The rise of quantum computers threatens public key security and its essential role in distributing symmetric keys. QKD offers a promising solution by leveraging quantum principles for secure key distribution between two points. To enable network-wide key distribution, two candidate architectures have emerged: Relayed QKD which relays neighboring generated keys along a path, and Switched QKD which uses optical switches to dynamically connect QKD devices and create key generation sessions between nodes. Both architectures require algorithmic solutions for effective key management and distribution. In prior work, we derived for uniform ring topologies optimal configurations and analytical formulas for keys consumption and compared the Switched and Relayed architectures. In this study, we extend that work by introducing scheduling and key management algorithms for arbitrary topologies and use them to compare these two architectures in non-uniform rings. Our findings reinforce previous conclusions: Switched QKD is more effective for dense (large number of nodes and short distances) networks, such as metropolitan rings, while Relayed QKD outperforms in larger rings with longer distances.
The rise of quantum computers threatens public key security and its essential role in distributing symmetric keys. QKD offers a promising solution by leveraging quantum principles for secure key distribution between two points. To enable network-wide key distribution, two candidate architectures have emerged: Relayed QKD which relays neighboring generated keys along a path, and Switched QKD which uses optical switches to dynamically connect QKD devices and create key generation sessions between nodes. Both architectures require algorithmic solutions for effective key management and distribution. In prior work, we derived for uniform ring topologies optimal configurations and analytical formulas for keys consumption and compared the Switched and Relayed architectures. In this study, we extend that work by introducing scheduling and key management algorithms for arbitrary topologies and use them to compare these two architectures in non-uniform rings. Our findings reinforce previous conclusions: Switched QKD is more effective for dense (large number of nodes and short distances) networks, such as metropolitan rings, while Relayed QKD outperforms in larger rings with longer distances.
The rise of quantum computers threatens public-key cryptography and its foundational role in secure symmetric key distribution. Quantum Key Distribution (QKD) offers a promising alternative, leveraging quantum principles to securely distribute keys between two endpoints. To enable network-wide key distribution, two main architectures have emerged: Relayed QKD, which forwards keys generated between neighbors along a path, and Switched QKD, which uses optical switches to dynamically establish QKD links between nodes for scheduled key generation sessions. Both architectures require algorithmic solutions for efficient key management and distribution. We present optimal configurations and analytical formulas for uniform rings and compare the performance of the two architectures. We also define generic key management algorithms and apply them to compare the two architectures in non-uniform rings. Our findings are consistent across both uniform and non-uniform rings: Switched QKD is more effective in dense networks (i.e., with many nodes and short distances), while Relayed QKD performs better in larger rings with longer inter-node distances.
We evaluate the performance of two architectures for network-wide quantum key distribution (QKD): Relayed QKD, which relays keys over multi-link QKD paths for non-adjacent nodes, and Switched QKD, which uses optical switches to dynamically connect arbitrary QKD modules to form direct QKD links between them. An advantage of Switched QKD is that it distributes quantum keys end-to-end, whereas Relayed relies on trusted nodes. However, Switched depends on arbitrary matching of QKD modules. We first experimentally evaluate the performance of commercial DV-QKD modules; for each of three vendors we benchmark the performance in standard/matched module pairs and in unmatched pairs to emulate configurations in the Switched QKD network architecture. The analysis reveals that in some cases a notable variation in the generated secret key rate (SKR) between the matched and unmatched pairs is observed. Driven by these experimental findings, we conduct a comprehensive theoretical analysis that evaluates the network wide performance of the two architectures. Our analysis is based on uniform ring networks, where we derive optimal key management configurations and analytical formulas for the achievable consumed SKR. We compare network performance under varying ring sizes, QKD link losses, QKD receivers' sensitivity and performance penalties of unmatched modules. Our findings indicate that Switched QKD performs better in dense rings (short distances, large node counts), while Relayed QKD is more effective in longer distances and large node counts. Moreover, we confirm that unmatched QKD modules penalties significantly impact the efficiency of Switched QKD architecture.
With the advent of powerful quantum computers, an emerging quantum-resilient security mechanism within existing networks is crucial. Thus, Quantum Key Distribution (QKD), which generates symmetric secret keys with Information-Theoretical Security (ITS) for secure point-to-point communication, is present as a solution. Despite QKD’s potential, its deployment is challenging due to significant investment and infrastructure requirements. Using state-of-the-art technology, the maximum distance between nodes is limited to hundreds of kilometers, necessitating multiple nodes to relay keys. For now, QKD Network (QKDN) relies on software-defined networking (SDN) and a central orchestrator, but this centralized approach has limitations. Hence, the main challenge is to select an efficient path between key relays to avoid communication failure. To address these challenges, a more distributed approach could be envisioned. In this paper, we propose to leverage one of the distributed routing protocols, OSPF, to redefine and improve the current architecture. We propose a novel QKDN-based OSPF (Open Shortest Path First) architecture for efficient key relay routing, offering a completely different dimension to the overall network management: we modify QKDN architecture to exploit the OSPF networks and present a QKD-enabled OSPF version capable of computing the best path for key relay, offering a cost-effective and scalable solution for widespread QKD adoption.
Quantum Key Distribution (QKD) is a technique for sharing encryption keys between two adjacent nodes in an unconditionally secure manner based on quantum theory. From the viewpoint of network system research, QKD is considered to be a building block for providing secure link communication in network systems. Although the communication distance is subject to a limitation attributable to the QKD fundamentals, recent research and some QKD field trials of “key relaying” over a “QKD network” are overcoming this limitation. It also enables each node on the QKD network to exchange encryption keys with arbitrary nodes on the QKD network. However, the previous research didn't address a routing method on the QKD network in detail. This paper focuses on the routing issues on the QKD network, clarifies the requirements of the routing protocol, and proposes a routing solution designed for the key relaying on the QKD network. The proposed routing solution consists of 4 components: (1) a node interface architecture addressing both encrypted and unencrypted traffics, (2) a path selection algorithm based on the number of keys, (3) an IP address assignment scheme connecting unencrypted interfaces and encrypted interfaces, and (4) a routing protocol deployment method consuming no extra keys. The proposed routing solution allows the QKD network to select a suitable key relaying path according to the QKD system condition and to reduce the extra key consumption, which optimizes the key utilization on the QKD network. The proposed routing solution was implemented with a network emulating QKD technology and evaluated. The evaluation result shows that the proposed routing solution could select a path that stores enough keys, which is suitable for a QKD network. Additional impact analysis reveals that the proposed routing solution could save up to 52% of key consumption depending on the QKD key sharing speed and the routing protocol configuration.
Quantum Key Distribution (QKD) has emerged as a promising technology for secure the communication because its security is achieved through the physical laws of quantum mechanics, rather than being based on mathematical problems. In most of the earlier implementations, QKD relied on the direct exchange of the secret keys between two users. Once implemented in a practical system outside of a controlled laboratory setting, QKD experiences complications associated with the limited distances, communication losses, and vulnerabilities to eavesdropping in the multi-user network configurations, compromising its ability to be this third-generation secure communication system. In this work, we show how quantum relay nodes can be implemented as points along a QKD network. The relay nodes provide additional advantages such as extending the communication distances, increasing eavesdropping resistance and allowing for more sophisticated configurations. While relying on theoretical models and experimentally motivated studies, this paper discusses advantages of implementing a relay architecture into a QKD network and highlights technical difficulties that need to be addressed prior to widespread implementation.
Secure communication makes the widespread use of telecommunication networks and services possible. With the constant progress of computing and mathematics, new cryptographic methods are being diligently developed. Quantum Key Distribution (QKD) is a promising technology that provides an Information-Theoretically Secure (ITS) solution to the secret-key agreement problem between two remote parties. QKD networks based on trusted relay nodes are built to provide service to a larger number of parties at arbitrary distances. They function as an add-on technology to traditional networks, generating, managing, distributing, and supplying ITS cryptographic keys. Since key resources are limited, integrating QKD network services into critical infrastructures necessitates effective key management. As a result, this article provides a comprehensive review of key management approaches for trusted-relay QKD networks. They are analyzed to facilitate the identification of potential strategies and accelerate the future development of QKD networks.