Quantum key distribution (QKD) networks require relaying when distant key management entities share no direct quantum link. Most relay strategies, however, rely on centralized control or globally maintained routing state. This paper asks whether useful security and efficiency can still be obtained with topology-oblivious stochastic forwarding. It studies the security-overhead trade-off in a model in which fragmented key material is relayed via random-walk variants and reconstructed under privacy amplification. The analysis asks whether strictly local forwarding can retain useful information-theoretic security (ITS). Evaluation on the GÉANT topology, representing a European academic backbone network, shows clear differences between random-walk variants. The proposed highest-score-neighbor local path-diversification heuristic reduces the probability that relayed key material passes through a compromised node. The evaluation also shows that scouting-based loop erasure significantly shortens sampled routes and improves throughput in the model. Against one- to three-node cartels, random flow protects slightly more source-target pairs than a static disjoint-multipath method on the evaluated topologies. These findings position topology-oblivious stochastic forwarding as a simpler decentralized design for QKD relaying without centralized orchestration or gossip protocols.
Quantum key distribution (QKD) networks require relaying when distant key management entities share no direct quantum link. Most relay strategies, however, rely on centralized control or globally maintained routing state. This paper asks whether useful security and efficiency can still be obtained with topology-oblivious stochastic forwarding. It studies the security-overhead trade-off in a model in which fragmented key material is relayed via random-walk variants and reconstructed under privacy amplification. The analysis asks whether strictly local forwarding can retain useful information-theoretic security (ITS). Evaluation on the GÉANT topology, representing a European academic backbone network, shows clear differences between random-walk variants. The proposed highest-score-neighbor local path-diversification heuristic reduces the probability that relayed key material passes through a compromised node. The evaluation also shows that scouting-based loop erasure significantly shortens sampled routes and improves throughput in the model. Against one- to three-node cartels, random flow protects slightly more source-target pairs than a static disjoint-multipath method on the evaluated topologies. These findings position topology-oblivious stochastic forwarding as a simpler decentralized design for QKD relaying without centralized orchestration or gossip protocols.
ABSTRACT Due to distance and key‐rate limitations, current quantum key distribution (QKD) technology requires the use of trusted nodes, which, together with QKD links, form a graph referred to as a QKD network. We address the problem of securely routing (relaying) keys between trusted nodes, where some of them can be malicious. Existing solutions typically rely on centralized controllers, which simplify adaptive routing and congestion control but introduce single points of failure. Moreover, some proactive key‐relay protocols distribute keys to multiple nodes in the network; thus, compromising a single node results in the compromise of the shared keys. In this paper, we propose a decentralized, topology‐oblivious key‐relay algorithm based on random walks. Our algorithm provides information‐theoretic security (ITS) for QKD network topologies having at least one non‐malicious path between any pair of nodes (in particular, ‐vertex‐disjoint paths can tolerate malicious cartels of size ). Besides, it provides strong computational security guarantees for other topologies (even for graphs with malicious articulation points). We evaluate the proposed algorithm on the GÉANT GN4‐3N topology, which provides a realistic approximation of a multi‐state cross‐border topology for future QKD networks.
Quantum key distribution (QKD) allows the distribution of secret keys for quantum-secure communication between two distant parties, vital in the quantum computing era in order to protect against quantum-enabled attackers. However, overcoming rate-distance limits in QKD and the establishment of quantum key distribution networks necessitate key relaying over trusted nodes. This process may be resource-intensive, consuming a substantial share of the scarce QKD key material to establish end-to-end secret keys. Hence, an efficient scheme for key relaying and the establishment of end-to-end key pools is essential for practical and extended quantum-secured networking. In this paper, we propose and compare two protocols for managing, storing, and distributing secret key material in QKD networks, addressing challenges such as the success rate of key requests, key consumption, and overhead resulting from relaying. We present an innovative, fully decentralized key distribution strategy as an alternative to the traditional hop-by-hop relaying via trusted nodes, where three experiments are considered to evaluate performance metrics under varying key demand. Our results show that the decentralized pre-flooding approach achieves higher success rates as application demands increase. This analysis highlights the strengths of each approach in enhancing QKD network performance, offering valuable insights for developing robust key distribution strategies in different scenarios.
Abstract Secure key distribution is crucial for maintaining communication confidentiality in networks with multiple communicating partners. Asymmetric key algorithms are vulnerable to quantum attacks because of the computational advantage offered by quantum computers, whereas symmetric key algorithms with sufficiently large keys remain comparatively more resistant. Quantum Key Distribution (QKD) has emerged as a promising quantum-secure key distribution technique based on the principles of quantum physics. However, practical QKD networks often rely on relay nodes to extend communication distance, and malicious relay nodes can compromise quantum keys during the relaying process. This study proposes a secure key relaying approach based on Shamir's Secret Sharing to mitigate this vulnerability. The proposed method uses a probabilistic behavioural model to assess relay nodes according to their curiosity and collaboration tendencies. By splitting a quantum key into multiple shares and routing them through paths with minimum compromise risk, the approach reduces exposure to malicious or colluding relay nodes. The proposed algorithm assigns risk to network paths by evaluating node-level curiosity and collaboration potential, determines the appropriate number of shares, and selects secure routing paths to minimise key compromise. The study further analyses the parameters influencing the ideal number of shares for a given network, thereby offering a resilient mechanism for quantum-safe communication in QKD networks with malicious relay nodes.
With the advent of powerful quantum computers, an emerging quantum-resilient security mechanism within existing networks is crucial. Thus, Quantum Key Distribution (QKD), which generates symmetric secret keys with Information-Theoretical Security (ITS) for secure point-to-point communication, is present as a solution. Despite QKD’s potential, its deployment is challenging due to significant investment and infrastructure requirements. Using state-of-the-art technology, the maximum distance between nodes is limited to hundreds of kilometers, necessitating multiple nodes to relay keys. For now, QKD Network (QKDN) relies on software-defined networking (SDN) and a central orchestrator, but this centralized approach has limitations. Hence, the main challenge is to select an efficient path between key relays to avoid communication failure. To address these challenges, a more distributed approach could be envisioned. In this paper, we propose to leverage one of the distributed routing protocols, OSPF, to redefine and improve the current architecture. We propose a novel QKDN-based OSPF (Open Shortest Path First) architecture for efficient key relay routing, offering a completely different dimension to the overall network management: we modify QKDN architecture to exploit the OSPF networks and present a QKD-enabled OSPF version capable of computing the best path for key relay, offering a cost-effective and scalable solution for widespread QKD adoption.
Quantum Key Distribution allows the exchange of symmetric keys with information-theoretic security between adjacent nodes. Key relay techniques in Quantum Key Distribution Networks (QKDNs) address the need for symmetric keys between nodes that are either too distant for establishing a quantum link or separated by intermediate nodes. The Secure Key Rate is limited, which triggers a need to use buffers (Quantum Key Pools) to store keys for later use. The secure key relay uses One-Time Pad, thus the number of links in the route impacts the number of keys used to deliver a pair of symmetric keys. The need for efficient routing algorithms in QKDNs has led to different routing algorithms. This work revisits some routing approaches that have been improved here. Results show that using asymmetrical link costs reduces blocking, a Long Short-Term Memory approach is enhanced by including cross-validation, and finally some strategies to reduce management traffic are proposed.
Quantum Key Distribution (QKD) is a technique for sharing encryption keys between two adjacent nodes in an unconditionally secure manner based on quantum theory. From the viewpoint of network system research, QKD is considered to be a building block for providing secure link communication in network systems. Although the communication distance is subject to a limitation attributable to the QKD fundamentals, recent research and some QKD field trials of “key relaying” over a “QKD network” are overcoming this limitation. It also enables each node on the QKD network to exchange encryption keys with arbitrary nodes on the QKD network. However, the previous research didn't address a routing method on the QKD network in detail. This paper focuses on the routing issues on the QKD network, clarifies the requirements of the routing protocol, and proposes a routing solution designed for the key relaying on the QKD network. The proposed routing solution consists of 4 components: (1) a node interface architecture addressing both encrypted and unencrypted traffics, (2) a path selection algorithm based on the number of keys, (3) an IP address assignment scheme connecting unencrypted interfaces and encrypted interfaces, and (4) a routing protocol deployment method consuming no extra keys. The proposed routing solution allows the QKD network to select a suitable key relaying path according to the QKD system condition and to reduce the extra key consumption, which optimizes the key utilization on the QKD network. The proposed routing solution was implemented with a network emulating QKD technology and evaluated. The evaluation result shows that the proposed routing solution could select a path that stores enough keys, which is suitable for a QKD network. Additional impact analysis reveals that the proposed routing solution could save up to 52% of key consumption depending on the QKD key sharing speed and the routing protocol configuration.