ABSTRACT Software‐defined networking (SDN) consolidates network control at a centralised controller, making the southbound TLS‐protected channel between the controller and OpenFlow switches the principal security boundary of the entire network. Classical public‐key mechanisms underpinning this channel—RSA, ECDHE and X.509 certificate infrastructure—are fundamentally threatened by Shor's algorithm, which solves their underlying hard problems in polynomial quantum time. This paper presents the design, implementation and experimental evaluation of a key management system (KMS) serving as the central trust anchor in a fully quantum key distribution (QKD)‐integrated SDN architecture. We formally characterise the KMS's two interdependent roles: (i) a topology role , mediating all BB84‐derived quantum key material to every OpenFlow switch while enforcing hierarchical role‐based access control (RBAC) and maintaining three distinct key‐type domains; and (ii) a security role , operating a formally specified four‐state lifecycle state machine with pre‐emptive refresh that eliminates cryptographic downtime, AES‐256‐GCM key storage backed by a software keystore (extensible to HSM/TPM in production deployments) and a tamper‐protected audit subsystem. The system is implemented entirely in Python 3.10 on the Ryu 4.34 SDN framework with Open vSwitch 2.17 and evaluated in a two‐tier Mininet testbed comprising 12 OpenFlow switches, 24 hosts and dual redundant controllers. Over 30 statistically independent trials, full key synchronisation completes in 1.72 s for 12 switches at a sustained rate of 20.9 keys/s ( ≈ 144 ms per switch); automatic key refresh incurs a bounded transient CPU spike from 22% to 37%, resolving within 15 s; and dual‐controller failover mediated by the KMS completes in 1.17 s on average with zero standing packet loss. Total performance overhead relative to classical RSA + TLS is 19%–33% across all measured metrics, establishing the practical deployability of the proposed KMS architecture for quantum‐safe SDN control planes.
ABSTRACT Software‐defined networking (SDN) consolidates network control at a centralised controller, making the southbound TLS‐protected channel between the controller and OpenFlow switches the principal security boundary of the entire network. Classical public‐key mechanisms underpinning this channel—RSA, ECDHE and X.509 certificate infrastructure—are fundamentally threatened by Shor's algorithm, which solves their underlying hard problems in polynomial quantum time. This paper presents the design, implementation and experimental evaluation of a key management system (KMS) serving as the central trust anchor in a fully quantum key distribution (QKD)‐integrated SDN architecture. We formally characterise the KMS's two interdependent roles: (i) a topology role , mediating all BB84‐derived quantum key material to every OpenFlow switch while enforcing hierarchical role‐based access control (RBAC) and maintaining three distinct key‐type domains; and (ii) a security role , operating a formally specified four‐state lifecycle state machine with pre‐emptive refresh that eliminates cryptographic downtime, AES‐256‐GCM key storage backed by a software keystore (extensible to HSM/TPM in production deployments) and a tamper‐protected audit subsystem. The system is implemented entirely in Python 3.10 on the Ryu 4.34 SDN framework with Open vSwitch 2.17 and evaluated in a two‐tier Mininet testbed comprising 12 OpenFlow switches, 24 hosts and dual redundant controllers. Over 30 statistically independent trials, full key synchronisation completes in 1.72 s for 12 switches at a sustained rate of 20.9 keys/s ( ≈ 144 ms per switch); automatic key refresh incurs a bounded transient CPU spike from 22% to 37%, resolving within 15 s; and dual‐controller failover mediated by the KMS completes in 1.17 s on average with zero standing packet loss. Total performance overhead relative to classical RSA + TLS is 19%–33% across all measured metrics, establishing the practical deployability of the proposed KMS architecture for quantum‐safe SDN control planes.
ABSTRACT Classical public‐key cryptography used to secure Software‐Defined Networking (SDN) control planes remains vulnerable to future cryptographically relevant quantum computers through Shor's algorithm, motivating the exploration of quantum‐safe key establishment mechanisms. While Quantum Key Distribution (QKD) has been widely studied as a standalone technology, its direct integration into SDN control‐plane protection remains insufficiently quantified from both architectural and operational perspectives. This paper presents a quantum‐secure SDN control‐plane framework in which BB84‐based key generation, key lifecycle management, and quantum‐authenticated flow‐rule protection are integrated into the Ryu controller through a QBER‐aware Key Management System (KMS) and OpenFlow 1.3 Experimenter extensions. Beyond implementation, the paper positions the design as a practical migration model for quantum‐resilient SDN infrastructures and evaluates its security–performance trade‐offs against a classical RSA + TLS baseline. The system is implemented using Ryu, Open vSwitch, and a software BB84 simulator in a Mininet testbed with up to 20 OpenFlow switches. All measurements are repeated over 30 independent trials with full statistical reporting, while QBER stability is assessed over 1000 runs. Results show that BB84 key generation latency averages 45.3 ms ( σ = 3.2 ms), mean QBER remains at 4.8% with zero threshold violations, flow installation latency increases from 13.2 to 17.6 ms, controller CPU overhead is +3.8 percentage points, and throughput decreases from 8200 to 7580 pps under saturation. In addition, scalability follows a near‐perfect linear trend ( R 2 = 0.998), enabling projection to larger SDN deployments. These findings show that QKD‐secured SDN control‐plane protection is operationally feasible on commodity hardware with bounded and predictable overhead, while offering a practical blueprint for the gradual deployment of quantum‐resilient networking infrastructure.
ABSTRACT Quantum computing is a serious threat to classical cryptographic systems, especially for Internet of things (IoT) networks that do not have a lot of resources and are meant to run for a long time. This paper presents QuantumShield, an integrated security framework that combines quantum key distribution (QKD) with software‐defined networking (SDN) to achieve information‐theoretic protection for IoT communications. The framework makes four core contributions: (1) an enhanced BB84 protocol (eBB84) with adaptive quantum bit error rate (QBER) thresholding, achieving 89.6% detection sensitivity at attack strength 0.3—a 37% improvement over the conventional fixed‐threshold BB84 baseline (threshold = 0.11); (2) a hierarchical key management architecture integrating quantum‐derived cryptographic keys with SDN flow control, supporting heterogeneous IoT devices through a three‐tier security model; (3) a multiparameter attack detection mechanism that provides robust defence against eavesdropping (97.2% detection), man‐in‐the‐middle attacks (96.7% detection and 0.4% false positives) and brute‐force attempts that are computationally infeasible (10 years for classical and 10 3 years for quantum systems) and (4) the proposed framework demonstrates improved control‐plane security and scalable performance based on empirical evaluation in SDN‐enabled IoT environments, without relying on theoretical asymptotic complexity claims, a key generation rate of 3.7 keys/s for 256‐bit keys and only 8.2% throughput overhead. Unlike computational cryptography schemes, such as CP/PB‐ABE, RSA or ECC, which rely on mathematical hardness assumptions and are vulnerable to quantum algorithms, such as Shor's and Grover's,QuantumShield, achieves information‐theoretic security for key establishment via the eBB84 protocol, whereas message authentication and data‐plane integrity rely on classical symmetric primitives (HMAC–SHA256 and AES‐256) seeded with quantum‐derived keys, providing computational security hardened against long‐term key reuse. Extensive experimental validation confirms its practicality and robustness for mission‐critical IoT deployments requiring quantum‐resilient security in the postquantum era.
Software-defined networking (SDN) has emerged as a promising paradigm for managing and controlling network resources efficiently. However, ensuring the security of data packets transmitted within an SDN environment remains a critical challenge. Traditional networking relies on static configurations, while SDN offers dynamic control and programmability, revolutionizing network management. In SDN, the application layer employs tools like OpenDaylight and Mininet for network management and testing. The control layer, managed by controllers such as Floodlight or ONOS, orchestrates traffic flow among switches. In the infrastructure layer, Quantum Key Distribution (QKD) with the BB84 protocol ensures secure communication. Together, these layers enable agile, programmable, and secure networking paradigms. This paper proposes integrating quantum key distribution (QKD) into SDN architectures to bolster packet-level security. By leveraging quantum entanglement and uncertainty, a secure communication channel between SDN controllers and switches is established, resilient to quantum attacks. Evaluation through simulations and real-world experiments demonstrates efficacy in mitigating security threats while minimizing overhead and latency, advancing SDN security IEEE 802.1X capabilities and leveraging quantum technologies for cybersecurity.
The rapid evolution of digital infrastructure has raised significant concerns about the security of data transmission, particularly with the advent of quantum computing. Traditional cryptographic algorithms are vulnerable to attacks, highlighting the need for quantum-resistant solutions. This paper presents the integration of Quantum Key Distribution (QKD) with Software-Defined Networking (SDN) and network slicing to build a secure, programmable, and flexible network architecture. QKD ensures unconditional security based on quantum mechanics by enabling key distribution with the ability to detect eavesdropping through quantum bit error rates (QBER). SDN provides centralized control and real-time traffic management, while network slicing allows isolation, reliability and customization of traffic flows for specific applications such as URLLC, eMBB, and mMTC. When abnormal QBER or decryption failures are detected, mitigation actions such as Quantum key refresh, traffic rerouting, or attacker isolation are triggered and Performance evaluation of the system is based on Latency and throughput Experimental validation using Mininet and Ryu demonstrates secure key distribution, attack detection, and slice-specific threat mitigation. This integrated approach enhances end-to-end security for next-generation networks, with strong applicability to5G/6G, IoT, and mission-critical services.
Abstract Network management has been significantly transformed by software‐defined networking (SDN), which consolidates control and improves adaptability. As a result of this paradigm shift, security concerns have emerged concurrently. Within SDN environments, maintaining service path integrity is of utmost importance because malicious entities can exploit network flows to gain access to data, resulting in security breaches. Thus, QKD networks require a management plane that can control and manage the QKD resources. Quantum key distribution networks can be controlled and managed separately by SDN, allowing quantum key forwarding to be separated from their control and management. The paper provides an overview of QKD networks enabled by SDN, along with an overview of its architecture, interfaces, and protocols. This paper elaborates on the overall architecture and related interfaces and protocols of QKD networks assisted by SDN. Then, three important paradigms for simulation are presented using three use cases.
With the advent of quantum computing, the increasing threats to security poses a great challenge to communication networks. Recent innovations in this field resulted in promising technologies such as Quantum Key Distribution (QKD), which enables the generation of unconditionally secure keys, establishing secure communications between remote nodes. Additionally, QKD networks enable the interconnection of multi-node architectures, extending the point-to-point nature of QKD. However, due to the limitations of the current state of technology, the scalability of QKD networks remains a challenge toward feasible implementations. When it comes to long-distance implementations, trusted relay nodes partially solve the distance issue through the forwarding of the distributed keys, allowing applications that do not have a direct QKD link to securely share key material. Even though the relay procedure itself has been extensively studied, the establishment of the relaying node path still lacks a solution. This paper proposes an innovative network architecture that solves the challenges of Key Management System (KMS) identification, relay path discovery, and scalability of QKD networks by integrating Software-Defined Networking (SDN) principles, and establishing high-level virtual KMSs (vKMS) in each node and creating a new entity called the Quantum Security Controller (QuSeC). The vKMS serves the end-user key requests, managing the multiple KMSs within the node and abstracting the user from discovering the correct KMS. Additionally, based on the high-level view of the network topology and status, the QuSeC serves the path discovery requests from vKMSs, computing the end-to-end (E2E) relay path and applying security policies. The paper also provides a security analysis of the proposal, identifying the security levels of the architecture and analyzing the core networking security properties, and a performance evaluation that confirms the feasibility and scalability of the proposal.