Alia, Obada

Arabul, Ekin

Kanellos, George

Muqaddas, Abubakar Siddique

Nejabati, Reza

Simeonidou, Dimitra

Stange Tessinari, Rodrigo

English

We successfully implemented a QKD-Aware SDN application capable of real-time monitoring and controlling a quantum secure network paired with a programmable FPGA encryption/decryption technology to provide on-demand encryption algorithms for network services between different sites

Explore Bristol Research

                          Stange Tessinari, R., Arabul, E., Alia, O., Muqaddas, A. S., Kanellos,G., Nejabati, R., & Simeonidou, D. (2021). Demonstration of aDynamic QKD Network Control Using a QKD-Aware SDN ApplicationOver a Programmable Hardware Encryptor. Paper presented at TheOptical Networking and Communication Conference & Exhibition(OFC 2021), United States.Peer reviewed versionLink to publication record in Explore Bristol ResearchPDF-documentUniversity of Bristol - Explore Bristol ResearchGeneral rightsThis document is made available in accordance with publisher policies. Please cite only thepublished version using the reference above. Full terms of use are available:http://www.bristol.ac.uk/red/research-policy/pure/user-guides/ebr-terms/Demonstration of a Dynamic QKD NetworkControl Using a QKD-Aware SDN ApplicationOver a Programmable Hardware EncryptorR. S. Tessinari, E. Arabul, O. Alia, A. S. Muqaddas, G. T. Kanellos, R. Nejabati,D. SimeonidouHigh Performance Networks Group, University of Bristol, Woodland Road, Bristol, United Kingdomrodrigo.tessinari@bristol.ac.ukAbstract: We successfully implemented a QKD-Aware SDN application capable of real-time monitoring and controlling a quantum secure network paired with a programmableFPGA encryption/decryption technology to provide on-demand encryption algorithms fornetwork services between different sites. © 2021 The Author(s)1. OverviewRecently, commercial high throughput encryption solutions were developed to work with Quantum Key Distribu-tion (QKD) to answer the increased interest for quantum-secure networking, leading to many collaborations in thefield. One of these collaborations was Nokia, SK Telecom and ID Quantique in 2018, where an IDQ QKD sys-tem was used for encryption with Nokia’s Optical Transport Network systems on SKT’s commercial network [1].Moreover, in 2019, IDQ and ADVA partnered to produce the first commercial QKD encryption solution, whereIDQ’s Cerberis3 QKD System was combined with ADVA’s FSP3000 encryptors to achieve quantum secure AESbased 100 Gb/s encryption data line with dynamic Diffie-Hellman key exchange [3].Data encryption rates have also been significantly increasing using hardware encryption, as it was demonstratedin [4] where an AES-based FPGA encryptor achieved a remarkable throughput of 482 Gb/s. Also in [5], a quasi-reconfigurable FPGA based encryptor has been demonstrated having a throughput of 200 Gb/s with limited 48.38Gb/s AES rate.However, all high-throughput and quantum secure hardware encryptor solutions available in the literature andmarket exhibit very limited reconfigurability, either locked within the firmware or non-existing [5]. Therefore, theencryption/decryption schemes on these implementations cannot be controlled dynamically to adjust, for exam-ple, the encryption scheme or the key consumption rate to fit the application or network operation requirements.Recently, a dynamic QKD network configuration was demonstrated in a field deployment [6] to offer enhancedrerouting capabilities in the distribution of keys, highlighting the potential for highly programmable networks withthe use of reconfigurable hardware encryptors.We recently reported on the implementation details of a new programmable FPGA-based encrpytor and dis-cussed its performance in [7] (submitted in OFC 20211). However in this paper, we demonstrate the implemen-tation of a quantum SDN application, built on top of ONOS SDN Controller that takes advantage of its pro-grammability to control multiple software agents and provides added flexibility to the network while leveragingthe hardware encryptor to offer on-demand encryption. We also demonstrate network operation with on-demandchoices of instigating QKD links while offering re-configurable on-the-fly encryption scheme changes and dy-namic key consumption rates for different secured Virtual Network Services (VNSs) based on chained VirtualNetwork Functions (VNFs).2. Demo OverviewThe demonstration validates two main points of the system: i) that the SDN controller can establish QKD connec-tions, monitor relevant parameters, and take actions accordingly, and ii) the FPGA-based encryptor adapts to theSDN controller commands in adjusting the encryption scheme and controlling the key consumption rate. On thenext paragraphs, we describe the testbed details, followed by a workflow of the demonstration.The testbed is detailed in Fig. 1 and is partitioned into three layers; the data layer, agent layer, and controllayer. Starting from the bottom-up, the data plane is composed of compute servers, Optical Cross Connectors1submission id: 3560910; N3: Architecture and software-defined control for metro and core networks, Keydistribution and quantum networkingOXCsDriverVideoClientQuantum Secured Virtual Network Service (VNF1 + VNF2)VNF1Compute Server QKDAliceQKDBobVNF2Compute ServerQuantum SDN APPQKDPluginFPGAPluginControl PlaneAgent <> AgentAgent <> DeviceQuantum ChannelData ChannelEncrypted Data ChannelFPGA FPGAOXC OXCOXCAgentQKDAgentFPGAAgentQKDAgentOXCAgentFPGAAgentVIMOpenStackVIMOpenStackFig. 1. Testbed setup(OXCs), QKD devices, and FPGAs. The compute servers host VNFs including, but not restricted to, firewalls,deep packet inspectors, authentication servers, and video servers. Two or more VNFs are chained together to forma VNS which can be secure or not, according to the agreed Quality of Service (QoS). Next, the OXCs connectthe devices inter- and intra-sites, where the ID Quantique Clavis 2 QKD devices generate 256-bit sized quantumsymmetric keys. For encryptors, we used an FPGA implementation that can be programmed in real-time by theSDN controller with various encryption algorithms. The encryptor supports 10 Gb/s clients and can transmit up to100 Gb/s encrypted traffic bidirectionally [7].Each device has a companion agent that facilitates the communication with the SDN Controller. For instance,the QKD Agent (CQP Toolkit [8]) interfaces with QKD devices, stores the generated keys and can be controlledvia gRPC; the OXC Agent applies the received flows from the SDN controller; and the FPGA Agent pusheskeys and loads encryption algorithms. Moreover, there is a public communication channel between some of theagents to its peers, mainly for key synchronisation purposes. As an example, Fig. 2. a) illustrates how the FPGAagents synchronise keys, thus guaranteeing that the decryptor party always has the matching key, mitigating apotential problem of missing keys. It is important to mention that although instances of OpenStack as the referenceVirtual Infrastructure Manager (VIM) are also part of our testbed, for the purpose of this demonstration, the VNForchestration is outside the scope of this demo and is shown in more detail in [9, 10].To conclude, on the control layer we take an advantage of ONOS southbound to install flows on classicalequipment (i.e. the OXC devices in this particular demo). We also leverage internal ONOS gRPC and RESTlibraries to communicate with the other devices. Additionally, we created a Quantum SDN App to monitor boththe QKD and encryption parameters. This application enables us to interact with the system during the demo, viaONOS northbound REST API interface.In Fig. 2. b), the main aspects of the demonstration are highlighted. First, the QKD system will generate keys,being perceived as a continuous increase in the number of available keys. Following this, the Quantum SDNApp is requested to provision an (insecure) connection between VNF1 and VNF2. Although the traffic is flowingthrough the FPGA, there is no encryption, hence no impact on the key consumption rate. Next, a change in theQoS of the connection is issued, resulting in the SDN controller sending a command to change the encryptionalgorithm. During the configuration time, the video stream freezes and resumes shortly after the configurationis done. Moreover, the encryptors start to consume keys, consequently decreasing the number of available keys.Finally, the SDN controller detects a high key consumption rate, thus it automatically intervenes by reducing theencryptors’ key refresh rate to a more suitable value. This configuration occurs seamlessly to the application, andas a result, the number of available keys in the database stabilises.The experimental validation will be conducted remotely at the University of Bristol, and all the software com-ponents will be accessed from the OFC premises. We will start the demo with a working QKD system producingkeys and then show its operation by terminating the existing connection. The ONOS SDN controller and otherVNFs will run on Ubuntu-based virtual machines. The logging of the software components will be visible to showall the relevant events. Custom software will show the available keys and key consumption levels. Furthermore,the video client will be accessed to show the end-to-end video streaming for verifying the connectivity status.ActionQKD startNew request(no encryption)Change ofencryption: key generation start : keys gen ratio constant: video streaming starts: Key consumption starts: video freezes and resumesHigh keyconsumptiondetectedSDN configuresFPGA reducingkey refresh rate : Available keys goes up: no changes to video : SDN configures FPGA   reducing key refresh rate Consequence(s)FPGAAgent 1QKDAgent 1 FPGA 1key requestkey_id, keykey_idFPGAAgent 2QKDAgent 2FPGA 2key_idkeykey_id, key                                           ACK, key_idkey_id, key...data transmissionusing previous key...new keya) b)Fig. 2. a) Key synchronisation diagram. b) Demonstration workflow.3. InnovationThe demo showcases the deployment of 100 Gb/s FPGA-based encryptors, that supports varied encryption al-gorithms and can be programmed real-time by an application built on top of ONOS SDN Controller. The SDNcontroller itself brings three innovations: i) a QKD-aware module capable of controlling the QKD operation andmanaging the key generation process, ii) control the encryption application’s key consumption rate and balance itbased on real-time key generation rates, and iii) access a library of encryption algorithms which can be pushed tothe FPGAs according to the requirements of the network operator or the resource optimisation algorithms. Cur-rently, our system supports six encryption modes: AES (128, 192, 256), Camellia-256, XOR, and no encryption.4. OFC RelevanceThis demo is tailored particularly for the OFC audience, based on the ongoing trends of quantum secure networks,network control and secure applications/devices. This work may be of great interest for industry players who arethinking ahead and looking for ways to improve security in face of the new dawn of quantum computers andthe vulnerability of current encryption solutions. Additionally, this work is also of interest of hardware manufac-tures, interested in novel designs for encryption devices. The OFC demo zone is a relevant venue for showcasingthe results achieved under cooperation of UNIQORN, 5G-COMPLETE and UK Quantum Communication Hubprojects, so the audience can learn more about the contributions of these projects towards the optical networkscommunity. Furthermore, we use ONOS as the state-of-the art open source SDN controller, aiming to make ourimplementation more compatible with current community efforts.AcknowledgementsThis work was funded by EU funded projects 5G-COMPLETE (871900) and UNIQORN (820474); and part of the researchleading to this work has been supported by the Quantum Communication Hub funded by the EPSRC grant ref. EP/T001011/1.References1. ID Quantique SA, “ID Quantique, SK Telecom & Nokia Secure Optical Transport System Using Quantum Key Distribution (QKD),”Press Release, 2018.2. ADVA, “ADVA FSP 3000 powers UK’s first quantum network,” Press Release, 2018.3. ID Quantique SA, “ID Quantique partners with ADVA to commercialise a quantum-safe encryption solution,” Press Release, 2019.4. B. Buhrow et. al., “A highly parallel AES-GCM core for authenticated encryption of 400 Gb/s network protocols,” ReConFig, 2015.5. Z. Martinasek et. al., “200 Gbps Hardware Accelerated Encryption System for FPGA Network Cards,” ASHES, 2018.6. R. S. Tessinari et. al., “Field Trial of Dynamic DV-QKD Networking in the SDN-Controlled Fully-Meshed Optical Metro Network ofthe Bristol City 5GUK Test Network,” ECOC, 2019.7. E. Arabul et. al., “Experimental Demonstration of Programmable 100 Gb/s SDN-Enabled Encryptors/Decryptors for QKD Networks,”submitted to OFC, 2021.8. R. Collins et. al., “QComms QKD Software Toolkit” Journal of Open Source Software, 4(38), pp.1119, 2019.9. A. Aguado et. al., “Secure NFV Orchestration Over an SDN-Controlled Optical Network With Time-Shared Quantum Key DistributionResources,” J. Lightwave Technol. 35(8), pp. 1357-1362, 2017.10. R. Nejabati et. al., “First demonstration of quantum-secured, inter-domain 5G service orchestration and on-demand NFV chainingover flexi-WDM optical networks,” OFC, Th4C.6, 2019.

Demonstration of a Dynamic QKD Network Control Using a QKD-Aware SDN Application Over a Programmable Hardware Encryptor

https://research-information.bris.ac.uk/files/269440661/20210222_Accepted_Demonstration_of_a_Dynamic_QKD_Network_Control_Using_a_QKD_Aware_SDN_Application_Over_a_Programmable_Hardware_Encryptor.pdf

Demonstration of a Dynamic QKD Network Control Using a QKD-Aware SDN Application Over a Programmable Hardware Encryptor

Abstract

Similar works

Full text

Available Versions

Explore Bristol Research