Method and device for sharing secret keys in a network including a satellite

Abstract

A secure secret key distribution method for securing communications between a first communication station (S1) and a second communication station (S2), using a first and second satellite (STA, STB) that fly over a common station, exchanging a second and third secret key respectively via QKD, and that fly over the first and second communication stations respectively, exchanging a first and fourth secret key via QKD. [Fig. 3A]

Description

Title of the invention: Method and device for sharing secret keys in a network comprising a satellite Technical field

[0001] The present invention relates to the field of information technology security and more particularly to the field of sharing encryption keys by satellite via quantum channels. Prior art

[0002] There has always been a need to exchange sensitive information that must remain secret over a public communication channel. Suppose two people, Alice and Bob, wish to exchange sensitive information over an authenticated public communication channel (e.g., the Internet), away from prying eyes. To do this, they must encrypt their messages. Let's call Eve the person who wants to intercept these messages. Alice must, using a published (i.e., non-secret) cryptographic function and a secret key, encrypt her messages before sending them to Bob over a public channel. When Bob receives the encrypted messages, he must, using the same cryptographic function and the same secret key as Alice, decrypt them to be able to access the information in plain text.

[0003] Now comes the problem of the secret key shared between Alice and Bob: how is it generated, how is it exchanged securely and away from prying eyes?

[0004] During secure exchanges on the internet, the establishment of a shared secret key is carried out using techniques based on public key cryptography that we do not detail here. A new solution was imagined at the end of the 20th century. It proposes to use a quantum channel that allows Alice and Bob to establish a common secret key by exchanging quantum particles (e.g. photons) without Eve being able to trace the key by intercepting these particles. However, this technique of sharing keys via quantum channels (QKD in English for Quantum Key Distribution) suffers from some limitations that make its application difficult to a large number of users and over very long distances. This could, in the long term, make this technique unattractive and therefore not profitable enough to generate industrial opportunities.

[0005] [Fig.l] schematically represents the architecture of a quantum channel which allows two users Alice (the particle transmitter) and Bob (the particle receiver) to establish a common secret key. The key is a sequence of bits, random, therefore being able to take as value 0 or 1. For example, in the framework of the BB84 protocol, Alice proposes key bits using two photon polarization modes prepared by Alice, the choice of the polarization mode is random. Alice notes for each bit (therefore each photon) the randomly chosen polarization mode. Using a polarizing filter and a photon detector which can be oriented alternately according to the two randomly chosen polarization modes, Bob notes the detection result (the photon exited the filter by the 'parallel' path or by the 'perpendicular' path to its axis.), as well as the chosen orientation of the filter.

[0006] In BB84, once the entire sequence has been transmitted, Alice sends Bob the polarization modes used for each detection via an authenticated clear channel. Bob can then deduce the value of the bits for which the polarization orientation was the same. He then knows with certainty NU bits on average for N bits transmitted by Alice, this sequence being called the reconciled key. This step can be accompanied by error correction methods using control values ​​and LDPC or cascade type algorithms, which use control parameters exchanged over the authenticated channel.

[0007] Finally, Alice and Bob agree on a subset of bits in the reconciled key. They then compare whether they obtained the same bits in this subset. Each difference is attributed by default to an eavesdropper (even if measurement errors may also have caused them). Indeed, the no-cloning theorem guarantees that in the event of eavesdropping, Eve forces the photon into a polarization mode (which is not necessarily Alice's). So, if Eve correctly guesses Alice's mode with a probability of 50%, then 25% of the bits in the reconciliation key will be in disagreement between Alice and Bob. At this stage, a mathematical proof of security makes it possible, based on the number of different bits, to evaluate the quantity of information thus potentially compromised, and to define a one-way function (Hash function) which, applied to the reconciled key, produces a smaller key, but no longer containing any compromised information.This is the privacy amplification step, which provides a secure key.

[0008] At the level of ground networks, the exchange of keys (or more precisely: the establishment of keys) by a quantum channel is done simply, via an optical communication channel carried by optical fiber. However, the exchange of single polarized photons (or very low intensity light pulses) through a fiber does not allow Alice and Bob to exchange these photons beyond a few tens of km which represent the combined asymptote of the probability of 100% absorption of the photons by the material which composes the optical fiber and the shortening of the key by the confidentiality amplification.

[0009] As a result, the architecture of quantum channel networks is strongly impacted by this physical constraint. Two solutions have been devised to overcome this this distance limitation in optical fiber.

[0010] The first solution envisaged is to propagate the keys by so-called "trusted nodes" (or "trusted nodes") placed at regular intervals (every 50 kilometers for example). Figure 2A schematically illustrates a key generation device by trusted node known from the prior art. The trusted node manipulates in clear the key established with Alice (Key A) and the key established with Bob (Key B). This trusted node is positioned approximately equidistant between Alice and Bob and allows doubling the range of key establishment by quantum channels. Then, the trusted node relies on the disposable mask technique to transmit this key A to Bob. To do this, the trusted node performs an "XOR" (bit-by-bit exclusive OR logic gate) between Alice's key and Bob's key. By "XOR" is meant here and in the rest of the document the fact of combining two keys by the logical operator "exclusive or" or "XOR", of symbol ®.The result is transmitted to Bob through an authenticated clear channel. Bob, who holds key B, can again perform an XOR between the sequence received from node 2 and his key (Key B) to recover Alice's key (Key A).

[0011] This first solution is based on the property of the XOR function: A ® B © B = A © (B © B)-o = A but also on the One Time Pad cryptography (OTP) technique which guarantees that it is not possible to trace back to key A and / or key B by simply knowing the sequence Key A © Key B. We call A ® B, "encrypted key". The one time pad technique is based on the following principle. Any message that must be encrypted will be encrypted by a strictly random key, the size of the message and which will be combined with the plain message to result in the encrypted message. Decryption will be carried out by performing the reverse operation on the encrypted message using the same secret key. This technique has been demonstrated theoretically secure by Claude Shannon, regardless of the means available to the attacker, provided that 3 absolutely fundamental rules are respected: A. The key must be as long as the message to be encrypted, 。 B. The key must be strictly random, the elements that constitute the key (bits or characters) of the key must all be independent of each other. C. Each key (or mask) must only be used once to encrypt a single message.

[0012] However, this first solution requires that the trusted nodes, which handle the keys in clear, be secured with a very high level of security which implies significant additional costs and operational constraints. Then, this type of solution is difficult, if not impossible, to implement to interconnect two users separated by an ocean (difficult and expensive to implement trusted nodes every 100km in the ocean).

[0013] The second solution is to carry out photon exchanges in free space, and from space to reach long distances. In this case, the 100-kilometer limit of optical fiber is no longer applicable and it is possible to distribute encryption keys to two users located anywhere on Earth via QKD channels from space. This configuration is illustrated in Figure 2B. In this case, it is the satellite that acts as a trusted node since it will establish a key A with Alice (for example, a ground station) and a key B with Bob (for example, another ground station) and then transmit to Bob the key A © key B (encryption key) over a clear and authenticated conventional communication channel during the flyby of Bob's station. On the ground, Bob, holder of key B, will be able to extract Alice's key A by performing an XOR of key B with the encryption key of sequence Key A ® Key B that the satellite will have brought back to him.Here, the satellite, if it is in low orbit, moves relative to Alice and relative to Bob. So, regardless of the distance between Alice and Bob, the satellite acts as a mobile trusted node capable of establishing Key A and Key B and distributing the Key A ® Key B combination that allows Alice and Bob to share a common secret key (Key A).

[0014] In this second solution, the 'pair management' aspect of ground stations and the 'overflight of paired stations' aspect is likely to strongly constrain the planning of quantum optical contacts between station and satellite in the means generally considered. Indeed, the trajectories of the satellites are extremely rigid, and the periods of optical contact between satellites and ground stations, if they are predictable, are not flexible. In addition, cloud cover is likely to interrupt the quantum channel connecting the satellite and a ground station and thus prevent the establishment of an elementary satellite-station link. In this case, the planning of the exchanges must therefore be able to be updated.

[0015] These constraints make the planning of contacts between stations and satellites very complex and inefficient. Indeed, the solution of [Fig.2B] requires a precise sequence of the different contacts, due to the fact that it does not manage point-to-point connections, but in fact pairs of connections to share keys between pairs of ground stations. If the sequence is interrupted by a poorly anticipated meteorological disturbance, the availability of the service can be endangered because the visibility of the station that one wanted to connect may not recur until several days later. Consequently, the strategies for optimizing contacts between satellites and stations are extremely complex and require the resolution of problems whose optimum is difficult to determine.

[0016] The invention aims to overcome some of the aforementioned problems of the prior art. To this end, an object of the invention is a method and a device for sharing secure secret keys intended to secure communications between a first communication station and a second communication station. The invention is implemented in a network comprising at least two satellites which fly over a common station so as to be in optical visibility of the latter. In the method and process of the invention, the secure secret key is distributed in a step temporally separated from the step where these keys are generated by QKD, via the common station. Also, the distribution of the secure key to the first and second stations via the common station is carried out by channels which do not necessarily require optical visibility between the satellites and the common station and can be done much later depending on the needs of the users.The solution of the invention makes it possible to avoid having to implement trajectories of the two satellites which successively fly over the first and second stations which one wishes to connect: the work can be shared between several satellites by packets of stations and not by packets of pairs of stations as is usually envisaged in the prior art. Summary of the invention

[0017] To this end, an object of the invention is a method of sharing a secure secret key intended to secure communications between a first communication station and a second communication station, said method comprising the following steps: A. exchanging, via a quantum channel connecting a first satellite to the first communication station, a first secret key and exchanging, via a quantum channel connecting the first satellite to a third communication station called a common station, a second secret key B. exchanging, via a quantum channel connecting a second satellite to the common station, a third secret key and exchanging, via a quantum channel connecting the second satellite to the second communication station, a fourth secret key C. receiving, in the first and second satellites, a communication request between the first and second communication stations, D. encrypting, in the first satellite, the first secret key by a symmetric encryption method which uses the second secret key, so as to generate a first encrypted message and transmit the first encrypted message to the common station (by a first authenticated channel E. encrypting, in the second satellite, the fourth secret key by a symmetric encryption method which uses the third secret key, so as to generate a second encrypted message and transmit the second encrypted message to the common station by a second authenticated channel F. in the common station, decrypt the first encrypted message using the second secret key, so as to obtain the first secret key, and de encrypt the second encrypted message using the third secret key, so as to obtain the fourth secret key G. encrypting, in the common station, the first secret key by a symmetric encryption method which uses the fourth secret key, so as to generate a third encrypted message and transmit the third encrypted message to the second communication station by a third authenticated channel.

[0018] According to one embodiment, the method of the invention comprises a subsequent step H consisting of decrypting, in the second communication station, the third encrypted message using the fourth secret key so as to obtain the first secret key, the first secret key forming the secure secret key.

[0019] Preferably, the symmetric encryption method is the disposable mask method and in which the secret keys and the encrypted messages are binary coded, the encryption steps each being carried out by the XOR logic gate combining the secret keys respectively involved in said encryption step, the decryption steps each being carried out by the XOR logic gate combining the encrypted message with the encrypted secret key which are respectively involved in said decryption step.

[0020] According to one embodiment, the method of the invention comprises two subsequent steps I and J which consist of:

[0021] I. encrypting, in the first communication station, a non-random message using the first secret key and then transmitting the encrypted non-random message to the second communication station via a so-called clear channel.

[0022] J. decrypting, in the second communication station, said non-random message encrypted using the first secret key.

[0023] According to one embodiment, steps A to H are repeated a plurality of times in order to form a plurality of secure secret keys.

[0024] According to one embodiment, in step A, the exchange of the second secret key requires a reconciliation sub-step carried out via said first authenticated channel and / or, in step B, the exchange of the third secret key requires a reconciliation sub-step carried out via said second authenticated channel.

[0025] According to one embodiment, steps A to H are repeated a plurality of times with a pair of communication stations different from the first and second communication stations.

[0026] Another object of the invention is a communication system comprising a first and a second communication station, a third communication station called a common station and a first and a second satellite, said first satellite being adapted to exchange, via a quantum channel connecting the first satellite to the first communication station, a first secret key and to exchange, via a quantum channel connecting the first satellite to the common station, a second secret key, said second satellite being adapted to exchange, via a quantum channel connecting the second satellite to the common station, a third secret key and to exchange, via a quantum channel connecting the second satellite to the second communication station, a fourth secret key, the first satellite being further adapted to receive a communication request between the first and second communication stations transmitted via a clear request channel, and after which encrypt the first secret key by a symmetric encryption method which uses the second secret key so as to generate a first encrypted message and transmit the first encrypted message to the common station by a first authenticated channel,the second satellite being further adapted to receive said communication request, and after which encrypt the fourth secret key by a symmetric encryption method which uses the third secret key so as to generate a second encrypted message and transmit the second encrypted message to the common station by a second authenticated channel, the common station being adapted to: , - decrypt the first encrypted message using the second secret key so as to obtain the first secret key and decrypt, in the common station, the second encrypted message using the third secret key so as to obtain the fourth secret key - encrypting the first secret key by a symmetric encryption method which uses the fourth secret key so as to generate a third encrypted message and transmitting the third encrypted message to the second communication station by a third authenticated channel.

[0027] According to one embodiment, the second communication station is adapted to decrypt the third encrypted message using the fourth secret key so as to obtain the first secret key, the first secret key forming the secure secret key.

[0028] According to one embodiment, the first authenticated channel and / or the second authenticated channel are each a bidirectional telemetry / remote control link of the first satellite and the second satellite respectively.

[0029] According to one embodiment, the first authenticated channel is relayed by an additional satellite via an optical or RF inter-satellite link connecting the additional satellite and the first satellite and / or the second authenticated channel is relayed by an additional satellite via an optical or RF inter-satellite link connecting the additional satellite and the second satellite.

[0030] According to one embodiment, the first authenticated channel and the second authenticated channel are each an RF or optical anchor link of a telecommunications service. communication carried by the first satellite and the second satellite respectively.

[0031] According to one embodiment, the station the first authenticated channel is different from the quantum channel connecting the first satellite to said common station (S3) and the second authenticated channel is different from the quantum channel connecting the second satellite to said common station.

[0032] According to one embodiment, the clear request channel is relayed by a local station capable of communicating with the first and second satellites via an authenticated local link.

[0033] Another object of the invention is a communication station called a common station, said station being adapted for: - receive a second secret key exchanged via a quantum channel connecting a first satellite and the common station - receive a third secret key exchanged via a quantum channel connecting a second satellite to the common station - receive, via a first authenticated channel, a first encrypted message transmitted by the first satellite and generated by a symmetric encryption method which encrypts, with the second secret key, a first secret key exchanged via a quantum channel connecting the first satellite to a first communication station, and - receive, via a second authenticated channel, a second encrypted message transmitted by the second satellite and generated by a symmetric encryption method which encrypts, with the third secret key, a fourth secret key exchanged via a quantum channel connecting the second satellite to a second communication station, - decrypt the first encrypted message using the second secret key, so as to obtain the first secret key, and decrypt the second encrypted message using the third secret key, so as to obtain the fourth secret key. Brief description of the drawings

[0034] Other characteristics, details and advantages of the invention will emerge from reading the description given with reference to the appended drawings given by way of example and which represent, respectively:

[0035] [Fig-1] a schematic view of a QKD device according to the prior art,

[0036] [Fig.2A], a schematic view of a QKD key generation device by satellite of the prior art,

[0037] [Fig.2B], a schematic view of a key generation device by node of confidence in prior art,

[0038] [Fig.3A], a schematic view of a secure secret key distribution method according to the invention,

[0039] [Fig.3B], a schematic view of a secret key distribution system according to the invention,

[0040] [Fig.3C], a schematic view of a secret key distribution system according to a embodiment of the invention,

[0041] [Fig.3D], a schematic view of a secret key distribution system according to a embodiment of the invention,

[0042] [Fig.4], a schematic view of a method for generating a secure secret key according to a preferred embodiment of the method of the invention

[0043] [Fig.5A], a schematic view of a method for generating a secure secret key according to an embodiment of the method of the invention

[0044] [Fig.5B], a schematic view of a secret key distribution system according to a embodiment of the invention,

[0045] In the figures, unless otherwise indicated, the elements are not to scale. Description of the embodiments

[0046] [Fig. 3A] schematically illustrates a method according to the invention for distributing a secure secret key intended to secure communications between a first communication station SI and a second communication station S2. [Fig. 3B] schematically illustrates a communication system 1 according to the invention adapted to implement the method of [Fig. 3A]. In addition to the first and second stations SI, S2, the system 1 comprises a third communication station S3 called a common station and a first and second satellites STA, STB.

[0047] In a first step A of the method of the invention, the first satellite STA exchanges a first secret key KY via a quantum channel CQai connecting the first satellite STA to the first communication station SL. This exchange in step A is carried out when the satellite STA is in a position A, during the overflight of the station SI and requires that the satellite STA be in optical visibility of the station SI in order to transmit and detect qbits.

[0048] Furthermore, when the satellite STA is in a position B in which it is in optical visibility of the common station S3, the satellite exchanges a second secret key K2 via a quantum channel CQA3 connecting the first satellite STA to the common station S3.

[0049] For clarification, in the invention, when describing a step of key exchange by quantum channel connecting a station and a satellite, the emission of the qbits can be done from the satellite to the station or vice versa.

[0050] In a step B, the second satellite STB exchanges a third secret key K3 via a quantum channel CQB3 connecting a second STB satellite to the common station S3. This exchange is carried out when the STB satellite is in a position C, during the overflight of the common station S3 by the STB satellite and requires that it be in optical visibility of the station S3. In addition, when the STB satellite is in a position D in which it is in optical visibility of the station S2, the STB satellite exchanges a fourth secret key via a quantum channel CQB2 connecting the second STB satellite to the second communication station S2.

[0051] The aim of the method of the invention is to send the first key K} to the second station S2 in a perfectly secure manner so that the stations S1 and S2 can communicate securely with this key without it being necessary for the satellite STA to fly over the station S2 and while considerably easing the planning of the respective operations of the satellites STA and STB.

[0052] In the invention, the steps of exchanging secret keys by quantum channel can be carried out by any QKD protocol known to those skilled in the art. It is recalled that cloud cover above a terrestrial communication station blocks any optical link in free space in the visible and near infrared. In addition, the sun generates large quantities of parasitic photons by diffraction in the atmosphere (indirect irradiance) which strongly degrade the detection of qbits which can lead to the breaking of the link. Thus, the current state of the art of QKD by satellite allows the transmission of qbits by the optical link in near infrared through the atmosphere in clear skies. Thus the availability of the quantum channel between a satellite and a terrestrial communication station is dependent on meteorological events and hazards above the station.

[0053] It is understood that, in the method of the invention, the relative order of the progress of steps A and B is unimportant. Also, the two steps A and B can be implemented simultaneously or one after the other (either step A then step B or B then A).

[0054] After steps A and B, the method of the invention comprises a step C consisting of receiving in the satellites STA and STB a communication request between the station SI and the station S2 emitted by a so-called transmitting station and transmitted via a request channel CR. According to the embodiment illustrated in [Fig.3B] the request is emitted by the station S1 which therefore forms the transmitting station. Alternatively, according to another embodiment, the request is emitted by the station S2 or the station S3 or another station, for example a mission control station, different from the stations S1-S3 (not shown in [Fig.3B]).

[0055] This request channel CR is an authenticated channel which does not necessarily require optical visibility between the satellites STA and STB and the transmitting station. It can for example be an RF channel or an optical channel. Also, step C is temporally decorrelated from steps A and B and can therefore be implemented at a time when the STA and STB satellites are not in optical visibility of the transmitting station, for example because they are too far from this station or because the atmospheric disturbances between the STA and STB satellites and the transmitting station are too great. It can be transmitted only when the need arises to communicate securely between stations S1 and S2.

[0056] After receiving this request, in a step D, the satellite STA is adapted to encrypt the first secret key K by a symmetric encryption method which uses the second secret key K so as to generate a first encrypted message ^Ci2. In addition, step D comprises transmitting the first encrypted message to the common station S3 by a first authenticated channel CAb

[0057] Similarly, after receiving the request, in a step E, the satellite STB is adapted to encrypt the fourth secret key K^ by a symmetric encryption method which uses the third secret key K-^ so as to generate a second encrypted message ^C43. The satellite STB then transmits a second encrypted message to the common station S3 by a second authenticated channel CA2.

[0058] Just like the request channel CR, the authenticated channels CAh CA^ are not channels which necessarily require optical visibility between the satellites STA and STB and the station S3 because the steps D and E are temporally decorrelated from the steps A and B. The authenticated channels CAh CA2 can therefore be any conventional channels of opportunity authenticated in the RF or optical domain (see below).

[0059] Furthermore, it is understood that the relative order of the performance of steps D and E is unimportant in the method of the invention. Also, the two steps D and E can be implemented simultaneously or one after the other.

[0060] After these steps D and E, the method of the invention comprises two steps F and G implemented in the common station S3. Step F consists of decrypting the first encrypted message KC i2 using the second secret key K2 so as to obtain the first secret key K1 and decrypting the second encrypted message KC43 using the third secret key K3 so as to obtain the fourth secret key K^,

[0061] After step F, the common station S3 is adapted to implement step G consisting of encrypting the first secret key K f by a symmetric encryption method which uses the fourth secret key A4dc so as to generate a third encrypted message KCI4. In addition, step G comprises the transmission of the third encrypted message ^C14 to the second communication station S2 by a third authenticated channel CA3.

[0062] At the end of the method in FIG. 3A, the station S2 is able to decrypt the third encrypted message KC 14 with the fourth secret key K4 that it had previously exchanged by QKD with the satellite STB. It is therefore able to obtain the first secret key K} which then forms the secure secret key (see method in FIG. 4). Thus, the first and second communication stations SI, S2 are each able to possess the secure secret key K]. The steps implemented in the method of the invention (QKD and symmetric encryption) being resistant to the quantum threat, the method of the invention therefore makes it possible to provide a secure secret key for the encryption of communications between station SI and station S2.

[0063] As mentioned previously, in the invention, steps A and B of exchanging secret keys by QKD are temporally decorrelated from the distribution of encrypted messages KCX2> KC43 to station S3 in steps D and E respectively. Thus, the distribution of encrypted messages KC^ KC43 via channels CAh CA2 respectively does not necessarily require optical visibility between satellites STA, STB and common station S3. Concretely, this implies that in step D, satellite STA can be significantly further from station S3 when it carries out the distribution of encrypted message KC12 than when it is in position B to carry out the exchange of key K2 with station S3. Similarly, in step E, the STB satellite may be significantly further from station S3 when it performs the distribution of the encrypted message KC43 than when it is in position C to perform the exchange of the key K3 with station S3.This time separation between the exchange of the secret keys K-^ K2 by QKD and the distribution of the encrypted messages is not present in the methods of the prior art. Indeed, in these methods of the prior art, the distribution of the secure secret key was carried out by the satellite during the overflight of a station almost simultaneously after establishment of an encryption key by QKD to encrypt the transmission of the secure secret key between the satellite and the station (see [Fig.2B]).

[0064] The solution of the invention makes it possible to considerably relax the planning of operations compared to the method of the prior art illustrated in Figure 2B. In addition, the solution of the invention makes it possible to delay the distribution of encrypted messages, for example, depending on the needs of the users of the stations SI and S2 and therefore to avoid prolonged storage of the secret keys K h K4 and the encrypted messages in the common station S3 which could potentially be compromised. In addition, the solution of the invention makes it possible not to have to implement trajectories of the two satellites STA, STB which successively fly over the first and second stations SI, S2 which it is desired to connect: the work can be shared between the satellites STA, STB by packets of stations (SI, S3) and (S3, S2) and not by packets of pairs of stations (SI, S2) as is usually envisaged in the prior art.

[0065] It is understood that the fact of temporally decorrelating steps A and B from the rest of the steps of the invention implies that the satellites STA and STB can securely store the keys K2 and the keys K3, K4 respectively after their exchange by QKD.

[0066] According to the invention, the symmetric encryption method of steps D, E and G can be any block or stream method known to those skilled in the art, for example the disposable mask method or the AES method (for Advanced Encryption Standard in English) or the Triple DES method.

[0067] In the invention, step G may alternatively consist of generating a third encrypted message KC4i generated by encrypting the fourth secret key K 4 by a symmetric encryption method which uses the first secret key and transmitting the third encrypted message KC14 to the communication station SI by a third authenticated channel CA?. These two formulations are equivalent, the only difference being that, in the first alternative, the key K! is the secure secret key for encrypting communications between the station SI and the station S2 whereas, in the second alternative, the key is the secure secret key.

[0068] As mentioned previously, the channels CAj and CA? can be any authenticated classical channels of opportunity. According to a preferred embodiment of the invention, denoted MR, the channels CA4 and CA2 are different from the quantum channels CQas and CQbs respectively.

[0069] According to an embodiment of the method of the invention noted MP, in step A, the reconciliation sub-step necessary for the exchange of the secret key K2 is carried out via the channel CAb. Similarly, in step B, the reconciliation sub-step necessary for the exchange of the secret key K3 is carried out via the channel CA2. Indeed, these reconciliation sub-steps, just like the steps for distributing the encrypted messages KC12, ^6'43 do not require that the satellites STA and STB be in optical visibility of the common station S3. Thus, it is possible to simplify the architecture of the network of the system 1 by pooling some of the links necessary for its operation. This embodiment MP is compatible with the embodiment MR.

[0070] According to another embodiment, compatible with the MR embodiment and the MP embodiment, the first authenticated channel and / or the second authenticated channel are each a bidirectional telemetry / remote control link of the first satellite and the second satellite respectively. Here, the term "bidirectional telemetry / remote control link of the satellite" refers to a link allowing, on the one hand, the control, configuration and programming of the mission of the satellite and, on the other hand, the measurement of the configuration and state of the satellite. Thus, it is possible to simplify the architecture of the network of the system 1 by pooling some of the links necessary for its operation.

[0071] According to another embodiment of the system of the invention, the first authenticated channel and the second authenticated channel are each an RF or optical anchor link of a telecommunications service carried by the first satellite and the second satellite respectively. This embodiment also makes it possible to simplify the architecture of the system network 1.

[0072] The system of any one of claims 7 to 10, wherein the first authenticated channel and the second authenticated channel are each an RF or optical anchor link of a telecommunications service carried by the first satellite and the second satellite respectively.

[0073] Figure 3C schematically illustrates an embodiment of the system 1 of Figure 3B, in which the authenticated channel CA2 is relayed by an additional satellite SR via an inter-satellite link LI connecting the satellite STB and the additional satellite SR. This link LI is for example an optical or RF link. This embodiment makes it possible to improve the availability of the system 1, for example when the satellite STB is too far from the station S3 to be able to communicate with it directly without the intermediary of the additional satellite SR. More generally, according to an embodiment of the system 1 of the invention the first and / or the second authenticated channel CAb CA2 are / is relayed by the additional satellite SR via an inter-satellite link LI connecting the additional satellite SR and respectively the satellite STA and STB.

[0074] Advantageously, according to an embodiment of the system 1 of FIG. 3C, the additional satellite SR is configured to operate at an altitude higher than clouds and atmospheric turbulence, for example in the stratosphere or in orbit. In addition, the portion of the channel CA2 between the station S3 and the additional satellite SR uses a wavelength in the RF, visible or LWIR domain so as not to be subject to possible disturbances linked to meteorological conditions (e.g. clouds). Finally, the portion of the channel CA2 between the satellite STB and the additional satellite SR uses a length making it possible to maximize the transmission capacity, for example a wavelength in the SWIR domain (for Short Wavelength InfraRed, typically between 1 and 2.7 [mï). This embodiment makes it possible to optimize the operation of the system 1 by making it more robust to meteorological hazards.

[0075] [Fig. 3D] schematically illustrates an embodiment of the system 1 of the invention in which the communication request sent by the transmitting station (for example the station SI as illustrated in [Fig. 3D]) is relayed to the satellites STA and STB by a local station SL capable of communicating with these satellites via an authenticated local link LL. This embodiment is advantageous in order to take advantage of a possible overflight of the station SL by the satellites STA and STB while they are too far from the transmitting station for the latter to be able to transmit the communication request directly to them.

[0076] Figure 4 illustrates a preferred embodiment of the method of the invention. This method is particularly suitable for being implemented by the system 1 of Figure 3B. The method of Figure 4 comprises an additional step H which consists of decrypting, in the second communication station S2, the third message encrypted KC14 using the fourth secret key K4. Thus, station S2 obtains the first secret key KA,

[0077] This step H is necessary so that the stations SI and S2 both have the secure secret key K} that they can subsequently use to encrypt non-random messages that they wish to exchange (see Figures 5A and 5B). Indeed, given that the encryption of the secure secret key in step G is carried out by a symmetric encryption method, the decryption of the first encrypted message ^C14 is carried out with the same key as that used for encryption, i.e. the fourth secret key K4. Thus, the method of Figure 4 makes it possible to easily distribute in a secure and tamper-proof manner - even by quantum attack - a secure secret key K। to encrypt communications between the station SI and the station S2 by relaxing the key distribution constraints compared to other methods of the prior art.

[0078] According to an embodiment of the method of [Fig.4], steps A to H are repeated a plurality of times in order to form a plurality of secure secret keys each intended to secure communications between station SI and station S2.

[0079] In a preferred embodiment of the invention, the symmetric encryption method is the disposable mask method. In this embodiment, the secret keys K2, K^ and the encrypted messages KCl2, KC±3, KC^ t are binary coded. Thus, the encryption steps are each performed by the XOR logic gate by combining the secret keys respectively involved in said encryption step. For example, in step D, the encryption step is obtained by combining the first and second secret keys K2, by the following logical operation KC12 — Ki®K2. Similarly, the decryption steps are each performed by the XOR logic gate combining the encrypted message with the encrypted secret key which are respectively involved in said decryption step.For example, in step F, the step of decrypting the first encrypted message KC l2 is carried out by the following logical operation: KC l2®K2=Ki®K2®K2 — K^cq which allows the station S3 to obtain the key This embodiment is the one which allows the least complex implementation of the invention.

[0080] In order to ensure the safety of the disposable mask technique in the invention, all steps implementing the disposable mask technique combine two secret keys or a secret key and a key and an encrypted message which are of the same length (key size in English).

[0081] [Fig.5A] illustrates a preferred embodiment of the method of [Fig.4], making it possible to securely exchange a non-random message M between the station SI and the station S2. [Fig.5B] schematically illustrates an embodiment of the system of the invention adapted to implement the method of [Fig.5A]. In In addition to the previously detailed steps, the method of [Fig.5A] includes two subsequent steps I and J which consist of:

[0082] I - encrypt, in the first communication station SI, a non-random message M using a first secret key K} and transmit the encrypted non-random message MC to the second communication station S2'

[0083] J- decrypt the non-random message encrypted using the first secret key in step F. Thus, the station S2 obtains the non-random message M in a perfectly secure manner.

[0084] According to an embodiment different from that illustrated in [Fig.5B], the message M is exchanged from the station S2 to the station SI.

[0085] According to a preferred embodiment of the method of Figure 5A, steps I and J are repeated a plurality n of times in order to encrypt a plurality of communications between the station S1 and the station S2. The number n of repetitions of steps I and J is less than a so-called critical number calculated from a crypto-period of the key used for the encryption of the message M and the decryption of the message MC. This characteristic makes it possible to avoid the compromise of the exchanged messages and is relevant when encoding a non-random message M (for example human language). Here, the term "crypto-period" refers to the number of uses of a key in an encryption algorithm which must not be exceeded in order to guarantee the security of the message encrypted by this key.

[0086] Finally, another object of the invention is the common station S3 of the system 1 described above. The station S3 is therefore suitable for: - receive the second secret key K2 exchanged via the quantum channel CQA3 - receive the third secret key K3 exchanged via the quantum channel CQB3 - receive, via the CA^ channel, the first encrypted KC l2 message transmitted by the first STA satellite - receive, via the CA2 channel, the second encrypted KC43 message transmitted by the second STB satellite - decrypt the first encrypted message KC12 using the second secret key K2 so as to obtain the first secret key Kh and decrypt the second encrypted message ^C43 using the third secret key K3 so as to obtain the fourth secret key K^ - encrypt the first secret key A” । by a symmetric encryption method which uses the fourth secret key K^ so as to generate the third encrypted message KC 14 and transmit the third encrypted message to the second communication station S2 by a third authenticated channel ca3.

[0087] The common station S3 of system 1 is therefore suitable for implementing a method in which the stages are "localized" in the same geographical area (i.e. station S3), instead of being distributed over different stations and satellites spaced several hundred or thousands of kilometers apart.

Claims

1. Claims A secure secret key sharing method for securing communications between a first communication station (SI) and a second communication station (S2), said method comprising the following steps: A. exchanging, via a quantum channel (CQai) connecting a first satellite (STA) to the first communication station (SI), a first secret key (X'J and exchanging, via a quantum channel (CQAÎ) connecting the first satellite (STA) to a third communication station called a common station (S3), a second secret key B. exchange, via a quantum channel (CQbs) connecting a second satellite (STB) to the common station (S3), a third secret key) and exchange, via a quantum channel (CQB2) connecting the second satellite (STB) to the second communication station (S2), a fourth secret key C. receiving, in the first and second satellites (STA, STB), a communication request between the first and second communication stations, D. encrypting, in the first satellite, the first secret key (A) by a symmetric encryption method which uses the second secret key (K) so as to generate a first encrypted message (AC12) and transmitting the first encrypted message to the common station (S3) by a first authenticated channel (CAj) E. encrypt, in the second satellite, the fourth secret key ( by a symmetric encryption method which uses the third secret key (K^, so as to generate a second encrypted message (AC43) and transmit the second encrypted message to the common station (S3) by a second authenticated channel (CA2) F. in the common station (S3), decrypt the first encrypted message (AC]2) using the second secret key (A2), so as to obtain the first secret key (K^), and decrypt the second encrypted message (AC43) using the third key secret key (^3), so as to obtain the fourth secret key (K*) G. encrypt, in the common station (S3), the first secret key (K j by a symmetric encryption method which uses the fourth secret key (K^ so as to generate a third encrypted message (KC i4) and transmit the third encrypted message to the second communication station (S2) by a third authenticated channel (CA3).

2. Method according to the preceding claim, comprising a subsequent step H consisting of decrypting, in the second communication station, the third encrypted message (^C14) using the fourth secret key (^4), so as to obtain the first secret key (Æ j, the first secret key forming the secure secret key.

3. Method according to the preceding claim, said symmetric encryption method is the disposable mask method and wherein the secret keys (K^ K2, and the encrypted messages ( KC^, KC^ KC41) are binary coded, the encryption steps each being performed by the XOR logic gate combining the secret keys respectively involved in said encryption step, the decryption steps each being performed by the XOR logic gate combining the encrypted message with the encrypted secret key which are respectively involved in said decryption step.

4. Method according to any one of claims 2 to 3, comprising two subsequent steps I and J which consist of: I. encrypting, in the first communication station, a non-random message (M) using the first secret key then transmitting the encrypted non-random message (MC) to the second communication station by a so-called clear channel J. decrypting, in the second communication station, said encrypted non-random message using the first secret key.

5. A method according to any one of claims 2 to 4, wherein steps A to H are repeated a plurality of times to form a plurality of secure secret keys.

6. Method according to any one of the preceding claims, wherein in step A, the exchange of the second secret key requires a reconciliation sub-step carried out via said first channel au- authenticated and / or, in step B, the exchange of the third secret key requires a reconciliation sub-step carried out via said second authenticated channel.

7. A method according to any one of claims 2 to 6, wherein steps A to H are repeated a plurality of times with a pair of communication stations different from the first and second communication stations.

8. Communication system comprising a first and a second communication station (SI, S2), a third communication station called common station (S3) and a first and a second satellite (STA, STB), said first satellite (STA) being adapted to exchange, via a quantum channel (CQAi) connecting the first satellite (STA) to the first communication station (S3), a first secret key and to exchange, via a quantum channel (CQA3) connecting the first satellite (STA) to the common station (S3), a second secret key, said second satellite (STB) being adapted to exchange, via a quantum channel (CQbs) connecting the second satellite (STB) to the common station (S3), a third secret key and to exchange, via a quantum channel (CQbs) connecting the second satellite (STB) to the second communication station,a fourth secret key (X"), the first satellite being further adapted to receive a communication request between the first and second communication stations transmitted via a clear request channel (CR), and after which encrypt the first secret key (K) by a symmetric encryption method which uses the second secret key so as to generate a first encrypted message (KCl) and transmit the first encrypted message to the common station (S) by a first authenticated channel (CA), the second satellite being further adapted to receive said communication request, and after which encrypt the fourth secret key (K) by a symmetric encryption method which uses the third secret key (K) so as to generate a second encrypted message (KC) and transmit the second encrypted message to the common station (S) by a second authenticated channel (CA), the common station being adapted to: • decrypt the first encrypted message (^C12) using the second secret key (^¾ so as to obtain the first secret key (K\^ and decrypt, in the common station (S3), the second encrypted message (KC43) using the third secret key (^3), so as to obtain the fourth secret key (K3) • encrypt the first secret key (K by a symmetric encryption method which uses the fourth secret key (K 4), so as to generate a third encrypted message (^C!4) and transmit the third encrypted message to the second communication station (S2) by a third authenticated channel (CA3)

9. System according to the preceding claim, in which the second communication station is adapted to decrypt the third encrypted message (£^4) using the fourth secret key (^4), so as to obtain the first secret key (K ]), the first secret key forming the secure secret key.

10. The system of claim 8 or 9, wherein the first authenticated channel and / or the second authenticated channel are each a two-way telemetry / remote control link of the first satellite and the second satellite respectively.

11. System according to any one of claims 8 to 10, wherein the first authenticated channel is relayed by an additional satellite (SR) via an optical or RF inter-satellite link (LI) connecting the additional satellite and the first satellite and / or the second authenticated channel is relayed by an additional satellite (SR) via an optical or RF inter-satellite link (LI) connecting the additional satellite and the second satellite.

12. A system according to any one of claims 8 to 9 or 11, wherein the first authenticated channel and the second authenticated channel are each an RF or optical anchor link of a telecommunications service carried by the first satellite and the second satellite respectively.

13. System according to any one of claims 8 to 11, the first authenticated channel is different from the quantum channel connecting the first satellite to said common station (S3) and the second channel au- authenticated is different from the quantum channel connecting the second satellite to said common station (S3).

14. System according to any one of claims 8 to 12, in which the clear request channel is relayed by a local station (SL) capable of communicating with the first and the second satellite via an authenticated local link (LL).

15. Communication station called common station (S3), said station being adapted for: - receive a second secret key exchanged via a channel quantum (CQA3) connecting a first satellite (STA) and the common station (S3), - receive a third secret key j exchanged via a quantum channel (CQB3) connecting a second satellite (STB) to the common station (S 3) - receive, via a first authenticated channel, a first encrypted message (KC}2) transmitted by the first satellite and generated by a symmetric encryption method which encrypts, with the second secret key, a first secret key exchanged via a quantum channel (CQAi) connecting the first satellite (STA) to a first communication station (SI), and - receive, via a second authenticated channel, a second encrypted message (J^C43) transmitted by the second satellite and generated by a symmetric encryption method which encrypts, with the third secret key, a fourth secret key exchanged via a quantum channel (CQB2) connecting the second satellite (STB) to a second communication station (S2), - decrypt the first encrypted message (KC12) using the second secret key (^2), so as to obtain the first secret key (^J, and decrypt the second encrypted message (KC4Î) using the third secret key (^3), so as to obtain the fourth secret key (K^) - encrypt the first secret key (A^) by a symmetric encryption method which uses the fourth secret key (K^, so as to generate a third encrypted message (KC} 4) and transmit the third encrypted message to the second communication station (S2) by a third authenticated channel. 23

Images