In this demonstration, we showcase the realization of a prototype of an edge computing network, where the client and edge domains both host simulated Quantum Key Distribution devices, for a hospital use case. In particular, digital health applications using the Function-as-a-Service (FaaS) paradigm will invoke remote functions provided by an Apache OpenWhisk cluster deployed in the edge infrastructure, where the arguments and return value are encrypted using keys generated through an underlying simulated QKD point-to-point network. All the interactions in the control/management plane are handled through standard interfaces defined by the ETSI MEC and QKD industry study groups.
In this demonstration, we showcase the realization of a prototype of an edge computing network, where the client and edge domains both host simulated Quantum Key Distribution devices, for a hospital use case. In particular, digital health applications using the Function-as-a-Service (FaaS) paradigm will invoke remote functions provided by an Apache OpenWhisk cluster deployed in the edge infrastructure, where the arguments and return value are encrypted using keys generated through an underlying simulated QKD point-to-point network. All the interactions in the control/management plane are handled through standard interfaces defined by the ETSI MEC and QKD industry study groups.
Many modern applications rely on the ability to offload computation-intensive tasks to edge or cloud infrastructures. While this is clearly beneficial from the point of view of the client, because of the decreased load and system requirements, such an approach entails frequent exchanges with the edge/cloud application, which may include sensitive data. The interconnection of the client and remote infrastructures through a Quantum Key Distribution (QKD) network makes it possible to exchange quantum-secure keys between the peer applications. In this paper we study how to achieve this ambitious goal with applications using the Function-as-a-Service (FaaS) programming model in the context of ETSI MEC and QKD standards, as demonstrated in the national project QUANCOM, funded by the Italian Ministry of University and Research.
Edge computing is a leading trend in the deployment of computation and networking infrastructures, where processing is done closer to the users, compared to more traditional cloud-based solutions relying on remote data centers. On the other hand, Quantum Key Distribution (QKD) technologies, offering unconditional security between the communicating parties, is expected to become affordable in the near future and it will unlock new opportunities, e.g., for applications with long-term confidentiality requirements. In this paper we study how to enable ETSI ISG QKD key delivery within an ETSI MEC edge computing scenario, in the practical use case of cloud-native applications based on Function-as-a-Service (FaaS). This work is part of the activities of the PON project “Development of quantum systems and technologies for IT security in communication networks” (QUANCOM) which aims to the realization of a metropolitan quantum communication network through the collaboration between universities, research centers and companies operating in the communication market area.
The advent of distributed computing systems will offer great flexibility for application workloads, while also imposing more attention to security, where the future advent and adoption of quantum technology can introduce new security threats. For this reason, the Multi-access Edge Computing (MEC) working group at ETSI has recently started delving into security aspects, especially motivated by the upcoming reality of the MEC federation, which involves services made of application instances belonging to different systems (thus, different trust domains). On the other side, Quantum Key Distribution (QKD) can help strengthen the level of security by enabling the exchange of secure keys through an unconditionally secure protocol, e.g., to secure communication between REST clients and servers in distributed computing systems at the edge. In this paper, we propose a technical solution to achieve this goal, building on standard specifications, namely ETSI MEC and ETSI QKD, and discussing the gaps and limitations of current technology, which hamper full-fledged in-field deployment and mass adoption. Furthermore, we provide our look-ahead view on the future of secure distributed computing through the enticing option of federating edge computing domains.
There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.
Quantum-Safe Networks (QSNs) use quantum key distribution (QKD) to deliver keys generated using a Quantum Random Number Generator (QRNG) to consumers at scale. In practice, prevailing Quantum-Key-as-a-Service (QKaaS) offerings still assume that each consumer site deploys on-premise QKD hardware, creating cost and feasibility barriers that limit adoption. Although ETSI GS QKD 014 standardizes APIs for key retrieval between Secure Application Entities (SAEs) and Key Management Entities (KMEs), it does not address key delivery across untrusted classical networks to consumers without local QKD devices. We close this gap with a gateway architecture that transparently secures ETSI-compliant QKD APIs using Post-Quantum Cryptography (PQC)—applying PQC signatures and key-encapsulation mechanisms end-to-end—without requiring changes to existing devices or software. The design supports cryptographic agility, enabling runtime selection and rotation among standardized PQC schemes. Evaluations on both simulated QKD environments and production-grade hardware show minimal overhead (≈1.3×–1.5× versus baseline) and robust scaling across concurrent connections and multiple consumer sites, extending the reach of QSNs beyond premises equipped with QKD while preserving end-to-end quantum-safe guarantees. Overall, this paper equips practitioners with a systematized view of PQC–QKD integration in QSNs, with an actionable gateway blueprint for extending QSNs without the need for on-premise QKD deployments.
Quantum Key Distribution (QKD) is a mechanism that allows two entities to agree on a secret key over a quantum channel. Recently, commercially viable QKD technology appeared on the market and the European Telecommunications Standards Institute (ETSI) established a working group to standardize QKD for commercial applications. Several testbeds and pre-commercial QKD networks are being deployed in the world, all requiring sophisticated control mechanisms to enable key exchanges between non-adjacent nodes for remote applications. In this paper, we implement and evaluate a prototype that realizes the architecture defined by ETSI and uses trusted relay nodes to exchange keys between non-adjacent nodes. In particular, we present the Software-Defined Network (SDN) Controller and the Software-Defined QKD nodes designed to control the QKD experimental testbed in Milan, named PoliQI. We test the proposed prototype in an emulation environment, showing its advantages in inter-datacenter communication scenarios in terms of key delivery time and application acceptance ratio.