Quantum Key Distribution and Management in Passive Optical Networks

Abstract

Methods, systems, and apparatuses for quantum key distribution (QKD) in a passive optical network (PON) are described. The PON can be a point-to-multipoint system and can include a central node communicating with a plurality of remote nodes. In some cases, each remote node can include a QKD transmitter configured to generate quantum pulses indicative of a quantum key, a synchronization pulse generator configured to generate timing indications of the quantum pulses, and a filter configured to output the quantum pulses and the timing indications to the central node via optical components (e.g., an optical splitter, a circulator arrayed waveguide grating (AWG) router). The central node can receive the timing indications and the quantum pulses from the plurality of remote nodes. Accordingly, the central node and the remote nodes can be configured to communicate data encrypted using the quantum key.

Description

[0001] Related Applications

[0002] This application claims the benefit of U.S. Provisional Patent Application No. 62 / 916,553, filed Oct. 17, 2019, by Huberman et al., entitled "METHOD FOR CREATING A PROVABLE SECURE TRANSPORT LAYER (TLS) USING QUANTUM KEY DISTRIBUTION", U.S. Provisional Patent Application No. 62 / 928,118, filed Oct. 30, 2019, by Huberman et al., entitled "METHOD FOR CREATING A PROVABLE SECURE TRANSPORT LAYER (TLS) USING QUANTUM KEY DISTRIBUTION (QKD) AND QKD-TLS KEY MANAGEMENT", and U.S. Provisional Patent Application No. 62 / 916,562, filed Oct. 17, 2019, by Wang et al., entitled "SYSTEMS AND METHODS TO INTEGRATE QUANTUM KEY DISTRIBUTION INTO PASSIVE OPTICAL NETWORKS". Each of these applications is assigned to the assignee of the present application and is hereby incorporated by reference in its entirety. Background of the Disclosure

[0003] The field of the present disclosure relates to quantum keys and, more particularly, to quantum key distribution (QKD) in passive optical networks (PONs).

[0004] A PON may include fiber optic telecommunication technologies for providing broadband network access to end customers. Additionally, a PON may implement a point-to-multipoint topology where a central node can serve multiple remote nodes via an optical fiber using non-powered (e.g., passive) optical components (e.g., optical splitters, wavelength multiplexers) to divide the optical fiber bandwidth among the multiple remote nodes. In some cases, the optical fiber section coupling the central node to the multiple remote nodes may become a bottleneck for data capacity (e.g., user capacity), reduce communication speed (e.g., introduce latency), or otherwise negatively impact the user experience. Additionally, the optical fiber section coupling the central node to the multiple remote nodes may be vulnerable to security threats. That is, a network attack may rely on the broadcast nature of the optical fiber section to eavesdrop on insecure communications of user data. SUMMARY OF THE INVENTION

[0005] The described technology relates to improved methods, systems, apparatuses, or devices for supporting quantum key distribution (QKD) in a passive optical network (PON). Generally, the described technology provides for distributing quantum keys to encrypt communications between a central node and one or more remote nodes (e.g., within a PON). That is, each of the one or more remote nodes may be coupled to the central node via a classical channel (e.g., for transmitting data) and a QKD channel (e.g., for transmitting quantum keys). In some cases, the classical channel and the QKD channel may rely on the same optical fiber. The remote nodes may each include a QKD transmitter for transmitting quantum keys. Additionally, the central node may include a QKD receiver for receiving quantum keys. In some examples, the remote nodes may communicate with the central node according to time division multiplexing. Here, the remote nodes may communicate quantum keys to the central node via a set of resources that are time division multiplexed with resources associated with one or more other remote nodes communicating with the central node. In another example, the remote nodes may communicate with the central node according to wavelength division multiplexing. Here, the remote nodes may communicate quantum keys to the central node via a set of resources that are wavelength division multiplexed with resources associated with one or more other remote nodes communicating with the central node. In either example, each remote node may transmit a quantum key to the central node for encrypting communications between the central node and the remote node. Then, the central node and each of the one or more remote nodes may communicate encrypted data based on the quantum keys.

[0006] Transport Layer Security (TLS) is a protocol used to secure data transmission in a network (e.g., the Internet). Enhancing TLS to support quantum keys as the basis for symmetric encryption and decryption of information can theoretically or provably protect information from eavesdropping parties. Supporting quantum keys in TLS can include a key distribution layer exchanging quantum keys between network nodes connected via a quantum channel to enable quantum-secure communication between each node, even when not directly connected via a quantum channel. In some instances, a first network node can receive a quantum key (e.g., for encrypting communication between the first network node and a second network node) from a second network node via a QKD client at the first network node. The QKD client can be separated from the protocol stack of the first network node, and the QKD client can then pass the quantum key to an encryption protocol (e.g., the TLS protocol) within the protocol stack of the first network node. The first network node can then rely on the quantum key to encrypt and decrypt communication with the second network node. In some cases, the first network node can additionally be configured to exchange secure communication with a third network node using a fourth quantum key. For example, the first network node can receive a second quantum key derived from a third quantum key used for communication between the second network node and the third network node from the second network node, and derive a third quantum key from the first quantum key and the second quantum key. The first network node can then use the fourth quantum key derived from the first key and the second key to exchange secure communication with the third network node.

[0007] A device configured to communicate optically with a central node is described, the central node being configured to communicate with a group of remote nodes via optical components coupled to the central node and the group of remote nodes, the group of remote nodes including the device. The device can include a QKD transmitter configured to: identify a resource for outputting quantum pulses from a group of resources shared by the group of remote nodes, the quantum pulses indicating a quantum key for optical communication associated with the device; and generate the quantum pulses at least in part based on the identification. The device can additionally include: a synchronization pulse generator configured to generate a timing indication of the quantum pulses indicating the quantum key; and a filter coupled to the QKD transmitter and the synchronization pulse generator and configured to output the timing indication of the quantum pulses and the quantum pulses indicating the quantum key to the optical components using the identified resource.

[0008] In some examples of the device, the identified resource for outputting the quantum pulses is time-division multiplexed with a resource in the group of resources associated with the group of remote nodes, and the optical component is an optical splitter.

[0009] In some examples of the device, the identified resource for outputting the quantum pulse is wavelength-division multiplexed with the resources in the set of resources associated with the set of remote nodes, and the optical component is a circulator arrayed waveguide grating (AWG) router.

[0010] In some cases, the device may further include an optical switch configured to selectively couple the filter to the QKD transmitter and the synchronization pulse generator, or couple the filter to the data transmitter and the data receiver.

[0011] In some instances, the device may further include a data transmitter coupled to the filter and configured to: identify data for transmission to the central node; encrypt the data for transmission to the central node using the quantum key; and transmit the encrypted data to the filter, wherein the filter is further configured to output the encrypted data to the optical component.

[0012] In some examples of the device, the filter is further configured to receive encrypted data from the optical component, and the device further includes a data receiver coupled to the filter and configured to decrypt the encrypted data using the quantum key.

[0013] In some cases of the device, the filter is a coarse wavelength-division multiplexer (CWDM).

[0014] A method for optical communication with a central node at a remote node is described, the central node being configured to communicate with a set of remote nodes including the remote node via an optical component. The method may include: identifying a resource for outputting a quantum pulse from a set of resources shared by the set of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and the central node; generating the quantum pulse and a timing indication of the quantum pulse based on the identified resource; outputting the timing indication of the quantum pulse to the optical component; outputting the quantum pulse indicating the quantum key to the optical component using the identified resource based on outputting the timing indication of the quantum pulse; and communicating with the central node based on outputting the quantum pulse indicating the quantum key.

[0015] Describes a device for optical communication with a central node at a remote node, the central node being configured to communicate via an optical component with a group of remote nodes including the remote node. The device may include a processor, a memory in electronic communication with the processor, and instructions stored in the memory. The instructions may be executed by the processor to cause the device to perform the following operations: identify a resource for outputting a quantum pulse from a group of resources shared by the group of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and the central node; generate the quantum pulse and a timing indication of the quantum pulse based on the identification of the resource; output the timing indication of the quantum pulse to the optical component; based on the output of the timing indication of the quantum pulse, output the quantum pulse indicating the quantum key to the optical component using the identified resource; and communicate with the central node based on the output of the quantum pulse indicating the quantum key.

[0016] Describes another device for optical communication with a central node at a remote node, the central node being configured to communicate via an optical component with a group of remote nodes including the remote node. The device may include: means for identifying a resource for outputting a quantum pulse from a group of resources shared by the group of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and the central node; means for generating the quantum pulse and a timing indication of the quantum pulse based on the identification of the resource; means for outputting the timing indication of the quantum pulse to the optical component; means for outputting the quantum pulse indicating the quantum key to the optical component using the identified resource based on the output of the timing indication of the quantum pulse; and means for communicating with the central node based on the output of the quantum pulse indicating the quantum key.

[0017] Describes a non-transitory computer-readable medium storing code for optical communication with a central node at a remote node, the central node being configured to communicate via an optical component with a group of remote nodes including the remote node. The code may include instructions executable by a processor to perform the following operations: identify a resource for outputting a quantum pulse from a group of resources shared by the group of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and the central node; generate the quantum pulse and a timing indication of the quantum pulse based on the identification of the resource; output the timing indication of the quantum pulse to the optical component; based on the output of the timing indication of the quantum pulse, output the quantum pulse indicating the quantum key to the optical component using the identified resource; and communicate with the central node based on the output of the quantum pulse indicating the quantum key.

[0018] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the identified resources for outputting the quantum pulse may be time-division multiplexed with resources in the set of resources that may be associated with the set of remote nodes, and the optical component may be an optical splitter.

[0019] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the identified resources for outputting the quantum pulse may be wavelength-division multiplexed with resources in the set of resources that may be associated with the set of remote nodes, and the optical component may be a circulator arrayed waveguide grating (AWG) router.

[0020] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for: generating a second quantum pulse indicative of a second quantum key for optical communication between the remote node and the central node; and, after outputting the quantum pulse to the optical component, outputting the second quantum pulse indicative of the second quantum key to the optical component based on outputting the timing indication, where the timing indication indicates the timing of the quantum pulse and the second quantum pulse.

[0021] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, identifying resources for outputting the quantum key may include operations, features, means, or instructions for: outputting a request for a time resource for outputting the quantum key to the optical component; and receiving an indication of the identified resources from the optical component based on outputting the request for the time resource.

[0022] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for: switching from a first communication mode for transmitting the quantum pulse to the central node to a second communication mode for communicating data with the central node based on outputting the quantum pulse to the optical component, where communication with the central node may be based on the switch.

[0023] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, communicating with the central node may include operations, features, means, or instructions for: encrypting data for transmission to the central node using the quantum key; and outputting the encrypted data to the optical component.

[0024] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, communicating with a central node can include operations, features, means, or instructions for: receiving the encrypted data from the optical component; and decrypting the encrypted data received from the optical component using the quantum key.

[0025] An apparatus is described that is configured to communicate optically with a set of remote nodes via an optical component coupled to the apparatus and the set of remote nodes. The apparatus can include: a QKD receiver configured to receive a set of quantum pulses from a filter of the apparatus via a set of resources, each quantum pulse indicating a quantum key for optical communication associated with one of the set of remote nodes; a synchronization pulse receiver configured to receive a set of timing indications from the filter, each timing indication associated with one of the set of quantum pulses, wherein the QKD receiver is configured to receive each of the set of quantum pulses at least in part based on the set of timing indications; and the filter coupled to the QKD receiver and the synchronization pulse receiver and configured to receive the set of quantum pulses and the set of timing indications from the optical component, transmit the set of quantum pulses to the QKD receiver, and transmit the set of timing indications to the synchronization pulse receiver.

[0026] In some examples of the apparatus, each of the set of quantum pulses is received via a resource time-division multiplexed with a resource in the set of resources, and the optical component is an optical splitter.

[0027] In some examples of the apparatus, each of the set of quantum pulses is received via a resource wavelength-division multiplexed with a resource in the set of resources, and the optical component is a circulator AWG router.

[0028] In some examples of the apparatus, the filter is configured to receive the set of quantum pulses from the optical component via a first optical fiber; and the filter is configured to receive the set of timing indications from the optical component via a second optical fiber different from the first optical fiber.

[0029] In some cases, the apparatus can further include a gate coupled to the QKD receiver and configured to selectively couple the QKD receiver to the filter at least in part based on the set of timing indications.

[0030] In some instances, the apparatus can further include an optical switch configured to selectively couple the filter to the QKD receiver and the synchronization pulse receiver, or couple the filter to a data transmitter and a data receiver.

[0031] In some examples, the device may further include a narrowband filter that is coupled to the filter and the QKD receiver and is configured to transfer the set of quantum pulses from the filter to the QKD receiver.

[0032] In some cases, the device may further include a data transmitter that is coupled to the filter and is configured to: identify data for transmission to one of the set of remote nodes; encrypt the data for transmission to the one remote node using a quantum key for optical communication associated with the one remote node; and transfer the encrypted data to the filter, wherein the filter is further configured to output the encrypted data to the optical component.

[0033] In some instances of the device, the filter is further configured to receive encrypted data associated with one of the set of remote nodes from the optical component; and the device further includes a data receiver that is coupled to the filter and is configured to decrypt the encrypted data using the quantum key for optical communication associated with the one remote node.

[0034] In some examples of the device, the QKD may include a single photon detector (SPD).

[0035] In some cases of the device, the filter is a CWDM.

[0036] A method for optical communication with a set of remote nodes via an optical component coupled to each of the set of remote nodes at a central node. The method may include: receiving from the optical component a set of timing indications, each timing indication associated with one of a set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of the set of remote nodes; receiving the set of quantum pulses from the optical component via a set of resources based on receiving the set of timing indications; and communicating with the set of remote nodes based on receiving the set of quantum pulses, each quantum pulse indicating the quantum key for optical communication associated with one of the set of remote nodes.

[0037] An apparatus for optical communication with a set of remote nodes at a central node via optical components coupled to each of the set of remote nodes. The apparatus may include a processor, a memory in electronic communication with the processor, and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to perform the following operations: receive a set of timing indications from the optical components, each timing indication associated with one of a set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of the set of remote nodes; receive the set of quantum pulses from the optical components via a set of resources based on receiving the set of timing indications; and communicate with the set of remote nodes based on receiving the set of quantum pulses, each quantum pulse indicating the quantum key for optical communication associated with one of the set of remote nodes.

[0038] Another apparatus for optical communication with a set of remote nodes at a central node via optical components coupled to each of the set of remote nodes. The apparatus may include: means for receiving a set of timing indications from the optical components, each timing indication associated with one of a set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of the set of remote nodes; means for receiving the set of quantum pulses from the optical components via a set of resources based on receiving the set of timing indications; and means for communicating with the set of remote nodes based on receiving the set of quantum pulses, each quantum pulse indicating the quantum key for optical communication associated with one of the set of remote nodes.

[0039] A non-transitory computer-readable medium storing code for optical communication with a set of remote nodes at a central node via optical components coupled to each of the set of remote nodes. The code may include instructions executable by a processor to perform the following operations: receive a set of timing indications from the optical components, each timing indication associated with one of a set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of the set of remote nodes; receive the set of quantum pulses from the optical components via a set of resources based on receiving the set of timing indications; and communicate with the set of remote nodes based on receiving the set of quantum pulses, each quantum pulse indicating the quantum key for optical communication associated with one of the set of remote nodes.

[0040] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, each of the set of quantum pulses may be received via a resource that may be time-division multiplexed with a resource in the set of resources, and the optical component may be an optical splitter.

[0041] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, each of the set of quantum pulses can be received via a resource that can be wavelength division multiplexed with a resource of the set of resources, and the optical component can be a circulatory AWG router.

[0042] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein can further include operations, features, apparatuses, or instructions for performing the following: receiving, from the optical component, a request for a time resource for one of the set of quantum pulses; outputting, to the optical component, an indication of a time resource within the set of resources for the one quantum pulse of the set of quantum pulses, wherein receiving the set of quantum pulses can be based on outputting the indication.

[0043] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein can further include operations, features, apparatuses, or instructions for performing the following: switching from a first communication mode for receiving the set of quantum pulses to a second communication mode for communicating data with the set of remote nodes based on receiving the set of quantum pulses from the optical component, wherein communicating with the set of remote nodes can be based on the switching.

[0044] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, communicating with the set of remote nodes can include operations, features, apparatuses, or instructions for performing the following: identifying data for transmission to one remote node of the set of remote nodes; encrypting the data for transmission to the central node using the quantum key for optical communication associated with the one remote node; and transmitting the encrypted data to the one remote node via the optical component.

[0045] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, communicating with the set of remote nodes can include operations, features, apparatuses, or instructions for performing the following: receiving, from the optical component, encrypted data associated with one remote node of the set of remote nodes; and decrypting the encrypted data received from the optical component using the quantum key for optical communication associated with the one remote node.

[0046] A method at a first network node is described, the first network node including a protocol stack and a QKD client different from the protocol stack. The method may include: receiving, by the QKD client, a first quantum key and a first quantum key identifier from a second network node; passing the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node; and communicating encrypted data with the second network node via an encryption protocol of the protocol stack, wherein the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier.

[0047] An apparatus at a first network node is described, the first network node including a protocol stack and a QKD client different from the protocol stack. The apparatus may include a processor, a memory in electronic communication with the processor, and instructions stored in the memory. The instructions may be executed by the processor to cause the apparatus to perform the following operations: receiving, by the QKD client, a first quantum key and a first quantum key identifier from a second network node; passing the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node; and communicating encrypted data with the second network node via an encryption protocol of the protocol stack, wherein the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier.

[0048] Another apparatus at a first network node is described, the first network node including a protocol stack and a QKD client different from the protocol stack. The apparatus may include: means for receiving, by the QKD client, a first quantum key and a first quantum key identifier from a second network node; means for passing the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node; and means for communicating encrypted data with the second network node via an encryption protocol of the protocol stack, wherein the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier.

[0049] Describes a non-transitory computer-readable medium storing code at a first network node, the first network node including a protocol stack and a QKD client different from the protocol stack. The code may include instructions executable by a processor to perform the following operations: receive a first quantum key and a first quantum key identifier from a second network node via the QKD client; transfer the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node; and communicate encrypted data with the second network node via an encryption protocol of the protocol stack, wherein the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier.

[0050] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may further include operations, features, apparatuses, or instructions for performing the following: receive a message including a second quantum key from the second network node, the second quantum key being derived from a third quantum key associated with communication between the second network node and a third network node; identify the third quantum key based on the second quantum key and the first quantum key; and communicate second encrypted data with the third network node via the encryption protocol of the protocol stack, wherein the second encrypted data may be encrypted using the first quantum key and the third quantum key.

[0051] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, transferring the first quantum key and the first quantum key identifier may include operations, features, apparatuses, or instructions for performing the following: transfer the first quantum key and the first quantum key identifier from the QKD client of the first network node to a key management layer of the first network node; and store the first quantum key and the first quantum key identifier on a server associated with the key management layer, wherein communicating encrypted data with the second network node may be based on the storage.

[0052] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may further include operations, features, apparatuses, or instructions for performing the following: transmit a request for the first quantum key to a corresponding key management layer of the second network node via a key management layer of the first network node, wherein receiving the first quantum key via the QKD client of the first network node may be based on transmitting the request.

[0053] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, communicating encrypted data with a second network node may further include operations, features, apparatuses, or instructions for: identifying data for transmission to the second network node; encrypting the data for transmission to the second network node using the first quantum key via the encryption protocol of the protocol stack; and indicating the encrypted data and the first quantum key identifier for transmission to the second network node via the encryption protocol of the protocol stack.

[0054] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, communicating encrypted data with a second network node may further include operations, features, apparatuses, or instructions for: receiving encrypted data from the second network node via the encryption protocol of the protocol stack, wherein the encrypted data includes an indication of the first quantum key identifier; obtaining the first quantum key from a server associated with the key management layer of the first network node via the encryption protocol of the protocol stack based on the indication of the first quantum key identifier; and decrypting the encrypted data using the first quantum key via the encryption protocol of the protocol stack based on obtaining the first quantum key.

[0055] A first network node is described. The first network node may include: a QKD client configured to receive a first quantum key and a first quantum key identifier from a second network node; and a protocol stack different from and coupled to the QKD client, wherein the protocol stack includes an encryption protocol configured to receive the first quantum key and the first quantum key identifier from the QKD client and communicate encrypted data with the second network node, wherein the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier.

[0056] In some examples of the first network node, the protocol stack is configured to: receive a message including a second quantum key from the second network node, the second quantum key being derived from a third quantum key associated with communication between the second network node and a third network node; identify the third quantum key at least in part based on the first quantum key and the second quantum key; and communicate second encrypted data with the third network node, wherein the second encrypted data is encrypted using the first quantum key and the third quantum key.

[0057] In some cases of the first network node, the first network node includes a key management layer coupled to the encryption protocol, wherein the key management layer is configured to: store the first quantum key and the first quantum key identifier on a server associated with the key management layer; and provide the first quantum key and the first quantum key identifier to the encryption protocol, wherein communicating encrypted data with the second network node is at least partially based on the storage.

[0058] In some instances of the first network node, the first network node includes a key management layer coupled to the encryption protocol, the key management layer being configured to transmit a request for the first quantum key, wherein receiving the first quantum key by the QKD client of the first network node is at least partially based on transmitting the request.

[0059] In some examples of the first network node, the encryption protocol is further configured to: identify data for transmission to the second network node; encrypt the data for transmission to the second network node using the first quantum key; and transmit an indication of the encrypted data and the first quantum key identifier to the second network node, wherein communicating encrypted data with the second network node is at least partially based on transmitting the indication of the encrypted data and the first quantum key identifier to the second network node.

[0060] In some cases of the first network node, the encryption protocol is further configured to: receive encrypted data including an indication of the first quantum key identifier from the second network node, wherein communicating encrypted data with the second network node is at least partially based on receiving the encrypted data from the second network node; obtain the first quantum key from a server associated with the key management layer of the first network node at least partially based on the indication of the first quantum key identifier; and decrypt the encrypted data using the first quantum key at least partially based on obtaining the first quantum key. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 Illustrates an example of a system supporting quantum key distribution (QKD) in a passive optical network (PON) according to examples disclosed herein.

[0062] Figure 2A Illustrates an example of a system supporting QKD in a PON according to examples disclosed herein.

[0063] Figure 2B Illustrates an example of a wavelength plan supporting QKD in a PON according to examples disclosed herein.

[0064] Figure 3A Illustrates an example of a system supporting QKD in PON according to an example disclosed herein.

[0065] Figure 3B Illustrates an example of a wavelength plan supporting QKD in PON according to an example disclosed herein.

[0066] Figure 4A Illustrates an example of a system supporting QKD in PON according to an example disclosed herein.

[0067] Figure 4B Illustrates an example of a wavelength plan supporting QKD in PON according to an example disclosed herein.

[0068] Figure 5A Illustrates an example of a system supporting QKD in PON according to an example disclosed herein.

[0069] Figure 5B Illustrates an example of a wavelength plan supporting QKD in PON according to an example disclosed herein.

[0070] Figure 6 and Figure 7 Illustrates an example of a system supporting QKD in PON according to an example disclosed herein.

[0071] Figure 8 Illustrates an example of a process flow supporting QKD in PON according to an example disclosed herein.

[0072] Figure 9 Shows a block diagram of a remote node supporting QKD in PON according to aspects of the present disclosure.

[0073] Figure 10 Shows a block diagram of a central node supporting QKD in PON according to aspects of the present disclosure.

[0074] Figure 11 Shows a block diagram of a network node supporting QKD in PON according to aspects of the present disclosure.

[0075] Figures 12 to 15 Shows a flowchart illustrating one or more methods for supporting QKD in PON according to examples as disclosed herein. Detailed Description

[0076] The core network can be configured to provide data connections to one or more customers. In some cases, the core network can utilize a Passive Optical Network (PON) to transmit data between a central node associated with the core network and one or more remote nodes (e.g., each remote node is associated with a customer). In an example of a point-to-multipoint PON, the central node can be configured to serve multiple remote nodes via optical fiber using non-powered (e.g., passive) optical components (e.g., optical splitters, optical multiplexers) to divide the optical fiber bandwidth among the multiple remote nodes. Here, the central node can be configured to broadcast data to the multiple remote nodes via the optical components. In some instances, the central node and the remote nodes can encrypt the data used for communication in order to reduce the security risks associated with the broadcast data. Some PONs can utilize symmetric encryption based on the Advanced Encryption Standard (AES), which can encrypt the data of each individual remote node (e.g., the data of each individual user). To transmit keys between the central node and the remote nodes, the PON can deliver classical encryption keys through a Public Key Infrastructure (PKI). Delivering classical encryption keys through PKI can include using asymmetric or public encryption to protect the keys. However, the security of classical encryption keys delivered by PKI may be vulnerable (e.g., against the emergence of quantum computers).

[0077] To improve the security associated with key distribution, the PON can use Quantum Key Distribution (QKD) (e.g., instead of PKI). Here, the central node or the remote nodes can utilize QKD to deliver quantum keys (e.g., by transmitting individual bits that are logical values '0' or '1') to different central nodes or remote nodes. Compared with classical key distribution methods, QKD may be more secure. However, in some instances, QKD may be sensitive to channel loss and noise because QKD relies on single photons to carry qubits. Therefore, QKD may be limited based on physical distance. For example, QKD may be relatively successful when the optical fiber distance is less than 500 kilometers, and the key rate decreases as the optical fiber distance increases. In some instances, reducing the amount of noise from the classical channel can increase the success rate of QKD. That is, utilizing a dedicated point-to-point optical fiber for QKD between the remote node and the central node can increase the success rate of QKD. Additionally, by combining the dedicated point-to-point optical fiber with a trusted relay or a satellite relay, the distance of QKD can be extended (e.g., applicable to most long-distance networks, core networks, and metropolitan area networks). Here, the data transmitted via each hop (e.g., data communication from one device or node to another device or node) can be decrypted and re-encrypted because each hop can be associated with a separate key. Therefore, these options for improving the success rate of QKD may be incompatible with point-to-multipoint PONs (e.g., where a single central node communicates with multiple remote nodes).

[0078] To provide QKD for point-to-multipoint PON, each remote node can be configured to include a quantum key emitter to transmit quantum keys to a central node. That is, the central node can receive one or more quantum keys from the respective remote nodes via a single optical fiber and can use the quantum keys to communicate securely with the respective remote nodes. In some examples, the remote nodes can communicate with the central node according to time division multiplexing. Here, the remote nodes can communicate quantum keys with the central node via a set of resources that are time division multiplexed with resources associated with one or more other remote nodes communicating with the central node. In another example, the remote nodes can communicate with the central node according to wavelength division multiplexing. Here, the remote nodes can communicate quantum keys with the central node via a set of resources that are wavelength division multiplexed with resources associated with one or more other remote nodes communicating with the central node. In either example, each remote node can transmit a quantum key to the central node for encrypting the communication between the central node and the remote node. Then, the central node and each of the one or more remote nodes can communicate encrypted data based on the quantum key.

[0079] A network node that relies on a quantum key to encrypt data can enable the network node to rely on the quantum key as a basis for symmetric encryption and decryption of information. Additionally, transmitting data encrypted by a quantum key can be secure from eavesdroppers. In some cases, the Transport Layer Security (TLS) protocol (e.g., for secure data transmission in the Internet) may rely on computationally difficult algorithms to symmetrically encrypt and decrypt information, which may be less secure compared to quantum key encryption and decryption. In some instances, a first network node can receive a quantum key (e.g., for encrypting the communication between the first network node and a second network node) from the second network node via a QKD client at the first network node. The QKD client can be separated from the protocol stack of the first network node, and the QKD client can then pass the quantum key to an encryption protocol (e.g., the TLS protocol) within the protocol stack of the first network node. Then the first network node can rely on the quantum key to encrypt and decrypt the communication with the second network node. The network node can additionally be configured to perform a trusted relay of the quantum key. In some cases, the first network node can additionally be configured to exchange secure communication with a third network node using a fourth quantum key. For example, the first network node then receives a second key derived from a third key for communication between the second network node and the third network node from the second network node and derives a third key from the first key and the second key. Then, the first network node can exchange secure communication with the third network node using the fourth key derived from the first key and the second key.

[0080] The features of this disclosure were initially described in reference to Figure 1described in the context of the systems and dies described up to FIG. 2. Features of the present disclosure are described in the context systems, wavelength plans, and process flows described with reference to Figures 2A to 8 The present disclosure's these and other features are further illustrated by and described with reference to the device diagrams and flowcharts related to QKD in PON described with reference to Figures 9 to 15 device diagrams and flowcharts related to QKD in PON described with reference to

[0081] Figure 1 FIG. 8 illustrates an example of a system 100 that supports QKD in PON according to aspects of the present disclosure. System 100 may be an example of a point-to-multipoint PON system 100 configured to transmit data encrypted with a quantum key between a central node 105 and a plurality of remote nodes 110. System 100 may include optical components 115, which may be examples of a power splitter or a wavelength multiplexer. Communication between the central node 105 and the optical components 115 may be via a feeder fiber, and communication between the optical components 115 and each remote node 110 may be via a drop fiber.

[0082] Each remote node 110 may communicate with the central node 105 via the optical components 115 and using a set of resources. In some examples, the central node 105 may allocate resources to the remote nodes 110. Additionally, one or more remote nodes 110 may transmit requests for resources (e.g., to the central node 105), and the central node 105 may allocate resources in response to the requests. In some cases, the remote nodes 110 may communicate with the central node 105 using time-division multiplexing (TDM). Here, resources associated with time slots may be allocated for each remote node 110 to communicate with the central node 105. In an example of TDM, data packets associated with communication between the central node 105 and different remote nodes 110 may be multiplexed in the time domain. When system 100 employs TDM for communication between the remote nodes 110 and the central node 105, system 100 may be referred to as a time-division multiplexing PON (TDM-PON). In some instances, TDM-PONs may be standardized in Ethernet PON (EPON), Gigabit PON (GPON), 10G-EPON, or XG-PON. In some other cases, the remote nodes 110 may communicate with the central node 105 using wavelength-division multiplexing (WDM). Here, one (or more) dedicated wavelengths may be allocated for each remote node 110. When system 100 employs WDM for communication between the remote nodes 110 and the central node 105, system 100 may be referred to as a WDM-PON.

[0083] The central node 105 and the remote nodes 110 may use quantum keys to encrypt the communication between the central node 105 and the remote nodes 110. That is, the central node 105 and the remote nodes 110 may use quantum keys to encrypt and decrypt both the downstream data 120 and the upstream data 135. For example, the remote node 110-a and the central node 105 may use (e.g., quantum keys associated with the communication between the remote node 110-a and the central node 105) to encrypt and decrypt the communication between the central node 105 and the remote node 110-a. Each remote node 110-a may include a QKD transmitter configured to generate quantum pulses 130 and transmit them to the central node 105. Additionally, the central node 105 may include a QKD receiver configured to detect the quantum pulses 130 from each remote node 110. The QKD receiver may use single-photon detectors (SPDs) (e.g., two SPDs, four SPDs, eight SPDs) to detect single photons (e.g., the quantum pulses 130).

[0084] Before transmitting the quantum pulses 130 to the central node 105, the remote node 110 may first transmit a timing indication 125 to the central node 105. For example, the QKD receiver at the central node 105 may be gated (e.g., may not receive and / or detect the quantum pulses 130 unless the gate is open). Thus, the remote node 110 may transmit the timing indication 125 to indicate to the central node 105 to open the gate associated with the QKD receiver to detect subsequent quantum pulses 130. For example, the remote node 110-a may transmit a timing indication 125-a indicating the timing associated with the quantum pulse 130-a to the central node (e.g., via the optical component 115). Thus, when the remote node 110-a transmits the quantum pulse 130-a (e.g., according to the timing indicated by the timing indication 125-a), the central node 105 may open the gate of the QKD receiver to receive and / or detect the quantum pulse 130-a.

[0085] To encrypt the downlink data 120 and uplink data 135 for communication with the central node, each remote node 110 can transmit at least one timing indication 125 and at least one quantum pulse 130 to the central node 105. For example, remote node 110-a can transmit timing indication 125-a and quantum pulse 130-a to central node 105, remote node 110-b can transmit timing indication 125-b and quantum pulse 130-b to central node 105, and remote node 110-c can transmit timing indication 125-c and quantum pulse 130-c to central node 105. Each remote node 110 can transmit the timing indication 125 and the quantum pulse 130 to the central node 105 via an optical component 115 (e.g., through different incoming optical fibers). The optical component 115 can be an optical splitter (e.g., if the system 100 is a TDM-PON) or a wavelength multiplexer (e.g., if the system is a WDM-PON). In either case, the optical component 115 can transmit the timing indication 125-d (including timing indications 125-a, 125-b, and 125-c) and the quantum pulse 130-d (e.g., including quantum pulses 130-a, 130-b, and 130-c) to the central node 105 (e.g., via a feeder optical fiber).

[0086] In some cases, each remote node 110 can be configured to transmit a timing indication 125 for each quantum pulse 130 transmitted by that remote node 110. In some other cases, each remote node 110 can be configured to transmit one timing indication 125 for a group of quantum pulses 130. For example, remote node 110-b can transmit a timing indication 125-b indicating a group of quantum pulses 130-b transmitted by remote node 110-b according to a certain periodicity (e.g., based on the conditions of the classical or quantum channel between remote node 110-b and central node 105). Each remote node 110 can transmit additional timing indications 125 and quantum pulses 130 as needed to transmit multiple bits of the quantum key. For example, remote node 110 can update the quantum key every few hours or days.

[0087] In the case where system 100 is a TDM-PON, any timing indications 125-a, 125-b, and 125-c transmitted by remote node 110 can be time-division multiplexed within timing indication 125-d. Additionally, any quantum pulses 130-a, 130-b, and 130-c transmitted by remote node 110 can be time-division multiplexed within quantum pulse 130-d. In the case where system 100 is a WDM-PON, any timing indications 125-a, 125-b, and 125-c transmitted by remote node 110 can be wavelength-division multiplexed within timing indication 125-d received by central node 105 on the feeder fiber. Additionally, any quantum pulses 130-a, 130-b, and 130-c transmitted by remote node 110 can be wavelength-division multiplexed within quantum pulse 130-d received by central node 105 on the feeder fiber.

[0088] In some instances, the fiber length between central node 105 and remote node 110 may pose challenges for integrating QKD into PON (e.g., as shown in system 100). For example, integrating QKD into PON may be vulnerable to Raman scattering noise. Raman scattering noise may occur when quantum channels are multiplexed with classical channels. That is, Raman scattering noise may arise as an inelastic scattering effect between incident photons and the optical fiber (e.g., the feeder fiber coupling central node 105 to optical component 115, the drop fiber coupling optical component 115 to remote node 110). Additionally, Raman scattering noise may not only change the direction of scattered photons but also their energy. In an optical fiber, scattered photons can propagate in two directions and can be defined as forward scattering and backward scattering (e.g., depending on their propagation direction relative to the incident light). In some instances, backward scattering may be stronger than forward scattering (e.g., due to higher efficiency). Additionally, photons that lose energy during scattering (e.g., Stokes photons) may have a reduced frequency and redshifted wavelength (e.g., when compared to photons that do not lose energy during scattering). Photons that gain energy (e.g., anti-Stokes photons) may have an increased frequency and blueshifted wavelength. In some cases, Raman noise may cover a spectral range of up to 200 nanometers centered at the incident light wavelength, with peak intensity at a frequency shift of 13 THz. Since scattered photons change their wavelength, they may become noise for existing signals at those wavelengths. Thus, Raman scattering noise from the classical channel at the quantum channel wavelength may be a major factor limiting QKD distance and quantum key rate.

[0089] In some instances, QKD may have two bands. A first band (e.g., the C-band that ranges from 1530 nanometers to 1565 nanometers) may be associated with lower fiber loss (e.g., 0.2 decibels (dBs) per kilometer). A second band (e.g., the O-band that ranges from 1250 nanometers to 1360 nanometers) may be associated with reduced Raman noise. In an example of system 100, the remote node 110 may use the second band to transmit the quantum pulse 130 to the central node 105. Here, the quantum channel (e.g., for transmitting the quantum pulse 130) may be associated with higher fiber loss (e.g., 0.33 dB per kilometer) but lower noise (e.g., when compared to using the first band for the quantum channel). That is, using the second band for the quantum channel may allow the quantum channel to be outside the Raman spectrum of most classical channels (e.g., in the first band). Additionally, by allocating the second band (e.g., a band shorter than the band associated with the classical channel) to the quantum channel, the quantum channel may be associated with weaker anti-Stokes scattering (e.g., when compared to Stokes scattering). However, in some cases, the system cost associated with the quantum channel of the second band may be higher (e.g., when compared to the quantum channel of the first band).

[0090] After transmitting the quantum pulse 130 indicating the quantum key for communication between the central node 105 and the remote node 110 to the central node 105, the remote node 110 may communicate data encrypted using the quantum key with the central node 105. For example, the central node may transmit the downlink data 120 encrypted using the quantum key to the remote node 110, and the remote node 110 may transmit the uplink data 135 encrypted using the quantum key to the central node 105.

[0091] To transmit downstream data 120 to the remote node 110, the central node 105 may send the downstream data 120-d to the optical component 115. That is, the downstream data 120-d may include the downstream data 120 associated with each remote node 110. In an example where the system 100 is a TDM-PON, the downstream data 120-d and the downstream data 120 transmitted from the optical component 115 to each remote node 110 may be the same. That is, the optical component 115 may be an optical splitter configured to split the downstream data 120-d received from the central node 105 into multiple transmissions of the same downstream data 120-a, 120-b, and 120-c (e.g., at a lower power than the downstream data 120-d), each transmission being directed to one of the remote nodes 110. Here, each remote node 110 may decrypt only the data message dedicated to that remote node 110. For example, the remote node 110-b may decrypt only the subset of the downstream data 120-b encrypted using the quantum key associated with the communication between the remote node 110-b and the central node 105 (e.g., indicated by the quantum pulse 130-b).

[0092] In an example where the system 100 is a WDM-PON, the downstream data 120-d may include each transmission of the downstream data 120-a, 120-b, and 120-c. For example, the optical component 115 may be configured to split the transmission of the downstream data 120-d into the downstream data 120-a associated with the first wavelength, the downstream data 120-b associated with the second wavelength, and the downstream data 120-c associated with the third wavelength. In either case, the remote node 110 may receive the downstream data 120 and may decrypt the downstream data 120 using the quantum key associated with the communication between that remote node 110 and the central node 105.

[0093] Each remote node 110 may additionally be configured to transmit uplink data 135 encrypted using a quantum key to the central node 105. That is, remote node 110-a may be configured to transmit uplink data 135-a, remote node 110-b may be configured to transmit uplink data 135-b, and remote node 110-c may be configured to transmit uplink data 135-c. Each remote node 110 may utilize a set of resources to transmit the uplink data 135, and the uplink data may be time-division multiplexed or wavelength-division multiplexed with the uplink data 135 associated with other remote nodes 110. Additionally, the optical component 115 may be configured to receive each uplink data 135 from the remote node 110 and transmit the uplink data 135-d to the central node 105. In the TDM-PON system 100, the uplink data 135-d may include the time-division multiplexed uplink data 135-a, 135-b, and 135-c. Additionally, in the WDM-PON system 100, the uplink data 135-d may include the wavelength-division multiplexed uplink data 135-a, 135-b, and 135-c.

[0094] When the central node 105 receives the uplink data 135-d, the central node 105 may use the quantum key associated with each remote node 110 that transmitted the uplink data 135 to decrypt the uplink data 135. For example, the central node 105 may use the quantum key associated with the communication between the remote node 110-c and the central node 105 to decrypt the uplink data 135-c.

[0095] Figure 2A and Figure 2B Illustrated is an example of a system 200 and a wavelength plan 201 that support QKD in a PON according to aspects of the present disclosure. The system 200 may be an example of a point-to-multipoint TDM-PON system 200 that is configured to transmit data encrypted using a quantum key (e.g., as described with reference to Figure 1 ), and the wavelength plan 201 may be an example of a wavelength plan 201 for the communication used by the system 200. Additionally, the system 200 may include aspects of the system 100 described with reference to Figure 1 . For example, the central node 205, the remote node 210, and the optical splitter 215 may be examples of the central node 105, the remote node 110, and the optical component 115, respectively. The system 200 may additionally include a feeder optical fiber 260 for communication between the central node 205 and the optical splitter 215 and a drop optical fiber 265 for communication between the optical splitter 215 and the remote node 210.

[0096] System 200 may rely on time-division multiplexing to transmit data, quantum keys, and timing indications between central node 205 and one or more remote nodes 210. That is, each remote node 210 may be configured to identify resources that are time-division multiplexed with resources associated with other remote nodes 210 for communication with central node 205. Additionally, as Figure 2B shown, downlink data, uplink data, timing indications, and quantum pulses may be associated with different wavelengths 275. That is, the quantum channel may be associated with wavelength 275-a (e.g., 1310 nm), the downlink channel may be associated with wavelength 275-b (e.g., 1490 nm), the uplink channel may be associated with wavelength 275-c (e.g., 1550 nm), and the synchronization channel (e.g., for transmitting timing indications) may be associated with wavelength 275-d (e.g., 1610 nm). In some cases, the downlink or uplink channel may additionally be used as an auxiliary channel for post-processing (including basis reconciliation, key screening, error correction, and privacy amplification).

[0097] Remote node 210-a may include a data receiver 220-a, a synchronization pulse generator 225, a data transmitter 230-a, and a QKD transmitter 235, each coupled to a filter 240-a. The QKD transmitter 235 may be configured to generate quantum pulses indicative of a quantum key for optical communication between remote node 210-a and central node 205. Additionally, the synchronization pulse generator 225 may be configured to generate timing indications for the quantum pulses indicative of the quantum key. The data receiver 220-a may be configured to receive downlink data (e.g., encrypted using the quantum key) from central node 205. The data receiver 220-a may additionally be configured to decrypt the encrypted downlink data using the quantum key. The data transmitter 230-a may be configured to transmit uplink data (e.g., encrypted using the quantum key) to central node 205. That is, the data transmitter 230-a may be configured to identify available uplink time slot resources and encrypt the uplink data with the quantum pair.

[0098] Filter 240-a can be a coarse wavelength division multiplexing (CWDM) filter and can be configured to separate and combine optical signals. For example, filter 240-a can receive optical signals from optical splitter 215 via incoming optical fiber 265-a, separate them based on the wavelength 275 of the optical signals, and route the separated signals to different components of remote node 210-a. For example, filter 240-a can route an optical signal having a wavelength 275-b (e.g., associated with a downlink channel) to data receiver 220-a. Additionally, filter 240-a can receive optical signals from synchronization pulse generator 225, data transmitter 230-a, and QKD transmitter 235, and can propagate them to the optical splitter via incoming optical fiber 265-a.

[0099] Central node 205 can include data transmitter 230-b, synchronization pulse receiver 250, data receiver 220-b, QKD receiver 255, and filters 240-b and 240-c. Synchronization pulse receiver 250 can be configured to receive timing indications from one or more remote nodes 210, and QKD receiver 255 can consist of a set of SPDs configured to receive quantum pulses indicating quantum keys from one or more remote nodes 210. QKD receiver 255 can be configured to receive a single quantum pulse at a given time. Data transmitter 230-b can be configured to send downlink data to each of one or more remote nodes 210, encrypt the downlink data using a quantum key associated with the optical communication between central node 205 and remote node 210-a, and transmit the encrypted downlink data to remote node 210-a. Data receiver 220-b can be configured to receive uplink data from one or more remote nodes 210. That is, data receiver 220-b can receive encrypted uplink data from remote node 210 and decrypt the encrypted uplink data using a quantum key associated with the optical communication between remote node 210 and central node 205. The quantum key for uplink data can be the same as or different from the quantum key for downlink data.

[0100] QKD receiver 255 can be coupled to filter 240-c. Filter 240-c can be a narrowband optical filter (e.g., a fiber Bragg grating (FBG) filter). In some instances, filter 240-c can filter some noise (e.g., Raman noise) from the quantum channel to improve the reliability of the quantum channel. That is, the wavelength 275-a of the quantum channel may be spaced apart from the wavelengths of the classical channels (e.g., downlink channel, uplink channel, synchronization channel), but there may still be Raman scattering noise originating from the classical channels. Additionally, time filtering of the quantum channel (e.g., by opening the gate of QKD receiver 255 only when the timing indication indicates a quantum pulse) can reduce the impact of the noise on the quantum channel.

[0101] Filter 240-b can be a CWDM filter and can be configured to separate and combine optical signals. For example, filter 240-b can receive optical signals from optical splitter 215 via feeder fiber 260, separate them based on the wavelength 275 of the optical signals, and route the separated signals to different components of central node 205. For example, filter 240-b can route an optical signal having a wavelength 275-a (e.g., associated with a quantum channel) to QKD receiver 255. Filter 240-b can route an optical signal having a wavelength 275-c (e.g., associated with an upstream channel) to data receiver 220-b. Filter 240-b can route an optical signal having a wavelength 275-d (e.g., associated with a synchronization channel) to synchronization pulse receiver 250. Additionally, filter 240-b can receive optical signals from data transmitter 230-b and propagate them to the optical splitter via feeder fiber 260.

[0102] To communicate with central node 205, synchronization pulse generator 225 can generate timing indications for one or more subsequent quantum pulses and can transmit the timing indications to central node 205 (e.g., via filter 240-a and optical splitter 215). Synchronization pulse receiver 250 can receive the timing indications and identify when (multiple) subsequent quantum pulses will be received (e.g., to open a gate associated with QKD receiver 255). Based on the timing indications, QKD transmitter 235 can generate quantum pulses and transmit the quantum pulses to central node 205 via filter 240-a and optical splitter 215.

[0103] Figure 3A and Figure 3B Illustrated is an example of a system 300 and a wavelength plan 301 that support QKD in a PON according to aspects of the present disclosure. System 300 can be an example of a point-to-multipoint TDM-PON system 300 that is configured to transmit data encrypted using a quantum key (e.g., as described with reference to Figure 1 and FIG. 2) between central node 305 and multiple remote nodes 310, and wavelength plan 301 can be an example of a wavelength plan 301 for communication used by system 300. System 300 can include aspects of systems 100 and 200 as described with reference to Figure 1 and FIG. 2, respectively. For example, central node 305, remote nodes 310, and optical splitter 315 can be examples of similar components as described with reference to Figure 1 and FIG. 2.

[0104] System 300 may rely on time division multiplexing to transmit data, quantum keys, and timing indications between central node 305 and one or more remote nodes 310. Additionally, system 300 may be configured to operate either in classical mode or in quantum mode. That is, a set of time resources for communication between central node 305 and one or more remote nodes 310 may be configured for classical communication (e.g., uplink data or downlink data) or quantum communication (e.g., timing indications or quantum pulses). In some cases, this additionally reduces noise on the quantum channel compared to systems configured to support both classical and quantum communication simultaneously. As Figure 3B shown, downlink data, uplink data, timing indications, and quantum pulses may be associated with different wavelengths 375. That is, the quantum channel and the uplink channel may be associated with wavelength 375-a (e.g., 1310 nm). Additionally, the downlink channel and the synchronization channel may be associated with wavelength 375-b (e.g., 1490 nm). Since system 300 operates either in classical mode or in quantum mode, classical channels (e.g., the downlink channel and the uplink channel) may utilize wavelengths similar to those of the quantum channels (e.g., the quantum channel and the synchronization channel).

[0105] Each of remote nodes 310 and central node 305 may include switches 345 to switch between quantum mode and classical mode. For example, remote node 310-a may include switches 345-a and 345-b, and central node 305 may include switches 345-c and 345-d. The switches 345 may be linked. For example, the switches 345 may couple a first set of components (e.g., data receiver 320 and data transmitter 330) of remote nodes 310 and central node 305 to filter 340 during classical communication mode, and may couple a second set of components (e.g., synchronization pulse generator 325, QKD transmitter 335, synchronization pulse receiver 350, and QKD receiver 355) of remote node 310-a and central node 305 to filter 340 during quantum communication mode.

[0106] The remote node 310-a may include a data receiver 320-a, a synchronization pulse generator 325, a data transmitter 330-a, and a QKD transmitter 335, each coupled to a filter 340-a. The QKD transmitter 335 may be configured to generate quantum pulses indicative of a quantum key for optical communication between the remote node 310-a and the central node 305. Additionally, the synchronization pulse generator 325 may be configured to generate a timing indication of the quantum pulses indicative of the quantum key. The data receiver 320-a may be configured to receive (e.g., using the quantum key encrypted) downlink data from the central node 305. The data receiver 320-a may additionally be configured to decrypt the encrypted downlink data using the quantum key. The data transmitter 330-a may be configured to transmit (e.g., using the quantum key encrypted) uplink data to the central node 305. That is, the data transmitter 330-a may be configured to identify available time slot resources for transmission to the central node 305 and encrypt the uplink data using the quantum key.

[0107] The filter 340-a may be a CWDM filter and may be configured to separate and combine optical signals. For example, the filter 340-a may receive optical signals from an optical splitter 315 via an ingress optical fiber 365-a, separate them based on the wavelength 375 of the optical signals, and route the separated signals to different components of the remote node 310-a. For example, the filter 340-a may route an optical signal having a wavelength 375-b (e.g., associated with a downlink channel) to the data receiver 320-a via a switch 345-a. Additionally, the filter 340-a may receive optical signals from the synchronization pulse generator 325, the data transmitter 330-a, and the QKD transmitter 335, and may propagate them to the optical splitter via the ingress optical fiber 365-a.

[0108] The central node 305 may include a data transmitter 330-b, a synchronization pulse receiver 350, a data receiver 320-b, a QKD receiver 355, and filters 340-b and 340-c. The synchronization pulse receiver 350 may be configured to receive timing indications from one or more remote nodes 310, and the QKD receiver 355 may consist of a set of SPDs configured to receive quantum pulses indicating quantum keys from one or more remote nodes 310. The QKD receiver 355 may be configured to receive a single quantum pulse at a given time. The data transmitter 330-b may be configured to send downlink data to each of one or more remote nodes 310, encrypt the downlink data using a quantum key associated with the optical communication between the central node 305 and the remote node 310-a, and transmit the encrypted downlink data to the remote node 310-a. The data receiver 320-b may be configured to receive uplink data from one or more remote nodes 310. That is, the data receiver 320-b may receive encrypted uplink data from the remote node 310 and decrypt the encrypted uplink data using a quantum key associated with the optical communication between the remote node 310 and the central node 305. The quantum key for the uplink data may be the same as or different from the quantum key for the downlink data.

[0109] The QKD receiver 355 may be coupled to the filter 340-c. The filter 340-c may be a narrowband filter (e.g., a fiber Bragg grating (FBG) filter). In some instances, the filter 340-c may filter out some noise (e.g., Raman noise) of the quantum channel to improve the reliability of the quantum channel. Additionally, performing temporal filtering on the quantum channel (e.g., by opening the gate of the QKD receiver 355 only when the timing indication indicates a quantum pulse) may reduce the impact of noise on the quantum channel. Due to the alternating quantum operation mode and classical operation mode, it is not the uplink channel, downlink channel, and synchronization channel that contribute noise to the quantum channel, but only the synchronization channel that may contribute noise to the quantum channel.

[0110] Filter 340-b can be a CWDM filter and can be configured to separate and combine optical signals. For example, filter 340-b can receive optical signals from optical splitter 315 via feeder fiber 360, separate them based on the wavelength 375 of the optical signals, and route the separated signals to different components of central node 305. For example, filter 340-b can route optical signals having a wavelength 375-a (e.g., associated with a quantum channel or an upstream channel) between QKD receiver 355 or data receiver 320-b and optical splitter 315 (e.g., via switch 345-d). In another example, filter 340-b can route optical signals having a wavelength 375-d (e.g., associated with a synchronization channel or a downstream channel) between synchronization pulse receiver 350 or data transmitter 330-b and optical splitter 315 (e.g., via switch 345-c).

[0111] To communicate with central node 305 and while system 300 operates in quantum mode, synchronization pulse generator 325 can generate timing indications for one or more subsequent quantum pulses and can transmit the timing indications to central node 305 (e.g., via filter 340-a and optical splitter 315). In quantum mode, synchronization pulse receiver 350 can receive the timing indications and identify when the (multiple) subsequent quantum pulses will be received (e.g., to open a gate associated with QKD receiver 355). QKD transmitter 335 can generate quantum pulses and transmit the quantum pulses to central node 305 via filter 340-a and optical splitter 315. In some cases, by switching switch 345, system 300 switches to classical mode for downstream and upstream optical communications.

[0112] Figure 4A and Figure 4B illustrates an example of a system 400 and a wavelength plan 401 that support QKD in a PON in accordance with aspects of the present disclosure. System 400 can be an example of a point-to-multipoint WDM-PON system 400 that is configured to convey data encrypted using a quantum key between a central node 405 and a plurality of remote nodes 410 (e.g., as described with reference to Figure 1 ), and wavelength plan 401 can be an example of a wavelength plan 401 for communications used by system 400. Additionally, system 400 can include as described with reference to Figure 1Aspects of the described system 100. For example, the central node 405, the remote node 410, and the circulator arrayed waveguide grating (AWG) router 415 (or another type of optical multiplexer) can be examples of the central node 105, the remote node 110, and the optical component 115, respectively. The system 400 can additionally include a feeder fiber 460 for communication between the central node 405 and the circulator AWG router 415 and a drop fiber 465 for communication between the circulator AWG router 415 and the remote node 410.

[0113] The system 400 can rely on wavelength division multiplexing to transmit data, quantum keys, and timing indications between the central node 405 and one or more remote nodes 410. That is, each remote node 410 can utilize resources wavelength division multiplexed with resources associated with other remote nodes 410 used for communication with the central node 405. Additionally, as Figure 4B shown, the downlink data, uplink data, timing indications, and quantum pulses can be associated with wavelengths 475, which can be different or at least partially overlapping. For example, the quantum channel can be associated with wavelength 475-a (e.g., 1310 nm), the downlink channel can be associated with wavelength 475-b (e.g., 1490 nm), the uplink channel can be associated with wavelength 475-c (e.g., 1550 nm), and the synchronization channel (e.g., for transmitting timing indications) can be associated with wavelength 475-d (e.g., 1610 nm).

[0114] As Figure 4B shown, each optical signal (e.g., quantum pulse, downlink data, uplink data, and timing indication) includes multiple wavelengths 475. Here, each wavelength 475 can be associated with one of the remote nodes 410. For example, the downlink data 475-b includes more than one different wavelength 475. Each of the different wavelengths 475 can be associated with one of the remote nodes 410. In one example, the remote node 410-a can be associated with a first different wavelength 475 within wavelength 475-a for transmitting quantum pulses, a second different wavelength 475 within wavelength 475-b for receiving downlink data, a third different wavelength 475 within wavelength 475-c for transmitting uplink data, and a fourth different wavelength 475 within wavelength 475-d for transmitting timing indications. In some examples, each remote node 410 can be associated with an index and can use the wavelengths 475 within each of wavelengths 475-a, 475-b, 475-c, and 475-d determined according to the index.

[0115] The remote node 410-a can include a data receiver 420-a, a synchronization pulse generator 425, a data transmitter 430-a, and a QKD transmitter 435, each coupled to a filter 440-a. The QKD transmitter 435 can be configured to generate quantum pulses indicative of a quantum key for optical communication between the remote node 410-a and the central node 405. Additionally, the synchronization pulse generator 425 can be configured to generate a timing indication of the quantum pulses indicative of the quantum key. The data receiver 420-a can be configured to receive downlink data (e.g., encrypted using the quantum key) from the central node 405. The data receiver 420-a can additionally be configured to decrypt the encrypted downlink data using the quantum key. The data transmitter 430-a can be configured to transmit uplink data (e.g., encrypted using the quantum key) to the central node 405. That is, the data transmitter 430-a can be configured to transmit uplink data to the central node 405 and encrypt the uplink data using the quantum key.

[0116] The filter 440-a can be a CWDM filter and can be configured to separate and combine optical signals. For example, the filter 440-a can receive optical signals from the circulator AWG router 415 via the drop fiber 465-a, separate them based on the wavelength 475 of the optical signals, and route the separated signals to different components of the remote node 410-a. For example, the filter 440-a can route an optical signal having a wavelength 475-b (e.g., associated with a downlink channel) to the data receiver 420-a. Additionally, the filter 440-a can receive optical signals from the synchronization pulse generator 425, the data transmitter 430-a, and the QKD transmitter 435, and can propagate them to the circulator AWG router via the drop fiber 465-a.

[0117] The central node 405 may include a data transmitter 430-b, a synchronization pulse receiver 450, a data receiver 420-b, a QKD receiver 455, and filters 440-c, 44-d, 440-e, 440-f, and 440-g. The synchronization pulse receiver 450 may be configured to receive timing indications from one or more remote nodes 410, and the QKD receiver 455 may be a single-photon detector configured to receive quantum pulses indicative of a quantum key from one or more remote nodes 410. The QKD receiver 455 may be configured to receive a single quantum pulse at a given time. The data transmitter 430-b may be configured to transmit downlink data for transmission to each of one or more remote nodes 410, encrypt the downlink data using a quantum key associated with the optical communication between the central node 405 and the remote node 410-a, and transmit the encrypted downlink data to the remote node 410-a. The data receiver 420-b may be configured to receive uplink data from one or more remote nodes 410. That is, the data receiver 420-b may receive encrypted uplink data from the remote node 410-a and decrypt the encrypted uplink data using a quantum key associated with the optical communication between the remote node 410-a and the central node 405.

[0118] The QKD receiver 455 may be coupled to the filter 440-g. The filter 440-g may be a narrowband optical filter (e.g., a fiber Bragg grating (FBG) filter). In some instances, the filter 440-c may filter some noise (e.g., Raman noise) from the quantum channel to improve the reliability of the quantum channel. That is, the wavelength 475-a of the quantum channel may be spaced apart from the wavelengths of the classical channels (e.g., the downlink channel, the uplink channel, the synchronization channel), but there may still be Raman scattering noise associated with the quantum channel. Additionally, time filtering of the quantum channel (e.g., by only opening the gate of the QKD receiver 455 when the timing indication indicates a quantum pulse) may reduce the impact of the noise on the quantum channel.

[0119] Filter 440-b can be a CWDM filter and can be configured to separate and combine optical signals. For example, filter 440-b can receive optical signals from the circulator AWG router 415 via the feeder fiber 460, separate them based on the wavelength 475 of the optical signals, and route the separated signals to different components of the central node 405. For example, filter 440-b can route an optical signal having a wavelength 475-a (e.g., associated with a quantum channel) to the QKD receiver 455. In another example, filter 440-b can route an optical signal having a wavelength 475-c (e.g., associated with an upstream channel) to the data receiver 420-b. In another example, filter 440-b can route an optical signal having a wavelength 475-d (e.g., associated with a synchronization channel) to the synchronization pulse receiver 450. Additionally, filter 440-b can receive optical signals from the data transmitter 430-b and can propagate them via the feeder fiber 460 to the circulator AWG router.

[0120] The central node 405 can additionally include filters 440-c, 440-d, 440-e, and 440-g, which can be AWG filters. These filters 440 can be coupled to the components of the central node 405 and can further filter the optical signals based on the wavelength 475 of the optical signals. That is, filter 440-b can be configured to separate or combine optical signals based on the type of the optical signals. For example, filter 440-b can separate or combine optical signals based on whether the optical signal is a quantum pulse, a timing indication, upstream data, or downstream data (e.g., based on the wavelength of the optical signal). Filters 440-c, 440-d, 440-e, and 440-f can be configured to separate or combine optical signals associated with different remote nodes 410. That is, each signal output from filter 440-b can include optical signals associated with multiple remote nodes 410, each remote node associated with a different wavelength within a certain wavelength range (e.g., as Figure 4Bas shown). For example, filter 440-c can be configured to receive downlink data from data transmitter 430-b (or, in some cases, from multiple data transmitters 430-b or each of the constituent data transmitters of data transmitter 430-b associated with different remote nodes 410), where the downlink data includes multiple different wavelengths, each wavelength associated with a different remote node 410-a. Filter 440-c can then combine the multiple different wavelengths to output an optical signal including wavelength 475-b associated with the downlink data transmission. Similarly, filters 440-d, 440-e, and 440-f can be configured to receive the optical signal and separate the optical signal into wavelengths associated with each remote node 410, which can then be respectively passed to different instances of the synchronization pulse receiver 450, data receiver 420-b, and QCK receiver 455 (or different constituent receivers associated with different wavelengths).

[0121] To communicate with central node 405, synchronization pulse generator 425 can generate a timing indication for subsequent quantum pulses and can transmit the timing indication to central node 405 (e.g., via filter 440-a and loop AWG router 415). Synchronization pulse receiver 450 can receive the timing indication and identify when subsequent quantum pulses will be received (e.g., to open a gate associated with QKD receiver 455). Based on the timing indication, QKD transmitter 435 can generate quantum pulses and transmit the quantum pulses to central node 405 via filter 440-a and loop AWG router 415.

[0122] In some cases, system 400 can additionally include dual-feed fiber 470 and filter 440-h. Here, filter 440-h can direct quantum pulses to central node 405 via dual-feed fiber 470 (e.g., instead of feeder fiber 460). In some cases, this can reduce the amount of noise on the quantum channel and improve the signal quality associated with quantum pulse transmission.

[0123] Figure 5A and Figure 5B illustrates an example of a system 500 and wavelength plan 501 that support QKD in a PON according to aspects of the present disclosure. System 500 can be an example of a point-to-multipoint WDM-PON system 500 configured to transmit data encrypted with a quantum key (e.g., as described with reference to Figure 1 and FIG. 4), and wavelength plan 501 can be an example of a wavelength plan 501 for communication used by system 500. Additionally, system 500 can include as described with reference to Figure 1Aspects of systems 100 and 400 described with reference to FIGS. 1 and 4. For example, central node 505, remote nodes 510, and circulator AWG router 515 (or another type of optical multiplexer) can be examples of similar components described with reference to FIGS. 1 and 4. System 500 can additionally include feeder fiber 560 for communication between central node 505 and circulator AWG router 515 and drop fiber 565 for communication between circulator AWG router 515 and remote nodes 510. Figure 1 System 500 can rely on wavelength division multiplexing to transmit data, quantum keys, and timing indications between central node 505 and one or more remote nodes 510. That is, each remote node 510 can be configured to utilize resources wavelength division multiplexed with resources associated with other remote nodes 510 used for communication with central node 505. Additionally, system 300 can be configured to operate either in classical mode or in quantum mode. That is, a set of time resources for communication between central node 505 and one or more remote nodes 510 can be configured for classical communication (e.g., uplink data or downlink data) or quantum communication (e.g., timing indications or quantum pulses). In some cases, this can additionally reduce the amount of noise on the quantum channel compared to a system configured to support classical and quantum communication during overlapping time resources.

[0124] As shown, downlink data, uplink data, timing indications, and quantum pulses can be associated with wavelengths 575, which can be different or at least partially overlapping. For example, the quantum channel and the uplink channel can be associated with wavelength 575-a (e.g., 1310 nm). Additionally, the downlink channel and the synchronization channel can be associated with wavelength 575-b (e.g., 1490 nm). To enable WDM communication, each optical signal (e.g., quantum pulse, downlink data, uplink data, and timing indication) includes multiple wavelengths 575. Here, each wavelength 575 can be associated with one of remote nodes 510. For example, downlink data 575-b can include more than one different wavelength 575, where each of the different wavelengths 575 can be associated with one of remote nodes 510. In some examples, each remote node 510 can be associated with an index and can use a wavelength 575 within each of wavelengths 575-a, 575-b, 575-c, and 575-d determined according to the index. Because system 500 operates either in classical mode or in quantum mode, classical channels (e.g., downlink channel and uplink channel) can utilize wavelengths similar to those of the quantum channel (e.g., quantum channel and synchronization channel).

[0125] As Figure 5B shown

[0126] Each of the remote node 510 and the central node 505 may include a switch 545 to switch between a quantum mode and a classical mode. For example, the remote node 510-a may include switches 545-a and 545-b, and the central node 505 may include switches 545-c and 545-d. In some cases, the switches 545 may be linked. For example, the switch 545 may couple a first set of components (e.g., the data receiver 520 and the data transmitter 530) of the remote node 510 and the central node 505 to the filter 540 during a classical communication mode, and may couple a second set of components (e.g., the synchronization pulse generator 525, the QKD transmitter 535, the synchronization pulse receiver 550, and the QKD receiver 555) of the remote node 510-a and the central node 505 to the filter 540 during a quantum communication mode.

[0127] The remote node 510-a may include a data receiver 520-a, a synchronization pulse generator 525, a data transmitter 530-a, and a QKD transmitter 535, each coupled to a filter 540-a. The QKD transmitter 535 may be configured to generate quantum pulses indicative of a quantum key for optical communication between the remote node 510-a and the central node 505. Additionally, the synchronization pulse generator 525 may be configured to generate a timing indication of the quantum pulses indicative of the quantum key. The data receiver 520-a may be configured to receive (e.g., downlink data encrypted using the quantum key) from the central node 505. The data receiver 520-a may additionally be configured to decrypt the encrypted downlink data using the quantum key. The data transmitter 530-a may be configured to transmit (e.g., uplink data encrypted using the quantum key) to the central node 505. That is, the data transmitter 530-a may be configured to transmit uplink data for transmission to the central node 505 and encrypt the uplink data using the quantum key.

[0128] The filter 540-a may be a CWDM filter and may be configured to separate and combine optical signals. For example, the filter 540-a may receive optical signals from the circulator AWG router 515 via the drop fiber 565-a, separate them based on the wavelength 575 of the optical signals, and route the separated signals to different components of the remote node 510-a. For example, the filter 540-a may route an optical signal having a wavelength 575-b (e.g., associated with a downlink channel) to the data receiver 520-a. Additionally, the filter 540-a may receive optical signals from the synchronization pulse generator 525, the data transmitter 530-a, and the QKD transmitter 535, and may propagate them to the circulator AWG router via the drop fiber 565-a.

[0129] The central node 505 may include a data transmitter 530-b, a synchronization pulse receiver 550, a data receiver 520-b, a QKD receiver 555, and filters 540-c, 540-d, 540-e, 540-f, and 540-g. The synchronization pulse receiver 550 may be configured to receive timing indications from one or more remote nodes 510, and the QKD receiver 555 may be a single-photon detector configured to receive quantum pulses indicative of a quantum key from one or more remote nodes 510. The QKD receiver 555 may be configured to receive a single quantum pulse at a given time. The data transmitter 530-b may be configured to transmit downlink data to each of one or more remote nodes 510, encrypt the downlink data using a quantum key associated with the optical communication between the central node 505 and the remote node 510-a, and transmit the encrypted downlink data to the remote node 510-a. The data receiver 520-b may be configured to receive uplink data from one or more remote nodes 510. That is, the data receiver 520-b may receive encrypted uplink data from the remote node 510-a and decrypt the encrypted uplink data using a quantum key associated with the optical communication between the remote node 510-a and the central node 505.

[0130] The QKD receiver 555 may be coupled to the filter 540-e. The filter 540-e may be a narrowband optical filter (e.g., an FBG filter). In some instances, the filter 540-e may filter some noise (e.g., Raman noise) from the quantum channel to improve the reliability of the quantum channel. Additionally, time filtering of the quantum channel (e.g., by opening the gate of the QKD receiver 555 only when the timing indication indicates a quantum pulse) may reduce the impact of the noise on the quantum channel. In some cases, the system 500 may additionally include a dual-feed fiber 570 and a filter 540-h. Here, the filter 540-h may direct quantum pulses to the central node 505 via the dual-feed fiber 570 (e.g., instead of the feed fiber 560). In some cases, this may reduce the amount of noise on the quantum channel and improve the signal quality associated with the transmission of quantum pulses.

[0131] Filter 540-b can be a CWDM filter and can be configured to separate and combine optical signals. For example, filter 540-b can receive optical signals from the circulator AWG router 515 via the feeder fiber 560, separate them based on the wavelength 575 of the optical signals, and route the separated signals to different components of the central node 505. For example, filter 540-b can route an optical signal having a wavelength 575-a (e.g., associated with an upstream channel or a quantum channel) to the data receiver 520-b or the QKD receiver 555 via the switch 545-d. In another example, filter 540-b can route an optical signal having a wavelength 575-b (e.g., associated with a downstream channel or a synchronization channel) (e.g., via the switch 545-c) between the data transmitter 530-b or the synchronization pulse receiver 550 and the filter 540-b.

[0132] The central node 505 can additionally include filters 540-c and 540-d, which can be AWG filters. These filters 540 can be coupled to the components of the central node 505 and can further filter the optical signals based on the wavelength 575 of the optical signals. That is, filter 540-b can be configured to separate or combine optical signals based on the type of optical signal. For example, filter 540-b can separate or combine optical signals based on whether the optical signal is a quantum pulse, a timing indication, upstream data, or downstream data (e.g., based on the wavelength of the optical signal). Filters 540-c and 540-d can be configured to separate or combine optical signals associated with different remote nodes 510. That is, each signal output from filter 540-b can include optical signals associated with multiple remote nodes 510, each remote node associated with a different wavelength within a certain wavelength range (e.g., as Figure 5Bas shown). For example, filter 540-c may be configured to receive downlink data from data transmitter 530-b (or, in some cases, from multiple data transmitters 530-b or each of the component data transmitters of data transmitter 530-b associated with different remote nodes 510), where the downlink data includes multiple different wavelengths, each wavelength associated with a different remote node 510. Filter 540-c may then combine the multiple different wavelengths to output an optical signal including wavelength 575-b associated with the downlink data transmission. Filter 540-c may similarly separate the optical signal including wavelength 575-b into component wavelengths for uplink data transmission associated with each remote node 510 to deliver each of the different component wavelengths to different instances of synchronization pulse receiver 550 (or different component receivers of synchronization pulse receiver 550). Similarly, filter 540-d may be configured to receive an optical signal and separate the optical signal into wavelengths associated with each remote node 510, which may then be delivered to different instances of synchronization pulse receiver 520-b and QCK receiver 555 (or different component receivers associated with different wavelengths), respectively.

[0133] To communicate with central node 505, synchronization pulse generator 525 may generate timing indications for one or more subsequent quantum pulses and may transmit the timing indications to central node 505 (e.g., via filter 540-a and loop AWG router 515). Synchronization pulse receiver 550 may receive the timing indications and identify when the (multiple) subsequent quantum pulses will be received (e.g., to open the gates associated with QKD receiver 555). Based on the timing indications, system 500 may switch to a classical mode for optical communication (e.g., by switching switch 545), and QKD transmitter 535 may generate quantum pulses and transmit the quantum pulses to central node 505 via filter 540-a and optical splitter 515.

[0134] Figure 6 FIG. illustrates an example of a QKD-enabled system 600 in accordance with aspects of the present disclosure. System 600 may be an example of a hybrid system for Internet communication. In some cases, system 600 may adopt aspects of the point-to-multipoint PON system described with reference Figure 1 to FIGS. 5. For example, network node 605 may be an example of a network node (e.g., remote node, central node) as described herein. System 600 may include network node 605 configured to convey encrypted data using classical channel 615. System 600 may additionally include one or more quantum channels 610 for conveying quantum keys (e.g., via quantum pulses as described herein) for encrypting data communications between network nodes 605.

[0135] Network node 605-a can communicate with both network node 605-b and network node 605-c via quantum channel 610 and classical channel 615. Network node 605-a can communicate quantum key 625 (pre-shared key) with network nodes 605-b and 605-c via quantum channel 610. For example, network node 605-a can transmit quantum key 625-a and quantum key identifier 620-a (e.g., identifying quantum key 625-a) to network node 605-b via quantum channel 610-a. Additionally, network node 605-a can transmit quantum key 625-b and quantum key identifier 620-b (e.g., identifying quantum key 625-b) to network node 605-c via quantum channel 610-b.

[0136] After transmitting quantum key 625 and quantum key identifier 620, network node 605-a can communicate encrypted data 630 with network nodes 605-b and 605-c via the classical channel. That is, the transmitting network node 605 can use quantum key 625 to generate encrypted data 630, and the receiving network node 605 can use quantum key 625 to decrypt encrypted data 630. For example, network node 605-a can communicate encrypted data 630-a with network node 605-b via classical channel 615-a using quantum key 625-a. In some cases, encrypted data 630-a can include an indication of quantum key identifier 620-a. In another example, network node 605-a can communicate encrypted data 630-b with network node 605-c via classical channel 615-b using quantum key 625-b. In some instances, encrypted data 630-b can include an indication of quantum key identifier 620-b.

[0137] In some instances, network nodes 605-b and 605-c may not be directly coupled via quantum channel 610. That is, network nodes 605-b and 605-c may not be configured to directly transmit quantum keys (e.g., for generating or decrypting encrypted data 630-c) via quantum channel 610. Here, network node 605-a can be configured to transmit a message to each of network nodes 605-b and 605-c to indicate quantum key 625 for communication between network nodes 605-b and 605-c. That is, network node 605-a can transmit a message indicating quantum key 625 derived from the combination of quantum keys 625-a and 625-b (e.g., to both network nodes 605-b and 605-c). For example, the message can indicate quantum key 625 derived from the logical combination (e.g., XOR combination) of quantum keys 625-a and 625-b.

[0138] Based on a message indicating the derived quantum key 625, each of network nodes 605-b and 605-c can identify both quantum keys 625-a and 625-b. For example, network node 605-c can identify quantum key 625-a based on the indicated derived quantum key 625 and quantum key 625-b (e.g., received from network node 605-a via quantum channel 610-b). Thus, both network nodes 605-b and 605-c can identify both quantum keys 625-a and 625-b. Network nodes 605-b and 605-c can use the combination of quantum keys 625-a and 625-b to transmit encrypted data 630-c via classical channel 615-c.

[0139] Network nodes 605 can each include one or more layers or components. As an example, the various layers or components of network node 605-a are illustrated, but network nodes 605-b and 605-c can include similar layers or components. Network node 605-a can include a QKD client 635, a key management layer 640, a transport client 645, an encryption protocol 650, and a client application 655. The QKD client 635 of network node 605-a can be configured to communicate (e.g., transmit, receive) quantum key 625 with another network node 605 via quantum channel 610. The QKD client 635 can be configured to pass the quantum key 625 and quantum key identifier 620 from the QKD client 635 to the encryption protocol 650 (e.g., directly to the encryption protocol 650 without passing through the transport client 645). The QKD client 635 can additionally pass the quantum key 625 and quantum key identifier 620 to the key management layer 640 of network node 605-a. The key management layer 640 can be configured to store the quantum key 625 and quantum key identifier 620.

[0140] The transport client 645, encryption protocol 650, and client application 655 can be part of the protocol stack of network node 605-a and can be configured to receive data (e.g., associated with client application 655) via classical channels 615-a and 615-b. The transport client 645 can pass the encrypted data to the encryption protocol 650 for decoding. Additionally, the encryption protocol 650 can be configured to encrypt data before transmitting it via classical channel 615. That is, the encryption protocol 650 can be an example of a TLS client and can include software packages (e.g., GNUTLS, OPENSSL) that can include libraries for performing encryption functions to transmit encrypted information.

[0141] Figure 7Illustrated is an example of a QKD-enabled system 700 in accordance with aspects of the present disclosure. System 700 may be an example of a hybrid system and may implement aspects of the point-to-multipoint PON system and other hybrid systems described with reference to Figure 1 FIGs. 2 to 5. For example, network node 705 may be an example of a network node (e.g., a remote node, a central node) as described herein. System 700 may include a network node 705 configured to transmit data encrypted using a quantum key.

[0142] Network node 705-a may include a QKD client 735-a, a key management layer 740-a, a transport client 745-a, an encryption protocol 750-a, and a client application 755-a. Network node 705-b may include a QKD server 735-b, a key management layer 740-b, a transport server 745-b, an encryption protocol 750-b, and a server application 755-b. The QKD server 735-b of network node 705-b may be configured to provide a quantum key and a quantum key identifier 725-a to the QKD client 735-a of network node 705-a (e.g., via a quantum channel). The QKD server 735-b of network node 705-b may additionally transmit a quantum key and a quantum key identifier 725-c to the encryption protocol 750-b (e.g., within the protocol stack of network node 705-b). In some cases, the quantum key identifier may be unique between two Internet Protocol (IP) addresses of network nodes 705-a and 705-b. Additionally, the QKD server 735-b may transmit a quantum key and a quantum key identifier 725-c to the key management layer 740-b. The key management layer 740-b may be configured to store the quantum key and the quantum key identifier 725-c. For example, the key management layer 740-b may store the quantum key and the quantum key identifier 725-c together with the IP addresses associated with network nodes 705-a and 705-b.

[0143] When network node 705-a receives the quantum key and the quantum key identifier 725-a, the QKD client 735-a may transmit the quantum key and the quantum key identifier 725-c to the key management layer 740-a (e.g., for storage). For example, the key management layer 740-a may store the quantum key and the quantum key identifier 725-b together with the IP addresses associated with network nodes 705-a and 705-b.

[0144] The transport layer 745-a, the encryption protocol 750-a, and the client application 755-a can be part of the protocol stack of the network node 705-a and can be configured to receive an indication 760 of encrypted data and quantum key identifiers (e.g., associated with the application 755) from the network node 705-b (e.g., via a classical channel). In some cases, the transport client 745-a can receive encrypted data from the network node 705-b and transmit encrypted data to the network node, and transmit the encrypted data to the encryption protocol 750-a. The transport layer 745-b, the encryption protocol 750-b, and the server application 755-b can be part of the communication protocol stack of the network node 705-b and can be configured to receive an indication 760 of encrypted data and quantum key identifiers (e.g., associated with the application 755) from the network node 705-a (e.g., via a classical channel). The communication protocol stack can include, for example, (transport layer, network layer, data link layer, or physical layer). In some cases, the transport server 745-b can use TCP to achieve reliability and flow control to receive encrypted data from the network node 705-a and transmit encrypted data to the network node, and transmit the encrypted data to the encryption protocol 750-b.

[0145] When transmitting data to the network node 705-a, the server application 755-b can provide the data to be transmitted to the encryption protocol 750-b and an indication of the network node 705-a (e.g., the IP address associated with the network node 705-a). The encryption protocol 750-b can obtain a quantum key associated with the communication between the network nodes 705-b and 705-a (e.g., from the key management layer 740-b). The encryption protocol 750-b can then encrypt the data from the server application 755-b using the quantum key associated with the network node 705-a and transmit the encrypted data and an indication 760 of the quantum key identifier to the network node 705-a. The network node 705-a can receive the encrypted data and an indication 760 of the quantum key identifier from the network node 705-b (e.g., through the encryption protocol 750-a or the transport client 745-a). The encryption protocol 750-a can obtain a quantum key based on the indication of the quantum key identifier (e.g., from the key management layer 740-a) and can use the quantum key to decrypt the data.

[0146] To transfer data from network node 705-a to network node 705-b, client application 755-a may provide data for transfer to encryption protocol 750-a and an indication of network node 705-b (e.g., an IP address associated with network node 705-b). Encryption protocol 750-a may obtain a quantum key associated with the communication between network nodes 705-b and 705-a (e.g., from key management layer 740-a). For example, transport client 745-a may receive an indication of the IP address associated with network node 705-b (e.g., from a routing table). Transport client 745-a may indicate the IP address associated with network node 705-b, and key management layer 740-a may determine a quantum key for communicating with network node 705-b. For example, the quantum key may be directly exchanged with network node 705-b via a quantum channel or may be a combination of keys derived from keys exchanged with one or more other network nodes via a quantum channel as described above. Encryption protocol 750-a may then encrypt the data from client application 755-a using the quantum key associated with network node 705-b and transmit the encrypted data and an indication 760 of the quantum key identifier to network node 705-b. Network node 705-b may receive the encrypted data and the indication 760 of the quantum key identifier from network node 705-a (e.g., via encryption protocol 750-b or transport server 745-b). Encryption protocol 750-b may obtain the quantum key based on the indication of the quantum key identifier (e.g., from key management layer 740-b) and may use the quantum key to decrypt the data.

[0147] In some cases, network node 705 may additionally include an IP layer. The IP layer may be configured to identify to which next network node 705 (e.g., network node 705-b) to transfer data (e.g., in order to route the data to the correct destination network node 705). The IP layer of the current network node 705-a may identify the next network node 705-b based on a routing table that may use an IP address to indicate the next network node 705-b. Here, the current network node 705-a may use this IP address to search (e.g., within key management layer 740) for a quantum key associated with the communication with the next network node 705-b. The key management layer 740 may then provide the necessary quantum key (or a combination of more than one quantum key) to encrypt the data before transferring it to the next network node 705-b.

[0148] Figure 8FIG. 800 illustrates an example of a process flow for supporting QKD in PON according to aspects of the present disclosure. The process flow 800 may be implemented by a network node 805, which may be an example of a network node as described herein (e.g., a remote node, a central node). In the following description of the process flow 800, these operations may be performed in a different order or at different times. Some operations may also be omitted from the process flow 800, and other operations may be added to the process flow 800.

[0149] At 810, the network node 805-a may transmit a first quantum key and a first quantum key identifier to the network node 805-b (e.g., via a quantum channel) through a QKD server. The network node 805-b may receive the first quantum key and the first quantum key identifier through a QKD client.

[0150] At 815, the network node 805-b may pass the first quantum key and the first quantum key identifier from the QKD client to the protocol stack of the first network node (e.g., to the encryption protocol of the protocol stack).

[0151] At 820, the network node 805-b and the network node 805-a may communicate encrypted data through the encryption protocol of the protocol stack. In some cases, the data may be encrypted using the first quantum key and may include an indication of the first quantum key identifier.

[0152] At 825, the network node 805-a may transmit a message including a second quantum key, which is derived from a third quantum key associated with the communication between the network node 805-a and the network node 805-c.

[0153] At 830, the network node 805-b may identify the third quantum key based on the second quantum key and the first quantum key.

[0154] At 835, the network node 805-b may communicate encrypted data with the network node 805-c through the encryption protocol of the protocol stack. In some cases, the data may be encrypted using a combination of the first quantum key and the third quantum key (e.g., according to a predetermined or negotiated function).

[0155] Figure 9 FIG. 900 is a block diagram of a remote node 905 supporting QKD in PON according to an example disclosed herein. The remote node 905 may be a reference Figure 1Examples of aspects of the remote node described with respect to FIGS. 1-5. The remote node 905 may include a resource manager 910, a quantum pulse generator 915, a timing indicator transmitter 920, a quantum pulse transmitter 925, and a communication component 930. Each of these modules may communicate with each other directly or indirectly (e.g., via one or more buses).

[0156] The resource manager 910 may identify a resource for outputting a quantum pulse from a set of resources shared by the set of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and the central node. In some examples, the resource manager 910 may output a request for a time resource for outputting a quantum key to an optical component. In some cases, the resource manager 910 may receive an indication of the identified resource from the optical component based on outputting the request for the time resource. In some instances, the identified resource for outputting a quantum pulse is time-division multiplexed with a resource in the set of resources associated with the set of remote nodes. Here, the optical component may be an optical splitter. In some cases, the identified resource for outputting a quantum pulse is wavelength-division multiplexed with a resource in the set of resources associated with the set of remote nodes. Here, the optical component may be a circulator AWG router.

[0157] The quantum pulse generator 915 may generate a quantum pulse and a timing indicator of the quantum pulse based on the identified resource. In some examples, the quantum pulse generator 915 may generate a second quantum pulse indicating a second quantum key for optical communication between the remote node and the central node.

[0158] The timing indicator transmitter 920 may output a timing indicator of the quantum pulse to an optical component.

[0159] The quantum pulse transmitter 925 may output a quantum pulse indicating a quantum key to an optical component using the identified resource based on outputting the timing indicator of the quantum pulse. In some examples, the quantum pulse transmitter 925 may output a second quantum pulse indicating a second quantum key to the optical component based on outputting the timing indicator after outputting the quantum pulse to the optical component, wherein the timing indicator indicates the timing of the quantum pulse and the second quantum pulse.

[0160] The communication component 930 can communicate with the central node based on outputting quantum pulses indicating quantum keys. In some examples, the communication component 930 can switch from a first communication mode for transmitting quantum pulses to the central node to a second communication mode for communicating data with the central node based on outputting the quantum pulses to the optical component, where the communication with the central node is based on the switch. In some cases, the communication component 930 can encrypt the data to be transmitted to the central node using the quantum key. In some instances, the communication component 930 can output the encrypted data to the optical component. In some examples, the communication component 930 can receive encrypted data from the optical component. In some cases, the communication component 930 can decrypt the encrypted data received from the optical component using the quantum key.

[0161] Figure 10 Block diagram 1000 of a central node 1005 supporting QKD in PON according to examples disclosed herein is shown. The central node 1005 can be an example of aspects of the central node described with reference Figure 1 to FIGS. 5. The central node 1005 can include a timing indication manager 1010, a quantum pulse manager 1015, a communication manager 1020, and a resource manager 1025. Each of these modules can communicate with each other directly or indirectly (e.g., via one or more buses).

[0162] The timing indication manager 1010 can receive a set of timing indications from the optical component, each timing indication associated with one of a set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of a set of remote nodes.

[0163] The quantum pulse manager 1015 can receive the set of quantum pulses from the optical component based on receiving the set of timing indications via a set of resources. In some cases, each of the set of quantum pulses is received via a resource time-division multiplexed with a resource in the set of resources. In some examples, the optical component is an optical splitter. In some instances, each of the set of quantum pulses is received via a resource wavelength-division multiplexed with a resource in the set of resources. In some examples, the optical component is a cyclic AWG router.

[0164] The communication manager 1020 may communicate with the set of remote nodes based on receiving the set of quantum pulses, where each quantum pulse indicates a quantum key for optical communication associated with one of the set of remote nodes. In some examples, the communication manager 1020 may switch from a first communication mode for receiving the set of quantum pulses from an optical component to a second communication mode for communicating data with the set of remote nodes based on receiving the set of quantum pulses, and the communication with the set of remote nodes is based on the switch. In some cases, the communication manager 1020 may identify data for transmission to one of the set of remote nodes.

[0165] In some instances, the communication manager 1020 may encrypt data for transmission to a central node using a quantum key for optical communication associated with the one remote node. In some examples, the communication manager 1020 may transmit the encrypted data to the one remote node via an optical component. In some cases, the communication manager 1020 may receive encrypted data associated with one of the set of remote nodes from an optical component. In some instances, the communication manager 1020 may decrypt the encrypted data received from the optical component using a quantum key for optical communication associated with the one remote node.

[0166] The resource manager 1025 may receive a request for a time resource for one of the set of quantum pulses from an optical component. In some examples, the resource manager 1025 may output an indication of the time resource for the one quantum pulse of the set of quantum pulses within the set of resources, and receiving the set of quantum pulses is based on outputting the indication.

[0167] Figure 11 FIG. 1100 is a block diagram showing a network node 1105 supporting QKD in PON according to examples disclosed herein. The network node 1105 may be an example of aspects of the network node described with reference to Figures 1 to 8 The network node 1105 may include a quantum key receiver 1110, a quantum key manager 1115, and a communication manager 1120. Each of these modules may communicate directly or indirectly with each other (e.g., via one or more buses).

[0168] The quantum key receiver 1110 may receive a first quantum key and a first quantum key identifier from a second network node via a QKD client. In some examples, the quantum key receiver 1110 may receive a message including a second quantum key from the second network node, where the second quantum key is derived from a third quantum key associated with communication between the second network node and a third network node.

[0169] The quantum key manager 1115 can transfer the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node. In some examples, the quantum key manager 1115 can identify a third quantum key based on the second quantum key and the first quantum key. In some cases, the quantum key manager 1115 can transfer the first quantum key and the first quantum key identifier from the QKD client of the first network node to the key management layer of the first network node. In some instances, the quantum key manager 1115 can store the first quantum key and the first quantum key identifier on a server associated with the key management layer, where communicating encrypted data with the second network node is based on the storage. In some examples, the quantum key manager 1115 can transmit a request for the first quantum key to the corresponding key management layer of the second network node through the key management layer of the first network node, where receiving the first quantum key through the QKD client of the first network node is based on transmitting the request.

[0170] The communication manager 1120 can communicate encrypted data with the second network node through the encryption protocol of the protocol stack, where the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier. In some examples, the communication manager 1120 can communicate second encrypted data with the third network node through the encryption protocol of the protocol stack, where the second encrypted data is encrypted using the first quantum key and the third quantum key. In some cases, the communication manager 1120 can identify data for transmission to the second network node. In some instances, the communication manager 1120 can encrypt the data for transmission to the second network node using the first quantum key through the encryption protocol of the protocol stack.

[0171] In some examples, the communication manager 1120 can transmit the encrypted data and an indication of the first quantum key identifier to the second network node through the encryption protocol of the protocol stack. In some cases, receive encrypted data from the second network node through the encryption protocol of the protocol stack, where the encrypted data includes an indication of the first quantum key identifier. In some instances, the communication manager 1120 can obtain the first quantum key from a server associated with the key management layer of the first network node through the encryption protocol of the protocol stack based on the indication of the first quantum key identifier. In some examples, the communication manager 1120 can decrypt the encrypted data using the first quantum key through the encryption protocol of the protocol stack based on obtaining the first quantum key.

[0172] Figure 12FIG. 1200 is a flowchart illustrating one or more methods 1200 for supporting QKD in a PON in accordance with aspects of the present disclosure. Operations of method 1200 may be implemented by a remote node or components thereof as described herein. For example, operations of method 1200 may be performed by a remote node as referenced Figure 9 described. In some examples, the remote node may execute a set of instructions to control functional elements of the remote node to perform the described functions. Additionally or alternatively, the remote node may use dedicated hardware to perform aspects of the functions.

[0173] At 1205, the remote node may identify a resource for outputting a quantum pulse from a set of resources shared by the set of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and a central node. The operation of 1205 may be performed according to methods described herein. In some examples, aspects of the operation of 1205 may be performed by a resource manager as referenced Figure 9 described.

[0174] At 1210, the remote node may generate a quantum pulse and a timing indication of the quantum pulse based on the identified resource. The operation of 1210 may be performed according to methods described herein. In some examples, aspects of the operation of 1210 may be performed by a quantum pulse generator as referenced Figure 9 described.

[0175] At 1215, the remote node may output a timing indication of the quantum pulse to an optical component. The operation of 1215 may be performed according to methods described herein. In some examples, aspects of the operation of 1215 may be performed by a timing indication transmitter as referenced Figure 9 described.

[0176] At 1220, the remote node may output a quantum pulse indicating a quantum key to the optical component using the identified resource based on the output timing indication of the quantum pulse. The operation of 1220 may be performed according to methods described herein. In some examples, aspects of the operation of 1220 may be performed by a quantum pulse transmitter as referenced Figure 9 described.

[0177] At 1225, the remote node may communicate with the central node based on the output quantum pulse indicating the quantum key. The operation of 1225 may be performed according to methods described herein. In some examples, aspects of the operation of 1225 may be performed by a communication component as referenced Figure 9 described.

[0178] Figure 13FIG. 1300 is a flow chart illustrating one or more methods 1300 for supporting QKD in a PON in accordance with aspects of the present disclosure. Operations of method 1300 may be implemented by a central node or components thereof as described herein. For example, operations of method 1300 may be performed by the central node referenced Figure 10 as described. In some examples, the central node may execute a set of instructions to control functional elements of the central node to perform the described functions. Additionally or alternatively, the central node may use dedicated hardware to perform aspects of the described functions.

[0179] At 1305, the central node may receive a set of timing indications from an optical component, each timing indication associated with one of a set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of a set of remote nodes. The operation of 1305 may be performed in accordance with methods described herein. In some examples, aspects of the operation of 1305 may be performed by the timing indication manager referenced Figure 10 as described.

[0180] At 1310, the central node may receive the set of quantum pulses from the optical component via a set of resources based on receiving the set of timing indications. The operation of 1310 may be performed in accordance with methods described herein. In some examples, aspects of the operation of 1310 may be performed by the quantum pulse manager referenced Figure 10 as described.

[0181] At 1315, the central node may communicate with the set of remote nodes based on receiving the set of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of the set of remote nodes. The operation of 1315 may be performed in accordance with methods described herein. In some examples, aspects of the operation of 1315 may be performed by the communication manager referenced Figure 10 as described.

[0182] Figure 14 FIG. 1400 is a flow chart illustrating one or more methods 1400 for supporting QKD in a PON in accordance with aspects of the present disclosure. Operations of method 1400 may be implemented by a network node or components thereof as described herein. For example, operations of method 1400 may be performed by the network node referenced Figure 11 as described. In some examples, the network node may execute a set of instructions to control functional elements of the network node to perform the described functions. Additionally or alternatively, the network node may use dedicated hardware to perform aspects of the described functions.

[0183] At 1405, a network node may receive a first quantum key and a first quantum key identifier from a second network node via a QKD client. The operations at 1405 may be performed according to the methods described herein. In some examples, aspects of the operations at 1405 may be performed by a quantum key receiver as referenced Figure 11 as described.

[0184] At 1410, a network node may pass the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node. The operations at 1410 may be performed according to the methods described herein. In some examples, aspects of the operations at 1410 may be performed by a quantum key manager as referenced Figure 11 as described.

[0185] At 1415, a network node may communicate encrypted data with a second network node via an encryption protocol of the protocol stack, where the encrypted data is encrypted using the first quantum key and includes an indication of the first quantum key identifier. The operations at 1415 may be performed according to the methods described herein. In some examples, aspects of the operations at 1415 may be performed by a communication manager as referenced Figure 11 as described.

[0186] Figure 15 FIG. 1500 is a flow diagram illustrating one or more methods 1500 for supporting QKD in PON in accordance with aspects of the present disclosure. The operations of method 1500 may be implemented by a network node or components thereof as described herein. For example, the operations of method 1500 may be performed by a network node as referenced Figure 11 described. In some examples, a network node may execute a set of instructions to control functional elements of the network node to perform the described functions. Additionally or alternatively, the network node may use dedicated hardware to perform aspects of the functions.

[0187] At 1505, a network node may receive a first quantum key and a first quantum key identifier from a second network node via a QKD client. The operations at 1505 may be performed according to the methods described herein. In some examples, aspects of the operations at 1505 may be performed by a quantum key receiver as referenced Figure 11 as described.

[0188] At 1510, a network node may pass the first quantum key and the first quantum key identifier from the QKD client of the first network node to the protocol stack of the first network node. The operations at 1510 may be performed according to the methods described herein. In some examples, aspects of the operations at 1510 may be performed by a quantum key manager as referenced Figure 11 as described.

[0189] At 1515, a network node may communicate encrypted data with a second network node via an encryption protocol of a protocol stack, where the encrypted data is encrypted using a first quantum key and includes an indication of a first quantum key identifier. The operation of 1515 may be performed according to the methods described herein. In some examples, aspects of the operation of 1515 may be performed by a communication manager as described with reference to Figure 11 the communication manager described.

[0190] At 1520, a network node may receive a message including a second quantum key from a second network node, where the second quantum key is derived from a third quantum key associated with communication between the second network node and a third network node. The operation of 1520 may be performed according to the methods described herein. In some examples, aspects of the operation of 1520 may be performed by a quantum key receiver as described with reference to Figure 11 the quantum key receiver described.

[0191] At 1525, a network node may identify a third quantum key based on the second quantum key and the first quantum key. The operation of 1525 may be performed according to the methods described herein. In some examples, aspects of the operation of 1525 may be performed by a quantum key manager as described with reference to Figure 11 the quantum key manager described.

[0192] At 1530, a network node may communicate second encrypted data with a third network node via an encryption protocol of a protocol stack, where the second encrypted data is encrypted using the first quantum key and the third quantum key. The operation of 1530 may be performed according to the methods described herein. In some examples, aspects of the operation of 1530 may be performed by a communication manager as described with reference to Figure 11 the communication manager described.

[0193] It should be noted that the methods described herein are possible embodiments, and the operations and steps may be rearranged or otherwise modified, and other embodiments are possible. In addition, parts of two or more methods may be combined.

[0194] The various illustrative blocks and modules described in connection with the disclosure herein may be implemented or performed with a general-purpose processor, a digital signal processor (DSP), an ASIC, an FPGA, or other programmable logic device designed to perform the functions described herein, discrete gate or transistor logic, discrete hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).

[0195] The functions described herein can be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions can be stored or transmitted as one or more instructions or code on a computer-readable medium. Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software, the functions described herein can be implemented using software executed by a processor, hardware, firmware, hardwiring, or any combination thereof. Features implementing the functions can also be physically located in various positions, including being distributed such that portions of the functions are implemented at different physical locations.

[0196] Computer-readable media includes both non-transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. Non-transitory storage media can be any available media that can be accessed by a general or special purpose computer. By way of example and not limitation, non-transitory computer-readable media can include random access memory (RAM), read only memory (ROM), electrically erasable programmable ROM (EEPROM), flash memory, compact disc ROM (CD-ROM) or other optical disc storage, magnetic disk storage or other magnetic storage devices, or any other non-transitory medium that can be used to carry or store desired program code means in the form of instructions or data structures and that can be accessed by a general or special purpose computer or a general or special purpose processor. Also, any connection is properly termed a computer-readable medium. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of the medium. As used herein, disk or disc includes CD, laser disc, optical disc, digital versatile disc (DVD), floppy disk, and Blu-ray disc, where disks typically reproduce data magnetically, while discs optically reproduce data with lasers. Combinations of the above are also included within the scope of computer-readable media.

[0197] As used herein (including in the claims), the "or" used in a list of items (e.g., a list of items beginning with phrases such as "at least one of" or "one or more of") indicates an inclusive list such that, for example, a list of at least one of A, B, or C represents A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Also, as used herein, the phrase "based on" should not be construed as a reference to a closed set of conditions. For example, an exemplary step described as "based on condition A" can be based on both condition A and condition B without departing from the scope of this disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "at least partially based on".

[0198] In the drawings, like parts or features may have the same reference numeral. Further, various parts of the same type can be distinguished by following the reference numeral with a dash and a second label that differentiates between the like parts. If only the first reference numeral is used in the specification, the description applies to any of the like parts having the same first reference numeral, regardless of the second reference numeral or any subsequent reference numerals.

[0199] The description set forth herein in conjunction with the drawings describes example configurations and does not represent all examples that can be implemented or that are within the scope of the claims. The term "exemplary" as used herein means "serving as an example, instance, or illustration" and not "preferred" or "superior to other examples". The detailed description includes specific details to provide an understanding of the described techniques. However, the techniques can be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form to avoid obscuring the concepts of the described examples.

[0200] The present description is provided to enable a person skilled in the art to make or use the present disclosure. Various modifications to the present disclosure will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other variations without departing from the scope of the present disclosure. Thus, the present disclosure is not limited to the examples and designs described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device configured to communicate optically with a central node, the central node being configured to communicate with a plurality of remote nodes via an optical component coupled to the central node and the plurality of remote nodes, the plurality of remote nodes including the device, the device comprising: A quantum key distribution transmitter configured to: Identify a resource for outputting a quantum pulse from a set of resources shared by the plurality of remote nodes, the quantum pulse indicating a quantum key for optical communication associated with the device; And Generate the quantum pulse at least in part based on the identification; A synchronization pulse generator configured to generate a timing indication of the quantum pulse indicating the quantum key; And A filter coupled to the quantum key distribution transmitter and the synchronization pulse generator and configured to output the timing indication of the quantum pulse and the quantum pulse indicating the quantum key to the optical component using the identified resource; A data transmitter coupled to the filter and configured to: Identify data for transmission to the central node; Encrypt the data for transmission to the central node using the quantum key; And Transmit the encrypted data to the filter, wherein the filter is further configured to output the encrypted data to the optical component.

2. The device according to claim 1, wherein: The identified resource for outputting the quantum pulse is time-division multiplexed with a resource associated with the plurality of remote nodes in the set of resources; and The optical component is an optical splitter.

3. The device according to claim 1, wherein: The identified resource for outputting the quantum pulse is wavelength-division multiplexed with a resource associated with the plurality of remote nodes in the set of resources; and The optical component is a circulator arrayed waveguide grating router.

4. The device according to claim 1, further comprising an optical switch configured to selectively couple the filter to the quantum key distribution transmitter and the synchronization pulse generator, or couple the filter to the data transmitter and the data receiver.

5. The device according to claim 1, wherein: The filter is further configured to receive encrypted data from the optical component; and The device further comprises a data receiver coupled to the filter and configured to decrypt the encrypted data using the quantum key.

6. The device according to claim 1, wherein, The filter is a coarse wavelength division multiplexer.

7. A method for optically communicating with a central node at a remote node, the central node being configured to communicate with a plurality of remote nodes including the remote node via an optical component, the method comprising: Identifying a resource for outputting a quantum pulse from a set of resources shared by the plurality of remote nodes, the quantum pulse indicating a quantum key for optical communication between the remote node and the central node; Generating the quantum pulse and a timing indication of the quantum pulse at least in part based on identifying the resource; Output the timing indication of the quantum pulse to the optical component; Output the quantum pulse indicating the quantum key to the optical component using the identified resource, at least partially based on the timing indication of outputting the quantum pulse; And Communicate with the central node at least partially based on outputting the quantum pulse indicating the quantum key; Encrypt the data to be transmitted to the central node using the quantum key; And Output the encrypted data to the optical component.

8. The method according to claim 7, wherein: The identified resource for outputting the quantum pulse is time-division multiplexed with the resources associated with the multiple remote nodes in the set of resources; and The optical component is an optical splitter.

9. The method according to claim 7, wherein: The identified resource for outputting the quantum pulse is wavelength-division multiplexed with the resources associated with the multiple remote nodes in the set of resources; and The optical component is a cyclic array waveguide grating router.

10. The method according to claim 7, further comprising: Generate a second quantum pulse indicating a second quantum key for optical communication between the remote node and the central node; And After outputting the quantum pulse to the optical component, output the second quantum pulse indicating the second quantum key to the optical component at least partially based on outputting the timing indication, wherein the timing indication indicates the timing of the quantum pulse and the second quantum pulse.

11. The method according to claim 7, wherein, Identifying the resource for outputting the quantum key includes: Output a request for the time resource for outputting the quantum key to the optical component; and Receive an indication of the identified resource from the optical component at least partially based on outputting the request for the time resource.

12. The method according to claim 7, further comprising: Switch from a first communication mode for transmitting the quantum pulse to the central node to a second communication mode for communicating data with the central node at least partially based on outputting the quantum pulse to the optical component, wherein the communication with the central node is at least partially based on the switch.

13. The method according to claim 7, wherein, The communication with the central node includes: Receive the encrypted data from the optical component; and Decrypt the encrypted data received from the optical component using the quantum key.

14. An apparatus configured to communicate optically with a plurality of remote nodes via an optical component coupled to the apparatus and the plurality of remote nodes, the apparatus comprising: A quantum key distribution receiver configured to receive a plurality of quantum pulses from a filter of the apparatus via a set of resources, each quantum pulse indicating a quantum key for optical communication associated with one of the plurality of remote nodes, A synchronization pulse receiver configured to receive a plurality of timing indications from the filter, each timing indication associated with one of the plurality of quantum pulses, wherein the quantum key distribution receiver is configured to receive each of the plurality of quantum pulses at least partially based on the plurality of timing indications, and The filter, which is coupled to the quantum key distribution receiver and the synchronization pulse receiver and is configured to: Receive the plurality of quantum pulses and the plurality of timing indications from the optical component; Transmit the plurality of quantum pulses to the quantum key distribution receiver; and Transmit the plurality of timing indications to the synchronization pulse receiver; A data transmitter, which is coupled to the filter and is configured to: Identify data for transmission to one of the plurality of remote nodes; Encrypt the data for transmission to the one remote node using the quantum key for optical communication associated with the one remote node; and Transmit the encrypted data to the filter, wherein the filter is further configured to output the encrypted data to the optical component.

15. The apparatus according to claim 14, wherein: Each of the plurality of quantum pulses is received via a resource time-division multiplexed with a resource in the set of resources; and The optical component is an optical splitter.

16. The apparatus according to claim 14, wherein: Each of the plurality of quantum pulses is received via a resource wavelength-division multiplexed with a resource in the set of resources; and The optical component is a circulator arrayed waveguide grating router.

17. The apparatus according to claim 16, wherein: The filter is configured to receive the plurality of quantum pulses from the optical component via a first optical fiber; and The filter is configured to receive the plurality of timing indications from the optical component via a second optical fiber different from the first optical fiber.

18. The apparatus according to claim 14, further comprising a gate, which is coupled to the quantum key distribution receiver and is configured to selectively couple the quantum key distribution receiver to the filter at least in part based on the plurality of timing indications.

19. The apparatus according to claim 14, further comprising an optical switch, which is configured to selectively couple the filter to the quantum key distribution receiver and the synchronization pulse receiver, or couple the filter to the data transmitter and the data receiver.

20. The apparatus according to claim 14, further comprising a narrowband optical filter, which is coupled to the filter and the quantum key distribution receiver and is configured to transmit the plurality of quantum pulses from the filter to the quantum key distribution receiver.

21. The apparatus according to claim 14, wherein: The filter is further configured to receive encrypted data associated with one of the plurality of remote nodes from the optical component; and The apparatus further comprises a data receiver, which is coupled to the filter and is configured to decrypt the encrypted data using the quantum key for optical communication associated with the one remote node.

22. The device according to claim 14, wherein The quantum key distribution receiver includes a single-photon detector.

23. The device according to claim 14, wherein, The filter is a coarse wavelength division multiplexer.

24. A method for optical communication with a plurality of remote nodes via optical components coupled to each of the plurality of remote nodes at a central node, the method comprising: Receiving a plurality of timing indications from the optical components, each timing indication being associated with one of a plurality of quantum pulses, each quantum pulse indicating a quantum key for optical communication associated with one of the plurality of remote nodes; Receiving the plurality of quantum pulses from the optical components via a set of resources at least in part based on receiving the plurality of timing indications; And Communicating with the plurality of remote nodes at least in part based on receiving the plurality of quantum pulses, each quantum pulse indicating the quantum key for optical communication associated with one of the plurality of remote nodes; Identifying data to be transmitted to one of the plurality of remote nodes; Encrypting the data to be transmitted to the central node using the quantum key for optical communication associated with the one remote node; And Transmitting the encrypted data to the one remote node via the optical components.

25. The method according to claim 24, wherein: Each of the plurality of quantum pulses is received via a resource time-division multiplexed with a resource in the set of resources; and The optical component is an optical splitter.

26. The method according to claim 24, wherein: Each of the plurality of quantum pulses is received via a resource wavelength-division multiplexed with a resource in the set of resources; and The optical component is a circulator arrayed waveguide grating router.

27. The method according to claim 24, further comprising: Receiving a request for time resources for one of the plurality of quantum pulses from the optical components; And Outputting an indication of the time resources for the one of the plurality of quantum pulses within the set of resources to the optical components, wherein receiving the plurality of quantum pulses is at least in part based on outputting the indication.

28. The method according to claim 24, further comprising: Switching from a first communication mode for receiving the plurality of quantum pulses to a second communication mode for communicating data with the plurality of remote nodes at least in part based on receiving the plurality of quantum pulses from the optical components, wherein communication with the plurality of remote nodes is at least in part based on the switching.

29. The method according to claim 24, wherein, Communication with the plurality of remote nodes includes: Receiving encrypted data associated with one of the plurality of remote nodes from the optical components; and Decrypting the encrypted data received from the optical components using the quantum key for optical communication associated with the one remote node.

Images