In recent years, multi-hop Quantum Key Distribution (QKD) network has been proven as a promising solution through rigorous practices to provide end-to-end key exchange service for arbitrary communication parties. However, existing decentralized solutions still face critical challenges including consistency and fairness that stem from storable nature of quantum key material. Thus, in this paper, we first devise a Key Management and Service (KM&S) framework for decentralized multi-hop QKD networks, which provides functional decoupling and pipeline processing to guarantee flexibility and compatibility for practical implementation. After that, to address consistency and fairness challenges during end-to-end key exchange service, we focus on two aspects including local key management and end-to-end congestion control, and respectively propose an elastic key supply rate control scheme named AUTO and a Capacity Probing-driven Backpressure Flow Control (CP-BFC) scheme. Furthermore, we construct an experiment platform equipped with realistic QKD devices based on China metropolitan QKD network topology to implement the proposed framework and schemes, and conduct extensive experiments compared to representative schemes in existing studies. The experimental results show that AUTO&CP-BFC significantly outperforms representative schemes in terms of consistency and fairness.
In recent years, multi-hop Quantum Key Distribution (QKD) network has been proven as a promising solution through rigorous practices to provide end-to-end key exchange service for arbitrary communication parties. However, existing decentralized solutions still face critical challenges including consistency and fairness that stem from storable nature of quantum key material. Thus, in this paper, we first devise a Key Management and Service (KM&S) framework for decentralized multi-hop QKD networks, which provides functional decoupling and pipeline processing to guarantee flexibility and compatibility for practical implementation. After that, to address consistency and fairness challenges during end-to-end key exchange service, we focus on two aspects including local key management and end-to-end congestion control, and respectively propose an elastic key supply rate control scheme named AUTO and a Capacity Probing-driven Backpressure Flow Control (CP-BFC) scheme. Furthermore, we construct an experiment platform equipped with realistic QKD devices based on China metropolitan QKD network topology to implement the proposed framework and schemes, and conduct extensive experiments compared to representative schemes in existing studies. The experimental results show that AUTO&CP-BFC significantly outperforms representative schemes in terms of consistency and fairness.
The key flooding protocol in Quantum Key Distribution Networks (QKDNs) is a fully decentralized strategy that proactively distributes key material to pre-establish end-to-end key pools, enabling immediate delivery to clients. We enhance this protocol to increase key availability and overall distribution efficiency. The protocol has been implemented in an in-house developed, fully functional Key Management System (KMS), and the evaluation has been carried out over a Docker-based simulated network with a representative topology, demonstrating practicality and feasibility in realistic deployment scenarios. Experimental results show that, under moderate network load, the enhanced protocol significantly improves key request success rates by up to 5.6 % while authentication overhead is reduced by up to 59 % compared to the baseline flooding approach. The protocol maintains stable performance under stress conditions, preserving robustness against increased traffic.
Quantum key distribution (QKD) allows the distribution of secret keys for quantum-secure communication between two distant parties, vital in the quantum computing era in order to protect against quantum-enabled attackers. However, overcoming rate-distance limits in QKD and the establishment of quantum key distribution networks necessitate key relaying over trusted nodes. This process may be resource-intensive, consuming a substantial share of the scarce QKD key material to establish end-to-end secret keys. Hence, an efficient scheme for key relaying and the establishment of end-to-end key pools is essential for practical and extended quantum-secured networking. In this paper, we propose and compare two protocols for managing, storing, and distributing secret key material in QKD networks, addressing challenges such as the success rate of key requests, key consumption, and overhead resulting from relaying. We present an innovative, fully decentralized key distribution strategy as an alternative to the traditional hop-by-hop relaying via trusted nodes, where three experiments are considered to evaluate performance metrics under varying key demand. Our results show that the decentralized pre-flooding approach achieves higher success rates as application demands increase. This analysis highlights the strengths of each approach in enhancing QKD network performance, offering valuable insights for developing robust key distribution strategies in different scenarios.
Secure communication makes the widespread use of telecommunication networks and services possible. With the constant progress of computing and mathematics, new cryptographic methods are being diligently developed. Quantum Key Distribution (QKD) is a promising technology that provides an Information-Theoretically Secure (ITS) solution to the secret-key agreement problem between two remote parties. QKD networks based on trusted relay nodes are built to provide service to a larger number of parties at arbitrary distances. They function as an add-on technology to traditional networks, generating, managing, distributing, and supplying ITS cryptographic keys. Since key resources are limited, integrating QKD network services into critical infrastructures necessitates effective key management. As a result, this article provides a comprehensive review of key management approaches for trusted-relay QKD networks. They are analyzed to facilitate the identification of potential strategies and accelerate the future development of QKD networks.
Quantum Key Distribution (QKD) networks enable unconditionally secure key exchange using quantum mechanical principles. However, routing cryptographic keys across multi-hop quantum networks introduces challenges unique to quantum communication. This survey analyzes and classifies 26 routing strategies proposed between 2013 and 2024 for terrestrial, satellite, and hybrid QKD infrastructures. Dynamic, key-aware routing algorithms have been shown to reduce service rejection rates by 25-40% compared to static shortest-path methods by incorporating real-time key pool availability and link error rates. Multi-path strategies improve resilience against trusted-node compromise by distributing keys across disjoint routes, albeit with an increase in key consumption of 30-60%. SDN-based orchestration frameworks emerge as essential enablers of flexible, QoS-aware routing for hybrid networks integrating terrestrial fibers and intermittent satellite links. Critical research directions include reducing dependence on trusted nodes through quantum repeaters or post-quantum cryptography, developing standardized key management interfaces for interoperability, and adopting AI-driven predictive routing for adapting to fluctuating network states. This comprehensive synthesis of routing algorithms, performance trade-offs, and unresolved issues offers practical guidance for engineering secure, adaptable, and large-scale QKD networks capable of meeting real-world deployment demands.
The European Quantum Communication Infrastructure (EuroQCI) initiative is fostering the deployment of national quantum key distribution (QKD) testbeds across the European Union. In this context, we report on the design, implementation, and evaluation of the Austrian testbed, with a particular focus on advances in key management and applicationlevel integration of QKD. First, we introduce a hybrid key management system (KMS) that combines QKD-derived keys in a decentralized architecture with post-quantum authenticated key exchange, enabling end-to-end hybrid keys while reducing trust assumptions in intermediate nodes. Second, we present three QKD-enabled applications: (i) a secure secret-sharing-based storage system leveraging QKD-protected share distribution, (ii) a QKD-integrated extension of Jitsi employing ETSI GS QKD 014 group keys to reduce overhead in multi-party communication, and (iii) a hybrid QKD/PQC WireGuard-based VPN enabling QKD-secured HSM backup operations without requiring modifications to proprietary HSM protocols. Finally, we describe the deployment of these solutions in a national network comprising a four-node metropolitan testbed and a 200 km long-distance link with trusted nodes, and provide performance measurements for both the network and the hybrid KMS. Together, these results demonstrate the feasibility of integrating QKD into heterogeneous applications and hybrid cryptographic infrastructures.
Quantum Key Distribution (QKD) networks allow multiple users to generate and share secret quantum keys with unconditional security. Although many schemes of QKD networks have been presented, they are only concentrated on the system realization and physical implementations. For the complete practical quantum network, a succinct theoretic model that systematically describes the working processes from physical schemes to key process protocols, from network topology to key management, and from quantum communication to classical communication is still absent. One would hope that research and experience have shown that there are certain succinct model in the design of communication network. With demonstration of the different QKD links and the four primary types of quantum networks including probability multiplexing, wavelength multiplexing, time multiplexing and quantum multiplexing, we suggest a layer model for QKD networks which will be compatible with different implementations and protocols. We divide it into four main layers by their functional independency while defining each layer's services and responsibilities in detail, orderly named quantum links layer, quantum networks layer, quantum key distribution protocols process layer, and keys management layer. It will be helpful for the systematic design and construction of real QKD networks.