Method and device for sharing secret keys in a network including a satellite

Abstract

Method for distributing pairs of secure secret keys intended to secure communications between a first communication station (S1) and a second communication station (S2), said method comprising the following steps: exchanging, via a quantum channel (CQ1) linking a satellite (Sat) to said first communication station (S1), a first secret key; exchanging, via a quantum channel (CQ2) linking said satellite (Sat) to said second communication station (S2), a second secret key; receiving, in said satellite, a communication request between the first and second communication stations issued by said first or second communication station, referred to as the transmitting station; encrypting, in said satellite, the first secret key (by a symmetric encryption method which uses the second secret key (,in order to generate a first encrypted message ( ) and transmit said first encrypted message to said second communication station (S2) via an authenticated channel ( , called first authenticated channel. [Fig. 3A],

Description

Title of the invention: Method and device for sharing secret keys in a network comprising a satellite Technical field

[0001] The present invention relates to the field of information technology security and more particularly to the field of sharing encryption keys by satellite via quantum channels. Prior art

[0002] There has always been a need to exchange sensitive information that must remain secret over a public communication channel. Suppose two people, Alice and Bob, wish to exchange sensitive information over an authenticated public communication channel (e.g., the Internet), away from prying eyes. To do this, they must encrypt their messages. Let's call Eve the person who wants to intercept these messages. Alice must, using a published (i.e., non-secret) cryptographic function and a secret key, encrypt her messages before sending them to Bob over a public channel. When Bob receives the encrypted messages, he must, using the same cryptographic function and the same secret key as Alice, decrypt them to be able to access the information in plain text.

[0003] Now comes the problem of the secret key shared between Alice and Bob: how is it generated, how is it exchanged securely and away from prying eyes?

[0004] During secure exchanges on the internet, the establishment of a shared secret key is carried out using techniques based on public key cryptography that we do not detail here. A new solution was imagined at the end of the 20th century. It proposes to use a quantum channel that allows Alice and Bob to establish a common secret key by exchanging quantum particles (e.g. photons) without Eve being able to trace the key by intercepting these particles. However, this technique of sharing keys via quantum channels (QKD in English for Quantum Key Distribution) suffers from some limitations that make its application difficult to a large number of users and over very long distances. This could, in the long term, make this technique unattractive and therefore not profitable enough to generate industrial opportunities.

[0005] [Fig.l] schematically represents the architecture of a quantum channel which allows two users Alice (the particle transmitter) and Bob (the particle receiver) to establish a common secret key. The key is a sequence of bits, random, therefore being able to take as value 0 or 1. For example, in the BB84 protocol, Alice proposes key bits using two photon polarization modes prepared by Alice, the choice of the polarization mode is random. Alice notes for each bit (therefore each photon) the randomly chosen polarization mode. Using a polarizing filter and a photon detector which can be oriented alternately according to the two randomly chosen polarization modes, Bob notes the detection result (the photon exited the filter by the 'parallel' path or by the 'perpendicular' path to its axis.), as well as the chosen orientation of the filter.

[0006] In BB84, once the entire sequence has been transmitted, Alice sends Bob the polarization modes used for each detection via an authenticated clear channel. Bob can then deduce the value of the bits for which the polarization orientation was the same. He then knows with certainty NU bits on average for N bits transmitted by Alice, this sequence being called the reconciled key. This step can be accompanied by error correction methods using control values ​​and LDPC or cascade type algorithms, which use control parameters exchanged over the authenticated channel.

[0007] Finally, Alice and Bob agree on a subset of bits in the reconciled key. They then compare whether they obtained the same bits in this subset. Each difference is attributed by default to an eavesdropper (even if measurement errors may also have caused them). Indeed, the no-cloning theorem guarantees that in the event of eavesdropping, Eve forces the photon into a polarization mode (which is not necessarily Alice's). So, if Eve correctly guesses Alice's mode with a probability of 50%, then 25% of the bits in the reconciliation key will be in disagreement between Alice and Bob. At this stage, a mathematical proof of security makes it possible, based on the number of different bits, to evaluate the quantity of information thus potentially compromised, and to define a one-way function (Hash function) which, applied to the reconciled key, produces a smaller key, but no longer containing any compromised information.This is the privacy amplification step, which provides a secure key.

[0008] At the level of ground networks, the exchange of keys (or more precisely: the establishment of keys) by a quantum channel is done simply, via an optical communication channel carried by optical fiber. However, the exchange of single polarized photons (or very low intensity light pulses) through a fiber does not allow Alice and Bob to exchange these photons beyond a few tens of km which represent the combined asymptote of the probability of 100% absorption of the photons by the material which composes the optical fiber and the shortening of the key by the confidentiality amplification.

[0009] As a result, the architecture of quantum channel networks is strongly impacted by this physical constraint. Two solutions have been devised to overcome this this distance limitation in optical fiber.

[0010] The first solution envisaged is to propagate the keys by so-called "trusted nodes" (or "trusted nodes") placed at regular intervals (every 50 kilometers for example). Figure 2A schematically illustrates a key generation device by trusted node known from the prior art. The trusted node manipulates in clear the key established with Alice (Key A) and the key established with Bob (Key B). This trusted node is positioned approximately equidistant between Alice and Bob and allows doubling the range of key establishment by quantum channels. Then, the trusted node relies on the disposable mask technique to transmit this key A to Bob. To do this, the trusted node performs an "XOR" (bit-by-bit exclusive OR logic gate) between Alice's key and Bob's key. By "XOR" is meant here and in the rest of the document the fact of combining two keys by the logical operator "exclusive or" or "XOR", of symbol ®.The result is transmitted to Bob through an authenticated clear channel. Bob, who holds key B, can again perform an XOR between the sequence received from node 2 and his key (Key B) to recover Alice's key (Key A).

[0011] This first solution is based on the property of the XOR function: A ® B ® B = A ® (B ® B) - o = A but also on the one-time pad encryption technique (OTP in English for One Time Pad cryptography) which guarantees that it is not possible to go back to key A and / or key B by only knowing the sequence Key A ® Key B. We call A ® B, "encrypted key". The one-time pad technique is based on the following principle. Any message that must be encrypted will be encrypted by a strictly random key, the size of the message and which will be combined with the clear message to arrive at the encrypted message. Decryption will be carried out by performing the inverse operation on the encrypted message using the same secret key. This technique has been demonstrated theoretically secure by Claude Shannon, and this, whatever the means available to the attacker provided that 3 absolutely fundamental rules are respected: A. The key must be as long as the message to be encrypted, B. The key must be strictly random, the elements that make up the key (bits or characters) of the key must all be independent of each other. C. Each key (or mask) must only be used once to encrypt a single message.

[0012] However, this first solution requires that the trusted nodes, which handle the keys in clear, be secured with a very high level of security which implies significant additional costs and operational constraints. Then, this type of solution is difficult, if not impossible, to implement to interconnect two users separated by an ocean (difficult and expensive to implement trusted nodes every 100km in the ocean).

[0013] The second solution is to carry out photon exchanges in free space, and from space to reach long distances. In this case, the 100-kilometer limit of optical fiber is no longer applicable and it is possible to distribute encryption keys to two users located anywhere on Earth via QKD channels from space. This configuration is illustrated in Figure 2B. In this case, it is the satellite that acts as a trusted node since it will establish a key A with Alice (for example, a ground station) and a key B with Bob (for example, another ground station) and then transmit to Bob the key A ® key B (encryption key) over a clear and authenticated conventional communication channel during the flyby of Bob's station. On the ground, Bob, holder of key B, will be able to extract Alice's key A by performing an XOR of key B with the encryption key of sequence Key A ® Key B that the satellite will have brought back to him.Here, the satellite, if it is in low orbit, moves relative to Alice and relative to Bob. So, regardless of the distance between Alice and Bob, the satellite acts as a mobile trusted node capable of establishing Key A and Key B and distributing the Key A ® Key B combination that allows Alice and Bob to share a common secret key (Key A).

[0014] In this second solution, the 'pair management' aspect of ground stations and the 'overflight of paired stations' aspect is likely to strongly constrain the planning of quantum optical contacts between station and satellite in the means generally considered. Indeed, the trajectories of the satellites are extremely rigid, and the periods of optical contact between satellites and ground stations, if they are predictable, are not flexible. In addition, cloud cover is likely to interrupt the quantum channel connecting the satellite and a ground station and thus prevent the establishment of an elementary satellite-station link. In this case, the planning of the exchanges must therefore be able to be updated.

[0015] These constraints make the planning of contacts between stations and satellites very complex and inefficient. Indeed, the solution of [Fig.2B] requires a precise sequence of the different contacts, due to the fact that it does not manage point-to-point connections, but in fact pairs of connections to share keys between pairs of ground stations. If the sequence is interrupted by a poorly anticipated meteorological disturbance, the availability of the service can be endangered because the visibility of the station that one wanted to connect may not recur until several days later. Consequently, the strategies for optimizing contacts between satellites and stations are extremely complex and require the resolution of problems whose optimum is difficult to determine.

[0016] The invention aims to overcome certain problems of the prior art. To this end, an object of the invention is a method and a device for distributing secure secret keys intended to secure communications between a first communication station and a second communication station, in a network comprising a satellite. In the method and process of the invention, the secure secret keys are shared by a pair of stations in a step temporally separated from the step where these keys are generated by QKD. In the invention, the distribution of the secure secret keys to the pair of stations is carried out by a channel that does not necessarily require optical visibility between the satellite and the stations and can be done much later depending on the needs of the users. The solution of the invention allows for more opportunistic use than the solutions of the prior art of the keys pre-established but not allocated in advance to a pair of stations. Summary of the invention

[0017] To this end, an object of the invention is a method for sharing secure secret keys intended to secure communications between a first communication station and a second communication station, said method comprising the following steps: A. exchanging, via a quantum channel connecting a satellite to said first communication station, a first secret key B. exchange, via a quantum channel connecting said satellite to said second communication station, a second secret key C. receiving, in said satellite, a communication request between the first and second communication stations D. encrypting, in said satellite, the first secret key by a symmetric encryption method which uses the second secret key, so as to generate a first encrypted message and transmit said first encrypted message to said second communication station by an authenticated channel, called the first authenticated channel.

[0018] According to a preferred embodiment, the method of the invention comprises a subsequent step E which consists of decrypting, in said second communication station, the first encrypted message using the second secret key, so as to obtain the first secret key, the first secret key forming the secure secret key.

[0019] Preferably, in the preferred embodiment, the symmetric encryption method is the disposable mask method and in which the first and second secret keys and the first message are binary coded, the generation of the first encrypted message being carried out by the XOR logic gate combining the first and second secret keys, the decryption of the first encrypted message being carried out by the XOR logic gate combining the first encrypted message with the second secret key.

[0020] Preferably, in the preferred embodiment, the method of the invention comprises two subsequent steps F and G which consist of: F- encrypt, in the first communication station, a non-random message to using the first secret key and then transmitting the encrypted non-random message to the second communication station, G- decrypting said encrypted non-random message using the first secret key.

[0021] Preferably, in the preferred embodiment, steps A to E are repeated a plurality of times in order to form a plurality of secure secret keys.

[0022] According to one embodiment, step B requires a reconciliation sub-step carried out via said first authenticated channel.

[0023] Preferably, in the preferred embodiment, steps A to E are repeated a plurality of times with a pair of communication stations different from the first and second communication stations.

[0024] Preferably, in the preferred embodiment, the method of the invention further comprises a step D' and a step E', said step D' consisting of encrypting, in said satellite, the second secret key by a symmetric encryption method which uses the first secret key so as to generate a second encrypted message and transmit said second encrypted message to said first communication station, by an authenticated channel called the first authenticated channel, said step E' consisting of decrypting, in said second communication station, the first encrypted message using the second secret key so as to obtain the first secret key.

[0025] Another object of the invention is a satellite for distributing a secure secret key intended to secure communications between a first communication station and a second communication station, said satellite being adapted to - exchange, via a quantum channel connecting said satellite to said first communication station, a first secret key - exchange, via a quantum channel connecting the satellite to said second communication station, a second secret key - receive a communication request between the first and second communication stations transmitted via a clear request channel - encrypting the first secret key by a symmetric encryption method which uses the second secret key, so as to generate a first encrypted message and transmitting said first encrypted message to said second communication station by an authenticated channel called the first authenticated channel.

[0026] Another object of the invention is a communication system comprising the satellite according to the invention and comprising the first and second communication stations, said second communication station being adapted to decrypt the first encrypted message using the second secret key, so as to obtain the first secret key, the first secret key forming the secure secret key.

[0027] According to a preferred embodiment of the communication system of the invention, the first authenticated channel is different from the quantum channel connecting the satellite to said second communication station. Preferably, the first authenticated channel is a bidirectional telemetry / remote control link of said satellite.

[0028] According to one embodiment of the communication system of the invention, the first authenticated channel is relayed by an additional satellite via an optical or RF intersatellite link connecting the satellite and said additional satellite.

[0029] According to one embodiment of the communication system of the invention, the first authenticated channel is an RF or optical anchor link of a telecommunications service carried by the satellite.

[0030] According to one embodiment of the communication system of the invention, the clear request channel is relayed by a local station capable of communicating with said satellite via an authenticated local link. Brief description of the drawings

[0031] Other characteristics, details and advantages of the invention will emerge from reading the description given with reference to the appended drawings given by way of example and which represent, respectively:

[0032] [Fig.l] a schematic view of a QKD device according to the prior art,

[0033] [Fig.2A], a schematic view of a QKD key generation device by satellite of the prior art,

[0034] [Fig.2B], a schematic view of a key generation device by node of confidence in prior art,

[0035] [Fig.3A], a schematic view of a method for distributing secure secret keys according to the invention,

[0036] [Fig.3B], a schematic view of a secret key distribution system according to the invention,

[0037] [Fig.3C], a schematic view of a method for generating a secure secret key according to a preferred embodiment of the method of the invention

[0038] [Fig.3D], a schematic view of a method for generating a secure secret key according to an embodiment of the method of the invention

[0039] [Fig.3E], a schematic view of a secret key distribution system according to a embodiment of the invention,

[0040] [Fig.3F], a schematic view of a secret key distribution system according to a embodiment of the invention,

[0041] [Fig.4], a schematic view of a method for generating a secure secret key according to a preferred embodiment of the method of the invention

[0042] [Fig.5A], a schematic view of a method for generating a secure secret key according to an embodiment of the method of the invention

[0043] [Fig.5B], a schematic view of a secret key distribution system according to a embodiment of the invention,

[0044] In the figures, unless otherwise indicated, the elements are not to scale. Description of the embodiments

[0045] [Fig.3A] schematically illustrates a method according to the invention for distributing a secure secret key intended to secure communications between a first communication station S1 and a second communication station S2.

[0046] [Fig. 3B] schematically illustrates a communication system according to the invention which comprises the first and second communication stations S1, S2 and a satellite Sat. The satellite Sat is adapted to implement the method of [Fig. 3A]. By way of non-limiting example, [Fig. 3B] illustrates an embodiment in which the system 1 comprises two communication stations. Alternatively, according to another embodiment, the system 1 comprises more than two communication stations.

[0047] In a first step A of the method of the invention, the satellite Sat establishes a first secret key denoted K y with the first station Si via a quantum channel CQi. This channel CQi connects the satellite Sat to the first communication station Si. This step A is carried out when the satellite Sat is in a position A, during the overflight of the station Si by the satellite Sat and requires that the satellite Sat be in optical visibility of the station Si in order to transmit and detect qbits. In step A, the emission of the qbits can be done from the satellite Sat to the station Si or vice versa.

[0048] In a step B, the satellite Sat is adapted to exchange a second secret key K2 with the second communication station S2 via a quantum channel CQ2 connecting the satellite Sat to the second communication station S2. Step B is carried out when the satellite is in a position B, during the overflight of the station S2 by the satellite and requires that the satellite Sat is in optical visibility of the station S2. In step B, the emission of the qbits can be done from the satellite Sat to the station S2 or vice versa.

[0049] The satellite Sat knows and stores all the secret keys K{ and K2 in clear text, these keys forming the secure secret key pair. This satellite is therefore the trusted node of system 1.

[0050] In the invention, the steps of exchanging secret keys by quantum channel can be carried out by any QKD protocol known to those skilled in the art. It is recalled that cloud cover above a terrestrial communication station blocks any optical link in free space in the visible and near infrared. In addition, the sun generates large quantities of parasitic photons by diffraction in the atmosphere (indirect irradiance) which strongly degrade the detection of the qbits which can lead to the link breakdown. Thus, the current state of the art of satellite QKD allows the transmission of qbits by optical link in near infrared through the atmosphere in clear skies and especially during the night. Thus the availability of the quantum channel between a satellite and a ground communication station is dependent on meteorological events and hazards above the station.

[0051] After steps A and B, the method of the invention comprises a step C consisting of receiving, in the satellite Sat, a communication request between the first and second communication stations SI, S2 via a clear request channel CR. In the embodiment illustrated in [Fig.3B], by way of example, this request is sent by the first communication station Si, called the transmitting station, via a clear request channel CR when the satellite is in a position C. Alternatively, according to another embodiment, the transmitting station is the second station S2.

[0052] After receiving the request, in a step D, the satellite Sat encrypts the first secret key K\ by a symmetric encryption method which uses the second secret key K^ so as to generate a first encrypted message KC12. In addition, step D comprises the transmission of the first encrypted message to the second communication station S2 by an authenticated channel CA2, called the first authenticated channel.

[0053] At the end of the method in Figure 3A, the second communication station S2 is able to decrypt the first encrypted message so as to obtain the first secret key (see method in Figure 4). Thus, the first and second communication stations Si, S2 can each possess the first secret key Kj which forms the secure secret key. Now, the steps implemented in the method of the invention (QKD and symmetric encryption) being resistant to the quantum threat, the method of the invention therefore makes it possible to provide a secure secret key for the encryption of communications between the station Si and the station S2.

[0054] It is important to note that in the invention, steps A and B of exchanging the secret keys K], K2 by QKD are temporally decorrelated from the distribution of the encrypted message KC 12 to the station S2 in step D. Thus, the distribution of the encrypted message KCi2 via the channel CA2 does not necessarily require optical visibility between the satellite Sat and the station S2. The channel CA2 can therefore be any conventional channel of opportunity authenticated in the RF or optical domain (see below). Concretely, this implies that the satellite Sat can be significantly further from the station S2 when it carries out the distribution of the encrypted message KCÏ2 than when it carries out steps A and B. This temporal separation between the exchange of the secret keys ^2 by QKD and the distribution of the encrypted message KC 12 is not present in the methods of the prior art.Indeed, in these methods of the prior art, the distribution of the secure secret key was carried out by the satellite during the overflight of a station almost simultaneously after establishment of an encryption key by QKD for . encrypt the transmission of the secure secret key between the satellite and the station (see [Fig.2B]).

[0055] The solution of the invention makes it possible to considerably relax the planning of operations compared to the method of the prior art illustrated in FIG. 2B. In addition, the solution of the invention makes it possible to delay the distribution of the encrypted message KC12, for example, depending on the needs of the users of the stations SI and S2 and therefore to avoid prolonged storage of the secret keys K2 and of the message KC}2 in the station S2 which could potentially be compromised. Thus, the solution of the invention makes it possible to use in a more opportunistic manner than the solutions of the prior art the secret keys Kb K2 pre-established in steps A and B but not allocated in advance to the pair of stations SI and S2.

[0056] It is understood that the fact of temporally decorrelating the distribution of the encrypted message KC}2 to the station S2 from the exchange of the secret keys Kb K2 by QKD to the stations SI and S2 implies that the satellite can securely store the keys K, K2 after their exchange by QKD, at least until the distribution step D.

[0057] According to an embodiment illustrated in Figure 3C, the method of the invention further comprises a step D', in which the satellite encrypts the second secret key K2 by a symmetric encryption method which uses the first secret key so as to generate a second encrypted message KC2i. In addition, step D' comprises the transmission of the second encrypted message to the first communication station SI by an authenticated channel CA^ called the second authenticated channel. As explained above, step E is temporally decorrelated from step A of exchanging the secret keys by QKD. Figure 3D schematically illustrates a device suitable for implementing the method of Figure 3C.At the end of the method in Figure 3C, the first and second communication stations SI, S2 are able to decrypt respectively the second and first encrypted message so as to obtain respectively the second and first secret keys K2, Kv. Thus, the first and second communication stations SI, S2 have the capacity to each obtain the first and second secret keys K b K2, which form a pair of secure secret keys allowing secure communication between the stations SI and S2.

[0058] According to the invention, the symmetric encryption method of steps D and D' can be any block or stream method known to those skilled in the art, for example the disposable mask method or the AES method (for Advanced Encryption Standard in English) or the Triple DES method.

[0059] As mentioned previously, the channel CA^ and the channel CA2 (when present) can be any conventional authenticated channels of opportunity. According to a preferred embodiment of the invention, denoted MR, the first and second communication stations are terrestrial stations on the ground.

[0060] According to an embodiment of the method of the invention noted MP, in step A, the reconciliation sub-step necessary for the exchange of the first secret key KY is carried out via the second authenticated channel. Similarly, in step B, the reconciliation sub-step necessary for the exchange of the second secret key K2 is carried out via the first authenticated channel. These reconciliation sub-steps, just like the steps for distributing the encrypted messages KC2p KC21 do not require that the satellite Sat be in optical visibility of the stations SI and S2. Thus, it is possible to simplify the architecture of the network of the system 1 by sharing some of the links necessary for its operation. This embodiment MP is compatible with the embodiment MR.

[0061] According to another embodiment, compatible with the MR embodiment and the MP embodiment, the first authenticated channel and the second authenticated channel are each a bidirectional satellite telemetry / remote control link. Here, the term "bidirectional satellite telemetry / remote control link" refers to a link allowing, on the one hand, the control, configuration and programming of the satellite mission and, on the other hand, the measurement of the configuration and state of the satellite. Thus, it is possible to simplify the architecture of the network of the system 1 by pooling some of the links necessary for its operation.

[0062] According to another embodiment of the system of the invention, the first authenticated channel and the second authenticated channel are each an RF or optical anchor link of a telecommunications service carried by the satellite.

[0063] Figure 3E schematically illustrates an embodiment of the system 1 of Figure 3D, in which the authenticated channel CA ^ is relayed by an additional satellite SR via an inter-satellite link LI connecting the satellite Sat and the additional satellite SR. This link LI is for example an optical or RF link. This embodiment makes it possible to improve the availability of the system 1, for example when the satellite Sat is too far from the station SI to be able to communicate with it directly without the intermediary of the additional satellite SR. More generally, according to an embodiment of the system 1 of the invention the first and / or the second authenticated channel are / is relayed by the additional satellite SR via the inter-satellite link LL

[0064] Advantageously, according to an embodiment of the system 1 of [Fig.3E], the additional satellite SR is configured to evolve in geostationary orbit to maximize its availability. Alternatively, the additional satellite SR is in low LEO orbit or MEO orbit.

[0065] [Fig.3F] schematically illustrates an embodiment of the system 1 of the invention in which the communication request sent by the transmitting station is relayed to the satellite by a local station SL capable of communicating with the satellite via an authenticated local link LL. This embodiment is advantageous in order to take advantage of starting from a possible overflight of the SL station by the satellite while the Sat satellite is too far from the transmitting station for the latter to be able to transmit the communication request directly.

[0066] Figure 4 illustrates a preferred embodiment of the method of the invention. This method is particularly suitable for implementation by the system 1 of Figure 3B. The method of Figure 4 comprises an additional step E which consists of decrypting, in the second communication station S2, the first encrypted message KC12 using the second secret key K2. Thus, the station S2 obtains the first secret key K b

[0067] This step E is necessary so that the stations SI and S2 both possess the secure secret key K^ that they can subsequently use to encrypt non-random messages that they wish to exchange (see Figures 5A and 5B). Indeed, given the fact that the encryption of the secure secret key is carried out by a symmetric encryption method, the decryption of the first encrypted message KCi2 is carried out with the same key as that used for the encryption, i.e. the second secure secret key K2. Thus, the method of [Fig. 4] makes it possible to easily distribute in a secure and tamper-proof manner - even by quantum attack - a secure secret key to encrypt communications between the station SI and the station S2 by relaxing the key distribution constraints and doubling the volume of secure secret keys available compared to other methods of the prior art.

[0068] According to an embodiment of the method of [Fig.4], steps A to E are repeated a plurality of times in order to form a plurality of secure secret keys each intended to secure communications between station SI and station S2.

[0069] When the method of Figure 4 is combined with the embodiment of Figure 3C, in addition to step E, the method comprises a step E' which consists of decrypting, in the first communication station SI, the second encrypted message KC2i using the first secret key K{. Thus, the station SI obtains the second secret key K2.

[0070] In a preferred embodiment of the invention, the symmetric encryption method is the disposable mask method.

[0071] In this embodiment, the first and second secret keys K^ K2, and the first encrypted message F <CI2 (et KC2X le cas échéant) sont codées en binaire. Ainsi, la génération du premier crypté ^C12 (et KC2X le cas échéant) est réalisée par la porte logique XOR (de symbole ®) combinant la première et la deuxième clés secrètes K^ K2. Plus précisément, le premier et le deuxième message cryptés sont identiques et sont obtenus par l’opération logique suivante KC i2 = K2l = K^K2. De même, le déchiffrement du premier et du deuxième messages cryptés KC 12, KC2i est réalisée par la porte logique XOR combinant respectivement le premier message crypté avec la second secret key and the second message encrypted with the first secret key. More precisely, the decryption of the second encrypted message KC2} in the first station S1 corresponds to the logical operation: KC2^Ki = KfëK2®Ki = K2. Similarly, the decryption of the first encrypted message KC}2 in the second station S2 corresponds to the logical operation: KCi2®K2 = KfëK2®K2 = K^. This embodiment is the one that allows the least complex implementation of the invention.

[0072] In order to ensure the security of the disposable mask technique, the first and second secret keys are of the same length (key size in English). More generally, in the invention, all the steps implementing the disposable mask technique combine two keys which are of the same length.

[0073] [Fig.5A] illustrates a preferred embodiment of the method of [Fig.4], making it possible to securely exchange a non-random message M between the station SI and the station S2. [Fig.5B] schematically illustrates an embodiment of the system of the invention adapted to implement the method of [Fig.5A]. In addition to the steps detailed previously, the method of [Fig.5A] comprises two subsequent steps F and G which consist of: F- encrypt, in the first communication station SI, a non-random message M using one of the first secret key Kl and transmit the encrypted non-random message MC to the second communication station S2 G- decrypt the non-random message encrypted using the first secret key Kr in step F. Thus, station S2 obtains the non-random message M in a perfectly secure manner.

[0074] According to an embodiment different from that illustrated in [Fig.5B], the message M is exchanged from the station S2 to the station SL

[0075] According to a preferred embodiment of the method of [Fig.5A], steps F and G are repeated a plurality n of times in order to encrypt a plurality of communications between the station S1 and the station S2. The number n of repetitions of steps F and G is less than a so-called critical number calculated from a crypto-period of the key used for the encryption of the message M and the decryption of the message MC. This characteristic makes it possible to avoid the compromise of the exchanged messages. Here, the term "crypto-period" refers to the number of uses of a key in an encryption algorithm which must not be exceeded in order to guarantee the security of the message encrypted by this key.

Claims

Claims

1. Method for sharing secure secret keys intended to secure communications between a first communication station (SI) and a second communication station (S2), said method comprising the following steps: A. exchanging, via a quantum channel (CQ1) connecting a satellite (Sat) to said first communication station (SI), a first secret key (Kj B. exchanging, via a quantum channel (CQ2) connecting said satellite (Sat) to said second communication station (S2), a second secret key (KJ C. receiving, in said satellite, a communication request between the first and second communication stations D.encrypting, in said satellite, the first secret key (Kj) by a symmetric encryption method which uses the second secret key (K2), so as to generate a first encrypted message (KC12) and transmitting said first encrypted message to said second communication station (S2) by an authenticated channel (CAÀ called first authenticated channel.

2. Method according to the preceding claim, comprising a subsequent step which consists of: E. decrypting, in said second communication station (S2), the first encrypted message (KCi2) using the second secret key (K2), so as to obtain the first secret key (Kj), the first secret key forming the secure secret key.

3. A method according to claim 2, wherein said symmetric encryption method is the disposable mask method and wherein the first and second secret keys (K^ K2), and the first encrypted message (ACp) are binary encoded, the generation of the first encrypted message (ÆCp) being performed by the XOR logic gate combining the first and second secret keys (K^ Æ2), the decryption of the first encrypted message (ACi2) being performed by the XOR logic gate combining the first encrypted message with the second secret key.

4. Method according to any one of claims 2 to 3, comprising two subsequent steps F and G which consist of: F. encrypting, in the first communication station, a non-random message (M) using the first secret key and then transmitting the encrypted non-random message (MC) to the second communication station' G. decrypting said encrypted non-random message using the first secret key.

5. A method according to any one of claims 2 to 4, wherein steps A to E are repeated a plurality of times to form a plurality of secure secret keys.

6. Method according to any one of the preceding claims, in which step B requires a reconciliation sub-step carried out via said first authenticated channel.

7. A method according to any one of claims 2 to 5, wherein steps A to E are repeated a plurality of times with a pair of communication stations different from the first and second communication stations.

8. Method according to any one of claims 2 to 7, further comprising a step D' and a step E', said step D' consisting of encrypting, in said satellite, the second secret key (K9) by a symmetric encryption method which uses the first secret key (Kj), so as to generate a second encrypted message (KC21) and transmitting said second encrypted message to said first communication station (SI), by an authenticated channel (CAj), called first authenticated channel, said step E' consisting of decrypting, in said second communication station (S2), the first encrypted message (KC12) using the second secret key (K2), so as to obtain the first secret key (KD-

9. Satellite (Sat) for distributing a secure secret key intended to secure communications between a first communication station (SI) and a second communication station (S2), said satellite being adapted to - exchange, via a quantum channel (CQ1) connecting said satellite (Sat) to said first communication station (SI), a first secret key (K,) - exchange, via a quantum channel (CQ2) connecting the satellite (Sat) to said second communication station (S2), a second secret key (Kj - receiving a communication request between the first and second communication stations transmitted via a clear request channel (CR) - encrypting the first secret key (K|) by a symmetric encryption method which uses the second secret key (K9), so as to generate a first encrypted message (KC12) and transmitting said first encrypted message to said second communication station (S2) by an authenticated channel (CA2) called the first authenticated channel.

10. Communication system comprising the satellite according to the preceding claim and comprising said first and second communication stations, said second communication station being adapted to decrypt the first encrypted message (KC12) using the second secret key (K2), so as to obtain the first secret key (Kj), the first secret key forming the secure secret key.

11. System according to the preceding claim, in which the first authenticated channel is different from the quantum channel connecting the satellite (Sat) to said second communication station (S2).

12. System according to the preceding claim, in which the first authenticated channel is a bidirectional telemetry / remote control link of said satellite.

13. System according to any one of claims 10 to 12, wherein the first authenticated channel is relayed by an additional satellite (SR) via an optical or RF inter-satellite link (LI) connecting the satellite and said additional satellite.

14. A system according to any one of claims 10 to 13 wherein the first authenticated channel is an RF or optical anchor link of a telecommunications service carried by the satellite.

15. System according to any one of claims 10 to 14, in which the clear request channel is relayed by a local station (SL) capable of communicating with said satellite via an authenticated local link (LL).

Images