A Security Plane Architecture for Ultra-Low-Energy, High-Capacity Optical Transport Networks

The evolution toward agile, ultra-low-energy, high-capacity optical transport networks can benefit from solutions incorporating multi-band, multi-fiber, and point-to-multipoint (P2MP)/sliceable high-capacity transport technologies carefully designed to simplify network hierarchy and minimize optical-electrical-optical (OED) conversions. To guarantee quantum-secure communications, these networks require a thorough reassessment of their security plane architecture, acting as a transversal plane to the data and control planes. In this paper, we propose a programmable Quantum Key Distribution (QKD) network built upon multi-protocol QKD systems, including entangled QKD for P2MP secure access/metro scenarios, Quantum Random Key Generation (QRNG) modules as alternative entropy sources for links where QKD system deployment is not economically viable, and hybrid classic/QKD/Post-Quantum Cryptography (PQC) primitives for greater flexibility and backward compatibility. Authentication services are performed through physically-unclonable-function (PUF) certification authorities, particularly implementing strong Rayleigh-backscattering-pattern or speckle-pattern-based optical Physically Unclonable Functions (OP-UFs). These security technologies leverage on agnostic key management system (KMS) and quantum digital twin (QDT) assisted performance optimization, e.g. for artificial intelligence (AI)-based State of Polarization (SOP) compensation. Key relay between border nodes is realized by means of a combination of a centralized PUF and a procedure to securely exchange keys between KMSs based on ETSI-014 and PQC. The KMS can feed keys to encryptors implemented at the different data-plane layers, but the proposed architecture favors encryption relying on physical-layer security techniques to align with the above design principle aimed at a flatter network and fewer OEO conversions. Examples of this are Light Path SECurity (LPSec) techniques, consisting of two nested physical ciphers ensuring a high-security level, and all-optical steganography. Coexistence of classical and quantum signals is generally feasible in the access and metro segments, whereas in the backbone segment it needs to be evaluated on a case-by-case basis.