Orchestrating Key Scarcity: Global Capacity Allocation in Hybrid QKD-PQC Networks
Abstract
This article presents a Distributed Key Management System (DKMS) that provisions quantum-safe symmetric encryption keys to applications across a network. To overcome the distance and rate limitations inherent to Quantum Key Distribution (QKD), the architecture adopts a hybrid design: it utilizes multi-hop trusted relays for physical key transport, while applying an end-to-end Post-Quantum Cryptography (PQC) layer to ensure the relayed key material remains strictly protected from intermediate nodes. Because QKD transforms key generation into a scarce physical resource, managing unpredictable application demands poses a critical capacity allocation problem. The core contribution of this work is an SDN-driven control plane that globally orchestrates the network. Rather than relying on vulnerable hop-by-hop capacity reservations, a central controller simultaneously computes optimal filling rates and multipath routing for all per-peer key buffers. This global orchestration ensures that no application is starved and that all key buffers synchronize their filling processes. Evaluated on a Kubernetes-based digital twin across five distinct network topologies, the controller successfully filled all key buffers to capacity in under six minutes. Furthermore, under deliberately excessive demand, the network demonstrated graceful degradation, safely rejecting excess requests through controlled rate-limiting rather than experiencing catastrophic failure.
Related
- TDM flexible PON based optical fronthaul networks: fine-grained QoT-aware dynamic bandwidth allocation
- Efficient routing and spectrum allocation in arbitrary flex-grid entanglement networks
- Efficient routing and spectrum allocation in arbitrary flex-grid entanglement networks
- Allocation Condensation in Redistributive Networks
- A General Capacity Frontier of Complex Networks
BibTeX
@misc{rejo2026orchestrating,
title = {{Orchestrating Key Scarcity: Global Capacity Allocation in Hybrid QKD-PQC Networks}},
author = {Pablo P. Rejo and Manuel Fernández-Veiga and Ana Fernández-Vilas and Diego Cajaraville-Aboy and Javier Vecino-Peñas and Rebeca P. Díaz-Redondo},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.27332},
eprint = {2610.27332},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.27332},
}
RIS
TY - UNPB
TI - Orchestrating Key Scarcity: Global Capacity Allocation in Hybrid QKD-PQC Networks
AU - Pablo P. Rejo
AU - Manuel Fernández-Veiga
AU - Ana Fernández-Vilas
AU - Diego Cajaraville-Aboy
AU - Javier Vecino-Peñas
AU - Rebeca P. Díaz-Redondo
PY - 2026
DA - 2026/10/19
PB - arXiv
DO - 10.48550/arxiv.2610.27332
UR - https://arxiv.org/abs/2610.27332
AB - This article presents a Distributed Key Management System (DKMS) that provisions quantum-safe symmetric encryption keys to applications across a network. To overcome the distance and rate limitations inherent to Quantum Key Distribution (QKD), the architecture adopts a hybrid design: it utilizes multi-hop trusted relays for physical key transport, while applying an end-to-end Post-Quantum Cryptography (PQC) layer to ensure the relayed key material remains strictly protected from intermediate nodes. Because QKD transforms key generation into a scarce physical resource, managing unpredictable application demands poses a critical capacity allocation problem. The core contribution of this work is an SDN-driven control plane that globally orchestrates the network. Rather than relying on vulnerable hop-by-hop capacity reservations, a central controller simultaneously computes optimal filling rates and multipath routing for all per-peer key buffers. This global orchestration ensures that no application is starved and that all key buffers synchronize their filling processes. Evaluated on a Kubernetes-based digital twin across five distinct network topologies, the controller successfully filled all key buffers to capacity in under six minutes. Furthermore, under deliberately excessive demand, the network demonstrated graceful degradation, safely rejecting excess requests through controlled rate-limiting rather than experiencing catastrophic failure.
ER -