BB84 Quantum Key Distribution in Software-Defined Networking Control Planes: End-to-End Integration, Security Analysis, and Performance Benchmarking

Abstract

Classical public-key cryptography used to secure Software-Defined Networking (SDN) control planes remains vulnerable to future cryptographically relevant quantum computers through Shor's algorithm, motivating the exploration of quantum-safe key establishment mechanisms. While Quantum Key Distribution (QKD) has been widely studied as a standalone technology, its direct integration into SDN control-plane protection remains insufficiently quantified from both architectural and operational perspectives. This paper presents a quantum-secure SDN control-plane framework in which BB84-based key generation, key lifecycle management, and quantum-authenticated flow-rule protection are integrated into the Ryu controller through a QBER-aware Key Management System (KMS) and OpenFlow 1.3 Experimenter extensions. Beyond implementation, the paper positions the design as a practical migration model for quantum-resilient SDN infrastructures and evaluates its security–performance trade-offs against a classical RSA + TLS baseline. The system is implemented using Ryu, Open vSwitch, and a software BB84 simulator in a Mininet testbed with up to 20 OpenFlow switches. All measurements are repeated over 30 independent trials with full statistical reporting, while QBER stability is assessed over 1000 runs. Results show that BB84 key generation latency averages 45.3 ms (σ = 3.2 ms), mean QBER remains at 4.8% with zero threshold violations, flow installation latency increases from 13.2 to 17.6 ms, controller CPU overhead is +3.8 percentage points, and throughput decreases from 8200 to 7580 pps under saturation. In addition, scalability follows a near-perfect linear trend (R² = 0.998), enabling projection to larger SDN deployments. These findings show that QKD-secured SDN control-plane protection is operationally feasible on commodity hardware with bounded and predictable overhead, while offering a practical blueprint for the gradual deployment of quantum-resilient networking infrastructure.