## 2 Materials and Methods
### Fiber-Wireless Topology  
The final part of our study aims to investigate alternative implementations of the P2 MP topology, relying on the use of a mesh networking operated by mmWave wireless links. The mmWaves have  
Figure 4: Quantum-secured multi-user topology with a centralized Alice station and multiple Bob stations located at the 5G terminal nodes. A passive optical distribution network based on 1:N splitter stage implements the P2 MP topology with shared single-mode fiber segments for classical and quantum layer.  
been manifested as wireless fibers since they can provide reliable multiple gigabit capacity and they gain more and more ground in the field of Fixed Wireless Access (FWA) [55]. The integration of directional mmWave links over the installed Passive Optical (PON) legacy infrastructure has been recently reported [56], verifying the potential of their successful coexistence with the existing deep fiber installations. Besides the attractive properties in terms of data transport capabilities, the pencil-beam antennas as well the high free-space-loss at these frequencies ensure spatial isolation and guarantee interference-free performance. These characteristics also enhance the security of mmWave communications by protecting from passively eavesdropping and actively jamming [57]. When malicious eavesdroppers want to intercept and decode the confidential messages successfully, they need to physically be within the transmission path of mmWave signals with narrow beams. To this end, we propose a hybrid Fiber-Wireless (Fi-Wi) P2 MP topology to deliver secured keys to multiple 5G terminal nodes where the optical segments can be safeguarded using QKD between the optical nodes and the wireless link is fortified through enhanced security features provided by the ultra-narrow mmWave beams.  
Figure 5 illustrates the proposed Fi-Wi topology supporting the secured P2 MP distribution using mmWave nodes to interconnect several 5G terminal nodes which are physically connected with mmWave mesh clients. In this topology, a shared fiber infrastructure is assumed for the interconnection of the BBU and the multiple mmWave mesh nodes. This shared fiber segment is assumed to support the secret key establishment, the classical data transmission and the communication protocols implementing the radio controller functions. For the needs of our analysis, each mesh node communicates, in turn, with four mesh clients via an Over-The-Air (OTA) link. This assumption can be easily satisfied from the radio equipment vendors providing 360-degree coverage mesh node [58]. Since the distilled secret keys at Bob stations located at mesh nodes are used to encrypt both the packetized data flow as well the Radio control and management messages, the key rate demands are significantly increased. In our study, we considered the use of parameters provided by commercially available mmWave radio nodes including the full list of their control functions involving encryption. According to the documentation provided by radio equipment vendor Siklu, the encryption of four control and management functions is based on the use of AES algorithm with maximum key lengths of 128 and 256 bits, respectively [59]). As was discussed in Section 2.1, by tuning the key rotation times to achieve different attack surfaces, a different amount of SKR is required. Regarding the latency component added by this mmWave link, the typical latency of the 10 Gbps Frequency Division Duplexing (FDD) radios is about 10 usecs [60], leading thereby to a slightly shorter fiber distance of 17 km which satisfies the end-to-end latency budget of 3 ms for ultra-low services. The use of Time Division Duplexing (TDD) radios adding a typical latency of 350 usecs can be considered for scenarios where delay insensitive services are targeted.  
Figure 5: Fi-Wi topology supporting the secured P2 MP distribution using mmWave nodes to interconnect several 5G terminal nodes which are physically connected with mmWave mesh clients.