantum-secure Key Management System based on PQC Key Encapsulation and Signature algorithms. The hardware and the software components of the QKD network authenticate themselves using a PQC trust chain and Pre-Shared Secrets, wherever supported. The communication between QKD nodes, as for the encryption key forwarding process, is hardened by Post-Quantum Cryptography to prevent cryptographic key exposure on intermediate network nodes. Using the two implemented key exchange processes, based on QKD and PQC, applications are able to request any kind of encryption key from the Key Management System and combine them arbitrarily to compute more reliable cryptographic keys.
Quantum Key Distribution technology is evaluated for carrier-grade provider networks in the Berlin OpenQKD testbed, which is operated by Deutsche Telekom. It includes the investigation of modular architectures, standardized interfaces and layered network structures containing quantum, key management, and application layers as well as hybrid technologies, consisting of Quantum Key Distribution and Post-Quantum Cryptography. The testbed incorporates field-installed wireline fiber links together with wireless radio connections, enabling carrier-grade use cases and proof of concepts under real telecommunication operating environments for various scenarios of layer interworking, vendor agnostic networking, and quantum security for network as well as end-to-end user applications.
Quantum key distribution (QKD) is an innovative technology allowing information-theoretically-secure key sharing among distant users relying only on fundamental rules of quantum physics, without assumptions about the computational power of the attacker [1]. Different variants of this technology are making their way into the market since several years and QKD testbeds are under deployment worldwide, for institutional and commercial use. Among the remaining challenges, its integration in existing infrastructure is a vital one, together with the hybridization with different technologies.
Continuing efforts have been made to develop practical quantum key distribution (QKD) systems on the installed fiber networks since early 2000s [1]. Recently, several groups have demonstrated high-speed QKD systems [2,3] with GHz-clock frequency working stably on the installed-fiber networks [4-7]. Along with the hardware development, an efficient key management protocol [7] has been implemented to construct a QKD platform to supply information-theoretically secure key for multiple applications. The highly available QKD platform is expected to promote social deployment of the QKD technology.