Many modern applications rely on the ability to offload computation-intensive tasks to edge or cloud infrastructures. While this is clearly beneficial from the point of view of the client, because of the decreased load and system requirements, such an approach entails frequent exchanges with the edge/cloud application, which may include sensitive data. The interconnection of the client and remote infrastructures through a Quantum Key Distribution (QKD) network makes it possible to exchange quantum-secure keys between the peer applications. In this paper we study how to achieve this ambitious goal with applications using the Function-as-a-Service (FaaS) programming model in the context of ETSI MEC and QKD standards, as demonstrated in the national project QUANCOM, funded by the Italian Ministry of University and Research.
Many modern applications rely on the ability to offload computation-intensive tasks to edge or cloud infrastructures. While this is clearly beneficial from the point of view of the client, because of the decreased load and system requirements, such an approach entails frequent exchanges with the edge/cloud application, which may include sensitive data. The interconnection of the client and remote infrastructures through a Quantum Key Distribution (QKD) network makes it possible to exchange quantum-secure keys between the peer applications. In this paper we study how to achieve this ambitious goal with applications using the Function-as-a-Service (FaaS) programming model in the context of ETSI MEC and QKD standards, as demonstrated in the national project QUANCOM, funded by the Italian Ministry of University and Research.
Edge computing is a leading trend in the deployment of computation and networking infrastructures, where processing is done closer to the users, compared to more traditional cloud-based solutions relying on remote data centers. On the other hand, Quantum Key Distribution (QKD) technologies, offering unconditional security between the communicating parties, is expected to become affordable in the near future and it will unlock new opportunities, e.g., for applications with long-term confidentiality requirements. In this paper we study how to enable ETSI ISG QKD key delivery within an ETSI MEC edge computing scenario, in the practical use case of cloud-native applications based on Function-as-a-Service (FaaS). This work is part of the activities of the PON project “Development of quantum systems and technologies for IT security in communication networks” (QUANCOM) which aims to the realization of a metropolitan quantum communication network through the collaboration between universities, research centers and companies operating in the communication market area.
In this demonstration, we showcase the realization of a prototype of an edge computing network, where the client and edge domains both host simulated Quantum Key Distribution devices, for a hospital use case. In particular, digital health applications using the Function-as-a-Service (FaaS) paradigm will invoke remote functions provided by an Apache OpenWhisk cluster deployed in the edge infrastructure, where the arguments and return value are encrypted using keys generated through an underlying simulated QKD point-to-point network. All the interactions in the control/management plane are handled through standard interfaces defined by the ETSI MEC and QKD industry study groups.
The advent of distributed computing systems will offer great flexibility for application workloads, while also imposing more attention to security, where the future advent and adoption of quantum technology can introduce new security threats. For this reason, the Multi-access Edge Computing (MEC) working group at ETSI has recently started delving into security aspects, especially motivated by the upcoming reality of the MEC federation, which involves services made of application instances belonging to different systems (thus, different trust domains). On the other side, Quantum Key Distribution (QKD) can help strengthen the level of security by enabling the exchange of secure keys through an unconditionally secure protocol, e.g., to secure communication between REST clients and servers in distributed computing systems at the edge. In this paper, we propose a technical solution to achieve this goal, building on standard specifications, namely ETSI MEC and ETSI QKD, and discussing the gaps and limitations of current technology, which hamper full-fledged in-field deployment and mass adoption. Furthermore, we provide our look-ahead view on the future of secure distributed computing through the enticing option of federating edge computing domains.
Quantum Key Distribution (QKD) is a rising field of research that aims at solving a very common problem in computer security: the problem of cryptographic key exchange. Nowadays, key distribution problem is solved leveraging algorithms that allow to dynamically generate common secrets starting from shared information. For these algorithms security lies in the difficulty for an adversary to compute mathematical operations needed to recover the generated secret. Nevertheless, advent of quantum computers represents a huge concern for classical security, since it has been proved capable of solving these operations in polynomial time. QKD represents a possible solution to this problem, since it allows to exchange keys between two distant parties in a way that is considered secure against both classical and quantum attacks. Recent studies focus their attention on protocols and technologies needed to improve QKD between two parties, with little attention to practical integration in real contexts. This work proposes a different approach: QKD is here used in a softwarised network in order to be accessed from different security services or applications that may need it. The goal of this work is to outline main challenges that need to be faced when distributing QKD as a service for multiple clients. A QKD simulator has been developed to understand limits and characteristics of different protocols in such an environment. On the top of it, QKD ETSI standard has been implemented in order to realise a key server capable of distributing quantum distributed keys to different clients. The proposed work provides a new perspective, in which QKD can be used in cloud environments without taking care about the implementation complexity that it carries with it. Moreover, it outlines criticalities and challenges that needs to be faced in order to integrate QKD in such a systems.
There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.
Quantum Key Distribution (QKD) promises information-theoretic security, yet integrating QKD into existing protocols like TLS remains challenging due to its fundamentally different operational model. In this paper, we propose a hybrid QKD-KEM protocol with two distinct integration approaches: a client-initiated flow compatible with both ETSI 004 and 014 specifications, and a server-initiated flow similar to existing work but limited to stateless ETSI 014 APIs. Unlike previous implementations, our work specifically addresses the integration of stateful QKD key exchange protocols (ETSI 004) which is essential for production QKD networks but has remained largely unexplored. By adapting OpenSSL’s provider infrastructure to accommodate QKD’s pre-distributed key model, we maintain compatibility with current TLS implementations while offering dual layers of security. Performance evaluations demonstrate the feasibility of our hybrid scheme with acceptable overhead, showing that robust security against quantum threats is achievable while addressing the unique requirements of different QKD API specifications.