Quantum Key Distribution (QKD) is a mechanism that allows two entities to agree on a secret key over a quantum channel. Recently, commercially viable QKD technology appeared on the market and the European Telecommunications Standards Institute (ETSI) established a working group to standardize QKD for commercial applications. Several testbeds and pre-commercial QKD networks are being deployed in the world, all requiring sophisticated control mechanisms to enable key exchanges between non-adjacent nodes for remote applications. In this paper, we implement and evaluate a prototype that realizes the architecture defined by ETSI and uses trusted relay nodes to exchange keys between non-adjacent nodes. In particular, we present the Software-Defined Network (SDN) Controller and the Software-Defined QKD nodes designed to control the QKD experimental testbed in Milan, named PoliQI. We test the proposed prototype in an emulation environment, showing its advantages in inter-datacenter communication scenarios in terms of key delivery time and application acceptance ratio.
Quantum Key Distribution (QKD) is a mechanism that allows two entities to agree on a secret key over a quantum channel. Recently, commercially viable QKD technology appeared on the market and the European Telecommunications Standards Institute (ETSI) established a working group to standardize QKD for commercial applications. Several testbeds and pre-commercial QKD networks are being deployed in the world, all requiring sophisticated control mechanisms to enable key exchanges between non-adjacent nodes for remote applications. In this paper, we implement and evaluate a prototype that realizes the architecture defined by ETSI and uses trusted relay nodes to exchange keys between non-adjacent nodes. In particular, we present the Software-Defined Network (SDN) Controller and the Software-Defined QKD nodes designed to control the QKD experimental testbed in Milan, named PoliQI. We test the proposed prototype in an emulation environment, showing its advantages in inter-datacenter communication scenarios in terms of key delivery time and application acceptance ratio.
Quantum-key-distribution (QKD) networks can theoretically generate quantum secret keys that are completely secure for an entire communication system. The rate of key distribution is low and decreases exponentially with increasing distance. A classic trusted relay (CTR) uses additional keys to enhance security distance in QKD networks. In practice, the assurance of security for certain relay nodes is still lacking, despite the fact that CTR requires that all nodes be trusted. Owing to channel unreliability, system faults accumulate during the key relay, thereby increasing the probability of CTR failing to distribute the secret key. The failure of a successful key relay would then result in the subsequent destruction of all the keys involved in the process, which leads to the wasting of the quantum secret key and reduction system encryption. Accordingly, reducing the impact of CTR failures and realising the key security distribution of remote quantum networks have become new challenges that require the development of a new survivability scheme. In this study, a software-defined networking (SDN) technique is introduced to circumvent this drawback by utilising the flexibility provided by the SDN paradigm for better QKD network management efficiency. In particular, a novel survivability model called software-defined quantum key relay failure (SDQKRF) is proposed in this paper in which a new function is developed and added to the SDN controller. According to the simulation results, SDN over a QKD network using the SDQKRF model is more reliable and performs better in terms of the key generation ratio, key utilisation rate, recovery after failure, avalanche effect, and service blocking rate than a regular QKD network without the SDQTRF model.
With the advent of quantum computing, the increasing threats to security poses a great challenge to communication networks. Recent innovations in this field resulted in promising technologies such as Quantum Key Distribution (QKD), which enables the generation of unconditionally secure keys, establishing secure communications between remote nodes. Additionally, QKD networks enable the interconnection of multi-node architectures, extending the point-to-point nature of QKD. However, due to the limitations of the current state of technology, the scalability of QKD networks remains a challenge toward feasible implementations. When it comes to long-distance implementations, trusted relay nodes partially solve the distance issue through the forwarding of the distributed keys, allowing applications that do not have a direct QKD link to securely share key material. Even though the relay procedure itself has been extensively studied, the establishment of the relaying node path still lacks a solution. This paper proposes an innovative network architecture that solves the challenges of Key Management System (KMS) identification, relay path discovery, and scalability of QKD networks by integrating Software-Defined Networking (SDN) principles, and establishing high-level virtual KMSs (vKMS) in each node and creating a new entity called the Quantum Security Controller (QuSeC). The vKMS serves the end-user key requests, managing the multiple KMSs within the node and abstracting the user from discovering the correct KMS. Additionally, based on the high-level view of the network topology and status, the QuSeC serves the path discovery requests from vKMSs, computing the end-to-end (E2E) relay path and applying security policies. The paper also provides a security analysis of the proposal, identifying the security levels of the architecture and analyzing the core networking security properties, and a performance evaluation that confirms the feasibility and scalability of the proposal.
Quantum Key Distribution is an emerging technology. On real production networks is starting to be installed due to it can strength robustness in communications and face next threat that Quantum Computing could be in next years if communications are not ready. As a new technology, it is difficult to integrate or interoperate with it without the necessary standards or interfaces, Software Defined Networking is presented as a solution to integrate QKD in real environments thanks to an approach based on standards, models, and interfaces. NETCONF and RESTCONF are protocols well known by the community oriented to manage devices remotely based on models that are integrated on SDN environments, in this sense, a Trusted Node can be configurable and manageable if we consider it as a device instead of a set of elements. In this paper we propose a method for the integration and management of Trusted Nodes on SDN independently of the transport protocol between the SDN logically centralized Controller and each QKD Node to provide end to end symmetric key for final application services
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
Quantum Key Distribution (QKD) has emerged as a promising technology for secure the communication because its security is achieved through the physical laws of quantum mechanics, rather than being based on mathematical problems. In most of the earlier implementations, QKD relied on the direct exchange of the secret keys between two users. Once implemented in a practical system outside of a controlled laboratory setting, QKD experiences complications associated with the limited distances, communication losses, and vulnerabilities to eavesdropping in the multi-user network configurations, compromising its ability to be this third-generation secure communication system. In this work, we show how quantum relay nodes can be implemented as points along a QKD network. The relay nodes provide additional advantages such as extending the communication distances, increasing eavesdropping resistance and allowing for more sophisticated configurations. While relying on theoretical models and experimentally motivated studies, this paper discusses advantages of implementing a relay architecture into a QKD network and highlights technical difficulties that need to be addressed prior to widespread implementation.
This work addresses the orchestration of large-scale Quantum Key Distribution Networks (QKDNs) using Software Defined Networking (SDN). Building on ETSI and ITU specifications, common best practices and architectures are outlined. The main task of the SDN Controller is to aggregate technical key performance indicators (KPI) from the network and, based on these, select the optimal path. Multiple path selection algorithms, based on Dijkstra or a maximum-minimum capacity algorithm, with built-in load balancing are presented. The algorithms were tested in simulations and their performances, and tradeoffs, are discussed. Additional critical aspects related to SDN controlled QKDNs are discussed, such as query batching, multi-path selection and group key capabilities. An oblivious multi-party protocol is proposed for relay path selection in a multi-domain scenario, so providers don't have to disclose sensitive information about their QKDN. These contributions aim to enhance scalability, resilience and interoperability in quantum-secure network infrastructures.