A Scalable Cloud-Orchestrated and Service-Oriented Multi-Domain QKD Network with PQC Integration

Source: arXiv:2607.12765 · Published 2026-07-14 · By Konstantinos Krilakis, Antonia Tsili, Aikaterini Mandilara, Dimitris Syvridis

TL;DR

This paper addresses the key challenges in scaling quantum key distribution (QKD) networks across heterogeneous infrastructures and administrative domains, which traditionally suffer from vendor-specific interfaces, trusted-node constraints, limited interoperability, and high deployment costs. The authors propose a flexible, cloud-orchestrated, multi-domain QKD network architecture that integrates vendor-agnostic QKD systems with Software Defined Networking (SDN) orchestration and cloud-managed trust services. They combine QKD with post-quantum cryptography (PQC) based authentication and key encapsulation, enabling secure end-to-end key distribution that extends beyond native QKD links across multiple administrative boundaries.

The system was experimentally validated on a 12-domain testbed featuring heterogeneous hardware platforms and QKD nodes from three different vendors, along with domains lacking QKD infrastructure. Results demonstrate that the PQC and SDN overheads remain relatively low even on constrained devices. The main performance bottleneck comes from vendor-specific QKD key retrieval and key streaming limitations during relay. The proposed framework enables flexible quantum-safe key transport over long distances and across legacy infrastructures while retaining multi-vendor interoperability and zero-trust security principles.

Key findings

• The multi-domain system was deployed on a real-world 12-domain testbed incorporating QKD nodes from three vendors (Toshiba MU, ID Quantique Clavis XG, ThinkQuantum QUKY) plus classical domains without QKD.
• PQC and SDN orchestration overhead added minimal latency and processing load on constrained devices like Raspberry Pi and RISC-V platforms.
• QKD key retrieval and vendor-specific streaming interfaces are the main throughput bottlenecks in the deployed system.
• The proposed key relay method combines QKD-generated keys masked with XOR operations and PQC-based KEM encapsulation to securely extend key transport over quantum and non-quantum domains.
• Multi-factor authentication leveraging PQC KEM key pairs and TLS ensures zero-trust access across domains with cloud-supervised policy updates and token exchange.
• The system supports dynamic SDN-based network path reconfiguration and fine-grained policy enforcement for client pools within domains.
• Trusted nodes operate as domain proxies performing key masking and forwarding, enabling trusted-node-like emulation over incomplete or dangling chain edges.
• The flexible software architecture supports hybrid QKD-PQC deployments and is hardware agnostic, facilitating gradual migration within existing networks.

Threat model

The adversary is assumed to have no access or control over trusted nodes (TNs), cloud management services, or the administrative domain gateways. The adversary can observe classical network traffic but cannot compromise domain authentication mechanisms based on PQC keys. Attacks on the quantum channels are modeled via the QBER metric and mitigated by trusted-node relay and PQC encapsulation. The model follows a zero-trust principle requiring strict multi-factor authentication and continuous policy verification. Attacks attempting to impersonate authenticated clients or intercept/modify keys are prevented via PQC-based key encapsulation and mutual authentication protocols.

Methodology — deep read

The authors first define a threat model in which adversaries cannot compromise trusted nodes (TNs) or the cloud policy enforcement; edge and intermediate domains enforce strict authentication policies via PQC-based multi-factor mechanisms. Attacks on classical links are mitigated with post-quantum secure key encapsulation. The overall assumption is a zero-trust access model where all network entities must authenticate and be authorized by cloud-managed policies.

The testbed data consists of a 12-domain network organized into quantum domains (each with one QKD node) and classical domains without QKD, interconnected via administrative boundaries. The QKD pairs implement variations of BB84 protocols with trusted-node chain topologies, including nodes from three vendors. Hardware platforms vary from Raspberry Pi, RISC-V boards, to x64 systems supporting SDN gateway routers.

Architecturally, each domain contains a Domain Secure Services Provider (DSSP) that authenticates clients via multi-factor methods incorporating TLS and PQC KEM asymmetric key pairs. Clients request keys from local QKD terminals. Key distribution across domains uses a multi-stage protocol whereby QKD-generated keys are forwarded using XOR masking by DSSPs and PQC-based key encapsulation (KEM) is used to securely transfer keys over non-quantum or vendor-incompatible domain boundaries.

Network management and orchestration is implemented via an SDN controller (ONOS) managing OpenFlow 1.3 switches enabling dynamic flow and policy control per client pools. The cloud control plane enforces policies, manages certificates, and provides zero-touch provisioning via distributed PKI with PQC capabilities.

The system was trained/deployed on a real testbed with extensive monitoring of latency, packet overhead, and key relay throughput metrics. Authentication and policy workflows were instrumented using logged token exchanges and cryptographic protocol traces. Detailed intradomain and interdomain message flows are captured illustrating handshake and key transfer phases.

Evaluation includes latency measurements of key distribution transactions, processing overhead caused by SDN orchestration and PQC operations on constrained hardware, and end-to-end successful key relay tests spanning multiple quantum and classical domains. Although no explicit cross-validation or statistical tests are mentioned, diverse deployment topologies and multi-vendor QKD devices provide practical reproducibility. Code is implemented as portable, lightweight application-layer libraries supporting KTLS but it is unclear if public source code or datasets are released.

As a concrete example, a client in one quantum domain authenticates through TLS and PQC KEM secret key operations to retrieve a QKD-generated symmetric key, which is then securely forwarded XOR-masked by the DSSP through intermediate trusted nodes and finally encapsulated via PQC KEM to a client in a classical domain. This end-to-end multi-domain key transport extends quantum security guarantees beyond native QKD links.

Technical innovations

• A vendor-agnostic, cloud-orchestrated multi-domain QKD network architecture integrating QKD with SDN orchestration and cloud-managed trust services.
• A hybrid key relay mechanism combining QKD-generated keys with post-quantum cryptography key encapsulation to enable quantum-safe key transport across non-quantum and heterogeneous domain boundaries.
• A multi-factor zero-trust authentication and access framework leveraging TLS coupled with PQC KEM asymmetric key pairs and cloud policy enforcement.
• SDN-driven dynamic network path reconfiguration and client pool segmentation to support programmable, multi-vendor QKD and classical infrastructures.

Datasets

• 12-domain heterogeneous QKD-classical network testbed — 12 domains with mixed hardware and vendor QKD nodes (Toshiba MU, ID Quantique Clavis XG, ThinkQuantum QUKY) — Internal real-world deployment

Baselines vs proposed

• SDN and PQC overhead on constrained devices: processing latency increase < 10ms vs baseline with no orchestration or PQC
• End-to-end key relay latency dominated by QKD key retrieval times — bottleneck observed compared to PQC encapsulation and SDN forwarding overheads
• System interoperability across 3 different vendor QKD devices — successful seamless key relay verified vs no interoperability in legacy isolated networks

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.12765.

Fig 1: High-level schematic illustration of the proposed network model. Each disk represents a domain; The white cubes

Fig 9: The cloud servers

Fig 10: Toshiba MU nodes

Fig 11: ThinkQuantum QUKY

Fig 12: ID Quantique Clavis XG

Limitations

• Performance bottleneck caused by vendor-specific QKD key streaming interfaces limits throughput and latency improvements.
• No thorough adversarial or security robustness evaluation beyond protocol design and trust assumptions on TNs and cloud components.
• Experimental evaluation limited to a single real-world testbed; scalability and deployment challenges in larger or more heterogeneous networks remain to be explored.
• No public release of code or datasets limiting independent reproducibility beyond provided architectural descriptions.
• Assumes existence of fully trusted nodes and domains which may be unrealistic in some deployment scenarios.
• Protocol relies on cloud-managed policy enforcement which introduces a central point of trust and potential availability constraints.

Open questions / follow-ons

• How will the system scale and perform latency-wise in larger multi-domain deployments with dozens or hundreds of domains and QKD nodes?
• What is the security impact if trusted nodes or cloud managers are compromised; can zero-trust principles be strengthened further?
• How robust is the approach under network failures or partial connectivity loss among domains, especially for key relay continuity?
• What are effective mechanism designs for cross-vendor standardization of QKD key streaming APIs to reduce vendor-specific bottlenecks?

Why it matters for bot defense

For bot-defense or CAPTCHA practitioners investigating quantum-safe key distribution mechanisms, this work illustrates a practical multi-domain QKD deployment enhanced with post-quantum cryptography integration. The architecture provides a blueprint for securely orchestrating quantum key material in heterogeneous vendor environments under zero-trust principles, which is directly relevant for securing critical backend key management services that protect CAPTCHA validation or bot-detection infrastructure. The hybrid QKD-PQC approach balances unconditional security with practical scalability and interoperability, highlighting that while pure QKD is limited in scalability and integration, combining it with PQC enables more flexible and cloud-manageable quantum-safe protections. Understanding this layered quantum-classical authentication and key relay framework can inform designs for future-proof CAPTCHA backend services resistant to quantum adversaries. However, the demonstrated bottlenecks in vendor interoperability and trusted-node reliance remain open challenges for deploying truly large-scale or adversarially hardened quantum-safe authentication systems.

Cite

@article{arxiv2607_12765,
  title={ A Scalable Cloud-Orchestrated and Service-Oriented Multi-Domain QKD Network with PQC Integration },
  author={ Konstantinos Krilakis and Antonia Tsili and Aikaterini Mandilara and Dimitris Syvridis },
  journal={arXiv preprint arXiv:2607.12765},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.12765}
}

Read the full paper

• arXiv:2607.12765 (abstract)
• arXiv:2607.12765 (PDF)