## 3 Problem Statement
### Network Model
The key resources required by the service are compared to judge whether the link can provide the key quantity meeting the service requirements within the service duration. If the key resources on the selected link are sufficient, the secret key resources for the working path are allocated. Then, the protection path resource allocation stage is performed. However, if the key resources on the selected link are insufficient, the hop link with insufficient resources in the network topology should be abstracted, which means disconnecting it provisionally. After that, the process returns to the previous routing stage, and the new shortest path in the new topology is calculated, carrying out the process mentioned above. The process is repeated until the appropriate working path is found. The link abstraction interrupt flag will not be erased until the last path in the set of the possible paths set \(P\) cannot meet the key service requirements. Lastly, there is the process of protection path and secret key resource allocation. The working paths in the path set \(P\) and the paths previously disconnected due to insufficient resources are removed, retaining the remaining optional paths in the network. Then, the _Dijkstra_ algorithm is used to calculate the shortest path in the QKDN topology at this time, which is temporarily marked as the protection path. Then, it is judged whether the remaining key resources of the link are sufficient for each hop link along the temporarily marked protection path by comparison. If the key resources on the link are sufficient, the next judgment step can be entered. However, if the key resources on the link are insufficient, the hop link should be abstractly disconnected, and the protection path needs to be reselected. The process is repeated until the appropriate protection path is selected. After the protection path resource allocation is successful, the key resources in the network are updated. The whole topology is traversed to ensure that the key resources, link spectrum wavelength time slot resources and other status information on each link are updated. When the service leaves, all the resources allocated to it are retracted. However, when the key resources on the network are limited, the unrestricted occupation of key resources by the protection path may lead to higher blocking rate of key service requests. To solve the problem, the key protection threshold \(T_{p}\) is proposed, the calculation method of which is as follows. The key protection threshold \(T_{p}\) is the product of the current remaining key resources \(T_{h}\) of the link and \(\eta\). \(\eta\) is a constant between 0 and 1 related to the key protection threshold, which can be adjusted as needed. The problem can be effectively solved by increasing the comparison between the number of keys required by the service and the key protection threshold. QKD needs to take optical fiber resources as the transmission medium and provide users with secure keys through wavelength division multiplexing technology. The key resources mentioned above refer to the wavelength and time slot resources in the channel. The number of quantum signal channels (QSCH) in a fiber link can be multiple, and QSCH can be divided into several time slots (TS). The key resources of each service request need to occupy several time slots, which are measured by unit/s. Figure 3 shows an example of the algorithm. The initial network topology is assumed as shown on the left. According to the method of network topology abstraction process, the abstract network topology is shown on the right in Figure 3. Dashed lines between node pairs represent virtual direct links, while solid lines between node pairs represent physical direct links. The link generation key resource rate is set to 50 unit/s. \(\eta\) is set to 0.8. Supposing service request 1 and service request 2 arrive at the same time, their routing and transmission in the link are shown in Table 2.  
Figure 3: Process of network topology abstraction.