Cyber–physical systems rely heavily on communication networks for remote monitoring and control. It is crucial to protect the communication networks from cyberattacks because an attack on the physical subsystem can be indirectly launched from a compromised cyber subsystem. Since remote control devices have limited computational power, we ensure communication confidentiality and integrity using one-time-pad (OTP) symmetric cryptography, which despite simple is unconditionally secure. To provide OTP with secret keys, we use quantum key distribution (QKD) across multiple hops, where each intermediate relay is a trusted node. These nodes can be weak points in cyberattacks. Hence, this article focuses on routing in multihop QKD networks that reduces the required number of trusted nodes. We formulate and solve an optimization problem to find the set of QKD routes that minimizes the number of activated trusted nodes while satisfying the secret key rate requirements of multiple communicating pairs. Extensive evaluation results confirm that the proposed scheme can indeed has fewer activated trusted nodes as compared to a benchmark scheme that finds only the shortest paths for communicating pairs.
Cyber–physical systems rely heavily on communication networks for remote monitoring and control. It is crucial to protect the communication networks from cyberattacks because an attack on the physical subsystem can be indirectly launched from a compromised cyber subsystem. Since remote control devices have limited computational power, we ensure communication confidentiality and integrity using one-time-pad (OTP) symmetric cryptography, which despite simple is unconditionally secure. To provide OTP with secret keys, we use quantum key distribution (QKD) across multiple hops, where each intermediate relay is a trusted node. These nodes can be weak points in cyberattacks. Hence, this article focuses on routing in multihop QKD networks that reduces the required number of trusted nodes. We formulate and solve an optimization problem to find the set of QKD routes that minimizes the number of activated trusted nodes while satisfying the secret key rate requirements of multiple communicating pairs. Extensive evaluation results confirm that the proposed scheme can indeed has fewer activated trusted nodes as compared to a benchmark scheme that finds only the shortest paths for communicating pairs.
There is a need to ensure unconditionally secure communications between different sites of an organization. We use quantum key distribution (QKD) protocol to provide a continuous stream of secret key bits to each communicating pair for message encryption through one-time-pad (OTP) cryptography. Due to long distance between different sites, trusted nodes are used to relay each service key in a hop-by-hop manner from one end node to another end node of a communicating pair. In a QKD network, routes for key relaying can be affected by availability of relay key bits at trusted nodes. Also, relay key allocation among different routes can impact security. We consider the scenario of supporting multiple communicating pairs, where each pair demands delivery of a certain service key rate across the QKD network, and trusted nodes may not have sufficient relay key rates to perform bitwise encryption to protect the service key. Hence, there is a need to allocate the limited relay key bits to meet all service key delivery demands while considering its effects on security. We propose to perform jointly routing and relay key allocation to minimize attack success probability. We have formulated the joint problem as an optimization and further proposed an efficient algorithm to find the optimal solutions. We have evaluated the proposed algorithm to confirm its ability and efficiency in finding optimal routes and relay key allocations. For the specific network topology that we have adopted, results show that the minimum number of required trusted nodes increases linearly when end nodes are added to the system. Furthermore, we can achieve a higher security level by adding more trusted nodes in a QKD network. But increasing the number of trusted nodes beyond the minimum requirement may not continue to reduce significantly the attack success probability.
In a cyber–physical system, quantum key distribution (QKD) protocols can provide a continuous supply of common secret key bits for secure communications between the control center and a remote device. QKD protocols operate on a peer-to-peer basis between two adjacent nodes and are distance-limited. Hence, trusted nodes are installed between two communicating end nodes for a better QKD range and key rate. These trusted nodes relay in a hop-by-hop manner, key bits generated in the first hop to the other end node. At each trusted node, the first hop key bits are encrypted by other locally generated key bits before being relayed. Since QKD process is stochastic, secret key bits are generated at different rates at different hops. Thus, buffer is needed at a trusted node to temporally hold some key bits while waiting for other key bits. There is no existing work that accounts for such a realistic relaying operation in deriving the key rate. This article contributes to developing a key rate model to determine accurately the end-to-end rates across multiple trusted nodes. We have evaluated accuracy of the proposed model through extensive simulations. The results show that there exist an optimal number of trusted nodes for a given distance between two end nodes. For example, the optimal number of relays increases from four for 100 km to six for 200 km.
Quantum key distribution (QKD) protocols generate a same secret key at two nodes which are at different locations. Such key is used to encrypt and decrypt messages for unconditionally secure communications through a classical channel. Originally, QKD protocols are designed to work between two nodes which are directly connected through a point-to-point quantum channel. Currently, commercial QKD systems have limited range and key rate. To increase key rate and extend range, the key generated by QKD at one end node is relayed hop-by-hop to the other end node through multiple trusted nodes. In a QKD network with multiple pairs of communicating nodes, routing deals with the issue of deciding for each pair, which trusted nodes are used to form a path connecting the end nodes. This paper presents an overview of QKD and highlights the differences between QKD routing as compared to classical routing. The challenges of QKD routing are presented. Existing works dealing with the challenges are surveyed. This paper ends with a discussion on remaining research issues.
Quantum key distribution (QKD), a key application of quantum information technology and “one-time pad” (OTP) encryption, enables secure key exchange with information-theoretic security, meaning its security is grounded in the laws of physics rather than computational assumptions. However, in QKD networks, achieving long-distance communication often requires trusted relays to mitigate channel losses. This reliance introduces significant challenges, including vulnerabilities to compromised relays and the high costs of infrastructure, which hinder widespread deployment. To address these limitations, we propose a zero-trust spatiotemporal diversification framework for multipath–multi-key distribution. The proposed approach enhances the security of end-to-end key distribution by dynamically shuffling key exchange routes, enabling secure multipath key distribution. Furthermore, it incorporates a dynamic adaptive path recovery mechanism that leverages a recursive penalty model to identify and exclude suspicious or compromised relay nodes. To validate this framework, we conducted extensive simulations and compared its performance against established multipath QKD methods. The results demonstrate that the proposed approach achieves a 97.22% lower attack success rate with 20% attacker pervasiveness and a 91.42% reduction in the attack success rate for single key transmission. The total security percentage improves by 35% under 20% attacker pervasiveness, and security enhancement reaches 79.6% when increasing QKD pairs. Additionally, the proposed scheme exhibits an 86.04% improvement in defense against interception and nearly doubles the key distribution success rate compared to traditional methods. The results demonstrate that the proposed approach significantly improves both security robustness and efficiency, underscoring its potential to advance the practical deployment of QKD networks.
We develop a novel key routing algorithm for quantum key distribution (QKD) networks that utilizes a distribution of keys between remote nodes, i.e., not directly connected by a QKD link, through multiple non-overlapping paths. This approach focuses on the security of a QKD network by minimizing potential vulnerabilities associated with individual trusted nodes. The algorithm ensures a balanced allocation of the workload across the QKD network links, while aiming for the target key generation rate between directly connected and remote nodes. We present the results of testing the algorithm on two QKD network models consisting of 6 and 10 nodes. The testing demonstrates the ability of the algorithm to distribute secure keys among the nodes of the network in an all-to-all manner, ensuring that the information-theoretic security of the keys between remote nodes is maintained even when one of the trusted nodes is compromised. These results highlight the potential of the algorithm to improve the performance of QKD networks.
Quantum Key Distribution (QKD) is considered to be an ultimate solution to communication security. However, current QKD devices, especially quantum photon sources, are expensive, and they can generate secret keys only at a low rate. In this paper, we design a system named RPSP for trusted relay-based QKD networks to not only minimize the number of photon sources needed in a network to ensure at least one feasible relay path exists for any potential QKD requests but also save the time to complete a batch of end-to-end QKD requests by jointly optimizing the routing of relay paths and the provisioning of photon sources along each relay path. Compared with existing works, RPSP focuses on a more practical scenario where only some of the nodes are equipped with photon sources and it leverages optical switching to enable dynamic photon source provisioning such that we can utilize such QKD devices in a more efficient way. Extensive simulations show that compared with baseline schemes, RPSP can save up to 87% of the photon sources needed in a trusted relay based QKD network, and 36% of the time to complete a batch of QKD requests.