WLPA: A Network Management Framework for Allocating Scarce Quantum-Safe Link Postures under Weakest-Link Exposure

Abstract:Network operators migrating distributed systems to post-quantum and quantum-safe cryptography face a resource-management problem: quantum key distribution (QKD) gives the strongest guarantee available but is hardware-scarce and costly, so only a fraction of a deployment's links can receive it. Default practice -- ranking links by traffic or centrality and upgrading the top scorers -- optimizes each link in isolation, while a distributed job's real security is set by whichever active link ends up weakest. We present WLPA (Weakest-Link Posture Assignment), an implementation-ready decision framework and algorithm for allocating scarce quantum-safe postures under hardware, latency, and compliance constraints. WLPA computes the optimal weakest-link posture in closed form and returns an assignment in O(|E| log |E|) time -- 125 ms for a 20,000-link network on a laptop -- with a breach-aware refinement matching an exact integer program under common conditions. Our central contribution is a dichotomy telling operators exactly when existing per-link heuristics already match this optimum and when they systematically fail: under constant upgrade cost and uniform traffic-driven risk the two coincide exactly; once costs vary or an adversary concentrates on weak targets, heuristics leave the weakest link unprotected, unboundedly. We validate WLPA across 19 experiments: four microservice topologies, a real enterprise network (SNAP email-Eu-core), a post-quantum latency benchmark, a Qiskit BB84 simulation and a real-hardware BB84 run on IBM's ibm_marrakesh processor, checks against real production traffic traces, a CVE-calibrated correlated-compromise study, Bayesian uncertainty quantification, and seven baseline methods. A concrete-security reduction grounds the framework as theoretical foundation, not primary contribution.

Cryptography and Security (cs.CR); Quantum Physics (quant-ph)

arXiv:2610.04897 [cs.CR]

(or arXiv:2610.04897v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2610.04897 Focus to learn more arXiv-issued DOI via DataCite (pending registration)

code/README_pqc_benchmark.md

code/original_four_architecture_pipeline/README.md

code/original_four_architecture_pipeline/extra.py

code/original_four_architecture_pipeline/reproduce_N11_N9_R11.py

code/original_four_architecture_pipeline/run_experiments.py

code/original_four_architecture_pipeline/verify.py

code/original_four_architecture_pipeline/wlpa/__init__.py

code/original_four_architecture_pipeline/wlpa/algorithms.py

code/original_four_architecture_pipeline/wlpa/breach.py

code/original_four_architecture_pipeline/wlpa/casestudy.py

code/original_four_architecture_pipeline/wlpa/generators.py

code/original_four_architecture_pipeline/wlpa/hardness.py

code/original_four_architecture_pipeline/wlpa/klevel.py

code/original_four_architecture_pipeline/wlpa/model.py

code/original_four_architecture_pipeline/wlpa/resilience.py

code/original_four_architecture_pipeline/wlpa/stats.py

code/pqc_benchmark.py

code/pqc_benchmark_results.json

code/run_real_topology.py

quantum_circuits_full/QC10_wlpa_allocation.png

quantum_circuits_full/QC1_bb84_z_match.png

quantum_circuits_full/QC2_bb84_x_match.png

quantum_circuits_full/QC3_bb84_mismatch.png

quantum_circuits_full/QC4_bb84_eavesdropper.png

quantum_circuits_full/QC5_bb84_noisy.png

quantum_circuits_full/QC6_bb84_session.png

quantum_circuits_full/QC7_privacy_amplification.png

quantum_circuits_full/QC8_e91_entanglement.png

quantum_circuits_full/QC9_qrng_8bit.png

(26 additional files not shown) You must enabled JavaScript to view entire file list.

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.