Quantum key distribution (QKD) is experiencing a rapid increase of interest due to its security advantages in the face of quantum computers. However, typical QKD deployments are point-to-point and limited in terms of distance, which significantly restricts their utilization for end-user applications. To overcome these restrictions, trusted relays are adopted as intermediate nodes to allow the transition to QKD networks (QKDNs), where one of the hallmarks is the key management system. In this work, we investigate different key allocation strategies as a method to enhance the performance of key management systems in QKDN from the perspective of key allocation success rate and key delivery delay. We first describe an upgrade model from classical to QKDN at three distinct network layers—quantum, key management, and service. Then, we propose a novel, to our knowledge, key allocation strategy leveraging the benefits of key storage and relaying as a solution to improve the QKDN performance. To achieve this, our method makes use of end-to-end virtual quantum key pools (VQKPs) implemented between non-adjacent nodes requesting key material. We introduce static and dynamic upper and lower threshold limits at the VQKP level, with the dynamic thresholds adapted according to application demand, to control the key distribution in the network and fill the pools ahead of end-user requests. We demonstrate through simulations that the introduction of thresholds achieves performance enhancement and explain the trade-off between the key allocation success rate and key delivery delay evaluation metrics in comparison with different on-demand key allocation strategies.
Quantum key distribution (QKD) is experiencing a rapid increase of interest due to its security advantages in the face of quantum computers. However, typical QKD deployments are point-to-point and limited in terms of distance, which significantly restricts their utilization for end-user applications. To overcome these restrictions, trusted relays are adopted as intermediate nodes to allow the transition to QKD networks (QKDNs), where one of the hallmarks is the key management system. In this work, we investigate different key allocation strategies as a method to enhance the performance of key management systems in QKDN from the perspective of key allocation success rate and key delivery delay. We first describe an upgrade model from classical to QKDN at three distinct network layers—quantum, key management, and service. Then, we propose a novel, to our knowledge, key allocation strategy leveraging the benefits of key storage and relaying as a solution to improve the QKDN performance. To achieve this, our method makes use of end-to-end virtual quantum key pools (VQKPs) implemented between non-adjacent nodes requesting key material. We introduce static and dynamic upper and lower threshold limits at the VQKP level, with the dynamic thresholds adapted according to application demand, to control the key distribution in the network and fill the pools ahead of end-user requests. We demonstrate through simulations that the introduction of thresholds achieves performance enhancement and explain the trade-off between the key allocation success rate and key delivery delay evaluation metrics in comparison with different on-demand key allocation strategies.
Quantum key distribution (QKD) is a symmetric key exchange mechanism designed to enhance the security of current communication systems. Although QKD provides unconditional security, it also comes with deployment challenges. One challenge is the distance limitation between the transmitter and receiver, which restricts the large-scale adoption of QKD. To overcome this, trusted relays are used as intermediate nodes, allowing QKD to evolve from distance-limited point-to-point connections to unlimited QKD networks (QKDN). With an increasing deployment of QKD and a growing number of applications requesting keys, quality of service (QoS) constraints must be set for efficient key resource management to alleviate the risk of rejecting application requests. In this work, we integrate key delivery delay and maximum requested key size as QoS constraints in a novel key allocation algorithm built on three QKDN layers – quantum, key management and service. Moreover, we design key relaying using quantum key pools and virtual quantum key pools as storage mechanisms. We use static and dynamic weights for relay path computation and evaluate their impact on the proposed key allocation strategies with QoS constraints and find that static weights show a good overall performance for QKDN, while performance with dynamic weights varies based on historical key consumption data.
Quantum key distribution (QKD) allows the distribution of secret keys for quantum-secure communication between two distant parties, vital in the quantum computing era in order to protect against quantum-enabled attackers. However, overcoming rate-distance limits in QKD and the establishment of quantum key distribution networks necessitate key relaying over trusted nodes. This process may be resource-intensive, consuming a substantial share of the scarce QKD key material to establish end-to-end secret keys. Hence, an efficient scheme for key relaying and the establishment of end-to-end key pools is essential for practical and extended quantum-secured networking. In this paper, we propose and compare two protocols for managing, storing, and distributing secret key material in QKD networks, addressing challenges such as the success rate of key requests, key consumption, and overhead resulting from relaying. We present an innovative, fully decentralized key distribution strategy as an alternative to the traditional hop-by-hop relaying via trusted nodes, where three experiments are considered to evaluate performance metrics under varying key demand. Our results show that the decentralized pre-flooding approach achieves higher success rates as application demands increase. This analysis highlights the strengths of each approach in enhancing QKD network performance, offering valuable insights for developing robust key distribution strategies in different scenarios.
Guaranteeing security and privacy in communication networks is an ever-growing need of our society. As the internet becomes increasingly widespread in everyone’s lives, ensuring that our information is not tampered with or accessible by unauthorised parties is of the utmost importance.Quantum Key Distribution Networks (QKDNs) serve as an extension of current communication networks, and are supported by the laws of quantum physics, which allow for the exchange of secret keys in a theoretically secure way. These keys can then be delivered to an application, which, using an encryption algorithm, allows the intended parties to exchange data.Current implementations of QKDNs are relatively scarce as the technology is still under research and development. Limited link distances and low key generation rates constitute some of the limitations that hinder a broader QKDN implementation. To overcome these limitations, Trusted Relay Nodes (TRNs) and Quantum Key Pools (QKPs) are usually employed. However, the use of TRNs introduces some delays during the process of key delivery. To that end, this work investigates Key Pre-Provisioning (KPP) schemes as a means to enhance QKDN performance.An On-Demand (OD) scheme based on current methods for key relaying was first implemented. This scheme was used as a baseline to compare with KPP schemes. A first variation of KPP, the Pre-provisioning strategy based on Key Flooding (KPP-R), was developed drawing inspiration from existing works. KPP-R reduced key delivery delays but was limited in terms of key routing alternatives. Pre-provisioning strategy variant A (KPP-A) and Pre-provisioning strategy variant B (KPP-B) are proposed as variants of KPP-R, aiming to address some of its shortcomings. Additionally, the impact of very large capacity QKPs was also studied.All key relaying schemes were compared using several performance metrics, such as the probability of a key request being blocked and average key delivery delay. Within the scope of the OD scheme, routing algorithms were previously assessed to determine the most appropriate to use in the context of KPP.
The key flooding protocol in Quantum Key Distribution Networks (QKDNs) is a fully decentralized strategy that proactively distributes key material to pre-establish end-to-end key pools, enabling immediate delivery to clients. We enhance this protocol to increase key availability and overall distribution efficiency. The protocol has been implemented in an in-house developed, fully functional Key Management System (KMS), and the evaluation has been carried out over a Docker-based simulated network with a representative topology, demonstrating practicality and feasibility in realistic deployment scenarios. Experimental results show that, under moderate network load, the enhanced protocol significantly improves key request success rates by up to 5.6 % while authentication overhead is reduced by up to 59 % compared to the baseline flooding approach. The protocol maintains stable performance under stress conditions, preserving robustness against increased traffic.
This article presents a Distributed Key Management System (DKMS) that provisions quantum-safe symmetric encryption keys to applications across a network. To overcome the distance and rate limitations inherent to Quantum Key Distribution (QKD), the architecture adopts a hybrid design: it utilizes multi-hop trusted relays for physical key transport, while applying an end-to-end Post-Quantum Cryptography (PQC) layer to ensure the relayed key material remains strictly protected from intermediate nodes. Because QKD transforms key generation into a scarce physical resource, managing unpredictable application demands poses a critical capacity allocation problem. The core contribution of this work is an SDN-driven control plane that globally orchestrates the network. Rather than relying on vulnerable hop-by-hop capacity reservations, a central controller simultaneously computes optimal filling rates and multipath routing for all per-peer key buffers. This global orchestration ensures that no application is starved and that all key buffers synchronize their filling processes. Evaluated on a Kubernetes-based digital twin across five distinct network topologies, the controller successfully filled all key buffers to capacity in under six minutes. Furthermore, under deliberately excessive demand, the network demonstrated graceful degradation, safely rejecting excess requests through controlled rate-limiting rather than experiencing catastrophic failure.
Quantum Key Distribution (QKD) networks are proposed as a solution to ensure information-theoretic security for symmetric key exchange in post-quantum networks. Key generation is limited and variable, hence Quantum Key Pools (QKPs) have been proposed to allow applications a quicker access to quantum keys for secure data exchange. Nevertheless, On-Demand (OD) key relaying can still entail a delay too large for some applications. Therefore, the concept of key provisioning has been proposed to expedite key supply whenever necessary, resulting in Virtual QKPs for non-adjacent QKD nodes. After the implementation of a key pre-provisioning strategy inspired by an approach proposed by other authors, some novel variants are proposed that aim to decrease demand blocking due to the lack of keys, without significantly increasing the delay for key supply. In this work, an experimental study is conducted, where different settings are considered for the simulation parameters (including the QKP capacity). We conclude that the different pre-provisioning strategies allow for a reduction in the blocking probability (calculated for demands and for data) and in the delay, when compared to an OD strategy.