PaperlayerView exact revision on arXiv

Source-linked AI summary

The Engineering of Software-Defined Quantum Key Distribution Networks

Alejandro Aguado, Victor Lopez, Diego Lopez, Momtchil Peev, Andreas Poppe, Antonio Pastor, Jesus Folgueira, Vicente Martiin

arXiv:1907.00174v1cs.NIcs.CR

TL;DR

Quantum computing threatens existing cryptographic protocols, while quantum-safe alternatives take time to standardize and deploy. This paper demonstrates an SDN-managed network integrating quantum and classical communications in production, supporting an evolutionary deployment path without large upfront costs.

  • Problem

    Quantum computing threatens established security protocols, while quantum-safe technologies are still being standardized and will take time to deploy at scale.

    Source: §I · p. 1

  • Method

    The paper uses SDN principles and QKD systems to integrate quantum links and classical communications under a shared network infrastructure and management.

    Source: §I · p. 2, §III · p. 4

  • Results

    The production testbed integrated quantum and classical communications under SDN management and tolerated more than 20 classical 100Gbps channels alongside the quantum channel in the C band.

    Source: §IV · p. 5, §V · p. 6

  • Takeaways & Limitations

    The demonstrated architecture supports staged QKD deployment using existing security mechanisms while avoiding large upfront costs for a separate network.

    Source: §V · p. 6

    QKD remains distance-limited by fiber attenuation; the paper describes practical distances of about 150 km, with longer reach requiring quantum repeaters that remain years away.

    Source: §II · p. 2

Abstract

from arXiv · show

Quantum computers will change the cryptographic panorama. A technology once believed to lay far away into the future is increasingly closer to real world applications. Quantum computers will break the algorithms used in our public key infrastructure and in our key exchange protocols, forcing a complete retooling of the cryptography as we know it. Quantum Key distribution is a physical layer technology immune to quantum or classical computational threats. However, it requires a physical substrate, and optical fiber has been the usual choice. Most of the time used just as a point to point link for the exclusive transport of the delicate quantum signals. Its integration in a real-world shared network has not been attempted so far. Here we show how the new programmable software network architectures, together with specially designed quantum systems can be used to produce a network that integrates classical and quantum communications, including management, in a single, production-level infrastructure. The network can also incorporate new quantum-safe algorithms and use the existing security protocols, thus bridging the gap between today's network security and the quantum-safe network of the future. This can be done in an evolutionary way, without zero-day migrations and the corresponding upfront costs. We also present how the technologies have been deployed in practice using a production network.

I. INTRODUCTION

Quantum computing threatens established cryptographic protocols, while quantum-safe alternatives will take time to standardize and deploy. The paper proposes integrating quantum and classical communications into production telecom networks using SDN, enabling an evolutionary path to quantum-safe infrastructure.

I. INTRODUCTION

  • Quantum computers threaten widely used public-key algorithms, and information recorded today could be decrypted later, making future-proof security important now.The paper notes that replacing security infrastructure takes years.Source: §I · p. 1
  • Quantum-safe infrastructure can rely on post-quantum algorithms or quantum cryptography; both are being standardized, but deployment at global scale will take time.QKD is described as a physical-layer technology immune to computational threats, whereas post-quantum algorithms rely on computational complexity.Source: §I · pp. 1–2
  • QKD has largely remained in restricted, often point-to-point deployments outside network management systems, making separate ad-hoc networks expensive and cumbersome.The paper identifies this as a barrier to broad adoption in network infrastructures.Source: §I · p. 2
  • The paper argues that telecom networks are needed to advance QKD services, with corporate deployments potentially supporting later economies of scale for residential services.Source: §I · p. 2
  • The work demonstrates a production-level network integrating quantum and classical communications and compatible with existing and post-quantum security protocols.The authors present this as an evolutionary path to quantum-safe infrastructure.Source: §I · p. 2

II. QKD TECHNOLOGY AND NETWORKS

QKD uses quantum links to generate shared keys, but distance losses constrain throughput and multi-point delivery relies on trusted nodes. The section reviews network approaches and presents an integrated production deployment in which quantum and classical communications are managed consistently.

II. QKD TECHNOLOGY AND NETWORKS

  • QKD uses optical fiber to carry quantum signals and requires an authenticated classical channel for post-processing and authentication.The paper says security depends on correct implementation and installation, with no side channels.Source: §II · p. 2
  • QKD is distance-limited by transmission losses, with practical fiber distances around 150 km and lower key rates beyond that range.The paper gives about 1 Mbps of final secret key at 40 km for direct links without passive network equipment; quantum repeaters are described as years away.Source: §II · p. 2
  • The paper reports a production-facility testbed where quantum and classical network parts are integrated and consistently managed, supporting incremental QKD deployment without a separate network.The testbed was also used to demonstrate industrially relevant service and infrastructure security use cases.Source: §II · p. 3
  • Longer-distance key delivery uses interconnected trusted nodes, with each hop providing information-theoretically secure encryption and authentication.The paper identifies inter-datacenter and last-mile business deployments as relevant operator scenarios.Source: §II · pp. 2–3
  • Earlier QKD networks used dedicated or parallel infrastructure, while prior management approaches included distributed routing and key-delivery layers.The paper notes that centralized SDN planning could mitigate non-optimal path choices and key-material misuse while managing quantum-classical coexistence.Source: §II · p. 3
  • A software-defined QKD node places one or more QKD systems under an SDN agent, with a Local Key Management System managing generated keys.Source: Figure 1 · p. 3

III. ABSTRACTION MODEL FOR SOFTWARE-DEFINED QKD NODES

The SDQKD abstraction presents QKD systems as manageable network elements while hiding their internal complexity and protecting key material. Its model supports physical and virtual links, application management, and centralized optimization.

III. ABSTRACTION MODEL FOR SOFTWARE-DEFINED QKD NODES

  • The SDN controller manages QKD systems through an abstraction that hides hardware and software complexity while keeping internal information and key material confidential.The SDN agent gathers node data, communicates with the controller, and orchestrates the local key management system and QKD systems.Source: §III · pp. 3–4
  • The model targets standard interfaces, reduced integration time, optical spectrum allocation, and centralized optimization of key generation and use.The functional QKD network can include virtual links over multi-hop paths, such as B to D through C.Source: §III · p. 3, Figure 2 · p. 4
  • The model’s four components are interfaces, applications, links, and capabilities or additional information.Applications use keys from the local key management system; links may be physical or virtual trusted-relay associations.Source: §III · p. 4
  • A physical QKD link joins two QKD systems over a point-to-point quantum channel, while a virtual link connects nodes through intermediate trusted nodes.The controller can automate physical-link creation to optimize spectrum allocation and monitor link performance.Source: §III · p. 4
  • The controller detects and manages client applications, which request key material through their endpoints without needing awareness of the QKD network.Central tracking also supports application and key-usage accounting, and the three base operations underpin more complex uses such as multicast associations.Source: §III · p. 4

IV. TESTBED

The Madrid field trial deployed an SDQKD network on Telefonica’s production infrastructure, combining quantum and classical channels with SDN management. It demonstrated co-propagation, multi-receiver key generation, and security use cases across communications layers.

IV. TESTBED

  • The quantum channel was co-propagated with commercial classical communications, and the testbed reports tolerance of more than 20 classical channels at 100 Gbps in the same C band.The testbed used commercial OTN platforms to inject the quantum channel without nonstandard equipment.Source: §IV · p. 5
  • The network added QKD keys incrementally to existing security infrastructure by XOR-ing them with standard-protocol keys when composable, retaining existing protocol certifications.The field trial also implemented use cases to secure multiple communication layers among points of presence.Source: §IV · p. 5
  • Above 70 kbps on Almagro–Norte and above 20 kbps on Almagro–Concepcion were calculated from measured signals with quantum and classical channels coexisting.Almagro–Norte was 3.9 km with around 6 dB losses; Almagro–Concepcion was 6.4 km with around 7 + 4 dB losses, including a 20 km spool.Source: §IV · p. 5
  • The Madrid testbed connected three Telefonica Spain production facilities, with one transmitter at Almagro and receivers at Norte and Concepcion.Norte–Concepcion carried classical channels only and supported a multi-hop virtual link using SDN and QKD keys.Source: §IV · p. 5
  • The production trial used RESTCONF interfaces and a YANG-based abstraction for controller-agent communication, with RabbitMQ notifications for agent changes.Multiple server interfaces separated control, QKD/network, and data channels before multiplexing them with the quantum channel.Source: §IV · p. 6
  • The Almagro–Norte OTDR measurement showed around 6 dB loss in each direction, while the OSA capture showed classical channels alongside the quantum channel.Up to 17 classical channels were used; a pilot tone near 1550 nm marked the quantum channel and supported synchronization.Source: Figure 4 · p. 5, §IV · p. 6

V. CONCLUSIONS AND FUTURE CHALLENGES

The demonstrations integrate QKD into current operator infrastructure through a converged quantum-classical network sharing physical and logical resources. The proposed architecture brings both communications under shared management and supports staged deployment alongside existing security mechanisms.

V. CONCLUSIONS AND FUTURE CHALLENGES

  • QKD network designs should accommodate coexistence with conventional communications or separated networks, and both dynamic SDN allocation and fixed schemes.Source: §V · p. 6
  • The demonstrated network shares physical and logical infrastructure for quantum and classical channels, bringing both under the same management.This enables network optimization to better use resources.Source: §V · p. 6
  • The architecture supports staged deployment and existing security mechanisms, avoiding large upfront deployment costs.Production-site demonstrations showcase the technology’s maturity for real-world services.Source: §V · p. 6
Loading 1907.00174v1…