There is a need to ensure unconditionally secure communications between different sites of an organization. We use quantum key distribution (QKD) protocol to provide a continuous stream of secret key bits to each communicating pair for message encryption through one-time-pad (OTP) cryptography. Due to long distance between different sites, trusted nodes are used to relay each service key in a hop-by-hop manner from one end node to another end node of a communicating pair. In a QKD network, routes for key relaying can be affected by availability of relay key bits at trusted nodes. Also, relay key allocation among different routes can impact security. We consider the scenario of supporting multiple communicating pairs, where each pair demands delivery of a certain service key rate across the QKD network, and trusted nodes may not have sufficient relay key rates to perform bitwise encryption to protect the service key. Hence, there is a need to allocate the limited relay key bits to meet all service key delivery demands while considering its effects on security. We propose to perform jointly routing and relay key allocation to minimize attack success probability. We have formulated the joint problem as an optimization and further proposed an efficient algorithm to find the optimal solutions. We have evaluated the proposed algorithm to confirm its ability and efficiency in finding optimal routes and relay key allocations. For the specific network topology that we have adopted, results show that the minimum number of required trusted nodes increases linearly when end nodes are added to the system. Furthermore, we can achieve a higher security level by adding more trusted nodes in a QKD network. But increasing the number of trusted nodes beyond the minimum requirement may not continue to reduce significantly the attack success probability.
There is a need to ensure unconditionally secure communications between different sites of an organization. We use quantum key distribution (QKD) protocol to provide a continuous stream of secret key bits to each communicating pair for message encryption through one-time-pad (OTP) cryptography. Due to long distance between different sites, trusted nodes are used to relay each service key in a hop-by-hop manner from one end node to another end node of a communicating pair. In a QKD network, routes for key relaying can be affected by availability of relay key bits at trusted nodes. Also, relay key allocation among different routes can impact security. We consider the scenario of supporting multiple communicating pairs, where each pair demands delivery of a certain service key rate across the QKD network, and trusted nodes may not have sufficient relay key rates to perform bitwise encryption to protect the service key. Hence, there is a need to allocate the limited relay key bits to meet all service key delivery demands while considering its effects on security. We propose to perform jointly routing and relay key allocation to minimize attack success probability. We have formulated the joint problem as an optimization and further proposed an efficient algorithm to find the optimal solutions. We have evaluated the proposed algorithm to confirm its ability and efficiency in finding optimal routes and relay key allocations. For the specific network topology that we have adopted, results show that the minimum number of required trusted nodes increases linearly when end nodes are added to the system. Furthermore, we can achieve a higher security level by adding more trusted nodes in a QKD network. But increasing the number of trusted nodes beyond the minimum requirement may not continue to reduce significantly the attack success probability.
Cyber–physical systems rely heavily on communication networks for remote monitoring and control. It is crucial to protect the communication networks from cyberattacks because an attack on the physical subsystem can be indirectly launched from a compromised cyber subsystem. Since remote control devices have limited computational power, we ensure communication confidentiality and integrity using one-time-pad (OTP) symmetric cryptography, which despite simple is unconditionally secure. To provide OTP with secret keys, we use quantum key distribution (QKD) across multiple hops, where each intermediate relay is a trusted node. These nodes can be weak points in cyberattacks. Hence, this article focuses on routing in multihop QKD networks that reduces the required number of trusted nodes. We formulate and solve an optimization problem to find the set of QKD routes that minimizes the number of activated trusted nodes while satisfying the secret key rate requirements of multiple communicating pairs. Extensive evaluation results confirm that the proposed scheme can indeed has fewer activated trusted nodes as compared to a benchmark scheme that finds only the shortest paths for communicating pairs.
Quantum key distribution (QKD) protocols generate a same secret key at two nodes which are at different locations. Such key is used to encrypt and decrypt messages for unconditionally secure communications through a classical channel. Originally, QKD protocols are designed to work between two nodes which are directly connected through a point-to-point quantum channel. Currently, commercial QKD systems have limited range and key rate. To increase key rate and extend range, the key generated by QKD at one end node is relayed hop-by-hop to the other end node through multiple trusted nodes. In a QKD network with multiple pairs of communicating nodes, routing deals with the issue of deciding for each pair, which trusted nodes are used to form a path connecting the end nodes. This paper presents an overview of QKD and highlights the differences between QKD routing as compared to classical routing. The challenges of QKD routing are presented. Existing works dealing with the challenges are surveyed. This paper ends with a discussion on remaining research issues.
In a cyber–physical system, quantum key distribution (QKD) protocols can provide a continuous supply of common secret key bits for secure communications between the control center and a remote device. QKD protocols operate on a peer-to-peer basis between two adjacent nodes and are distance-limited. Hence, trusted nodes are installed between two communicating end nodes for a better QKD range and key rate. These trusted nodes relay in a hop-by-hop manner, key bits generated in the first hop to the other end node. At each trusted node, the first hop key bits are encrypted by other locally generated key bits before being relayed. Since QKD process is stochastic, secret key bits are generated at different rates at different hops. Thus, buffer is needed at a trusted node to temporally hold some key bits while waiting for other key bits. There is no existing work that accounts for such a realistic relaying operation in deriving the key rate. This article contributes to developing a key rate model to determine accurately the end-to-end rates across multiple trusted nodes. We have evaluated accuracy of the proposed model through extensive simulations. The results show that there exist an optimal number of trusted nodes for a given distance between two end nodes. For example, the optimal number of relays increases from four for 100 km to six for 200 km.
This study proposes a group key service node placement method for quantum key distribution (QKD) networks based on partially trusted relays, aiming to optimize network structure, improve key distribution efficiency, reduce communication delay, and ensure transmission integrity and confidentiality. Based on graph theory, a key information model for the quantum key distribution network is established, which defines node types, functions, and connectivity. Leveraging the secure transmission protocol of quantum keys, the unconditional security of the key during transmission is ensured. Furthermore, this study proposes a QKD network architecture incorporating partially trusted relays, which combines trusted and untrusted relay technologies. An improved p-median model is introduced and solved using a greedy algorithm to ensure secure quantum key distribution and optimal deployment of group key service nodes. Experimental results demonstrate that the location of group key service nodes in quantum key distribution network ensures the minimum number of key service nodes and minimizes the path length from network demand nodes to group key service nodes. Furthermore, this method significantly improves the key distribution efficiency, success rate, security, energy consumption, resource consumption, network coverage, and blind area of quantum key distribution network.
Quantum key distribution (QKD) allows the distribution of secret keys for quantum-secure communication between two distant parties, vital in the quantum computing era in order to protect against quantum-enabled attackers. However, overcoming rate-distance limits in QKD and the establishment of quantum key distribution networks necessitate key relaying over trusted nodes. This process may be resource-intensive, consuming a substantial share of the scarce QKD key material to establish end-to-end secret keys. Hence, an efficient scheme for key relaying and the establishment of end-to-end key pools is essential for practical and extended quantum-secured networking. In this paper, we propose and compare two protocols for managing, storing, and distributing secret key material in QKD networks, addressing challenges such as the success rate of key requests, key consumption, and overhead resulting from relaying. We present an innovative, fully decentralized key distribution strategy as an alternative to the traditional hop-by-hop relaying via trusted nodes, where three experiments are considered to evaluate performance metrics under varying key demand. Our results show that the decentralized pre-flooding approach achieves higher success rates as application demands increase. This analysis highlights the strengths of each approach in enhancing QKD network performance, offering valuable insights for developing robust key distribution strategies in different scenarios.
Quantum Key Distribution (QKD) is a recent technology for secure distribution of symmetric keys, which is currently being deployed to increase communications security against quantum attacks. However, the key rate achievable over a weak quantum signal is limited by the link performance (e.g., loss and noise) and propagation distance, especially in multi-node QKD networks, making it necessary to design a scheme to efficiently and timely distribute keys to the various nodes. In this work, we formulate, using a Mixed Integer Linear Programming (MILP) model, a novel Routing, Channel, and Key-rate Assignment (RCKA) problem for QKD with Quantum Key Pool (QKP), which exploits the opportunity of using trusted relays and optical bypass. Our formulation accounts for the possibility to build a quantum key distribution path that combines both quantum channels and trusted relays to increase the acceptance ratio of key rate requests. Leveraging different versions of the proposed MILP model, we evaluate several strategies exploiting different combinations of trusted relays and optical bypass for the RCKA problem. Results show how different trade-offs between security and resource-efficiency (expressed in terms of acceptance ratio of key rate requests vs. key storing rate in QKP) can be achieved when adopting trusted-relay and/or optical-bypass technologies. Trusted relays can provide a higher acceptance ratio when the number of QKD modules (transmitters or receivers) is sufficiently large, while optical bypass, which does not require the implementation of expensive trusted relays, is preferable when the number of QKD modules is a limiting factor.