ABSTRACT Classical public‐key cryptography used to secure Software‐Defined Networking (SDN) control planes remains vulnerable to future cryptographically relevant quantum computers through Shor's algorithm, motivating the exploration of quantum‐safe key establishment mechanisms. While Quantum Key Distribution (QKD) has been widely studied as a standalone technology, its direct integration into SDN control‐plane protection remains insufficiently quantified from both architectural and operational perspectives. This paper presents a quantum‐secure SDN control‐plane framework in which BB84‐based key generation, key lifecycle management, and quantum‐authenticated flow‐rule protection are integrated into the Ryu controller through a QBER‐aware Key Management System (KMS) and OpenFlow 1.3 Experimenter extensions. Beyond implementation, the paper positions the design as a practical migration model for quantum‐resilient SDN infrastructures and evaluates its security–performance trade‐offs against a classical RSA + TLS baseline. The system is implemented using Ryu, Open vSwitch, and a software BB84 simulator in a Mininet testbed with up to 20 OpenFlow switches. All measurements are repeated over 30 independent trials with full statistical reporting, while QBER stability is assessed over 1000 runs. Results show that BB84 key generation latency averages 45.3 ms ( σ = 3.2 ms), mean QBER remains at 4.8% with zero threshold violations, flow installation latency increases from 13.2 to 17.6 ms, controller CPU overhead is +3.8 percentage points, and throughput decreases from 8200 to 7580 pps under saturation. In addition, scalability follows a near‐perfect linear trend ( R 2 = 0.998), enabling projection to larger SDN deployments. These findings show that QKD‐secured SDN control‐plane protection is operationally feasible on commodity hardware with bounded and predictable overhead, while offering a practical blueprint for the gradual deployment of quantum‐resilient networking infrastructure.
ABSTRACT Classical public‐key cryptography used to secure Software‐Defined Networking (SDN) control planes remains vulnerable to future cryptographically relevant quantum computers through Shor's algorithm, motivating the exploration of quantum‐safe key establishment mechanisms. While Quantum Key Distribution (QKD) has been widely studied as a standalone technology, its direct integration into SDN control‐plane protection remains insufficiently quantified from both architectural and operational perspectives. This paper presents a quantum‐secure SDN control‐plane framework in which BB84‐based key generation, key lifecycle management, and quantum‐authenticated flow‐rule protection are integrated into the Ryu controller through a QBER‐aware Key Management System (KMS) and OpenFlow 1.3 Experimenter extensions. Beyond implementation, the paper positions the design as a practical migration model for quantum‐resilient SDN infrastructures and evaluates its security–performance trade‐offs against a classical RSA + TLS baseline. The system is implemented using Ryu, Open vSwitch, and a software BB84 simulator in a Mininet testbed with up to 20 OpenFlow switches. All measurements are repeated over 30 independent trials with full statistical reporting, while QBER stability is assessed over 1000 runs. Results show that BB84 key generation latency averages 45.3 ms ( σ = 3.2 ms), mean QBER remains at 4.8% with zero threshold violations, flow installation latency increases from 13.2 to 17.6 ms, controller CPU overhead is +3.8 percentage points, and throughput decreases from 8200 to 7580 pps under saturation. In addition, scalability follows a near‐perfect linear trend ( R 2 = 0.998), enabling projection to larger SDN deployments. These findings show that QKD‐secured SDN control‐plane protection is operationally feasible on commodity hardware with bounded and predictable overhead, while offering a practical blueprint for the gradual deployment of quantum‐resilient networking infrastructure.
ABSTRACT Software‐defined networking (SDN) consolidates network control at a centralised controller, making the southbound TLS‐protected channel between the controller and OpenFlow switches the principal security boundary of the entire network. Classical public‐key mechanisms underpinning this channel—RSA, ECDHE and X.509 certificate infrastructure—are fundamentally threatened by Shor's algorithm, which solves their underlying hard problems in polynomial quantum time. This paper presents the design, implementation and experimental evaluation of a key management system (KMS) serving as the central trust anchor in a fully quantum key distribution (QKD)‐integrated SDN architecture. We formally characterise the KMS's two interdependent roles: (i) a topology role , mediating all BB84‐derived quantum key material to every OpenFlow switch while enforcing hierarchical role‐based access control (RBAC) and maintaining three distinct key‐type domains; and (ii) a security role , operating a formally specified four‐state lifecycle state machine with pre‐emptive refresh that eliminates cryptographic downtime, AES‐256‐GCM key storage backed by a software keystore (extensible to HSM/TPM in production deployments) and a tamper‐protected audit subsystem. The system is implemented entirely in Python 3.10 on the Ryu 4.34 SDN framework with Open vSwitch 2.17 and evaluated in a two‐tier Mininet testbed comprising 12 OpenFlow switches, 24 hosts and dual redundant controllers. Over 30 statistically independent trials, full key synchronisation completes in 1.72 s for 12 switches at a sustained rate of 20.9 keys/s ( ≈ 144 ms per switch); automatic key refresh incurs a bounded transient CPU spike from 22% to 37%, resolving within 15 s; and dual‐controller failover mediated by the KMS completes in 1.17 s on average with zero standing packet loss. Total performance overhead relative to classical RSA + TLS is 19%–33% across all measured metrics, establishing the practical deployability of the proposed KMS architecture for quantum‐safe SDN control planes.
Software-defined networking (SDN) has emerged as a promising paradigm for managing and controlling network resources efficiently. However, ensuring the security of data packets transmitted within an SDN environment remains a critical challenge. Traditional networking relies on static configurations, while SDN offers dynamic control and programmability, revolutionizing network management. In SDN, the application layer employs tools like OpenDaylight and Mininet for network management and testing. The control layer, managed by controllers such as Floodlight or ONOS, orchestrates traffic flow among switches. In the infrastructure layer, Quantum Key Distribution (QKD) with the BB84 protocol ensures secure communication. Together, these layers enable agile, programmable, and secure networking paradigms. This paper proposes integrating quantum key distribution (QKD) into SDN architectures to bolster packet-level security. By leveraging quantum entanglement and uncertainty, a secure communication channel between SDN controllers and switches is established, resilient to quantum attacks. Evaluation through simulations and real-world experiments demonstrates efficacy in mitigating security threats while minimizing overhead and latency, advancing SDN security IEEE 802.1X capabilities and leveraging quantum technologies for cybersecurity.
The rapid evolution of digital infrastructure has raised significant concerns about the security of data transmission, particularly with the advent of quantum computing. Traditional cryptographic algorithms are vulnerable to attacks, highlighting the need for quantum-resistant solutions. This paper presents the integration of Quantum Key Distribution (QKD) with Software-Defined Networking (SDN) and network slicing to build a secure, programmable, and flexible network architecture. QKD ensures unconditional security based on quantum mechanics by enabling key distribution with the ability to detect eavesdropping through quantum bit error rates (QBER). SDN provides centralized control and real-time traffic management, while network slicing allows isolation, reliability and customization of traffic flows for specific applications such as URLLC, eMBB, and mMTC. When abnormal QBER or decryption failures are detected, mitigation actions such as Quantum key refresh, traffic rerouting, or attacker isolation are triggered and Performance evaluation of the system is based on Latency and throughput Experimental validation using Mininet and Ryu demonstrates secure key distribution, attack detection, and slice-specific threat mitigation. This integrated approach enhances end-to-end security for next-generation networks, with strong applicability to5G/6G, IoT, and mission-critical services.
ABSTRACT Quantum computing is a serious threat to classical cryptographic systems, especially for Internet of things (IoT) networks that do not have a lot of resources and are meant to run for a long time. This paper presents QuantumShield, an integrated security framework that combines quantum key distribution (QKD) with software‐defined networking (SDN) to achieve information‐theoretic protection for IoT communications. The framework makes four core contributions: (1) an enhanced BB84 protocol (eBB84) with adaptive quantum bit error rate (QBER) thresholding, achieving 89.6% detection sensitivity at attack strength 0.3—a 37% improvement over the conventional fixed‐threshold BB84 baseline (threshold = 0.11); (2) a hierarchical key management architecture integrating quantum‐derived cryptographic keys with SDN flow control, supporting heterogeneous IoT devices through a three‐tier security model; (3) a multiparameter attack detection mechanism that provides robust defence against eavesdropping (97.2% detection), man‐in‐the‐middle attacks (96.7% detection and 0.4% false positives) and brute‐force attempts that are computationally infeasible (10 years for classical and 10 3 years for quantum systems) and (4) the proposed framework demonstrates improved control‐plane security and scalable performance based on empirical evaluation in SDN‐enabled IoT environments, without relying on theoretical asymptotic complexity claims, a key generation rate of 3.7 keys/s for 256‐bit keys and only 8.2% throughput overhead. Unlike computational cryptography schemes, such as CP/PB‐ABE, RSA or ECC, which rely on mathematical hardness assumptions and are vulnerable to quantum algorithms, such as Shor's and Grover's,QuantumShield, achieves information‐theoretic security for key establishment via the eBB84 protocol, whereas message authentication and data‐plane integrity rely on classical symmetric primitives (HMAC–SHA256 and AES‐256) seeded with quantum‐derived keys, providing computational security hardened against long‐term key reuse. Extensive experimental validation confirms its practicality and robustness for mission‐critical IoT deployments requiring quantum‐resilient security in the postquantum era.
Quantum Key Distribution (QKD) protocols, particularly the decoy-state BB84, offer a promising approach to enhancing network security by enabling theoretically unbreakable encryption.Integrating QKD into OpenDaylight Software-Defined Networking (SDN) controllers addresses key management challenges in dynamic, large-scale networks.Automated key rotation for IPSec and VPN tunnels eliminates the need for manual key distribution, ensuring continuous encryption with minimal latency.The implementation of ETSI-compliant QKD protocols ensures efficient, seamless key rotation without compromising performance.Furthermore, Quantum Bit Error Rate (QBER) thresholds are optimized to enhance key generation rates while minimizing key discards.Simulation results indicate that this solution significantly improves network security, reduces latency, and maintains continuous encryption.This research explores how integrating automated QKD protocols within SDN-driven networks can provide a practical and scalable solution for safeguarding communications, ultimately strengthening defenses against cyber threats while maintaining high network performance.
Software-Defined Networking (SDN) is an emerging networking paradigm that decouples the control and data plane in order to enable programmable and flexible networks, optimizing its applications and advancing computer systems. It does so through its architecture, a key part of which is a centralized network management through open interfaces that revolutionizes the way in which networks are designed and makes them more agile and versatile to the evolving needs of modern and future applications services. This also means, however, that there is now a centralized point of attack that is a major vulnerability, threatening the security of the entire network. With such an advanced network paradigm, it requires a security system that will mitigate these risks and warrant long-term security. In attempts to allow secure communications within the network, this research proposes the implementation of Quantum Key Distribution (QKD), leveraging quantum mechanics to secure the network against any computational advancements in the future. QKD is a recent cryptographic system that includes a traditional-computational channel and a physical-quantum channel to generate and distribute keys between parties. It uses the principles of quantum mechanics including entanglement and superposition to ensure that the physical layer cannot be compromised computationally. QKD provides confidentiality and privacy of information and communication. Moreover, it is resistant to technological advancements. The implications of QKD significantly enhance SDN security through its protection against attacks, efficient key distribution, reliable network orchestration, and data integrity, creating an architecture that establishes stable communication channels that are resistant to cyber threats.