QSN Key Delivery System (KDS)
Resilient, efficient network-wide key delivery
Quantum-safe networks need to adapt as cryptographic technologies, standards and threats evolve. Toshiba QSN Key Delivery System (KDS) provides an abstracted software layer for delivering quantum-safe keys across different physical network topologies.
Build resiliency into key delivery
Integrated directly within QSN hardware, the KDS combines Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC) and Diffie-Hellman (DH) key exchange to support hybrid key delivery and a layered, defence-in-depth security approach. This crypto-agile architecture enables organisations to adapt their quantum cryptography strategy as requirements change without being dependent on a single cryptographic technology.
Built for resilience, the KDS uses a distributed architecture with no external servers or single point of failure. Optimised key-delivery routes across the network are assigned automatically, with automatic re-routing to maintain key delivery if the underlying physical path becomes unavailable.
Standards-based interfaces connect quantum-safe keys with the applications and systems that need them. Support for ETSI GS QKD 014, ETSI GS QKD 020 enabling integration with encryptors, applications, other QKD systems and third-party key management environments.
Highlights
Features & Benefits
Adaptable to your cryptography needs
Combine QKD, PQC and Diffie-Hellman key exchange within a single key delivery architecture. Hybrid key delivery provides a defence-in-depth approach while giving organisations greater flexibility to respond as technologies, standards and security requirements evolve.
Keep keys moving when networks change
Optimised key-delivery routes across the network are assigned automatically, with automatic re-routing to maintain key delivery if the underlying physical path becomes unavailable. This helps maintain resilient key delivery without relying on a single network route.
Remove single points of failure
The KDS is integrated directly within QSN hardware and operates as a distributed system, removing the need for separate external key-delivery servers. This reduces infrastructure complexity and avoids introducing an additional potential single point of failure.
Integrate with existing systems
Standards-based interfaces enable quantum-safe keys to be delivered into established security environments. ETSI GS QKD 014 supports delivery to encryptors and applications, while ETSI GS QKD 020 supports interoperability with other key management systems.
Connect across QKD environments
Support for standardised key interfaces enables interworking with other QKD systems and Key Management Systems deployed across wider network environments, providing greater flexibility as quantum-safe networks expand.
Specifications
- Model
- Toshiba QSN Transceiver 1550 / Toshiba QSN Transceiver 1310
- Type
- Integrated QKD transmitter + receiver (single chassis)
- Primary applications
- Trusted-node relay, dual quantum channel, point-to-point, ring, mesh
- Quantum and optical channel
- Protocol: Toshiba T12 (efficient BB84 with decoy states and phase encoding)
- Quantum wavelengths: 1550 nm (C-band), 1310 nm (O-band)
- 1530.33 nm (channel 59) and 1529.55 nm (channel 60), SFP’s are changeable to any C-band channel aligned to the ITU-T grid between 1530 nm and 1565 nm
- Fibre: Dual fibre deployment on both variants, single fibre deployment with the 1310 nm variant when using the QSN Multipexer
- Multiplexing: compatible with QSN Multiplexer (DWDM up to 90 channels or 20 dBm combined launch power)
- Entropy source: QRNG
- Performance
- Secret key rate: 300 kbps at 10 dB (specified), 600 kbps typical
- Maximum loss budget: 30 dB
- Maximum distance: 150 km (1550 nm), 90 km (1310 nm)
- Security parameter: <1 × 10⁻¹⁰
- Monitoring and security
- Management: SNMP v2/v3, GUI, CLI, REST API
- Interfaces: 2 × LC optical (TX/RX), 2 × SFP QKD service channels), 2 × RJ45 for management and key delivery, 2 × SFP (for optional optical management and key delivery interface), VGA and 2 × USB for local access
- Tamper detection: hardware-based with alarming
- Key delivery / SDN: ETSI GS QKD 014, Cisco SKIP, ETSI GS QKD 015
- Key management
- Optional integrated KDS for network-wide key delivery
- Physical and environmental
- Form factor: 19-inch rack, 2U
- Dimensions: 482 × 606 × 87 mm
- Weight: 18.5 kg
- Power: 1+1 redundant hot-swappable PSU (100–240 VAC or -48 VDC)
- Connectors: LC/PC
- Compliance
- CE, FCC, FDA, ICES, VCCI, IEC 62368-1, IEC 60825-1/-2, IEC 63000, others TBA