The advent of softwarization and disaggregated architectures has transformed modern communication networks, sparking innovation by separating network functionalities from the underlying hardware. Following this trend, in future quantum networks, the virtualization and softwarization of critical components will be essential to achieve global interoperability and enhance adaptability. Virtualization allows for the abstraction of hardware resources, making it easier to manage and scale networks dynamically, while softwarization promotes flexibility, reconfigurability, and interoperability by enabling the use of standardized, software-defined protocols that can be easily updated and modified to work across diverse and evolving network environments. In this paper, we introduce and examine an operational model for QKD networks that leverages the virtualization of control and key management functionalities. We detail its elements and procedures to optimize QKD services. The design paves the way for the integration of quantum network with functions already established in modern mobile networks while adhering to established QKD network standards. The proposed operational model has been validated at the 5G Telefonica Open Network Innovation Centre (5TONIC) using an environment that deploys digital twins of QKD networks.
The advent of softwarization and disaggregated architectures has transformed modern communication networks, sparking innovation by separating network functionalities from the underlying hardware. Following this trend, in future quantum networks, the virtualization and softwarization of critical components will be essential to achieve global interoperability and enhance adaptability. Virtualization allows for the abstraction of hardware resources, making it easier to manage and scale networks dynamically, while softwarization promotes flexibility, reconfigurability, and interoperability by enabling the use of standardized, software-defined protocols that can be easily updated and modified to work across diverse and evolving network environments. In this paper, we introduce and examine an operational model for QKD networks that leverages the virtualization of control and key management functionalities. We detail its elements and procedures to optimize QKD services. The design paves the way for the integration of quantum network with functions already established in modern mobile networks while adhering to established QKD network standards. The proposed operational model has been validated at the 5G Telefonica Open Network Innovation Centre (5TONIC) using an environment that deploys digital twins of QKD networks.
Softwarization and disaggregated architectures have transformed traditional communication networks by separating network control functions from the hardware, catalyzing innovation, and dramatically reducing deployment and operation costs. This paper extends these concepts to Quantum Key Distribution (QKD) networks, emphasizing the importance of virtualizing key management functions with advanced cloud-native technologies for enhanced global interoperability and flexibility. Our approach advocates for a fully disaggregated key management plane supported by softwarization and virtualization technologies, without losing sight of the established standards. The proposed model unlocks multiple benefits, including the facilitation of tailored access control mechanisms for QKD network administrators, the ability to apply real-time performance monitoring and base the control and management of the network on the gathered data, as well as conducting different key generation Quality of Service (QoS) admission control mechanisms on the QKD network. Moreover, a disaggregated model of the key management functions facilitates the implementation of different strategies for cross-domain collaboration between QKD network providers, as well as continuous key provisioning even in the midst of quantum infrastructure outages. The model has been validated through experiments in a virtualized environment, leveraging software tools to create customizable digital twins of QKD networks.
Quantum technologies promise major advances in different areas. From computation to sensing or telecommunications, quantum implementations could bring significant improvements to these fields, arousing the interest of researchers, companies, and governments. In particular, the deployment of Quantum Key Distribution (QKD) networks, which enable the secure dissemination of cryptographic keys to remote application entities following Quantum Mechanics Principles, appears to be one of the most attractive and relevant use cases. Quantum devices and equipment are still in a development phase, making their availability low and their price high, hindering the deployment of physical QKD networks and, therefore, the research and experimentation activities related to this field. In this context, this paper focuses on providing research stakeholders with an open-access testbed where it is feasible to emulate the deployment of QKD networks, thus enabling the execution of experiments and trials, where even potential network attacks can be analyzed, without the quantum physical equipment requirement, nor compromising the integrity of an already built QKD network. The designed solution allows users to automatically deploy, configure, and run a digital twin environment of a QKD network, offering cost-effectiveness and great flexibility in the study of the integration of quantum communications in the current network infrastructures. This solution is aligned with the European Telecommunications Standard Institute (ETSI) standardized application interface for QKD, and is built upon open-source technologies. The feasibility of this solution has been validated throughout several functional trials carried out in the 5G Telefónica Open Network Innovation Centre (5TONIC), verifying the service performance in terms of speed and discarded qubits when generating the quantum keys.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
Monitoring mechanisms are essential in modern telecommunications networks, ensuring reliability, performance, and security by continuously tracking network health and status. These mechanisms enable real-time anomaly detection and response, allowing for fast intervention and dynamic optimization of network resources. To advance Quantum Key Distribution (QKD) networks toward becoming a mainstream service within current telecommunication infrastructures, comprehensive monitoring mechanisms must be available. This paper explores the integration of such a monitoring approach for QKD. Leveraging a recently proposed model that utilizes virtualization to create an abstraction layer over the highly heterogeneous array of quantum and classical hardware, this monitoring mechanism offers significant advantages. These include the continuous provisioning of real-time data and traffic statistics on network segments, as well as the detection of potential attacks or failures on critical network elements, enabling dynamic, data-driven routing, operations, and management. The proposed monitoring strategy, which incorporates both passive and active measurements, enables proactive and immediate actions when any network irregularity is detected. Beyond detailing the monitoring mechanism, we demonstrate its feasibility through a virtual environment test, validating its effectiveness in a controlled setting.
There is a great attention to quantum technologies in the ICT environment. In particular, when dealing with security matters, the most prominent quantum technology is Quantum Key Distribution (QKD). QKD allows the sharing of symmetric keys with information theoretic security (ITS, i.e. independently of the computational power of the attacker) between two remote network nodes. QKD is the only known method to share a key able to reach ITS. During the last two decades, there has been a tremendous technological progress in QKD research, that has led to the availability of QKD network demonstrators.Software Defined Networks (SDN) enables the automation of service provisioning within network operator infrastructures. With the advent of web-scale services and dynamic network requirements, operators can not anymore deploy their services based on manual intervention or using proprietary vendor solutions. Programmability is key in the next-generation network infrastructure and any new technology must be integrated with this paradigm. Let us highlight that this requirement is even more important with virtual environments, where a Virtual Network Function (VNF) can be deployed in any point-of-presence of the operator. The new 5G deployments will enable operators to have edge computing services supporting different capabilities, thus increasing even more the complexity to deliver services without any automation.In spite of the high potential of QKD, this technology has not yet found its path to wide adoption, commercialization and deployment. QKD is a physical technology that requires the existence of a quantum channel, a physical connection able to transmit quantum bits without perturbation, making hard its integration in networks. The aim of this document is to present how QKD can be deployed in next generation infrastructures, based on realistic scenarios. To do so, this paper describes the technological components of the solutions, as well as the use cases that motivate such effort. These use cases are described from a telecommunication provider's point of view, as they are the actors in charge of deploying QKD systems in their networks.
The nature of network services has drastically changed in recent years. New demands require new capabilities, forcing the infrastructure to dynamically adapt to new scenarios. Novel network paradigms, such as software-defined networking (SDN) and network functions virtualization, have appeared to provide flexibility for network management and services. The reliance on software and commoditized hardware of these new paradigms introduces new security threats and, consequently, one of the most desired capabilities is a strengthened security layer when connecting remote premises. On the other hand, traditional cryptographic protocols are based on computational complexity assumptions. They rely on certain mathematical problems (e.g., integer factorization, discrete logarithms, or elliptic curves) that cannot be efficiently solved using conventional computing. This general assumption is being revisited because of quantum computing. The creation of a quantum computer would put these protocols at risk and force a general overhaul of network security. Quantum key distribution (QKD) is a novel technique for providing synchronized sources of symmetric keys between two separated domains. Its security is based on the fundamental laws of quantum physics, which makes it impossible to copy the quantum states exchanged between both endpoints. Therefore, if implemented properly, QKD generates highly secure keys, immune to any algorithmic cryptanalysis. This work proposes a node design to provide QKD-enhanced security in end-to-end services and analyze the control plane requirements for service provisioning in transport networks. We define and demonstrate the necessary workflows and protocol extensions in different SDN scenarios, integrating the proposed solution into a virtual router providing QKD-enhanced IPsec sessions.