## 2 Materials and Methods
### Dark Fiber Topology  
The first part of our study focuses on the performance of a typical 5G Ethernet-based fronthaul segment operating with eCPRI interfaces, for which the Alice station for QKD layer was hosted on the Baseband Unit (BBU) node while a dark fiber link was considered for the distribution of quantum keys to the Bob station located at the 5G Terminal Node, as illustrated in Figure 1. The selection of an equal length telecom fiber for the QKD layer allows for a quantum transmission without the contamination of noise photons associated with the presence of intense classical data flows. The use of eCPRI transport layer facilitates the splitting of some of the baseband functions between the Radio Equipment Control (REC) hosted at the Baseband Unit (BBU) Node and the Radio Equipment (RE) at the 5G Terminal Node. In our study, we assumed a fixed transport line rate of 10 Gbps over the dedicated fiber link. This topology should also be subject to the 5G fronthaul latency requirements imposed for low-latency services. More specifically, the sum of transmission delays and baseband processing time at BBU must be less than 3 ms [28]. In contrast to the reported methodology in [28] where the exchange of symmetric keys was realized over the classical communication channel, our proposed distribution scheme of quantum keys between the REC and RE nodes is naturally dependent on the fiber fronthaul distance. This link distance dependence appeared since the optical loss eliminates the photon detections at the Bob station, thereby lowering the available Raw Key Rate and subsequently the Secure Key Rate (SKR) for the AES-based encryption/decryption engines. Concerning the latency components of the fronthaul segment, the QKD layer introduces an additional latency component associated with the key distillation process, an essential post-processing step to guarantee the unconditional security. As calculated in Appendix A, for a round-trip processing of less than 3 ms, the fiber fronthaul distance is limited to be less than 17 km. Moving towards networks where multiple 5G terminal nodes need to establish a secure communication link with a centralized BBU node, there exist two alternative approaches for the interconnection of the QKD stations undertaking this task. The first one lies in the one-to-one dedicated links interconnecting the number of Alice and Bob stations respectively. On the other hand, if one node hosts the source or the detection unit serving more than one link, then this could lead to significant complexity and cost reduction, at the expense of lowering the key rates. Recently, a time-division multiplexing (TDM) technique was demonstrated using a single set of photon detectors (one Bob station) to establish QKD channels with four users (four distinct Alice stations) [32]. Driven by the ongoing developments on the miniaturization of upconversion-assisted silicon photon detectors relying on the use of integrated quantum photonic chips [33], we present a scheme where one centralized transmitter (Alice) can communicate with multiple quantum receivers (Bob stations). This approach can also exploit the centralized baseband resources to efficiently perform the postprocessing modules at higher speeds for correcting the quantum-channel noise errors and distilling identical corrected keys between Alice-Bob stations. Figure 2 shows the modification of our proposed secured fronthaul layer to support multiple 5G terminal nodes. This multi-user extension relies on the use of a centralized Alice station distributing single-photons to multiple Bob stations located at the Remote Radio nodes. In more  
Figure 1: Quantum-secured evolved Common Public Radio Interface (eCPRI) transport layer interconnecting the Baseband Unit (BBU) and the 5G terminal nodes. A dedicated fiber link is used for quantum key exchange between Alice and Bob stations. detail, a single-photon emitter (Alice) is located in the BBU and a single and independent Bob station (quantum receiver) for each one of the 5G terminal nodes of the network.