International Conference on Military Communications and Information Systems (ICMCIS)
DISCRETION: First Field Demonstration of a Quantum Enabled SDN in the Context of a Military Exercise
Catarina Bastos, Francisco Pinto, Rodrigo Bacar, Gustavo Anjos, Margarida Almeida, Armando N. Pinto, Ricardo Chaves, Tiago M. Dias, Joana Afonso, Rui Calé, Miguel Borges de Freitas, Luis Maia, Luis Magalhães, Alejandro Muñiz, Rafael Cantó, Juan P. Brito, Jesús Ballesta, Ruben B. Méndez, Stephan Laschet, Sebastian Ramacher, Paul James, Luca Torresetti, Pietro Piscione, Ahmed K Abdulwahed, Pietro G. Giardina, Vicente Martín, Laura Ortíz, Antonio Pastor, Nelson Jesus Muga, Nuno A. Silva, Diego R. Lopez, Margarida Vieira, Carmen Escribano, Luis Mengal
The DISCRETION project aims at the development of a prototype of a Quantum Key Distribution (QKD) integrating a Software Defined Network (SDN) solution providing quantum-safe secure communications capabilities, in a way that European Defence can benefit from the flexibility, security, and resilience that these technologies bring to the communication networks. DISCRETION integrates these disruptive technologies within a red-black network separation principle, in compliance with the doctrine of military network segregation. The encryption and protection of all data between red and black networks is realized through dedicated hardware hardened Cipher Machines (CM) using the keys obtained from QKD systems integrated by the SDN and a Key Management System (KMS). Both SDN and KMS were developed in DISCRETION in compliance with the ETSI GS QKD015 and QKD004 standards. We explore the Continuous-Variables (CV) QKD technology, which is currently regarded as one of the main building blocks for large-scale deployment of quantum cryptography, since it facilitates coexistence with traditional optical networks, using classical photonics platforms. In this work, we present a field live demonstration of the DISCRETION project in the context of the Robotic Experimentation and Prototyping using Maritime Uncrewed Systems (REPMUS 24) organized annually by the Portuguese Navy and NATO. We also show how Software Defined Radios (SDR) can be securely connected to the DISCRETION's system from various locations to get a set of keys generated and distributed by a CV-QKD Network and use them for encrypted communications in a mission. Finally, we show how we can use the quantum generated keys to feed CM to protect red side messages sent through unsafe black network connections.
The DISCRETION project aims at the development of a prototype of a Quantum Key Distribution (QKD) integrating a Software Defined Network (SDN) solution providing quantum-safe secure communications capabilities, in a way that European Defence can benefit from the flexibility, security, and resilience that these technologies bring to the communication networks. DISCRETION integrates these disruptive technologies within a red-black network separation principle, in compliance with the doctrine of military network segregation. The encryption and protection of all data between red and black networks is realized through dedicated hardware hardened Cipher Machines (CM) using the keys obtained from QKD systems integrated by the SDN and a Key Management System (KMS). Both SDN and KMS were developed in DISCRETION in compliance with the ETSI GS QKD015 and QKD004 standards. We explore the Continuous-Variables (CV) QKD technology, which is currently regarded as one of the main building blocks for large-scale deployment of quantum cryptography, since it facilitates coexistence with traditional optical networks, using classical photonics platforms. In this work, we present a field live demonstration of the DISCRETION project in the context of the Robotic Experimentation and Prototyping using Maritime Uncrewed Systems (REPMUS 24) organized annually by the Portuguese Navy and NATO. We also show how Software Defined Radios (SDR) can be securely connected to the DISCRETION's system from various locations to get a set of keys generated and distributed by a CV-QKD Network and use them for encrypted communications in a mission. Finally, we show how we can use the quantum generated keys to feed CM to protect red side messages sent through unsafe black network connections.
In military contexts, information and communication services are critical, relying on secure and robust infrastructures. However, current network architectures in defense are often static and inflexible. Software-Defined Networking offers significant advantages in terms of flexibility, agility, net-work management, and operational costs. These properties are essential in dynamic environments, and SDN technology can further enhance these benefits by incorporating Software-Defined Radio technologies, which are highly used in defense environments. Additionally, SDN networks can ensure redundancy and resilience against failures. The adoption of SDN facilitates the flexible integration of Quantum Key Distribution networks, which provide an inherently secure method for cryptographic key distribution across network nodes. However, current QKD implementations face limitations in scope and flexibility, as they are generally based on fixed, point-to-point connections and static infrastructure. Together, SDN and QKD present synergistic benefits: SDN enables a flexible QKD network with enhanced control and monitoring capabilities, while QKD ensures secure communication even against quantum threats within the SDN architecture. The DISCRETION project develops an SDN solution integrating QKD capabilities for secure communications, enhancing European defense capabilities through these advanced technologies. Cipher Machines within DISCRETION assure the red-black network segregation, an essential feature in military networks. This is provided by enabling real-time encryption and decryption using keys supplied by the SDN-QKD layer, alongside pre-shared keys. For mobility and tactical scenarios, SDR solutions are evaluated and incorporated into the SDN solution to support radio network segments and ensure secure communications in mobile contexts. The proposed DISCRETION solution was deployed at the REPMUS 2024 defense event, yielding notable results.
As quantum computers advance, they pose a growing threat to traditional encryption methods that protect sensitive information. Quantum Key Distribution (QKD) offers a secure alternative by using quantum mechanics to create shared secret keys whose interception can be detected. Integrating this technology into existing networks is essential to enable quantum-safe communications without requiring new infrastructure. This dissertation explores how Continuous-Variable Quantum Key Distribution (CV-QKD) systems can be integrated into current network infrastructures. It discusses relevant models, architectures, and standards that support this integration, focusing on how the SoftwareDefined Networking (SDN) model can standardize and simplify communication between QKD systems and traditional networks.
Future optical networks, envisioning the support of 6G services and related demanding requirements, should provide ultra-high-capacity and reliable connectivity, ensuring sustainability and security. Quantum key distribution (QKD) is a technology to address the limitations of classical cryptography, enabling quantum secure communications. Continuous variable QKD (CV-QKD) offers potential cost savings and enhanced compatibility with classical systems. This facilitates the integration within the network infrastructure, particularly in synergy with software-defined networking (SDN), further promoting interoperability and resource sharing/saving. For the adoption and practical implementation of CV-QKD, it is relevant to consider composable security and a finite number of symbols employed in the protocol (block size). In this work, we present the comparison of two models, to provide a figure of the required block size. We also assess the results using a simulation software. Furthermore, we explore a coexistence scenario considering a flexible grid, to exploit the CV-QKD capability of arbitrarily tuning the operating wavelength. This is a relevant feature enabling flexible allocation of the quantum channel to mitigate impairment and saving spectral resources. Considering realistic parameters aligned to commercially available CV-QKD systems and finite block size, we show an improvement with respect to our previous results. A minimum quantum-classical channel spacing of 112.5 GHz is required in a coexistence scenario with 8×200G transceivers and 9 dBm of total power over a 15 km link. In case of 10 dBm of total power, 125 GHz quantum-classical channel spacing is required to generate keys for practical implementation over the analyzed links. Finally, we discuss SDN aspects relevant for dynamic quantum channel allocation and flexible network management, enabling coexistence and efficient resource sharing, facilitating QKD technology integration in deployed networks. The presented results and envisioned potentialities of CV-QKD for practical implementation in optical networks pave the way for its adoption in the network infrastructure toward future quantum secure communications.
The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.
To face the challenges of open and disaggregated 6G networks and the prospect/threat of quantum computing, we propose to adopt continuous-variable QKD (CV-QKD), as a promising technology compatible and suitable to be integrated with conventional optical systems, in combination with software defined networking (SDN). In this work, we present our most recent advances on SDN-enabled flexible CV-QKD for future secure communications. We describe the proposed network architecture, identifying the relevant parameters and interfaces. We consider and analyze a Gaussian-modulated coherent state CV-QKD system, reporting recent experimental results at the varying of the QKD system wavelength, as relevant adaptable parameter, that can be configured by the SDN controller, for distributing highly secure keys in metropolitan networks. The capabilities and potentialities of our proposed approach for future secure communications in open and disaggregated 6G networks are also discussed.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.