# Quantum key distribution in a packet-switched network

Reem Mandil<EMAIL_ADDRESS>Cisco Quantum Lab, Los Angeles,
California, USA  University of Toronto, Toronto, Canada  Stephen DiAdamo
<EMAIL_ADDRESS>Cisco Quantum Lab, Garching bei München, Germany  Bing Qi
<EMAIL_ADDRESS>Cisco Quantum Lab, Los Angeles, California, USA  Alireza
Shabani  Cisco Quantum Lab, Los Angeles, California, USA

###### Abstract

Packet switching revolutionized the Internet by allowing the efficient use of
network resources for data transmission. In a previous work, we introduced
packet switching in quantum networks as a path to the Quantum Internet and
presented a proof-of-concept for its application to quantum key distribution
(QKD). In this paper, we outline a three-step approach for key rate
optimization in a packet-switched network. Our simulated results show that
practical key rates may be achieved in a sixteen-user network with no optical
storage capacity. Under certain network conditions, we may improve the key
rate by using an ultra-low-loss fiber delay line to store packets during
network delays. We also find that implementing cut-off storage times in a
strategy analogous to real-time selection in free-space QKD can significantly
enhance performance. Our work demonstrates that packet switching is imminently
suitable as a platform for QKD, an important step towards developing large-
scale and integrated quantum networks.

##  I Introduction

Packet-switched communication networks were introduced as an efficient and
scalable alternative to circuit switching in the early sixties [1, 2]. Today,
packet switching is the dominant mode of operation in the Internet. Recently
we have introduced packet switching as a paradigm for quantum networks using
hybrid (classical-quantum) data frames [3]. Inside a frame, a quantum payload
is prepended with a classical header containing information for routing and
more. Frames travel from sender to receiver through a series of routers which
process the header to determine the channel forward based on the current
conditions of the network (Fig. 1). This is in contrast to a circuit-switched
network where a dedicated channel is established between sender and receiver
and reserved until communication is complete (Fig. 1).

There are important considerations to be made when deciding whether packet
switching or circuit switching is best suited for a network application. In a
circuit-switched network, communication across multiple user pairs must be
done in a coordinated fashion in order to enable bandwidth sharing (e.g., via
time or wavelength-division multiplexing). In a packet-switched network, the
communication need not be coordinated in advance. However, frames will
experience delays at the intermediate nodes between users due to finite header
processing times and, under some traffic conditions, queuing times.
Furthermore, packet switching is generally advantageous over circuit switching
when the traffic generated by network users is bursty, characterized by
intervals of activity and intervals of inactivity.

One important application in a quantum network is quantum key distribution
(QKD), a procedure that allows two remote users (e.g., Alice and Bob) to
establish shared encryption keys with information-theoretic security [4, 5].
An important feature of QKD is that it is robust against loss in transmission,
meaning that a secure key can still be established even when most of the
transmitted signals are lost. This suggests that data loss due to delays in a
packet-switched network may be tolerated even without any storage of QKD
signals at the routers. Moreover, the optical loss introduced by an imperfect
storage medium may also be tolerated. Another important feature of QKD is that
key generation is not time-critical, meaning that secure keys need not be
generated immediately before their consumption. This implies that bursty frame
generation may be sufficient since users can establish and store keys for
later use.

Figure 1: (a) Packet-switched network. The channel between sender (S) and
receiver (R) is not predetermined and can be dynamically reconfigured. (b)
Circuit-switched network. A dedicated channel between sender and receiver is
set up before data is transferred between them.

These features motivate our hypothesis that packet switching is imminently
suitable as a platform for QKD. One may of course imagine a scenario where
network users prefer access to a dedicated quantum channel for their key
distribution (e.g., urgent requests or large size requirement for encryption
keys). Furthermore, most existing demonstrations of multi-user QKD are
conducted over dedicated networks [6, 7, 8, 9, 10, 11, 12] where QKD is the
sole task. In this case, it may be beneficial to have a central controller to
coordinate QKD among different user pairs, in a fashion similar to circuit
switching. However, if we wish to integrate QKD with existing classical
networks in order to extend its applications, packet switching is a natural
choice. Therefore, the goal of this paper is to demonstrate the feasibility of
performing QKD in a packet-switched network.

To meet this goal, we take a three-step approach. First, we choose a network
routing protocol which describes how a router handles a frame during network
delays. In this paper, we will investigate three different routing protocols
based on varying optical storage capacity. Second, we simulate the transport
of frames in a network operating under a given routing protocol and traffic
model. The simulation provides us with statistics for the dynamic channel
between each Alice-Bob pair. Lastly, we use the simulated network statistics
to predict the maximum secure key rate for each user pair in the network by
performing a finite-key analysis.

In our previous work [3], we presented a proof-of-concept for QKD in a packet-
switched quantum network, and considered a basic model for a two-user
communication scenario where the routers had no optical storage capacity.
Packet switching in quantum networks is a relatively unexplored topic, but has
been proposed as a solution for overcoming scalability issues in previous
works [13, 14]. Moreover, Ref. [15] has investigated using leading classical
signals to make routing decisions in a QKD network, although packet switching
is not considered in their approach. In this work, we analyze a sixteen-user
network with and without optical storage capacity at the routers. We also
consider a finite-size security analysis for a practical decoy-state QKD
protocol. Our results show that QKD is feasible in a packet-switched network
with today’s commercial technology and that optical storage can be used to
improve its performance under certain conditions.

This paper is organized as follows. In Sec. II, we describe the routing
component of a packet-switched network, including network delays and the
routing protocols considered in this work. We also present a router hardware
design based on current technology. In Sec. III, we describe the QKD protocol
and key rate analysis under consideration. In Sec. IV, we describe our
software tool for simulating the dynamics of a packet-switched network.
Finally, in Sec. V, we present and discuss the simulated QKD results.

##  II Network Routing

In this section, we describe how the routers in a packet-switched network may
handle frames that are intended for a QKD application. We review the frame
structure and outline the network delays and routing strategies considered.

###  II.1 Network Delays

The total time a frame needs to move through a router is the sum of three
sources of delay. First, there is the processing delay, $d_{proc}$, which is
the time to process the classical header and determine the next action for the
frame as well as regenerate the header when needed. Depending on the network
complexity, this delay can range from 10 $\mu s$ to 1,000 $\mu s$ [16]. In
this work, we assume a $d_{proc}$ of 100 $\mu s$. Second, there is the queuing
delay, $d_{queue}$, which is the time the frame must wait before it can be
forwarded from a router (after the header has been processed). This quantity
depends on the traffic conditions of the network and can range from zero to
infinity. Lastly, there is the transmission delay, $d_{trans}$, which is the
time required to transmit the entire frame onto an outgoing link. This is
equal to the temporal frame length, $T_{f}$, which may shrink at each router
it traverses depending on the routing protocol employed.

###  II.2 Routing Protocols

(a) (b)

Figure 2: (a) The classical header and trailer ($\lambda_{C}$) and the quantum
payload ($\lambda_{Q}$) are generated from a laser source and multiplexed into
a hybrid data frame using time-division and wavelength-division multiplexing
(not shown to scale). (b) The hybrid frame includes guard time—a time delay
between the end of the header and the beginning of the payload.

The network routing protocol determines what happens to a frame during the
network delays $d_{proc}^{i}$ and $d_{queue}^{i}$, where the superscript $i$
is used to index each router in the frame’s path from sender to receiver. Fig.
2 depicts a hybrid frame with a quantum payload consisting of weak laser
pulses with repetition rate $R_{t}$ (Hz). The frame may be configured to
include a time delay between the end of the header and the beginning of the
payload, referred to as the guard time, $T_{g}$.

In general, our network routing protocols fall into one of two categories
based on the capacity to store frames at the routers. For protocols based on
no storage, $d_{trans}^{i}$ ($=T_{f}^{i}$) will shrink by a duration equal to
$d_{proc}^{i}+d_{queue}^{i}$ at each router the frame traverses. If
$T_{g}^{i}=0$, this corresponds to the discarding of
$R_{t}(d_{proc}^{i}+d_{queue}^{i})$ pulses in the leading portion of the
payload (note that we consider the lengths of the classical header and trailer
to be negligible compared to the quantum payload). If $T_{g}^{i}>0$, then it
will serve as a buffer to reduce the number of pulses that are lost (i.e., if
$T_{g}^{i}>d_{proc}^{i}+d_{queue}^{i}$, then no pulses are discarded as the
frame shrinks but $T_{g}^{i}$ will decrease accordingly). Note that in each
routing protocol we consider, the guard time is not reset at each router. This
alternative approach may be useful for a quantum network application in which
the payload carries information that should not be lost.

For protocols based on storage, the frame will enter a fiber delay line for a
storage time $T_{s}^{i}\leq d_{proc}^{i}+d_{queue}^{i}$. During $T_{s}^{i}$,
no pulses are discarded from the payload, but they will be subject to the
attenuation of the fiber delay line. If $T_{g}^{i}>0$, then it will again
serve as a buffer to reduce $T_{s}^{i}$ (i.e., if
$T_{g}^{i}>d_{proc}^{i}+d_{queue}^{i}$, then $T_{s}^{i}=0$ but $T_{g}^{i}$
will decrease accordingly). Note that the header may be configured to include
a field that tracks the cumulative time spent in storage as a frame traverses
the network. In this work, we investigate the following three routing
protocols.

  1. 1.

No storage during delays. At each router, a frame will have its payload
discarded for a time $d_{proc}^{i}+d_{queue}^{i}$ and $d_{trans}^{i}$ will
shrink by the same amount. If $d_{trans}^{i}$ reaches zero, then the frame is
discarded from the network.

  2. 2.

Storage during delays (unlimited). At each router, a frame will enter a fiber
delay line for a storage time
$T_{s}^{i}=\max(0,d_{proc}^{i}+d_{queue}^{i}-T_{g}^{i})$ and $d_{trans}^{i}$
will shrink by $\min(T_{g}^{i},d_{proc}^{i}+d_{queue}^{i})$.

  3. 3.

Storage during delays (limited). At each router, a frame will enter a fiber
delay line for a storage time
$T_{s}^{i}=\max(0,d_{proc}^{i}+d_{queue}^{i}-T_{g}^{i})$ and $d_{trans}^{i}$
will shrink by $\min(T_{g}^{i},d_{proc}^{i}+d_{queue}^{i})$. If the total time
a frame has spent in storage reaches a predetermined storage time limit, the
frame is immediately discarded from the network.

In the no storage routing protocol, network delays introduce a controlled
photon loss as a portion of the payload is discarded. In the storage routing
protocols, network delays introduce random photon loss in the payload due to
the attenuation of the fiber delay line. The regime in which one strategy may
dominate over the other therefore depends on factors such as the frame length,
the network delays, and the attenuation of the storage line. A more detailed
motivation for the two types of routing protocols is provided in Appendix A.

To motivate the limited storage routing protocol, we make the observation that
the dynamic channel conditions in a packet-switched network are analogous to
those in free-space QKD under turbulent conditions. In such scenarios, it has
been shown that the key rate can be improved by rejecting key bits when the
channel’s transmittance is below a threshold [17, 18, 19]. In our case, since
the routing history is recorded in the classical header, we can discard frames
en-route, which has the additional benefit of reducing network congestion.
Another option, more analogous to the technique used in free-space QKD, is to
allow all frames to reach the receiver end via the unlimited storage routing
protocol, but enforce a storage time limit (STL) in post-processing. That is,
frames for which $\sum_{i}T_{s}^{i}>STL$ will be excluded from key generation.
In this work, we compare both options for implementing a cut-off channel
transmittance.

###  II.3 Router Hardware

A conceptual router design is shown in Fig. 3. This router behaves as a
quantum version of a reconfigurable optical add drop multiplexer (ROADM).
Frames may arrive at the router from three different directions (North, East,
West) after which a wavelength-division multiplexer is used to separate the
quantum payload from the classical header and trailer. The header is fed into
a control unit to decide how to further process the frame. Once the header has
been processed, the frame will be forwarded towards the next node in the
network (i.e., to another router via the East or West degree, or to a receiver
via an Output channel). The control unit will regenerate the header with
updated fields for the quantum payload duration, guard time, and time spent in
storage prior to transmitting the frame to the next node.

We assume the control unit is capable of processing up to $k$ headers
simultaneously and that the router has access to $q$ variable optical fiber
delay lines via its Add/Drop channels. To achieve an arbitrary delay, each
fiber delay line can be combined with an active optical switch (not
illustrated in figure). The router can also discard frames or partially
discard the quantum payload via its Drop channels. The use of these channels
depends on the network routing protocol being implemented.

We also assume the router to have a minimum insertion loss of 4 dB, which
accounts for the circulators, multiplexers, and optical switch fabric
(excludes the fiber delay lines). Therefore the total loss (dB) at each router
is given by

$loss_{r}^{i}=T_{s}^{i}v_{g}\alpha_{s}+4\hskip 2.84526ptdB,$ (1)

where $v_{g}$ is the speed of light in fiber and $\alpha_{s}$ is the
attenuation coefficient (dB/km) of the fiber storage line. Furthermore, we
assume the router may compensate the polarization drift of all incoming
channels by using a feedback signal generated from the measured drift of the
classical pulses in the header.

Lastly, we note that this router design is directly suitable for the network
configuration in Fig. 4 although additional input fibers and ROADM degrees may
be added to the router depending on the desired connectivity of the network.
We also consider hardware that is directly suitable for the hybrid frame in
Fig. 2 although the hardware can be modified according to the multiplexing
scheme employed for the frame.

Figure 3: Hardware design of a router in a packet-switched network. A frame
arrives at the router from the North, East, or West degree. Channels in the
North degree are directly connected to senders. The links in the East and West
degrees consist of a fiber directly connected to another router; a circulator
is used to allow for bidirectional transmission. A frame passes through a
wavelength-division multiplexer to separate the classical and quantum
information. The classical information is processed in the control unit, which
signals to the optical switch fabric where to route the frame (i.e., to
another router via the East or West degree, or to a receiver via an Output
channel) and regenerates the header prior to transmitting the frame. Add/Drop
channels are used to access variable optical fiber delay lines. Drop channels
are used for discarding pulses or entire frames. PD: photodiode; PBS:
polarizing beam splitter; EPC: electronic polarization controller.

##  III QKD Security Analysis

Practical implementations of QKD adopt the decoy-state method [20, 21, 22, 23]
to allow for use of a weak pulsed laser source instead of an ideal single-
photon source. In this work, we consider a decoy-state asymmetric coding BB84
protocol [24] and we adopt the finite-size security analysis in Ref. [25] to
calculate the secure key rate. In this section, we provide a brief summary of
the QKD protocol and then describe our strategy for key rate optimization in a
packet-switched network.

###  III.1 Protocol Description

1\. Preparation. Alice chooses a bit value $b_{A}$ uniformly at random. Then,
she selects a basis $\in\\{X,Z\\}$ with probabilities $q_{x}$ and $1-q_{x}$,
respectively, and an intensity
$k_{i}\in\mathcal{K}\coloneqq\\{\mu_{1},\mu_{2},\mu_{3}\\}$ with probabilities
$p_{\mu_{1}}$, $p_{\mu_{2}}$, and $p_{\mu_{3}}=1-p_{\mu_{1}}-p_{\mu_{2}}$,
respectively. If Alice chooses the $X$ basis, she prepares a weak laser pulse
of the chosen intensity in the horizontal polarization state $\ket{H}$ for the
bit value $b_{A}=0$ or vertical state $\ket{V}$ for the bit value $b_{A}=1$.
If the $Z$ basis is chosen, she prepares the diagonal (45-degrees)
polarization state $\ket{D}$ for the bit value $b_{A}=0$ or antidiagonal
(135-degrees) state $\ket{A}$ for the bit value $b_{A}=1$. Lastly, she sends
her prepared state to Bob.

2\. Measurement. Bob selects a basis $\in\\{X,Z\\}$ with probabilities $q_{x}$
and $1-q_{x}$, respectively. Then, he performs a measurement in the chosen
basis and records the outcome in a bit value $b_{B}$. More precisely, he
assigns $b_{B}=0$ for a click in single-photon detector $D_{0}$ and $b_{B}=1$
for a click in detector $D_{1}$. If both detectors click, he assigns a random
value to $b_{B}$. If neither detector clicks, he does not assign any value.

3\. Basis reconciliation. Alice and Bob announce their basis and intensity
choices over an authenticated public channel. Based on the information
announced, Alice and Bob identify their raw keys $b_{A}$ and $b_{B}$ from the
instances where they both chose basis $X$ and Bob observed a detection event.
Note that all intensity levels are used for the key generation [25]. They use
the instances where they both chose basis $Z$ and Bob observed a detection
event for phase error estimation.

4\. Post-processing. Alice and Bob perform classical error correction and
privacy amplification on their raw key pair to extract a secure key.

###  III.2 Key Rate Optimization

A convenient feature of QKD security proofs is that the quantum channel
between users is assumed to be fully controlled by an adversary and thus we do
not need to develop a new security proof for QKD in a packet-switched network.
One may ask whether we need to trust the routers which control the discarding
of pulses and frames. If a security proof allows for the adversary to fully
control Bob’s post-selection process, as is the case for the proof adopted in
this work, then we need not trust the routers. Nonetheless, packet switching
poses a unique challenge to QKD due to the dynamic nature of the quantum
channel between users. In order to maximize the secure key rate in the decoy-
state protocol described above, we must optimize over the free parameters
$\\{q_{x},p_{\mu_{1}},p_{\mu_{2}},\mu_{1},\mu_{2}\\}$ [25] which requires
knowledge of the average channel transmittance, $\langle\eta_{tot}\rangle$,
where the average is taken over all frames contributing to the key.
Furthermore, in order to conduct a finite-size analysis, we must determine the
total number of QKD states, $N$, passed to Bob. Depending on the network
routing protocol employed, this may not be equivalent to the number of states
transmitted by Alice, $N_{0}$, due to discarding at the routers. Therefore, in
order to predict the maximum secure key rates from QKD in a packet-switched
network, we need a tool for assessing $\langle\eta_{tot}\rangle$ and $N$ for
each user pair. One may consider an analytic approach to gathering these
statistics, however this quickly becomes infeasible for increased complexity
of the network. The theory of Jackson networks [26] allows us to calculate the
average queuing delay at each router quite simply, but only if the network
obeys a specific traffic model. Instead, we build a network simulation tool to
numerically determine the channel statistics. Details of the key rate
analysis, including noise and detection parameters, are given in Appendix B.

##  IV Network Simulation

In this section, we first provide a high-level description for the sequence of
events that occur as a frame travels from sender to receiver in a packet-
switched network and then describe our software tool for simulating these
events in order to extract the dynamic channel statistics.

We model the arrival of frames into the network as follows. Each sender is
allowed to transmit frames one at a time, following an exponentially
distributed inter-arrival time with average $1/\gamma$. Note that all senders
can be active simultaneously. We assume a repetition rate $R_{t}=1$ GHz for
the signals in the quantum payload. The destination for each frame is assigned
randomly from the list of all receivers in the network.

A frame travels from a sender towards its default router (i.e., the router to
which the sender is directly connected). The default router and all subsequent
routers a frame encounters will forward the frame according to the path
determined by the routing algorithm for the network. The routing algorithm
calculates the least-cost path from sender to receiver, where the cost of a
path is the sum of the link costs along the path. In this work, we consider a
load-insensitive routing algorithm, meaning the cost of each link in the
network does not reflect its level of congestion and is determined solely by
its physical length. Therefore, the least-cost path is simply the shortest
path. Note that in the case of multiple least-cost paths, the router will
select one at random. In general, the shortest path may not have the highest
expected transmittance, depending on the number of routers it contains. In
this case, the cost of the path may be modified to include router loss,
although this scenario is not applicable in this work.

A frame can be forwarded from a router only if there are fewer than $c$ frames
simultaneously being forwarded from the router and there are no frames
preceding it in the queue (we refer to $c$ as the number of servers for the
queue); otherwise, the frame must join the queue. A frame may join the queue
only if there are fewer than $q$ frames already in the queue (we refer to $q$
as the capacity of the queue); otherwise, the frame will be discarded. Frames
will be forwarded from the queue according to a first-come first-served
discipline.

In order to simulate these events in a network, we developed a software tool
based on a simulation method known as discrete-event simulation (DES) [27]. We
build on the DES Python package SimPy [28] for the timing and resource
management aspects of the network. For the network configuration, including
path calculations and topology initialization, we use the Python package
NetworkX [29].

The first step in using our simulation is to configure a topology of nodes
(i.e., users and routers) and links (i.e., connections between nodes). Each
node is able to generate frames as well as process any incoming frames. If the
node is a sender, frames at the node do not undergo header processing and the
frame need only wait to be sent into the network according to the frame
arrival model. If the node is a router or a receiver, frames at the node will
undergo a processing delay. In our simulation, routers can process $k\gg 1$
headers simultaneously. In general, if $k$ is small, the frames may experience
a queuing delay prior to header processing. In our simulation, the queue in
each router has $c=1$ server and unlimited storage capacity
($q\rightarrow\infty$). The actions on the frame during the processing and
queuing delays will depend on the network routing protocol, as outlined in
Sec. II.2.

Each frame in the network holds attributes (corresponding to header fields)
for the storage time limit, how long it has spent in storage, the temporal
frame length, the guard time, the path it has travelled, and its status (in
transit, arrived, or discarded). We can simulate the network dynamics for a
specified duration and collect data on the number of routed QKD signals, $N$,
as well as the path they have travelled, i.e., the number of routers traversed
and the average total time spent in storage,
$\langle\sum_{i}T_{s}^{i}\rangle$. Note that signals from different frames
will have a different total storage time, and so we take an average over all
frames. We may then determine the average channel transmittance for each user-
pairing,

$\langle\eta_{tot}\rangle=10^{(-\alpha
L-\langle\sum_{i}loss_{r}^{i}\rangle)/10},$ (2)

where $\alpha$ is the attenuation coefficient (dB/km) of the network links,
$L$ is the distance between sender and receiver, and
$\langle\sum_{i}loss_{r}^{i}\rangle$ is the average loss over all routers in
the channel, found by Eq. 1.

The simulated $N$ and $\langle\eta_{tot}\rangle$ may then be used by senders
in the network to optimize their decoy-state parameters. Note that the network
statistics correspond to a particular network configuration; namely, the
topology, number of users, frame inter-arrival time, and routing protocol.
Thus, these parameters must be known and fixed prior to a QKD session in order
for user pairs to have accurate knowledge of their transmittance statistics.
This is feasible in practice. For example, the network can employ traffic
shaping [30] to ensure that frames from each sender arrive one at a time with
inter-arrival times following the intended distribution. The remaining
parameters typically do not change very frequently and their status can be
updated as needed to all network users.

##  V Results and Discussion

In order to demonstrate the feasibility of performing QKD in a packet-switched
network, we analyze the network shown in Fig. 4. We choose this topology as it
combines properties of star, ring, and dumbbell networks. We emphasize,
however, that our approach may be used to test an arbitrary network
configuration. In our simulated network, sixteen users are connected through
four routers by standard single-mode fiber. In practice, each user can operate
as a sender or a receiver, but we assume that users do not operate in both
modes simultaneously. Thus, half of the users are designated as senders
(“Alices”) and half as receivers (“Bobs”). In this section, we present the
secure key rates per sent pulse for Alice-Bob pairs separated by one, two, and
three routers. We test each of the three routing protocols outlined in Sec.
II.2.

Figure 4: Sixteen-user network for simulation. Each of the four routers are
connected to two Alices and two Bobs. The links are assumed to be standard
single-mode optical fiber (0.2 dB/km) spanning 20 km between routers and 5 km
between each user and their default router.

###  V.1 No Storage During Delays

In Fig. 5, we show the key rate performance in a network with no storage
during delays. We fix the number of frames sent between each user pair and
examine the effects of the average frame inter-arrival time $1/\gamma$, the
initial frame length $T_{f}^{0}$, and the initial guard time $T_{g}^{0}$. In
this routing protocol, these parameters affect the data size, $N$, for key
generation. The top and bottom rows contain the results for zero and non-zero
guard times, respectively. The columns from left to right show the results for
a user pair separated by one, two, and three routers.

Figure 5: Secure key rates in a network with no storage during delays. A total
of 18,750 frames are generated by Alice in each user pair. The finite data
size is $N\approx 10^{12}$. In plots (a)-(c), we fix the initial guard time,
$T_{g}^{0}=0$ and vary the initial frame length, $T_{f}^{0}$ and average frame
inter-arrival time, $1/\gamma$. In plots (d)-(f), we fix
$T_{f}^{0}=2,000\leavevmode\nobreak\ \mu s$ and vary $T_{g}^{0}$ and
$1/\gamma$. Columns (left to right) are for user pairs $A_{31}$ and $B_{32}$,
$A_{42}$ and $B_{22}$, and $A_{22}$ and $B_{31}$ of Fig. 4. Color map changes
from white to purple as the key rate increases.

We interpret these results as follows. Firstly, the secure key rate is
expected to decrease with higher channel loss. Therefore, we observe the
highest key rates for $A_{31}$ and $B_{32}$ and the lowest for $A_{22}$ and
$B_{31}$. We note that due to the symmetry of the network configuration, there
are negligible differences between the results of different user pairs with
the same separation. For small values of $1/\gamma$, higher network traffic
results in larger $d_{queue}$ leading to more pulses being discarded and thus
smaller $N$. As a result, we observe a decrease in the key rate as $1/\gamma$
decreases. In Figs. 5(a)-5(c), we observe the effect of $T_{f}^{0}$. As this
parameter increases, more pulses are generated. However, longer frames have a
larger $d_{trans}$ which increases the time for which the server is occupied
at each router and therefore increases $d_{queue}$. Thus we expect the upwards
trend in the key rate to eventually stop, as is observed in Fig. 5(c). In
Figs. 5(d)-5(f), we observe the effect of $T_{g}^{0}$ for a fixed $T_{f}^{0}$.
A larger guard time means fewer pulses are discarded during delays but smaller
payloads are generated. Due to this effect, we see a rise then fall in the key
rate as $T_{g}^{0}$ increases. Furthermore, for a given $T_{f}^{0}$, a non-
zero guard time is shown to slightly enhance the key rate. Ultimately, these
results suggest that QKD can succeed in a packet-switched network even without
any optical storage capacity at the routers.

###  V.2 Storage During Delays (Unlimited)

In Fig. 6, we show the key rate performance in a network with storage during
delays, where frames have no storage time limit. We fix the number of frames
sent between each user pair and examine the effect of the attenuation
coefficient, $\alpha_{s}$, for the fiber delay lines used as storage at the
routers which will determine $\langle\eta_{tot}\rangle$ for the QKD channel.
The top and bottom rows consider scenarios of long and short frame lengths,
respectively, where the ratio of frame length to $1/\gamma$ is fixed in each
such that the average network traffic is the same. The left and right columns
consider zero and non-zero guard times, respectively. For each user pair, we
compare the results of this routing protocol to the no storage routing
protocol under the same network parameters.

Figure 6: Secure key rates in a network with storage during delays
(unlimited). In each plot, we fix the network parameters and vary the
attenuation of the fiber storage lines. A total of 37,500 frames are generated
by Alice in each user pair. The finite data size is $N\approx 10^{12}$. Unless
displayed, the no storage routing protocol fails to produce a secure key. (a)
$T_{g}^{0}=0$, $1/\gamma=30,000\leavevmode\nobreak\ \mu s$,
$T_{f}^{0}=2,000\leavevmode\nobreak\ \mu s$. (b)
$T_{g}^{0}=800\leavevmode\nobreak\ \mu s$,
$1/\gamma=30,000\leavevmode\nobreak\ \mu s$,
$T_{f}^{0}=2,000\leavevmode\nobreak\ \mu s$. (c) $T_{g}^{0}=0$,
$1/\gamma=3,000\leavevmode\nobreak\ \mu s$, $T_{f}^{0}=200\leavevmode\nobreak\
\mu s$. (d) $T_{g}^{0}=80\leavevmode\nobreak\ \mu s$,
$1/\gamma=3,000\leavevmode\nobreak\ \mu s$, $T_{f}^{0}=200\leavevmode\nobreak\
\mu s$.

We interpret these results as follows. Firstly, the secure key rate decreases
exponentially with $\alpha_{s}$, as expected. A non-zero guard time is again
shown to enhance the key rate since it reduces the storage time of each
payload, which increases $\langle\eta_{tot}\rangle$. Guard time also reduces
$d_{queue}$ since it shrinks $d_{trans}$ at each router. The enhancement is
more pronounced in the long frames scenario since the guard time is $\gg
d_{proc}$ in this case. We observe that the short frames scenario is generally
more robust to increasing $\alpha_{s}$, which can be attributed to smaller
storage times due to a smaller $d_{trans}$. The distributions of the storage
time in the long and short frames scenarios are shown in Fig. 8 for the case
of zero guard time. In Figs. 6(a) and 6(b), we observe that the no storage
routing protocol is generally superior when $\alpha_{s}>0.01$ dB/km. We note
that while attenuation coefficients as low as 0.14 dB/km have been achieved
over telecom wavelengths using state-of-the-art technology [31], it is
unrealistic to consider an attenuation much smaller than this. For a more
efficient storage medium, we require long-lived quantum memories. In Figs.
6(c) and 6(d), we do not extract any secure keys with the no storage routing
protocol except in the case of one router separating users. This can be
explained since the frame length is on the order of $d_{proc}$, so there are
zero to few non-discarded pulses from each payload. Our results suggest that,
for short frames, storage during network delays is a better strategy than
discarding pulses. The opposite holds true for frame lengths $\gg d_{proc}$
when we consider realistic fibers as our storage medium. This finding is
important since frame lengths in a packet-switched network may have practical
constraints.

As mentioned previously, we may enforce a STL in post-processing, analogous to
applying a cut-off $\langle\eta_{tot}\rangle$, in order to improve the key
rate. Fig. 7 shows the results for the same parameters as in Fig. 6, but with
frames excluded from key generation if their storage time reached the STL. We
consider an ultra-low-loss fiber with $\alpha_{s}=0.16$ dB/km as our storage
medium and examine the effect of the STL duration. It is clear that
implementing a STL enhances the key rate in each scenario considered, and most
significantly for frame lengths $\gg d_{proc}$. In Fig. 7(a), the optimal STL
for users separated by one, two, and three routers is 200 $\mu s$, 300 $\mu
s$, and 400 $\mu s$, respectively. From Fig. 8(a), we see that these STLs
preserve 82%, 70%, and 58% of frames across the user pairs. In Fig. 7(b), the
optimal STL is roughly 150 $\mu s$ for all user pairs and the key rates
approach those of the no storage routing protocol.

Figure 7: Secure key rates in a network with storage during delays (unlimited)
and STL implemented in post-processing. In each plot, we fix the network
parameters and vary the STL duration. The attenuation of the fiber storage
lines is fixed at 0.16 dB/km. The network parameters are identical to Fig. 6.

(a) (b)

Figure 8: Distribution of storage times in a network with storage during
delays (unlimited). The y-axis denotes the fraction out of all frames
traversing the indicated number of routers. $T_{g}^{0}=0$. (a)
$1/\gamma=30,000\leavevmode\nobreak\ \mu s$,
$T_{f}^{0}=2,000\leavevmode\nobreak\ \mu s$. (b)
$1/\gamma=3,000\leavevmode\nobreak\ \mu s$, $T_{f}^{0}=200\leavevmode\nobreak\
\mu s$.

###  V.3 Storage During Delays (Limited)

In Fig. 9, we show the key rate performance in a network with storage during
delays, where frames have a storage time limit. Once again, we fix the number
of frames sent between each user pair and consider $\alpha_{s}=0.16$ dB/km. We
examine the effect of the STL duration under various network parameters and in
each case we compare the results with the unlimited storage routing protocol
where a STL is implemented in post-processing. Note that for the network
parameters in the previous subsection, the two methods for implementing a cut-
off transmittance produce very similar results. Here we show scenarios in
which discarding frames en-route provides a significant advantage due to its
mitigation of network congestion.

Figure 9: Secure key rates in a network with storage during delays (limited).
The attenuation of the fiber storage lines is fixed at 0.16 dB/km. A total of
37,500 frames are generated by Alice in each user pair. $T_{g}^{0}=0$. (a)
$1/\gamma=15,000\leavevmode\nobreak\ \mu s$,
$T_{f}^{0}=2,000\leavevmode\nobreak\ \mu s$. (b) STL $=320\leavevmode\nobreak\
\mu s$, $T_{f}^{0}=2,000\leavevmode\nobreak\ \mu s$. (c)
$1/\gamma=50,000\leavevmode\nobreak\ \mu s$,
$T_{f}^{0}=10,000\leavevmode\nobreak\ \mu s$. (d) STL
$=550\leavevmode\nobreak\ \mu s$, $T_{f}^{0}=10,000\leavevmode\nobreak\ \mu
s$.

##  VI Outlook and Conclusions

In this work, we have developed a framework for key rate optimization in a
packet-switched network and assessed QKD performance in relation to several
network parameters such as frame length, guard time, frame inter-arrival time,
and storage efficiency. Notably, we found that practical secure key rates can
be achieved without any optical storage capacity in the network and that guard
time can generally be used to mitigate the effects of network delays. We also
found that the transmittance threshold strategy used in free-space QKD can be
applied in a packet-switched network to significantly enhance the key rate by
limiting the permissible storage time of frames. We believe our results pave
the way for future exploration of quantum applications in a packet-switched
network.

Future areas of investigation may include examining more complex network
topologies and perhaps a topology deployed in the field. Given that our
simulation tool can accommodate arbitrary network configurations, hardware
specifications, and traffic models, it can be used to establish a performance
benchmark for real-world systems. The simulation tool, which we aim to make
publicly available in the near future, can also be extended to examine the
performance of other quantum communication tasks besides QKD such as
entanglement distribution. An interesting question to address is how QKD in a
packet-switched network compares to a circuit-switched network. While we have
a general idea of when packet switching outperforms circuit switching based on
classical networks, determining specific conditions for this advantage in a
quantum network may be useful. Lastly, future work may consider the security
of QKD protocols other than BB84, such as protocols where all signals sent by
Alice are required to be measured by Bob. Such protocols may require us to re-
evaluate the security at the routers in a packet-switched network.

## References

  * [1] L. Kleinrock.  Information Flow in Large Communication Nets.  Ph.D. Thesis Proposal, Massachusetts Institute of Technology, 1961.
  * [2] Paul Baran.  On Distributed Communications: I. Introduction to Distributed Communications Networks.  RAND Corporation, Santa Monica, CA, 1964.
  * [3] Stephen DiAdamo, Bing Qi, Glen Miller, Ramana Kompella, and Alireza Shabani.  Packet switching in quantum networks: A path to the quantum Internet.  Phys. Rev. Research, 4:043064, 2022.
  * [4] C.H. Bennett and G. Brassard.  Quantum cryptography: public key distribution and coin tossing.  Proc. IEEE Int. Conf. Comp. Systems Signal Processing, pages 175–179, 1984.
  * [5] Artur K. Ekert.  Quantum cryptography based on Bell’s theorem.  Phys. Rev. Lett., 67:661–663, 1991.
  * [6] Paul D. Townsend.  Quantum cryptography on multiuser optical fibre networks.  Nature, 385(6611):47–49, 1997.
  * [7] Elliott, C., Colvin, A., Pearson, D., Pikalo, O., et al. Current status of the DARPA quantum network. Proc. SPIE 5815, Quantum Information and Computation III (2005).
  * [8] M Peev, C Pacher, R Alléaume, C Barreiro, et al.  The SECOQC quantum key distribution network in vienna.  New Journal of Physics, 11(7):075001, 2009.
  * [9] M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, et al.  Field test of quantum key distribution in the Tokyo QKD Network.  Opt. Express, 19(11):10387–10409, 2011.
  * [10] Bernd Fröhlich, James F. Dynes, Marco Lucamarini, Andrew W. Sharpe, et al.  A quantum access network.  Nature, 501(7465):69–72, 2013.
  * [11] Yan-Lin Tang, Hua-Lei Yin, Qi Zhao, Hui Liu, et al.  Measurement-Device-Independent Quantum Key Distribution over Untrustful Metropolitan Network.  Phys. Rev. X, 6:011024, 2016.
  * [12] Yu-Ao Chen, Qiang Zhang, Teng-Yun Chen, Wen-Qi Cai, et al.  An integrated space-to-ground quantum communication network over 4,600 kilometres.  Nature, 589(7841):214–219, 2021.
  * [13] William J Munro, Nicolo’Lo Piparo, Josephine Dias, Michael Hanks, and Kae Nemoto.  Designing tomorrow’s quantum internet.  AVS Quantum Science, 4(2):020503, 2022.
  * [14] SJ Ben Yoo and Prem Kumar.  Quantum Wrapper Networking.  In 2021 IEEE Photonics Conference (IPC), pages 1–2. IEEE, 2021\.
  * [15] Ansh Singal, Sundaraja Sitharam Iyengar, Latesh Kumar, and Azad M Madni.  Hardware routed quantum key distribution networks.  IET Quantum Communication, 2022.
  * [16] R. Ramaswamy, Ning Weng, and T. Wolf.  Characterizing network processing delay.  In IEEE Global Telecommunications Conference, 2004. GLOBECOM ’04., volume 3, pages 1629–1634 Vol.3, 2004.
  * [17] C Erven, B Heim, E Meyer-Scott, J P Bourgoin, R Laflamme, G Weihs, and T Jennewein.  Studying free-space transmission statistics and improving free-space quantum key distribution in the turbulent atmosphere.  New Journal of Physics, 14(12):123018, 2012.
  * [18] Giuseppe Vallone, Davide G. Marangon, Matteo Canale, Ilaria Savorgnan, et al.  Adaptive real time selection for quantum key distribution in lossy and turbulent free-space channels.  Phys. Rev. A, 91:042320, 2015.
  * [19] Wenyuan Wang, Feihu Xu, and Hoi-Kwong Lo.  Prefixed-threshold real-time selection method in free-space quantum key distribution.  Phys. Rev. A, 97:032337, 2018.
  * [20] Won-Young Hwang.  Quantum Key Distribution with High Loss: Toward Global Secure Communication.  Phys. Rev. Lett., 91:057901, 2003.
  * [21] Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen.  Decoy State Quantum Key Distribution.  Phys. Rev. Lett., 94:230504, 2005.
  * [22] Xiongfeng Ma, Bing Qi, Yi Zhao, and Hoi-Kwong Lo.  Practical decoy state for quantum key distribution.  Phys. Rev. A, 72:012326, 2005.
  * [23] Xiang-Bin Wang.  Beating the Photon-Number-Splitting Attack in Practical Quantum Cryptography.  Phys. Rev. Lett., 94:230503, 2005.
  * [24] Hoi-Kwong Lo, Hoi Fung Chau, and Mohammed Ardehali.  Efficient quantum key distribution scheme and a proof of its unconditional security.  Journal of Cryptology, 18(2):133–165, 2005.
  * [25] Charles Ci Wen Lim, Marcos Curty, Nino Walenta, Feihu Xu, and Hugo Zbinden.  Concise security bounds for practical decoy-state quantum key distribution.  Phys. Rev. A, 89:022307, 2014.
  * [26] James R Jackson.  Networks of Waiting Lines.  Operations research, 5(4):518–521, 1957.
  * [27] Norm Matloff.  Introduction to Discrete-Event Simulation and the SimPy Language.  Davis, CA. Dept of Computer Science. University of California at Davis. Retrieved on August, 2(2009):1–33, 2008.
  * [28] Klaus Muller and Tony Vignaux.  SimPy: Simulating Systems in Python.  O’Reilly, 650, 2003.
  * [29] Aric Hagberg, Pieter Swart, and Daniel S Chult.  Exploring network structure, dynamics, and function using NetworkX.  Technical report, Los Alamos National Lab.(LANL), Los Alamos, NM (United States), 2008.
  * [30] Mohammad Noormohammadpour and Cauligi S Raghavendra.  Datacenter traffic control: Understanding techniques and tradeoffs.  IEEE Communications Surveys & Tutorials, 20(2):1492–1525, 2017\.
  * [31] Yoshiaki Tamura, Hirotaka Sakuma, Keisei Morita, Masato Suzuki, et al.  The First 0.14-dB/km Loss Optical Fiber and its Impact on Submarine Transmission.  J. Lightwave Technol., 36(1):44–49, 2018.
  * [32] Gilles Brassard and Louis Salvail.  Secret-Key Reconciliation by Public Discussion.  In Tor Helleseth, editor, Advances in Cryptology — EUROCRYPT ’93, pages 410–423, Berlin, Heidelberg, 1994. Springer Berlin Heidelberg.

##  Appendix A Storage vs. No Storage

In this Appendix, we discuss and compare the effects of using storage versus
no storage in a network routing protocol. Fig. 10 depicts the photon losses
experienced by a payload in a router implementing these two types of
strategies. We may describe the transmittance of a fiber delay line in a
storage routing protocol as

$\eta_{s}=10^{-\alpha_{s}t_{D}v_{g}\alpha_{s}/10},$ (3)

where $t_{D}=d_{proc}+d_{queue}$. Thus, the number of transmitted pulses in a
quantum payload of duration $t_{Q}$ in a storage routing protocol is given by
$\eta_{s}R_{t}t_{Q}$. Similarly, the number of transmitted pulses in the no
storage routing protocol is given by $R_{t}(t_{Q}-t_{D})$. Let us assume that
equal proportions of random and controlleddeterministic photon loss have the
same effect on the key rate (valid so long as the detector noise is low
compared to the signal). Then we expect a storage routing protocol to be
favorable in the case where

$\eta_{s}t_{Q}>t_{Q}-t_{D}.$ (4)

Note that this comparison assumes the same network delays in each type of
routing protocol. However, the no storage routing protocol introduces smaller
$d_{trans}$ since frames will shrink by $t_{D}$ at each router they encounter.
This effect leads to smaller $d_{queue}$ in the no storage routing protocol.
The use of guard time in the storage routing protocol will also introduce
smaller $d_{trans}$, however it is reduced by at most $T_{g}$.

(a) (b)

Figure 10: Schematic of a hybrid frame before and after passing a router in a
packet-switched network. The duration of the quantum payload is denoted by
$t_{Q}$. The delay time, $t_{D}$, is given by $d_{proc}+d_{queue}$. (a) No
storage. (b) Storage.

##  Appendix B Key Rate Analysis

In this Appendix, we explain how the secure key rate is calculated and
describe the optimization process. We follow the notation of Ref. [25]. After
completing the protocol described in Sec. III.1, Alice and Bob may distill a
secure key of length

$\ell=\Bigg{\lfloor}s_{X,0}+s_{X,1}-s_{X,1}h(\phi_{X})\\\
-n_{X}f_{EC}h(e_{obs})-6\log_{2}\frac{21}{\varepsilon_{sec}}-\log_{2}\frac{2}{\varepsilon_{cor}}\Bigg{\rfloor}.$
(5)

Here, $s_{X,0}$ and $s_{X,1}$ are the lower bounds on the number of bits
generated from zero- and single-photon pulses, respectively. The term
$s_{X,1}h(\phi_{X})$ is the number of bits consumed during privacy
amplification, where $\phi_{X}$ is the upper bound on the phase error rate
associated with the single-photon events and
$h(x)\coloneqq-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary entropy function.
The term $n_{X}f_{EC}h(e_{obs})$ describes the bits consumed by the classical
error correction algorithm [32] with efficiency $f_{EC}$, where $n_{X}$ is the
number of detection events in basis $X$. The post-processing stage ensures
that Alice’s and Bob’s keys are identical expect with small probability
$\varepsilon_{cor}$ and secret except with small probability
$\varepsilon_{sec}$. Table 1 summarizes the parameter values used in the key
rate analysis.

Table 1: Key rate analysis parameters. Parameter | Value
---|---
$f_{EC}$ | 1.16
$\varepsilon_{cor}$ | $10^{-15}$
$\varepsilon_{sec}$ | $10^{-10}$
$p_{dc}$ | $2\times 10^{-7}$
$\eta_{Bob}$ | $0.15$
$e_{mis}$ | $0.005$
$\mu_{3}$ | $0.0002$

Next, we show how to estimate $s_{X,0}$, $s_{X,1}$, and $\phi_{X}$. The number
of zero-photon events satisfies [25]

$s_{X,0}\geqslant\tau_{0}\frac{\mu_{2}n_{X,\mu_{3}}^{-}-\mu_{3}n_{X,\mu_{2}}^{+}}{\mu_{2}-\mu_{3}},$
(6)

where $\tau_{n}\coloneqq\sum_{k\in\mathcal{K}}e^{-k}k^{n}p_{k}/n!$ is the
probability that Alice sends a $n$-photon state, and

$n_{X,k}^{\pm}\coloneqq\frac{e^{k}}{p_{k}}\Bigg{[}n_{X,k}\pm\sqrt{\frac{n_{X}}{2}\ln\frac{21}{\varepsilon_{sec}}}\Bigg{]}$
(7)

is the number of detection events in basis $X$ for pulses of intensity $k$
when considering the finite sample size. Here,
$n_{X}=\sum_{k\in\mathcal{K}}n_{X,k}$. The detection numbers are given by

$n_{X,k}=Nq_{x}^{2}p_{k}(1-(1-2p_{dc})e^{-\eta_{tot}\eta_{Bob}k}),$ (8)

where $\eta_{tot}=10^{(-0.2L-\sum_{i}loss_{r}^{i})/10}$ denotes the overall
transmittance of the channel including the fiber links of distance $L$ (km)
and the routers between Alice and Bob. Pulses belonging to different frames
will have a different $\eta_{tot}$, so we take
$\eta_{tot}\rightarrow\langle\eta_{tot}\rangle$ by averaging over all frames
contributing to the key. Bob uses an active measurement setup with two single-
photon detectors (InGaAs APDs) each with a dark count probability $p_{dc}$.
The overall efficiency of Bob’s measurement is given by $\eta_{Bob}$.

The number of single-photon events satisfies

$s_{X,1}\geqslant\frac{\tau_{1}\mu_{1}[n_{X,\mu_{2}}^{-}-n_{X,\mu_{3}}^{+}-\frac{\mu_{2}^{2}-\mu_{3}^{2}}{\mu_{1}^{2}}(n_{X,\mu_{1}}^{+}-\frac{s_{X,0}}{\tau_{0}})]}{\mu_{1}(\mu_{2}-\mu_{3})-\mu_{2}^{2}+\mu_{3}^{2}}.$
(9)

The number of zero- and single-photon events in basis $Z$, $s_{Z,0}$ and
$s_{Z,1}$, respectively, may be calculated using the same expressions by
replacing $X\rightarrow Z$.

The phase error rate of the single-photon events in basis $X$ is estimated as

$\phi_{X}\leqslant\frac{v_{Z,1}}{s_{Z,1}}+\gamma\Big{(}\varepsilon_{sec},\frac{v_{Z,1}}{s_{Z,1}},s_{Z,1},s_{X,1}\Big{)},$
(10)

where $\gamma(\cdot)$ is the estimation uncertainty given by

$\gamma(a,b,c,d)\coloneqq\sqrt{\frac{(c+d)(1-b)b}{cd\log
2}\log_{2}\Big{(}\frac{c+d}{cd(1-b)b}\frac{21^{2}}{a^{2}}\Big{)}}$ (11)

and $v_{Z,1}$ is the number of bit errors in the single-photon events in basis
$Z$ estimated as

$v_{Z,1}\leqslant\tau_{1}\frac{m_{Z,\mu_{2}}^{+}-m_{Z,\mu_{3}}^{-}}{\mu_{2}-\mu_{3}}.$
(12)

Here, $m_{Z,k}^{\pm}$ is the number of bit errors in basis $Z$ for pulses of
intensity $k$ when considering the finite sample size and is given by

$m_{Z,k}^{\pm}\coloneqq\frac{e^{k}}{p_{k}}\Bigg{[}m_{Z,k}\pm\sqrt{\frac{m_{Z}}{2}\ln\frac{21}{\varepsilon_{sec}}}\Bigg{]},$
(13)

where $m_{Z}=\sum_{k\in\mathcal{K}}m_{Z,k}$ is the number of bit errors in
basis $Z$. The error numbers are given by

$m_{Z,k}=N(1-q_{x})^{2}p_{k}(p_{dc}+e_{mis}(1-e^{-\eta_{tot}k})),$ (14)

where $e_{mis}$ is the error rate due to optical misalignment.

Finally, the bit error rate in basis $X$ is calculated as

$e_{obs}=\frac{m_{X}}{n_{X}},$ (15)

where $m_{X}$ is the number of bit errors in basis $X$, calculated analogously
to $m_{Z}$.

The numerical optimization returns the parameters
$\\{q_{x},p_{\mu_{1}},p_{\mu_{2}},\mu_{1},\mu_{2}\\}$ that maximize the secure
key rate $R\coloneqq\ell/N$ for a given number, $N$, of pulses that are routed
to Bob (i.e., $N$ is the difference between the number of sent pulses,
$N_{0}$, and the number of pulses discarded in the routing process). The decoy
intensities satisfy $\mu_{1}>\mu_{2}+\mu_{3}$ and $\mu_{2}>\mu_{3}\geqslant
0$. We fix the vacuum decoy state to be $\mu_{3}=0.0002$. The key rates
presented in this paper are scaled by $N/N_{0}$ to show the secure key rate
per sent pulse.