Deploying and validating a metropolitan QKD secure network: architecture and field performance

This study reports on the successful field deployment of a metropolitan-scale Quantum Key Distribution (QKD) network in Milan, Italy. As classical public-key infrastructure faces increasing threats from quantum computing, QKD offers a method for establishing symmetric keys with information-theoretic security. The authors integrated QKD hardware, a standards-compliant Key Management (KM) layer, and Software-Defined Networking (SDN) to create a robust, reconfigurable communication infrastructure across three commercial data centers.

The network utilizes a four-node topology across three physical locations (Points of Presence). The architecture is organized into four distinct layers: the QKD layer for physical key generation, the KM layer for key storage and distribution, the encryption layer for securing traffic, and the application layer for end-user workloads. A key feature of this deployment is the use of SDN-controlled optical switching and trusted-node routing, which allows the network to dynamically reconfigure paths and maintain a consistent inventory of cryptographic keys across the infrastructure, even in the event of link failures or simulated denial-of-service attacks.

The system was evaluated over a 14-hour period, during which it maintained stable Secure Key Rate (SKR) performance despite the complexities of a time-varying, multi-hop topology. The KM layer successfully managed key distribution across different paths, automatically triggering optical switches to balance key inventories based on predefined thresholds. Application-layer validation confirmed that encrypted traffic could be maintained seamlessly across these reconfigurations, demonstrating that the integrated stack is ready for real-world production environments.