System and method for quantum-enabled cyber security in a wireless mobile network

Aspects of the subject disclosure may include, for example, monitoring a security status of a wireless communication session comprising a back-haul link supporting a classical communication channel between a wireless access point and a wireless mobility core network. The classical communication channel is adapted to transport underlying data of the wireless communication session and, responsive to determining a change in the security status, associating with the wireless communication session a quantum communication channel adapted to transport information via qubits. Information is exchanged between the wireless access point and the mobility core network via the qubits of the quantum communication channel, wherein the exchanging of the information via the qubits enhances a security level of the wireless communication session in view of a perceived threat. Other embodiments are disclosed.

FIELD OF THE DISCLOSURE

The subject disclosure relates to a system and method for quantum-enabled cyber security in a wireless mobile network.

BACKGROUND

Quantum teleportation relates to a process whereby quantum information may be transported from one location to another according to a quantum mechanical state of a particle, such as a photon. The quantum state refers to a state encoded onto a property of the particle, sometimes referred to as a quantum observable. For example, the property can include one of a polarization, a wavelength or an emission time. More specifically, pairs of entangled particles, such as photons are created and sending one of each pair to different recipients. The photons may be transmitted in free space, or in a guided manner, e.g., via a waveguide, such as an optical fiber. The encoded photons, or qubits, are directed toward a receiver adapted to analyze the quantum bits to detect the encoded information. Whatever happens to one spin influences the other instantaneously, in a predictable manner without regard to their distance of separation. If a first recipient allows one of the entangled particles to interact with a memory qubit that holds the information to be exchanged, the interaction changes the state of the photon. Through quantum entanglement, the state of the entangled photon at the second recipient changes instantaneously. Such quantum teleportation also requires that information relating to the quantum states be shared between remote entities via a classical communication channel. The quantum state information, together with the observable quantum properties, may be used to exchange information in a secure manner.

DETAILED DESCRIPTION

The subject disclosure describes, among other things, illustrative embodiments for establishing a quantum channel between a wireless access point and a mobile core network responsive to a perceived security threat, and securing at least a portion of a mobile backhaul communications channel between the wireless access point and the mobile core network according to an exchange of quantum entangled particles via the quantum channel. Other embodiments are described in the subject disclosure.

One or more aspects of the subject disclosure include a system that includes a processing system having a processor and a memory. The memory stores executable instructions that, when executed by the processing system, facilitate performance of operations. The operations include monitoring a security status of a mobile communication session comprising a back-haul link between a wireless access point and a mobility core network. The back-haul link includes a classical communication channel adapted to transport underlying data of the mobile communication session between the wireless access point and the mobility core network. Responsive to determining a change in the security status indicating a perceived threat, a quantum communication channel adapted to transport information via qubits is provisioned between the wireless access point and the mobility core network. Information is exchanged between the wireless access point and the mobility core network via the qubits of the quantum communication channel, wherein the exchanging of the information via the qubits enhances a security level of the mobile communication session to obtain an enhanced security level in view of the perceived threat.

One or more aspects of the subject disclosure include a process, that includes monitoring, by a processing system including a processor, a security status of a wireless communication session. The wireless communication session relies upon a back-haul link between a wireless access point and a mobility core network. The back-haul link includes a classical communication channel adapted to transport underlying data of the wireless communication session between the wireless access point and the mobility core network. Responsive to determining a change in the security status indicating a perceived threat, a quantum communication channel is initiated, by the processing system, between the wireless access point and the mobility core network. The quantum communication channel is adapted to transport information via qubits. Information is exchanged, by the processing system, between the wireless access point and the mobility core network via the qubits of the quantum communication channel, wherein the exchanging of the information via the qubits enhances a security level of the wireless communication session to obtain an enhanced security level in view of the perceived threat.

One or more aspects of the subject disclosure include a machine-readable medium, that includes executable instructions that, when executed by a processing system including a processor, facilitate performance of operations. The operations include monitoring a security status of a wireless communication session including a back-haul link between a wireless access point and a mobility core network. The back-haul link includes a classical communication channel adapted to transport underlying data of the wireless communication session between the wireless access point and the mobility core network. Responsive to determining a change in the security status indicating a perceived threat, a quantum communication channel is associated with the wireless communication session between the wireless access point and the mobility core network. The quantum communication channel is adapted to transport information via qubits. Information is exchanged between the wireless access point and the mobility core network via the qubits of the quantum communication channel, wherein the exchanging of the information via the qubits enhances a security level of the wireless communication session to obtain an enhanced security level in view of the perceived threat.

A potential security threat to a mobile communication network may be discovered through a threat detection mechanism, such as automated malware quarantine (AMQ), IoT scanner or any other suitable techniques. User data services of one or more mobile users may be transitioned to a secure quantum-enabled communication channel, on-demand. The quantum-enabled communication channel may extend between a network cloud and one or more wireless access points (WAP), such as wireless local area network (WLAN) hot-spots, to heighten security for Wi-Fi connected mobile devices and/or mobile cellular access terminals, or base stations, to heighten security for 4G and/or 5G connected mobile devices.

The quantum-enabled communication channels may be provisioned upon demand, e.g., in response to detection of potential security threats. Similarly, the quantum-enabled communication channels may be deprovisioned once a communication session has terminated, and/or responsive to a particular application and/or service of an active communication session having been terminated, and/or responsive to a handoff of the associated mobile device to a neighboring cell. In at least some embodiments, a status of a provisioning and/or current use of a quantum-enabled channel may be shared between one or more neighboring cells, including small cells, microcells and femtocells and between one or more nearby WAPs and/or one or more neighboring cells to facilitate handover events. In some embodiments, one or more quantum-enabled channels may be provisioned and/or pre-provisioned in anticipation of a potential handover of a mobile communication session engaged in a communication session relying upon a quantum-enabled channel. It is understood that in at least some instances, despite there being a detected security threat, such provisioning and/or pre-provisioning, e.g., based on potential hand-over events, may not be necessary based on one or more of the nature of the security threat, infrastructure differences of backhaul links and the like.

It is further understood that quantum-enabled communication channels require specialized infrastructure adapted to process information according to quantum states of particles. Such quantum-aware devices and/or systems, e.g., quantum computers, generally impose stringent requirements associated with the generation, storage and/or processing of such quantum particles, as discussed in more detail below. In at least some embodiments the quantum-aware systems, such as a quantum-aware WLAN base station may be in safe and appropriate accommodating location, such as enterprise corporate sites, airports, and large dual units. With the current approach, after the threat has been detected and contained, a software solution, for example, AMQ, automatically allows the device to rejoin the network risking the same threat again. The ability to add such heightened security, e.g., hardening, on demand allows active communication sessions to proceed, despite the perceived and/or actual confirmed security breach or threat. The disclosed techniques providing a quantum-enabled communication channel on demand, offer improvements over current security solutions, such as better threat proof added security for the highly sensitive content users or mission critical systems.

In at least some embodiments, supporting infrastructure facilitates quantum-enabled adaptations to mobile communication networks, which allow end users to migrate over a quantum secure connection on demand by employing at least three quantum-enabled systems or nodes. By way of nonlimiting example, a first node may include a quantum-enabled WLAN (Q-WLAN) through which a wireless user may be attached, e.g., at an active Wi-Fi hotspot. A second node may include a Quantum Front End Server (Q-FES) at a central site, such as at core cloud, e.g., a mobility core network. A third node may include a Quantum Resource Manager (Q-RM), e.g., at and/or otherwise associated with the core cloud.

Having detected a security breach for a mobile user through any suitable security detection and/or threat assessment technique, a traditional or classical software defined network (SDN) may be adapted to add, acquire, and/or otherwise association and/or outsource quantum security tasks to a quantum entity. For example, an SDN controller or orchestrator may, after having detected a potential threat, request such quantum-aware functionality via the Q-RM. The Q-RM, in turn, may facilitate a suitable quantum-enabled channel to address and/or otherwise counter the perceived security threat. For example, the Q-RM may associate, configure, re-configure and/or otherwise activate quantum-enabled infrastructure, such as the Q-WLAN and/or the Q-FES, to provision and/or otherwise enable the quantum-enabled communication channel. It is understood that the proposed quantum-channel on-demand features may be applied to one or more specific implementations, such as 5G, in which a required sequence of the solution may involve messaging between one or more of the aforementioned three quantum touch points.

It is believed that the disclosed quantum-channel on-demand features, at least as they relate to mobile, e.g., 5G, cyber security, do not exist today. The ability to establish a quantum-channel on-demand enables mobile end users, including IoT type devices that may or may not be mobile, to migrate to a quantum secure connection on demand, e.g., by employing the aforementioned three quantum touchpoints: Q-WLAN, Q-RM, and Q-FES, at least for SDN applications. The ability to provision and/or otherwise establish and/or activate a quantum-channel on-demand is distinguishable from current approaches, which may isolate and contain communication infrastructure after the threat is detected. For example, the AMQ type solutions allow an affected device to rejoin the network, thereby risking a subsequent security breach. Such solutions fail to provide other alternatives, such as the enhanced level of security offered by quantum-enabled communication channels. Moreover, it has been observed that currently available security solutions are generally difficult to deploy, manage, program, scale, and/or secure.

Contrary to the disclosed techniques, which may apply threat mitigation policies according to services and applications, currently available solutions often rely on security threat mitigation policies that are tightly coupled to physical resources. Such physical resource dependence hinders security solutions, which may struggle to provide quick and automated threat mitigation across equipment from multiple vendors. Furthermore consistent security policies that are tightly coupled to physical resources are difficult to administer across compute, storage, and network domains, and multiple data centers.

By implementing a quantum-enabled channel on-demand, e.g., active communication sessions and/or services may proceed with heightened security, without necessitating that they automatically rejoin the network without such quantum-aware provisions that would otherwise risk a recurrence of any threat. Rather, the disclosed techniques mitigate threats by migrating at least a portion of the underlying session communications to a quantum secure path, which may be under a joint control of a classical SDN and a Q-RM.

Referring now toFIG.1, a block diagram is shown illustrating an example, non-limiting embodiment of a system100in accordance with various aspects described herein. For example, system100can facilitate in whole or in part, a provisioning, an establishment and/or an activation of a quantum-enabled communication channel between a wireless access point and a mobile core network responsive to a perceived security threat, and securing mobile backhaul communications according to an exchange of quantum entangled particles via the quantum channel. In particular, a communications network125is presented for providing broadband access110to a plurality of data terminals114via access terminal112, wireless access120to a plurality of mobile devices124and vehicle126via base station or access point122, voice access130to a plurality of telephony devices134, via switching device132and/or media access140to a plurality of audio/video display devices144via media terminal142. The wireless access point may be in communication with the communications network125via a backhaul network or backhaul link182. In at least some embodiments, the communications network125provides communication access to wireless devices that may or may not be mobile, such as drones and/or appliances, e.g., home appliances, security systems, and the like. Wireless communications access may include, without limitation machine-to-machine or machine-type communications, e.g., according to Internet of Things (IoT) applications. In addition, communication network125is coupled to one or more content sources175of audio, video, graphics, text and/or other media. While broadband access110, wireless access120, voice access130and media access140are shown separately, one or more of these forms of access can be combined to provide multiple access services to a single client device (e.g., mobile devices124can receive media content via media terminal142, data terminal114can be provided voice access via switching device132, and so on).

In at least some embodiments, the system100includes a security monitor170and one or more quantum-aware devices or systems171,172,176. For example, the system100may include a quantum-aware wireless access point, such as a quantum-aware wireless local area network (Q-WLAN)171. The Q-WLAN171may include a radio adapted to support wireless communications and a quantum processor adapted to support one or more quantum processes. The Q-WAP wireless communications may be implemented according to a wireless communication protocol, such as a wireless local area network (WLAN) protocol. Example WLAN protocols include any of these generally known to those skilled in the art, including the examples disclosed herein, such as any of the IEEE 802.11 protocols, e.g., Wi-Fi, or Bluetooth. In at least some embodiments, the Q-WLAN171may include a classical network interface, such as a network interface card, e.g., an Ethernet interface, adapted to connect to a classical communications channel, such as a classical communications backhaul channel173between the Q-WLAN171and an edge device of a mobility core network of the communications network125. The Q-WLAN171is also in communication with the quantum channel174.

Alternatively or in addition, the access terminal122may include a quantum-aware radio access network (Q-RAN) terminal172(shown in phantom). The Q-RAN terminal172may include one or more radios adapted to support wireless mobile communications along with a quantum processor adapted to support one or more quantum processes. In at least some embodiments, the Q-RAN terminal172includes a quantum-aware base station and/or quantum-aware radio controller. The wireless mobile communications may be implemented according to one or more wireless mobile communication protocols, such as any of the example wireless mobility protocols disclosed herein or otherwise generally known to those skilled in the art. Example wireless mobility protocols include, without limitation, one or more of the example 3GPP LTE protocols, e.g., sometimes referred to generally as 3G, 4G, 5G and 6G. In at least some embodiments, the Q-RAN terminal172may include a classical network interface, such as a network interface card, e.g., an Ethernet interface, adapted to connect to a classical communications channel, such as a classical communications backhaul channel175between the Q-RAN terminal172and an edge device of a mobility core network of the communications network125. The Q-RAN terminal172is also in communication with the quantum channel174.

In at least some embodiments, backhaul communications of an active mobile communication session, e.g., providing one or more of mobile devices124,126with access to backend services, may be secured according to one or more quantum processes, such as the exchange of qubits via the quantum channel174. Quantum processes may include, without limitation, one or more of any of the quantum processes disclosed herein, such as generation of qubits, generation of quantum entangled particles or qubits, transmission and/or receipt of qubits and/or quantum entangled particles or qubits, entanglement swapping, quantum teleportation, sensing of quantum states, evaluation of qubit values, detection of tampering by evaluation of quantum states, quantum key distribution (QKD), storage of entangled particles and/or qubits, quantum processing of qubits, e.g., according to quantum gates, and the like. A qubit is quantum mechanical analogue of a classical bit embodied in one or more of ions, electrons, and/or photons.

In at least some embodiments, the communications network125includes one or more quantum-aware devices, such as a quantum frontend server (Q-FES)176. The Q-FES176includes a quantum processor adapted to support one or more quantum processes, as well as a traditional processing system, e.g., running an operating system, such as UNIX®, a registered trademark of X/Open Co. Ltd., Corp. of Berkshire, England, or Windows®, a registered trademark of Microsoft Corp., of Seattle, WA, and/or Apple® iOS, a registered trademark of Apple Corp. of Cupertino, CA. The Q-FES176is in communication with one or more of the classical communications backend links173,175. The Q-FES176is also in communication with the quantum channel173.

In at least some embodiments, the Q-FES176is in communication with one or more servers providing access to backend services. The servers may be local, e.g., providing services offered by a network service provider of the mobility core network and/or the communications network125. Alternatively or in addition, the services may be available from third party services178, such as streaming media services, e.g., Pandora®, a registered trademark of Pandora Media, LLC, of Oakland CA, and Netflix®, a registered trademark of Netflix, Inc., of Los Gatos, CA. Other services may include, without limitation, web-browsing, instant messaging, video chat, VoIP, teleconferencing, security monitoring, social media, such as Facebook®, a registered trademark of Facebook, Inc. of Menlo Park, CA, Twitter®, a registered trademark of Twitter, Inc., of San Francisco, CA, TikTok®, a registered trademark of Bytedance Ltd. of Grand Cayman, Cayman Islands, and so on.

The system100may include a quantum resource manager Q-RM177. The Q-RM177is in communication with the Q-FES176and is adapted to facilitate association of the quantum channel with one or more of the backhaul links173,175. Presently, quantum processes are complex, requiring access to one or more of specialized quantum processors, quantum storage devices, quantum channels, and the like. Presently, quantum processes, such as quantum internet, quantum communications, quantum teleportation and quantum processing are somewhat limited in bandwidth, or qubit capacity, such that access to such quantum processes may be reserved for special applications, e.g., requiring heightened security, special users, e.g., privileged users, and/or special situations, e.g., perceived security breaches. Accordingly, the Q-RM177may facilitate quantum-enabled backhaul communications according to an on-demand and/or as-needed basis. It us understood that in at least some embodiments, the Q-RM177may facilitate transition or reversion from quantum-enabled backhaul communications to traditional classical communications, e.g., via one or more of the backhaul links173,175. Such reversions from quantum-enabled links to classical links may be provided according to an on-demand and/or as-needed basis. Examples include, without limitation, situations in which a heightened security status is no longer necessary, upon an expiration of time, in response to an event, such as alleviation of any perceived security breach that may have initiated quantum access, and so on.

For embodiments, in which the Q-RM177, the Q-WLAN171and/or the Q-RAN172are engaged in a selective manner, they may operate under the control of another device, such as a quantum controller. The quantum controller may be in communication with one or more of the Q-RM177, the Q-WLAN171and/or the Q-RAN172, providing an indication, such as a control signal, to indicate when quantum processes should be engaged and/or disengaged, e.g., facilitating a controlled access to the quantum channel174. The quantum controller may initiate such control signals responsive to an event, such as a user action, e.g., at a user interface, and/or a monitored event, such as an environmental event and/or a timer or clock encountering an activation/deactivation time. Alternatively or in addition, the quantum controller may determine the indication, i.e., control signal according to logic. The logic may be adapted to provide the control signal according to a logical processing of one or more of user inputs, environmental sensors, timers, clocks, signals from other devices, systems and/or services, such as security monitors, and the like.

According to the illustrative embodiment, the quantum controller comprises a security monitor170. The security monitor may be adapted to assess a security status related to one or more active mobile communication sessions. By way of example, and without limitation, the security monitor170may receive indications from environmental monitors, e.g., motion sensors, security cameras, door latch actuators, ID card scanners, and the like, to identify potential threats as they may relate to unauthorized access to physical spaces, such as equipment cabinets, equipment racks, communication facilities, and the like, associated with a backhaul link173,175of the active mobile communication session. Presuming a potential security threat is detected, the security monitor170provides a signal to one or more of the Q-FES176, the Q-WLAN171, and the Q-RAN172. The signal may be selectively directed to the particular devices associated with a backhaul link associated with the potential security threat.

Alternatively or in addition perceived security threats may be determined according to a monitoring of network communications, link status, error rates, packet delays, signal levels, signal loss, and the like. Such monitoring may be provided by standalone monitoring equipment, e.g., positioned along one or more of the backhaul links173,175, at one or more of the Q-FES176, the Q-WLAN171, and the Q-RAN172, by one or more of the network elements150,152,153,156, from a remote system or service178, such as a security monitoring service. In at least some embodiments, a potential threat may be determined according to an application hosted on one or more of the backend servers of the services178, backend servers of the communications network125, and/or the Q-FES176, the Q-WLAN171, and the Q-RAN172, and/or the mobile devices124,126.

The Q-FES176, the Q-WLAN171, and the Q-RAN172may be operable responsive to a signal from the security monitor170to engage and/or disengage the quantum processes with one or more active communication sessions utilizing one or more of the backhaul links173,175.

FIG.2Ais a block diagram illustrating an example, non-limiting embodiment of a quantum-enabled system200functioning within the communication network ofFIG.1in accordance with various aspects described herein. The system200include a quantum-aware WLAN (Q-WLAN)201providing wireless service to a mobile communication device209within a wireless access region202. The mobile communication device209may be engaged in an active communication session in which the device209engages one or more services via one or more remote systems. For example, the services may be provided by and/or otherwise accessed through one or more backend servers208at a mobile network provider's core network. The example core network includes a core cloud network203that may include, be implemented and/or otherwise adapted according to a software defined network (SDN)217. The SDN217includes an SDN orchestrator and/or controller206adapted to configure one or more core cloud network resources203to facilitate delivery of mobile services to the mobile communication device209.

The Q-WLAN201is in communication with the core cloud203via a backhaul communications channel218. The example backhaul communication channel218facilitates communications between the Q-WLAN201, the mobile communication device209and the core cloud203. According to the illustrative example, the backhaul channel218includes an edge server207of the core cloud203. Underlying data exchanged via the backhaul communications channel218may include user data211, e.g., associated with one or more applications and/or services accessed by the mobile communications device209. For example, the edge server207is in further communication with one or more backend servers208adapted to deliver and/or otherwise support services available to the mobile communications device209. User data may include, without limitation, Web queries, file transfers, text messaging, email communications, social media, streaming audio and/or streaming video, and the like. Alternatively or in addition, the underlying data exchanged via the backhaul communications channel218may include control and/or signaling data210, e.g., associated with discovery, attachment, and/or mobility of the mobile communications device209.

In more detail, the backhaul communications channel218may include an edge cloud204, facilitating one or more of a front portion, a mid-portion and/or a backhaul portion of the backhaul communications channel218. The edge cloud204may be a private edge cloud, e.g., installed, maintained, leased and/or otherwise managed by a network service provider. Alternatively or in addition, the edge cloud204and/or another portion of the backhaul communications channel218may include publicly accessible infrastructure, not necessarily under the control or management of the network service provider. For example, at least a portion of the backhaul communications channel218may include an IP network205, such as the Internet (shown in phantom). It is understood that securing against perceived threats over any portion of the backhaul communications channel218that requires securing physical access to communications infrastructure may prove exceedingly difficult.

The system200includes three main quantum-aware systems, subsystems, or nodes, sometimes referred to as quantum “touch points.” Namely, the system200includes a Q-RM213, a Q-FES214, and Q-WLAN201. The system200, by way of the quantum-aware touchpoints102,213,214, allows mobile end users, including IoT wireless devices, which may or may not be mobile, to migrate communications to a quantum secured connection, on demand. According to the illustrative example, the system200includes a quantum channel215between the Q-WLAN201and the Q-FES214. The quantum channel215is adapted to transport quantum information, e.g., in the form of quantum particles, qubits, quantum states, and the like. According to the illustrative example, the quantum channel215comprises an optical link adapted to convey photons, wherein the quantum information is conveyed through one or more physical properties of the photons. Physical properties of the photons may include, without limitation, polarization and/or angular momentum, including angular orbital momentum. The optical link may include, without limitation, an optical waveguide, such as an optical fiber cable, and/or a free-space optical link.

The quantum communications channel215may be established responsive to a perceived security threat. For example, the mobile communications device209may be engaged in a communications session, e.g., accessing services via one or more of the backend servers208via a classical communications channel supported by the backhaul communications channel218. The example system200includes a security monitor212adapted to detect a potential security threat. The security monitor212, upon detecting a potential security threat, may provide an indication of the perceived threat to the SDN controller206. The SDN controller206, in turn, may evaluate the perceived threat alone or in combination with one or more of an identity and/or type of the mobile communications device209, an identify of a user of the mobile communications device209, an active service engaged by the mobile communications device209, a quantum capability of the active wireless access point and/or quantum capabilities of other wireless access points that may be capable of providing overlapping coverage to the mobile communications device209.

In at least some embodiments, the optical link may include one or more quantum repeaters216. The quantum repeaters216are adapted to extend a usable range of the optical link as may be particularly useful for optical fiber cable embodiments, in which currently achievable ranges are from about 60 to about 120 miles. It is understood that free-space optical links may not be limited, with reported examples permitting quantum-enabled satellite communications links. Quantum repeaters216may include a quantum receiver, a qubit regenerator, and a quantum transmitter to effectively establish two independent quantum-enabled channels between the Q-WLAN201and the Q-FES214. In such instances, the quantum repeaters216are provided in a physically secure location to guard against security threats. Alternatively or in addition, the quantum repeaters216may employ a quantum process referred to as entanglement swapping, in which security of the quantum communications channel215is assured without necessarily requiring physical security at the quantum repeater216, or along the fiber and/or free-space link. It is understood that qubits, by their nature, are immune to unauthorized access without the system200becoming aware of such access, e.g., by a disruption to the quantum properties, such as a collapse of a quantum entangled state.

In at least some embodiments qubits, e.g., the photons, are generated and/or otherwise sourced locally at one or more of the Q-FES214and the Q-WLAN201. Alternatively or in addition, the qubits, e.g., the photons, may be generated and/or otherwise sourced from a remote entity, such as the example qubit source219. For example, the qubit source219may generate entangled photons, e.g., having orthogonal polarization states, and transmit a first one of the entangled pair to the Q-FES214and a second one of the entangled pair to the Q-WLAN201. The qubits, by their quantum states, may facilitate a quantum-enabled exchange of information between the Q-FES214and the Q-WLAN201. In at least some embodiments, the exchange of quantum-enable information may be in one direction, e.g., from the Q-FES214to the Q-WLAN201. Alternatively or in addition, the exchange of quantum-enabled information may be in both directions. Such bi-directional exchanges of quantum-enabled information may occur in a simplex fashion. Alternatively or in addition, they may occur in a full-duplex fashion.

By way of illustrative example, the SDN217may be notified about a change in security status, such as a possible security breach. For example, the SDN217receives an indication of a possible security breach from the security monitor212. In at least some embodiments, the SDN217determines the nature of the threat and determines the remedy based on the pre-defined logic. For example, the SDN controller206receives an indication of a possible security breach. The SDN controller206may evaluate the nature of the breach to determine if there is a possibility that the breach may pose a security threat the mobile communication device209and/or any applications and/or services with which the mobile communication device209is actively utilizing.

For example, the security monitor212may provide one or more details related to the breach. Such details may include, without limitation, identification of physical locations, e.g., buildings, equipment rooms, utility poles, network devices, communication links, e.g., which backhaul link218and/or which wireless access point may be associated with the breach. The SDN controller206may include logic that is adapted to process information obtained from the security monitor212alone and/or in combination with information available from the SDN217, such as identification of a configuration of the associated core cloud203, and/or identification of an associated edge server207and/or identification of associated backend servers208and/or identification of wireless access point, and so on. The logic may be adapted to identify a potentially affected mobile device, and/or a wireless access point and/or a backhaul link. Alternatively or in addition logic may be adapted to assess a level of the potential security threat to support a determine as to whether a quantum channel is necessary. It is understood that certain users, and/or applications may be more sensitive to a security breach than others, such that a limited quantum resource, such as the quantum channel215may be selectively provisioned and/or otherwise activated in some situations, while not being activated in others that may not be as sensitive to the security breach.

In at least some embodiments, the SDN217, e.g., the SDN controller206, obtains an identification and/or a physical location and/or a network location, e.g., an IP address, of the Q-WLAN201serving the affected mobile device209. Physical locations, e.g., geocoordinates and/or addresses, may be obtained from a location reported by a GPS receiver of the mobile device, and/or a pre-determined location of the Q-WLAN201. The SDN controller206may identify which backhaul link218is being used for the particular Q-WLAN201and determine whether a separately reported security breach may impact one or more of the Q-WLAN and/or the backhaul link218.

To the extent the SDN, e.g., the SDN controller206, determines that quantum-enabled communications should be applied to the particular backhaul link218, the SDN controller206may outsource a quantum-enabled solution to a quantum network infrastructure. According to the illustrative embodiment, the SDN controller206may engage the Q-RM213to facilitate establishment of a quantum-enabled solution, e.g., a quantum security treatment. In at least some embodiments, the Q-RM213maintains a mapping table of quantum resources, such as entanglement generators219, Q-FES214, Q-WLAN201, quantum repeaters216, quantum links215, and the like. Alternatively or in addition, the Q-RM213is adapted to determine availabilities and/or capabilities of any such quantum resources. For example, the Q-RM213may be adapted to determine a capacity of quantum node pairs, such as those pairs as may be available to and/or at the Q-WLAN201and/or the core Q-FES214, that have backend services and/or application mapping. The Q-RM213, in turn, is adapted to facilitate establishment of a quantum-enabled communication channel215between the Q-WLAN201servicing the affected mobile device209and the Q-FES214.

The Q-RM213may facilitate the quantum-enabled communication channel over a satellite communication link, and/or over a the optical fiber communications link and/or over a free-space link, or any other physical link suitable for transporting entangled qubits, while also preserving their quantum states. The physical infrastructure supporting the exchange of qubits may be the same infrastructure supporting the affected backhaul, e.g., the same optical fiber. Alternatively or in addition, the physical infrastructure supporting the exchange of qubits may be separate from the affected backhaul link218.

The Q-RM213may notify the SDN, e.g., the SDN controller206, regarding completion of a provisioning and/or activation of the quantum-enabled communication channel215. Upon receiving an indication from the Q-RM213that the quantum-enabled communication channel215has been provisioned and/or otherwise made available for use, SDN, e.g., the SDN controller206, instructs one or more of the core edge server207and/or the edge cloud204, e.g., a 5G edge cloud, to transition and/or otherwise switch and/or modify the backhaul communications to transition the user channel to the core cloud203via the Q-WLAN201. The Q-WLAN201may resume the user session with the core cloud network203by leveraging security of the qubits over the quantum-enabled link215to the user session. It is understood that, without limitation, leveraging the qubits may include implementing a quantum key distribution over the quantum channel215to establish a secure encryption key that may be applied to user session communications over the classical communication channel, e.g., over the existing backhaul link218.

Alternatively or in addition, leveraging the qubits may include implementing quantum internet, e.g., utilizing quantum teleportation of quantum states over the quantum channel215to convey underlying data associated with the user session communications. It is understood that in the latter example in which the quantum channel215is adapted to convey the underlying user data, a corresponding classical communication channel may be necessary through which quantum state information may be shared between the Q-WLAN201and the Q-FES214. The classical communications channel may utilize the same satellite, and/or optical fiber, and/or free space optical link supporting the quantum channel215. Alternatively or in addition, the classical communications channel may utilize the same communication link, e.g., the original backhaul link218, that was breached. The quantum-enabled configuration, once established, may remain in place until one or more of the Q-WLAN201and/or the Q-FES and/or the Q-RM213is instructed otherwise, e.g., by the SDN controller206, which may occur over the classical edge cloud204.

FIG.2Bis a block diagram illustrating an example, non-limiting embodiment of a quantum-enabled communication node220functioning within the quantum-enabled system ofFIG.2Aand the communication network ofFIG.1. For example, the quantum-enabled communication node220may be associated with and/or incorporated into one or more of the Q-FES176,214, the Q-WLAN171, the Q-WLAN201and the Q-RAN172(FIGS.1and2A). The example quantum-enabled communication node220includes a photon source221, an entanglement generator222, a quantum processor223and a photon detector224. The quantum-enabled communication node220also includes a quantum node controller225in communication with one or more of the photon source221, the entanglement generator222, the quantum processor223and the photon detector224.

The photon source221can include without limitation, source of photons. Optical sources can include, without limitation, coherent devices, such as lasers or masers, non-coherent devices, such as light emitting diodes (LEDs), and combinations thereof. Lasers can include solid state lasers, e.g., semiconductor diode lasers, gas lasers, chemical lasers fiber lasers, photonic crystal lasers, and so on. Although the term optical source is used, it is understood that devices may operate within and/or without a visible light region of the spectrum, e.g., within the infrared and/or ultraviolet spectra. In at least some embodiments, optical source devices can include millimeter wave and/or microwave devices, e.g., masers, and the like.

In at least some embodiments photons produced by the photon source221are coherent, e.g., produced by a laser. The laser can include a pump source to produce energetic coherent photons having an energy above a predetermined minimum threshold. For example, the predetermined minimum threshold level of the energetic photons can be determined according to a predetermined classical optical channel, e.g., such that the energetic photons maintain a minimum energy level after passage through the classical optical channel. In at least some embodiments, the minimum energy level can be determined according to one or more of a photon detector sensitivity, a path loss of the classical optical channel, a noise threshold, a quantum analyzer sensitivity, and the like. In some embodiments, the photon source221provides individual photons. Alternatively or in addition, the photon source221provides multiple photons, e.g., providing a group of multiple photons according to a single request received from the quantum node controller225.

In at least some embodiments, the photon source221can generate photons having characteristics suitable for an intended application. For example, the photon source221can generate photons having a wavelength adapted for telecommunication applications. By way of non-limiting example, the photon wavelengths can be one or more of 850, 1300 and 1550 nm for optical fiber channel applications.

Within the framework of quantum communications over long distances, photons at so-called “telecom” wavelengths have naturally come to the forefront as ideal support for quantum information because of their very weak interaction with the environment and of the low losses on propagation in standard optical fibers. Telecom wavelengths are defined by the International Telecommunications Union (ITU) in the form of standardized frequency bands (for example O, E, S, C, L, U). However, although very low, the transmission losses set a limit beyond which communication is no longer possible since the rate of detected photons becomes lower than the noise rate in the detector which remains the main limitation of the signal-to-noise ratio.

In at least some embodiments, the entanglement generator222includes a quantum state adjustor and/or selector. A source for emitting entangled photons, such as the entanglement generator222, emits pairs of photons correlated on one of their quantum observables. Stated otherwise, the quantum state of each of the photons taken individually cannot be defined. For example, the entanglement generator222may receive photons from the photon source221, split the photons using a nonlinear crystal, exhibiting spontaneous parametric down-conversion to obtain entangled photon pairs. The entangled photons may be processed within the entanglement generator222and/or the quantum processor223to obtain entangled photons. By way of nonlimiting example, the processing may include filtering the photons according to different, e.g., orthogonal filters to selectively obtain entangled photons having a preferred polarization.

Alternatively or in addition, the entangled photons may be adapted according to their angular orbital momentum. Devices adapted for altering an orbital angular momentum include, without limitation, spiral phase plates. Spiral phase plates, or mirrors, can include spiral-shaped pieces of crystal and/or plastic that are engineered specifically to a predetermined topological charge and incident wavelength. Adjustable spiral phase plates can be made by providing an adjustable separation, e.g., by moving a wedge between two sides of a split or cracked piece of plastic. It is envisioned that other devices can be used to produce vortices of a photon or photon beam, such as a hologram, a deformable mirror, a birefringent liquid crystal plate, sometimes referred to as a q-plate. For example, a q-plate with a topological charge “q” can generate a ±2q charge vortex in an optical beam based on polarization of an input beam. Applications of orbital angular momentum devices, including modulators and demodulators and/or detectors are disclosed in U.S. patent application Ser. No. 16/211,809, entitled “Free-Space, Twisted Light Optical Communication System,” filed on Dec. 6, 2018, the entire teachings of which are incorporated herein by reference in its entirety.

The orbital angular momentum of light refers to a component of angular momentum of a light beam or photon that is dependent on a field spatial distribution, and not on a polarization. High-order orbital angular momentum is a quantum mechanical state, one of the few that can be observed at the macroscopic level. It has become an attractive branch of studied due one its most intensely examined phenomena, Optical Vortices (OVs), which has found numerous applications, including; the ability to spin microscopic objects (known as an optical tweezer), create new forms of imaging systems, and behaves within nonlinear materials to give new insights into quantum optics.

In an optical vortex, otherwise known as “twisted light” or “topological charge”, light is twisted like a corkscrew around its axis of travel. Because of the twisting, the light waves at the axis itself cancel each other out. When projected onto a flat surface, an optical vortex looks like a ring of light, with a dark hole in the center. This corkscrew of light, with darkness at the center, is called an optical vortex.

In some embodiments, the entanglement generator222provides one or more of the entangled photons for application to a source endpoint of a quantum teleportation system, e.g., a quantum transmitter, a destination endpoint of a quantum teleportation system, e.g., a quantum receiver or detector, and/or a quantum relay or repeater. Alternatively or in addition, the entanglement generator222provides one or both qubits of an entangled photon pair to a storage device. The quantum particles may be transported over a quantum channel via a quantum channel interface226. classical information, e.g., identifying an observed quantum state may be conveyed to one or more communication nodes, e.g., the Q-WLAN and/or the Q-FES over a classical channel, via a classical channel interface227. Data may be exchanged between the quantum-enabled communication node220and one or more external devices, such as the mobile communications device209, and/or the backend servers208.

The quantum node controller225may be adapted to implement one or more instructions and/or rules that initiate generation of entangled photon pairs or qubits having a predetermined label or tag value impressed on the photon, e.g., by way of a photon's orbital angular momentum. The generated qubits can be used as generated and/or stored in a storage element for later retrieval. It is understood that in at least some embodiments, one or more of the quantum-enabled communication node220and/or the separate qubit source219(FIG.2) may develop a reservoir or pool of tagged or labeled qubits that can be stored and retrieved on an as needed basis.

Although the system elements of the example entangled photon provisioning system200are presented in a particular order, it is understood that the ordering of one or more of the system elements can be changed. For example, photon may be tagged and/or otherwise modified according to an identification label, e.g., a number. Such tagged photons may be arranged after the entanglement generator222to tag the entangled photon pairs. Alternatively or in addition, a photon tagger may be arranged after the controller225to tag the entangled photons and/or entangled photon pairs retrieved from the storage element.

It is understood that energy injected into a quantum system can disrupt a fragile entangled photon pair relationship. Furthermore, reading a quantum particle in a state of superposition will collapse the superposition. For these reasons, a traditional approach of photon amplification used in optical fiber networks is not suitable for entangled photons that are in a state of superposition. To amplify a regular photon, one combines it with another light pulse of a higher intensity, their combined intensity if an average of the original constituents. But they have to be separated so that the original photon stream regains data coherence. Therefore, traditional amplification processes would disrupt quantum entanglement, and the separation of the combined light pulse would act like a measurement and shatter the superposition. This can be overcome by using an entanglement swapping strategy. The disclosed photon creation process supports a practical scalability, providing both high performance and increased efficiency, by providing substantially pure photon “blanks” upon which to generate entangled pairs as disclosed in U.S. patent application Ser. No. 16/426,891, entitled “System and Method for Provisioning of Entangled-Photon Pairs,” filed on May 30, 2019, the entire teachings of which are incorporated herein by reference in its entirety.

FIG.2Cdepicts an illustrative embodiment of a process230in accordance with various aspects described herein. According to the example process230, a security status of mobile communication session is monitored at232, and a determination is made at233as to whether a security threat may exist. For example, a security monitor170,212(FIGS.1,2A) monitors a security status of a communications session and/or a backhaul communications link173,175,218(FIGS.1,2A). To the extent it is determined that no security threat exists, the process230continues monitoring at232and assessing potential security threats at233. Monitoring of the potential security threats may include implementing logic at SDN controller206responsive to an indication from the security monitor170,212. The logic may determine that an indication from the security monitory in one instance may necessitate utilizing a quantum-enabled communications channel, while in another instance, communications may continue according to a classical communications channel, without utilizing quantum information.

To the extent it is determined at233that a potential security threat exists, a quantum communication channel is provisioned at234. Provisioning of the quantum communication channel may include the SDN controller206notifying the Q-RM213(FIG.2) that a quantum communication channel is required. The Q-RM213may determine whether a suitable quantum communication channel has already been established, e.g., between the Q-WLAN201and the Q-FES214, in which instance, provisioning may include simply allocating at least a portion of the qubits to a communication session209of the mobile device209. Alternatively or in addition, the Q-RM213may determine that a suitable quantum communication does not exist and that one is necessary. In such instances, the Q-RM213may identify available quantum resources, such as one or more of the Q-WLAN201, the Q-FES214, the qubit source219, the quantum repeater216and a physical layer of the quantum communication channel215. The Q-RM213orchestrates establishment of the quantum communication channel and informs the SDN controller206once the quantum communications channel has been provisioned.

The SDN controller206, in turn, may notify one or more of the edge server207, the edge cloud204, the Q-WLAN201and the Q-FES214to initiate a transition from a mobile device209user session relying upon classical communications to a similar user session relying upon a quantum-enabled session according to the quantum communication channel. Quantum information may then be exchanged at235between one or more of the Q-FES176, the Q-WLAN171, and the Q-RAN172, via the quantum channel174,215. A security level of the communication session is enhanced at236according to the exchange of quantum information via the quantum channel.

FIG.2Ddepicts an illustrative embodiment of another process240in accordance with various aspects described herein. According to the example process240, a security status of mobile communication session is monitored at242. A determination is made at243as to whether a security threat may exist. To the extent it is determined that no security threat exists, the process240continues monitoring at242and assessing potential security threats at243. To the extent it is determined at243that a potential security threat exists, it is determined at244whether a quantum channel has already been provisioned. To the extent it is determined at244that a quantum channel has not yet been provisioned, the quantum communication channel is provisioned at245. Once it has been determined that the quantum channel has been provisioned, information is exchanged at246between one or more of the Q-FES176, the Q-WLAN171and the Q-RAN172, via the quantum channel174(FIG.1). A security level of the communication session is enhanced at247according to the exchange of quantum information via the quantum channel.

In some embodiments, the process240optionally determines whether a quantum channel has been provisioned at248(shown in phantom). This determination may be performed responsive to a security threat not having been determined and/or otherwise detected at243. To the extent a quantum channel is currently provisioned, the quantum channel may be optionally released and/or otherwise disassociated and/or deactivated at249(shown in phantom). After having released the provisioned quantum channel at249, the process240continues monitoring the security status at242. Likewise, to the extent it is determined that a quantum channel has not been provisioned at248, the process240also continues monitoring the security status at242. According to the illustrative process, q quantum communication may be provisioned responsive to a detected security threat and, in at least some embodiments, released and/or otherwise decommissioned responsive to a subsequent lack of a security threat.

Referring now toFIG.3, a block diagram is shown illustrating an example, non-limiting embodiment of a virtualized communication network300in accordance with various aspects described herein. In particular a virtualized communication network is presented that can be used to implement some or all of the subsystems and functions of system100, the subsystems and functions of the system200, the communication node220and the processes230,240presented inFIGS.1,2A,2B,2C,2D and3. For example, the virtualized communication network300may facilitate in whole or in part, a provisioning, an establishment and/or an activation of a quantum-enabled communication channel between a wireless access point and a mobile core network responsive to a perceived security threat, and securing mobile backhaul communications according to an exchange of quantum entangled particles via the quantum channel.

The example virtualized communication network300includes a quantum-aware substrate adapted to perform computational and/or communication functions based at least in part upon quantum mechanical principles. According to the quantum-aware substrate, the wireless access120network element may one or more quantum-aware wireless access points and/or quantum-aware radio access networks. According to the illustrative example, the wireless access120include a Q-WLAN377. Similarly, the virtualized network function cloud325may include one or more quantum-aware network elements. According to the illustrative example, the virtualized network function cloud325includes at least one Q-FES378. The Q-WLAN377and the Q-FES378may include one or more elements of the illustrative quantum-enabled communication node220(FIG.2B).

Continuing with the illustrative example, the cloud computing environment375may include a quantum resource manager (Q-RM)380. The Q-RM380may receive instructions from an SDN controller of the cloud computing environment375to provision and/or otherwise associate a quantum channel379with a wireless communication link. The example virtualized communication network300may include one or more security monitors381. The security monitor381may be implemented in whole or in part according to the cloud computing environment375, e.g., associated with the virtualized network function cloud325. Alternatively or in addition, the security monitor381may be separate from the cloud computing environment375, e.g., as a standalone device. The security monitor381is adapted to detect a possible breach or security and/or security threat. The security monitor381may inform the cloud computing environment375, e.g., via a SDN controller. The SDN controller, in turn, may implement one or more rules and/or policies to determine whether a perceived threat may require provisioning of a quantum-enabled communication channel. To the extent it is determined that a quantum-enabled communication channel is necessary, the Q-RM380coordinates quantum-aware assets, such as one or more of the Q-FES378and/or the Q-WLAN377to provision the quantum-enabled communication channel.

Turning now toFIG.4, there is illustrated a block diagram of a computing environment in accordance with various aspects described herein. In order to provide additional context for various embodiments of the embodiments described herein,FIG.4and the following discussion are intended to provide a brief, general description of a suitable computing environment400in which the various embodiments of the subject disclosure can be implemented. In particular, computing environment400can be used in the implementation of network elements150,152,154,156, access terminal112, base station or access point122, switching device132, media terminal142, and/or VNEs330,332,334, etc. Each of these devices can be implemented via computer-executable instructions that can run on one or more computers, and/or in combination with other program modules and/or as a combination of hardware and software. For example, the computing environment400may facilitate in whole or in part, a provisioning, an establishment and/or an activation of a quantum-enabled communication channel between a wireless access point and a mobile core network responsive to a perceived security threat, and securing mobile backhaul communications according to an exchange of quantum entangled particles via the quantum channel.

The example computer environment400includes quantum-aware elements or subsystems adapted to perform computational and/or communication functions based at least in part upon quantum mechanical principles. According to the quantum-aware elements, the computer402may include one or more elements of the illustrative quantum-enabled communication node220(FIG.2B). According to the illustrative example, the computer402include a quantum processor490, which may include one or more of a qubit source, an entanglement generator, a quantum processor and/or a qubit detector. Similarly, the example computer environment400may include one or more separate quantum-aware network elements. According to the illustrative example, the computer environment400includes at least one Q-WLAN477, which may include one or more elements of the illustrative quantum-enabled communication node220(FIG.2B).

Turning now toFIG.5, a mobile network environment500including an embodiment of a mobile network platform510is shown that is an example of network elements150,152,154,156, and/or VNEs330,332,334, etc. For example, the platform510may facilitate in whole or in part may facilitate in whole or in part, a provisioning, an establishment and/or an activation of a quantum-enabled communication channel between a wireless access point and a mobile core network responsive to a perceived security threat, and securing mobile backhaul communications according to an exchange of quantum entangled particles via the quantum channel. In one or more embodiments, the mobile network platform510can generate and receive signals transmitted and received by base stations or access points such as base station or access point122. Generally, mobile network platform510can comprise components, e.g., nodes, gateways, interfaces, servers, or disparate platforms, that facilitate both packet-switched (PS) (e.g., internet protocol (IP), frame relay, asynchronous transfer mode (ATM)) and circuit-switched (CS) traffic (e.g., voice and data), as well as control generation for networked wireless telecommunication. As a non-limiting example, mobile network platform510can be included in telecommunications carrier networks and can be considered carrier-side components as discussed elsewhere herein. Mobile network platform510comprises CS gateway node(s)512which can interface CS traffic received from legacy networks like telephony network(s)540(e.g., public switched telephone network (PSTN), or public land mobile network (PLMN)) or a signaling system #7 (SS7) network560. CS gateway node(s)512can authorize and authenticate traffic (e.g., voice) arising from such networks. Additionally, CS gateway node(s)512can access mobility, or roaming, data generated through SS7 network560; for instance, mobility data stored in a visited location register (VLR), which can reside in memory530. Moreover, CS gateway node(s)512interfaces CS-based traffic and signaling and PS gateway node(s)518. As an example, in a 3GPP UMTS network, CS gateway node(s)512can be realized at least in part in gateway GPRS support node(s) (GGSN). It should be appreciated that functionality and specific operation of CS gateway node(s)512, PS gateway node(s)518, and serving node(s)516, is provided and dictated by radio technology(ies) utilized by mobile network platform510for telecommunication over a radio access network520with other devices, such as a radiotelephone575.

The mobile network environment500includes quantum-aware elements or subsystems adapted to perform computational and/or communication functions based at least in part upon quantum mechanical principles. According to the quantum-aware elements, the mobile network platform510may include one or more elements of the illustrative quantum-enabled communication node220(FIG.2B). According to the illustrative example, the mobile network platform510include a quantum processor590, which may include one or more of a qubit source, an entanglement generator, a quantum processor and/or a qubit detector. Similarly, the example mobile network platform510may include one or more separate quantum-aware network elements. In at least some embodiments, the mobile network platform510may include a security monitor581. The security monitor581is adapted to detect a possible security breach or threat, which may result in a provisioning and/or use of a quantum-enabled communication channel579according to the various techniques disclosed herein.

Turning now toFIG.6, an illustrative embodiment of a communication device600is shown. The communication device600can serve as an illustrative embodiment of devices such as data terminals114, mobile devices124, vehicle126, display devices144or other client devices for communication via either communications network125. For example, the computing device600may facilitate in whole or in part, a provisioning, an establishment and/or an activation of a quantum-enabled communication channel between a wireless access point and a mobile core network responsive to a perceived security threat, and securing mobile backhaul communications according to an exchange of quantum entangled particles via the quantum channel.