Milo Grillo
email: milo.grillo@math.ethz.ch

Alexis A Dowhuszko
email: alexis.dowhuszko@aalto.fi

Mohammad-Ali Khalighi
email: ali.khalighi@fresnel.fr

Jyri Hämäläinen
email: jyri.hamalainen@aalto.fi

Resource allocation in a Quantum Key Distribution Network with LEO and GEO trusted-repeaters

Keywords: Quantum Key Distribution, LEO/GEO satellite networks, Centralized resource allocation, Multi-commodity flow

Quantum Key Distribution (QKD) is a technology that enables the exchange of private encryption keys between two legitimate parties, using for this purpose different protocols that involve components of quantum mechanics. Since the rate at which secret keys can be exchanged depends on the attenuation that the optical signals experience, it is convenient to replace terrestrial fibers with optical satellite links to implement a QKD network at a global scale. Then, satellite nodes can take the role of trusted-relays, forwarding the secret keys from the sources to the destinations. However, since the rate at which secret keys can be generated in each quantum link is limited, it is very important to select the intermediate satellite nodes to inter-connect ground stations efficiently. This paper studies the most convenient allocation of resources in a QKD network that combines both GEO and LEO satellites, which provide complementary services according to their position in the sky. The aim of the centralized routing algorithm is to select the most convenient trusted-relays to forward the secret keys between pairs of ground stations, verifying the constraints that satelliteto-ground and inter-satellite quantum channels have in practice.

I. INTRODUCTION

Quantum Key Distribution (QKD) networks enable the distribution of secret keys between two legitimate parties by encoding the information in one of two randomly chosen nonorthogonal quantum states [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF]. The security of QKD is not based on the computational hardness of solving mathematical problems, but rather on physical processes that are not vulnerable to powerful computers [START_REF] Bacsardi | On the way to quantum-based satellite communication[END_REF]. QKD can be also classified as an optical technology, which automates the delivery of encryption keys between any two points that share an optical link that could be either wired (fibers) or wireless (Free Space Optics). Unfortunately, QKD networks based solely on optical fibers face serious problems when trying to distribute secret keys in wide coverage areas. This is because the power loss that the physical communication channel introduces grows exponentially with distance, limiting the rate at which secret keys can be successfully exchanged over long coverage ranges [START_REF] Bedington | Progress in satellite quantum key distribution[END_REF].

The intrinsic point-to-point nature of a QKD system is a bottleneck for its applicability in global scale. Fortunately, the coverage range of a QKD system can be extended by using trusted-relays, which can be conveniently placed on satellite payloads to make them difficult to eavesdrop [START_REF] Simon | Towards a global quantum network[END_REF]. Apart from providing better security, optical satellite links experience less attenuation than optical fiber links, as most of the propagation losses are concentrated in the low-layers of the atmosphere [START_REF] Tomaello | Link budget and background noise for satellite quantum key distribution[END_REF]. Different satellite orbits can be used for this purpose, such as Geostationary (GEO) and Low Earth Orbit (LEO) satellites [START_REF] Bacsardi | On the way to quantum-based satellite communication[END_REF]. A GEO quantum satellite can provide a slow but continuous secret key generation rate, due to its fixed position on the sky at a very high altitude. In contrast, LEO quantum satellites are much closer to the Earth's surface and, due to that, they can provide a faster but intermittent secret key generation service [START_REF] Huang | Quantum key distribution over double-layer quantum satellite networks[END_REF].

Most of the research done so far in the literature considered the use of LEO satellites for QKD, taking advantage of their low channel loss [START_REF] Bedington | Progress in satellite quantum key distribution[END_REF]. However, since a quantum LEO satellite is only visible to a particular Ground Station (GS) for a limited time period, the secret key rate that is predicted is only available during the flyover time, few times a day [START_REF] Bourgoin | A comprehensive design and performance analysis of low Earth orbit satellite quantum communication[END_REF], [START_REF] Liao | Satellite-relayed intercontinental quantum network[END_REF]. Trying to provide a continuous QKD service, there are other authors that considered the use of a constellation of LEO satellites with inter-satellite links, similar to the IRIDIUM satellite system [START_REF] Pratt | An operational and performance overview of the IRIDIUM low earth orbit satellite system[END_REF], or the addition of GEO satellites to enable continuous service [START_REF] Tomaello | Link budget and background noise for satellite quantum key distribution[END_REF]. However, in most of these cases, the most convenient allocation of resources was not studied in detail for the whole (global) QKD network, or the routing and key allocation for the satellite-to-ground and inter-satellite links was done using heuristic algorithms that do not necessary reflect the actual constraints of the satellite QKD network [START_REF] Huang | Quantum key distribution over double-layer quantum satellite networks[END_REF].

In this paper, we study the resource allocation problem of a QKD network that combines both GEO and LEO satellite constellations to enable an exchange of secret keys in a global coverage. The BB84 protocol with decoy state is considered in the quantum channels [START_REF] Lo | Decoy state quantum key distribution[END_REF], and the relay of secret keys between ground stations is performed with the aid of trustedrelays in the satellites [START_REF] Liao | Satellite-relayed intercontinental quantum network[END_REF]. By abstracting the GS and quantum satellites as nodes, the quantum channels as edges, and the amount of available secure keys as weights, the satellite QKD network was modeled as a time varyingGraph [START_REF] Li | Mathematical model and topology evaluation of quantum key distribution network[END_REF]. Then, the optimal routing and resource allocation for the QKD network is determined in a centralized way, solving an equivalent Linear-Programming problem with constraints in the GEOto-GS, LEO-to-GS, and LEO-to-LEO quantum links.

The rest of the paper is organized as follows: Section II presents the system model of the satellite QKD network, including the formulas that estimate rate at which secret keys can be generated the space-to-ground and inter-satellite link. Section III introduces the graph representation of the QKD network at a given time instant, and derives the algorithm that optimizes the routing and flow of secret keys in a centralized Fig. 1. Overview of the QKD network that combines GEO and LEO trustedrepeaters. The Central Control Unit knows the rate at which secret keys can be generated on the ground-to-space and inter-satellite quantum channels (dashed blue lines), determines the most convenient routing on the classical channels (solid blue lines) to optimize the flow of secret keys, and informs these decisions to the QKD nodes using the control channels (red solid lines).

way. The parameters of the simulation setting, as well as the performance analysis of the obtained results, are presented in Section IV. Finally, conclusions and suggestions for future work are given in Section V.

II. SYSTEM MODEL

The simplified model of the satellite QKD network that combines both LEO and GEO trusted-repeaters is illustrated in Fig. 1. It consists of a constellation of (few) GEO and (many) LEO satellites that provide service to a large number of GSs that are sparsely deployed on the globe. Similar to terrestrial QKD networks based on optical fibers, the nodes of the satellite QKD network have quantum communication channels that are used to generate secret keys, and classical communication channels that are used to transport the QKD protocol signaling as well as to forward encrypted secret keys between non-directly connected nodes.

Let us also assume that the service area of the whole QKD network is divided into non-overlapping regions served by a GS, whose associated users receive the secret keys using terrestrial optical fiber networks. Without loss of generality, we consider that each GS is equipped with three Free-Space Optical (FSO) transceivers, which enable the connectivity with the GEO satellite and (up to two) LEO satellites that may be visible on the sky at each time window. Each LEO satellite relies on two FSO links for inter-satellite connectivity and two FSO link for space-to-ground QKD (i.e., LEO-to-GS). Note that the GEO satellite is always visible to the same GSs, whereas the visibility of a LEO satellite towards a given GS varies with the time of the day. Finally, it is considered that the centralized resource manager has access to the status of the whole QKD network in each time window (i.e., secret key pools in nodes and secret key rates per FSO link), and that is able to determine the most convenient route to exchange secret keys between each given pair of remote GSs.

A. Decoy state Quantum Key Distribution

In this paper, the QKD between space nodes (GEO/LEO) and ground nodes (GS) is carried out in downlink, from spaceto-ground. The QKD transmitters in the satellites use weak coherent laser pulses to implement the decoy-state Bennett-Brassard 1984 (BB84) protocol [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF], that is immune to photonnumber-splitting attacks from eavesdroppers.

Let us assume that we implement the BB84 protocol with vacuum-plus-weak-decoy-state [START_REF] Lo | Decoy state quantum key distribution[END_REF]. That is, we consider that Alice can prepare and emit a weak coherent state √ µ e jθ .

Assuming that phase θ of each signal is randomized, then the probability distribution for the number of photons of the signal state follows a Poisson distribution with a parameter µ, which represents the intensity of the signal states. In this situation,

P n (µ) = µ n e -µ /n!, (1)
is the probability that the pulse generated by Alice contains n photons. So, it is assumed that any mixture of photon number states with Poisson distribution can be prepared by Alice, with an intensity that can changed for each individual pulse.

A lower bound for the rate at which secret keys can be generated in this situation was presented in [START_REF] Lo | Decoy state quantum key distribution[END_REF], i.e.,

R bb84 ≥ q -Q µ f (E µ ) H 2 (E µ ) + Q 1 1 -H 2 (e 1 ) , (2)
where Q µ and E µ are the gain and Quantum Bit Error Rate (QBER) of the signal states, whereas Q 1 and e 1 are the gain and the error rate of single-photon states, respectively. Moreover, q = 1/2 is the efficiency of the BB84 protocol, f (x) = 1.22 is the bi-directional error correction efficiency for the Cascade protocol, and

H 2 (x) = -x log 2 (x) -(1 -x) log 2 (1 -x) (3)
is the binary Shannon entropy. For a coherent state, the gain and QBER of the signal states is given by

Q µ = ∞ n=0 Y n P n (µ), E µ = ∞ n=0 Y n P n (µ) e n /Q µ , (4)
where

Y n = Y 0 + δ n -Y 0 δ n ≈ Y 0 + δ n (5)
is the probability that Bob's measurement is conclusive when Alice emits an n-photon pulse, and

e n = Y 0 /(2 Y n ), δ n = 1 -(1 -δ) n (6)
are the error rate and attenuation of the n-photon signals.

The values of Q µ and E µ can be estimated directly from (4). However, the value of Q 1 cannot be determined in closed form and needs to be bounded based on other gains. According to [START_REF] Ma | Practical decoy state for quantum key distribution[END_REF], the gain and error rate of the single-photon states when using the vacuum-plus-weak-decoy-states method verify

Q L 1 = µ e -µ Y L 1 ≤ Q 1 , e U 1 = E ν Q ν e ν -e 0 Y 0 Y L 1 ν , (7)
where

Y L 1 = µ µν -ν 2 Q ν e ν -Q µ e µ ν 2 µ 2 - µ 2 -ν 2 µ 2 Y 0 ≤ Y 1 . (8)
The background yield Y 0 can be computed as the gain of the vacuum decoy state, whereas the background error rate e 0 = 1/2 due to dark counts happen randomly, so half of the times photons click on the correct detector in this situation.

B. Satellite based QKD network based on trusted-repeaters

Quantum satellites can be used as trusted-repeaters to generate secret keys between distant nodes that do not share a QKD link in common. For example, let us assume that source node S wants to generate a secret key with destination node D. To achieve this goal, S starts the process by generating a random key K s,d of suitable length, and forward it to an intermediate node I 1 performing a bit-wise Exclusive OR (XOR) operation (⊕) with a secret key of same length K s,i1 that shares with I 1 . This new string (K s,i1 ⊕ K s,d ) can be sent through a classical communication channel from S to I 1 , who can decode the original key with another XOR operation (i.e.,

K s,d = (K s,i1 ⊕ K s,d ) ⊕ K s,I1
). Then, the XOR operation is performed with the secret key shared between node I 1 and I 2 (K I1,I2 ), the resulting string of bits is transmitted over a classical communication channel, and the original key K s,d is recovered in the intermediate node I 2 . Note that this procedure is repeated until the secret key K s,d reaches D, consuming the same amount of secret keys in each of the links that are used.

The XOR operation that is performed to forward the random keys from the source GS to the destination GS consumes the secret keys that are available in each link. For this purpose, each LEO-to-GS, GEO-to-GS, and LEO-to-LEO link must generate secret keys continuously, and store them in quantum key pools associated to the different links of the QKD network. Due to the rate at which secret keys can be generated is limited, the centralized control system should optimize the route selection and key assignment, such that the limited resources of the QKD network are efficiently used.

Without loss of generality, we assume that the centralized controller has continuous access to the status of the whole QKD network, and that is able to perform the resource allocation to optimize the target objective, such as the maximization of key flows and the minimization of secret key consumption.

C. Attenuation of space-to-ground and inter-satellite links

The total attenuation that an FSO link experiences is defined as the ratio between the mean transmit and receive power, measured at the entrance and exit of the transmit and receive telescopes, respectively. When the optical receiver is placed in the far field of the transmitter (i.e., when L ≥ D 2 T /λ), the attenuation due to diffraction in the FSO link is given by [START_REF] Pfennigbauer | Free-space optical quantum key distribution using intersatellite links[END_REF]

δ diff = L 2 θ 2 T + θ 2 atm D 2 R 1 T T 1 -L P T R , ( 9
)
where L is the link distance, λ is the wavelength, D T (D R ) is the diameter of the transmit (receive) telescope, T T (T R ) is the transmit (receive) telescope transmission factor, and L P is the pointing loss due to misalignment between transmitter and receiver. The divergence angle resulting from the transmit telescope can be approximated by θ T = λ/D T , and the additional divergence caused by the atmospheric turbulence is given by θ atm = λ/r 0 , where r 0 is the Fried parameter. The attenuation due to diffraction is originated by the natural beam-broadering that light experiences when propagating, which makes that a certain faction of the transmitted power cannot be collected at the receiver when the received beam diameter is larger than the aperture of the receive telescope. Apart from the geometric loss in [START_REF] Pratt | An operational and performance overview of the IRIDIUM low earth orbit satellite system[END_REF], there are other losses to be considered when estimating the rate at which secret keys can be generated in a quantum channel. Therefore, the total attenuation that an optical wireless link experiences becomes [START_REF] Lo | Decoy state quantum key distribution[END_REF] where δ rec is the loss due to inefficiencies in the photon detection process and δ atm is the attenuation in the atmosphere originated in the absorption (δ abs ) and scattering (δ scat ) imposed by the constituent gases and particles of the atmosphere, as well as the atmospheric turbulence (δ turb ) caused by random fluctuations in the refractive index of the light-beam path.

δ = δ diff × δ atm × δ rec , δ atm = δ abs × δ scat × δ turb ,
III. CENTRALIZED OPTIMIZATION OF THE HYBRID SATELLITE QKD NETWORK This section introduces the graph representation of the QKD network topology, and derives the algorithm that optimizes the routing and flow of secret keys in a centralized way.

A. Dynamic Graph representation

All transceivers in our QKD network are represented by nodes in a weighted temporal graph. The weight of the edges between two nodes represent the secret key transfer rate between them. In our satellite QKD network, we distinguish between three types of nodes connected by FSO links, namely:

• GS nodes, which are stationary with respect to the Earth and can communicate with few GEO/LEO satellites at the same time. A GS aims at exchanging secret keys with other GSs, with whom it does not have a direct quantum communication channel. In graph technical terms, GS acts as either a source/destination node or as trusted-relay. • GEO satellite, which is stationary in an orbit that is relatively far from Earth's surface (i.e., at about 36000 km).

Due to that, the rate at which secret keys can be generated in GEO-to-GS links is relatively slow but constant. In the graph, a GEO node can only act as a relaying node. • LEO satellites, which are not stationary with respect to the Earth as they usually move from pole-to-pole, in sunsynchronous orbits. As a result, the rate at which secret keys can be generated varies in LEO-to-GS links, but may remain constant between LEOs in the same orbit.

The secret key rate is maximal when the distance between nodes is minimal. A LEO can only act as a relaying node. A very simple example of this graph representation is given in Fig. 2. The time-dependent connections are represented using dotted lines. Note that the amount of keys in the quantum key pool is, strictly speaking, time-dependent as the keys on link i are constantly generated by rate R i and consumed by the trusted-nodes. The generation rate R i depends on the distance D i between the nodes at both extremes of the link.

B. Multi-commodity flow problem

Consider a graph similar to the one shown in Fig. 2, with N gs ground stations, all connected by a network of LEO and GEO satellites. If we simply want to find the maximum amount of secret keys that GS A can exchang with GS Z, we can formulate this optimization problem as a max-flow problem and continue to solve it using straightforward path-finding techniques. When multiple GS want to exchange secret keys with multiple other GSs, one may be tempted to formulate the optimization problem as a multi-source, multi-sink max-flow problem. Although this formulation may be straightforward, it fails to consider that the keys sent out by a given source GS are aimed towards a specific destination GS, not just any arbitrary GS open to accept secret keys (i.e., the keys from the different GS should be considered as unique commodities).

This fact leads us to the multi-commodity flow problem formulation. Let us consider a flow network G = (V, E), where each edge (v, w) ∈ E has a maximum capacity u(v, w) ≥ 0. In our system, the capacity is the amount of secret keys in the key pool associated to the link (v, w). In our graph, k of the N GSs wish to exchange secret keys with other k GSs. So, we consider k commodities K 1 , K 2 , . . . , K k with K i = (s i , t t , d i ) ∀i, where s i and t i are the standard source, sink and demand of commodity K i , respectively. We define f i (v, w) as the flow of commodity K i on edge (v, w), which is the amount of secret keys of sort K i that are sent over the link (v, w). This flow has a few natural restrictions:

A) Link capacity. It is not possible to send more secret keys than the maximum amount dictated by the link capacity. That is, i∈K f i (v, w) ≤ u(v, w), ∀(v, w) ∈ E. B) Positive flow. It is not possible to send a negative amount of secret keys, i.e., f i (v, w) ≥ 0, ∀(v, w) ∈ E, i ∈ [k]. C) Flow conservation. At each relaying node, the same amount that flow in should flow out. However, for source and sink nodes, the flow should be (up to a minus sign) equal to the demand. That is, ∀v ∈

V, i ∈ [k], w∈Nv f i (v, w)- w∈Nv f i (w, v) =      0 if s i = v = t i d i if v = s i -d i if v = t i (11)
should be verified, where N v are the neighbours of v. A flow graph with such restrictions allows for several possible optimizations. One option is to maximize the total demand, i.e. a formulation in which the d i 's are not fixed and the goal is to maximise i∈[k] d i . Similarly, one could try to maximise min i∈[k] (d i ). A third reasonable optimization option is that, for a given a set of demands {d i } i∈[k] , minimize the total flow on the QKD network, i.e. to consume the least amount keys in the pools. Additionally, each flow can receive a weight that represent the relative cost of using each FSO link.

Algorithm 1 Greedy Rounding

Require: A Graph G = (V, E), with edge capacities, founds flows f per edge and commodity and demands d per commodity 1: Round down flows in f and adjust demands d accordingly 2: Subtract all the flows from their respective edge capacities 3: while available commodities exist do 4:

Pick k with lowest demand from the available commodities 5:

Using Dijkstra, find the path which consumes the least amount of secret keys to send one additional from source to sink 6:

if a route exists then All optimizations have a different purpose and interpretation, and in this paper we focus on the later two options: on one hand, the max-min demand optimization, which ensures that all GS pairs generate at least a given amount of secret keys, such that the path of one request does not hinder another requests. On the other hand, the min flow optimization, which ensures that the least amount of keys is consumed to fulfill all requests. Note that the later approach is useful when the QKD network needs to be prepared to handle future requests of key generations.

In case we only allow integer values for f i , these optimization problems become NP-complex [START_REF] Even | On the complexity of time table and multi-commodity flow problems[END_REF]. Though it makes sense to have only integer-valued flows in the QKD network (as keys cannot be split into parts), a relaxation that allows f i to take fractional values can be applied to solve the optimization problem using Linear Programming (LP) schemes. Then, in favor of the reduced algorithmic complexity, fractional-valued solutions can be first found and then rounded down to an integer value. This is justified by the fact that the demand d i in QKD is typically of the order of hundreds or thousands so, by rounding down, the relative loss is negligible.

The round down processing guarantees as well that the resulting flow-paths are feasible. However, it may also result in an unused link capacity. Therefore, after the first part of the algorithm is over, we obtain a new graph with reduced capacity. Then, we greedily choose the commodity K i with the lowest filled demand d i , and find a path from source s i to sink t i such that exactly one key can be sent over this path. If a path is found, the demand d i is increased by one, and the found path is added to the solution. If no path is found, the algorithm ends. This procedure is summarized in Algorithm 1.

To find the optimal fractional flows, we use a LP algorithm, which aims at finding a vector x, such that c T x is minimised while verifying Ax ≤ b, where c and b are two appropriate vectors and A is a matrix. The inequality is to be understood element-wise. By proper manipulation, the LP formulation can also allow equality restrictions. Standard LP problems can be solved using python packages, such as scipy [START_REF] Virtanen | SciPy 1.0: Fundamental Algorithms for Scientific Computing in Python[END_REF] End algorithm 8: end if 9: Round down flows and demands in x using Algorithm 1 10: return All values in x.

The restrictions A, B and C, as given above, allow for a LP formulation. By choosing the parameter x as the demands and the flows of all commodities, each edges in two directions filling the matrix A with 0, 1 and -1 at the correct places, and b with either 0 or the edge capacities, one can write the (in)equalities from the restriction in matrix form. Note that x will be of size at least #commodities×(2×#edges+1) if we keep d i variable, and #commodities × 2 × #edges if we fix d i , ∀i ∈ [k]. The algorithm for max-min demand optimization and the minimum resource usage given a set of requests are summarized as Algorithms 2 and 3, respectively2 .

IV. SIMULATION RESULTS

This section presents the parameters of the simulation setting and the performance analysis of the obtained results.

A. Parameters of the simulation scenario

The satellite constellation used in the simulations is shown in Fig. 3, where on each edge, the secret key generation rate is specified in bits-per-second (bps). In this setup, we assume that a GS may act as trusted-repeaters if convenient. Note that if only one FSO link is enabled per GS, the option to make it act as trusted-repeater becomes unfeasible. Without loss of generality, we assume that QKD network in Fig. 3 has been up for exactly one minute, starting from empty quantum key pools. This gives a setup with reasonable ratios between the sizes of the quantum key pools of the links. We investigate the case where the goal is to maximise the minimum of the met demands (i.e., max min i d i ), as well as the situation in which a set amount of requests is given. In satellite-based quantum communications, the uplink and downlink optical wireless channels are very different. Since the atmospheric turbulence occurs only in the last part of the downlink propagation path, near the terrestrial GS, the width of the light beam that enters the atmosphere is usually larger than the scale of the turbulent eddies. Due to that, the power loss due to the beam-wandering effect is minimal, and the attenuation losses are dominated by the diffraction effects considered in [START_REF] Pratt | An operational and performance overview of the IRIDIUM low earth orbit satellite system[END_REF]. Scintillation can occur at some extend, but the averaging effect of large ground telescopes makes the effect of turbulence negligible [START_REF] Hosseinidehaj | Satellite-based continuous-variable quantum communications: State-of-the-art and a predictive outlook[END_REF]. The FSO link budget parameters for the different space-to-ground and inter-satellite links are summarized in Table I. On the other hand, Table II, gives the parameters of the BB84 protocol with weak decoy states that was used, and makes an estimation of the secret key rates generated on the different QKD network links.

B. Performance analysis

In very simple cases, only the isolated exchange of secret keys between two GSs is required. Consider e.g. the exchange of secret keys between GS A and GS B. Table III compares the multi-commodity flow method with other methods, such as Dijkstra that simply chooses the shortest available path. The first row of Table III demonstrates that the max-min multi-commodity flow method already outperforms a standard shortest-path finding algorithm, as it allows for the large amount of keys to be split up and send over multiple links. The algorithm becomes even more interesting when actually handling multiple key exchanges at once. Whereas in case of the Dijkstra algorithm, the order of the requests is relevant, the Max-Min algorithm treats all requests equally, ensuring that all GS pairs can exchange a reasonable amount of keys.

With five GSs as in Fig. 3, there are 5 2 = 10 unique source sink combinations up to direction. Algorithm 2 finds out that it is possible to send at most 600 secret keys bits per GS pair before the QKD network becomes in outage. Note that this does not mean that no more additional secret key could be sent. Actually, when running Algorithm 3 with requests of size 600, it is possible to see that most of the links of the QKD network still have quantum keys in its pools. The only links in outage are those connecting the group {A, B, C} to {D, E}. This is because any exchange of secret keys between a GS from {A, B, C} to a GS in {D, E} must go through an inter-satellite link, which has a much lower secret key generation rate than a LEO-to-GS links due to the difficulty of placing large payloads on the space. This effect is well illustrated by the performance of the Max-Min multi-commodity flow algorithm, in Table IV, which shows the minimal demands filled by Algorithm 2 on few sample combinations. This table summarizes the amount of secret keys that would be consumed by sharing the given amount of keys on each pair of GSs, according to Algorithm 3, and the corresponding consumption rate, which is the amount of used keys per successfully sent out key. Indeed for the combinations involving GS A, GS B, and GS C,the algorithm finds that a minimum demand of 13, 500 bits is feasible.

V. CONCLUSIONS

This paper studied the resource allocation problem of a QKD network that combines both GEO and LEO quantum satellites, acting as trusted-repeaters, which use the BB84 protocol with decoy state to generate secret keys that are consumed when GS pairs exchange encryption keys securely. Starting from the graph representation of the QKD network in a given time window, an equivalent LP problem was presented, and two different algorithms were derived to maximize the minimum amount of keys exchanged in each GS pair, and the minimum amount of secret keys consumed in the space-toground and inter-satellite links to fulfill a given demand.

The results suggest that the max-min multi-commodity flow algorithm exhausts the link between two subsets of the nodes of the graph, with plenty of resources on links within the subsets. This could be taken into account by using the max- min flow algorithm recursively on the subsets until no more subsets can be created to fully exhaust the network.

The assumption to allow a GS to act as a trusted-repeaters could be considered questionable. A straightforward solution would be to allow each GS only one link. A more complex solution, which would allow multiple connections, would be to take out the GS nodes from the flow graph, give each commodity multiple sinks and sources, which would then be the satellites which have a link with the GS. The restrictions of the demands would be based on the size of the QKPs of the links. Similar to section III-B, a linear system of the flows and demands can be created, to be solved using LP. ACKNOWLEDGMENT This publication has been based upon work from COST Action CA19111 NEWFOCUS, supported by COST (European Cooperation in Science and Technology).

Fig. 2 .

 2 Fig. 2. Graph representation of a simplified QKD network topology that combines two GEO satellites, three LEO satellites, and two ground stations.

7 :

 7 Add one to the demand and respective flows in found path; subtract one from the capacity of the edges on the path 8:

  end while 12: return All rounded down flows and demands.

1 . 1

 11 Scipy's linprog optimization allows for upper bound constraints in the form A ub x = b ub , a matrix equality Aeqx = beq, and strict bounds L ≤ x ≤ U which significantly simplifies the notation.

Algorithm 2 2 :

 22 Routing: Maximise minimum demand (MMD) Require: A Graph G = (V, E) with capacities per edge 1: for all GS pairs (a, b) ∈ {a, b : a, b ∈ VGS, a = b} do Create a commodity Ki = (a, b, di), where di is variable 3: end for 4: Translate graph restrictions to LP matrix notation, i.e., find A and b such that A x ≤ b, where x = (t, d1, . . . d k , f 1 1 , f 1 1 , . . . , f k n ), with t a dummy variable and cost c = (-1, 0, . . . , 0) 5: Find x by LP 6: Round down flows and demands in x using Algorithm 1 7: return All values in x except t. Algorithm 3 Routing: Minimize resource usage (MR) Require: A Graph G = (V, E) with capacities per edge. A set of key exchange requests r with given amounts 1: for all exchange request r = (si, ti, di) do 2: Create a corresponding commodity Ki = (si, ti, di) 3: end for 4: Translate graph restrictions to LP matrix notation, i.e., find matrix A and vector b such that A x ≤ b, where x = (f 1 1 , f 1 1 , . . . , f k n ) and a relative cost c = by default (1, 1, . . . , 1) 5: Find x by LP 6: if no solution is found then 7:

Fig. 3 .

 3 Fig. 3. Schematic representation of the GSs and the satellite constellations setup for a given time window. Each edge specifies the key generation rate.

TABLE I FSO

 I LINK PARAMETERS FOR SPACE-TO-GROUND (LEO-TO-GS AND GEO-TO-GS) AND INTER-SATELLITE (LEO-TO-LEO) LINKS.

	Parameter (Notation)	LEO-to-GS	GEO-to-GS	LEO-to-LEO
	Wavelength (λ)	850 nm	650 nm	1550 nm
	Transmitter aperture (D T )		30 cm
	Receiver aperture (D R )	100 cm	100 cm	30 cm
	Pointing loss (L P )	7 dB	1 dB	3 dB
	Telescope factors (T T / T R )		0.8 / 0.8
	Detector efficiency (δrec)	65%	65%	65%
	Atmospheric loss (δatm)	1 dB	1 dB	0 dB
	Link range (L min ; Lmax)	(800 km; 1200 km)	(36000 km; 42000 km)	4000 km

  Gain signal states (Qµ) 1.96 × 10 -3 1.27 × 10 -5

			TABLE II
	PARAMETERS FOR THE BB84 PROTOCOL WITH WEAK-DECOY-STATES.
	Parameter	LEO-to-GS	GEO-to-GS	LEO-to-LEO
	Wavelength (λ)	850 nm		650 nm	1550 nm
	Link distance (L)	1000 km		39000 km	4000 km
	QKD scheme	BB84 weak decoy states (µ = 0.3; ν = 0.1)
	Dark counts (Y 0 )	1.7 × 10 -6	1.7 × 10 -6	1.7 × 10 -6
					2.26 × 10 -5
	QBER signal states (Eµ)	0.04%		6.68%	3.76%
	Gain vacuum states (Qν ) 3.28 × 10 -4 5.38 × 10 -6	8.66 × 10 -6
	QBER vacuum states (Eν )	0.26%		15.81%	9.81%
	Secret key rate (R bb84 ) ∼ 1000 bps		∼ 10 bps	∼ 40 bps
			TABLE III
	COMPARISON OF ELEMENTARY RESULTS FROM DIFFERENT METHODS.
	MULTIPLE REQUESTS INTERPRETED AS SEQUENTIAL IN DIJKSTRA.
	Path	Method	Max-min demand	(sequential) Dijkstra
		A → B	27,000		24,000
		A → E	3,600		600
		C → D	3,600		600
	C → A, B → A	13,500 & 13,500	24,000 & 2,400
	B → A, C → A	13,500 & 13,500	24,000 & 2,400

TABLE IV RESULTS

 IV FOR THE REQUESTS HANDLED BY GS COMBINATIONS.

	Combi-Min. filled demand Total consumed	Consumption rate
	-nations	by MMD	keys by MR (#used keys/#sent key)
	A, B	27,000	56,400	2.09
	A, D	3,600	19,200	5.3
	A, B, C	13,500	106,800	2.64
	A, B, D	1,800	20,400	3.78
	A, B, D, E	900	18,000	3.33
	All GSs	600	18,000	3.00

In the algorithms, we note that if f (v, w) = f k j , then f (w, v) = f k j .


Oussama Haddad

Mohammad Ali Khalighi
email: ali.khalighi@fresnel.fr

Anatolij Zubow

Wireless Body-Area Networks in Medical Applications Using Optical Signal Transmission

Keywords:

We consider optical wireless technology-based medical wireless body-area networks (WBANs). After presenting the most recent results on channel modeling and signal transmission, a new multiple access MAC layer scheme is proposed for intra-WBAN links.

Introduction

Wireless body-area networks (WBANs) have recently received increasing attention thanks to the advances made in the very large-scale integration of sensors and actuators. In medical applications, WBANs can be used for realtime vital signs remote monitoring of patients in health-care centers and elderly people at home [START_REF] Movassaghi | Wireless body area networks: A survey[END_REF]. A WBAN consists of a set of sensor nodes (SN) that are connected to a coordinator node (CN) through intra-WBAN links. The CN then transmits the collected data to a mobile device or a fixed access point (AP) via an extra-WBAN link [START_REF] Haddad | Channel characterization and modeling for optical wireless bodyarea networks[END_REF][START_REF] Hasan | Performance analysis of Optical-CDMA for uplink transmission in medical extra-WBANs[END_REF]. WBANs have stringent requirements regarding energy consumption and latency, as well as specific characteristics such as the non-stationary nature of the networks due to the movement of the patients, and the heterogeneity of applications [START_REF] Haddad | Enabling communication technologies for medical wireless body-area networks[END_REF]. Concerning WBAN wireless connectivity, most research works consider the use of RF technologies in the unlicensed ISM bands, which are subject to interference and data security issues [START_REF] Movassaghi | Wireless body area networks: A survey[END_REF][START_REF] Haddad | Enabling communication technologies for medical wireless body-area networks[END_REF]. This has motivated the consideration of optical wireless communications (OWC) as an interesting alternative technology for medical WBANs. OWC has the advantages of immunity to external interference, inherent security due to the indoor confinement of light, and a negligible small-scale fading effect [START_REF]Visible Light Communications: Theory and Applications[END_REF].

OWC-based WBANs for medical monitoring

Figure 1 illustrates a typical scenario of a hospital ward with several patients equipped with medical WBANs. Intra-WBAN connectivity is realized through infra-red (IR) links, assuming that the SNs are not covered by the patient's cloths. For extra-WBANs, IR links are used for uplink (i.e., from the CN to the AP), and visible-light (VL) links are used for downlink, which can be conveniently done through the LED luminaires. Interference between intra-and extra-WBAN IR links can be avoided by using different wavelengths. Nevertheless, efficient multipleaccess (MA) signaling should be used to avoid interference between the (extra-WBAN) signals of different users, as well as between the (intra-WBAN) links of the different SNs. Whereas the optical code-division multiple access (O-CDMA) has been shown to be a suitable MA scheme in the physical (PHY) layer for the case of extra-WBANs [START_REF] Hasan | Performance analysis of Optical-CDMA for uplink transmission in medical extra-WBANs[END_REF], managing MA interference in intra-WBAN links is more challenging.

Channel characterization and basic PHY design for optical WBANs

The specificities of optical WBANs include high sensitivity to body shadowing and negligible small-scale fading effect. Considering a realistic mobility model for a user inside a typical hospital room, and based on extensive Monte Carlo ray-tracing simulations, [START_REF] Haddad | Channel characterization and modeling for optical wireless bodyarea networks[END_REF][START_REF] Haddad | Channel characterization for optical extra-WBAN links considering local and global user mobility[END_REF] showed the high impact of the body position and orientation inside the room on the variations of the channel gain. The optical channels can nevertheless be considered as effectively flat for low-to-moderate data-rates. They also have slower time variations (typical coherence times of a few seconds), compared to the RF counterparts (coherence times of tens of ms). This allows using larger packet sizes for the former, thus a lower pilot overhead and a simplified power control over successive frames. To evaluate the link performance in a practical scenario, [START_REF] Haddad | Channel characterization and modeling for optical wireless bodyarea networks[END_REF][START_REF] Haddad | Channel characterization for optical extra-WBAN links considering local and global user mobility[END_REF] proposed best-fit statistical models (to ray-tracing simulated data) for the channel gain. For the cases of intra-and extra-WBAN links, the Gamma distribution and non-parametric kernel density estimation based on Gaussian kernel were proposed, respectively. For intra-WBAN connectivity, the link performance is significantly affected by shadowing resulting from local body mobility, which also depends on the position of the CN. Another consideration is the transmit optical power, given the eye-safety limitations and the typical ambient light level, and accordingly, the choice of the photodetector at the receiver (Rx). For the intra-WBAN case, given the constraints on the system complexity and power consumption, a PIN-based Rx (CN) is the suitable choice. However, for extra-WBAN uplink, using an avalanche photodiode at the Rx (AP) is suggested except under strong background radiations; this allows increased robustness against shadowing when using a more sensitive PD, as well as reduced required IR power level at the Tx (CN). Lastly, the extra-WBAN link reliability can be significantly improved by using multiple APs (see Fig. 1).

Addressing MA for intra-WBAN links

When several patients share the same hospital ward, the used MA scheme should avoid inter-sensor interference for a given user (interference in uplink operation from SNs towards CN), as well as the interference of the sensors of a user with those of another user. Given the potentially large number of SNs that could be used for each patient, developing a robust MA scheme in the PHY layer is quite challenging. More efficient MA management can be achieved through the medium access control (MAC) layer by minimizing packet collisions and their scheduling to ensure acceptable energy consumption and access delay. MAC protocols can be divided into two major categories of contention-based and scheduled-based protocols. The former protocols such as carrier-sense MA with collision avoidance (CSMA/CA) are not energy efficient enough for our application and have a larger latency when the traffic is unpredictable, whereas scheduled-based protocols are not sufficiently spectrally efficient, given the heterogeneous traffic of the medical sensors [START_REF] Otal | Design and analysis of an energy-saving distributed MAC mechanism for wireless body sensor networks[END_REF]. This motives the use of distributed queuing (DQ) based protocols, which can address the both above-mentioned issues [START_REF] Pandey | An energy efficient distributed queuing random access (EE-DQRA) MAC protocol for wireless body sensor networks[END_REF]. Given the potentially large number of medical sensors and the presence of several users, even with DQ, the probability of successful access to the channel and data transmission throughput could be very low. This latter issue can be dealt with optical orthogonal frequency-division MA (O-OFDMA) or multi-band carrier-less amplitude and phase modulation (m-CAP) [START_REF] Haigh | Multi-band carrier-less amplitude and phase modulation for bandlimited visible light communications systems[END_REF].

DQ MAC protocol with m-CAP signaling

Here, we propose to combine the DQ random access with multi-user (MU) m-CAP to provide both efficient random access and data transmission capability for optical intra-WBANs. As illustrated in Fig. 2a, the frame structure of DQ-MAC is composed of three parts: a contention resolution (CR) window, which is divided into M CR mini-slots for the transmission of access-request sequences (ARS); a contention-free data transmission (DT) window; and a window for downlink feedback packet (FBP) from the CN. The basic idea of DQ-MAC is to restrict the users contention to short access-requests while keeping the larger frame part for sending data. Figure 2b illustrates the system model of the proposed multichannel (i.e. m-CAP based) DQ scheme. It consists of three subsystems of new-user access control (NAC), CR, and DT. The NAC prevents newly arrived SNs to contend for CRs until the resolution of all previous collisions. Then, at the start of a new frame, SNs which have data to send and which have not yet sent an ARS, will randomly choose one of the M available CRs. Depending on the reception status at the CN side, SNs will enter either the CR queue (CRQ) in the case of collision detection, or the DT queue (DTQ) otherwise. This information is notified to the SNs in the FBP at the end of the frame [START_REF] Otal | Design and analysis of an energy-saving distributed MAC mechanism for wireless body sensor networks[END_REF]. For SNs that enter the CRQ, a tree-splitting algorithm is used to resolve the contentions. Also, SNs that successfully enter the DTQ will be allowed to transmit their data in a first-in first-out order, where up to m SNs can transmit within a single DT window over the available m sub-bands of the MU m-CAP scheme.

Numerical Results

Figure 3 shows the simulation results using MAC from [7, Table 1], and considering an ideal channel (i.e., with no packet loss due to transmission). For the sake of comparison, two cases of RF-and OWC-based networks are considered. Power consumption in transmit, receive, and idle modes are respectively set to 22.09, 35.23, and 0.712 mW for the RF transceiver (acc. ZigBee), and 40, 0.5, 0.3 mW for the OWC transceiver (acc. IrDA). From Fig. 3a, we notice the decrease in energy consumption of DQ schemes for the cases of RF and single channel (OOK) and multichannel (10-CAP) OWC, assuming a traffic load of λ = 0.8 packets/frame. OWC allows a reduced energy consumption for payloads shorter than 120 bytes. From Fig. 3b, interestingly, energy consumption does not increase considerably with increase in λ for OWC-based systems. Nevertheless, the RFbased system has a lower energy consumption for λ 0.6. In fact, the energy consumption of OWC-based systems is higher in the transmit mode, but much lower in the receive and idle modes. For large λ , SNs will spend most of the time in idle/receive modes. Lastly, Fig. 3c shows the improvement in terms of average delay using m-CAP.

Conclusions and future research directions

This paper presented an overview of the recent research on OWC-based WBANs for medical applications. In order to manage the MA requirement, DQ in the MAC layer together with m-CAP transmission was proposed and its efficiency shown through numerical results. Future research will investigate the proposed scheme with realistic optical WBAN channel models, as well as its performance evaluation under heterogeneous traffic conditions.

Acknowledgment

This work was supported by the European Union's Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No. 764461 (VisIoN).

Fig. 1 :

 1 Fig. 1: Typical hospital ward scenario with several patients equipped with medical WBANs.

Fig. 3 :

 3 (a) Energy consumption vs. payload length for λ = 0.8, (b) energy consumption vs. traffic load, (c) average delay.