Michael Hentschel

Current quantum key distribution (QKD) networks focus almost exclusively on transporting secret keys with the highest possible rate. Consequently, they are built as mostly fixed, ad hoc, logically, and physically isolated infrastructures designed to avoid any penalty to the quantum channel. This architecture is neither scalable nor cost-effective and future, real-world deployments will differ considerably. The structure of the MadQCI QKD network presented here is based on disaggregated components and modern paradigms especially designed for flexibility, upgradability, and facilitating the integration of QKD in the security and telecommunications-networks ecosystem. These underlying ideas have been tested by deploying many QKD systems from several manufacturers in a real-world, multi-tenant telecommunications network, installed in production facilities and sharing the infrastructure with commercial traffic. Different technologies have been used in different links to address the variety of situations and needs that arise in real networks, exploring a wide range of possibilities. Finally, a set of realistic use cases have been implemented to demonstrate the validity and performance of the network. The testing took place during a period close to three years, where most of the nodes were continuously active.

The conventional point-to-point setting of a Quantum Key Distribution (QKD) protocol typically considers two directly connected remote parties that aim to establish secret keys. This work proposes a natural generalization of a well-established point-to-point discrete-modulated continuous-variable (CV) QKD protocol to the point-to-multipoint setting. We explore four different trust levels among the communicating parties and provide secure key rates for the loss-only channel and the lossy & noisy channel both in the asymptotic limit and in the finite-size regime. We experimentally demonstrate the feasibility of our protocols in an access network topology with 10 km-long access links, achieving a key rate of $7.09 \times 10^{-3}$ bits per symbol or of 0.866 Mbit/s. Our study shows that discrete-modulated CV-QKD is a suitable candidate to connect several dozens of users in a point-to-multipoint network, achieving high rates at a reduced cost, using off-the-shelf components employed in modern communication infrastructure.

Since 2004 AIT has developed a software suite for QKD post processing and key routing in trusted repeater networks. This software provides a set of building blocks to integrate sifting, error estimation, error correction, confirmation, privacy amplification and information-theoretically secure message authentication. Accompanying the QKD post-processing is the Quantum Point-to-Point Protocol (Q3P) node which enforces information-theoretically secure network peer-to-peer communication for classical applications. We already reported on the support for different DV and CV-QKD protocols, and high-performance error correction using GPUs for terrestrial QKD. Here we will discuss the following new capabilities of the software * a low dependency footprint for future use on satellites, * hibernation of QKD post-processing pipelines and switching between them for key establishment with different ground terminals and satellites, * CoAP interfaces to cover demands of the control and management plane in today’s network environment, and * the port to ARM/FPGA SoC boards. The CoAP interfaces allow rapid scripting of QKD modules or AIT QKD based applications with Python or even Bash. Utilities and tools, as well as a boilerplate setup for QKD module coding projects, also support the creation of new QKD post-processing modules or QKD based user applications. The AIT QKD software is bundled with management tools, partly GUI oriented. The software is available under different license options and AIT welcomes suggestions from academic groups or industry to co-operate.