Interconnecting Regional QKD Networks: Hybrid Key Delivery Across Quantum Domains

TL;DR

This paper introduces a standards-driven hybrid key delivery system connecting isolated QKD networks over classical WANs, enhancing secure wide-area quantum communication.

Contribution

It presents a novel distributed architecture and implementation of a hybrid key relay system for interconnecting QKD domains using classical networks.

Findings

Implemented in an operational testbed with three regional subnetworks.

Demonstrated scalable key delivery with secure relaying and dynamic routing.

Achieved performance results validating the system's effectiveness.

Abstract

QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.