Quantum Key Distribution (QKD) enables information-theoretic secure key exchange, but the deployment of large-scale QKD networks introduces new challenges related to routing, resource allocation, and security exposure in trusted-node-based architectures. In multipath QKD networks, the secret key rate can be partitioned and transmitted over multiple link-disjoint paths, so that an adversary must simultaneously compromise all paths to reconstruct the complete secret key. However, traffic is often equally distributed across the available disjoint paths, although such uniform partitioning may be suboptimal when candidate paths exhibit heterogeneous vulnerability levels. This paper proposes a security-aware optimization framework for QKD-enabled optical networks that determines a non-uniform multipath traffic partitioning strategy aimed at minimizing the expected amount of eavesdropped traffic. The proposed approach is formulated as a Mixed-Integer Linear Programming (MILP) model that integrates probabilistic secrecy metrics derived from trusted node compromise probabilities, a traffic vulnerability threshold that limits partial information exposure, and adaptive bandwidth squeezing protection to ensure service continuity under failure scenarios. The model jointly optimizes traffic allocation and excess key capacity, allowing the protection overhead to be dynamically determined according to security and resilience requirements. Numerical evaluations conducted on both a toy topology and the Pan-European network demonstrate that the proposed exposure-aware partitioning strategy significantly reduces the expected eavesdropped traffic compared to conventional equal-splitting approaches while maintaining resilience guarantees. These results highlight the potential of security-driven traffic engineering for the design of resilient and efficient multipath QKD networks.
Quantum Key Distribution (QKD) enables information-theoretic secure key exchange, but the deployment of large-scale QKD networks introduces new challenges related to routing, resource allocation, and security exposure in trusted-node-based architectures. In multipath QKD networks, the secret key rate can be partitioned and transmitted over multiple link-disjoint paths, so that an adversary must simultaneously compromise all paths to reconstruct the complete secret key. However, traffic is often equally distributed across the available disjoint paths, although such uniform partitioning may be suboptimal when candidate paths exhibit heterogeneous vulnerability levels. This paper proposes a security-aware optimization framework for QKD-enabled optical networks that determines a non-uniform multipath traffic partitioning strategy aimed at minimizing the expected amount of eavesdropped traffic. The proposed approach is formulated as a Mixed-Integer Linear Programming (MILP) model that integrates probabilistic secrecy metrics derived from trusted node compromise probabilities, a traffic vulnerability threshold that limits partial information exposure, and adaptive bandwidth squeezing protection to ensure service continuity under failure scenarios. The model jointly optimizes traffic allocation and excess key capacity, allowing the protection overhead to be dynamically determined according to security and resilience requirements. Numerical evaluations conducted on both a toy topology and the Pan-European network demonstrate that the proposed exposure-aware partitioning strategy significantly reduces the expected eavesdropped traffic compared to conventional equal-splitting approaches while maintaining resilience guarantees. These results highlight the potential of security-driven traffic engineering for the design of resilient and efficient multipath QKD networks.
Quantum key distribution (QKD), a key application of quantum information technology and “one-time pad” (OTP) encryption, enables secure key exchange with information-theoretic security, meaning its security is grounded in the laws of physics rather than computational assumptions. However, in QKD networks, achieving long-distance communication often requires trusted relays to mitigate channel losses. This reliance introduces significant challenges, including vulnerabilities to compromised relays and the high costs of infrastructure, which hinder widespread deployment. To address these limitations, we propose a zero-trust spatiotemporal diversification framework for multipath–multi-key distribution. The proposed approach enhances the security of end-to-end key distribution by dynamically shuffling key exchange routes, enabling secure multipath key distribution. Furthermore, it incorporates a dynamic adaptive path recovery mechanism that leverages a recursive penalty model to identify and exclude suspicious or compromised relay nodes. To validate this framework, we conducted extensive simulations and compared its performance against established multipath QKD methods. The results demonstrate that the proposed approach achieves a 97.22% lower attack success rate with 20% attacker pervasiveness and a 91.42% reduction in the attack success rate for single key transmission. The total security percentage improves by 35% under 20% attacker pervasiveness, and security enhancement reaches 79.6% when increasing QKD pairs. Additionally, the proposed scheme exhibits an 86.04% improvement in defense against interception and nearly doubles the key distribution success rate compared to traditional methods. The results demonstrate that the proposed approach significantly improves both security robustness and efficiency, underscoring its potential to advance the practical deployment of QKD networks.
Quantum Key Distribution (QKD) is a recent technology for secure distribution of symmetric keys, which is currently being deployed to increase communications security against quantum attacks. However, the key rate achievable over a weak quantum signal is limited by the link performance (e.g., loss and noise) and propagation distance, especially in multi-node QKD networks, making it necessary to design a scheme to efficiently and timely distribute keys to the various nodes. In this work, we formulate, using a Mixed Integer Linear Programming (MILP) model, a novel Routing, Channel, and Key-rate Assignment (RCKA) problem for QKD with Quantum Key Pool (QKP), which exploits the opportunity of using trusted relays and optical bypass. Our formulation accounts for the possibility to build a quantum key distribution path that combines both quantum channels and trusted relays to increase the acceptance ratio of key rate requests. Leveraging different versions of the proposed MILP model, we evaluate several strategies exploiting different combinations of trusted relays and optical bypass for the RCKA problem. Results show how different trade-offs between security and resource-efficiency (expressed in terms of acceptance ratio of key rate requests vs. key storing rate in QKP) can be achieved when adopting trusted-relay and/or optical-bypass technologies. Trusted relays can provide a higher acceptance ratio when the number of QKD modules (transmitters or receivers) is sufficiently large, while optical bypass, which does not require the implementation of expensive trusted relays, is preferable when the number of QKD modules is a limiting factor.
Quantum Key Distribution (QKD) networks enable unconditionally secure key exchange using quantum mechanical principles. However, routing cryptographic keys across multi-hop quantum networks introduces challenges unique to quantum communication. This survey analyzes and classifies 26 routing strategies proposed between 2013 and 2024 for terrestrial, satellite, and hybrid QKD infrastructures. Dynamic, key-aware routing algorithms have been shown to reduce service rejection rates by 25-40% compared to static shortest-path methods by incorporating real-time key pool availability and link error rates. Multi-path strategies improve resilience against trusted-node compromise by distributing keys across disjoint routes, albeit with an increase in key consumption of 30-60%. SDN-based orchestration frameworks emerge as essential enablers of flexible, QoS-aware routing for hybrid networks integrating terrestrial fibers and intermittent satellite links. Critical research directions include reducing dependence on trusted nodes through quantum repeaters or post-quantum cryptography, developing standardized key management interfaces for interoperability, and adopting AI-driven predictive routing for adapting to fluctuating network states. This comprehensive synthesis of routing algorithms, performance trade-offs, and unresolved issues offers practical guidance for engineering secure, adaptable, and large-scale QKD networks capable of meeting real-world deployment demands.
We develop a novel key routing algorithm for quantum key distribution (QKD) networks that utilizes a distribution of keys between remote nodes, i.e., not directly connected by a QKD link, through multiple non-overlapping paths. This approach focuses on the security of a QKD network by minimizing potential vulnerabilities associated with individual trusted nodes. The algorithm ensures a balanced allocation of the workload across the QKD network links, while aiming for the target key generation rate between directly connected and remote nodes. We present the results of testing the algorithm on two QKD network models consisting of 6 and 10 nodes. The testing demonstrates the ability of the algorithm to distribute secure keys among the nodes of the network in an all-to-all manner, ensuring that the information-theoretic security of the keys between remote nodes is maintained even when one of the trusted nodes is compromised. These results highlight the potential of the algorithm to improve the performance of QKD networks.
In quantum key distribution (QKD) networks, the quantum service channel (QSCh) is highly sensitive to link failures, as any interruption in the quantum channel can immediately halt key generation, and hence the transmission of secured data across optical networks. Hence, robust protection mechanisms are essential to ensure continuous secure key distribution. However, conventional protection approaches, such as dedicated protection and fixed-path routing, often suffer from low resource efficiency and poor adaptability to heterogeneous relay environments. To ensure both survivability and efficient resource allocation in QKD based optical networks, we propose a shared path protection scheme based on hybrid relays. In the proposed approach, K-candidate paths are computed for both the traditional data channel (TDCh) and QSCh, and the working path is selected using a weighted metric that considers both the hop-count and the security degree. To enhance resilience, the shared protection paths are established, allowing multiple backup paths to reuse network resources for connection requests. A connection request is accepted only if both the working and the protection paths are successfully reserved, thereby ensuring strong protection. The system incorporates joint allocation of wavelength and time-slot, and introduces a protection threshold to support shared use of backup resources. Simulation results show that the proposed method achieves lower blocking probability, while maintaining high wavelength and time-slot efficiency compared to the baseline methods in different networks.
As a promising application of quantum information technology, Quantum Key Distribution (QKD) can provide information-theoretically secure key exchange for adjacent communication parties. To achieve long-distance secure communication and scale expansion against inherent channel loss, trusted relays, which are assumed to be absolutely secure, are introduced into QKD networks. However, in practice, trusted relays may be compromised by attacks from ubiquitous eavesdroppers even protected by powerful hardware. Thus, how to ensure the security of end-to-end key distribution in partially-trusted relay QKD networks with the coexistence of trusted relays and untrusted relays becomes a challenging but urgent problem to be solved. To address this critical problem, in this article, we design a segment-based multipath key distribution method. The basic idea of the method is to maximize the security of the end-to-end key distribution through the segment-based multipath key distribution. Under the premise of security level requirements, we further propose a flexible key reconstruction scheme to improve the efficiency of key distribution and obtain available secret keys as many as possible. The extensive simulations are conducted and the results reveal that our method significantly outperforms the traditional multipath QKD method in terms of both security and efficiency.