International Conference on Quantum Communications, Networking, and Computing (QCNC)
A Security Plane Architecture for Ultra-Low-Energy, High-Capacity Optical Transport Networks
José Manuel Rivas-Moscoso, A. Melgar, Luca Potì, Konstantinos Krilakis, Luis Velasco, Sima Bahrani, Michela Svaluto Moreolo, Idelfonso Tafur Monroy, P. Nguyen, Marc Ruiz, Dimitris Syvridis, Aikaterini Mandilara, A. Pagano, J. Morales, Antonio Pastor, Reza Nejabati, R. Wang, Pantea Nadimi Goki, Alfonso Sánchez‐Macián, Stella Civelli, Simon Rommel, Carlos Rubio García, Masab Iqbal, Romerson Deiny Oliveira, José Crispín Hernández Hernández, David Larrabeiti, Jesús Folgueira
The evolution toward agile, ultra-low-energy, high-capacity optical transport networks can benefit from solutions incorporating multi-band, multi-fiber, and point-to-multipoint (P2MP)/sliceable high-capacity transport technologies carefully designed to simplify network hierarchy and minimize optical-electrical-optical (OED) conversions. To guarantee quantum-secure communications, these networks require a thorough reassessment of their security plane architecture, acting as a transversal plane to the data and control planes. In this paper, we propose a programmable Quantum Key Distribution (QKD) network built upon multi-protocol QKD systems, including entangled QKD for P2MP secure access/metro scenarios, Quantum Random Key Generation (QRNG) modules as alternative entropy sources for links where QKD system deployment is not economically viable, and hybrid classic/QKD/Post-Quantum Cryptography (PQC) primitives for greater flexibility and backward compatibility. Authentication services are performed through physically-unclonable-function (PUF) certification authorities, particularly implementing strong Rayleigh-backscattering-pattern or speckle-pattern-based optical Physically Unclonable Functions (OP-UFs). These security technologies leverage on agnostic key management system (KMS) and quantum digital twin (QDT) assisted performance optimization, e.g. for artificial intelligence (AI)-based State of Polarization (SOP) compensation. Key relay between border nodes is realized by means of a combination of a centralized PUF and a procedure to securely exchange keys between KMSs based on ETSI-014 and PQC. The KMS can feed keys to encryptors implemented at the different data-plane layers, but the proposed architecture favors encryption relying on physical-layer security techniques to align with the above design principle aimed at a flatter network and fewer OEO conversions. Examples of this are Light Path SECurity (LPSec) techniques, consisting of two nested physical ciphers ensuring a high-security level, and all-optical steganography. Coexistence of classical and quantum signals is generally feasible in the access and metro segments, whereas in the backbone segment it needs to be evaluated on a case-by-case basis.
The evolution toward agile, ultra-low-energy, high-capacity optical transport networks can benefit from solutions incorporating multi-band, multi-fiber, and point-to-multipoint (P2MP)/sliceable high-capacity transport technologies carefully designed to simplify network hierarchy and minimize optical-electrical-optical (OED) conversions. To guarantee quantum-secure communications, these networks require a thorough reassessment of their security plane architecture, acting as a transversal plane to the data and control planes. In this paper, we propose a programmable Quantum Key Distribution (QKD) network built upon multi-protocol QKD systems, including entangled QKD for P2MP secure access/metro scenarios, Quantum Random Key Generation (QRNG) modules as alternative entropy sources for links where QKD system deployment is not economically viable, and hybrid classic/QKD/Post-Quantum Cryptography (PQC) primitives for greater flexibility and backward compatibility. Authentication services are performed through physically-unclonable-function (PUF) certification authorities, particularly implementing strong Rayleigh-backscattering-pattern or speckle-pattern-based optical Physically Unclonable Functions (OP-UFs). These security technologies leverage on agnostic key management system (KMS) and quantum digital twin (QDT) assisted performance optimization, e.g. for artificial intelligence (AI)-based State of Polarization (SOP) compensation. Key relay between border nodes is realized by means of a combination of a centralized PUF and a procedure to securely exchange keys between KMSs based on ETSI-014 and PQC. The KMS can feed keys to encryptors implemented at the different data-plane layers, but the proposed architecture favors encryption relying on physical-layer security techniques to align with the above design principle aimed at a flatter network and fewer OEO conversions. Examples of this are Light Path SECurity (LPSec) techniques, consisting of two nested physical ciphers ensuring a high-security level, and all-optical steganography. Coexistence of classical and quantum signals is generally feasible in the access and metro segments, whereas in the backbone segment it needs to be evaluated on a case-by-case basis.
The future security of digital communications will increasingly rely on the integration of Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), indicating a necessary convergence rather than a competitive relationship between these two technologies. Following the publication of NIST FIPS 203, 204 and 205, the industry now possesses standardised algorithmic tools for migrating away from RSA and elliptic-curve cryptography (ECC). At the same time, for critical infrastructure facing “harvest-now, decrypt-later” adversaries, purely software-based measures provide only computational, not information-theoretic, security. We argue that the optimal solution is a hybrid architecture, in which PQC provides authentication and cryptographic agility across heterogeneous endpoints, while QKD supplies an additional physical-layer shield for high-value links. The central engineering challenge is brownfield coexistence: deploying QKD over existing lit telecom fibers that carry high-power classical traffic. We review three spectral coexistence strategies to mitigate Spontaneous Raman Scattering (SpRS) – O-band separation, dense C-band DWDM integration with guard bands, and an “inverted” spectrum approach where data uses the O-band and QKD uses the C-band – and we discuss emerging physical media such as hollow-core and multi-core fibers. At the protocol layer, we discuss hybrid key encapsulation and the role of crypto-agile gateways in combining keys from classical, PQC and QKD sources [1]. Finally, we survey industrial pilots (e.g., SK Telecom, EuroQCI / OPENQKD) and outline open challenges in cost, standardisation and operations. The goal is to provide practitioners with a realistic, engineering-oriented overview of how PQC and QKD can be combined in brownfield optical networks.
Optical communications providing huge capacity and low latency remain vulnerable to a range of attacks. In consequence, encryption at the optical layer is needed to ensure secure data transmission. In our previous work, we proposed LightPath SECurity (LPSec), a secure cryptographic solution for optical transmission that leverages stream ciphers and Diffie-Hellman (DH) key exchange for high-speed optical encryption. Still, LPSec faces limitations related to key generation and key distribution. To address these limitations, in this paper, we rely on Quantum Random Number Generators (QRNG) and Quantum Key Distribution (QKD) networks. Specifically, we focus on three meaningful scenarios: In Scenario A, the two optical transponders (Tp) involved in the optical transmission are within the security perimeter of the QKD network. In Scenario B, only one Tp is within the QKD network, so keys are retrieved from a QRNG and distributed using LPSec. Finally, Scenario C extends Scenario B by employing Post-Quantum Cryptography (PQC) by implementing a Key Encapsulation Mechanism (KEM) to secure key exchanges. The scenarios are analyzed based on their security, efficiency, and applicability, demonstrating the potential of quantum-enhanced LPSec to provide secure, low-latency encryption for current optical communications. The experimental assessment, conducted on the Madrid Quantum Infrastructure, validates the feasibility of the proposed solutions.
Quantum Key Distribution (QKD) has progressed from a theoretical cryptographic concept to an emerging secure communication infrastructure technology. While early work focused on protocol security and physical-layer feasibility, current research increasingly addresses scalable network deployment, hardware acceleration, and integration with classical communication systems. As QKD expands from point-to-point links to metropolitan, backbone, and hybrid satellite–terrestrial networks, new engineering challenges arise in topology design, entropy generation, real-time key distillation, and multi-vendor interoperability. This survey provides an infrastructure-oriented review of QKD networks, examining architectural models, quantum randomness as a root of trust, FPGA and system-on-chip (SoC) based acceleration techniques, and programmable control-plane integration. Key management system architectures and standardized interfaces are analyzed to highlight their roles in enabling scalable, interoperable deployments. The paper also synthesizes major standardization efforts and deployment initiatives shaping carrier-grade QKD infrastructures. Finally, open engineering challenges, including scalability, control-plane integration, certification harmonization, and hybridization with post-quantum cryptography, are identified, positioning QKD as a foundational component of next-generation secure communication systems.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The exponential development of quantum computing represents a serious threat to the existence of the modern cybersecurity infrastructure. Fault-tolerant large-scale quantum computing will be realized roughly five to ten years hence, and will make most of the current standards for asymmetric cryptography-such as RSA and ECC-deviant. While mitigations, such as Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD) offer possible countermeasures, both are hampered by vulnerabilities of their own. Respectively, PQC relies on unproven mathematical hardness assumptions that are always subject to future algorithmic innovations, while QKD is limited by the physical requirements of a dedicated quantum channel.This paper presents a new hybrid protocol which aims to solve these limitations by combining PQC and QKD into a unified design. The proposed scheme will hybridize the secure key resulting from the BB84-based QKD protocol with a second secret derived by using a lattice-based PQC key exchange, using a strong hybrid key derivation function. It deals with a point-to-point transport-layer model, which is in line with the technological limitations of QKD models at present. The implementation would need trusted nodes or quantum repeaters, which are beyond the reach of this implementation. The system is implemented on a dual-channel platform: the quantum channel is used for key distribution and the classical channel is used for PQC negotiation and secure data transmission, all classical communication is authenticated by HMAC. The resulting architecture is a future-proof quantum-safe communication system that will protect government sensitive data, as well as financial and e-commerce enterprises, thus ensuring the transition to a quantum resistant digital society in the face of a catastrophic event that would have a massive financial and societal impact.
The advent of large-scale quantum computing poses critical threats to classical public-key cryptography, raising urgent concerns for mission-critical infrastructures such as power systems. Existing authentication mechanisms—whether based on physical unclonable functions (PUFs), quantum key distribution (QKD), or post-quantum cryptography (PQC)—each offer unique advantages but also face limitations when deployed in isolation. This paper presents a multi-level quantum-resistant authentication methodology that systematically integrates PUF-based device identity, QKD-derived symmetric keys, and PQC-based primitives. To unify these heterogeneous sources, we design a structured session key fusion mechanism that incorporates entropy preprocessing, cross-layer validation tokens, forward-linked context binding, and dual key derivation functions (KDFs). The resulting session key is inseparably derived from all layers, eliminating single points of failure and enhancing defense against both classical and quantum adversaries. Compared with prior single-layer or loosely coupled approaches, the proposed design achieves defense-in-depth, practical scalability across edge and backbone infrastructures, and alignment with emerging cryptographic standards, providing a secure pathway for next-generation power communication systems.