Source-linked AI summary
Hybrid QKD-PQC Network Emulation through Automated and Scalable Cloud-Native Orchestration
Iván Melijosa, Javier Pérez, Borja Nogales, Iván Vidal, Francisco Valera
TL;DR
Hybrid QKD-PQC networks need systematic experimental evaluation, but physical QKD infrastructure is costly and existing emulation lacks scalable hybrid support. Quditto adds automated cloud-native deployment, post-quantum nodes, and secure key management; validation reports sublinear deployment-time scaling and deployments exceeding 200 nodes in approximately six minutes.
Problem
Systematic, large-scale evaluation of hybrid QKD-PQC networks remains limited because physical testbeds are costly, difficult to reproduce, and inaccessible to much of the research community.
Source: §2.1 · p. 5Method
Quditto combines automated cloud and multi-cluster infrastructure deployment with optimized provisioning, native IKEv2-based post-quantum nodes, and persistent access-controlled key storage.
Source: §1 · p. 3Results
Deployment time scaled sublinearly, and deployments exceeded 200 nodes in approximately six minutes.
Source: §5.1 · pp. 17–18, §6 · p. 20Takeaways & Limitations
Validation supports large-scale hybrid-network evaluation without high-performance computing infrastructure.
Source: §6 · p. 20
Abstract
from arXiv · showhide
The ongoing transition toward quantum-safe networking has motivated the development of hybrid network architectures integrating Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC). However, the experimental evaluation of hybrid QKD-PQC network architectures remains constrained by the high cost and limited accessibility of quantum hardware, as well as by the limited support for hybrid QKD-PQC networks in existing emulation platforms. Quditto is an open-source emulation platform originally designed for QKD networks that enables cost-effective and reproducible experimentation without requiring dedicated physical quantum infrastructure. Building on this foundation, this work presents Quditto as a hybrid QKD-PQC network emulation platform featuring automated and scalable cloud-native orchestration. The proposed platform introduces four principal contributions: a cloud-native orchestrator enabling fully automated infrastructure deployment across cloud and multi-cluster environments; an optimized provisioning workflow enabling large-scale quantum-safe network emulation; native integration of post-quantum nodes enabling unified emulation of hybrid QKD-PQC networks; and a secure key management module providing persistent and access-controlled storage of cryptographic material. Experimental validation demonstrates sublinear orchestration-time scaling with network size and successful end-to-end hybrid QKD-PQC key establishment on a representative spine-leaf deployment, thereby enabling the systematic evaluation of quantum-safe networking mechanisms in large-scale heterogeneous network environments.
1. Introduction
The original Quditto lacked hybrid QKD-PQC support and depended on manual infrastructure provisioning and sequential deployment. This work adds cloud-native orchestration, optimized provisioning, native PQC nodes, and secure key management.
1. Introduction
- Quditto’s original design lacked hybrid-network emulation, required pre-existing network-accessible devices and manual provisioning, and used a sequential workflow that constrained scalability.The work presents a hybrid-capable, autonomous, and scalable platform to address these limitations.Source: §1 · p. 3
- The platform integrates post-quantum nodes using IKEv2-based key establishment with ML-KEM and ML-DSA for unified hybrid QKD-PQC topologies.Source: §1 · p. 3
- A cloud-native orchestrator automates virtual-infrastructure deployment across cloud-hosted virtual machines and multi-cluster Kubernetes environments.Source: §1 · p. 3
- Prebuilt container images and parallel provisioning and initialization support deployments of up to 200 nodes in approximately six minutes.Source: §1 · p. 3
- A secure key-management module provides persistent, access-controlled storage of cryptographic material using HashiCorp Vault.Source: §1 · p. 3
- The platform supports evaluation of QKD protocols, key-management interfaces, hybrid key establishment, and cryptographic performance on large emulated networks without dedicated quantum hardware.Source: §1 · p. 3
2. State of the Art
The state-of-the-art review covers hybrid QKD-PQC architectures, quantum-safe emulation platforms, and orchestration frameworks, identifying gaps that motivate a scalable emulation platform for hybrid networks.
2.1. Hybrid QKD-PQC Network Architectures
- Hybrid QKD-PQC architectures combine QKD’s information-theoretic security with PQC’s deployment flexibility, but systematic, large-scale experimental evaluation remains difficult and costly.Existing validation is often limited to small physical testbeds that are difficult to reproduce and access.Source: §2.1 · pp. 4–5
2.2. Emulation Platforms for Quantum-Safe Networks
- Existing simulation, emulation, and physical testbed approaches do not natively provide scalable, controlled, reproducible evaluation of hybrid QKD-PQC network behavior.Reviewed platforms lack post-quantum components or distributed real-network nodes, while physical deployments are costly and limited in scale.Source: §2.2 · p. 5
2.3. Orchestration Frameworks for Emulation Platforms
- Current orchestration frameworks lack declarative support for heterogeneous network topologies and unified quantum-channel simulation with post-quantum protocol deployment.These gaps constrain systematic evaluation across heterogeneous infrastructure without dedicated quantum hardware or specialized infrastructure expertise.Source: §2.3 · p. 6
3. Design
Quditto extends its existing distributed-emulation design with native hybrid-network support and automated, scalable virtual-infrastructure deployment. Its layered architecture coordinates provisioning, QKD and PQC nodes, quantum-channel modeling, and secure key management.
3. Design
- Quditto adds native QKD-PQC configuration and automated, scalable infrastructure deployment while retaining distributed emulation and standardized key-delivery interfaces.The design aims to provide a unified and reproducible platform for hybrid quantum-safe network emulation.Source: §3 · p. 6
3.1. Quditto Orchestrator
- The orchestrator deploys virtual infrastructure and the emulation environment from declarative configuration, separating those stages while managing them through a common interface.Beyond specifying infrastructure and topology, the workflow requires no further manual intervention and can operate across multi-cluster environments.Source: §3.1 · pp. 7–8
3.2. Underlying Infrastructure
- Quditto supports virtual-machine, mixed virtual-machine and container-cluster, and distributed multi-cluster deployments; container orchestration provides the basis for large-scale emulation.Containers reduce resource footprint, speed instantiation, and support portability across heterogeneous infrastructure.Source: §3.2 · p. 8
3.3. Network Emulation Environment
- The emulation environment combines QKD and PQC nodes with a modeling engine, and can instantiate both logically separated planes for hybrid key establishment.A site may host a QKD node, a PQC node, or both; IKEv2-based PQC key establishment uses post-quantum algorithms and a shared key-identifier model across planes.Source: §3.3 · pp. 8–10
- Each node’s secure key-management component persistently stores keys from both planes and post-quantum session state, with authenticated access and fine-grained controls.The unified storage layer exposes a consistent retrieval interface and supports auditable, traceable operations.Source: §3.3 · p. 10
4. Implementation
Quditto combines quantum and post-quantum nodes, a quantum-behavior modeling engine, and an orchestrator that provisions infrastructure and initializes emulated networks. Its implementation supports hybrid key establishment and automated deployment across virtual machines and Kubernetes clusters.
4. Implementation
- Quditto is a Python-based platform organized around node, modeling-engine, and orchestrator packages.Its quantum and post-quantum nodes use local Vault instances for shared cryptographic-material management.Source: §4 · p. 10, §4.1 · p. 10
4.1. Quditto Node Package
- Quantum and post-quantum nodes expose ETSI key interfaces; the latter establish keys with IKEv2, ML-KEM, and ML-DSA.The node workflow stores keys in local Vault instances for later identifier-based retrieval; PQC nodes also retain IKE session state for rekeying.Source: §4.1 · pp. 10–13
4.2. Quditto Modeling Engine Package
- The modeling engine uses RabbitMQ and NetSquid to process QKD requests asynchronously, parallelizing across links while serializing requests on each link.It collects sufficient key material, enforces protocol- and link-dependent latency, and publishes results to both nodes.Source: §4.2 · p. 13
4.3. Quditto Orchestrator Package
- The orchestrator provisions cloud virtual machines and deploys Quditto on machines or Kubernetes, using Terraform, Helm charts, and Kubernetes bootstrap tooling.Declarative YAML specifies infrastructure, cluster configuration, component placement, and services, including multi-cluster deployment.Source: §4.3 · p. 14, §4.3.1 · p. 14
4.3.1. Resource Provisioning and Execution Environment Preparation
- Users can use existing connected infrastructure or delegate virtual-infrastructure provisioning and network deployment to the orchestrator.Cluster initialization is treated as a fixed one-time overhead, separate from network-scale orchestration measurements.Source: §4.3.2 · pp. 14–15
4.3.2. Deployment Workflow of the Quditto Network Emulation Environment
- Parallel provisioning, pod deployment, dependency installation, and service initialization reduce orchestration time and support networks of hundreds of nodes.The workflow installs prebuilt component images when available, otherwise installs dependencies during deployment before configuring and starting the emulated network.Source: §4.3.2 · pp. 15–16, Figure 6 · p. 15
5. Validation
The evaluation measures deployment scaling and tests key establishment across a hybrid spine-leaf network under background traffic. Orchestration time grows sublinearly through 200 nodes, and the test completes key distribution between post-quantum and quantum nodes.
5.1. Orchestration Performance
- 7.6 s for 2 nodes to 298.8 s for 200 nodes—a 39-fold time increase for 100-fold network growth, with total orchestration still approximately six minutes.The deployment stage dominates at larger sizes; the paper attributes the sublinear trend to concurrent pod instantiation.Source: Figure 7 · p. 17, §5.1 · p. 17
- Deployment scale increased from the original platform's practical limit of 20 nodes to 200 or more in approximately six minutes.The paper attributes this change to prebuilt images and parallelized deployment and initialization.Source: §5.1 · pp. 17–18
- At 50 nodes, reduced-resource machines required 96 s for environment deployment and 65 s for node initialization, versus 87 s and 25 s under the high-resource configuration.The paper reports the initialization stage as more sensitive to resource reduction than the deployment stage.Source: §5.1 · p. 18
5.2. Functional Validation of Hybrid Networks
- The spine-leaf test places QKD nodes at the spine, mixed QKD/PQC nodes at the leaf, and PQC nodes at the access level.The key-establishment path runs from an access-level PQC site to a spine-level quantum site while background traffic is measured.Source: §5.2 · p. 18, Figure 8 · p. 19
- Quantum-key generation took 10.895 s and 22.838 s in the two measured generations, while PQC key-request and recovery round trips took 1.210 s and 0.820 s.The paper notes that quantum-material generation varies with the probability of quantum measurements and was performed on demand.Source: §5.2 · pp. 18–19
- 38.033 s completes key distribution from a post-quantum access node to a quantum spine node under average background traffic of 325 requests per minute.The 36-node, 35-link test topology has 19 QKD links and 16 PQC links.Source: §5.2 · p. 19, Figure 8 · p. 19, Figure 9 · p. 20
6. Conclusion
Quditto addresses automation, scalability, and hybridization challenges through cloud-native provisioning, parallel deployment, post-quantum integration, and secure key management. Validation reports sublinear orchestration scaling and successful hybrid key exchange on a representative spine-leaf topology.
6. Conclusion
- Quditto adds automated cloud and multi-cluster provisioning, parallel deployment, IKEv2-based ML-KEM and ML-DSA nodes, and Vault-backed persistent, auditable key storage.The key-management module also provides integrity-protected storage of cryptographic material.Source: §6 · p. 20
- More than 200 nodes deploy in approximately six minutes, versus the original Quditto’s approximately 20-node limit, with deployment time scaling sublinearly.Under resource-constrained conditions, deployment remains primarily constrained by Kubernetes scheduling overhead rather than computational resource availability.Source: §6 · p. 20
- Future work targets additional topologies and larger hybrid deployments, adaptive QKD/PQC/hybrid configurations, and progressive integration with physical QKD devices.These directions would further characterize orchestration overhead across network structures and enable validation against real-world quantum hardware.Source: §6 · p. 21