Quantum key distribution (QKD) provides future-proof security for data communications over optical networks. Currently, sophisticated QKD systems are developed and the scale of QKD-secured optical networks (QKD-ONs) becomes larger. Given the complex network conditions and dynamic end-to-end security services in QKD-ONs, autonomic management and control becomes a promising paradigm to support end-to-end quality-of-service (QoS) assurance in an efficient and stable way without requiring human intervention. Hence, to enable and utilize the autonomic functionalities over QKD-ONs for realizing the end-to-end QoS assurance becomes a challenge. This work enhances the software defined networking (SDN) technique to tackle this challenge because SDN can add programmability and flexibility for QKD-ON's management and control. A new architecture of SDN-based QKD-ONs supporting autonomic end-to-end QoS assurance is designed, where a knowledge engine with autonomic control loops is developed in the SDN controller. We present the autonomic end-to-end QoS assurance procedure, and the cross-layer collaborative QoS assurance (CLC-QA) strategy for implementing the autonomic functionalities in the network level over QKD-ONs. We also establish an experimental testbed of SDN-based QKD-ONs supporting autonomic end-to-end QoS assurance, and perform the numerical simulation to verify our proposed approaches. Experimental results demonstrate that our presented approaches can achieve the millisecond-level overall latency of 337 ms and 618 ms, during the first and second autonomic adjustment without human intervention in case of the autonomic QoS protection. Moreover, the CLC-QA strategy is evaluated under different traffic loads by being compared with the baseline strategy without cross-layer collaboration. It can improve 22.5% protection success ratio and save 5.7% average key consumption.
Quantum key distribution (QKD) provides future-proof security for data communications over optical networks. Currently, sophisticated QKD systems are developed and the scale of QKD-secured optical networks (QKD-ONs) becomes larger. Given the complex network conditions and dynamic end-to-end security services in QKD-ONs, autonomic management and control becomes a promising paradigm to support end-to-end quality-of-service (QoS) assurance in an efficient and stable way without requiring human intervention. Hence, to enable and utilize the autonomic functionalities over QKD-ONs for realizing the end-to-end QoS assurance becomes a challenge. This work enhances the software defined networking (SDN) technique to tackle this challenge because SDN can add programmability and flexibility for QKD-ON's management and control. A new architecture of SDN-based QKD-ONs supporting autonomic end-to-end QoS assurance is designed, where a knowledge engine with autonomic control loops is developed in the SDN controller. We present the autonomic end-to-end QoS assurance procedure, and the cross-layer collaborative QoS assurance (CLC-QA) strategy for implementing the autonomic functionalities in the network level over QKD-ONs. We also establish an experimental testbed of SDN-based QKD-ONs supporting autonomic end-to-end QoS assurance, and perform the numerical simulation to verify our proposed approaches. Experimental results demonstrate that our presented approaches can achieve the millisecond-level overall latency of 337 ms and 618 ms, during the first and second autonomic adjustment without human intervention in case of the autonomic QoS protection. Moreover, the CLC-QA strategy is evaluated under different traffic loads by being compared with the baseline strategy without cross-layer collaboration. It can improve 22.5% protection success ratio and save 5.7% average key consumption.
Quantum key distribution (QKD) holds the potential of providing long-term integrity and confidentiality for data and communications. Currently, many fiber-based QKD systems have been commercialized and several QKD networks have been deployed. Given the high cost and complexity of QKD network deployment, QKD as a service (QaaS) becomes a promising pattern for future QKD networks. The QaaS concept is that multiple users can apply for QKD services to obtain their required secret-key rates (SKRs) from the same QKD network infrastructure instead of deploying their dedicated QKD networks. Accordingly, how to provide efficient and flexible QaaS for fulfilling the SKR requirements of multiple users over a QKD network infrastructure becomes a new challenge. This study introduces the software defined networking (SDN) technique to overcome this challenge, since SDN can add flexibility together with efficient QKD network management. A new framework of SDN for QaaS (SDQaaS) is proposed, where the QaaS functions are developed in the SDN controller. We present the protocol extension, intercommunication workflow, and routing and SKR assignment strategy for QaaS implementation in the SDQaaS framework. We also establish a SDQaaS experimental testbed and perform the numerical simulation to verify our presented approaches. Experimental results demonstrate that our presented approaches can achieve efficient and flexible QaaS over the QKD network. Moreover, simulation results indicate that the success probability of QKD service requests can be increased via lowering the flexibility of SKR requirements for QKD service creation, sacrificing more cost to produce higher SKR over the QKD network, or gradually reducing SKR requirements with the modification of QKD service.
Software-defined networking (SDN) has emerged as a promising paradigm for managing and controlling network resources efficiently. However, ensuring the security of data packets transmitted within an SDN environment remains a critical challenge. Traditional networking relies on static configurations, while SDN offers dynamic control and programmability, revolutionizing network management. In SDN, the application layer employs tools like OpenDaylight and Mininet for network management and testing. The control layer, managed by controllers such as Floodlight or ONOS, orchestrates traffic flow among switches. In the infrastructure layer, Quantum Key Distribution (QKD) with the BB84 protocol ensures secure communication. Together, these layers enable agile, programmable, and secure networking paradigms. This paper proposes integrating quantum key distribution (QKD) into SDN architectures to bolster packet-level security. By leveraging quantum entanglement and uncertainty, a secure communication channel between SDN controllers and switches is established, resilient to quantum attacks. Evaluation through simulations and real-world experiments demonstrates efficacy in mitigating security threats while minimizing overhead and latency, advancing SDN security IEEE 802.1X capabilities and leveraging quantum technologies for cybersecurity.
Dynamic and flexible optical networking combined with virtualization and softwarisation enabled by network function virtualization (NFV) and software defined networking (SDN) are the key technology enablers for supporting the dynamicity, bandwidth, and latency requirements of emerging 5G network services. To achieve the end-to-end connectivity objective of 5G, network services (NSes) must be often deployed transparently over multiple administrative and technological domains. Such scenario often presents security risks since a typical NS11Network service is a combination of multiple virtual and physical network functions created to realise a desired network functionality. may comprise a chain of network functions, each executed in different remote locations, and tampering within the network infrastructure may compromise their communication. To avoid such threats, quantum key distribution (QKD) has been identified and proposed as a future-proof method immune to any algorithmic cryptanalysis based on fundamental quantum-physics mechanisms to distribute symmetric keys. The maturity of QKD has enabled the research and development of quantum networks with gradual coexistence with classical optical networks using carrier-grade telecom equipment. This makes the QKD technology a suitable candidate for security of distributed and virtualised network services. In this article, for the first time, we propose a dynamic quantum-secured optical network for supporting network services that are dynamically created by chaining virtual network functions (VNFs)22Hardware network functions when implemented in software and deployed as VMs or containers are called VNFs. over multiple network domains. This work includes a new flex-grid quantum-switched reconfigurable optical add drop multiplexer (q-ROADM), extensions to SDN-enabled optical control plane, and extensions to NFV orchestration to achieve quantum-aware, on-demand chaining of VNFs. The experimental results verify the capability of routing quantum and classical data channels both individually and dynamically over shared fibre links. Moreover, quantum secured chaining of VNFs in 5G networks is experimentally demonstrated via interconnecting four autonomous 5G islands simultaneously through the q-ROADM with eight optical channels using the 5GUK Exchange orchestration platform. The experimental scenarios and results confirm the benefit of the proposed data plane architecture and control/management plane framework.
The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.
As an important support for quantum communication, quantum key distribution (QKD) networks have achieved a relatively mature level of development, and they face higher requirements for multi-user end-to-end networking capabilities. Thus, QKD networks need an effective management plane to control and coordinate with the QKD resources. As a promising technology, software defined networking (SDN) can separate the control and management of QKD networks from the actual forwarding of the quantum keys. This paper systematically introduces QKD networks enabled by SDN, by elaborating on its overall architecture, related interfaces, and protocols. Then, three-use cases are provided as important paradigms with their corresponding schemes and simulation performances.
Quantum key distribution (QKD) has been identified as a secure method for providing symmetric keys between two parties based on the fundamental laws of quantum physics, making it impossible for a third party to copy the quantum states exchanged without being detected by the sender (Alice) and receiver (Bob) and without altering the original states. However, when QKD is applied in a deployed optical network, physical-layer intrusions may occur in the optical links by injecting harmful signals directly into the optical fiber. This can have a detrimental effect on the key distribution and eventually lead to its disruption. On the other hand, network architectures with software-defined networking (SDN) benefit from a homogeneous and unified control plane that can seamlessly control a QKD-enabled optical network end-to-end. There is no need for a separate QKD control, a separate control for each segment of an optical network, and an orchestrator to coordinate between these parts. Furthermore, SDN allows customized and application-tailored control and algorithm provisioning, such as QKD-aware optical path computation, to be deployed in the network, independent of the underlying infrastructure. Therefore, in this paper, we investigate the integration of the application, SDN, and QKD infrastructure layers and confirm capability for flexible supervision and uninterrupted key service provisioning in the event of link level attacks. An experimental demonstrator is used, for the first time, to verify the architecture proposed, considering real-time monitoring of quantum parameters and fiber-optic link intruders to emulate real-world conditions. Furthermore, attacks on a standard single-mode fiber (via a 3 dB coupler) and a multicore fiber (via an adjacent core) are undertaken to explore different connectivity between QKD units. Results show additional attacker identification and switching time of less than 60 ms for the link cases investigated, being negligible compared to the total (re-)initialization time of 14 min of the QKD units.