The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.
The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.
The transition towards quantum-safe secure communications requires current network infrastructures to support the coexistence of multiple cryptographic technologies. In this context, crypto-agility becomes a key requirement, enabling the coordinated use of Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), and classical cryptographic mechanisms during a progressive migration process. This paper presents a general, standards-based architecture for crypto-agile IPsec service provisioning in Software-Defined Networking (SDN) environments. The proposal combines modular functional blocks that support the integration of QKD-, PQC-,and classical-derived key material under a common operational framework. The architecture builds on existing specifications, including RFC 9061 and ETSI GS QKD 004. Rather than focusing on implementation details or performance evaluation, this work describes the needs addressed by the architecture, its main components, and the operational workflows supporting secure tunnel establishment, rekeying, and attestation-related actions.
Shor's algorithm efficiently solves factoring and discrete logarithm problems using quantum computers, compromising all public key schemes used today. These schemes rely on assumptions on their computational complexity, which quantum computers can easily bypass. The solutions have to come from new algorithms - called Post-Quantum Cryptography (PQC) - or from new methods, such as Quantum Key Distribution (QKD). The former replicate the computational security ideas of classical public key algorithms, while the latter recurs to use the quantum properties of nature, which also brings a mathematical security proof, potentially offering Information-Theoretic Security. To secure data in the future, we must adopt these paradigms. With the speed of quantum computing advancements, the transition to quantum-safe cryptography within the next decade is critical. Delays could expose long-lived confidential data, as current encryption may be broken before its value expires. However, the shift must balance the adoption of new technologies with maintaining proven systems to protect against present and future threats. In this work, we have selected Transport Layer Security, one of the most widely used protocols, as the foundation to hybridize classical, quantum, and post-quantum cryptography in a way suitable for broad adoption in Software-Defined Networking, the most flexible networking paradigm that has been used to deploy integrated quantum-classical networks. To this end, we use standards for QKD key extraction and SDN integration. The purposed implementation is based on the latest version of TLS and demonstrates advanced capabilities such as rekeying and key transport across a large QKD network, while supporting crypto-agility and maintaining backward compatibility through the use of ciphersuites. The performance of this approach has been demonstrated using a deployed production infrastructure.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
In an era of unprecedented technological advancement, the rise of quantum computing poses both opportunities and challenges to network security. While quantum computers promise to revolutionize data processing and problem-solving, they also render traditional cryptographic protocols vulnerable, threatening the integrity of current network security systems. Quantum cryptography, particularly quantum key distribution (QKD), emerges as a groundbreaking solution, leveraging the principles of quantum mechanics to ensure unparalleled data security. Unlike classical methods, QKD guarantees secure communication by detecting eavesdropping attempts, as any observation of quantum states disrupts their integrity. This paper explores the pivotal role of quantum cryptography in shaping future network security protocols amidst a landscape of increasing cyber threats. It provides a comprehensive analysis of QKD systems, their integration into existing infrastructure, and their resilience against potential quantum-based attacks. The discussion includes real-world implementations, such as satellite-based QKD networks and fiber-optic quantum communication systems, illustrating their practical viability and scalability. Furthermore, the paper addresses current challenges, including cost, technical complexity, and interoperability with classical networks, offering insights into ongoing research aimed at overcoming these hurdles. As global reliance on digital infrastructure grows, the transition to quantum-resilient security frameworks becomes imperative. Policymakers, industry leaders, and technology developers must collaborate to advance quantum cryptographic technologies and ensure their accessibility. By securing communication channels against both classical and quantum threats, quantum cryptography is positioned to redefine the foundations of network security, paving the way for a more secure and interconnected digital future.
Abstract With the rapid advancement of quantum computing, traditional security protocols based on classical encryption algorithms are increasingly vulnerable to potential quantum attacks. The current IPsec protocol, which relies on classical cryptographic methods, is insufficient to withstand such threats, thereby compromising the security of long-term data transmission. To address this issue, we propose integrating quantum key distribution (QKD) into the internet protocol security (IPsec) protocol, thereby enhancing its resilience against quantum computing attacks. Here, two schemes that merge QKD-generated keys with classical cryptographic keys are designed to enhance both security and stability. Furthermore, we conduct a comprehensive evaluation of the performance of various QKD protocols implemented with the scheme, along with an assessment of its overall efficacy across a topological network configuration. This approach not only ensures secure data transmission in the era of quantum computing but also highlights the potential application value of integrating QKD with IPsec, providing valuable insights for the design and implementation of future quantum-secure communication systems.
The transition towards quantum-safe secure communications requires current network infrastructures to support the coexistence of multiple cryptographic technologies. In this context, crypto-agility becomes a key requirement, enabling the coordinated use of Quantum Key Distribution (QKD), PostQuantum Cryptography (PQC), and classical cryptographic mechanisms during a progressive migration process. This paper presents a general, standards-based architecture for crypto-agile IPsec service provisioning in Software-Defined Networking (SDN) environments. The proposal combines modular functional blocks that support the integration of QKD-, PQC-, and classical-derived key material under a common operational framework. The architecture builds on existing specifications, including RFC 9061 and ETSI GS QKD 004. Rather thanfocusing on implementation details or performance evaluation, this work describes the needs addressed by the architecture, its main components, and the operational workflows supporting secure tunnel establishment, rekeying, and attestation-related actions.