A node for a quantum communication system, a quantum communication system and method

Abstract

A node in a quantum communication system comprising a quantum key distribution unit (QKD) unit configured to allow a quantum key to be distributed between the node and an external further node. The node further comprises a post processing module applying post processing to the quantum key to produce a key with a predefined security parameter. The module comprises a controller configured to allow the security parameter applied to a quantum key to be changed for different quantum keys, the security parameter indicating the probability of security failure. The node also comprises a first key store and a second key store, wherein the node is configured to store keys having a security parameter with a value in a first range in the first store, and keys having a security parameter with a value in a second range in the second store, the first range having different values to the to the second range. The node may also comprise an authentication module. A method of quantum communication is also disclosed. Further disclosed is a method of operating a QKD system characterised by producing keys for a particular key store when the number of existing keys is below a threshold.

Description

FIELD Embodiments described herein relate to a node for a quantum communication system, a quantum communication system and method BACKGROUND Quantum Key Distribution (QKD) is a technology for the generation of random digital keys shared between remote users (conventionally referred to as Alice and Bob), where the security of the key exchange process can be quantified using theoretical principles alone (specifically, information theory and quantum theory). This means that QKD is secure against attacks where the eavesdropper (conventionally referred to as Eve) may possess extreme computational power (e.g. a large-scale fault-tolerant quantum computer). This is in stark contrast to conventional public key cryptography approaches to key exchange (such as RSA, Elliptic Curve Cryptography etc.), which all rely on computational assumptions - i.e. the perceived difficulty for computers to perform certain tasks. In brief, QKD commonly operates by transmitting from a transmitter (usually referred to as Alice) and measuring quantum states at a receiver (usually referred to as Bob), then postprocessing the measurements to output a secure key. Due to the laws of quantum mechanics, any attempts by an eavesdropper to intercept the quantum states will result in them unavoidably altering the states. This can therefore be detected based on the measurements at Bob and post-processing performed using classical communication between Alice and Bob. Intuitively, through post-processing the two users can effectively "process out” the eavesdropper’s impact (e.g. if she interfered with or measured any states during transit), to output only secure keys. Of course, the more an eavesdropper interferes with the train of transmitted quantum states, the more processing and bit-discarding that must be performed to remove her influence, reducing the size of the outputted secure key. BRIEF DESCRIPTION OF THE FIGURES FIG. 1 is a schematic of the communications between two nodes in a QKD system; FIG. 2 is a schematic of a method of generating and storing QKD keys; FIG. 3 is a schematic of a method of generating and storing QKD keys in accordance with an embodiment; FIG. 4 is a plot of key rate per raw key bit against length for different security parameters; FIG. 5 is a flow diagram showing a method of generating and storing keys where the size of the key store is monitored in accordance with an embodiment; FIG. 6 is a schematic of a node in accordance with an embodiment; and FIG. 7A is a schematic of an emitter for use in a QKD system and FIG. 7B is a schematic of a receiver for use in a QKD system. DETAILED DESCRIPTION In an embodiment, a node in a quantum communication system, the node comprising: a quantum key distribution unit configured to allow a quantum key to be distributed between the node and an external further node; a post processing module, said post processing module being configured to apply post processing to the quantum key to produce a key with a predefined security parameter, the post processing module comprising a controller configured to allow the security parameter applied to a quantum key to be changed for different quantum keys, security parameter indicating the probability of security failure; a first key store and a second key store, wherein the node is configured to store keys having a security parameter with a value in a first range in the first key store, and keys having a security parameter with a value in a second range in the second key store, the first range having different values to the to the second range. The above provides a flexible post-processing and key storage scheme whereby the postprocessing parameters are dynamically adjusted upon demand, in response to QKD system needs. The above provides key management for quantum key generating systems comprising separate key stores for different applications, where the keys in each keystore have different security parameters (resulting from processing stages with different parameter sets). The above also provides dynamical adjustment of post-processing parameters in a quantum communications system to optimise the long-term security of key generation. The system parameters (that affect the security of the overall system / generated keys) are dynamically optimised to maximise long-term security of key generation. In an embodiment, the post processing module is configured to perform privacy amplification. In an embodiment, the post-processing is performed either in software or using hardware-acceleration (e.g. on FPGA / using ASICs). The post-processing may be colocated with a QKD system, or in a separate module provided at the same location. For example, the QKD unit could be a low-processing-power computer and then the keys are sent over local LAN to a high-compute server that’s in the same network. QKD security typically concerns protection of the channel between nodes (over many km) and not protection of the LAN at a given node. In an embodiment, the node further comprises an authentication module, the authentication module being configured to authenticate communication over a classical communication channel with the further node. The authentication module can be configured to perform authentication using an authentication key obtained via the quantum key distribution unit. Thus, the QKD module is used to supply potential keys for authentication as, authentication keys will be updated either for every QKD session or eveiy TVQKD sessions where Ms an integer of at least 2. The quantum key distribution unit is configured to sift the quantum key using communication over an authenticated classical communication channel between the node and the further node. The authenticated channel can also be used for communications during error detection / correction and during privacy amplification. The node may also comprise a classical communication module configured to encrypt or decrypt communication using a key obtained via the quantum key distribution unit This allows the node to send or receive messages that have been encrypted with the QKD key which has been shared between two nodes. However, in a further embodiment, the QKD systems does not have to perform this encryption itself. In many cases, customers buy QKD systems to generate keys, which are then delivered to them for them to perform their own encryption. Thus, in an embodiment, the key store for non-authentication keys can also be used for delivering keys to "applications” where the application is left up to the user. In an embodiment, the values of the security parameter in the first range are lower than the values of the security parameter in the second range, the authentication module being a configured to access the first key store to obtain keys for authentication, the classical communication module being configured to obtain keys for encryption from the second key store. Thus, the keys which are used for authentication are more secure than those used for encrypting communications. In an embodiment, the security of the keys used for authentication is higher than those used to encrypt communications, this is because the security of the authentication key will affect the security of any keys generated where the authentication key is used in operations such as sifting, error correction and privacy amplification. The controller may be configured to receive a control signal, the controller being configured to determine the value of the security parameter for a key to be stored in response to the control signal. For example, the user or an external device such as another node may provide a control signal. Thus, in this situation, the post-processing parameters for keys that get outputted to each key store are user-adjustable. In a further embodiment, the parameters of processing (specifically the target security parameter in the privacy amplification stage) are determined based on some threshold size of each key store. Thus, the control signal may be provided by a monitoring circuit configured to monitor the number of keys in the first store which provides the control signal to post process keys to achieve a security parameter with values in the first range when the number of keys in the first store is equal to or below a threshold and to post process keys to achieve a security parameter with values in the second range when the number of keys in the first store is greater than a threshold. In an embodiment, the node will be capable of communicating with two or more nodes. Since authentication keys are specific to pairings of nodes, the thresholds are determined for each pair of nodes. The threshold may be the number of keys in a key store for authentication purposes. However, the threshold may be set for other purposes. In a QKD system when there are a plurality of nodes, the key stores in different nodes may be of different sizes and different thresholds might be set. When a key is generated, it is generated between two nodes, if one node has satisfied a condition for generating more authentication keys, it will send a control signal to the other node to advise the other node to also post process for authentication keys even if the other node has not reached a condition to generate further authentication keys. In other examples, the two nodes would be well synchronised in terms of parameters and key stores. The above has discussed two keys stores for two different security parameter ranges, but three or more key stores can be provided each storing keys with a different ranges of security parameters. In an embodiment, the first range may comprise keys having a security parameter from le-14 to le 22, the second range may comprise keys having a security parameter from le 8 to le-14 In a further embodiment, the quantum key distribution unit comprises at least one of: an encoder, said encoder being configured to encode information on light, wherein the information is encoded by randomly selecting one state from a plurality of states to send to said user node, the light leaving said server in pulses which contain on average less than one photon; and a decoder, said decoder being configured to receive light pulses which contain on average less than one photon and decode information from said light pulses by measuring said light pulses, wherein the measurement basis for the measurement are randomly selected from a set of measurement bases to allow measurement of the states used to encode the information, the quantum key distribution unit further comprising a sifting unit configured to allow the server to compare the basis it used for encoding or decoding with that used by the user node for decoding or encoding, the quantum key distribution unit being configured to discard the information from pulses where the encoding basis and the decoding measurement basis did not match. In an embodiment, the QKD distribution unit will comprise both a transmitter and a receiver dependent on whether the node is to work as a transmitter or a receiver during the QKD process. However, it is possible for the node to contain just a transmitter if it will just perform QKD with nodes which have a receiver and also a node may contain just a receiver if it will just perform QKD with nodes which have a transmitter. The above is not limited to a prepare and measure type QKD system, but any type of QKD system could be used including entanglement based systems, for example where the quantum communications system is a discrete variable (DV) QKD system, implementing a protocol such as (but not limited to) BB84, T12, MDI QKD or TF QKD. In further embodiments, the quantum communications system is a continuous variable (CV) QKD system. In an embodiment, a quantum communication system is provided which comprises a plurality of nodes. In a further embodiment, a method of quantum communication is provided, the method comprising: performing at a first node, quantum key distribution with a second node to obtain quantum key between the first node and the second node; performing post processing at the first node the quantum key to produce a key with a predefined security parameter, the post processing being controlled to allow the security parameter applied to a quantum key to be changed for different quantum keys, security parameter indicating the probability of security failure; storing by the first node, keys having a security parameter with a value in a first range in a first key store, and storing by the first node, keys having a security parameter with a value in a second range in the second key store, the first range having different values to the to the second range. In an embodiment, performing quantum key distribution comprises siftingthe quantum key using communication over an authenticated classical communication channel between the node and the further node. In an embodiment, encrypting or decrypting communications is performed using a key obtained via the quantum key distribution unit Since the keys which are used for encrypting and decrypting classical communications are not re-used to generate further keys, they can have higher security parameters than the authentication keys, the security parameters of which will contribute to the security of any quantum keys which are produced using the authentication keys for authentication. Thus, in an embodiment, the security parameter in the first range are lower than the values of the security parameter in the second range, keys being obtained from the first key store for authentication and keys for enciyption / decryption being obtained from the second key store. In an embodiment, the method further comprises monitoring the number of keys in the first key store and controlling the post processing to produce keys to achieve a security parameter with values in the first range when the number of keys in the first store is equal to or below a threshold and to post process keys to achieve a security parameter with values in the second range when the number of keys in the first store is greater than a threshold. The above has mainly referred to the security parameter, but other parameters, for example, the ‘key processing block size’ could be one of the parameters that is dynamically optimised for different key stores. In a further embodiment, a method of operating a QKD system is provided, the method comprising: obtaining an authentication key from a first key store; authenticating a first communication channel between a first node and a second node using the obtained authentication key; performing quantum key distribution between the first node and the second node, the quantum key being sifted using communication over the authenticated first channel to establish a first quantum key for the first user and server; determining the number of authentication keys in the first key store, wherein when the number of authentication keys in the first key store is below a threshold, post processing the quantum key to produce authentication keys for the first key store which have a security parameter within a first range of values; and wherein when the number of authentication keys in the first key store is above a threshold, post processing the quantum key to produce authentication keys for a second key store which have a security parameter within a second range of values, security parameters within the second range being higher than the security parameters in the first range. In a further embodiment, the first security parameter is lower than the second security parameter, the authentication module being a configured to access the first key store to obtain keys for authentication, the classical communication module being configured to obtain keys for encryption from the second key store. In a further embodiment, a method of operating a QKD system is provided, the method comprising: performing quantum key distribution between a first node and a second node to generate quantum keys; post processing the quantum keys to produce keys using at least one control processing parameter to produce keys of different types; storing the post processed keys in key stores such that each key store comprises keys of the same type; monitoring the number of keys in the different key stores and when the number of keys in a key store is below the threshold for that key store, controlling the post processing parameters of generated quantum keys to produce further keys to replenish the keys in the key store where the number of keys is below a threshold, wherein keys of the same type have parameters within predefined ranges. For example, in one embodiment, keys of the same type may have their security parameter within a set range. Other parameters could also be used, for example the key processing block size or the raw key length. FIG. 1 is a schematic of a quantum communication system. In this embodiment, a QKD protocol is described which is termed a prepare-and-measure point-to-point QKD protocol. However, other protocols such as (but not limited to) entanglement-based QKD, MDI QKD and TF QKD could also be used with the methods described herein. A basic prepare-and-measure point-to-point QKD protocol which uses polarisation will now be explained. However, it should be noted that this is not meant as limiting and other polarisation based protocols could also be used. Further, the above server could be used with any QKD system and is not limited to uses with polarisation. For example, phase or energy / time based QKD protocols could also be used. The protocol uses two bases wherein each basis is described by two orthogonal states. For this example the basis of horizontal / vertical (H / V) and Diagonal / Antidiagonal D / A. However, the left circularly polarized / right circularly polarized (L / R) basis could also be selected. The sender (Alice) in the protocol prepares states with one of H, V, D or A polarisation in step SI. In other words, the prepared states are selected from two orthogonal states (H and V or D and A) in one of two basis H / V and D / A. This can be thought of as sending a signal of 0 and 1 in one of two basis, for example H=0, V=1 in the H / V basis and D=0, A=1 in the D / A basis. The pulses are attenuated so that they comprise on average, one photon or less. Thus, if a measurement is made on the pulse, the pulse is destroyed. Also, it is not possible to split the pulse. The receiver (Bob) uses a measurement basis for the polarisation of a pulse selected from the H / V basis or the D / A basis in step S3. The selection of the measurement basis can be active or passive. In passive selection the basis is selected using fixed components, such as a beam splitter. In "active" basis choice, the receiver makes a decision which basis to measure in - e.g. using a modulator with an electrical control signal. If the basis used to measure the pulse at the receiver is the same as the basis used to encode the pulse, then the receiver’s measurement of the pulse is accurate. However, if the receiver selects the other basis to measure the pulse, then there will be a 50% error in the result measured by the receiver. To establish a key, the sender and receiver compare the basis that were used to encoder and measure (decode) in step S5. If they match, the results are kept, if they do not match the results are discarded. This process is generally referred to as sifting. If an eavesdropped intercepts the pulses and measures then, the eavesdropper must prepare another pulse to send to the receiver. However, the eavesdropper will not know the correct measurement basis and will therefore only has a 50% chance of correct measuring a pulse. Any pulse recreated by the eavesdropper will cause a larger error rate to the receiver which can be used to evidence the presence of an eavesdropper. The sender and receiver compare a small part of the key to determine the error rate and hence the presence of an eavesdropper in step S7. Next, in step S9, privacy amplification is performed. Privacy amplification uses Alice and Bob's key to produce a new, shorter key, in such a way that an eavesdropper has only negligible information about the new key. This can be done using a universal hash function chosen at random from a publicly known set of such functions, which takes as its input a binary string of length equal to the key and outputs a binary string of a chosen shorter length. The amount by which this new key is shortened may be calculated based on the error rate measured in S7 and the desired security of the QKD system. The keys obtained in S9 are then output to key stores in Alice and Bob’s equipment The objective of privacy amplification is to reduce the probability that the eavesdropper has any knowledge about the key below a certain boundary, e (the security parameter). Specifically, this involves converting a weak secret string (error corrected keys from the QKD sifting process) to a secure key that is maximally unknown by Eve. In terms of implementation, privacy amplification uses mathematical randomness extraction techniques, often using randomly chosen hash functions, to shorten the weak secret key to reduce the amount of information obtained by Eve as much as possible. By sacrificing partial key information of Alice and Bob, privacy amplification makes the knowledge obtained by Eve (i.e. as quantified intuitively by e) be as small as possible. The steps of privacy amplification can be summarised as follows: 1) After the sifting stage, Alice and Bob independently compute the final key length they need to achieve, which depends on the security proof and various parameters that are included in the proof. These parameters include measured quantities such as link quantum bit error rate (QBER) for each session as well as QKD System design parameters such as processing block size and critically, the desired security parameter e. 2) Alice selects randomly an appropriate hashing function belonging to a publicly known 2-universal class and communicates it to Bob (where the processing function is chosen to satisfy the required final key length given the input string size). 3) Alice and Bob perform hashing with this function, acting upon their error corrected keys to output a secure (but shorter) final QKD key. Although the above has been described in relation to polarisation this is as an illustration. Other QKD protocols could be used which are based on phase or other systems such as energy / time. The above QKD requires two channels, a "quantum channel” which is used for the communication of pulses that contain, one average, one photon or less, and a classical channel which is used for discussion of the basis ("sifting”), error correction and privacy amplification. Also, the classical channel can be used for further communication once the key has been established on the quantum channel. It should be noted that the term "channel” is used to refer to a logical channel. The quantum and classical channels may be provided within the same physical fibre. However, for the sifting process, error correction and privacy amplification, the classical channel also needs to be authenticated. This means that, without doubt, it can be verified that the classical messages communicated between Alice and Bob were sent by the other party and not tampered with in transit In other words, this avoids a man-in-the-middle attack. Authentication could be done using public key cryptography (e.g. RSA). However, in an embodiment, Alice and Bob authenticate each other using a pre-shared symmetric key (PSK). For completeness, it is noted that if two parties share a private key, they can authenticate each other using many different methods. One method involves the use of a message authentication code (MAC), which are often Wegman-Carter MACs. Here, the sender (e.g. Alice) and the receiver (e.g. Bob) share a key (PSK). In brief, to verify the authenticity and integrity of a message that Alice sends to Bob, Alice sends a MAC "tag” alongside the message itself. The MAC tag is computed at Alice by hashing the message and one-time-pad encrypting it using the PSK that is pre-shared with Bob. Bob verifies the message by computing the MAC tag for the message he receives and comparing it to the MAC tag that he receives from Alice. If the MAC tags match, then Bob accepts the message as authentic, since only Alice has the PSK needed to generate the exact MAC tag for that given message. Message authentication is often implemented using Wegman-Carter message authentication codes (MACs). There are many possible algorithms for generating an ITS MAC tag but the general idea is that some pre-shared secret is used to produce an authentication tag for a given message or series of messages. For example, the pre-shared key could be used to select a particular hash function from a family of available hash functions, and / or the key could be used to encrypt the hash before sending. However, despite the quantum nature of the key transmission, the security of QKD is probabilistic in nature. The final key can be claimed to be completely random and completely private, except with a probability e. With that probability e, one pessimistically assumes that an adversary might know the complete key. Thus, the security of QKD may be described by the "security parameter”, e, which defines the probability of a security failure (i.e. intuitively, the probability of an attacker learning a key). The security parameter e for a given protocol is determined by its security proof (derived from quantum mechanics, information theoiy etc.) which takes into account system parameters such as channel loss, error rate, size of processing data block etc. In an embodiment, a target security parameter is determined and privacy amplification is performed to achieve the target security parameter. The target security parameter can be determined to achieve a given probability of failure. The privacy amplification algorithm then performs enough processing to achieve this target. More privacy amplification processing means that more bits discarded (i.e. more secure so lower probability failure). The exact processing for privacy amplification depends on fairly complex mathematical formulae which are derived as partofthe security proof for QKD which involves information theory, statistics and quantum mechanics. This is the origin of the epsilon (i.e. security parameter) theoretically. Different protocols have different security proofs and thus potentially different ways that the epsilon is featured. Discussions of privacy amplification and security parameters can be found in ETSI GS QKD 005 vl.1.1 (2010-12), Quantum Key Distribution (QKD) Security Proofs and Liu et al "A Security Real-Time Privacy Amplification Scheme in QKD System, Journal of Universal Computer Science, vol. 19, no. 16 (2013) 2420-2436 There are many different protocols and proofs that exist for QKD, but the general concept is common and enables key generation with a known security parameter. There are various factors that contribute to e and for high-performance QKD systems, efforts are made to minimize this e value in order to offer maximum security. The aim of a QKD system could therefore be described more rigorously as generating information-theoretically secure (ITS) keys with security parameter e, where e is small. Note that the exact value of e that is considered acceptable is application / user dependent When considering cryptographic systems, the overall cryptographic application may be built up from various underlying cryptographic primitives (i.e. fundamental protocols which perform a given function). To analyse such cryptographic systems, the framework of Universally Composable Security can be used - providing the cryptographic primitives are compatible with this. A ‘universally composable’ primitive is thus described as a cryptographic protocol where its output can be used by another cryptographic protocol such that the security proof for each protocol can be evaluated independently. Universal Composability is a mathematical feature that forms part of the security proof for information-theoretically secure crypto primitives. This feature is independent of whether the primitive is for QKD post-processing, or authentication, or something else. Therefore, to meet the requirements (i.e. to be composable), the primitive’s security proof must explicitly consider the ability for the primitive to be analysed independent or other protocols. If a primitive satisfies the requirements to be called composable, then epsilons can be added together when used as part of a wider cryptosystem. This greatly simplifies the analysis of cryptographic systems composed of multiple primitives and enables the overall system security parameter £ to be bounded by the sum of each component’s independently derived security parameter. For example, if 2 composable primitive operations with security parameters Ei and £2 are used in a system, then the security parameter for the overall operation of the system, e, is: £ < £1 + S2 QKD is an ITS cryptographic primitive. However, the QKD protocol relies upon the existence of an authenticated classical communication channel for the post-processing stage. If an attacker can successfully spoof messages between the users, then this man-in-the-middle attack can render the keys outputted from the QKD system as insecure. Therefore, practical QKD system operation relies upon composing the QKD primitive (with security parameter £qkd-Primitive) and a message authentication primitive. If an ITS message authentication scheme is used with security parameter £auth (i.e. £auth refers to the probability of‘passing’ the authentication protocol while the output of Bob’s side is in any way distinguishable from Alice’s intended message - i.e. intuitively, the probability of Eve successfully forging a message), then a full QKD operation (including authenticated classical communication) outputs a QKD key with overall security parameter £, where: £ — £qkd-primitive + £auth It should be noted that there are other primitives upon which full QKD depends, such as random number generation for choosing the bit values and measurement bases. The security parameter of random number generation (i.e. quantifying the probability of a non-truly random selection), and potentially other factors, should therefore also be added to the overall system security parameter. Such additional factors can potentially be made negligible with judicious choice of device design / parameters. To illustrate the concept, the following description will just focus here on security parameters of the QKD primitive and authentication. The QKD primitive operates in a block-wise fashion. This is because the security proof must account for statistical fluctuations that are intrinsic to any measurement (this is referred to as finite-key or finite-size QKD processing). The above also presumes that the security parameters from the previous stages combine by addition. However, the methods taught herein can be used with any type of system where the security parameters from earlier sessions can influence the security parameters of later keys. A single session of QKD will comprise sending / measuring some number of quantum states, followed by post-processing being performed on the block of measurements. Using a larger block size is more efficient (since the sample is more statistically representative of the population) and results in a higher "raw-measurements-to-secure-key-bits ratio”. However, a larger block is computationally more expensive to process and increases the delay before QKD keys are actually outputted. The target security parameter can also be set as a post-processing option, which will impact how much privacy amplification is performed. The overall authentication security parameter, Eauth, depends on both the authentication algorithm’s security parameter, Eauth-aigo, and security parameter of the key which is used in the authentication algorithm, Eauth key: £auth — E-auth-algo + £auth-key Thus, if QKD key generation requires authentication, and authentication itself requires a secure key, how is the process started? Also, since ITS security proofs prevent the reusing of keys, how can further keys be supplied to the authentication process while ensuing security? The first question can be answered by using pre-shared secrets - installed during manufacturing of QKD systems, i.e. when the Alice and Box QKD systems are first made, a key can be generated by a local quantum random number generator and installed on both systems (there is no need for a secure key exchange protocol here since the Alice and Bob units are collocated in a physically secure location). The second question, however, is more difficult to answer. ITS message authentication requires a "fresh” key to generate each MAC tag. This means that authentication depletes the pre-shared key store. In order to replenish the key store to prevent the authentication scheme running out of keys, new keys can be generated by QKD and added back into the keystore for subsequent authentication sessions. However, consider that the first session of QKD generates keys with security parameter: — £qkd-primitive + £auth When these QKD generated keys are used for authentication in subsequent sessions of QKD system operation, the security parameter becomes: £2 — £qkd_primitive + £auth ... expanding Eauth... £2 — £qkd-primitive + (Tauth-algo + £auth-key) ... substituting Eauth key with Ei since the previous session’s QKD outputted keys are used: £2 — £qkd-primitive + (Tauth-algo + £1) Thus, the security parameter includes a summation including the previous session’s security parameter. This means the new QKD key is a little bit less secure than the first generated QKD key, since the parameters for the QKD primitive (Eqkd-primitive) and authentication algorithm (Eauth-aig0) get added on. Thus, each time the authentication algorithm is rekeyed, the QKD keys generated in that session geta little bit less secure, i.e. £3 — £qkd-primitive + (Tauth-algo + £z) £3 — £qkd-primitive + (£auth-algo + [£qkd-primitive + (£auth-algo + £1)]) Generalising this, after TVsessions of QKD operation (where each session involves rekeying authentication using the previous session’s QKD keys), the security parameter is degraded to: (^qkd-primitive + £ auth.-alg o) FIG. 2 shows the operation of QKD comprising numerous sessions 51, 52, 55, 56, 57, 58 schematically. In this example, authentication is re-keyed after 2 QKD sessions, using one of the keys from the last session. For example, sessions 51 and 52 are both conducted using an authentication key with a security parameter e-^ Both of these sessions produce keys with a security parameters s2 which are then provided to the key store 53. Next the authentication is re-keyed using the latest keys which have a security parameter of e2. Sessions 55 and 56 are both conducted using an authentication key with a security parameter e2. Both of these sessions produce keys with a security parameters e3 which are then provided to the key store 53. Next the authentication is re-keyed using the latest keys which have a security parameter of e3. Sessions 57 and 58 are both conducted using an authentication key with a security parameter e3. Both of these sessions produce keys with a security parameters e4 which are then provided to the key store 53. In practice, any number of QKD sessions could be used within each authentication session - this is just chosen here for illustration purposes. Depending on the size of the keystore, many authentication sessions may be performed before needing to use QKD keys from previous sessions - again, the example here is just one possible illustrative implementation. As an example, a commonly used value ofEqkd-primitive=le-10 (where this is set by choosing appropriate parameters for the system design / post-processing algorithms). An ITS MAC scheme is used for this QKD system where the authentication algorithm’s security parameter is negligibly small ( e.g. eauth-aigo = le — 20) but the keys for this ITS MAC are used from previous QKD sessions. It will be assumed for this illustration that a QKD system runs for 5 years with authentication tags sent at 1-minute intervals. For simplicity we assume that QKD keys are generated each minute and the next minute uses QKD keys from the prior minute - i.e. each authentication session uses a fresh key from the last session. In this example, the number of sessions over the lifetime of the QKD system is AI~2e6, which means the security parameter for QKD keys generated towards the end of the QKD system lifetime is: eqkdn 2e6(le - 10 + le — 20) = 2e-4 This shows that while the first QKD key exhibits security parameter ~ le-10, the later QKD keys that are generated have a security parameter as bad as 2e-4 - i.e. six orders of magnitude reduction in security over the lifetime of the QKD system. This is clearly a problem for practical QKD systems that target long product lifetimes serving keys to real security applications. The previous discussion explains the long-term security degradation of current QKD systems that use generated keys to replenish key material for authentication in subsequent sessions. For practical QKD systems, it is desirable to offer applications a given security parameter specification value. If the security degrades with time, then the quoted system performance must be given as the worst-case scenario, i.e. after many years of operation (and degradation). FIG. 3 is a diagram showing a system in accordance with an embodiment. In FIG. 3, there are numerous QKD sessions. The arrows show the direction of key transit (i.e. used by authentication from authentication keystore, or put into a particular keystores from QKD session output) and the security parameter (£) of the keys are shown as a label. Note that whether a QKD session is a "user key session” or "authentication key session” could depend on some criteria - the pattern of sessions shown above is purely an example. When a QKD system is first set up, it is installed with a dedicated "authentication key” keystore 71 of pre-shared keys. During normal QKD operation, keys from this keystore are used to ensure the authenticated classical channel operates. The QKD post-processing parameters (specifically in the privacy amplification step) are set to generate keys with the target security parameter, e.g. Eqkd-Primitive-normai= le-10. It is assumed that the initially installed pre-shared authentication keys have an excellent security parameter much better than Eqkd-primitive-normai, e.g. E=le-20 in this example. The QKD-outputted keys from these sessions are stored in a separate "user key keystore” 73 and delivered to the user / customer for their application (this might be a direct key delivery to the user’s secure application entity, or as part of a wider QKD network through a Key Management System and trusted node relaying). These QKD keys have the desired security parameter of e.g. e ~ Eqkd-primitive-normai ~ le-10. In more detail, in the method of FIG. 3, the first two sessions 81 and 82 are conducted with an authentication key with a security parameter of Ei, these both produce keys which are to be used to encrypt later classical channels with a security parameter of ,E2. These generated keys are stored in QKD store 73. The next two sessions 83 and 84 are then used to generate further keys for authentication. These keys are produced with a security parameter for the QKD primitive that is sufficiently good that even after N sessions (and many years), the degraded performance still yields QKD keys with a security parameter that is acceptable (and this is what is quoted in QKD system specification). Using the numerical example earlier, this means thatifa 6 orders-of-magnitude degradation of e is expected with time, then to achieve a desired bound for long-term overall security parameter, the parameters for the QKD primitive could be chosen to yield a QKD primitive security parameter that is 6 orders-of-magnitude better than initially required. However, better security parameters in the QKD primitive are achieved at the cost of QKD key generation rate. Therefore, for these keys to be generated with higher security parameters, the overall system performance is degraded e.g. lower secure bit rate. As explained above, the QKD primitive involves numerous steps - after quantum states are sent from Alice and measured at Bob, the post-processing stage comprises: sifting (discarding measurements where they prepared / measured in a different basis), error correction (identifying and correcting errors in the bits they share after sifting) and finally privacy amplification (processing the error-corrected bitstreams to distil secure keys, where the amount of privacy amplification determines the key security parameter). Various parameters in the privacy amplification stage can be adjusted to vary the resulting security parameters for the QKD primitive - but there is always a trade-off: a better security parameter reduces the practical performance of key generation. For example, ensuring a better (i.e. smaller value) security parameter may mean more privacy amplification processing needs applying, which discards more bits to yield a lower secure bit rate for the system. Alternatively, parameters may be set that improve the security parameter by increasing the size of the block of data that is processed for each key session - although this can also be undesirable since it increases computational resources required and increases the time before a QKD key is available in each session. The exact performance impact depends on which QKD protocol is used and various other link parameters. However, examples of the performance-security parameter trade-off can be found in the prior art. For example, FIG. 4 shows simulated key rate performance for a particular QKD protocol and set of link parameters. Note that a smaller e value (i.e. more secure security parameter) results in reduced key rates (i.e. lower ‘key rate per raw key bit’ on y-axis) for a given raw key length (i.e. input block size). After the new authentication keys with a security parameter of Eia have been generated, these are then saved to authentication key store 73. The next two sessions 85 and 86 are conducted with an authentication key with a security parameter of Eia, these both produce keys which are to be used to encrypt later classical channels with a security parameter of E2a. These generated keys are stored in QKD store 73. The numbers on the size of authentication keystore or authentication period of messages as these may vary between QKD system implementations. Whatever values are chosen, it is true that the authentication key store will eventually run low and need replenishing. In a further embodiment, the QKD system will initiate a special "authentication key generation session”. For example, in one embodiment, the QKD system may monitor the remaining size of the "auth keys” keystore 73 and trigger an "auth key generation session” when the size drops below a certain threshold. The threshold may be pre-set or calculated intelligently based on link parameters and the expected key usage rate (to ensure it never empties fully). Such an arrangement is shown in the flow chart of FIG. 5. Here, the key generation process starts at step S501. Prior to generating a key, at step S503, the size of the key store of authentication keys is checked. If this has fallen below a threshold, the method progresses to step S505 where the authentication generation session is started. In an "authentication key generation session”, the QKD primitive is run as normal but the post-processing parameters, for example the privacy amplification parameters are adjusted to achieve a much more secure security parameter (i.e. much smaller value than desired for the security of QKD keys to be outputted for users), (e.g. Eqkd-pnmitive-extrasecure << le-10 for this current example’s values, say Eqkd-Primitive-extrasecure=le-17). The QKD keys generated by this session are stored in the "authentication key keystore” 507 and not the "user key keystore” 511. Due to the higher security parameter, the secure key rate is lower for this particular session. Once the authentication keystore 507 is replenished, subsequent QKD sessions switch back to using the "usual” security parameter target for post-processing, generating keys for the user keystore 511 in step S509, with the target security parameter, e.g. le-10. This security parameter results in higher key generation rates than using the le-17 security parameter target that is used for authentication key sessions. When the "authentication keystore” runs low, another "authentication key generation session” is triggered. This approach does not slow down the degradation of security parameters for keys to be used for authentication. Thus, a very secure epsilon is used as a target for the QKD primitive in auth key sessions, pre-compensating the expected degradation with time. However, by maintaining separate keystores for authentication keys and user keys, the system is able to spend the majority of time running "user key generation sessions” where the authentication key is taken from the authentication key keystore, thus possessing a significantly better security parameter than the current QKD post-processing session, so it has a negligible detrimental effect when composed. Thus, after N key sessions, the security parameter for user keys is: Eqkdn — ^qkd-primitive-normal + (£qkd-primitive-extrasecure + ^auth-algo) rather than the original approach which gave: Eqkdn — N (€qkd-primitive + ^auth-algo) Using values from the previous example: ^qkd-primitive-normal —   — 10 £qkd-primitive-extrasecure — 1^ — 17 ^auth-algo — 1^ — 20 N = 2e6 this means that after 5 years of QKD system operation, the QKD key security parameters for user keys are: £qkdn — ^qkd-primitive-normal + N (Gqkd-primitive-extrasecure + ^auth-algo^ —1.2e-10 This therefore effectively avoids the degradation of the QKD keys which are provided to users. This means there is much design flexibility in how to generate QKD keys and how to use them for authentication. In the above worked example, it was assumed that each QKD session used a new authentication session with a freshly generated QKD key. In reality, since QKD outputs a block of keys with a given security parameter, it is not necessary for the nth session to use the QKD keys from the (n-l)th session. Instead, a block of QKD keys from a much earlier session could be set aside and user for many subsequent sessions. Note that storing keys for too long is undesirable, however, since many security applications have policies for things like maximum key lifetime (a.k.a. time-to-live). Additionally, it is not necessary to use a new authentication session for each QKD session. Instead, authentication could be performed at particular intervals, with all communication between Alice and Bob (covering multiple blocks to be processed) buffered until the MAC tag is sent and verified. With these two ideas, it is possible to reduce the security parameter degradation rate, by using a block of QKD keys from an earlier session (with optimal e) for as many authentication sessions as possible. The keystore for providing authentication keys will still get depleted with time and can be replenished by a QKD session output FIG. 6 is a schematic of a node 301 which can be used as either that of Alice or Bob as described above. The node 301 comprises QKD hardware for generating quantum keys 303. The QKD hardware can comprise a quantum transmitter and a quantum receiver. An example of a possible transmitter is shown as 101 in FIG. 7A. The transmitter can be any type of quantum transmitter which is capable of emitting polarisation encoded photons. In this particular example, the transmitter 101 comprises four lasers, 105, 107, 109 and 111 each of which emit horizontally polarized light The output from laser 105 is provided towards polarisation combining optics 139. The output from laser 107 is provided towards polarisation combining optics 139 via a half wave plate which is configured to convert the horizontally polarized light to diagonally polarized light. The output from laser 109 is provided towards polarisation combining optics 139 via a half wave plate which is configured to convert the horizontally polarized light to vertically polarized light. The output from laser 111 is provided towards polarisation combining optics 139 via a half wave plate which is configured to convert the horizontally polarized light to anti-diagonally polarized light Polarisation combining optics allows the different polarisations to be combined into a stream of pulses with randomly varying polarisations. This may be achieved in many different ways. For example, the lasers may be pulsed lasers and a controller (not shown) is provided to randomly select a laser from lasers 105,107,109 and 111 to randomly output a pulse such that one pulse at a time reaches the polarisation combining optics. In other embodiments, the polarisation combining optics or a further component may be configured to randomly select the output from one laser or randomly selectively block the output from three lasers to allow for the pulsed output stream. The pulses may be produced by pulses lasers or cw lasers may be used with a further component to chop the output into pulses. An attenuator (not shown) is then used to attenuate the output of the pulses so that they contain on average less than one photon. Alternatively, single photon emitters can be used instead of lasers 105,107,109 and 111. A simplified form of the receiver is shown in FIG. 7B. The receiver comprises a 50-50 beam splitter 205 which will direct the incoming pulse either along first measurement channel 207 or a second measurement channel 209. Since the pulses contain on average less than one photon, the 50-50 beam splitter 205 will direct the pulse randomly along one of the first measurement channel or the second measurement channel. This has the result of selecting a measurement basis to be the X (D / A) basis or the Z (H / V) basis. The non-polarising beam splitter 205 functions to allow random selection of one of the two bases. The first measurement channel is for the X basis which corresponds to the D / A bases. Here, a half wave plate 211 is provided to rotate the polarisation by 45 degrees between the two detection branches, i.e. giving the 2 measurement bases X and Z. The output of the half wave plate 211 is then directed towards polarising beam splitter 213. Polarising beam splitter 213 directs pulses with anti-diagonal polarisation towards anti-diagonal detector 215 and pulses with a diagonal polarisation towards diagonal detector 217. Detectors 215 and 217 are single photon detectors, for example avalanche photodiodes. Pulses directed along the second measurement channel are measured in the Z basis to determine if they are horizontal or vertical. Here, the pulses directed into the second measurement channel are directed toward polarising beam splitter 219 which directs vertically polarised pulses towards detector 221 and horizontally polarised pulses towards detector 223. Again, detectors 221 and 223 are single photon detectors. If a photon is received which is polarised in the D / A bases and this is randomly sent to be measured in the Z bases along the second management channel 209, one of detectors 221, 223 are likely to register a count However, this result cannot be trusted as a photon received at polarising beam splitter 219 has a 50-50 chance ofbeing directed towards either the vertical or the horizontal detector. In an embodiment, the QKD hardware 303 in node 301 will comprise both a transmitter and a receiver dependent on whether the node is to work as a transmitter or a receiver during the QKD process. However, it is possible for the node to contain just a transmitter if it will just perform QKD with nodes which have a receiver and also a node may contain just a receiver if it will just perform QKD with nodes which have a transmitter. The node 301 also has a key management system 305. The key management system manages key exchange and storage. In the example of FIG. 6 the key management system 305 comprises a user QKD store 307 which stores the key established via QKD which is to be used for encrypting communications, an authentication keystore 308 which has authentication keys which have either been pre-stored or generated with higher security parameters than the user keys. In this example, for simplicity just two key stores are shown. However, more may be provided. For example, if the node is configured to perform QKD with two more other nodes, a separate key store may be provided for each node and each key store will be separately monitored. A controller will be provided to allow control of the post processing. This may be provided in the key management system, as part of the QKD hardware 305 or can be remote from the node. The controller may receive a control input from the user to set the security parameter, or receive a control input from another node to generate keys with a certain security parameter. In a further embodiment, the controller receives an input from a monitoring unit which monitors the size of the key stores. The node 301 also comprises a key consuming enciyptor 311. The data enciyptor uses QKD keys to encrypt / decrypt data communications (e.g. using the one-time-pad or an alternative cipher such as AES). The above has generally referred to the security parameter. However, the ‘key processing block size’ is a parameter which affects the key rate and the time taken for a key to be generated. A small block = worse key rate, but keys available more quickly for applications (since less processing required). This could be used instead of or in addition to the security parameter. The node may also comprise an authentication agent / unit 310 which is used during authentication. This may be a standalone component or part of any of the other components of the user node 301, for example the key consuming data encryptor. The above scheme is applicable to all QKD systems, independent of QKD protocol, since it applies to the post-processing stage which is common. This means the idea to relevant to, but is not limited to: point-to-point QKD (e.g. BB84 or T12 protocol, as well as distributed phase reference protocols such as coherent one-way (COW) and differential phase shift (DPS)), measurement-device independent QKD (MDI QKD) and twin-field QKD (TF QKD). The idea is also applicable to the class of continuous variable (CV) QKD protocols. The method of dynamically adjusting the post processing parameters and using separate key stores could be applicable to other systems too where privacy amplification techniques are used between users over an authenticated classical channel. 5 Whilst certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel devices, and methods described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the devices, 10 methods and products described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.

Claims

1. A node in a quantum communication system, the node comprising:a quantum key distribution unit configured to allow a quantum key to be distributed between the node and an external further node;a post processing module, said post processing module being configured to apply post processing to the quantum key to produce a key with a predefined security parameter, the post processing module comprising a controller configured to allow the security parameter applied to a quantum key to be changed for different quantum keys, security parameter indicating the probability of security failure; anda first key store and a second key store, wherein the node is configured to store keys having a security parameter with a value in a first range in the first key store, and keys having a security parameter with a value in a second range in the second key store, the first range having different values to the to the second range.

2. A node according to claim 1, wherein the post processing module is configured to perform privacy amplification.

3. A node according to either of claims 1 or 2, further comprising an authentication module, the authentication module being configured to authenticate communication over a classical communication channel with the further node.

4. A node according to claim 3, wherein the authentication module is configured to perform authentication using an authentication key obtained via the quantum key distribution unit.

5. A node according to claim 4, wherein the quantum key distribution unit is configured to sift the quantum key using communication over an authenticated classical communication channel between the node and the further node.

6. A node according to any of claims 3 to 5, further comprising a classical communication module configured to encrypt or decrypt communication using a key obtained via the quantum key distribution unit7. A node according to claim 6, wherein the values of the security parameter in the first range are lower than the values of the security parameter in the second range, the authentication module being a configured to access the first key store to obtain keys for authentication, the classical communication module being configured to obtain keys for encryption from the second key store.

8. A node according to claim 7, wherein the controller is configured to receive a control signal, the controller being configured to determine the value of the security parameter for a key to be stored in response to the control signal.

9. A node according to claim 8, further comprising a monitoring circuit configured to monitor the number of keys in the first store and to provide a control signal to post process keys to achieve a security parameter with values in the first range when the number of keys in the first store is equal to or below a threshold and to post process keys to achieve a security parameter with values in the second range when the number of keys in the first store is greater than a threshold.

10. A node according to any preceding claim, further comprising three or more key stores each storing keys with a different ranges of security parameters.

11. Anode according to any preceding claim, wherein the quantum key distribution unit comprises at least one of:an encoder, said encoder being configured to encode information on light, wherein the information is encoded by randomly selecting one state from a plurality of states to send to said user node, the light leaving said server in pulses which contain on average less than one photon; anda decoder, said decoder being configured to receive light pulses which contain on average less than one photon and decode information from said light pulses by measuring said light pulses, wherein the measurement basis for the measurement are randomly selected from a set of measurement bases to allow measurement of the states used to encode the information,the quantum key distribution unit further comprising a sifting unit configured to allow the server to compare the basis it used for encoding or decoding with that used by the user node for decoding or encoding, the quantum key distribution unit being configured todiscard the information from pulses where the encoding basis and the decoding measurement basis did not match.

12. A quantum communication system comprising:a plurality of nodes, wherein each node is a node according any of claims 1 to 11.

13. A quantum communication system according to claim 12, configured to implement discrete variable protocol or a continuous variable protocol.

14. A method of quantum communication, the method comprising:performing at a first node, quantum key distribution with a second node to obtain quantum key between the first node and the second node;performing post processing at the first node the quantum key to produce a key with a predefined security parameter, the post processing being controlled to allow the security parameter applied to a quantum key to be changed for different quantum keys, security parameter indicating the probability of security failure;storing by the first node, keys having a security parameter with a value in a first range in a first key store,andstoring by the first node, keys having a security parameter with a value in a second range in the second key store, the first range having different values to the to the second range.

15. A method according to claim 14, wherein performing quantum key distribution comprises sifting the quantum key using communication over an authenticated classical communication channel between the node and the further node.

16. A method according to claim 15, further comprising encrypting or decrypting communication using a key obtained via the quantum key distribution unit.

17. A method according to claim 16, wherein the values of the security parameter in the first range are lower than the values of the security parameter in the second range, keys being obtained from the first key store for authentication and keys for encryption / decryption being obtained from the second key store.

18. A method according to claim 17, further comprising monitoring the number of keys in the first key store and controlling the post processing to produce keys to achieve a security parameter with values in the first range when the number of keys in the first store is equal to or below a threshold and to post process keys to achieve a security parameter with values in the second range when the number of keys in the first store is greater than a threshold.

19. A method of operating a QKD system, the method comprising: obtaining an authentication key from a first key store;authenticating a first communication channel between a first node and a second node using the obtained authentication key;performing quantum key distribution between the first node and the second node, the quantum key being sifted using communication over the authenticated first channel to establish a first quantum key for the first user and server;determining the number of authentication keys in the first key store, wherein when the number of authentication keys in the first key store is below a threshold, postprocessing the quantum key to produce authentication keys for the first key store which have a security parameter within a first range of values; andwherein when the number of authentication keys in the first key store is above a threshold, post processing the quantum key to produce authentication keys for a second key store which have a security parameter within a second range of values, security parameters within the second range being higher than the security parameters in the first range.

20. A method of operating a QKD system, the method comprising:performing quantum key distribution between a first node and a second node to generate quantum keys;post processing the quantum keys to produce keys using at least one control processing parameter to produce keys of different types;storing the post processed keys in key stores such that each key store comprises keys of the same type;monitoring the number of keys in the different key stores and when the number of keys in a key store is below the threshold for that key store, controlling the post processing parameters of generated quantum keys to produce further keys to replenish the keys in thekey store where the number of keys is below a threshold, wherein keys of the same type have parameters within predefined ranges.

Images