Quantum key distribution (QKD) networks promise information-theoretic security for multiple nodes by leveraging the fundamental laws of quantum mechanics. In practice, QKD networks require dedicated routing protocols to coordinate secure key distribution among distributed nodes. However, most existing routing protocols operate under the assumption that all relay nodes are honest and fully trustworthy, an assumption that may not hold in realistic scenarios. Malicious nodes may tamper with routing updates, causing inconsistent key-state views or divergent routing plans across the network. Such inconsistencies increase routing failure rates and lead to severe wastage of valuable secret keys. To address these challenges, we propose a distributed routing framework that combines two key components: (i) Causal Consistency Key-State Update, which prevents malicious nodes from propagating inconsistent key states and routing plans; and (ii) Trust-Aware Multi-path Flow Optimization, which incorporates trust metrics derived from discrepancies in reported states into the path-selection objective, penalizing suspicious links and filtering fabricated demands. Across 50-node topologies with up to 30% malicious relays and under all three attack modes, our protocol sustains a high demand completion ratio (DCR) (mean 0.90, range 0.81-0.98) while keeping key utilization low (16.6 keys per demand), decisively outperforming the baselines-Multi-Path Planned (DCR 0.48, 30.8 keys per demand) and OSPF (DCR ≤0.12, 296 keys per demand; max 1601). These results highlight that our framework balances reliability and efficiency, providing a practical and resilient foundation for secure QKD networking in adversarial environments.
Quantum key distribution (QKD) networks promise information-theoretic security for multiple nodes by leveraging the fundamental laws of quantum mechanics. In practice, QKD networks require dedicated routing protocols to coordinate secure key distribution among distributed nodes. However, most existing routing protocols operate under the assumption that all relay nodes are honest and fully trustworthy, an assumption that may not hold in realistic scenarios. Malicious nodes may tamper with routing updates, causing inconsistent key-state views or divergent routing plans across the network. Such inconsistencies increase routing failure rates and lead to severe wastage of valuable secret keys. To address these challenges, we propose a distributed routing framework that combines two key components: (i) Causal Consistency Key-State Update, which prevents malicious nodes from propagating inconsistent key states and routing plans; and (ii) Trust-Aware Multi-path Flow Optimization, which incorporates trust metrics derived from discrepancies in reported states into the path-selection objective, penalizing suspicious links and filtering fabricated demands. Across 50-node topologies with up to 30% malicious relays and under all three attack modes, our protocol sustains a high demand completion ratio (DCR) (mean 0.90, range 0.81-0.98) while keeping key utilization low (16.6 keys per demand), decisively outperforming the baselines-Multi-Path Planned (DCR 0.48, 30.8 keys per demand) and OSPF (DCR ≤0.12, 296 keys per demand; max 1601). These results highlight that our framework balances reliability and efficiency, providing a practical and resilient foundation for secure QKD networking in adversarial environments.
Efficient and scalable quantum key scheduling remains a critical challenge in trusted-relay Quantum Key Distribution (QKD) networks due to imbalanced key resource utilization, dynamic key consumption, and topology-induced congestion. This paper presents a Q-learning-based adaptive routing framework designed to optimize quantum key delivery in dynamic QKD networks. The model formulates routing as a Markov Decision Process, with a compact state representation that combines the current node, destination node, and discretized key occupancy levels. Reward function is designed to jointly penalize resource imbalance and rapid key depletion while promoting traversal through links with sustainable key generation, guiding the agent toward balanced and congestion-aware decisions. Compared to Dijkstra, the Q-learning scheduler achieves significantly lower delivery latency, more effective key resource utilization, and greater reliability: maintaining 45.8 vs 118.5 hops in average delay under heavy load, sustaining 74.5\% vs 61.5\% in average key utilization, and reducing the failure ratio to 7.2\% vs 41.5\%, collectively confirming its advantages in scalability, congestion resilience, and resource-efficient decision making.
With the advent of powerful quantum computers, an emerging quantum-resilient security mechanism within existing networks is crucial. Thus, Quantum Key Distribution (QKD), which generates symmetric secret keys with Information-Theoretical Security (ITS) for secure point-to-point communication, is present as a solution. Despite QKD’s potential, its deployment is challenging due to significant investment and infrastructure requirements. Using state-of-the-art technology, the maximum distance between nodes is limited to hundreds of kilometers, necessitating multiple nodes to relay keys. For now, QKD Network (QKDN) relies on software-defined networking (SDN) and a central orchestrator, but this centralized approach has limitations. Hence, the main challenge is to select an efficient path between key relays to avoid communication failure. To address these challenges, a more distributed approach could be envisioned. In this paper, we propose to leverage one of the distributed routing protocols, OSPF, to redefine and improve the current architecture. We propose a novel QKDN-based OSPF (Open Shortest Path First) architecture for efficient key relay routing, offering a completely different dimension to the overall network management: we modify QKDN architecture to exploit the OSPF networks and present a QKD-enabled OSPF version capable of computing the best path for key relay, offering a cost-effective and scalable solution for widespread QKD adoption.
Quantum key distribution (QKD), a key application of quantum information technology and “one-time pad” (OTP) encryption, enables secure key exchange with information-theoretic security, meaning its security is grounded in the laws of physics rather than computational assumptions. However, in QKD networks, achieving long-distance communication often requires trusted relays to mitigate channel losses. This reliance introduces significant challenges, including vulnerabilities to compromised relays and the high costs of infrastructure, which hinder widespread deployment. To address these limitations, we propose a zero-trust spatiotemporal diversification framework for multipath–multi-key distribution. The proposed approach enhances the security of end-to-end key distribution by dynamically shuffling key exchange routes, enabling secure multipath key distribution. Furthermore, it incorporates a dynamic adaptive path recovery mechanism that leverages a recursive penalty model to identify and exclude suspicious or compromised relay nodes. To validate this framework, we conducted extensive simulations and compared its performance against established multipath QKD methods. The results demonstrate that the proposed approach achieves a 97.22% lower attack success rate with 20% attacker pervasiveness and a 91.42% reduction in the attack success rate for single key transmission. The total security percentage improves by 35% under 20% attacker pervasiveness, and security enhancement reaches 79.6% when increasing QKD pairs. Additionally, the proposed scheme exhibits an 86.04% improvement in defense against interception and nearly doubles the key distribution success rate compared to traditional methods. The results demonstrate that the proposed approach significantly improves both security robustness and efficiency, underscoring its potential to advance the practical deployment of QKD networks.
Quantum Key Distribution (QKD) networks enable unconditionally secure key exchange using quantum mechanical principles. However, routing cryptographic keys across multi-hop quantum networks introduces challenges unique to quantum communication. This survey analyzes and classifies 26 routing strategies proposed between 2013 and 2024 for terrestrial, satellite, and hybrid QKD infrastructures. Dynamic, key-aware routing algorithms have been shown to reduce service rejection rates by 25-40% compared to static shortest-path methods by incorporating real-time key pool availability and link error rates. Multi-path strategies improve resilience against trusted-node compromise by distributing keys across disjoint routes, albeit with an increase in key consumption of 30-60%. SDN-based orchestration frameworks emerge as essential enablers of flexible, QoS-aware routing for hybrid networks integrating terrestrial fibers and intermittent satellite links. Critical research directions include reducing dependence on trusted nodes through quantum repeaters or post-quantum cryptography, developing standardized key management interfaces for interoperability, and adopting AI-driven predictive routing for adapting to fluctuating network states. This comprehensive synthesis of routing algorithms, performance trade-offs, and unresolved issues offers practical guidance for engineering secure, adaptable, and large-scale QKD networks capable of meeting real-world deployment demands.
Quantum key distribution (QKD) networks are expected to enable information-theoretical secure (ITS) communication over a large-scale network. Most research on relay-based QKD networks assumes all relays or nodes are completely trustworthy. However, this assumption is unreasonable because the malicious behavior of even a single node can undermine the security of the entire network. Currently, there is no method to directly distinguish between honest nodes and malicious nodes. Moreover, the status of nodes as honest or malicious can be dynamic. Therefore, a solution is needed that can withstand a certain proportion of malicious nodes in QKD networks. We propose a novel paradigm, inspired by distributed systems, to address the active and passive attacks by collaborating with malicious nodes in QKD networks. First, regarding security, we propose the ITS distributed authentication scheme, which additionally ensures two crucial security properties to QKD networks: identity unforgeability and non-repudiation. Second, concerning correctness, we propose an ITS fault-tolerant consensus scheme based on our ITS distributed authentication to ensure global consistency. This enables participating nodes to collaborate correctly and complete end-to-end key distribution within a constant number of communication rounds. Through our simulation, we have shown that our scheme exhibits a significantly lower growth trend in key consumption compared to the original end-to-end pre-shared keys scheme. For instance, in larger networks, such as when the number of nodes is 80, our scheme’s key consumption is only 13.1% of the pre-shared keys scheme.
ABSTRACT Due to distance and key‐rate limitations, current quantum key distribution (QKD) technology requires the use of trusted nodes, which, together with QKD links, form a graph referred to as a QKD network. We address the problem of securely routing (relaying) keys between trusted nodes, where some of them can be malicious. Existing solutions typically rely on centralized controllers, which simplify adaptive routing and congestion control but introduce single points of failure. Moreover, some proactive key‐relay protocols distribute keys to multiple nodes in the network; thus, compromising a single node results in the compromise of the shared keys. In this paper, we propose a decentralized, topology‐oblivious key‐relay algorithm based on random walks. Our algorithm provides information‐theoretic security (ITS) for QKD network topologies having at least one non‐malicious path between any pair of nodes (in particular, ‐vertex‐disjoint paths can tolerate malicious cartels of size ). Besides, it provides strong computational security guarantees for other topologies (even for graphs with malicious articulation points). We evaluate the proposed algorithm on the GÉANT GN4‐3N topology, which provides a realistic approximation of a multi‐state cross‐border topology for future QKD networks.