Centralised Key Management System Architecture for Topology‐Aware and Quantum‐Resilient Security in QKD‐Integrated SDN Control Planes

Software‐defined networking (SDN) consolidates network control at a centralised controller, making the southbound TLS‐protected channel between the controller and OpenFlow switches the principal security boundary of the entire network. Classical public‐key mechanisms underpinning this channel—RSA, ECDHE and X.509 certificate infrastructure—are fundamentally threatened by Shor's algorithm, which solves their underlying hard problems in polynomial quantum time. This paper presents the design, implementation and experimental evaluation of a key management system (KMS) serving as the central trust anchor in a fully quantum key distribution (QKD)‐integrated SDN architecture. We formally characterise the KMS's two interdependent roles: (i) a topology role , mediating all BB84‐derived quantum key material to every OpenFlow switch while enforcing hierarchical role‐based access control (RBAC) and maintaining three distinct key‐type domains; and (ii) a security role , operating a formally specified four‐state lifecycle state machine with pre‐emptive refresh that eliminates cryptographic downtime, AES‐256‐GCM key storage backed by a software keystore (extensible to HSM/TPM in production deployments) and a tamper‐protected audit subsystem. The system is implemented entirely in Python 3.10 on the Ryu 4.34 SDN framework with Open vSwitch 2.17 and evaluated in a two‐tier Mininet testbed comprising 12 OpenFlow switches, 24 hosts and dual redundant controllers. Over 30 statistically independent trials, full key synchronisation completes in 1.72 s for 12 switches at a sustained rate of 20.9 keys/s ( ≈ 144 ms per switch); automatic key refresh incurs a bounded transient CPU spike from 22% to 37%, resolving within 15 s; and dual‐controller failover mediated by the KMS completes in 1.17 s on average with zero standing packet loss. Total performance overhead relative to classical RSA + TLS is 19%–33% across all measured metrics, establishing the practical deployability of the proposed KMS architecture for quantum‐safe SDN control planes.