The global Internet appears to users as a unified, seamless infrastructure, but in reality, it is composed of multiple interconnected networks: separate domains with different management and policies. This unified behavior is made possible by complexity-hiding mechanisms and inter-domain coordination protocols, which are critical components of modern networking. As we approach a paradigm shift driven by quantum technologies, new challenges and opportunities emerge. Quantum information processing enables capabilities that classical systems cannot achieve, including the potential to compromise public key infrastructures that support today’s network security. Quantum key distribution (QKD) offers a promising avenue by implementing a key agreement protocol that is information-theoretically secure against computational attack. However, to fully leverage QKD, networks must be adapted to the unique constraints of quantum communication, integrating both quantum bit transmission and secure key distribution across multiple domains. This paper discusses the interconnection of quantum key distribution networks (QKDNs) and presents a distributed, standards-aligned orchestration mechanism designed to manage QKD networks spanning multiple administrative domains. Our solution builds on existing QKDN standards to facilitate interoperability and practical deployment in heterogeneous environments and has been validated on a heterogeneous multi-domain network comprising three interconnected autonomous domains.
The global Internet appears to users as a unified, seamless infrastructure, but in reality, it is composed of multiple interconnected networks: separate domains with different management and policies. This unified behavior is made possible by complexity-hiding mechanisms and inter-domain coordination protocols, which are critical components of modern networking. As we approach a paradigm shift driven by quantum technologies, new challenges and opportunities emerge. Quantum information processing enables capabilities that classical systems cannot achieve, including the potential to compromise public key infrastructures that support today’s network security. Quantum key distribution (QKD) offers a promising avenue by implementing a key agreement protocol that is information-theoretically secure against computational attack. However, to fully leverage QKD, networks must be adapted to the unique constraints of quantum communication, integrating both quantum bit transmission and secure key distribution across multiple domains. This paper discusses the interconnection of quantum key distribution networks (QKDNs) and presents a distributed, standards-aligned orchestration mechanism designed to manage QKD networks spanning multiple administrative domains. Our solution builds on existing QKDN standards to facilitate interoperability and practical deployment in heterogeneous environments and has been validated on a heterogeneous multi-domain network comprising three interconnected autonomous domains.
A multi-vendor, multi-domain Quantum Key Distribution network comprising 15 nodes across three independently managed domains was deployed and operated during QCI Days 2025 in Athens. The large-scale field trial integrated heterogenous QKD technologies, multi-layer Key Management Systems, and SDN-controlled infrastructures into a unified inter-domain architecture enabling cross-domain key exchange and coordination. The setup combined in-rack domain nodes extended to a 4-node field-deployed metropolitan QKD network segment, providing a realistic operational environment for validating end-to-end functionality. Multiple QKD-enabled services were successfully supported across the federated infrastructure, proving the technical feasibility and viability of scalable QKD deployments in inter-domain settings.
Quantum key distribution (QKD) offers unconditional security but existing QKD networks remain difficult to scale across heterogeneous infrastructures and administrative domains due to vendor-specific interfaces, trusted-node constraints, and limited interoperability. This work presents a flexible multi-domain and multi-site quantum-secure network architecture integrating vendor-agnostic QKD, SDN orchestration, and cloud-managed trust services. Communication is based on Zero Trust Network Access protocols featuring multi-level authentication mechanisms building upon post-quantum cryptography (PQC) signature and key encapsulation algorithms. The system is deployed on a real-world testbed with domains incorporating QKD nodes from 3 vendors, as well as domains without QKD infrastructure elements. Experimental results show that PQC and SDN overhead remain relatively low even on constrained devices, with the main bottleneck being QKD key retrieval and vendor-specific key streaming limitations. The proposed framework extends quantum-safe key transport beyond native QKD boundaries while preserving flexibility, interoperability, and compatibility with existing infrastructures.
Quantum Key Distribution (QKD) stands as a cornerstone in the realm of quantum communications, promising unparalleled security through the principles of quantum mechanics. However, the realization of QKD's full potential hinges not only on technological advancements but also on the establishment of robust standards governing its implementation. This paper presents a comprehensive analysis of the current landscape of QKD standards, highlighting existing gaps and charting a course towards their evolution. We begin by elucidating the foundational importance of standards in ensuring interoperability, reliability, and scalability within QKD Networks (QKDN). Despite the existence of several standardization efforts, such as those by the International Telecommunication Union (ITU) and the European Telecommunications Standards Institute (ETSI), significant gaps persist. Furthermore, we identify emerging challenges posed by the integration of QKD into existing classical communication infrastructures, as well as the advent of quantum networks comprising multiple QKD nodes. Addressing these challenges necessitates a concerted effort towards the refinement and expansion of QKD standards. To this end, we propose several key directions for the evolution of QKD standards. We also advocate further enhancing collaboration between academia, industry and standards bodies to streamline the standardization process and foster innovation. Finally, we underscore the critical role of standards in catalyzing the adoption of QKD technologies by industry stakeholders. Standards-compliant QKD solutions not only instill confidence among end users, but also facilitate seamless integration into existing communication infrastructures. In conclusion, this paper offers insights into the state-of-the-art, challenges, and future directions in QKD standardization, underlining its fundamental importance for the advancement of practical applications of quantum secure communication technologies.
QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.
The advent of cryptographically relevant quantum computers poses an existential threat to classical public-key infrastructure. Quantum Key Distribution (QKD) addresses this challenge by providing information-theoretic security for key establishment, independently of any computational hardness assumption. In this work, the deployment and experimental validation of a metropolitan-scale quantum-secure network between data centers in Milan is reported. The network operates over installed fiber infrastructure and implements a layered architecture integrating QKD hardware, standards-compliant Key Management (KM), and centralized Software-Defined Networking (SDN) orchestration. Dynamic path reconfiguration via active optical switching and trusted-node routing allow automated fail-over solutions. Application-layer validation across diverse protocols and workloads confirms the seamless interoperability of all system components. These results establish the technical and operational readiness of metropolitan QKD networks for production deployment, and offer a replicable blueprint for building quantum-secure communication infrastructure at metropolitan scale.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability