A QKD network provides an additional security layer for IT-secure cryptographic key distribution that is added to existing conventional networks. Thus, QKD network components must be resilient to security challenges from conventional network environments. This paper provided solutions for realizing a Key Management System to avoid DoS attacks, and our solution allows applications to function securely in environments with a reduced amount of keys. In addition, we have provided approaches for allocating and managing QKD resources to avoid malicious key reservations. Simulation experiments verified the proposed solutions.
A QKD network provides an additional security layer for IT-secure cryptographic key distribution that is added to existing conventional networks. Thus, QKD network components must be resilient to security challenges from conventional network environments. This paper provided solutions for realizing a Key Management System to avoid DoS attacks, and our solution allows applications to function securely in environments with a reduced amount of keys. In addition, we have provided approaches for allocating and managing QKD resources to avoid malicious key reservations. Simulation experiments verified the proposed solutions.
A QKD network can be considered an add-on technology to a standard communication network that provides IT-secure cryptographic keys as a service. As a result, security challenges resulting in the suspension of functional work must be addressed. This study analyzes a Denial of Service (DoS) attack on the Key Management System (KMS), one of the critical components of the QKD network in charge of key management and key provisioning to authorized consumers. Through simulation methods performed in the QKDNetSim, we show that legitimate customers experience significantly worse service during an excessive DoS attack on KMS.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
The ability to protect information has always played an important role in the evolution of civilizations, and even in the history of mankind as a whole. Safe and reliable communications have become an essential component of people’s lives in the era of modern digital technologies, when all spheres and areas of activity, from defense and government to business and social communications, are unthinkable without real-time data exchange. Classical methods of cryptographic protection have long been used to ensure the security of data transmission, but with the explosive growth in computing power and the emerging development of quantum computers, many traditional solutions have become vulnerable. Quantum Key Distribution (QKD) is a popular research area at the moment, due to its use of the laws of quantum mechanics, and thus it is possible to provide a completely secure level of encryption. But traditional quantum communication protocols have their limitations, including low key generation rates, scalability problems in large networks, and vulnerabilities to various forms of cyberattacks in the network layer. Therefore, in this work we propose a new adaptive quantum key distribution algorithm using software-defined networking (SDN) technology. The main idea of the proposed approach is to introduce some level of redundancy in the key generation stage, which increases the throughput, robustness, and adaptability of multi-node quantum networks. In addition, the SDN control layer allows dynamic routing and resource management and quick response to changes in the network state, making the system more resistant to denial-of-service and eavesdropping attacks. Evaluating our solution in comparison with BB84, we show that the new algorithm provides better performance without losing its security level, making the work a step towards creating a working quantum-secure communication system.
The Key Management System (KMS) is an important component in scaling up from link-to-link key generation to large key distribution networks. In this work we provide an overview of a KMS in the context of Quantum Key Distribution Networks (QKDN) and give a thorough summary of the functionality of a KMS in such an application. Beyond classical QKDNs, we discuss Post Quantum Cryptography (PQC) hybridization techniques at the KMS level. These methods add an additional layer of security against quantum computer driven attacks. We also discuss selected topics regarding the development, deployment and operation of components for such security infrastructure. In addition, relevant standards in the realm of Quantum Key Distribution (QKD) are outlined and analyzed. As some of the necessary interfaces have not been standardized, namely the interface between two KMS instances and the interface between the KMS and the Software Defined Network (SDN) Agent, we propose APIs for these two cases. The design of the interface between the KMS and QKD modules is discussed and, considering their resource constraints, a push mode for the ETSI GS QKD 004 standard is proposed. Finally, implementation details of a prototype KMS are outlined and trade-offs are discussed.
Abstract Network management has been significantly transformed by software‐defined networking (SDN), which consolidates control and improves adaptability. As a result of this paradigm shift, security concerns have emerged concurrently. Within SDN environments, maintaining service path integrity is of utmost importance because malicious entities can exploit network flows to gain access to data, resulting in security breaches. Thus, QKD networks require a management plane that can control and manage the QKD resources. Quantum key distribution networks can be controlled and managed separately by SDN, allowing quantum key forwarding to be separated from their control and management. The paper provides an overview of QKD networks enabled by SDN, along with an overview of its architecture, interfaces, and protocols. This paper elaborates on the overall architecture and related interfaces and protocols of QKD networks assisted by SDN. Then, three important paradigms for simulation are presented using three use cases.
Quantum key distribution (QKD), a cryptography technology providing information theoretic security based on physical laws, has moved from the research stage to the engineering stage. Although the communication distance is subject to a limitation attributable to the QKD fundamentals, recent research and development of “key relaying” over a “QKD network” is overcoming this limitation. However, there are still barriers to widespread use of QKD integrated with conventional information systems: applicability and development cost. In order to break down these barriers, this paper proposes a new solution for developing secure network infrastructure based on QKD technology to accommodate multiple applications. The proposed solution introduces 3 functions: (1) a directory mechanism to manage multiple applications hosted on the QKD network, (2) a key management method to share and to allocate the keys for multiple applications, and (3) a cryptography communication library enabling existing cryptographic communication software to be ported to the QKD network easily. The proposed solution allows the QKD network to accommodate multiple applications of various types, and moreover, realizes applicability to conventional information systems easily. It also contributes to a reduction in the development cost per information system, since the development cost of the QKD network can be shared between the multiple applications. The proposed solution was implemented with a network emulating QKD technology and evaluated. The evaluation results show that the proposed solution enables the infrastructure of a single QKD network to host multiple applications concurrently, fairly, and effectively through a conventional application programming interface, OpenSSL API. In addition, the overhead of secure session establishment by the proposed solution was quantitatively evaluated and compared.