arXiv subjects

Jasone Astorga

Publications and source records attributed to Jasone Astorga.

16 recordsLinked to original sources

arXiv2026

SecDT: A Profile-Based Security Layer for TRDP Communications

The Train Real-time Data Protocol (TRDP) is widely used on rolling stock but it provides limited native support for cryptographic protection. Furthermore, the multicast traffic profile used in TRDP Process Data to exchange critical information between onboard subsystems makes the introduction of cryptographic protection a challenge. This paper presents a lightweight security layer for secure TRDP communication that implements a number of security profiles built around modern cryptographic algorithms. This additional layer relies on an On-board Key Management System (OKMS) for both security profile negotiation, dynamic key distribution and key lifecycle management. The security profiles allow for cryptographic agility and flexibility, ranging from simple authentication to Authenticated Encryption with Associated Data (AEAD) algorithms. The security profile negotiation procedure guarantees all TRDP End Devices (ED) on a common Communication ID (ComID) share the same security profile and can therefore process each other's messages. A prototype implementation based on mbedTLS and Arm Platform Security Architecture (PSA) was developed and evaluated. Experimental results demonstrate manageable overhead, suitable for the real-time and time-sensitive communication found on rolling stock.

cs.CR↗

arXiv2026

Quantum Homomorphic Encryption: Towards Practical and Private Computation on Untrusted Quantum Hardware

As quantum computing matures into a practical paradigm, the need for secure and private quantum computation on untrusted hardware becomes increasingly urgent. While classical fully homomorphic encryption has enabled computation over encrypted data in untrusted environments, a fully homomorphic and practically implementable quantum counterpart remains elusive. In this work, we propose a universal quantum homomorphic encryption (QHE) framework developed from the Quantum One-Time Pad (QOTP) scheme. Our approach (QOTPH) maintains information-theoretic security and supports a broad class of quantum operations on encrypted quantum states through a systematic set of homomorphic gate decompositions and key update rules. By leveraging the symmetric structure of QOTP and exploiting the transformation properties of quantum gates under Pauli encryption, we enable non-interactive homomorphic evaluation of arbitrary circuits expressible in the Clifford+T gate set, as well as controlled and parameterized operations relevant to variational quantum algorithms and delegated computation. We provide a formal specification of the proposed encryption model, detail its implementation procedure, and report the results obtained from both simulated environments and real quantum processors. Experimental validation demonstrates the correctness of the homomorphic operations and the preservation of key secrecy under circuit-level noise and real-device constraints. This work takes a step toward bridging the gap between theoretical quantum homomorphic encryption and practical realization on near-term quantum hardware, offering a scalable and symmetric cryptographic primitive for privacy-preserving quantum computation.

quant-ph↗

arXiv2026

IPsec based on Quantum Key Distribution: Adapting non-3GPP access to 5G Networks to the Quantum Era

The advent of quantum computing will pose great challenges to the current communication systems, requiring essential changes in the establishment of security associations in traditional architectures. In this context, the multi-technological and heterogeneous nature of 5G networks makes it a challenging scenario for the introduction of quantum communications. Specifically, 5G networks support the unification of non-3GPP access technologies (i.e. Wi-Fi), which are secured through the IPsec protocol suite and the Non-3GPP Interworking Function (N3IWF) entity. These mechanisms leverage traditional public key cryptography and Diffie-Hellman key exchange mechanisms, which should be updated to quantum-safe standards. Therefore, in this paper we present the design and development of a Quantum Key Distribution (QKD) based non-3GPP access mechanism for 5G networks, integrating QKD keys with IPsec tunnel establishment. Besides, we also demonstrate the feasibility of the system by experimental validation in a testbed with commercial QKD equipment and an open-source 5G core implementation. Results show that the time required to complete the authentication and IPsec security association establishment is 4.62% faster than traditional cryptography PSK-based systems and 5.17% faster than the certificate-based system, while ensuring Information-Theoretic Security (ITS) of the QKD systems.

cs.CR↗

arXiv2026

Towards Context-Aware Edge-Cloud Continuum Orchestration for Multi-user XR Services

The rapid growth of multi-user eXtended Reality (XR) applications, spanning fields such as entertainment, education, and telemedicine, demands seamless, immersive experiences for users interacting within shared, distributed environments. Delivering such latency-sensitive experiences involves considerable challenges in orchestrating network, computing, and service resources, where existing limitations highlight the need for a structured approach to analyse and optimise these complex systems. This challenge is amplified by the need for high-performance, low-latency connectivity, where 5G and 6G networks provide essential infrastructure to meet the requirements of XR services at scale. This article addresses these challenges by developing a model that parametrises multi-user XR services across four critical layers of the standard virtualisation architecture. We formalise this model mathematically, proposing a context-aware framework that defines key parameters at each level and integrates them into a comprehensive Edge-Cloud Continuum orchestration strategy. Our contributions include a detailed analysis of the current limitations and needs in existing Edge-Cloud Continuum orchestration approaches, the formulation of a layered mathematical model, and a validation framework that demonstrates the utility and feasibility of the proposed solution.

cs.NI↗

arXiv2025

QuLore: An Adaptive Security Framework to Extend Quantum-Safe Communications to Real-World Networks

The advent of quantum computing threatens classical cryptographic mechanisms, demanding new strategies for securing communication networks. Since real-world networks cannot be fully Quantum Key Distribution (QKD)-enabled due to infrastructure constraints, practical security solutions must support hybrid operation. This paper presents an adaptive security framework that enables quantum-safe communications across real-world heterogeneous networks by combining QKD and Post-Quantum Cryptography (PQC). Building upon a hierarchical key management architecture with Virtual Key Management Systems (vKMS) and a centralized Quantum Security Controller (QuSeC), the framework dynamically assigns security levels based on node capabilities. By transitioning between pure QKD, hybrid, and PQC modes, it ensures end-to-end quantum-safe protection regardless of the underlying node capabilities. The framework has been implemented and validated on a Kubernetes-based containerized testbed, demonstrating robust operation and performance across all scenarios. Results highlight its potential to support the gradual integration of quantum-safe technologies into existing infrastructures, paving the way toward fully quantum-safe communication networks.

cs.CR↗

arXiv2025

Toward quantum-safe scalable networks: an open, standards-aware key management framework

With the advent of quantum computing, the increasing threats to security poses a great challenge to communication networks. Recent innovations in this field resulted in promising technologies such as Quantum Key Distribution (QKD), which enables the generation of unconditionally secure keys, establishing secure communications between remote nodes. Additionally, QKD networks enable the interconnection of multinode architectures, extending the point-to-point nature of QKD. However, due to the limitations of the current state of technology, the scalability of QKD networks remains a challenge toward feasible implementations. When it comes to long-distance implementations, trusted relay nodes partially solve the distance issue through the forwarding of the distributed keys, allowing applications that do not have a direct QKD link to securely share key material. Even though the relay procedure itself has been extensively studied, the establishment of the relaying node path still lacks a solution. This paper proposes an innovative network architecture that solves the challenges of Key Management System (KMS) identification, relay path discovery, and scalability of QKD networks by integrating Software-Defined Networking (SDN) principles, and establishing high-level virtual KMSs (vKMS) in each node and creating a new entity called the Quantum Security Controller (QuSeC). The vKMS serves the end-user key requests, managing the multiple KMSs within the node and abstracting the user from discovering the correct KMS. Additionally, based on the high-level view of the network topology and status, the QuSeC serves the path discovery requests from vKMSs, computing the end-to-end (E2E) relay path and applying security policies. The paper also provides a security analysis of the proposal, identifying the security levels of the architecture and analyzing the core networking security properties.

cs.NI↗

arXiv2025

Leveraging 5G Physical Layer Monitoring for Adaptive Remote Rendering in XR Applications

As immersive eXtended Reality (XR) applications demand substantial network resources, understanding their interaction with 5G networks becomes crucial to improve them. This paper investigates the role of 5G physical-layer monitoring to manage and enhance the remote rendering of XR content dynamically. By observing network metrics directly from the physical layer, we propose a system to adapt streaming parameters such as bitrate, framerate, and resolution in real time based on available network capacity. Using theoretical formulas to estimate maximum data rate, our approach evaluates network resource availability, enabling the renderer to self-adjust media content representation. This is critical for providing consistent and smooth XR experiences to users, especially as network conditions fluctuate. Our findings suggest that physical-layer monitoring offers valuable insights to increase the Quality of Service (QoS) and has the potential to elevate user experience in remote-rendered XR applications.

cs.NI↗

arXiv2025

Privacy Enhanced QKD Networks: Zero Trust Relay Architecture based on Homomorphic Encryption

Quantum key distribution (QKD) enables unconditionally secure symmetric key exchange between parties. However, terrestrial fibre-optic links face inherent distance constraints due to quantum signal degradation. Traditional solutions to overcome these limits rely on trusted relay nodes, which perform intermediate re-encryption of keys using one-time pad (OTP) encryption. This approach, however, exposes keys as plaintext at each relay, requiring significant trust and stringent security controls at every intermediate node. These "trusted" relays become a security liability if compromised. To address this issue, we propose a zero-trust relay design that applies fully homomorphic encryption (FHE) to perform intermediate OTP re-encryption without exposing plaintext keys, effectively mitigating the risks associated with potentially compromised or malicious relay nodes. Additionally, the architecture enhances crypto-agility by incorporating external quantum random number generators, thus decoupling key generation from specific QKD hardware and reducing vulnerabilities tied to embedded key-generation modules. The solution is designed with the existing European Telecommunication Standards Institute (ETSI) QKD standards in mind, enabling straightforward integration into current infrastructures. Its feasibility has been successfully demonstrated through a hybrid network setup combining simulated and commercially available QKD equipment. The proposed zero-trust architecture thus significantly advances the scalability and practical security of large-scale QKD networks, greatly reducing reliance on fully trusted infrastructure.

cs.CR↗

arXiv2024

SareQuant: Towards a quantum-based communication network

This paper presents the SareQuant project, which aims to evolve the Basque NREN (National Research and Education Networks) into a quantum-based communication infrastructure. SareQuant focuses on the network design and on the integration of quantum technologies into real-world scenarios and applications. Therefore, this paper provides insights into the opportunities and challenges regarding the integration of quantum technologies, thus paving the way for a secure and advanced Quantum Internet.

cs.NI↗

arXiv2024

Preliminary approaches towards the integration of TSN communications into the NFV architectural framework

This paper presents a preliminary architecture for the integration of Time-Sensitive Networking (TSN) communications into the Network Functions Virtualization (NFV) architectural framework. Synergies between functional blocks and constructs of NFV, and components of TSN networks, are investigated in order to arrive at an integrated architecture. Additionally, mechanisms and configuration procedures to enable TSN-compliant, real-time, and virtualized end stations under the NFV framework are explored.

cs.NI↗

arXiv2024

Edge Rendering Architecture for multiuser XR Experiences and E2E Performance Assessment

Holographic communications are gaining ground among emerging eXtended-Reality (XR) applications due to their potential to revolutionize human communication. However, these technologies are characterized by higher requirements in terms of Quality of Service (QoS), such as high transmission data rates, very low latency, and high computation capacity, challenging current achievable capabilities. In this context, computation offloading techniques are being investigated, where resource-intensive computational tasks, like rendering XR experiences, are shifted from user devices to a separate processor, specifically an Edge Computing instance. This paper introduces an Edge Rendering architecture for multiuser XR experiences, implements it on top of widely employed XR and Web technologies, and proposes a method based on image and audio processing to evaluate its performance in terms of end-to-end media streaming latency, inter-device, and intra-media synchronization when employing different access networks.

cs.NI↗

arXiv2023

Multi-Layer Monitoring at the Edge for Vehicular Video Streaming: Field Trials

In an increasingly connected world, wireless networks' monitoring and characterization are of vital importance. Service and application providers need to have a detailed understanding of network performance to offer new solutions tailored to the needs of today's society. In the context of mobility, in-vehicle infotainment services are expected to stand out among other popular connected vehicle services, so it is essential that communication networks are able to satisfy the Quality of Service (QoS) and Quality of Experience (QoE) requirements needed for these type of services. This paper investigates a multi-layer network performance monitoring architecture at the edge providing QoS, QoE, and localization information for vehicular video streaming applications in real-time over 5G networks. In order to conduct field trials and show test results, Mobile Network Operators (MNOs)' 5G Standalone (SA) network and Multi-access Edge Computing (MEC) infrastructure are used to provide connectivity and edge computing resources to a vehicle equipped with a 5G modem.

cs.NI↗

arXiv2022

Too Many Options: A Survey of ABE Libraries for Developers

Attribute-based encryption (ABE) comprises a set of one-to-many encryption schemes that allow the encryption and decryption of data by associating it with access policies and attributes. Therefore, it is an asymmetric encryption scheme, and its computational requirements limit its deployment in IoT devices. There are different types of ABE and many schemes within each type. However, there is no consensus on the default library for ABE, and those that exist implement different schemes. Developers, therefore, face the challenge of balancing efficiency and security by choosing the suitable library for their projects. This paper studies eleven ABE libraries, analyzing their main features, the mathematical libraries used, and the ABE schemes they provide. The paper also presents an experimental analysis of the four libraries which are still maintained and identifies some of the insecure ABE schemes they implement. In this experimental analysis, we implement the schemes offered by these libraries, measuring their execution times on architectures with different capabilities, i.e., ARMv6 and ARMv8. The experiments provide developers with the necessary information to choose the most suitable library for their projects, according to objective and well-defined criteria.

cs.CR↗

arXiv2022

Towards integrating hardware Data Plane acceleration in Network Functions Virtualization

This paper proposes a framework for integrating data plane (DP) acceleration within the Network Functions Virtualization (NFV) architecture. Data plane programming (DPP) proves to be beneficial for NFV environments, as it provides full packet forwarding flexibility through the use of self-designed algorithms. Additionally, DPP provides high-performance networking, as the DP can be configured to execute specific functions on dedicated hardware. We present an integration of the DP acceleration within the ETSI NFV architecture that leverages custom DP functions implemented in hardware switches using P4 language. Besides, OpenStack and Kubernetes are used as Virtualized Infrastructure Managers (VIMs) and Open Source MANO (OSM) as the Management and Orchestration (MANO) element.

cs.NI↗

arXiv2022

End to End Secure Data Exchange in Value Chains with Dynamic Policy Updates

Data exchange among value chain partners provides them with a competitive advantage, but the risk of exposing sensitive data is ever-increasing. Information must be protected in storage and transmission to reduce this risk, so only the data producer and the final consumer can access or modify it. End-to-end (E2E) security mechanisms address this challenge, protecting companies from data breaches resulting from value chain attacks. Moreover, value chain particularities must also be considered. Multiple entities are involved in dynamic environments like these, both in data generation and consumption. Hence, a flexible generation of access policies is required to ensure that they can be updated whenever needed. This paper presents a CP-ABE-reliant data exchange system for value chains with E2E security. It considers the most relevant security and industrial requirements for value chains. The proposed solution can protect data according to access policies and update those policies without breaking E2E security or overloading field devices. In most cases, field devices are IIoT devices, limited in terms of processing and memory capabilities. The experimental evaluation has shown the proposed solution's feasibility for IIoT platforms.

cs.CR↗

arXiv2022

Securing IIoT using Defence-in-Depth: Towards an End-to-End Secure Industry 4.0

Industry 4.0 uses a subset of the IoT, named Industrial IoT (IIoT), to achieve connectivity, interoperability, and decentralization. The deployment of industrial networks rarely considers security by design, but this becomes imperative in smart manufacturing as connectivity increases. The combination of OT and IT infrastructures in Industry 4.0 adds new security threats beyond those of traditional industrial networks. Defence-in-Depth (DiD) strategies tackle the complexity of this problem by providing multiple defense layers, each of these focusing on a particular set of threats. Additionally, the strict requirements of IIoT networks demand lightweight encryption algorithms. Nevertheless, these ciphers must provide E2E (End-to-End) security, as data passes through intermediate entities or middleboxes before reaching their destination. If compromised, middleboxes could expose vulnerable information to potential attackers if it is not encrypted throughout this path. This paper presents an analysis of the most relevant security strategies in Industry 4.0, focusing primarily on DiD. With these in mind, it proposes a combination of DiD, an encryption algorithm called Attribute-Based-Encryption (ABE), and object security (i.e., OSCORE) to get an E2E security approach. This analysis is a critical first step to developing more complex and lightweight security frameworks suitable for Industry 4.0.

cs.CR↗