Current quantum key distribution (QKD) networks focus almost exclusively on transporting secret keys at the highest possible rate. Consequently, they are built as mostly fixed, ad hoc, logically, and physically isolated infrastructures designed to avoid any penalty to the quantum channel. This architecture is neither scalable nor cost-effective and future, real-world deployments will differ considerably. The structure of the MadQCI QKD network presented here is based on disaggregated components and modern paradigms especially designed for flexibility, upgradability, and facilitating the integration of QKD in the security and telecommunications-networks ecosystem. These underlying ideas have been tested by deploying many QKD systems from several manufacturers in a real-world, multi-tenant telecommunications network, installed in production facilities and sharing the infrastructure with commercial traffic. Different technologies have been used in different links to address the variety of situations and needs that arise in real networks, exploring a wide range of possibilities. Finally, a set of realistic use cases has been implemented to demonstrate the validity and performance of the network. The testing took place during a period close to three years, where most of the nodes were continuously active.

Quantum-key-distribution (QKD) networks are gaining importance and it has become necessary to analyze the most appropriate methods for their long-distance interconnection. In this paper, four different methods of interconnecting remote QKD networks are proposed. The methods are used to link three different QKD testbeds in Europe, located in Berlin, Madrid, and Poznan. Although long-distance QKD links are only emulated, the methods used can serve as a blueprint for the secure interconnection of distant QKD networks in the future. Specifically, the presented approaches combine, in a transparent way, different fiber and satellite physical media, as well as common standards of key delivery interfaces. The testbed interconnections are designed to increase the security by utilizing multipath techniques and multiple hybridizations of QKD and post-quantum cryptography (PQC) algorithms.

Advancements in quantum computing pose a significant threat to most of the cryptography currently deployed in our communication networks. Fortunately, cryptographic building blocks to mitigate this threat are already available; mostly based on Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD), but also on symmetric cryptography techniques. Notably, those building blocks must be deployed as soon as possible in communication networks due to the “harvest-now decrypt-later” attack scenario, which is already challenging our sensitive and encrypted data today. Following an agile and defense-in-depth approach, Hybrid Authenticated Key-Exchange (HAKE) protocols have recently been gaining significant attention. Such protocols have the benefit of modularly combining classical (symmetric) cryptography, PQC, and QKD to achieve strong confidentiality, authenticity, and integrity guarantees for network channels. Unfortunately, only a few protocols have yet been proposed (mainly Muckle and Muckle+) with different flexibility guarantees. Looking at available standards in the network domain – especially at the Media Access Control Security (MACsec) standard – we believe that HAKE protocols could already bring strong security benefits to MACsec today. MACsec is a standard designed to secure communication at the data link layer in Ethernet networks by providing confidentiality, authenticity, and integrity for all traffic between trusted nodes. In addition, it establishes secure channels within a Local Area Network (LAN), ensuring that data remain protected from eavesdropping, tampering, and unauthorized access, while operating transparently to higher layer protocols. Currently, MACsec does not offer enough protection against the aforementioned threats. In this work, we tackle the challenge and propose a new versatile HAKE protocol, dubbed VMuckle, which is sufficiently flexible for use in MACsec. The use of VMuckle in MACsec provides LAN participants with quantum-safe hybrid key material to ensure secure communication even in the event of cryptographically relevant quantum computers.

Within the Madrid Quantum Communication Infrastructure (MadQCI), a cloud-like, quantum-enabled network scenario has been commissioned to promote the growth of the quantum technology scientific community. This scenario is designed to provide both quantum communication primitives and quantum-enabled services to potential end users. This work focuses on exposing these quantum services in a user-friendly manner by abstracting the underlying technical complexity, letting end users operate without prior knowledge of implementation details. To this end, multiple quantum services—the SD-QKD software stack, QRNG, Quantum-Safe TLS, and Quantum-Safe IPsec as a Service—are offered following the cloud “anything as a service” (XaaS) model. The delivery of quantum-enabled services is therefore researched using an applied and transferable cloud-based paradigm.

Quantum Communications promise advances in cryptography, quantum computing and clock synchronisation, among other emerging applications. However, communication based on quantum phenomena requires an extreme level of isolation from external disturbances, complicating the co-propagation of quantum and classical signals. The challenge is greater when deploying networks that are both heterogeneous (e.g., multiple vendors) and installed in production facilities, given that this type of infrastructure already supports networks loaded with their own requirements. Moreover, to achieve a broad acceptance among network operators, the joint management and operation of quantum and classical resources, compliance with standards, and legal and quality assurance need to be addressed. This article presents solutions to the aforementioned challenges validated in the Madrid quantum network during the implementation of the projects CiViC and OpenQKD. This network was designed to integrate quantum communications in the telecommunications ecosystem by installing quantum-key-distribution modules from multiple providers in production nodes of two different operators. The modules were connected through an optically-switched network with more than 130 km of deployed optical fibre. The tests were done in compliance with strict service level agreements that protected the legacy traffic of the pre-existing classical network. The goal was to ensure full quantum-classical interoperability at all levels, while limiting the modifications to optical transport and encryption and complying with relevant standards. This effort is intended to lay the foundation for large-scale quantum network deployments.