Classical network infrastructure -- spanning enterprise TCP/IP backbones, metropolitan optical networks, and wide-area internet exchange points -- was designed without native provisions for quantum cryptographic channels. Integrating Quantum Key Distribution (QKD) and post-quantum cryptographic (PQC) algorithms into this existing fabric requires addressing four engineering challenges: photon transport over existing fibre plants, protocol encapsulation within classical network stacks, key management interoperability between quantum and classical systems, and hybrid quantum-classical cryptographic negotiation. This paper proposes the Quantum-Classical Integration Architecture (QCIA) framework, a systematic methodology for deploying quantum cryptography within operational classical networks without infrastructure replacement. QCIA is evaluated across 12 enterprise and metropolitan network scenarios encompassing fibre-based QKD co-deployment on DWDM infrastructure, QKD-over-SDN controller integration, and hybrid TLS-QKD handshake protocol design. Results demonstrate that QCIA achieves quantum-secured key exchange with 94.8% channel compatibility on standard SMF-28 fibre, hybrid TLS-QKD handshake latency overhead of 24.6 ms, and a Quantum Integration Readiness Score (QIRS) of 0.882 across evaluated scenarios. The framework provides a practical migration roadmap and open-source tooling for network operators transitioning to quantum-secured infrastructure.
Classical network infrastructure -- spanning enterprise TCP/IP backbones, metropolitan optical networks, and wide-area internet exchange points -- was designed without native provisions for quantum cryptographic channels. Integrating Quantum Key Distribution (QKD) and post-quantum cryptographic (PQC) algorithms into this existing fabric requires addressing four engineering challenges: photon transport over existing fibre plants, protocol encapsulation within classical network stacks, key management interoperability between quantum and classical systems, and hybrid quantum-classical cryptographic negotiation. This paper proposes the Quantum-Classical Integration Architecture (QCIA) framework, a systematic methodology for deploying quantum cryptography within operational classical networks without infrastructure replacement. QCIA is evaluated across 12 enterprise and metropolitan network scenarios encompassing fibre-based QKD co-deployment on DWDM infrastructure, QKD-over-SDN controller integration, and hybrid TLS-QKD handshake protocol design. Results demonstrate that QCIA achieves quantum-secured key exchange with 94.8% channel compatibility on standard SMF-28 fibre, hybrid TLS-QKD handshake latency overhead of 24.6 ms, and a Quantum Integration Readiness Score (QIRS) of 0.882 across evaluated scenarios. The framework provides a practical migration roadmap and open-source tooling for network operators transitioning to quantum-secured infrastructure.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The emergence of large-scale quantum computers poses a significant threat to current cryptographic protocols, particularly Transport Layer Security (TLS), which relies on RSA and elliptic curve cryptography vulnerable to Shor's algorithm. This paper presents a hybrid framework for quantum-resistant TLS handshakes that integrates post-quantum cryptography (PQC), quantum key distribution (QKD) and classical cryptography to provide comprehensive protection against both classical and quantum attacks. The approach employs three QKD protocols; BB84, E91, and Measurement-Device-Independent QKD (MDI-QKD) alongside NIST-standardized PQC algorithms as well as alternative candidates such as HQC and BIKE. A key innovation is the QKD key management module, which addresses performance bottlenecks through periodic key generation and secure reuse within predefined retention periods, significantly reducing QKD overhead in TLS handshakes. The experimental implementation using the quantum network simulator evaluated 144 distinct cryptographic protocol combinations. Results demonstrate that ML-KEM combined with ML-DSA provides optimal PQC performance, while QKD protocol selection is distance-dependent: BB84 for short-range and MDI-QKD for long-distance communication. The framework includes various attack mitigation mechanisms and ensure security as long as at least one cryptographic method remains uncompromised. Consistent with current global quantum network usage, the proposed TLS approach is designed primarily for MAN and WAN environments rather than the Internet, providing a balanced solution that combines theoretical security guarantees with computational efficiency.
The impending realization of fault-tolerant quantum computers threatens the foundational public-key cryptography underpinning global telecommunications and financial infrastructure. While algorithmic Post-Quantum Cryptography (PQC) provides mathematical computational hardness against quantum cryptanalysis, Quantum Key Distribution (QKD) establishes an alternative information-theoretically secure physical paradigm based on the immutable laws of quantum mechanics: the No-Cloning theorem and Heisenberg's uncertainty principle. However, deploying scalable, wide-area quantum networks introduces formidable physical and systems engineering challenges: exponential optical fiber attenuation that restricts direct point-to-point QKD to beneath 150 km, high dark-count rates in superconducting nanowire single-photon detectors (SNSPDs), non-deterministic Bell-state entanglement swapping across quantum repeaters, and intense Raman scattering cross-talk when multiplexing quantum channels alongside multi-terabit classical DWDM optical networks. This paper delivers an exhaustive, mathematically formal technical investigation and empirical architectural evaluation of quantum networking and QKD systems. We formalize the asymptotic secret key rate bounds under the Decoy-State BB84 and Measurement-Device-Independent (MDI-QKD) protocols, model continuous entanglement routing over quantum repeaters utilizing bipartite Bell-pair purification, and establish optical co-existence bounds under Dense Wavelength Division Multiplexing (DWDM). Furthermore, we construct an empirical optical testbed evaluating an 8-node metropolitan quantum network co-propagating QKD over 100 Gbps classical optical traffic, paired with hybrid PQC-QKD key derivation functions (ML-KEM + QKD). Our empirical findings demonstrate that decoy-state BB84 achieves a sustainable secret key rate of 1.42 kbps across 100 km of standard single-mode fiber (SMF-28), while hybrid PQC-QKD integration eliminates single-point cryptographic failures with less than 2.4 ms handshake latency overhead. Finally, we formulate open challenges in memory-assisted atomic quantum repeaters, satellite-to-ground freespace entanglement links, and quantum internet transport protocols.
Quantum Key Distribution (QKD) has progressed from a theoretical cryptographic concept to an emerging secure communication infrastructure technology. While early work focused on protocol security and physical-layer feasibility, current research increasingly addresses scalable network deployment, hardware acceleration, and integration with classical communication systems. As QKD expands from point-to-point links to metropolitan, backbone, and hybrid satellite–terrestrial networks, new engineering challenges arise in topology design, entropy generation, real-time key distillation, and multi-vendor interoperability. This survey provides an infrastructure-oriented review of QKD networks, examining architectural models, quantum randomness as a root of trust, FPGA and system-on-chip (SoC) based acceleration techniques, and programmable control-plane integration. Key management system architectures and standardized interfaces are analyzed to highlight their roles in enabling scalable, interoperable deployments. The paper also synthesizes major standardization efforts and deployment initiatives shaping carrier-grade QKD infrastructures. Finally, open engineering challenges, including scalability, control-plane integration, certification harmonization, and hybridization with post-quantum cryptography, are identified, positioning QKD as a foundational component of next-generation secure communication systems.
The future security of digital communications will increasingly rely on the integration of Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), indicating a necessary convergence rather than a competitive relationship between these two technologies. Following the publication of NIST FIPS 203, 204 and 205, the industry now possesses standardised algorithmic tools for migrating away from RSA and elliptic-curve cryptography (ECC). At the same time, for critical infrastructure facing “harvest-now, decrypt-later” adversaries, purely software-based measures provide only computational, not information-theoretic, security. We argue that the optimal solution is a hybrid architecture, in which PQC provides authentication and cryptographic agility across heterogeneous endpoints, while QKD supplies an additional physical-layer shield for high-value links. The central engineering challenge is brownfield coexistence: deploying QKD over existing lit telecom fibers that carry high-power classical traffic. We review three spectral coexistence strategies to mitigate Spontaneous Raman Scattering (SpRS) – O-band separation, dense C-band DWDM integration with guard bands, and an “inverted” spectrum approach where data uses the O-band and QKD uses the C-band – and we discuss emerging physical media such as hollow-core and multi-core fibers. At the protocol layer, we discuss hybrid key encapsulation and the role of crypto-agile gateways in combining keys from classical, PQC and QKD sources [1]. Finally, we survey industrial pilots (e.g., SK Telecom, EuroQCI / OPENQKD) and outline open challenges in cost, standardisation and operations. The goal is to provide practitioners with a realistic, engineering-oriented overview of how PQC and QKD can be combined in brownfield optical networks.
Quantum Key Distribution (QKD) enables information-theoretically secure cryptographic key exchange by exploiting quantum mechanical properties -- photon polarisation, entanglement, and the no-cloning theorem -- to detect any eavesdropping attempt. Scaling QKD from point-to-point laboratory demonstrations to large-scale metropolitan and wide-area networks requires addressing three engineering challenges: photon loss over long fibre distances (limiting practical QKD to ~100-150 km without quantum repeaters), network topology design for multi-party key delivery, and integration of QKD with classical network infrastructure. This paper proposes the Quantum Key Distribution Network Architecture (QKDNA) framework, a systematic evaluation of five QKD protocol families (BB84, E91, MDI-QKD, Twin-Field QKD, and CV-QKD) across four network topology models (star, ring, mesh, and hierarchical trusted-node) on 16 real-world metropolitan network scenarios. QKDNA achieves maximum secure key rate of 18.4 Mbps (Twin-Field QKD, 80 km fibre, mesh topology) and demonstrates scalable QKD delivery to 48 simultaneous users. The framework contributes a Network QKD Deployment Index (NQDI) and quantitative guidance for national quantum network infrastructure planning.