Method and apparatus for a software defined network

1 . A method performed by an apparatus in a Software Defined Network, SDN, the method comprising: receiving a request to define a virtual link, VL, in the SDN, the request including security constraint information for the VL; identifying from a network topology of the SDN physical links that are Quantum Cryptography, QC, enabled; wherein a physical link is QC enabled if endpoint nodes of the physical link have access to a shared Quantum key, Qkey; computing a path for the VL using only physical links of the identified QC enabled physical links; and initiating provisioning of the VL using the computed pathi wherein said identifying comprises interrogating QKD0 support information of the network topology physical links in a Traffic Engineering Database, TED, of the SDN to identify the physical links that are QC enabled, the QKD support information indicative of whether respective physical links are QC enabled; and wherein the QKD support information is provided within link topology definitions of the physical links in the TED.

2 . The method as claimed in claim 1 , wherein the QKD support information in the link topology definitions comprises one of a link type parameter indicative of whether the physical link is QC enabled or a link cost parameter indicative of whether the physical link is QC enabled.

3 . The method as claimed in claim 1 , wherein the endpoint nodes are supported by a quantum key distribution, QKD, infrastructure across which the shared Qkey has been exchanged.

4 . The method as claimed in claim 1 , wherein the security constraint information comprises a VL descriptor, VLD, including a sensitivity level attribute value indicative of whether the VL requires a path that is QC enabled.

5 . The method as claimed in claim 4 , wherein the sensitivity level attribute value is provided within a Connectivity Type information element of the VLD.

6 . The method as claimed in claim 1 , wherein the VL is for a security domain of the SDN.

7 . The method as claimed in claim 1 , wherein the VL is a lawful intercept, LI, interface.

8 . Apparatus for a Software Defined Network, SDN, the apparatus comprising: a controller configured to: receive a request to define a virtual link, VL, in the SDN, the request including security constraint information for the VL; and a Path Computation Element, PCE, ( 304 ) configured to: identify from a network topology of the SDN physical links that are Quantum Cryptography, QC, enabled; wherein a physical link is QC enabled if endpoint nodes of the physical link have access to a shared Quantum key, Qkey; and compute a path for the VL using only physical links of the identified QC enabled physical links, wherein the controller is further configured to initiate provisioning of the VL using the computed path a Traffic Engineering Database, TED, containing QKD support information of the network topology physical links and wherein the PCE is configured to interrogate the QKD support information in the TED to identify physical links that are OC enabled, the QKD support information indicative of whether respective physical links are QC enabled; wherein the QKD support information is provided within link topology definitions of the physical links in the TED.

9 . Apparatus as claimed in claim 8 , wherein the QKD support information in the link topology definitions comprises one of a link type parameter indicative of whether the physical link is QC enabled or a link cost parameter indicative of whether the physical link is QC enabled.

10 . Apparatus as claimed in claim 8 , wherein a physical link is QC enabled if endpoint nodes of the physical link have access to a shared Quantum key, Qkey.

11 . Apparatus as claimed in claim 8 , wherein the security constraint information comprises a VL descriptor, VLD, including a sensitivity level attribute value indicative of whether the VL requires a path that is QC enabled.

12 . Apparatus as claimed in claim 11 , wherein the sensitivity level attribute value is provided within a Connectivity Type information element of the VLD.

13 . Apparatus as claimed in claim 8 , wherein the apparatus comprises at least one processing circuitry and memory, the memory containing instructions executable by the at least one processing circuitry such that the apparatus is operative to implement the controller, the PCE and the TED as virtualised network functions, VNFs.

14 . A non-transitory computer-readable medium comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out a method according to claim 1 .

15 . Apparatus for defining a virtual link, VL, in a Software Defined Network, SDN, the apparatus comprising at least one processing circuitry and memory, the memory containing instructions executable by the at least one processing circuitry such that the apparatus is operative to: receive a request to define a virtual link, VL, in the SDN, the request including security constraint information for the VL; identify from a network topology of the SDN physical links that are Quantum Cryptography, QC, enabled; wherein a physical link is QC enabled if endpoint nodes of the physical link have access to a shared Quantum key, Qkey; compute a path for the VL using only physical links of the identified QC enabled physical links; and initiate provisioning of the VL using the computed path wherein said identifying comprises interrogating QKD support information of the network topology physical links in a Traffic Engineering Database, TED, of the SDN to identify the physical links that are QC enabled, the QKD support information indicative of whether respective physical links are OC enabled; and wherein the QKD support information is provided within link topology definitions of the physical links in the TED.