Softwarization and disaggregated architectures have transformed traditional communication networks by separating network control functions from the hardware, catalyzing innovation, and dramatically reducing deployment and operation costs. This paper extends these concepts to Quantum Key Distribution (QKD) networks, emphasizing the importance of virtualizing key management functions with advanced cloud-native technologies for enhanced global interoperability and flexibility. Our approach advocates for a fully disaggregated key management plane supported by softwarization and virtualization technologies, without losing sight of the established standards. The proposed model unlocks multiple benefits, including the facilitation of tailored access control mechanisms for QKD network administrators, the ability to apply real-time performance monitoring and base the control and management of the network on the gathered data, as well as conducting different key generation Quality of Service (QoS) admission control mechanisms on the QKD network. Moreover, a disaggregated model of the key management functions facilitates the implementation of different strategies for cross-domain collaboration between QKD network providers, as well as continuous key provisioning even in the midst of quantum infrastructure outages. The model has been validated through experiments in a virtualized environment, leveraging software tools to create customizable digital twins of QKD networks.
Softwarization and disaggregated architectures have transformed traditional communication networks by separating network control functions from the hardware, catalyzing innovation, and dramatically reducing deployment and operation costs. This paper extends these concepts to Quantum Key Distribution (QKD) networks, emphasizing the importance of virtualizing key management functions with advanced cloud-native technologies for enhanced global interoperability and flexibility. Our approach advocates for a fully disaggregated key management plane supported by softwarization and virtualization technologies, without losing sight of the established standards. The proposed model unlocks multiple benefits, including the facilitation of tailored access control mechanisms for QKD network administrators, the ability to apply real-time performance monitoring and base the control and management of the network on the gathered data, as well as conducting different key generation Quality of Service (QoS) admission control mechanisms on the QKD network. Moreover, a disaggregated model of the key management functions facilitates the implementation of different strategies for cross-domain collaboration between QKD network providers, as well as continuous key provisioning even in the midst of quantum infrastructure outages. The model has been validated through experiments in a virtualized environment, leveraging software tools to create customizable digital twins of QKD networks.
The advent of softwarization and disaggregated architectures has transformed modern communication networks, sparking innovation by separating network functionalities from the underlying hardware. Following this trend, in future quantum networks, the virtualization and softwarization of critical components will be essential to achieve global interoperability and enhance adaptability. Virtualization allows for the abstraction of hardware resources, making it easier to manage and scale networks dynamically, while softwarization promotes flexibility, reconfigurability, and interoperability by enabling the use of standardized, software-defined protocols that can be easily updated and modified to work across diverse and evolving network environments. In this paper, we introduce and examine an operational model for QKD networks that leverages the virtualization of control and key management functionalities. We detail its elements and procedures to optimize QKD services. The design paves the way for the integration of quantum network with functions already established in modern mobile networks while adhering to established QKD network standards. The proposed operational model has been validated at the 5G Telefonica Open Network Innovation Centre (5TONIC) using an environment that deploys digital twins of QKD networks.
The global Internet appears to users as a unified, seamless infrastructure, but in reality, it is composed of multiple interconnected networks: separate domains with different management and policies. This unified behavior is made possible by complexity-hiding mechanisms and inter-domain coordination protocols, which are critical components of modern networking. As we approach a paradigm shift driven by quantum technologies, new challenges and opportunities emerge. Quantum information processing enables capabilities that classical systems cannot achieve, including the potential to compromise public key infrastructures that support today’s network security. Quantum key distribution (QKD) offers a promising avenue by implementing a key agreement protocol that is information-theoretically secure against computational attack. However, to fully leverage QKD, networks must be adapted to the unique constraints of quantum communication, integrating both quantum bit transmission and secure key distribution across multiple domains. This paper discusses the interconnection of quantum key distribution networks (QKDNs) and presents a distributed, standards-aligned orchestration mechanism designed to manage QKD networks spanning multiple administrative domains. Our solution builds on existing QKDN standards to facilitate interoperability and practical deployment in heterogeneous environments and has been validated on a heterogeneous multi-domain network comprising three interconnected autonomous domains.
Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.
There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
Quantum Key Distribution (QKD) has progressed from a theoretical cryptographic concept to an emerging secure communication infrastructure technology. While early work focused on protocol security and physical-layer feasibility, current research increasingly addresses scalable network deployment, hardware acceleration, and integration with classical communication systems. As QKD expands from point-to-point links to metropolitan, backbone, and hybrid satellite–terrestrial networks, new engineering challenges arise in topology design, entropy generation, real-time key distillation, and multi-vendor interoperability. This survey provides an infrastructure-oriented review of QKD networks, examining architectural models, quantum randomness as a root of trust, FPGA and system-on-chip (SoC) based acceleration techniques, and programmable control-plane integration. Key management system architectures and standardized interfaces are analyzed to highlight their roles in enabling scalable, interoperable deployments. The paper also synthesizes major standardization efforts and deployment initiatives shaping carrier-grade QKD infrastructures. Finally, open engineering challenges, including scalability, control-plane integration, certification harmonization, and hybridization with post-quantum cryptography, are identified, positioning QKD as a foundational component of next-generation secure communication systems.