The paper aims to highlight how symmetric cryptographic key generation via Quantum Key Distribution-based technology can be used to secure protected communications within a private network. Within a testbed of the 5G network installed in the campus of the Technical University of Ostrava, the quantum key distribution (QKD) technology and encryptors are implemented to demonstrate secure 5G network concepts such as network function virtualization (NFV) and network management software-defined networking (SDN). Specifically, two APIs are programmed with all the necessary steps for two Secure Application Entities to secure a new symmetric key that is in turn generated by two Key Manager Entities via a protocol called "Coherent One-Way".
The paper aims to highlight how symmetric cryptographic key generation via Quantum Key Distribution-based technology can be used to secure protected communications within a private network. Within a testbed of the 5G network installed in the campus of the Technical University of Ostrava, the quantum key distribution (QKD) technology and encryptors are implemented to demonstrate secure 5G network concepts such as network function virtualization (NFV) and network management software-defined networking (SDN). Specifically, two APIs are programmed with all the necessary steps for two Secure Application Entities to secure a new symmetric key that is in turn generated by two Key Manager Entities via a protocol called "Coherent One-Way".
Every attempt to access to the Internet through a Web browser, email sent, VPN connection, VoIP call, instant message or other use of telecommunications systems involves cryptographic techniques. The most commonly applied technique is asymmetric cryptography, which is generally executed in the background without the user even being aware. It establishes a cryptographic code based on the computational complexity of mathematical problems. However, this type of cryptography, which is widely used in today’s telecommunications systems, is under threat as electronics and computing rapidly develop. The development of fifth-generation cellular networks (5G) is gaining momentum, and given its wide field of application, security requires special attention. This is especially true faced with the development of quantum computers. One solution to this security challenge is to use more advanced techniques to establish cryptographic keys that are not susceptible to attack. An essential part of quantum cryptography, Quantum Key Distribution (QKD) uses the principles of quantum physics to establish and distribute symmetric cryptographic keys between two geographically distant users. QKD establishes information-theoretically secure cryptographic keys that are resistant to eavesdropping when they are created. In this paper, we survey the security challenges and approaches in 5G networks concerning network protocols, interfaces and management organizations. We begin by examining the fundamentals of QKD and discuss the creation of QKD networks and their applications. We then outline QKD network architecture and its components and standards, following with a summary of QKD and post-quantum key distribution techniques and approaches for its integration into existing security frameworks such as VPNs (IPsec and MACsec). We also discuss the requirements, architecture and methods for implementing the FPGA-based encryptors needed to execute cryptographic algorithms with security keys. We discuss the performance and technologies of post-quantum cryptography, and finally, examine reported 5G demonstrations which have used quantum technologies, highlighting future research directions.
Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.
The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
Software-Defined Networking (SDN) is an emerging networking paradigm that decouples the control and data plane in order to enable programmable and flexible networks, optimizing its applications and advancing computer systems. It does so through its architecture, a key part of which is a centralized network management through open interfaces that revolutionizes the way in which networks are designed and makes them more agile and versatile to the evolving needs of modern and future applications services. This also means, however, that there is now a centralized point of attack that is a major vulnerability, threatening the security of the entire network. With such an advanced network paradigm, it requires a security system that will mitigate these risks and warrant long-term security. In attempts to allow secure communications within the network, this research proposes the implementation of Quantum Key Distribution (QKD), leveraging quantum mechanics to secure the network against any computational advancements in the future. QKD is a recent cryptographic system that includes a traditional-computational channel and a physical-quantum channel to generate and distribute keys between parties. It uses the principles of quantum mechanics including entanglement and superposition to ensure that the physical layer cannot be compromised computationally. QKD provides confidentiality and privacy of information and communication. Moreover, it is resistant to technological advancements. The implications of QKD significantly enhance SDN security through its protection against attacks, efficient key distribution, reliable network orchestration, and data integrity, creating an architecture that establishes stable communication channels that are resistant to cyber threats.
The advent of quantum computing will pose great challenges to the current communication systems, requiring essential changes in the establishment of security associations in traditional architectures. In this context, the multi-technological and heterogeneous nature of 5G networks makes it a challenging scenario for the introduction of quantum communications. Specifically, 5G networks support the unification of non-3GPP access technologies (i.e. Wi-Fi), which are secured through the IPsec protocol suite and the Non-3GPP Interworking Function (N3IWF) entity. These mechanisms leverage traditional public key cryptography and Diffie-Hellman key exchange mechanisms, which should be updated to quantum-safe standards. Therefore, in this paper we present the design and development of a Quantum Key Distribution (QKD) based non-3GPP access mechanism for 5G networks, integrating QKD keys with IPsec tunnel establishment. Besides, we also demonstrate the feasibility of the system by experimental validation in a testbed with commercial QKD equipment and an open-source 5G core implementation. Results show that the time required to complete the authentication and IPsec security association establishment is 4.62% faster than traditional cryptography PSK-based systems and 5.17% faster than the certificate-based system, while ensuring Information-Theoretic Security (ITS) of the QKD systems.