Optical Fiber Communication Conference

Field Trial of Quantum-Secured IPsec Tunnels with Chip-based QKD

Philip Sibson, Jake Kennard, Tom Crabtree, Paul Kenneth Wright, Catherine White, E. Hugues-Salas, Andrew Lord, Gert Grammel, Bill Mead, Radko Radev, Melchior Aelmans, Steven L. Jacques

Published Jan 1, 2024• 3 citations

Publisher

Abstract

We report a field trial of chip-based QKD over 28.5km of deployed G.652 fibre, integrated using RFC 8784 with Juniper routers, with concurrent IPsec tunnels consuming independent keys. This illustrates practical quantum-resilient transport layer communication.

DOI: 10.1364/ofc.2024.th3b.4

Related papers

Sentinel-Based Failover for QKD-Augmented IPsec Tunnels

Juan Carlos Hernandez-Hernandez, Francesco Vista, Haftay Gebreslasie Abreha +3 more

Quantum-safe IPsec through hybrid key establishment is practical, but creates a critical operational challenge: how to maintain tunnel availability when the QKD infrastructure becomes unavailable. In this paper, we present the design, implementation, and experimental evaluation of a quantum-safe key establishment mechanism for an IPsec tunnel that combines X25519, ML-KEM, and ETSI GS QKD 014 keys through the RFC 9370 multiple key exchange mechanism, and that degrades gracefully when the QKD key delivery fails. Our open-source StrongSwan plugin uses a sentinel-based coordination protocol, thereby permitting us to complete the handshake even if the QKD leg fails, instead of aborting, restoring the QKD share at the next rekey. On a testbed connected to a metropolitan QKD link over 33 km of deployed fiber, we evaluated five configurations, from a classical X25519 with RSA baseline to a hybrid one that adds ML-KEM-1024 and a QKD key. The full hybrid authentication costs 103 ms against 61 ms for the baseline, the QKD retrieval itself adds only about 7 ms. Failure injection experiments confirm that the tunnel survives a complete KME outage without any interruption of the protected traffic.

arXiv:2609.01121Sep 1, 20260 citations

Multi-Domain IPsec Over MACsec QKD Field Deployed Demonstration

Alkinoos Papageorgopoulos, Konstantinos Tsimvrakidis, Nikolaos Makris +9 more

We experimentally demonstrate a field-deployed, multi-domain network combining Layer 3 IPsec over Layer 2 MACsec secured with Quantum Generated Keys. The system achieves stable long-duration operation, low latency, zero packet loss, and scalable quantum-safe key management across domains.

International Conference on Quantum Communications, Networking, and Computing (QCNC)Apr 6, 20260 citations

Quantum-safe 10 Gbps Site-to-Site IPsec VPN Tunnel over 46 km Deployed Fibre

Obada Alia, A. Huang, H. Luo +3 more

We successfully demonstrated a 10 Gbps QKD-secured IPsec VPN tunnel between two JPMorgan Chase datacenters in a metro network over 46 km of deployed telecom fiber with over 168 hours of continuous operation.

Optical Fiber Communication ConferenceJan 1, 20248 citations

Quantum resistant software Defined-Networking IPsec, enabling ITS communication over IP networks on real telco infrastructures

Rubén B. Méndez, Jaime S. Buruaga, Juan Pedro Brito Méndez +3 more

The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.

Computer NetworksMar 4, 20262 citations

Schemes of IPsec integrated with quantum key distribution

Chun-Hui 春辉 Zhang 张, Wen-Xuan Zhang, Xing-Yu Zhou +4 more

Abstract With the rapid advancement of quantum computing, traditional security protocols based on classical encryption algorithms are increasingly vulnerable to potential quantum attacks. The current IPsec protocol, which relies on classical cryptographic methods, is insufficient to withstand such threats, thereby compromising the security of long-term data transmission. To address this issue, we propose integrating quantum key distribution (QKD) into the internet protocol security (IPsec) protocol, thereby enhancing its resilience against quantum computing attacks. Here, two schemes that merge QKD-generated keys with classical cryptographic keys are designed to enhance both security and stability. Furthermore, we conduct a comprehensive evaluation of the performance of various QKD protocols implemented with the scheme, along with an assessment of its overall efficacy across a topological network configuration. This approach not only ensures secure data transmission in the era of quantum computing but also highlights the potential application value of integrating QKD with IPsec, providing valuable insights for the design and implementation of future quantum-secure communication systems.

Chinese Physics BJan 4, 20260 citations

100 Gbps Quantum-safe IPsec VPN Tunnels over 46 km Deployed Fiber

Obada Alia, Huang, Albert, Huan Luo +3 more

We demonstrated for the first time quantum-safe high-speed 100 Gbps site-to-site IPsec tunnels secured using Quantum Key Distribution (QKD) technology. The demonstration was conducted between two JPMorgan Chase Data Centers (DCs) in an air-gapped environment over 46 km of deployed telecom fiber across Singapore achieving 45 days of continuous operation. Two different Virtual Private Network (VPN) tunnel configurations were tested: (1) a QKD-secured VPN tunnel configuration with a maximum throughput of 80 Gbps and (2) a multi-VPN tunnel configuration exhibiting 12 QKD-secured VPN tunnels with a throughput of 8.39 Gbps per tunnel resulting in an aggregated throughput of 99.62 Gbps for all tunnels. For the QKD system performance, we achieved an average Secret Key Rate (SKR) of 7.4 kbps (about 29 AES-256 keys per second), an average Quantum Bit Error Rate (QBER) of 0.8% and an average visibility of 98.6%. We utilized the ETSI-QKD-014 REST-based Application Programming Interface (API) to exchange the QKD generated keys between the key management server in the QKD system and the next-generation firewalls in order to encrypt and decrypt the data. The data was encrypted by the quantum-safe keys using the AES-256-GCM cipher suite with a key refresh rate of 120 seconds without affecting the VPN tunnel connectivity and performance

arXiv:2405.04415May 7, 20242 citations