10916 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO.

12, 15 JUNE 2023

Resource Allocation in Quantum-Key-Distribution-

Secured Datacenter Networks With
Cloud–Edge Collaboration
Qingcheng Zhu , Graduate Student Member, IEEE, Xiaosong Yu , Member, IEEE,
Yongli Zhao , Senior Member, IEEE, Avishek Nag , Senior Member, IEEE, and Jie Zhang

Abstract—Datacenter networks (DCNs) with cloud–edge col- transportation, smart agriculture, and healthcare are emerging.
laboration are emerging to satisfy the communication, compu- Such services may not only demand communication resources
tation, and caching (3C) requirements of future services such (e.g., wavelengths) for data transmission, but also require com-
as cloud-based IoT services. However, the enroute data over
DCNs with cloud–edge collaboration is likely to suffer from putation and caching resources (e.g., CPU cycles and caching
cyberattacks such as eavesdropping. A large number of services storage) for data processing and storing [1]. Datacenters
require not only 3C resources, but also cryptographic resources (DCs), as the primary information technology (IT) infras-
for encryption to ensure high security. Quantum key distribu- tructures, provide hardware resources, including computation
tion (QKD) is a practical approach to provide secret keys for and caching resources. DC networks (DCNs) interconnecting
remote users with information-theoretic security against attacks
from quantum computing. A QKD-secured DCN (QKD-DCN) DCs have been deployed as substrate networks to carry the
with cloud–edge collaboration can be deployed to satisfy the services with communication, computation, and caching (3C)
communication, computation, caching, and cryptographic (4C) requirements and play an important role in ensuring Quality
requirements of services. This article innovatively solves the of Services (QoS).
new 4C resource-allocation (4CRA) problem in the network to The cloud computing and caching paradigm has powerful
minimize the cryptographic resource consumption. It formu-
lates an integer linear programming (ILP) model and proposes computing and caching ability for data processing and stor-
a heuristic cryptographic-dependent 4CRA algorithm to find ing [2]. DCs in cloud computing and caching (i.e., cloud DCs)
optimal solutions. The proposed algorithm is compared with are usually centralized and located at few sites, which could be
two baseline 4CRA algorithms which, respectively, consider the far away from users. However, with the increasing data gener-
minimized service delivery latency and the first-fit resource avail- ated at the edge, the high bandwidth, long service delivery
ability. Analytical simulations show that the proposed algorithm
minimizes the key-resource-consumption ratio and the aver- latency, and large energy consumption will become bottle-
age key-resource consumption under static and dynamic traffic necks for cloud computing and caching. Edge computing and
scenarios in different network topologies. caching, which allows computation and caching performed at
Index Terms—Caching, cloud–edge collaboration, communica- the edge of the network, has emerged [3]. It can effectively
tion, computation, cryptographic, datacenter networks (DCNs), overcome the above deficiencies. It is usually deployed in
quantum key distribution (QKD), resource allocation. the form of small DCs (i.e., edge DCs) within the access-
aggregation networks. Previous works include the concepts
I. I NTRODUCTION like micro DC [4], cloudlet [5], cloud–edge computing [6],
etc. But they have the main bottleneck of the limited compu-
LOUD-BASED IoT services, tactile Internet services,
C and new IoT-based applications, such as smart
tation and communication capacities compared with the cloud
computing and caching. Cloud–edge collaboration, which can
quickly carry services by combining the idle edge resources
Manuscript received 9 December 2022; accepted 24 January 2023. Date
of publication 7 February 2023; date of current version 7 June 2023. This with the cloud resources, can be introduced in DCNs for
work was supported in part by the NSFC Project under Grant 61971068, performance improvement [7].
Grant U22B2026, and Grant 62150032; in part by the Funds for Creative In DCNs with cloud–edge collaboration, network security
Research Groups of China under Grant 62021005; in part by the Fund
of National Key Research and Development Program of China under has become one of the major challenges and will affect crit-
Grant 2020YFE0200600; in part by the Fundamental Research Funds for the ical services, such as smart hospitals and smart cities, and
Central Universities under Grant 2019XD-A05; and in part by BUPT Excellent banking, military, and government operations. The enroute
Ph.D. Students Foundation under Grant CX2021139. (Corresponding authors:
Xiaosong Yu; Yongli Zhao.) data over the DCNs is likely to suffer from cyberattacks such
Qingcheng Zhu, Xiaosong Yu, Yongli Zhao, and Jie Zhang are with the as eavesdropping. Apart from the intelligent intrusion detec-
State Key Laboratory of Information Photonics and Optical Communications, tion system to detect cyberattacks [8], classical cryptography
Beijing University of Posts and Telecommunications, Beijing 100876, China
(e-mail: [email protected]; [email protected]; yonglizhao@ based on the high complexity of mathematical problems is
bupt.edu.cn; [email protected]). usually applied to secure the data. As quantum computing
Avishek Nag is with the School of Electrical and Electronic Engineering, and quantum code-breaking are advancing rapidly, the security
University College Dublin, Dublin 4, D04 V1W8 Ireland (e-mail:
[email protected]). of traditional key-distribution techniques can be compro-
Digital Object Identifier 10.1109/JIOT.2023.3242725 mised. Quantum networks based on quantum entanglement are
2327-4662 
c 2023 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10917

inherently secure [9], [10], but their technologies have not been 4CRA algorithms which, respectively, consider the min-
mature for large-scale deployment. As a practical approach for imized service delivery latency and the first-fit resource
quantum cryptography, the quantum key distribution (QKD) availability, the proposed algorithm achieves the good
technology distributes secret keys for two remote entities performances in terms of secret key consumption and
with information-theoretic security [11]. It follows principles service success ratio (SR).
of quantum mechanics, including Heisenberg’s uncertainty The remainder of this article is organized as follows.
principle and the noncloning theorem [12], [13], [14]. The Section II investigates the related works; Section III gives the
QKD network is comprised of two or more QKD nodes problem statement; Section IV describes the network model
connected through QKD links, which allows sharing keys and 4CRA in QKD-DCNs with cloud–edge collaboration. In
between the QKD nodes by key relay. Until now, multiple Section V, the ILP model is formulated. In Section VI, the
QKD networks have been implemented [15], [16], [17] CryptoD-4CRA algorithm is proposed. Section VII presents
based on continuous-variable and discrete-variable QKD pro- the simulation results and analysis of the performances of the
tocols. Secret keys generated based on the QKD protocols ILP model, the CryptoD-4CRA algorithm, and baseline 4CRA
are a kind of cryptographic resources. By combining QKD algorithms. Finally, Section VIII concludes this article.
with encryption algorithms, such as one-time-pad (OTP) or
advanced-encryption-standard (AES) encryption [18], secret II. R ELATED W ORKS
keys can be provided for services to meet high-security
The related works are investigated from two aspects in
requirements.
DCNs with cloud–edge collaboration, including resource allo-
To satisfy 3C requirements and the high-security require-
cation and cryptographic technology.
ment of services, a QKD-secured DCN (QKD-DCN) with
cloud–edge collaboration can be deployed, where the QKD
technology is used to generate secret keys and secure the data A. Resource Allocation in DCNs With Cloud–Edge
transmission in a DCN with cloud–edge collaboration. In such Collaboration
DCNs, QKD equipment, quantum signal channels (QSChs) for In this section, we introduce the previous works on resource
quantum signal transmission and public interaction channels allocation related to DCNs with cloud–edge collaboration. In
(PIChs) for classical information exchange are additionally optical networks for cloud–edge computing, a traffic grooming
built [13], so that cryptographic resources (i.e., secret keys algorithm which saves the wavelength consumption and energy
generated based on QKD) are provided. Meanwhile, tradi- consumption is proposed based on the deep reinforcement
tional 3C resource allocation (3CRA) problems in DCNs have learning technology [6]. In collaborative cloud–edge comput-
been extended to be communication, computation, caching, ing, a solution is proposed in [21] for the virtual machine
and cryptographic (4C) resource allocation (4CRA) problem in (VM) placement and workload assignment problem to mini-
QKD-DCNs with cloud–edge collaboration. A large amount of mize the consumption of IT infrastructures, which optimizes
data transmitted (Gbps) in the network needs to be encrypted the resource efficiency of edge DCs as a result. For the
with cryptographic resources. However, the relatively low services with computation and communication requirements,
secret-key generation rate (Mbps) [19] and the scheme for geo-distributed job scheduling and lightpath provisioning are
destroying the keys, once the keys are used [20], are criti- completed by reallocating routing, modulation level, and
cal limits for security assurance and network performances. frequency slots, which are able to save job completion time
The new 4CRA problem still needs more efficient solutions to significantly [4]. In DCNs with collaborative edge caching,
minimize secret-key consumption. edge caching helps to reduce the average transmission delay
In this work, we focus on designing the 4CRA strategy to of delay-sensitive services with high priority and balances
minimize cryptographic resource consumption in QKD-DCNs the network loads [22]. Subject to the limited computation
with cloud–edge collaboration. The main contributions of this and caching resources of each micro DC, the optimal content
work include the following aspects. caching problem is solved and the solution minimizes the aver-
1) To satisfy the 4C requirements of services, QKD-DCNs age content delivery latency by developing mix-cooperative
with cloud–edge collaboration are designed. Apart from caching [23]. To minimize the job completion time in DCNs
the traditional 3C resources, cryptographic resources with edge computing and caching, the 3CRA problem is solved
generated by QKD are newly introduced. Based on by dividing the geo-distributed data into multiple clusters for
the created 4C resource models, the 4CRA problem parallel processing [24]. For virtual optical network embed-
extended from the 3CRA problem is first specified. ding in DCNs, the continuity degree of the available spectrum
2) An integer linear programming (ILP) model is formu- is employed to weaken the influence of spectrum fragmenta-
lated and a heuristic cryptographic-dependent 4CRA tion and achieve better spectral efficiency [25]. In IoT-edge-
(CryptoD-4CRA) algorithm is proposed to minimize cloud computing environments, the task offloading problem
the cryptographic resource consumption. In the heuristic can be solved by using machine learning algorithms efficiently.
algorithm, the strategy with the minimized cryptographic A distributed deep learning-driven task offloading algorithm
resource consumption is selected among the candidate is proposed to jointly optimize the system utility and the
available strategies for each service. bandwidth allocation [26]; a novel deep meta-reinforcement
3) Comprehensive simulations under static and dynamic learning-based offloading framework is designed to jointly
scenarios are conducted. Compared with two baseline minimize the delay and energy consumption [27].

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10918 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

Most of these works involve the 3CRA in DCNs with multiplexed QKD-secured optical networks in [40]. End-to-
cloud–edge collaboration or edge collaboration to improve end QKD schemes are designed to provide secret keys for
resource utilization and QoS. During the resource alloca- users and improve secret-key resource utilization as reported
tion, these works do not consider the security requirements. in [41] and [42]. Focusing on the multicast services in QKD-
Inspired from these works, we solve the resource alloca- DCNs, a secure multicast scheme is proposed in [43]. To
tion problem with security considerations in DCNs with provide secret keys on demand for services efficiently, a
cloud–edge collaboration. novel Key-on-Demand (KoD) scheme and a Key-as-a-Service
(KaaS) framework are designed where quantum key pools
(QKPs) are constructed [44], [45]. They can positively balance
B. Cryptographic Technology in DCNs With Cloud–Edge security requirements and cryptographic resource usage. To
Collaboration secure virtual network function (VNF) distribution across DCs,
In this section, we introduce the cryptographic technology network functions virtualization orchestration and QKD tech-
which can be applied in DCNs with cloud–edge collabora- nology are combined and a time-shared approach is designed
tion. There are two types of cryptography, including public-key for cost-effective deployment in [46] and [47]. In the QKD-
cryptography (PKC) and symmetric-key cryptography (SKC). secured space–air–ground integrated networks (SAGINs), a
PKC is widely used to preserve the data security. For the universal QKD-service-provisioning framework is designed to
secure use of PKC, secure certificate revocation schemes are minimize the cost of QKD services under the uncertainty and
studied and can satisfy different security needs [28]. For bet- the dynamism of communications [48]. In the QKD-secured
ter key management for PKC, a distributed key management federated edge learning (FEL), the optimization of the QKD
scheme is proposed in heterogeneous public-key cryptosys- resource allocation scheme is formulated and a learning-based
tems and builds key management protocols into networks [29]. QKD allocation scheme is proposed to minimize the total
By combining the computational security principles with the deployment costs of QKD resources under uncertainty [49].
physical layer security primitives, a new hybrid network- On the one hand, the previous works applying PKC and
coding cryptosystem is designed and can obtain post-quantum SKC based on computational complexity are not able to
cryptography at high rates [30]. Taking advantages of the achieve the security against quantum attacks; on the other
PKC and blockchain technology that ensures the reliabil- hand, the previous works related to SKC with quantum cryp-
ity and irreversibility of data, the blockchain-based network tography focus on the cryptographic resource allocation itself.
architecture emerges. A new routing protocol with the cluster We design a resource allocation method considering both tra-
structure for the blockchain-based architecture outperforms the ditional 3C resources and cryptographic resources, so as to
state-of-the-art security countermeasures as proposed in [31]. optimize the resource utilization in DCNs with cloud–edge
A public-permissioned blockchain security mechanism using collaboration.
digital signature is proposed in [32]. The resource allocation
strategy is optimized based on deep reinforcement learn-
ing [33] and a cooperative computing strategy is designed to III. P ROBLEM S TATEMENT
reduce the time to acquire hash values of blocks [34]. The In QKD-DCNs with cloud–edge collaboration, there are not
blockchain-enabled IoT-edge-cloud computing is proposed to only 3C resources, but also cryptographic resources. For the
address the challenge of data loss or privacy disclosure that services requiring 4C resources, the 3CRA problem has been
may occur in the process of task offloading. An energy- extended to be a 4C resource-allocation (4CRA) problem. An
efficient dynamic task offloading algorithm is developed to example application of smart medical healthcare initiated by a
jointly minimize the energy consumption and task response node is shown as follows [50]. It will: 1) retrieve real-time data
time [35]. However, as quantum computing matures, the from the healthcare devices, which requires communication
security of PKC may be compromised. resources; 2) cache the retrieved data, which requires caching
In contrast to PKC, several forms of SKC are believed to resources; 3) perform data analysis and summarization, which
be resistant against quantum attacks [36], [37]. The security requires computation resources; 4) upload the result data to the
of SKC mainly relies on establishment of secure symmetric cloud, which requires communication resources; and 5) pro-
keys. The QKD technology belongs to quantum cryptog- tect and encrypt the sensitive data during transmission, which
raphy and has information-theoretic security based on the requires cryptographic resources. Secret keys generated based
laws of quantum physics. The QKD technology has been on QKD are a type of cryptographic resources. Importantly,
studied to supply secure secret keys for services. To enable the relationships between 3C resources and the newly added
QKD-secured optical connections, three types of channels are cryptographic resources need to be specified. Secret keys are
required, including traditional data channel (TDCh), QSCh, used during the communication process and play the role
and PICh [13] over wavelengths. The routing, wavelength, and of encrypting the enroute data over the network. The key-
time slot assignment algorithm based on optical time-division relay technology based on trusted relays is applied during
multiplexing (OTDM) is designed for the channels [38]. the cryptographic resource allocation. The data encryption or
Three novels efficient load balancing routing, wavelength, and decryption is operated using secret keys in the caching nodes,
time-slot assignment approaches are designed to reduce the computing nodes, and the users which initiate services. The
overall network congestion in [39]. The spectrum, core, and enroute data over the communication paths is the encrypted
link resource allocation problem is solved in space division data and the valuable information cannot be eavesdropped.

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10919

As for solving the 4CRA problem, traditional 3CRA strate-

gies are not applicable. Simply adding the cryptographic
resource allocation based on the communication paths in tra-
ditional 3CRA strategies is no more efficient in terms of
secret key consumption. The secret key consumption is mainly
influenced by the cryptographic requirement and the paths
for providing secret keys. The traditional 3CRA strategies
cannot be aware of the cryptographic resource status when
finding paths, and are likely to cause secret key supply failure
or more secret key consumption. Hence, new 4CRA strate-
gies are needed in QKD-DCNs with cloud–edge collaboration.
For a service, we need to select caching nodes with caching
resources, computing nodes with computation resources, com- Fig. 1. QKD-DCN with cloud–edge collaboration.
munication paths with communication resources, and QKD
paths with cryptographic resources. As because QKD key- encrypted by the edge nodes near the users to provide prox-
generation rate is low and keys will be destroyed after usage, imity services. Thanks to the caching resources in the edge
minimizing the cryptographic resource consumption while sat- nodes, if the required contents have been cached, a few com-
isfying the requirements of services is important for network munication and cryptographic resources over the short paths
performance improvement. In this article, we focus on 4CRA for retrieving the contents securely will be needed. Thanks to
to minimize the cryptographic resource consumption. The the computation resources in the edge nodes, the computation
problem to be solved can be defined as follows: given a tasks can be offloaded to the edge node near the users, so
network topology with 4C resources and incoming services that communication resources for transmitting contents to the
with 4C requirements, one needs to find optimal caching computing node and cryptographic resources for encrypting
nodes, computing nodes, communication paths, and QKD contents will be saved. Hence, with cloud–edge collaboration,
paths, and allocate the corresponding resources to satisfy the the advantages of high security, low service delivery latency,
requirements of services while minimizing the cryptographic and low resource consumption can be achieved.
resource consumption. The QKD-DCN with cloud–edge collaboration is modeled
as a graph G(V, E), where V = {v1 , v2 , . . . , v|V| } represents a
set of network nodes and E = {e1 , e2 , . . . , e|E| } represents
IV. N ETWORK M ODEL a set of network links. The nodes are interconnected with
optical-fibre-based links. We use ve to denote edge nodes and
This section elaborates the network model, the 4C resources
vc to denote the cloud node; we use ee to denote the links
and 4C resource allocation in QKD-DCNs with cloud–edge
between two edge nodes and ec to denote the links between
collaboration.
an edge node and the cloud node. The nodes connected with
DCs are denoted by R ⊆ V. At time t, a node v ∈ V has avail-
A. Network Model able computation resources denoted as Rvcpu (t) and caching
A QKD-DCN with cloud–edge collaboration is shown in resources denoted as Rvcach (t); each link e ∈ E has available
Fig. 1. The network includes a cloud layer and an edge layer communication resources denoted as Recmu (t); the QKP over a
for providing 4C resources collaboratively. The cloud nodes link e between a pair of nodes is assumed to have available
at the cloud layer have cloud DCs with powerful computa- cryptographic resource denoted as Recryp (t). A set of contents
tion and caching resources. To achieve better QoS, some of C = {c1 , c2 , . . . , c|C| } is initialized in the network. The set of
the edge nodes at the edge layer are connected with edge nodes storing the content c is denoted by Nc .
DCs which can provide some limited computation and caching The services in QKD-DCNs with cloud–edge collabora-
resources near the users. An optical node and a QKD node are tion have 4C resource requirements. Each service s ∈ S is
cpu cryp
abstracted as one network node; an optical link and a QKD denoted by Ds = (us , Din s , Ds , Ds , Ds
out cmu
, Ds ), where
link are abstracted as one network link. Optical nodes and S is the set of services; us is the users that initialize the
links are the functional entities in an optical network, which service and its corresponding node set is V out ; Din s is the
cpu
is the substrate network to provide communication resources required inputting contents; Ds is the computation require-
and carry IP data. A QKD node contains QKD modules and ment; Dout
s is the outputting contents (after computation) that
key storage, and a QKD link contains QSChs and PIChs, so as are required to be transmitted to cloud layer or edge layer;
to enable key generation and provide cryptographic resources Dcmu
s is the required communication resources (e.g., wave-
using QKD. Secret keys between each pair of key storage lengths) to carry the inputting and outputting contents; and
cryp
in a node, can be virtualized into QKPs [44]. The cloud Ds is the required cryptographic resources (e.g., secret keys)
and edge nodes are all enabled with the communication and to encrypt the inputting and outputting contents.
cryptographic functions. In the QKD-DCN with cloud–edge
collaboration, the edge nodes can supplement the 4CRA abili- B. 4C Resources
ties of the cloud nodes which may be away from the users. The The 4C resources in QKD-DCNs with cloud–edge collabo-
required contents can be transmitted, processed, cached, and ration are collaboratively provided to transmit, compute, cache,

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10920 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

and encrypt the contents required by services. The descriptions is a library denoted as Lr (t) = {l1 , l2 , . . . , l|L| } working
for 4C resources are presented as follows. in a first-in first-out way [55].
1) Communication Resources: Dense wavelength division 4) Cryptographic Resources: Secret keys are generated
multiplexing (DWDM) is applied to provide commu- using QKD and stored in the QKP. A QKP over a link
nication resources for data transmission [51]. It allows e has the limited capacity of Q bits which can store
the simultaneous transmission of signals over a sin- e
Ncryp = Q/uk keys where uk (bit) is the length of a key
gle fiber by using different wavelengths with small unit. XOR are operated over the trusted nodes to realize
spacing grids (e.g., 50 GHz) and increases the total com- key relay. The Recryp (t) over a link e at time t is calcu-
munication bandwidth significantly. The core network lated by (3). Here, δ e is the key-generation rate (uk /s)
is based on IP offloading, transponders with fixed bit and ξ e is the key-consumption rate (uk /s) over a link e.
t e
rates [52]. Wavelengths are considered as communica- δ dt is the total generated keys from time t0 to t and
tt0 e
t0 ξ dt is the total consumed keys from time t0 to t over
tion resources. We assume that each fibre link e has
wavelengths W = {λ1 , λ2 , . . . , λi , . . . , λ|W| }, where |W| e (t) is the available keys of a QKP if there
a link e. Kcryp
is the total number of wavelengths per fibre link e. is no capacity limitation Ncryp e . If K e (t) is larger than
cryp
A wavelength λi is unavailable if it was allocated for e
Ncryp , a part of the old keys is destroyed for safety con-
services or it met a channel quality drop. The avail- sideration and new keys are stored. The keys are highly
able status of λi is denoted by i (t) in (1). Hence, recommended not to be used twice or more [20]. Once
Recmu (t) = {i (t)|λi ∈ W}. The line rate of a wave- the keys are consumed by the services, the used keys
length is β (Gbps). The data transmission latency over should be destroyed from the QKPs
ee and ec is assumed to be τE and τC , respectively. In  e
a generic manner, τC = γ τE where the values of the Kcryp (t), Kcryp
e (t) ≤ N e
Recryp (t) = cryp
ratio γ and τE are dependent to the specific edge and Ncryp , Kcryp e (t) > N e
cryp
 t  t
cloud infrastructure providers [53] e
Kcryp (t) = Recryp (t0 ) + δ e dt − ξ e dt. (3)
 t0 t0
0, if λi is available at time t
i (t) = . (1)
1, if λi is unavailable at time t
C. 4C Resource Allocation
2) Computation Resources: A node r ∈ R connected with
Given a network topology G(V, E) and arriving services
DCs has the computational capability of C in terms
S, the 4C resource allocation needs to find the 4CRA paths,
of the number of CPU cycles per second. We assume
where the target 4CRA paths include: 1) the available com-
that C computational capability can be divided into
puting node vcpu to compute for contents where computation
Ncpu = C/up computation resource blocks where a cpu
resources Ds are allocated; 2) the available caching node
computation resource block has the computational capa-
supporting content Din s caching and the destination node to
bility of up . The available status of a computation
cache Dout using caching resources; 3) the available communi-
resource block θi is denoted by i (t) in (2). Hence, s
cation paths Pcmu for transmitting data where communication
Rvcpu (t) = {1 (t), 2 (t), . . . , i (t), . . . , Ncpu (t)}. Ncpu
E
C resources Dcmu s over Pcmu are allocated; and 4) the available
and Ncpu are the number of computation resource blocks
QKD paths Pcryp for encrypting data where the cryptographic
on ve ∈ R and vc ∈ R, respectively. It is assumed that cryp
resources Ds over Pcryp are allocated.
the output content size will scale down by a factor of ρ
An example of the 4CRA paths for 4CRA is illustrated
after computation [54]. Different numbers of the com-
in Fig. 2. The service initiated in Node B requires to fetch
putation resource blocks will be allocated for services
or download the contents c1 and c2 , compute and cache for
with computation execution time σ according to their
the input contents, and get the computed results. Node C
computational requirements [55]
is selected as computing and caching node. Content c1 is
 stored in cloud layer and content c2 is cached in Node A. For
0, if θi is not usd for computation at time t
i (t) = . (2) inputting content c1 , the communication path Pcmu
c1
and QKD
1, if θi is usd for computation at time t c1
path Pcryp are both from cloud layer to Node C; for inputting
c2 c2
3) Caching Resources: A node r ∈ R has the caching stor- content c2 , the communication path Pcmu and QKD path Pcryp
age with F-bit capacity that can totally store Ncach r = are both A->D->C. After the contents c1 and c2 are transmitted
F/F caching blocks whose capacity is F bits. It is to to the computing node, Node C, the decryption is conducted
cache the contents which might be fetched or down- using keys and the input data is processed as the computed
loaded by services in the future. We assume that a set result using computation resources. For outputting the result
c3
of contents C = {c1 , c2 , . . . , c|C| } can be stored in r ∈ R. content c3 after computation, the communication path Pcmu
c3
The nodes with a content ci cached at time t are denoted and QKD path Pcryp are both from Node C to Node B. Two
c c c c c1 c2 c3
by V ci (t) = {v1i , v2i , . . . , vj i , . . . , v|Vi ci | }. The available wavelengths over Pcmu , Pcmu , and a wavelength over Pcmu are
caching resource is denoted by Rcach (t) and its value is
v allocated (filled rectangles over black arrows); two keys over
c1 c2 c3
the capacity not occupied by contents. The set of cached Pcryp , Pcryp , and a key over Pcryp are allocated (keys over
contents on a node r ∈ R connected with DCs at time t brown arrows).

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10921

  
Minimize Dcryp s
s,c x(i,j),c
s∈S (i,j)∈E c∈Din
  
s

+ s,c y(i,j),c .
Dcryp s
(4)
s∈S (i,j)∈E c∈Dout
s

The objective of the ILP model is to minimize the total

number of keys that are consumed by all services in QKD-
DCNs with cloud–edge collaboration. The first and second
terms of (4) are the consumed number of keys to input con-
tents into computing nodes and output the result contents from
computing nodes for all services, respectively.
Constraints: The optimization objective is subject to the
constraints as follows.
1) Flow-Conservation Constraint: The optimization objec-
tive is subject to the constraints as follows.
⎧
  ⎨ 1, i = sc
s
x(i,j),c − s
x(j,i),c = −1, i = dc
⎩
j∈V j∈V 0, else
∀ s ∈ S, c ∈ Din (5)
Fig. 2. Example of 4CRA paths in QKD-DCN with cloud–edge collaboration.
⎧ s
  ⎨ 1, i = sc
ys(i,j),c − ys(j,i),c = −1, i = dc
⎩
V. I NTEGER L INEAR P ROGRAMMING M ODEL j∈V j∈V 0, else
Based on the above network model and 4C resource descrip- ∀ s ∈ S, c ∈ Dout (6)
⎧ s
tion, we formulate an ILP model to conduct the optimization
  ⎨ 1, i = sc
for minimizing the cryptographic resource consumption in s
f(i,j),w,c − s
f(j,i),w,c = −1, i = dc
QKD-DCN with cloud–edge collaboration, so as to solve the ⎩
j∈V j∈V 0, else
4CRA problem under the static scenario. The given param-
∀s ∈ S, c ∈ Din
s , w∈ W (7)
eters, output variables, objective and constraints for the ILP ⎧
model are detailed in the following.   ⎨ 1, i = sc
Given: The given parameters, output variables, objective and gs(i,j),w,c − gs(j,i),w,c = −1, i = dc
⎩
constraints for the ILP model are detailed in the following. j∈V j∈V 0, else
1) G(V, E): QKD-DCN topology, where V denotes the set ∀s ∈ S, c ∈ Dout
s , w∈ W. (8)
of nodes and E denotes the set of links, (i, j) ∈ E.
2) R: Set of nodes with DCs connected, r ∈ R. Equations (5) and (6) specify the QKD paths to input and
3) S: Set of services, s ∈ S. Each service s is denoted by output a content for each service; (7) and (8) specify the
cpu cryp
Ds = (us , Din s , Ds , Ds , Ds
out cmu
, Ds ). communication paths to input and output a content for each
4) C: Set of contents, c ∈ C. service. The key or communication flow must be one in source
5) W: Set of wavelengths per link, w ∈ W. node sc and destination node dc of transmitting content c, and
Variables: The given parameters, output variables, objective be zero in intermediate nodes.
and constraints for the ILP model are detailed in the following. 2) Path-Across-Computing-Node Constraint: The
s
1) x(i,j),c : Boolean variable that equals 1 if keys on link optimization objective is subject to the constraints as
(i, j) are allocated to input content c into the computing follows.
node for service s, and 0 otherwise.  
2) ys(i,j),c : Boolean variable that equals 1 if keys on link
s
x(i,r),c = ys(r,i),ca = zsr
(i, j) are allocated to output the result content c from i∈V i∈V
the computing node for service s, and 0 otherwise. ∀ s ∈ S, c ∈ Din
s ,r ∈ R (9)
s
3) f(i,j),w,c : Boolean variable that equals 1 if wavelength    
w on link (i, j) is allocated to input content c into the
s
f(i,r),w,c ≥1 = gs(r,i),w,ca ≥ 1 = zsr
computing node for service s, and 0 otherwise. i∈V w∈W i∈V w∈W
4) gs(i,j),w,c : Boolean variable that equals 1 if wavelength w ∀ s ∈ S, c ∈ Din
s , r ∈ R. (10)
on link (i, j) is allocated to output the result content c
from the computing node for service s, and 0 otherwise. Equations (9) and (10) ensure that the QKD and communi-
5) zsr : Boolean variable that equals 1 if node r is allocated cation paths for each service go through the computing node
to operate computation for service s, and 0 otherwise. selected by the service. The destination node of the inputting
Objective: The given parameters, output variables, objective path for content c is the same as the source node of the
and constraints for the ILP model are detailed in the following. outputting path for the result content ca after computing.

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10922 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

3) Computing-Requirement Constraint: The optimization Algorithm 1 CryptoD-4CRA Algorithm

objective is subject to the constraints as follows. Input:
 Topology G(V, E), DCs R, contents C, services S.
zsr = 1 ∀s∈S (11) Output:

r∈R Target paths and the 4CRA result for each service.
Dcpu s
≤ Nrcpu ∀ r ∈ R. 1: while There is an unserved service s ∈ S at time t do
s zr (12)
vd
s∈S 2: if Rcach (t), vd ∈ V out is not enough for the content
needing caching in Dout s then
Equations (11) and (12) ensure that one computing node 3: Mark service s FAILED; continue;
is selected for each service and the computing requirement is 4: end if
satisfied. The computation resources allocated for services of 5: Adopt CCNS Algorithm to get candidate V cpu ;
a node should be no more than the total computation resources 6: for Each vcpu ∈ V cpu do
cpu
Nr of the node r.
7: for Each vs ∈ V in do
4) Cryptographic-Requirement Constraint: The
8: Get Pccmus and Pccryp
s by adopting CQPC Algorithm
optimization objective is subject to the constraints as
for (vs , vcpu ) and the content cs ∈ Din
s ;
follows.
   9: end for
s,c x(i,j),c +
Dcryp s
Dcryp s cryp
s,c y(i,j),c ≤ N(i,j)
10: for Each vd ∈ V out do
cd cd
s∈S c∈Din s∈S c∈Dout 11: Get Pcmu and Pcryp by adopting CQPC Algorithm
s s
for (vcpu , vd ) and the content cd ∈ Dout
s ;
∀ (i, j) ∈ E. (13)
12: end for  cd 
vcpu
Equation (13) together with (5) and (6) ensures that the 13: Qcryp ← cs ∈Din Qcs Pccryp s + cd ∈Dout
s
Qcd Pcryp ;
s
cryp
cryptographic requirement for each service s is satisfied. Ds,c 14: end for
vcpu
is the required keys to encrypt content c for service s. The 15: Target paths ← the paths with minvcpu Qcryp ;
allocated keys over a link (i, j) are no more than the total 16: if Target paths are NULL then
cryp
keys N(i,j) in the QKP over link (i, j). 17: Mark service s FAILED;
5) Communication-Requirement Constraint: The 18: else
optimization objective is subject to the constraints as 19: Allocate 4C resources based on Target paths;
follows. 20: Mark service s SUCCESSFUL;
 21: end if
s
f(i,j),w,c = Dcmu
s,c ∀ s ∈ S, (i, j) ∈ E, c ∈ Din
s (14) 22: end while
w∈W

gs(i,j),w,c = Dcmu
s,c ∀ s ∈ S, (i, j) ∈ E, c ∈ Dout
s . (15)
w∈W Equation (18) specifies that any wavelength can only be
Equations (14) and (15) together with (7) and (8) ensure allocated once for all services.
the communication requirement of each service. The required 8) Content-Caching-Node-Consistency Constraint: The
number Dcmus,c of communication resources (i.e., wavelengths) optimization objective is subject to the constraints as follows.
is allocated to transmit content c for service s.
6) Wavelength-Continuity Constraint: The optimization   
objective is subject to the constraints as follows.
s
x(sc ,j),c
= f(ss c ,j),w,c ≥ 1 ∀ s ∈ S, c ∈ Din
s (19)
  j∈V j∈V w∈W
s
f(i,j),w,c − s
f(j,i),w,c =0   
j∈V j∈V ys(i,dc ),c = gs(i,dc ),w,c ≥ 1 ∀ s ∈ S, c ∈ Dout
s . (20)
i∈V i∈V w∈W
∀ s ∈ S, c ∈ Din s , i ∈ V, i  = sc , i  = dc , w ∈ W (16)
 
g(i,j),w,c −
s
gs(j,i),w,c = 0 Equations (19) and (20) specify that the caching source (des-
j∈V j∈V tination) node of the communication path and the QKD path
∀ s ∈ S, c ∈ Dout for a content required by each service should be the same.
s , i ∈ V, i  = sc , i  = dc , w ∈ W. (17)
The complexity of the ILP formulation is mainly affected
Equations (16) and (17) ensure that each service should by the dominant numbers of variables and constraints. In the
use the same wavelength on each intermediate link over the proposed ILP model, the dominant number of variables is
inputting communication path and the outputting communica- O(|S||E||R||W|), and the dominant number of constraints is
tion path, respectively. O(|S||C|(|E| + |R| + |V||W|) + |W||E|). The ILP model can
7) Wavelength-Uniqueness Constraint: The optimization achieve optimal solutions by addressing the QKD and com-
objective is subject to the constraints as follows. munication path calculation and computing and caching node
   selection together. But when the problem size (e.g., number of
s
f(i,j),w,c + gs(i,j),w,c ≤ 1 services) is large, it may take a long time to perform a single
s∈S c∈Din
s
s∈S c∈Dout
s run. A heuristic algorithm for the 4CRA problem is therefore
∀w ∈ W, (i, j) ∈ E. (18) needed to get an efficient solution with a short computation time.

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10923

VI. C RYPTOGRAPHIC -D EPENDENT 4C R ESOURCE Algorithm 2 CCNS Algorithm

A LLOCATION A LGORITHM Input:
In this section, the 4CRA problem, to minimize cryp- Topology G(V, E), DCs R, contents C, an arrived service s.
tographic resource consumption, is solved by designing a Output:
heuristic algorithm in QKD-DCNs with cloud–edge collabora- The set of candidate computing nodes V cpu .
1: V cpu ,V cs ,V p ← ∅;
tion, so as to find a near-optimal solution with low complexity
2: for Each node r ∈ R do
and scalability for large-scale networks. More specifically, we
propose a CryptoD-4CRA algorithm (Algorithm 1). For the 3: if content library Lr contains the content cs ∈ Din
s
service with 4C requirements, the CryptoD-4CRA algorithm then
first considers the computation and caching resources, and 4: Add node r into source nodes V in ;
select candidate computing nodes by adopting the candidate 5: end if
6: end for
computing node selection (CCNS) algorithm (Algorithm 2).
7: for Each source node vs ∈ V in do
Then in the routing path calculating phase, the communication
and QKD path calculation (CQPC) algorithm (Algorithm 3) 8: for Each destination node vd ∈ V out do
is adopted, which can calculate the inputting paths (input 9: Calculate K-shortest-paths P from vs to vd ;
contents from source nodes to computing node) and out- 10: Add the nodes vp ∈ R over P into V p ;
putting paths (output results from computing node to des- 11: end for
12: end for
tination nodes) where the communication and cryptographic
13: for Each node vcpu ∈ V p do
requirements are met. Finally, the paths with the minimized vcpu cpu
cryptographic resource consumption are selected as the target 14: if Rcpu (t) ≥ Ds then
4CRA paths. The relationship between Algorithms 1 and 3 is 15: Add candidate computing node vcpu into V cpu ;
that Algorithms 2 and 3 are the subalgorithms for Algorithm 1. 16: end if
17: end for
18: Return V cpu
A. Candidate Computing Node Selection
Computing nodes have computation resources enabled by Algorithm 3 CQPC Algorithm
cloud DCs and edge DCs. The location of the selected com- Input:
puting nodes for satisfying the 4C requirements of services Topology G(V, E), node pair (vs , vd ), a required content c.
is important. The required contents need to be inputted into Output:
computing nodes for data decryption using cryptographic Communication path Pcmu and cryptographic path Pcryp .
resources; the computation resources in the computing node 1: Pcmu ,Pcryp ← ∅;
will be allocated; and the outputted computation results need 2: Calculate K-shortest-paths Psd from vs to vd ;
to be encrypted and transmitted to the destination nodes. In 3: for Each path p in Psd then
the 4CRA solution, the CCNS algorithm is proposed and spec- 4: if Recmu (t), ∀e ∈ p is enough for transmitting c then
ified in Algorithm 2. The CCNS algorithm considers both the 5: Calculate service delivery latency T c (p);
available computation resources of computing nodes (whether 6: Add p to Ptcmu ;
they are enough for the service), and the computing node loca- 7: end if
tion (whether the computing node is near the nodes caching 8: if Recryp (t), ∀e ∈ p is enough for en/decrypting c then
the required contents and final destination nodes). The set of 9: Calculate secret key consumption Qc (p);
the candidate computing nodes V cpu is further referred as the 10: Add p to Ptcryp ;
base to get the target paths for 4CRA in the CryptoD-4CRA 11: end if
algorithm. It will reduce the complexity for finding the optimal 12: end for
4CRA solution in QKD-DCN with cloud–edge collaboration. 13: Pcmu ← p ∈ Ptcmu with the minimized T c (p);
In Algorithm 2, there is a service s which requires to retrieve 14: Pcryp ← p ∈ Ptcryp with the minimized Qc (p);
contents Din s and transmit the outputted computation results to 15: Return Pcmu , Pcryp
us . First, the source nodes V in that cache Din
s in edge layer and
store Din s in cloud layer are obtained by finding the content
libraries Lr in DCs. Then, K-shortest-paths P are calculated
from each source node vs ∈ V in to each destination node B. Communication and QKD Path Calculation
vd ∈ V out . A path p ∈ P consists of several links Ep and For the essential routing path calculation phase, to sat-
nodes V p . The nodes vp ∈ R over each p ∈ P are added into isfy the communication and cryptographic requirements of
the node set V p without repetition. Finally, at current time t, services, communication and QKD paths need to be calcu-
based on the node set V p , the available computation resources lated. For content c to be transmitted and encrypted between
vcpu vcpu
Rcpu (t) of each node vcpu ∈ V p is checked. If Rcpu (t) is larger the node pair (vs , vd ), the communication path Pcmu from vs
cpu
than the required computation resources Ds of the service, to vd is to provide wavelengths as communication resources
the computing node vcpu is added into the candidate computing and the wavelengths along the path Pcmu will be allocated
node set V cpu . After checking all the nodes in V p , the final for transmitting the contents; the QKD path Pcryp from vs to
candidate computing nodes V cpu are achieved. vd is to provide secret keys as cryptographic resources and

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10924 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

the secret keys in QKPs along the path Pcryp will be allo-
cated for encrypting/decrypting data. In the 4CRA solution, a
CQPC algorithm is proposed and specified in Algorithm 3. The
CQPC algorithm not only considers the communication and
cryptographic resource status, but also considers the service
delivery latency along Pcmu and the secret key consumption
along Pcryp . Algorithm 3 is further applied in the CryptoD-
4CRA algorithm to prepare the basic Pcmu and Pcryp between
node pairs.
In Algorithm 3, to transmit and encrypt a required content
Fig. 3. Example of CryptoD-4CRA algorithm.
c from vs to vd on the network topology G(V, E), K-shortest-
paths Psd are first precalculated from vs to vd . Then, all paths
c
in Psd are traversed to check whether the Pcmu and Pcryp are cs ∈ Din s . For outputting content cd ∈ Ds
out
to V out , Pcmud
and
cd
with enough available resources. For each path p ∈ Psd at time Pcryp are calculated from each computing node vcpu ∈ V cpu
t, if the communication resources Recmu (t) on each link e ∈ p to each destination node vd ∈ V out . When vcpu is set as
is enough, that is, the number of free wavelengths satisfying the computing node, based on the calculated QKD path set
vcpu
the wavelength consistency along p are not smaller than the {p|p = Pccryp ∀c ∈ Din s ∪ Ds }, the number Qcryp of the
out

communication requirement Dcmu c of the content c, service consumed secret keys is calculated (line 13). After traversing
vcpu
delivery latency T c (p) along p is calculated, and the path p V cpu , the paths with the minimized Qcryp are selected as Target
is added to the temporary path set Ptcmu ; if the cryptographic paths. If Target paths are not found, the service is assumed to
resource Recryp (t) on each link e ∈ p at time t is enough, that is, be FAILED; otherwise, 4C resources are allocated according
the remained secret keys in QKPs along p are all not smaller to Target paths and the service is finally served successfully.
cryp
than cryptographic requirement Dc of the content c, secret The complexity analysis of the CryptoD-4CRA algorithm
key consumption Qc (p) along p is calculated and the path p is as follows. The time complexity to find K-shortest-paths
is added to temporary path set Ptcryp . After traversing Psd , is O(K|V|(|E| + |V|log|V|)). Under the worst scenario, the
p ∈ Ptcmu with the minimized T c (p) is selected as the target traversed times for V cpu are |R| which is the number of the
Pcmu ; p ∈ Ptcryp with the minimized Qc (p) is selected as the nodes with DCs. For each vcpu ∈ V cpu , V in , and V out are
target Pcryp . Finally, the communication path Pcmu and the traversed. The maximal number of |V in | is |R| and the maximal
QKD path Pcryp are achieved. number of |V out | is |V|. The times of running K-shortest-path
algorithm is (|V| + |R|)|R|. Hence, the time complexity of
the CryptoD-4CRA algorithm is O(K|V||R|(|V| + |R|)(|E| +
C. Cryptographic-Dependent 4C Resource Allocation |V|log|V|)).
In QKD-DCNs with cloud–edge collaboration, to solve An example of the CryptoD-4CRA algorithm
the 4CRA problem and minimize the cryptographic resource is shown in Fig. 3. The example service se ,
cpu cryp
consumption, the CryptoD-4CRA algorithm is proposed and Dse = (use , Din se , Dse , Dse , Dse , Dse ), requires to
out cmu

specified in Algorithm 1. The algorithm considers the required retrieve a content c1 cached in edge node v1 , compute and
contents both cached in different edge DCs and stored in cache c1 in computing node, and transmit the computed result
cloud DCs. It prepares different potential 4CRA strategies c2 to edge node v3 . Here, V in = {v1 }, V out = {v3 }, Din se = c1 ,
cryp cryp
by applying different computing nodes in V cpu , and calculat- Dout
se = c2 , Dse ,c1 = 2, and D se ,c2 = 1. There are four
ing the corresponding communication and QKD paths Pcmu nodes with computation resources, including v1 , vcloud , v2 ,
and Pcryp . The selection of target 4CRA paths depends on the and v3 , where v1 , v2 , and v3 are the edge nodes and vcloud
cryptographic resource consumption over the potential 4CRA is the cloud node. Assuming that the available computation
cpu
strategies and the paths with the minimized cryptographic resources in v1 is smaller than Dse , the candidate computing
resource consumption are the target paths. nodes V cpu
= {v2 , v3 , vcloud } are obtained by adopting the
In Algorithm 1, when there is an unserved service s at time CCNS algorithm. By adopting the CQPC algorithm, the
t, the 4C resource status are updated based on the current QKD paths corresponding to vcloud , v2 , and v3 are listed
vd
network situations. The available caching resources Rcach (t) in Fig. 3, including Path2 P2 , Path3 P3 , and Path4 P4 ,
in the node where caching is required, are first checked. If the respectively. The communication paths are assumed to be the
caching requirement is not satisfied, the service s is marked same with QKD paths. The path before the computing node
FAILED. Otherwise, the candidate computing nodes V cpu are is the inputting path and the path after the computing node
selected by adopting the CCNS algorithm. Different comput- is the outputting path. As for the secret key consumption,
vcloud v3
ing nodes influence different 4CRA paths and strategies. For we can get the calculation results Qcryp = 5, Qcryp = 4,
v2 v2
each computing node vcpu ∈ V cpu , the inputting paths and and Qcryp = 3. Because Qcryp is the minimized among the
outputting paths are calculated, respectively, by adopting the candidate paths, Path3 P3 is selected as the Target path and
CQPC algorithm. For inputting contents Din s to vcpu , source v2 is selected as the final computing node. The 4C resources
node set V in corresponding to contents Dins is obtained; then, are allocated for the service, including the computation and
Pccmu
s and Pccryp
s are calculated from each source node vs ∈ V in caching resources in v2 , the communication and cryptographic
to each computing node vcpu ∈ V cpu for inputting content resources over P3 .

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10925

TABLE I
PARAMETERS AND T HEIR VALUES IN THE S IMULATIONS

the services are generated one by one and the secret keys are
generated periodically.
In the simulation, two different content-caching conditions
are considered. Under the content-caching condition I (II),
each content is cached in the cloud and one (two) edge node(s)
that is (are) connected with DCs. The contents are retrieved
following uniform distribution. The number of the cached con-
tents is assumed to be 50 in a small-scale topology and 150
Fig. 4. Two small-scale network topologies. (a) 3-edge-node network in a large-scale topology. The size of the contents in DCNs
topology. (b) 6-edge-node network topology.
is assumed to be uniformly distributed between 1 and 10
Gb. The transmission time is dependent on specific infras-
tructure providers. In the simulation, τE is assumed to be
10 ms [56] and γ is 20 [53]. The computing time σ is assumed
as 100 ms [4] when allocating several up . Per Gb data to
be computed is assumed to require uk computation resources.
The output size ratio ρ is assumed to be 0.2 [54]. AES-256
(uk = 256 bit) is used as the encryption algorithm and 5uk
keys are required to encrypt per Mb data for high security
consideration. The key generation rate when applying a pair of
QKD equipment over a link ee is assumed as 10.24 Mb/s [19]
(δ ee = 4 × 104 uk /s). Considering the larger data volume
over the links between the cloud and edge, four pairs of QKD
equipment are equipped per link ec (δ ec = 1.6 × 105 uk /s).
ee ec
As for QKP, Ncryp is set as 2 × 106 uk and Ncryp is set as
8 × 10 uk . The initial numbers of keys in QKPs over ee and
6

ec in different scenarios are Recrype

(0) and Recryp
c
(0) and the ini-
Fig. 5. Large-scale 38-edge-node network topology. tial numbers of the cryptographic resources on ve and vc are
Rvcpu
e
(0) and Rvcpu
c
(0), whose values are shown in Table I. The
K in K-shortest-path algorithm is set as 2. Table I gives the
VII. P ERFORMANCE E VALUATION main parameters and their values used in the simulations.
In this section, we present performance evaluations by solv- The performances of the simulated algorithms are evaluated
ing the ILP model in Section V and simulating the proposed in terms of the following metrics.
heuristic algorithms in Section VI. The ILP formulations are 1) Key-Resource-Consumption Ratio (KCR): KCR is the
programmed based on the IBM CPLEX 12.6 software, and ratio of the number of the consumed secret keys by suc-
the heuristic algorithms are implemented based on Java. The cessfully served services over the total generated secret
simulation is run on a PC with Intel Core i7-10510U CPU keys. It is a metric to reflect how many of the generated
@1.80 GHz 2.30 GHz and 16-GB memory. Metro network secret keys are consumed.
topologies are employed, including two small-scale topolo- 2) Average Key-Resource Consumption (AKC): AKC is
gies and a large-scale topology as shown in Figs. 4 and 5, the ratio of the number of the total consumed secret
respectively. The simulation is conducted under two scenarios, keys over the successful services. It is also a secret-
including the static scenario and the dynamic scenario. Under key-related metric which is to reflect the secret key
the static scenario, services are generated in advance and the consumption of a successful service.
secret key generation is not considered; under the dynamic sce- 3) SR: SR is the ratio of the number of successful services
nario, services arrive dynamically at a Poisson arrival where over the total arrived services. It directly reflects the

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10926 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

TABLE II
R ESULTS OF THE ILP M ODEL AND THE C RYPTO D-4CRA A LGORITHM

performance of an algorithm about serving as many

services as possible. It also embodies the average
network cost for carrying per successful service. The
higher SR will embody the lower average network cost
per service.
4) Average Latency (AL): AL is the ratio of the number
of the total service delivery latency over the successful
services. In the simulation, AL considers the transmis-
sion time and computing time. It reflects the needed time
to deliver a service.
5) Wavelength Utilization (WU): WU is the ratio of the
number of the summed occupied wavelengths over the
total wavelengths on a link. It reflects the wavelength
occupation status of the network and how many of the
wavelengths are occupied. Fig. 6. KCR versus the number of services in 6-edge-node topology.
To evaluate the performances of the proposed CryptoD-4CRA
algorithm, considering realistic needs of services and infras-
tructure providers, we design two baseline 4CRA algorithms.
1) Latency-Dependent 4CRA (LatenD-4CRA) Algorithm: It
pays attention on achieving low service delivery latency,
which will be important for latency-sensitive services.
It modifies lines 13–15 in Algorithm 1 (in Section VI)
vcpu
where the service delivery latency Qlaten for each com-
cpu
puting node vcpu in V is calculated and the target
vcpu
paths select the paths with the minimized Qlaten .
2) First-Fit-Dependent 4CRA (FirstD-4CRA) Algorithm: It
focuses on the first-fit resource availability, which will
be important for providers to provide 4CRA solutions
quickly. It first employs the CCNS algorithm to get can-
didate computing nodes V cpu and employs the CQPC
algorithm to find communication and QKD paths for
Fig. 7. AKC per service versus the number of services in 6-edge-node
the node in V cpu one by one. Once the 4CRA paths topology.
with enough 4C resources can satisfy the service require-
ments, the service is allocated with the resources based 60 total services. The ILP model can find the optimal solu-
on the corresponding target strategy. tion and the CryptoD-4CRA algorithm finds a near-optimal
solution. The difference between the consumed keys using
A. Performance Analysis Under Static Scenario the ILP model and the CryptoD-4CRA algorithm accumulates
In this section, we analyze the results of the simulations when the services become more. This is because the CryptoD-
under the static scenario. Table II presents the simulation 4CRA algorithm finds a solution using the greedy concept,
results of the ILP model and the proposed heuristic CryptoD- which calculates the target 4CRA paths with the minimized
4CRA algorithm using the 3-edge-node topology in Fig. 4(a) key resource consumption for each service one by one, not the
while carrying all services successfully. We can find that optimal solution from a global perspective. However, the ILP
when the services are smaller than 50, the heuristic algo- model requires hundreds of seconds to solve large problems,
rithm can find the optimized 4CRA solution for services. which are much more than the running time in the millisecond
With the services increase, the optimality of the heuristic level needed by the heuristic CryptoD-4CRA algorithm.
algorithm becomes worse. The ILP model shows the better Simulation results shown in Figs. 6–10 use the 6-edge-
performance than the CryptoD-4CRA algorithm in terms of node topology in Fig. 4(b) and 100 groups of static services
the total key resource consumption when there are more than are simulated per point. The metrics of KCR and AKC are

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10927

Fig. 8. SR versus the number of services in 6-edge-node topology. Fig. 9. AL versus the number of services in 6-edge-node topology.

assessed in Figs. 6 and 7 for the CryptoD-4CRA algorithm and

the baseline algorithms versus the number of static services
under content-caching conditions I and II. It is shown that
the CryptoD-4CRA algorithm has the lowest KCR and AKC
compared with the baseline algorithms. In Fig. 6, when the
number of services is 360 under content-caching condition II,
the KCR (AKC) reduction of the CryptoD-4CRA-II algorithm
compared with the LatenD-4CRA-II and FirstD-4CRA-II algo-
rithms is 54.6% (63.8%) and 66.8% (66.6%), respectively.
This is because the CryptoD-4CRA algorithm always selects
the paths and the computing nodes with the minimized secret
key consumption among the potential strategies. The baseline
algorithms on the other hand, only partially consider the cryp-
tographic resource requirements as a constraint and not an
Fig. 10. WU versus the number of services in 6-edge-node topology.
important selecting reference. Comparing the cryptographic-
resource-related performances under different content-caching
conditions, the overall KCR and AKC under content-caching SR will be affected by the consumption status of 4C resources,
condition II are lower than that under condition I. It is because not only the cryptographic resource consumption. Through
by caching contents at more different locations, the fewer cloud–edge collaboration, the proposed algorithm has the bet-
secret keys will be consumed to satisfy the cryptographic ter tradeoff of the 4C resource consumption between the edge
requirement of services. layer and the cloud layer. During the initial period, a little SR
Fig. 8 shows the performance comparison in terms of SR will be sacrificed to realize such a tradeoff.
considering content-caching conditions I and II versus the Fig. 9 shows the comparisons of the simulated results on AL
number of static services. We can observe that the CryptoD- for different algorithms. It is apparent that the LatenD-4CRA
4CRA algorithm has the highest SR under content-caching algorithm has the lowest AL under content-caching conditions
conditions I and correspondingly its average network cost per I and II because it selects the target paths depending on the ser-
service is the lowest. The CryptoD-4CRA-I algorithm achieves vice delivery latency. The LatenD-4CRA-II algorithm achieves
the SR over 13.5% better than the LatenD-4CRA-I algorithm 24.3% and 53.3% lower AL than the CryptoD-4CRA-II and
and up to 25.5% better than FirstD-4CRA-I. The reason is FirstD-4CRA-II algorithms, respectively, when the number of
that the CryptoD-4CRA algorithm saves more secret keys services is 260. The AL of the proposed CryptoD-4CRA algo-
compared to the baseline algorithms and more services are rithm is not the lowest nor the highest compared with the
likely to be served successfully satisfying the cryptographic baseline algorithms. The reason is that the CryptoD-4CRA
resource constraint. Under content-caching condition II, the algorithm may select the link between the edge layer and the
SR (i.e., more than 96.2%) of the CryptoD-4CRA algorithm cloud layer with high latency and few consumed keys, instead
is better than that (i.e., more than 94.8%) under condition of the links at the edge layer with low latency, which may
I. This is because under condition II where each content is lead to the higher AL. Similarly, the FirstD-4CRA algorithm
cached in two different edge nodes, the cached contents have considers the cloud node as the computing node in a priority
a higher probability to be close to the users and the services which will increase the service delivery latency.
are more successfully served. It can also be observed that The performances of the algorithms on WU versus the num-
under content-caching condition II, the SR performance of the ber of services are shown in Fig. 10. Under content-caching
CryptoD-4CRA algorithm is not always the best, because the condition I, the WU of the CryptoD-4CRA-I algorithm is

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10928 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

Fig. 11. KCR versus service arrival rate in 6-edge-node topology. Fig. 13. AKC versus service arrival rate in 6-edge-node topology.

Fig. 12. KCR versus service arrival rate in 38-edge-node topology. Fig. 14. AKC versus service arrival rate in 38-edge-node topology.

KCR versus service arrival rate which is the average num-

higher than the LatenD-4CRA-I algorithm and near the FirstD- ber of the arrived services per time unit. Under the dynamic
4CRA-I algorithm. When 260 services exist, the WU of the scenario, the CryptoD-4CRA algorithm can achieve the low-
CryptoD-4CRA-I algorithm and the FirstD-4CRA-I algorithm est KCR compared with the baseline algorithms. As shown in
is 23.1% and 33.7% higher than the LatenD-4CRA-I algo- Fig. 11, when the service arrival rate is 70, the KCR of the
rithm, respectively. On the other hand, under content-caching CryptoD-4CRA-I algorithm is 40.4% and 36.2% lower than
condition II, the WU of the CryptoD-4CRA-II algorithm is the LatenD-4CRA-I algorithm and the FirstD-4CRA-I algo-
near the LatenD-4CRA-II algorithm and much lower than the rithm. When the service arrival rate is 250 as shown in Fig. 12,
FirstD-4CRA-II algorithm. The reason is that the 4CRA algo- the KCR of the CryptoD-4CRA-I algorithm is 30.0% and
rithms are dependent on different references to select target 8.7% lower than the LatenD-4CRA-I algorithm and the FirstD-
4CRA paths and the wavelength consumption is mainly deter- 4CRA-I algorithm. We can observe that the KCR performance
mined by the selected communication paths for services. The improvement of the CryptoD-4CRA algorithm in the small-
more unavailable resources will be between the cloud and edge scale topology is larger than that in the large-scale topology.
layers under content-caching condition I and the 4CRA paths It is caused by the more potential 4CRA paths with enough 4C
applying CryptoD-4CRA may occupy more wavelengths than resources and low secret key consumption existing in the large-
that applying LatenD-4CRA in most cases. On the contrary, scale topology. It is also obvious that the KCR performance
the more unavailable resources will be at the edge layer improvement of the CryptoD-4CRA algorithm under content-
under content-caching condition II and the 4CRA paths apply- caching condition II is better than that under condition I. The
ing CryptoD-4CRA may occupy fewer wavelengths than that KCR of the CryptoD-4CRA algorithm under content-caching
applying LatenD-4CRA in several cases. condition II is much lower than that under content-caching
condition I, while the KCR of the baseline algorithms has
a small difference under the two conditions. This is because
B. Performance Analysis Under Dynamic Scenario the content-caching condition II, which enables the contents
In this section, the simulations are under the dynamic sce- to be cached in more DCs, provides more optimization space
nario and use the topologies as shown in Figs. 4(b) and 5 in for the CryptoD-4CRA algorithm to find the paths with low
terms of the evaluation metrics. Figs. 11 and 12 present the key-resource consumption.

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10929

Fig. 15. SR versus service arrival rate in 6-edge-node topology. Fig. 17. AL versus service arrival rate in 6-edge-node topology.

Fig. 16. SR versus service arrival rate in 38-edge-node topology. Fig. 18. AL versus service arrival rate in 38-edge-node topology.

Figs. 13 and 14 show the AKC per service for dynamic dynamic services. Under content-caching condition I at arrival
services in 6-edge-node topology and 38-edge-node topology. rate 70 (250) in small-scale topology (large-scale topol-
We can find that the AKC of the CryptoD-4CRA algorithm is ogy), the CryptoD-4CRA-I algorithm achieves 1.8% (6.1%)
the lowest among the simulated 4CRA algorithms. As shown in higher SR than the LatenD-4CRA-I algorithm and also has
Fig. 13 (Fig. 14), when the service arrival rate is 70 (250), the higher SR than the FirstD-4CRA-I algorithm. Differently, the
KCR of the CryptoD-4CRA-I algorithm is 41.1% and 36.5% CryptoD-4CRA-II algorithm has 0.3% lower SR than the
(32.8% and 9.5%) lower than the LatenD-4CRA-I algorithm LatenD-4CRA-II algorithm in Fig. 15. This is because with
and the FirstD-4CRA-I algorithm, which is similar to the KCR the arrival rate increasing, the bottleneck of the resource avail-
performance improvement. The reason is that the CryptoD- ability over the nodes with DCs influences SR performance of
4CRA algorithm always chooses the computing node and the the CryptoD-4CRA algorithm, especially in the small-scale
corresponding paths to save the secret keys while serving a topology. Under content-caching condition II, it is observed
service. We can also find that the decreasing trend of AKC that the CryptoD-4CRA-II algorithm has 2.6% higher SR than
for the LatenD-4CRA algorithm versus the service arrival rate the LatenD-4CRA-II algorithm and similar SR compared with
is different from the increasing trend of KCR, which is more the FirstD-4CRA-II algorithm in Fig. 16. This is because in
obvious in Figs. 12 and 14. The reason for the decreasing trend the large-scale topology, when the service arrival rate becomes
of AKC for the LatenD-4CRA algorithm is that the LatenD- larger, the LatenD-4CRA-II algorithm will consume the major-
4CRA algorithm has a priority of selecting the paths with low ity of resources at the edge layer and cause lower SR, while
latency, while in cloud–edge collaboration cases, the paths with the other algorithms may consume more resources at the
low latency may have high secret key consumption. When the cloud layer. According to the relationship that the higher SR
arrival rate increases, resource-providing ability is relatively embodies the lower average network cost per service, the
fixed. Hence, the services requiring relatively high secret key CryptoD-4CRA algorithm is more cost-efficient than the other
consumption are more blocked in the LatenD-4CRA algorithm two algorithms under content-caching condition I and at least
and its AKC will decrease. one other algorithm under condition II.
The performance in terms of SR is illustrated in Figs. 17 and 18 are the simulation results in terms of AL
Figs. 15 and 16 under two content-caching conditions for versus arrival rate. In these cases, the LatenD-4CRA algorithm

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10930 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

from the arrival rate 200 (250), the WU of the CryptoD-4CRA-

I (CryptoD-4CRA-II) algorithm begins to exceed that of the
LatenD-4CRA-I (LatenD-4CRA-II) algorithm. At the arrival
rate 250, the WU of the LatenD-4CRA-I (LatenD-4CRA-II)
algorithm is 1.8% (0.6%) lower than that of the CryptoD-
4CRA-I (CryptoD-4CRA-II) algorithm. This is because the
CryptoD-4CRA algorithm pays more attention to the secret
key consumption instead of the communication resource con-
sumption. When the arrival rate increases, while selecting a
computing node, there is a higher probability of selecting the
communication and QKD paths with low secret key consump-
tion but high wavelength occupation. It can also be observed
under the dynamic scenario, there are blocked services, while
the WU is relatively low. The reason is that the SR is more
Fig. 19. WU versus service arrival rate in 6-edge-node topology. influenced by the secret key generation than the available
wavelengths, as the wavelengths are relatively sufficient for
the arrived services.

VIII. C ONCLUSION
In this article, we mainly solved the resource alloca-
tion problem to minimize cryptographic resource consump-
tion in QKD-DCNs with cloud–edge collaboration where
multidimensional 4C resources exist. An ILP model is for-
mulated which finds the optimal solution for services in terms
of key resource consumption. The heuristic cryptoD-4CRA
algorithm is also innovatively proposed which is scalable
to large-scale networks while considering the 4C resource
constraints. In the proposed algorithm, to obtain the candi-
date computing nodes, the CCNS algorithm is designed by
jointly considering the locations of the computing nodes and
Fig. 20. WU versus service arrival rate in 38-edge-node topology. the cached contents, as well as the cryptographic resource
consumption; to obtain the potential 4C resource allocation
has the minimized AL. Compared with the CryptoD-4CRA-I (4CRA) paths, the CQPC algorithm is proposed to calculate
algorithm and the FirstD-4CRA-I algorithm, the LatenD- the communication paths and QKD paths with awareness of
4CRA algorithm reduces the AL by 40.8% and 64.1% in the service delivery latency and the cryptographic resource
the small-scale 6-edge-node topology at arrival rate 70 and consumption; the 4CRA paths with the minimized crypto-
28.7% and 52.6% in the large-scale topology at arrival rate graphic resource consumption among the potential paths are
250. The CryptoD-4CRA algorithm saves the secret keys at the selected as the target solution. In the simulations, the results of
cost of longer AL, so as the FirstD-4CRA algorithm. This is the ILP model are presented in terms of the consumed num-
because serving the services over the edge-to-cloud links needs ber of keys. The great performances of the CryptoD-4CRA
fewer secret keys but longer latency compared to that over algorithm are analyzed comprehensively and compared with
the edge-to-edge links. And, the difference between content- the baseline algorithms, including the LatenD-4CRA algorithm
caching conditions I and II more impacts the performance and the FirstD-4CRA algorithm under static and dynamic sce-
of the CryptoD-4CRA and LatenD-4CRA algorithms because narios. The simulation results show that our algorithm reduces
they use the similar CCNS and CQPC algorithms where the the key resource consumption ratio and average key resource
candidate computing nodes and potential paths are influenced consumption significantly. The performances of the simulated
by the cached locations of the required contents. 4CRA algorithms in terms of SR, AL, and WU are also
Figs. 19 and 20 depict the WU of the 4CRA algorithms in evaluated.
different topologies. As shown in Fig. 19, at the arrival rate 70, The QKD technology will play a significant role in DCNs
the WU of the LatenD-4CRA-I algorithm occupies the mini- due to its information-theoretic security. The resource alloca-
mized wavelengths which is 14.9% and 42.7% lower than the tion for various applications in QKD-DCNs will become an
CryptoD-4CRA-I and FirstD-4CRA-I algorithm, respectively. investigation direction in the future. The 4CRA considering the
The reason is that the WU is mainly affected by the computing network virtualization technology will be critical for the future
node selection and the communication path calculation. The DCN evolution. For the development of machine-learning-
communication paths selected by the CQPC algorithm with related technologies, the enhanced optimization of 4CRA is
the minimized service delivery latency are more likely to con- also possible. Moreover, the protection and recovery methods
sume few wavelengths. As shown in Fig. 20, we can find that in QKD-DCNs are an important topic, which will keep the

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
ZHU et al.: RESOURCE ALLOCATION IN QUANTUM-KEY-DISTRIBUTION-SECURED DATACENTER NETWORKS 10931

stable QoS and network performances in case of the optical [24] Z. Liu, J. Zhang, Z. Guo, and Y. Ji, “Multi-stage aggregation and light-
channel quality drop. path provisioning of geo-distributed data over EON assisted by MEC,”
in Proc. Opt. Fiber Commun. Conf. (OFC), San Diego, CA, USA, 2020,
pp. 1–3.
[25] W. Wei, H. Gu, K. Wang, X. Yu, and X. Liu, “Improving cloud-based
R EFERENCES iot services through virtual network embedding in elastic optical inter-
DC networks,” IEEE Internet Things J., vol. 6, no. 1, pp. 986–996,
[1] W. Fang, M. Lu, X. Liu, L. Gong, and Z. Zhu, “Joint defragmenta- Feb. 2019.
tion of optical spectrum and IT resources in elastic optical datacenter
[26] H. Wu, Z. Zhang, C. Guan, K. Wolter, and M. Xu, “Collaborate edge and
interconnections,” J. Opt. Commun. Netw., vol. 7, no. 4, pp. 314–324,
cloud computing with distributed deep learning for smart city Internet
Apr. 2015.
of Things,” IEEE Internet Things J., vol. 7, no. 9, pp. 8099–8110,
[2] Cisco Global Cloud Index: Forecast and Methodology 2016–2021, Sep. 2020.
Cisco, San Jose, CA, USA, White Paper, Jul. 2018.
[27] G. Qu, H. Wu, R. Li, and P. Jiao, “DMRO: A deep meta reinforcement
[3] W. Shi, J. Cao, Q. Zhang, Y. Li and L. Xu, “Edge computing: Vision
learning-based task offloading framework for edge-cloud computing,”
and Challenges,” IEEE Internet Things J., vol. 3, no. 5, pp. 637–646,
IEEE Trans. Netw. Service Manag., vol. 18, no. 3, pp. 3448–3459,
Oct. 2016.
Sep. 2021.
[4] Z. Liu, J. Zhang, Y. Li, L. Bai, and Y. Ji, “Joint jobs scheduling and
[28] M. M. E. A. Mahmoud, J. Mišić, K. Akkaya, and X. Shen, “Investigating
lightpath provisioning in fog computing micro datacenter networks,” J.
public-key certificate revocation in smart grid,” IEEE Internet Things J.,
Opt. Commun. Netw., vol. 10, no. 7, pp. 152–163, Jul. 2018.
vol. 2, no. 6, pp. 490–503, May 2015.
[5] S. Chen, L. Jiao, F. Liu, and L. Wang, “EdgeDR: An online mecha-
[29] X. Lv, Y. Mu, and H. Li, “Key distribution for heterogeneous public-key
nism design for demand response in edge clouds,” IEEE Trans. Parallel
cryptosystems,” J. Commun. Netw., vol. 15, no. 5, pp. 464–468, 2013.
Distrib. Syst., vol. 33, no. 2, pp. 343–358, Feb. 2022.
[6] R. Zhu, S. Li, P. Wang, M. Xu, and S. Yu, “Energy-efficient deep [30] A. Cohen, R. G. L. D’Oliveira, S. Salamatian, and M. Médard, “Network
reinforced traffic grooming in elastic optical networks for cloud-fog coding-based post-quantum cryptography,” IEEE J. Sel. Areas Inf.
computing,” IEEE Internet Things J., vol. 8, no. 15, pp. 12410–12421, Theory, vol. 2, no. 1, pp. 49–64, Mar. 2021.
Aug. 2021. [31] S. A. Latif et al., “AI-empowered, blockchain and SDN integrated secu-
[7] J. Ren, G. Yu, Y. He, and G. Y. Li, “Collaborative cloud and edge rity architecture for IoT network of cyber physical systems,” Comput.
computing for latency minimization,” IEEE Trans. Veh. Technol., vol. 68, Commun., vol. 181, pp. 274–283, Jan. 2022.
no. 5, pp. 5031–5044, May 2019. [32] D. Ngabo, D. Wang, C. Iwendi, J. H. Anajemba, L. A. Ajao, and
[8] C. Iwendi, S. Rehman, A. Javed, S. Khan, and G. Srivastava, C. Biamba, “Blockchain-based security mechanism for the medical data
“Sustainable security for the Internet of Things using artificial intel- at fog computing architecture of Internet of Things,” Electronics, vol. 10,
ligence architectures,” ACM Trans. Internet Technol., vol. 21, no. 3, no. 17, p. 2110, Aug. 2021.
pp. 1–22, Aug. 2021. [33] J. Feng, F. R. Yu, Q. Pei, X. Chu, J. Du, and L. Zhu, “Cooperative
[9] M. Chehimi and W. Saad, “Entanglement rate optimization in hetero- computation offloading and resource allocation for blockchain-enabled
geneous quantum communication networks,” in Proc. 17th Int. Symp. mobile-edge computing: A deep reinforcement learning approach,” IEEE
Wireless Commun. Syst. (ISWCS), Sep. 2021, pp. 1–6. Internet Things J., vol. 7, no. 7, pp. 6214–6228, Jul. 2020.
[10] S. Zhang, S. Shi, C. Qian, and K. L. Yeung, “Fragmentation-aware entan- [34] D. Wu and N. Ansari, “A cooperative computing strategy for blockchain-
glement routing for quantum networks,” J. Lightw. Technol., vol. 39, secured fog computing,” IEEE Internet Things J., vol. 7, no. 7,
no. 14, pp. 4584–4591, Jul. 14, 2021. pp. 6603–6609, Jul. 2020.
[11] P. Kumavor, L. Cherian, E. Donkor, B. C. Wang, and S. F. Yelin, [35] H. Wu, K. Wolter, P. Jiao, Y. Deng, Y. Zhao, and M. Xu, “EEDTO:
“Comparison of four multi-user quantum key distribution schemes over An energy-efficient dynamic task offloading algorithm for blockchain-
passive optical networks,” in Proc. Opt. Fiber Commun. Conf. (OFC), enabled IoT-edge-cloud orchestrated computing,” IEEE Internet Things
Feb. 2004, p. 205. J., vol. 8, no. 4, pp. 2163–2176, Feb. 2021.
[12] W. Maeda, A. Tanaka, S. Takahashi, A. Tajima, and A. Tomita, [36] C. E. Shannon, “Communication theory of secrecy systems,” Bell Syst.
“Technologies for quantum key distribution networks integrated with Tech. J., vol. 28, no. 4, pp. 656–715, Oct. 1949.
optical communication networks,” IEEE J. Sel. Topics Quant. Electron., [37] L. K. Grover, “Quantum mechanics helps in searching for a needle in
vol. 15, no. 6, pp. 1591–1601, Nov./Dec. 2009. a haystack,” Phys. Rev. Lett., vol. 79, no. 2, pp. 325–328, Jul. 1997.
[13] H. K. Lo, M. Curty, and K. Tamaki, “Secure quantum key distribution,” [38] Y. Zhao et al., “Resource allocation in optical networks secured by quan-
Nat. Photon., vol. 8, pp. 595–604, Jul. 2014. tum key distribution,” IEEE Commun. Mag., vol. 56, no. 8, pp. 130–137,
[14] H. K. Lo and H. F. Chau, “Unconditional security ofquantum key dis- Aug. 2018.
tribution over arbitrarily long distances,” Science, vol. 283, no. 5410, [39] W. Ma et al., “Equilibrium allocation approaches of quantum key
pp. 2050–2056, 1999. resources with security levels in QKD-enabled optical data center
[15] M Peev et al., “The SECOQC quantum key distribution network in networks,” IEEE Internet Things J., vol. 9, no. 24, pp. 25660–25672,
Vienna,” New J. Phys., vol. 11, no. 7, 2009, Art. no. 075001. Dec. 2022.
[16] M Sasaki et al., “Field test of quantum key distribution in the Tokyo [40] E. E. Moghaddam, H. Beyranvand, and J. A. Salehi, “Resource alloca-
QKD Network,” Opt. Exp., vol. 19, no. 11, pp. 10387–10409, 2011. tion in space division multiplexed elastic optical networks secured with
[17] Q Zhang et al., “Large scale quantum key distribution: Challenges and quantum key distribution,” IEEE J. Sel. Areas Commun., vol. 39, no. 9,
solutions,” Opt. Exp., vol. 26, no. 18, pp. 24260–24273, 2018. pp. 2688–2700, Sep. 2021.
[18] R. Alléaume et al., “Using quantum key distribution for crypto- [41] H. Wang, Y. Zhao, A. Nag, X. Yu, X. He, and J. Zhang, “End-to-
graphic purposes: A survey,” Theor. Comput. Sci., vol. 560, pp. 62–81, end quantum key distribution (QKD) from metro to access networks,”
Dec. 2014. in Proc. 16th Int. Conf. Design Rel. Commun. Netw. (DRCN), 2020,
[19] Z. Yuan et al., “10-Mb/s quantum key distribution,” J. Lightw. Technol., pp. 1–5.
vol. 36, no. 16, pp. 3427–3433, Aug. 15, 2018. [42] A. Aguado, V. Lopez, J. Martinez-Mateo, M. Peev, D. Lopez, and
[20] “Quantum key distribution networks—Key management,” ITU, Geneva, V. Martin, “Virtual network function deployment and service automation
Switzerland, ITU Recommandation Y.3803, 2020. to provide end-to-end quantum encryption,” IEEE/OSA J. Opt. Commun.
[21] W. Wang et al., “Infrastructure-efficient virtual-machine placement and Netw., vol. 10, no. 4, pp. 421–430, Apr. 2018.
workload assignment in cooperative edge-cloud computing over back- [43] K. Dong, Y. Zhao, A. Nag, X. Yu, and J. Zhang, “Distributed
haul networks,” IEEE Trans. Cloud Comput., early access, Aug. 27, subkey-relay-tree-based secure multicast scheme in quantum data center
2021, doi: 10.1109/TCC.2021.3107596. networks,” Opt. Eng., vol. 59, no. 6, 2020, Art. no. 065102.
[22] W. Ke, Y. Wang, M. Ye, and J. Chen, “A priority-based multicast flow [44] Y. Cao, Y. Zhao, C. Colman-Meixner, X. Yu, and J. Zhang, “Key
scheduling method for a collaborative edge storage datacenter network,” on demand (KoD) for software-defined optical networks secured
IEEE Access, vol. 9, pp. 79793–79805, 2021. by quantum key distribution (QKD),” Opt. Exp., vol. 25, no. 22,
[23] N. Wang, W. Shao, S. K. Bose, and G. Shen, “MixCo: Optimal coop- pp. 26453–26467, 2017.
erative caching for mobile edge computing in fiber-wireless access [45] Y. Cao, Y. Zhao, J. Wang, X. Yu, Z. Ma, and J. Zhang, “KaaS: Key
networks,” in Proc. Opt. Fiber Commun. Conf. Exposit. (OFC), 2018, as a service over quantum key distribution integrated optical networks,”
pp. 1–3. IEEE Commun. Mag., vol. 57, no. 5, pp. 152–159, May 2019.

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.
10932 IEEE INTERNET OF THINGS JOURNAL, VOL. 10, NO. 12, 15 JUNE 2023

[46] A. Aguado et al., “Secure NFV orchestration over an SDN-controlled Xiaosong Yu (Member, IEEE) received the Ph.D. degree from Beijing
optical network with time-shared quantum key distribution resources,” University of Posts and Telecommunications (BUPT), Beijing, China, in 2015.
J. Lightw. Technol., vol. 35, no. 8, pp. 1357–1362, Apr. 15, 2017. From September 2013 to September 2014, he was a Visiting Scholar
[47] A. Aguado et al., “The engineering of software-defined quantum key with UC Davis, Davis, CA, USA. He is currently with the State Key
distribution networks,” IEEE Commun. Mag., vol. 57, no. 7, pp. 20–26, Laboratory of Information Photonics and Optical Communications, BUPT.
Jul. 2019. His research focuses on quantum key distribution optical networks, optical
[48] M. Xu et al., “Quantum-secured space-air-ground integrated networks: network optimization, and software-defined optical networks.
Concept, framework, and case study,” IEEE Wireless Commun., early
access, Oct. 10, 2022, doi: 10.1109/MWC.008.2200163.
[49] M. Xu et al., “Privacy-preserving intelligent resource allocation for fed-
erated edge learning in quantum Internet,” Oct. 2022, arXiv:2210.04308. Yongli Zhao (Senior Member, IEEE) received the B.S. degree in communica-
[50] M. Tang, L. Gao and J. Huang, “Communication, computation, and tion engineering and the Ph.D. degree in electromagnetic field and microwave
caching resource sharing for the Internet of Things,” IEEE Commun. technology from Beijing University of Posts and Telecommunications
Mag., vol. 58, no. 4, pp. 75–80, Apr. 2020. (BUPT), Beijing, China, in 2005 and 2010, respectively.
[51] “Spectral grids for WDM applications: DWDM frequency grid,” ITU, During January 2016 to January 2017, he was a Visiting Associate
Geneva, Switzerland, ITU Recommendation G.694.1, 2012. Professor with UC Davis, Davis, CA, USA. He is currently a Professor with
[52] M. Tahon et al., “Valuing flexibility in the migration to flexible- the Institute of Information Photonics and Optical Communications, BUPT,
grid networks [invited],” J. Opt. Commun. Netw., vol. 5, no. 10, pp. where he has been a Full Professor since 2018. He has published more than
A184–A191, Oct. 2013. 300 international journal and conference papers. His research focuses on
[53] X. Xia, F. Chen, Q. He, J. C. Grundy, M. Abdelrazek, and H. Jin, “Cost- F5G, software-defined optical networks, elastic optical networks, and optical
effective app data distribution in edge computing,” IEEE Trans. Parallel network security.
Distrib. Syst., vol. 32, no. 1, pp. 31–44, Jan. 2021.
[54] S. Luo, X. Chen, and Z. Zhou, “F3C: Fog-enabled joint computation,
communication and caching resource sharing for energy-efficient IoT
data stream processing,” in Proc. IEEE 39th Int. Conf. Distrib. Comput. Avishek Nag (Senior Member, IEEE) received the B.E. degree (Hons.) from
Syst. (ICDCS), 2019, pp. 1019–1028. Jadavpur University, Kolkata, India, in 2005, the M.Tech. degree from Indian
[55] Y. Wei, F. R. Yu, M. Song, and Z. Han, “Joint optimization of caching, Institute of Technology Kharagpur, Kharagpur, India, in 2007, and the Ph.D.
computing, and radio resources for fog-enabled IoT using natural actor– degree from the University of California at Davis, Davis, CA, USA, in 2012.
critic deep reinforcement learning,” IEEE Internet Things J., vol. 6, He is currently an Assistant Professor with the School of Electrical
no. 2, pp. 2061–2073, Apr. 2019. and Electronic Engineering, University College Dublin, Dublin, Ireland. He
[56] B. Charyyev, E. Arslan, and M. H. Gunes, “Latency comparison of worked as a Research Associate with the CONNECT Centre for Future
cloud datacenters and edge servers,” in Proc. IEEE Global Commun. Networks and Communication, Trinity College Dublin, Dublin, before joining
Conf. (GLOBECOM), 2020, pp. 1–6. University College Dublin. His research interests include, but are not limited
to cross-layer optimization in wired and wireless networks, network reliability,
mathematics of networks (optimization, graph theory), network virtualization,
software-defined networks, machine learning, data analytics, blockchain, and
the Internet of Things.
Dr. Nag is the Outreach Lead for Ireland for the IEEE U.K. and Ireland
Blockchain Group.

Jie Zhang received the bachelor’s degree in communication engineering and

the Ph.D. degree in electromagnetic field and microwave technology from
Beijing University of Posts and Telecommunications (BUPT), Beijing, China,
in 1993 and 1998, respectively.
He is currently a Professor and the Dean of Information Photonics and
Qingcheng Zhu (Graduate Student Member, IEEE) received the B.E. degree Optical Communications Institute, BUPT. He has published more than 300
in communication engineering from Soochow University, Suzhou, China, technical papers, authored eight books, and submitted 17 ITU-T recommenda-
in 2019. She is currently pursuing the Ph.D. degree with the Institute of tion contributions, and ten IETF drafts. Also, he holds more than 40 patents.
Information Photonics and Optical Communications, Beijing University of His research focuses on architecture, protocols, and standards of optical
Posts and Telecommunications, Beijing, China. transport networks.
Her current research interests include optical networks and quantum key Prof. Zhang has served as a TPC Member for a number of conferences,
distribution networks. such as ACP, OECC, PS, ONDM, COIN, and ChinaCom.

Authorized licensed use limited to: University of Leeds. Downloaded on December 04,2024 at 21:33:17 UTC from IEEE Xplore. Restrictions apply.