Network management framework allocates scarce quantum-safe security links
WLPA: A Network Management Framework for Allocating Scarce Quantum-Safe Link Postures under Weakest-Link Exposure
Cryptography and Security
Summary
Networks need strong quantum-safe security for their connections, but the best option, quantum key distribution (QKD), is expensive and limited. The authors show that simply upgrading the busiest or most important links separately misses the overall risk because the weakest link still determines security. They present a method called WLPA that finds the best way to assign limited quantum-safe upgrades to protect the overall system optimally. Their approach runs quickly on large networks and works better than existing heuristics, especially when upgrade costs vary or attackers target weak spots.
What this means in practice
- •For network operators: Optimize assigning limited quantum-safe upgrades to links to maximize overall network security under hardware and latency limits.
- •For iot infrastructure teams: Manage scarce cryptographic hardware to secure large distributed device networks against quantum threats while balancing cost and latency.
Authors
Bhanwar Gupta, Sanjeev Rana
Abstract
Network operators migrating distributed systems to post-quantum and quantum-safe cryptography face a resource-management problem: quantum key distribution (QKD) gives the strongest guarantee available but is hardware-scarce and costly, so only a fraction of a deployment's links can receive it. Default practice -- ranking links by traffic or centrality and upgrading the top scorers -- optimizes each link in isolation, while a distributed job's real security is set by whichever active link ends up weakest. We present WLPA (Weakest-Link Posture Assignment), an implementation-ready decision framework and algorithm for allocating scarce quantum-safe postures under hardware, latency, and compliance constraints. WLPA computes the optimal weakest-link posture in closed form and returns an assignment in O(|E| log |E|) time -- 125 ms for a 20,000-link network on a laptop -- with a breach-aware refinement matching an exact integer program under common conditions. Our central contribution is a dichotomy telling operators exactly when existing per-link heuristics already match this optimum and when they systematically fail: under constant upgrade cost and uniform traffic-driven risk the two coincide exactly; once costs vary or an adversary concentrates on weak targets, heuristics leave the weakest link unprotected, unboundedly. We validate WLPA across 19 experiments: four microservice topologies, a real enterprise network (SNAP email-Eu-core), a post-quantum latency benchmark, a Qiskit BB84 simulation and a real-hardware BB84 run on IBM's ibm_marrakesh processor, checks against real production traffic traces, a CVE-calibrated correlated-compromise study, Bayesian uncertainty quantification, and seven baseline methods. A concrete-security reduction grounds the framework as theoretical foundation, not primary contribution.