Monitoring device, quantum cryptography communication system, monitoring method and program

Abstract

To detect attacks on quantum cryptography communication systems with greater accuracy. [Solution] The monitoring device of the embodiment includes a processing unit that verifies the consistency of the key amount information of application keys at the first and second locations by using the key amount information of application keys used by the first application at the first location to encrypt communications and the key amount information of application keys used by the second application at the second location to decrypt encrypted communications, and verifies the consistency of the key amount information of quantum keys at the first and second locations by using the key amount information of quantum keys generated by QKD (Quantum Key Distribution) at the first location and used for encrypted transfer of the application keys and the key amount information of quantum keys generated by QKD at the second location and used for decryption of the encrypted transfer of the application keys.

Description

[Technical Field]

[0001] Embodiments of the present invention relate to a monitoring device, a quantum cryptography communication system, a monitoring method, and a program. [Background technology]

[0002] With the advancement of information and communication technology, diverse types of data are now being exchanged, making it a major challenge to ensure the confidentiality and security of transmitted information. Quantum cryptography is expected to be put into practical use as an encryption technology that cannot be deciphered even as computer processing power improves. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] M. Lucamarini, KAPatel, JFDynes, B. Frohlich, AWSharpe, ARDixon, ZLYuan, RVPenty, and AJShields, “Efficient decoy-state quantum key distribution with quantified security,” Opt.Express, vol. 21, no. 21, pp. 24 550-24 565, 2013. [Overview of the project] [Problems that the invention aims to solve]

[0004] However, conventional technologies have made it difficult to detect attacks on quantum cryptography communication systems with greater accuracy. [Means for solving the problem]

[0005] The monitoring device according to the embodiment uses the key amount information of the application key used by the first application at the first site for communication encryption and the key amount information of the application key used by the second application at the second site for decrypting encrypted communication to confirm the consistency of the key amount information of the application keys at the first and second sites. The monitoring device further includes a processing unit that uses the key amount information of the quantum key generated by QKD (Quantum Key Distribution) at the first site and used for encrypted transfer of the application key, and the key amount information of the quantum key generated by the QKD at the second site and used for decrypting the encrypted and transferred application key, to confirm the consistency of the key amount information of the quantum keys at the first and second sites.

Brief Description of the Drawings

[0006] [Figure 1] Figure showing an example of the basic configuration of a quantum cryptographic communication system. [Figure 2] Figure showing an example of the application key sharing process by the key management device according to the embodiment. [Figure 3] Figure showing an example of the use of the application key according to the embodiment. [Figure 4] Figure showing the relationship between the processing time of OTP and the generation time of the quantum key according to the embodiment. [Figure 5] Figure showing the relationship between the processing time of AES and the generation time of the quantum key according to the embodiment. [Figure 6] Figure showing an example of the encoding method in the encrypted communication process according to the embodiment. [Figure 7] Figure showing an example of the device configuration of the quantum cryptographic communication system according to the embodiment. [Figure 8] Figure showing an example of the statistical information collected by the monitoring device according to the embodiment. [Figure 9] Figure showing an example of the processing of statistical information at Site A according to the embodiment. [Figure 10] Figure showing an example of the statistical information of the application key according to the embodiment. [Figure 11] Figure showing an example of the statistical information of the quantum key according to the embodiment. [Figure 12] Figure showing an example of the processing of statistical information at Site B according to the embodiment. [Figure 13] A diagram showing an example of processing statistical information at the base X of the embodiment. [Figure 14A] A diagram showing Processing Example 1 of the confirmation unit of the embodiment. [Figure 14B] A diagram showing Processing Example 2 of the confirmation unit of the embodiment. [Figure 14C] A diagram showing Processing Example 3 of the confirmation unit of the embodiment. [Figure 15] A flowchart showing an example of the monitoring method of the embodiment. [Figure 16] A diagram showing an example of the hardware configuration of the QKD device of the embodiment. [Figure 17] A diagram showing an example of the hardware configuration of the control device, key management device, cryptographic communication device, and monitoring device of the embodiment.

Embodiments for Carrying Out the Invention

[0007] Embodiments of a monitoring device, a quantum cryptographic communication system, a monitoring method, and a program will be described in detail below with reference to the accompanying drawings.

[0008] In a quantum cryptographic communication system, a key management device (Key Manager) stores an application key (hereinafter simply referred to as "app key") for an end user to use in cryptographic communication of user content. The app key is the most important information asset in the quantum cryptographic communication system and is the top priority target for attacks by attackers such as eavesdroppers. Therefore, when an attack such as stealing of the app key occurs, it is necessary to implement a function in the quantum cryptographic communication system that can detect abnormal detection and take various countermeasures.

[0009] Hereinafter, embodiments of a quantum cryptographic communication system that detects attacks such as extraction of app keys and forced registration of fake app keys will be described.

[0010] First, the basic configuration of the quantum cryptographic communication system will be described.

[0011] Figure 1 shows an example of the basic configuration of a quantum cryptography communication system. The functions of a quantum cryptography communication system consist of two functions: quantum key distribution (QKD) and cryptographic processing. In the example in Figure 1, QKD and cryptographic processing are performed between two locations, A and B.

[0012] Site A contains a QKD device 1a, a control device 2a that controls the QKD device 1a, a key management device 3a, and an encrypted communication device 4a. Similarly, site B contains a QKD device 1b, a control device 2b that controls the QKD device 1b, a key management device 3b, and an encrypted communication device 4b.

[0013] The processing flow is explained below. First, the QKD devices 1a and 1b, and the control devices 2a and 2, generate a quantum key. Specifically, the data that will become the quantum key is transmitted and received between the QKD devices 1a and 1b, one bit at a time, using the state of a single photon (for example, polarization). Then, the control devices 2a and 2b perform key distillation on the transmitted and received data using the state of the single photon to generate a quantum key. After that, the generated quantum key is transmitted to the key management devices 3a and 3b. Since the quantum key is generated by the QKD devices 1a and 1b, it is also called a QKD key.

[0014] Next, the key management device 3a shares the application key used for encrypting user content in the encrypted communication devices 4a and 4b with the key management device 3b. When sharing the application key, the key management device 3a encrypts the application key using a quantum key with a One Time Pad (OTP) encryption, ensuring it is secure from an information security standpoint before transferring it. If the key management device 3a does not have the quantum key necessary to perform OTP encryption stored, it may also encrypt the application key using AES encryption before transferring it.

[0015] Finally, the encrypted communication device 4a runs an application that transfers user content to the encrypted communication device 4b. The application encrypts the user content using an application key, thereby transferring the user content to the encrypted communication device 4b in a secure state from an information security perspective.

[0016] The above describes the basic configuration and processing flow of the quantum cryptography communication system. Note that when QKD devices 1a and 1b are not distinguished, they are simply referred to as QKD device 1. The same applies hereafter to control devices 2a and 2b, key management devices 3a and 3b, and cryptographic communication devices 4a and 4b, etc.

[0017] Next, we will explain the process of sharing application keys between key management devices 3a and 3b.

[0018] Figure 2 shows an example of the application key sharing process by the key management devices 3a and 3b of the embodiment. In Figure 2, the functions of the key management devices 3a and 3b used in the application key sharing process will be explained. The key management device 3a includes a processing unit 31a and a communication unit 32a.

[0019] The processing unit 31a is implemented by at least one processing unit and executes the processing of the key management device 3a. This processing unit includes, for example, a control unit and an arithmetic unit, and is implemented by analog or digital circuits. The processing unit may be a central processing unit (CPU), a general-purpose processor, a microprocessor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a combination thereof. The processing units described later can also be implemented in the same way as the processing unit 31a.

[0020] Furthermore, the key management device 3a includes an application key DB 101a for storing application keys and a quantum key DB 102a for storing quantum keys. The application key DB 101a and quantum key DB 102a are stored in a storage device such as an HDD (Hard Disk Drive).

[0021] First, the processing unit 31a generates a random number and stores the generated random number in the application key DB 101a as the application key. The processing unit 31a may also generate the random number using a random number generator. Furthermore, the processing unit 31a inputs the application key to the communication unit 32a in order to share the application key with the key management device 3b.

[0022] The communication unit 32a is equipped with a communication interface that communicates using at least one of the following methods: wireless or wired. The communication unit 32a reads the quantum key stored in the quantum key DB 102a, performs OTP encryption on the application key using the quantum key, and then transfers the application key in the OTP encrypted state to the key management device 3b. The communication unit 32a may also encrypt the application key using an OTP encryptor.

[0023] Next, the functions of the key management device 3b used for sharing application keys will be described. In the description of the key management device 3b, explanations similar to those for the key management device 3a will be omitted. The communication unit 32b reads the quantum key stored in the quantum key DB 102b, performs OTP decryption on the application key using the quantum key, and then stores the application key in the application key DB 101b. The communication unit 32b may also decrypt the application key in the OTP encrypted state using an OTP decryptor.

[0024] Focusing on the application key DB 101a of key management device 3a and the application key DB 101b of key management device 3b, application keys are stored at the same time and with the same amount of keys. Similarly, focusing on the quantum key DB 102a of key management device 3a and the quantum key DB 102b of key management device 3b, quantum keys are used at the same time and with the same amount of keys. Furthermore, quantum keys are transferred from control devices 2a and 2b to key management devices 3a and 3b at the same time and with the same amount of keys, and stored in quantum key DBs 102a and 102b. Otherwise, application key sharing between key management devices 3a and 3b would not be possible.

[0025] Next, we will explain examples of how application keys are used in encrypted communication devices 4a and 4b.

[0026] Figure 3 shows an example of using an application key in the embodiment. Figure 3 describes the functions of the cryptographic communication devices 4a and 4b used in encrypted communication processing using the application key.

[0027] The encrypted communication device 4a includes a communication unit 41a. The communication unit 41a includes a communication interface that communicates using at least one of the following methods: wireless or wired.

[0028] First, the communication unit 41a requests an application key from the key management device 3a and receives the application key from the key management device 3a. The communication unit 41a encrypts user data (e.g., user content) using the application key and transmits the encrypted user data to the key management device 3b. The communication unit 41a may also perform the encryption process using the application key by using an encryptor.

[0029] Next, the functions of the encryption communication device 4b, which is used for encrypted communication processing using the application key, will be described. In the description of the encryption communication device 4b, explanations similar to those for the encryption communication device 4a will be omitted. When the communication unit 41b receives encrypted user data from the encryption communication device 4a, it decrypts the encrypted user data using the application key provided by the key management device 3b. The communication unit 41b may also perform the decryption process using the application key by using a decryptor.

[0030] If we focus on the application key DB 101a of key management device 3a and the application key DB 101b of key management device 3b, we see that the application keys are used at the same time and with the same amount of keys. Otherwise, encrypted communication of user data between encryption communication devices 4a and 4b would not be possible.

[0031] As mentioned above, focusing on the application key DBs 101a and 101b, and the quantum key DBs 102a and 102b, each DB is synchronized between sites A and B. When the QKD devices 1a and 1b, control devices 2a and 2b, and key management devices 3a and 3b are functioning normally, the synchronization of each DB is maintained. Conversely, if they are not synchronized, the application key DBs 101a and 101b, and the quantum key DBs 102a and 102b may be under attack, such as key theft.

[0032] In the quantum cryptography communication system of this embodiment, for example, it is confirmed whether the application key DBs 101a and 101b between locations A and B are consistent with each other. Also, for example, in the quantum cryptography communication system of this embodiment, it is confirmed whether the key amount information (e.g., storage amount, generation speed, and consumption speed, etc.) is consistent between quantum key DBs 102a and 102b.

[0033] The quantum cryptography communication system of this embodiment determines an anomaly if consistency is not maintained. In addition, the quantum cryptography communication system of this embodiment verifies whether consistency is maintained between the application key DB101 and the quantum key DB102 within the same location. Furthermore, the quantum cryptography communication system of this embodiment also verifies whether the key generation amount and key consumption amount for each key are theoretically correct.

[0034] Let's specifically explain the combinations of key quantity information that are subject to consistency verification. First, the key quantity information of the same type of key shared by the key sharing source and the key sharing destination is included as the target of verification. As mentioned above, there are two types of keys: application keys and quantum keys, and three types of key quantity information: storage amount, generation rate, and consumption rate.

[0035] In other words, the following six types will be subject to consistency verification. (1) App key storage capacity (2) App key generation speed (3) App key consumption rate (4) Quantum key storage capacity (5) Quantum key generation rate (6) Quantum key consumption rate

[0036] Regarding the consistency check of the application key storage volume in (1), the consistency between the application key storage volume at site A and the application key storage volume at site B at a given point in time is checked. An example of consistency check is that the storage volumes are equivalent. As the reference data for consistency check, the storage volume of either site is specified, and it is checked whether the storage volume being checked is equivalent to the reference data.

[0037] Regarding the consistency check of application key generation speed in (2), the consistency between the application key generation speed at site A and the application key generation speed at site B at a given point in time will be checked. An example of consistency check is that the generation speeds are equivalent. One of the generation speeds will be specified as the reference data for consistency check, and it will be checked whether the generation speed being checked is equivalent to the reference data.

[0038] Regarding the consistency check of application key consumption rate in (3), the consistency between the application key consumption rate at site A and the application key consumption rate at site B at a given point in time is checked. An example of consistency check is that the consumption rates are the same. As the reference data for consistency check, the consumption rate of either site is specified, and it is checked whether the consumption rate being checked is the same as the reference data.

[0039] The explanations for verifying the consistency of each key quantity information of the quantum key ((4)~(6)) are the same as those for the application key ((1)~(3)) mentioned above, so they will be omitted.

[0040] Next, we will explain specific examples of how to obtain key quantity information for each key. For storage capacity, the number of data entries in each database is used. For generation speed, the number of registrations in each database is used. For key consumption speed, the number of references or deletions in each database is used.

[0041] The number of data entries, registration counts, access counts, and deletion counts are stored in the operation logs of each database. The number of data entries, registration counts, access counts, and deletion counts are read from the storage device that stores the database operation logs.

[0042] When determining the storage capacity from the number of data entries in each database, the storage capacity is calculated as the key size per data entry multiplied by the number of data entries.

[0043] When determining the generation speed from the number of entries in each database, the number of entries Cb between a certain point in time Ta and another point in time Tb is collected, and the generation speed is calculated as Cb × (key size per data) / (Tb - Ta).

[0044] When calculating the consumption rate from the number of times each database is accessed, the number of times each database is accessed, Cd, from a certain point in time Tc to a certain point in time Td is collected, and the consumption rate is calculated as Cd × (key size per data) / (Td - Tc). The same method is used when calculating the consumption rate from the number of deletions.

[0045] While the above example listed key size information for keys that are actually generated and stored as data to be checked for consistency, other types of data can also be used as data to be checked for consistency.

[0046] If the quantum key generation rate is included in the consistency check combination, the estimated (theoretical) value of the quantum key generation rate can be used as data to be checked for consistency. As described in Non-Patent Literature 1, the quantum key generation rate can be theoretically calculated based on the status of the QKD link and the status of the error correction (EC) process. Therefore, the theoretically calculated value can be used as an estimate.

[0047] Regarding the status of the QKD link, relevant factors include the QbER (QbE), which is the error rate during single-photon communication over the QKD link; the number of photons transmitted from the transmitter to the receiver via the QKD link; and the number of photons detected by the receiver via the QKD link. Regarding the status of the EC (Encoded Communication) processing, relevant factors include, for example, the code data length and redundant data length used during EC processing.

[0048] Aside from the status of the QKD link and the error correction process, the estimated quantum key generation speed can also be calculated from the operation log information of the PA process performed by the control unit 2b. For example, if the operation log information includes the number of output bits of the quantum key generated in one PA process and the generation time, the estimated quantum key generation speed can be calculated as (number of output bits / generation time).

[0049] The generation time is the time required to generate the quantum key in question. The base value is the sum of the time required to send and receive photons via the QKD link, collect the key used for EC and PA processing, and the time required to perform EC and PA processing.

[0050] Other specific definitions of generation time are as follows:

[0051] The first approach is to define the generation time as the processing time of the processing with the longest processing time among the three processes, when the sifting process, EC process, and PA (Privacy Amplification) process are performed in parallel.

[0052] The second approach defines the generation time as the difference between the completion time of the PA process performed during the previous quantum key generation and the completion time of the PA process performed during the current quantum key generation.

[0053] Based on the above, the items to be checked for consistency are: (7) Quantum key generation rate using the estimated value of the quantum key generation rate These are some examples.

[0054] Specifically, the consistency of three data points—the quantum key generation rate at site A, the quantum key generation rate at site B, and an estimated value of the quantum key generation rate—is checked. The consistency check is the same as the check example described above.

[0055] If the application key generation speed is included in the consistency check combination, the estimated application key generation speed can be used as the consistency criterion data.

[0056] In other words, the items to be checked for consistency are: (8) App key generation speed using the estimated value of the app key generation speed These are some examples.

[0057] The specific verification method is the same as in case (7) above, so it will be omitted. Various data can be used to estimate the application key generation speed, so the available data will be explained below.

[0058] Let's explain the estimated generation speed of the first application key. The first estimated value is the quantum key consumption rate. When the encryption method for sharing application keys is the OTP method, an encryption key with a data length equivalent to the data to be encrypted is required. In other words, in the case of the OTP method, when performing OTP encryption, a quantum key equivalent to the amount of key data of the application key is required. Therefore, when it is working correctly, the application key generation speed is equivalent to the quantum key consumption rate.

[0059] Even when the encryption method for sharing application keys is AES, under certain conditions, the quantum key consumption rate can be used as an estimate of the application key generation speed. If the number of switching blocks for the seed key used in AES encryption (a 256-bit key in the case of AES256) is 1, then the estimated application key generation speed and the quantum key consumption rate will be equivalent. Here, the number of switching blocks refers to the number of processing blocks before the seed key is switched. For example, if the number of switching blocks is 1, it means that the 256-bit seed key is switched each time one block of AES is processed.

[0060] This allows for verification of the consistency between the application key generation speed and the quantum key consumption speed. Therefore, consistency verification can be performed not only using key quantity data for the same type of key, but also using key quantity data for different types of keys, such as application keys and quantum keys.

[0061] Let's explain the second estimate for the application key generation speed. The second estimate is the current bandwidth (communication speed) of the network used for sharing application keys.

[0062] As explained in Figure 2 above, the application key generation process is broadly divided into four processes: random number generation for the application key, database storage of the application key, encryption for sharing the application key, and network transfer of the encrypted application key. It is obvious that the smallest value among the processing speeds of these four processes will be the application key generation speed.

[0063] If the random number generation process, database storage process, and encryption process all operate faster than the maximum bandwidth of the network used for application key sharing, the network becomes a bottleneck in the application key generation process. In this case, the current bandwidth of the application key sharing network takes its maximum value, which is the maximum bandwidth (maximum communication speed).

[0064] When using OTP or AES as the encryption method for app key sharing, the data size does not change before and after encryption when the encryption process is performed on the data to be encrypted. Therefore, the app key generation speed will be equivalent to the maximum bandwidth of the app key sharing network.

[0065] Conversely, if any of the random number generation process, database storage process, or encryption process operates slower than the network bandwidth, the application key generation speed will be the smallest of the processing speeds of the random number generation process, the database storage process, and the encryption process, and the current bandwidth of the network used for sharing application keys will also be the same value.

[0066] Thus, the application key generation speed is always equal to the current bandwidth of the network used for application key sharing. Therefore, it is acceptable to use the current bandwidth of the network used for application key sharing as an estimate of the application key generation speed.

[0067] Let's explain the third estimated value for application key generation speed. The third estimated value is the processing speed of the encryption process for application key sharing when the quantum key storage amount is greater than the threshold, that is, the maximum bandwidth based on the implementation form of the encryption process for application key sharing. Details on how to set the threshold for determining whether the quantum key storage amount is large or small will be described later.

[0068] As mentioned above, the application key generation process is broadly divided into four processes: random number generation for the application key, database storage of the application key, encryption for application key sharing, and network transfer of the encrypted application key. The smallest value among the processing speeds of these four processes represents the application key generation speed. In the case of the third estimated value, the processing speed of the encryption for application key sharing is the smallest.

[0069] The encryption process for sharing application keys has the property that its encryption speed varies depending on the amount of quantum key stored. The larger the amount of quantum key stored, the faster the encryption process for sharing application keys theoretically approaches the maximum bandwidth based on the implementation. In addition, the application key generation speed also follows a similar value, so it can be used as an estimate without any problems. This argument holds true for both OTP and AES encryption methods used for sharing application keys.

[0070] Let's explain the fourth estimate of the application key generation speed. The fourth estimate is the processing speed of the encryption process for sharing application keys when the quantum key storage amount is smaller than the threshold.

[0071] The usage of the fourth estimate is similar to that of the third estimate, with the encryption processing speed for app key sharing being the smallest and equivalent to the app key generation speed. The difference from the third estimate is that it utilizes the processing speed for encryption processing for app key sharing when the quantum key storage amount is small.

[0072] This section explains the case where the encryption method for application key sharing is OTP. The smaller the quantum key storage capacity, the sooner the generated quantum key will be used for the encryption process for application key sharing after it is stored in the quantum key DB102. Therefore, the processing speed of the encryption process for application key sharing will be limited by the quantum key generation speed. In the case of OTP, the fourth estimated value is specifically the quantum key generation speed.

[0073] This situation is (the processing time per block of OTP (T OTP))<=(Time it takes for a quantum key to generate one block of keys (T Q This holds true as long as the relationship between )) is maintained. The relationship between AES processing time and quantum key generation time is shown in Figure 4, and the situation will be explained using Figure 4.

[0074] Figure 4 shows the relationship between the processing time of the OTP in the embodiment and the quantum key generation time. In the example in Figure 4, the OTP processing is divided into blocks, and the OTP processing for one block is T OTP This is being implemented over time. Here, the unit of processing each block is referred to as a slot. Also, the key generation time for the quantum key required for OTP encryption of one block is T. Q Let's assume that in slot (1), the quantum key necessary for the OTP encryption process in slot (2) is being generated. Also, generally speaking, the processing speed of the OTP process is much faster than the quantum key generation speed, so (T OTP <T Q ) is true, and the OTP processing mechanism will wait until the quantum key for the next slot is ready T W Wait for a few minutes.

[0075] Since the data size remains unchanged before and after OTP encryption, and considering that the size of the quantum key required for OTP encryption is equivalent to the size of the application key being encrypted, the size of the OTP encrypted application key is equivalent to the size of the quantum key. Therefore, when viewed on a slot-by-slot basis, the processing speed of the encryption process for sharing application keys is equivalent to the quantum key generation speed.

[0076] Next, we will explain the case where the application key encryption method is AES. The processing speed of the encryption process is calculated from the number of switching blocks of the seed key used for AES encryption (a 256-bit key in the case of the AES256 method) and the quantum key generation speed. As mentioned above, the number of switching blocks refers to the number of processing blocks until the seed key is switched. And, in the case of the encryption method AES, the estimated value is (number of switching blocks × quantum key generation speed).

[0077] I will explain the basis for the formula (number of switching blocks × quantum key generation speed).

[0078] FIG. 5 is a diagram showing the relationship between the processing time of AES in the embodiment and the quantum key generation time. In the example of FIG. 5, the number of switching blocks of AES is 2. When AES performs processing for two blocks, the key is switched. For example, in the case of the AES256 method, every time 512 bits (= 256 bits × 2 blocks) are processed, the 256-bit seed key is switched. The unit for performing processing for this number of switching blocks is defined as a slot. And, the processing time of AES for one block is T AES , the time for generating a quantum key with a seed key length (256 bits) is T Q , and the time that the AES processing waits until the next seed key arrives is T W .

[0079] Generally, since the processing of AES is very fast, T AES is much smaller than T Q , and it is in a state where (2 × T AES ) < T Q . In slot (1), AES performs processing of AES for two blocks, and as a result, 2 × T AES has elapsed. On the other hand, in order to prepare a quantum key used for the seed key for performing the AES processing in slot (2), T Q minutes are required. Therefore, the AES processing has a waiting time of T W minutes. The same relationship holds for subsequent slots.

[0080] Regarding the number of bits processed in each slot, when using the AES256 method, in each slot, the AES processing processes 512 bits, and the quantum key generates a key for 256 bits. Therefore, when converted to the processing speed, it can be seen that the processing speed of AES, which is the encryption processing for application key sharing, is twice the quantum key generation speed.

[0081] This situation is (the number of switching blocks × the processing time per block of AES (T AES )) <= (the time for the quantum key to generate a key for the seed key (TQ This argument holds true as long as the relationship )) is maintained. Furthermore, since this argument holds true regardless of the number of switching blocks, the estimated value is (number of switching blocks × quantum key generation rate).

[0082] Conversely, ((Number of switching blocks × T) AES )>T Q If the relationship is as described above, the estimated value represents the maximum speed based on the implementation. This concludes the explanation regarding the processing speed of the encryption process for app key sharing.

[0083] We previously stated that if the quantum key storage capacity is smaller than a threshold, the processing speed of the encryption process for application key sharing can be estimated based on the quantum key generation speed. Similarly, the processing speed of the encryption process for application key sharing can also be estimated from the estimated quantum key generation speed mentioned above. The formula for calculating the processing speed of the encryption process for application key sharing using the estimated quantum key generation speed is the same as in the case of the actual quantum key generation speed.

[0084] This section explains the threshold for determining the size of the quantum key storage capacity. The threshold for determining that the quantum key storage capacity is small is the size of the quantum key required to perform encryption processing for one slot. This is because encryption processing will not begin until the necessary quantum keys have been accumulated.

[0085] When the encryption method for sharing application keys is OTP, the required quantum key is equal to the data length required to perform the encryption process for one slot. For example, if a 512-bit application key is encrypted using OTP for one slot of encryption, a quantum key of 512 bits is required. Therefore, the threshold TH for determining that the quantum key storage amount is small in the case of the OTP method is... (OTP,S) This becomes 512 bits, and the quantum key storage amount is TH (OTP,S) If it is smaller than this, the quantum key storage capacity is determined to be small.

[0086] The required quantum key when the encryption method for sharing application keys is AES is the length of the seed key used to perform the encryption processing for one slot. For example, when using the AES256 method, the seed key length is 256 bits. Therefore, the threshold TH for determining if the quantum key storage amount is small in the case of the AES method is... (AES,S) This becomes 256 bits, and the quantum key storage amount is TH (AES,S) If it is smaller than this, the quantum key storage capacity is determined to be small.

[0087] Next, we will explain the threshold for determining whether the quantum key storage capacity is large. As the first candidate, similar to the threshold for determining whether the quantum key storage capacity is small, is the size of the quantum key required to perform encryption processing for just one slot. In particular, the quantum key generation speed is fast, and the time T required to generate the quantum key size necessary to perform encryption processing for one slot is also important. Q However, this is effective when the time required to perform encryption processing for one slot is shorter than the time required to perform encryption processing for one slot. Specifically, it is effective when the encryption method used for sharing application keys is AES, and the frequency of switching the AES seed key is very low (lower than a predetermined threshold).

[0088] In addition, it is possible to set the threshold to be larger than the key size of the quantum key required to perform encryption processing for only one slot, as explained as the first candidate. In particular, the measurement time interval T of the application key generation speed APP If the length is long, the need to set it this way increases.

[0089] Measurement time interval T for application key generation speed APP We will explain why the longer the interval, the more necessary it is to set the threshold higher than the value listed as the first candidate. As mentioned above, the larger the quantum key storage capacity, the more theoretically the processing speed of the encryption process for sharing application keys will reach the maximum bandwidth based on the implementation. One condition for satisfying the maximum bandwidth is that the quantum keys necessary for the encryption processing for the measurement time interval are stored. In particular, the measurement time interval T APPHowever, if the time required for encryption processing for several slots is equivalent to that shown in Figures 4 and 5 above, then the formula value used to determine that the quantum key storage capacity is large will be equivalent to the key storage capacity required for encryption processing for several slots.

[0090] Generalize the threshold. Threshold TH when the encryption method is OTP. (OTP,L) is "T APP ×Maximum bandwidth of the OTP method, that is, T APP This is the number of application keys generated. On the other hand, the threshold TH when the encryption method is AES. (AES,L) is "(T APP The formula is "÷ Usage time of the same seed key) × Seed key length", which means T APP This is the amount of seed key required to execute AES.

[0091] In summary, the threshold for determining whether the quantum key storage capacity is large is the size of the quantum key required to continuously execute application key cryptography for the duration of the application key generation speed measurement interval. If the quantum key storage capacity exceeds this threshold, it is determined that the quantum key storage capacity is large. This concludes the explanation regarding the storage capacity threshold.

[0092] Next, we will explain various calculation methods for verifying consistency. As mentioned above, one method is to set verification standard data and compare it with each key amount information to confirm that they are equivalent. However, considering the timing differences in data collection, this method of confirming equivalentity may misidentify inconsistencies even when there are actually no problems. A consistency verification method that is resilient to such timing differences in data collection is necessary.

[0093] As a robust integrity verification method, the following method can be cited: A threshold for anomaly detection is established (Step 1). Statistical information for each key amount information of the integrity verification combination and statistical information for the verification criteria data are calculated (Step 2). The absolute difference between the statistical information for each key amount information and the statistical information for the verification criteria data is calculated (Step 3). If the absolute difference is, for example, less than or equal to the threshold, the integrity verification is determined to be normal; if it exceeds the threshold, it is determined to be abnormal (Step 4).

[0094] Let's take the case of verifying the consistency of the application key storage volume described in (1) above as an example to explain a specific processing example. Here, the application key storage volume at site A is set as the verification criterion data, and the application key storage volume at site B is used as the data to be verified for consistency.

[0095] In the first step, an anomaly detection threshold is set. For example, in verifying the integrity of the application key storage amount, 10% of the absolute value of the statistical information of the verification criteria data is set as the anomaly detection threshold.

[0096] In the second step, the statistical information to be used for anomaly detection is determined. For example, in verifying the integrity of application key storage, the moving average is used among the statistical information. Specifically, the moving average of the application key storage at site A is calculated and used as the statistical information for the verification criteria data. Next, the moving average of the application key storage at site B is calculated and used as the statistical information for the data to be verified for integrity.

[0097] In the third step, the absolute difference between the statistical information of the verification criteria data and the actual data is calculated. For example, in verifying the consistency of application key storage volume, the difference between the moving average of the application key storage volume at site A and the moving average of the application key storage volume at site B is calculated, and the absolute difference is calculated using the absolute value of this difference.

[0098] In the fourth step, consistency is determined. For example, in the consistency check of the application key storage amount, as mentioned above, the threshold for determining an anomaly was set to 10% of the absolute value of the statistical information of the verification standard data. Therefore, if the absolute difference calculated in the third step is 10% or less of the absolute value of the statistical information of the verification standard data, consistency is achieved and it is determined to be normal. Conversely, if it exceeds 10%, consistency is not achieved and it is determined to be abnormal.

[0099] The above are specific examples of data integrity verification processes. Note that the data size may change depending on the data format used in each process. For example, base64 conversion is an encoding method commonly used in internet communications.

[0100] Figure 6 shows an example of an encoding method in the encrypted communication processing of the embodiment. The size of the data after base64 encoding is approximately 1.33 times the size of the input data (data before base64 encoding). For example, in the case of application key encryption sharing processing that includes base64 conversion (base64 encoding and base64 decoding) as shown in Figure 6, the data size is different before and after base64 conversion.

[0101] In the case of Figure 6, the application key generation speed and the OTP processing speed are theoretically equivalent. However, the Ethernet transfer speed of the application key is approximately 1.33 times faster than the application key generation speed and approximately 1.33 times faster than the OTP processing speed because it is transferred in a base64 converted state. During the series of processes, if the data format is converted and the data size differs, a correction for the data size conversion is not included in the consistency check; otherwise, many false detections of anomalies will occur, so a correction is introduced.

[0102] Furthermore, the base64 format is a popular data format for storing application keys in a database. Therefore, corrections should be made as needed depending on the data format and the timing of obtaining each key amount information.

[0103] Next, we will describe the device configuration of a quantum cryptography communication system in an embodiment that includes a monitoring system for performing the integrity checks described above.

[0104] [Example of device configuration] Figure 7 shows an example of the device configuration of the quantum cryptography communication system 100 according to the embodiment. In the example in Figure 7, in addition to bases A and B, a base X is established as a comprehensive monitoring base, and a monitoring device 5 is installed at base X. The monitoring device 5 collects statistical information from bases A and B and performs consistency checks from the collected information.

[0105] Note that while Figure 7 shows an example where there are two locations, the number of locations comprehensively monitored by the monitoring device 5 can be any number.

[0106] Figure 8 shows an example of statistical information collected by the monitoring device 5 of the embodiment. The monitoring device 5 collects various statistical information and performs the consistency check described above.

[0107] At site A, the key management device 3a transmits statistical information for site A to the monitoring device 5. The statistical information for site A includes statistical values ​​based on application key quantity information, quantum key quantity information, and communication information of application key sharing communication. For example, the statistical value is the moving average of the application key storage quantity at site A.

[0108] At site B, the key management device 3b transmits statistical information for site B to the monitoring device 5. The statistical information for site B includes statistical values ​​based on application key quantity information, quantum key quantity information, and communication information of application key sharing communication. For example, the statistical value is the moving average of the application key storage quantity at site B. Also at site B, the control device 2b transmits Sifting, EC, and PA statistical information to the monitoring device 5. The Sifting, EC, and PA statistical information includes statistical values ​​based on operational information of Sifting, EC, and PA processing. For example, the statistical value is QbER (Quantum bit Error Rate).

[0109] Figure 9 shows an example of statistical information processing at site A of the embodiment. The processing unit 31a collects key quantity information for application keys from application key DB 101a and key quantity information for quantum keys from quantum key DB 102a. As described above, the key quantity information for each key can be obtained from the number of data entries, registration counts, reference counts, and deletion counts stored in the operation logs of each DB. Therefore, the processing unit 31a collects the data in the operation logs of each DB and then calculates the statistical value of each key quantity information.

[0110] Furthermore, the processing unit 31a collects communication information (operational information) of the communication interface that performs application key sharing communication from the communication unit 32a, and then calculates statistical values ​​related to application key sharing communication.

[0111] The communication unit 32a transmits the statistical values ​​calculated by the processing unit 31a to the monitoring device 5 as statistical information for base A.

[0112] Figure 10 shows an example of application key statistics in an embodiment. The data items included in the application key statistics are explained below. The key type is the type of key handled in the quantum cryptography communication system, and there are two types: application keys and quantum keys. In the example in Figure 10, since it is application key statistics, the value of the key type is set to application key.

[0113] Key storage locations (1) and (2) are locations where keys are stored. In the example in Figure 10, it is shown that the key is shared between location A, which is set as key storage location (1), and location B, which is set as key storage location (2).

[0114] The application identification number is identification information that identifies an application that uses an application key to perform encrypted communication. In particular, when there are multiple applications and each application uses a different application key, the identification number is used to perform consistency checks.

[0115] A data collection site is the site from which data is collected. Typically, this is either the key management site (1) or the key management site (2).

[0116] The data collection time is the time when the data was collected.

[0117] The storage capacity, generation rate, and consumption rate are those of the key specified in the statistical information's key type.

[0118] Figure 11 shows an example of quantum key statistics for the embodiment. Regarding the explanation of Figure 11, data items that differ from those in Figure 10 will be explained, while explanations of data items similar to those in Figure 10 will be omitted. The QKD link identification number is a number that identifies the QKD link connected between key storage location (1) and key storage location (2). In particular, if there are multiple QKD links connected between key storage location (1) and key storage location (2), and the quantum keys generated for each QKD link are stored in separate databases, the QKD link identification number is used for consistency verification.

[0119] Figure 12 shows an example of statistical information processing at site B in the embodiment. The processing example for key management device 3b is the same as the processing example for key management device 3a at site A (Figure 9), so the explanation is omitted.

[0120] The control device 2b comprises a processing unit 21b and a communication unit 22b. The processing unit 21b comprises a sifting processing unit 211b, an EC processing unit 212b, a PA processing unit 213b, and a data collection unit 214b.

[0121] The Sifting processing unit 211b performs a shift operation to obtain a sifted key by referencing the photon data in predetermined bit sequence units using a reference basis randomly selected from multiple basis sets. The EC processing unit 212b corrects errors contained in the sifted key and obtains EC data. The PA processing unit 213b generates output data (quantum key) by performing a confidentiality enhancement process on the EC data.

[0122] The data collection unit 214b collects operational information for each of the QKD signal processing operations (Sifting process, EC process, and PA process) performed by the control device 2b, and then calculates statistical values ​​based on the operational information.

[0123] The communication unit 22b transmits Sifting·EC·PA statistical information to the monitoring device 5.

[0124] Sifting statistics include optical system information centered on photons, such as the number of photons transmitted from the photon transmitter to the photon receiver via the QKD link, and the number of photons detected by the photon receiver via the QKD link. EC statistics include the operational status of the EC, including the coded data length and redundant data length when EC processing was performed, as well as information on the QKD link error rate (QbER). PA statistics include the operational status of the PA, including the number of output bits of the quantum key after PA processing. Using these Sifting, EC, and PA statistics, for example, an estimated (theoretical) value of the quantum key generation speed is calculated.

[0125] Figure 13 shows an example of statistical information processing at site X in the embodiment. The monitoring device 5 at site X includes a processing unit 51 and a communication unit 52. The description of the hardware realizing the processing unit 51 and the communication unit 52 is the same as the description of the processing unit 31a and the communication unit 32a of the key management device 3a described above, so it is omitted. The processing unit 51 includes a calculation unit 511 and a verification unit 512. The communication unit 52 includes a KM communication unit 521 and a control communication unit 522.

[0126] The KM communication unit 521 receives statistical information for base A from the key management device 3a, receives statistical information for base B from the key management device 3b, and inputs the statistical information for bases A and B into the verification unit 512.

[0127] The control communication unit 522 receives Sifting, EC, and PA statistical information from base X and inputs the Sifting, EC, and PA statistical information to the calculation unit 511.

[0128] The calculation unit 511 calculates QKD-related information from the Sifting·EC·PA statistical information and inputs the QKD-related information to the verification unit 512. Here, the QKD-related information is, for example, the quantum key generation rate.

[0129] The verification unit 512 uses statistical information received from key management device 3a (location A), statistical information received from key management device 3b (location B), and QKD-related information to perform consistency checks on application keys and quantum keys.

[0130] For example, the verification unit 512 determines that the key amount information for the application keys of base A and base B is consistent if the difference between the key amount information for the application key of base A and base B is less than the first difference. In other words, the verification unit 512 determines that the key amount information for the application keys of base A and base B is inconsistent if the difference between the key amount information for the application key of base A and base B is greater than or equal to the first difference.

[0131] Similarly, the verification unit 512 determines that the key quantity information of the quantum keys at sites A and B is consistent if the difference between the key quantity information of the quantum key at site A and the key quantity information of the quantum key at site B is less than the first difference. In other words, the verification unit 512 determines that the key quantity information of the quantum keys at sites A and B is inconsistent if the difference between the key quantity information of the quantum key at site A and the key quantity information of the quantum key at site B is greater than or equal to the first difference.

[0132] The KM communications unit 521, if it detects an anomaly as a result of its integrity check, notifies each location of the anomaly. Then, if the key management devices 3a and 3b are notified of an anomaly, they take actions such as deleting the application key, deleting the quantum key, and stopping application key sharing.

[0133] Figure 14A shows an example of processing 1 of the verification unit 512 in the embodiment. The example in Figure 14A shows the consistency verification process for the consistency verification targets (1) to (6) described above. In the example of the verification process in Figure 14A, the verification unit 512 verifies the consistency of the same type of key quantity information for the same type of key between bases A and B. For example, in the verification process for the application key storage amount (verification target (1) described above), consistency is confirmed between the application key storage amount at base A and the application key storage amount at base B. The verification process for verification targets (2) to (6) is the same as for verification target (1).

[0134] Figure 14B shows an example of processing example 2 of the verification unit 512 in the embodiment. The example in Figure 14B shows the consistency verification process for the consistency verification target (7) described above. In the example of the verification process in Figure 14B, the verification unit 512 further uses the estimated value of the quantum key generation speed to perform consistency verification.

[0135] Specifically, the verification unit 512 obtains an estimated value (theoretical value) of the quantum key generation rate from QKD-related information and performs a verification process for the quantum key generation rate. The verification unit 512 verifies the consistency of the quantum key generation rate based on the quantum key generation rates (actual values) of sites A and B and the estimated value (theoretical value) of the quantum key generation rate.

[0136] For example, the verification unit 512 calculates an estimated value of the quantum key generation speed from the number of bits in the output data of the privacy enhancement process performed to generate the quantum key, and the time taken to generate the output data.

[0137] For example, the verification unit 512 calculates an estimated quantum key generation speed from the QbER of the QKD link used for QKD, the aforementioned optical system information of the QKD link, and the coded data length and redundant data length of the error correction process performed to generate the quantum key.

[0138] Figure 14C shows an example of processing example 3 of the verification unit 512 in the embodiment. The example in Figure 14C shows the consistency verification process for the consistency verification target (8) described above. In the example of the verification process in Figure 14C, the verification unit 512 further uses the estimated application key generation speed to perform consistency verification.

[0139] As mentioned above, five data points are used to estimate the application key generation speed: the quantum key consumption speed at each location, the bandwidth (communication speed) of the application key sharing network at each location, the maximum bandwidth (maximum communication speed) of the encryption method for application key sharing, the quantum key generation speed at each location, and the estimated value of the quantum key generation speed. The verification unit 512 uses these five data points, in addition to the application key generation speed at each location, to verify the consistency between the application key generation speed (actual value) and the estimated value (theoretical value) at each location. In addition, the verification unit 512 also uses the quantum key storage capacity at each location to determine the relative size of the quantum key storage capacity.

[0140] For example, if the amount of stored quantum keys is greater than the first storage amount, the verification unit 512 uses the maximum communication speed of the application key sharing network as an estimate of the application key generation speed. For example, the first storage amount is the size of the quantum key used for encrypted transfer of the application key, or the size of the quantum key used for decrypting the encrypted transfer of the application key, from the start to the end of the measurement of the application key generation speed. Alternatively, for example, the first storage amount is the size of the quantum key used to perform the encryption process for one slot (see Figure 4 above).

[0141] For example, if the amount of stored quantum key is smaller than the second storage amount, the verification unit 512 uses the quantum key generation speed as an estimate of the application key generation speed. For example, the second storage amount is the size of the quantum key used to perform encryption processing for one slot (see Figure 4 above).

[0142] In the consistency verification process for consistency verification target (8), one of the five data points mentioned above may be used as the estimated value of the application key generation speed, or multiple data points may be used. However, the selection must be within a range that does not cause inconsistencies regarding the conditions of the quantum key storage amount, etc. (for example, the selection must be under the same conditions regarding the timing or duration of data acquisition (or calculation)).

[0143] In this embodiment, the monitoring device 5 at site X performed the consistency check, but the consistency check may be performed at either site A or site B. For example, the key management device 3a at site A may collect statistical information, perform the consistency check, and transmit the consistency check result to the monitoring device 5 at site X. Alternatively, for example, the monitoring device 5 at site X may calculate statistical values ​​of key quantity information for each key and perform the consistency check based on the statistical information generated by the monitoring device 5.

[0144] In this embodiment, QKD-related information was calculated at site X, but the calculation of QKD-related information can be performed at any site that can obtain logs of the Sifting process, EC process, and PA process. For example, the control device 2b at site B may perform the calculation of QKD-related information. Alternatively, if the control device 2a at site A can obtain logs of the Sifting process, EC process, and PA process, the control device 2a may perform the calculation of QKD-related information.

[0145] [Examples of monitoring methods] Figure 15 is a flowchart illustrating an example of the monitoring method in the embodiment. First, the communication unit 52 of the monitoring device 5 receives the above-mentioned statistical information (see Figure 8) from the key management device 3a, and from the key management device 3b and the control device 2b (step S1). Specifically, the KM communication unit 521 receives statistical information for base A from the key management device 3a and statistical information for base B from the key management device 3b. In addition, the control communication unit 522 receives sifting, EC, and PA statistical information from the control device 2b.

[0146] Next, the calculation unit 511 calculates the above-mentioned QKD-related information from the sifting·EC·PA statistical information (step S2).

[0147] Next, the verification unit 512 uses the statistical information of bases A and B, as well as QKD-related information, to verify the consistency of the aforementioned consistency verification targets (1) to (8) (step S3). If consistency is found (step S4, Yes), the process ends.

[0148] If there is no consistency (step S4, No), the KM communication unit 521 notifies the key management devices 3a and 3b of the abnormality, and the control communication unit 522 notifies the control device 2b of the abnormality. Specifically, if the verification unit 512 finds that there is no consistency in the key quantity information of the application keys for bases A and B, it outputs an abnormality notification indicating that there is no consistency in the key quantity information of the application keys for bases A and B. Also, if the verification unit 512 finds that there is no consistency in the key quantity information of the quantum keys for bases A and B, it outputs an abnormality notification indicating that there is no consistency in the key quantity information of the quantum keys for bases A and B.

[0149] The abnormality notification may also be output to at least one of the display device of the monitoring device, the key management devices 3a and 3b, and the control devices 2a and 2b.

[0150] As described above, in the monitoring device 5 of the embodiment, the verification unit 512 uses the key amount information of the application key used by the first application at base A (first base) (in this embodiment, the application operating on the encryption communication device 4a) to encrypt communications and the key amount information of the application key used by the second application at base B (second base) (in this embodiment, the application operating on the encryption communication device 4b) to decrypt encrypted communications to verify the consistency of the key amount information of the application keys at bases A and B. Furthermore, the verification unit 512 uses the key amount information of the quantum key generated by QKD at base A and used for encrypted transfer of the application key and the key amount information of the quantum key generated by QKD at base B and used for decryption of the encrypted transfer of the application key to verify the consistency of the key amount information of the quantum key at bases A and B.

[0151] As a result, the monitoring device 5 of this embodiment can detect attacks on the quantum cryptography communication system 100 with greater accuracy.

[0152] Finally, an example of the hardware configuration of the QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment will be described.

[0153] [Example hardware configuration] Figure 16 shows an example of the hardware configuration of the QKD device 1 of the embodiment. The QKD device 1 of the embodiment includes a control device 301, a main memory 302, an auxiliary memory 303, a display device 304, an input device 305, a quantum communication interface 306, and a classical communication interface 307.

[0154] The control device 301, main memory 302, auxiliary memory 303, display device 304, input device 305, quantum communication IF 306, and classical communication IF 307 are connected via bus 310.

[0155] The control device 301 executes the program read from the auxiliary storage device 303 into the main storage device 302. The main storage device 302 is memory such as ROM (Read Only Memory) and RAM (Random Access Memory). The auxiliary storage device 303 is such as an HDD and a memory card.

[0156] The display device 304 displays the status of the QKD device 1, etc. The input device 305 accepts input from the user. The display device 304 and the input device 305 may be implemented as touch panels or the like that have display and input functions. Furthermore, the display device 304 and the input device 305 do not have to be provided in the QKD device 1. In this case, for example, the display and input functions of an external terminal connected to the QKD device 1 may be used.

[0157] IF306 is an interface for connecting to a QKD link where photons are transmitted. IF307 is an interface for connecting to a wireless or wired network where control signals, etc., are transmitted.

[0158] Figure 17 shows an example of the hardware configuration of the control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment. The control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment include a control device 401, a main memory 402, an auxiliary memory 403, a display device 404, an input device 405, and a communication IF 406.

[0159] The control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment are implemented, for example, by a server device having the hardware configuration shown in Figure 17.

[0160] The control device 401, main memory 402, auxiliary memory 403, display device 404, input device 405, and communication IF 406 are connected via bus 410.

[0161] The control device 401 executes the program read from the auxiliary storage device 403 into the main storage device 402. The main storage device 402 is memory such as ROM and RAM. The auxiliary storage device 403 is such as an HDD and memory card.

[0162] The display device 404 displays the status of the key management device 3, etc. The input device 405 accepts input from the user. The display device 404 and the input device 405 may be implemented by a touch panel or the like having display and input functions. Furthermore, the display device 404 and the input device 405 do not have to be provided in the control device 2, key management device 3, encrypted communication device 4, and monitoring device 5. In this case, for example, the display and input functions of an external terminal connected to the control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment are used.

[0163] The communication IF406 is an interface for connecting to the transmission line.

[0164] The programs executed by the QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment are stored in installable or executable file format on computer-readable storage media such as CD-ROMs, memory cards, CD-Rs, and DVDs (Digital Versatile Discs) and provided as computer program products.

[0165] Furthermore, the programs executed by the QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment may be stored on a computer connected to a network such as the Internet, and provided by allowing users to download them via the network.

[0166] Furthermore, the programs executed by the QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment may be configured to be provided via a network such as the Internet without requiring downloads.

[0167] Furthermore, the programs executed by the QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 of the embodiment may be pre-installed and provided in ROM or the like.

[0168] The program executed in the QKD device 1 of this embodiment has a modular configuration that includes functions that can be implemented by the program, as part of the functional configuration of the QKD device 1. The functions implemented by the program are loaded into the main memory 302 by the control device 301 reading the program from a storage medium such as the auxiliary storage device 303 and executing it. In other words, the functions implemented by the program are generated on the main memory 302.

[0169] Furthermore, the programs executed by the control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 in this embodiment are configured as modules that include functions that can be implemented by the program, among the functional configurations of the control device 2, key management device 3, encrypted communication device 4, and monitoring device 5. The functions implemented by the program are loaded into the main memory 402 by the control device 401 reading the program from a storage medium such as the auxiliary storage device 403 and executing it. In other words, the functions implemented by the program are generated on the main memory 402.

[0170] Furthermore, some or all of the functions of the QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 may be implemented by hardware such as an IC (Integrated Circuit). An IC is, for example, a processor that performs dedicated processing.

[0171] Furthermore, when multiple processors are used to implement each function, each processor may implement one of the functions, or it may implement two or more of the functions.

[0172] Furthermore, the operating modes of the QKD device 1 and the key management device 3 are arbitrary. The QKD device 1, control device 2, key management device 3, encrypted communication device 4, and monitoring device 5 may be operated as a quantum cryptography communication system that realizes encrypted communication of a cloud system on a network, for example.

[0173] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be carried out in a variety of other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims of the invention and its equivalents.

[0174] (Note) Furthermore, the above embodiments can be summarized in the following technical proposal.

[0175] Technical proposal 1 Using the key amount information of the application key used by the first application at the first site to encrypt communications, and the key amount information of the application key used by the second application at the second site to decrypt encrypted communications, the consistency of the key amount information of the application keys at the first and second sites is confirmed. A processing unit that verifies the consistency of the quantum key information of the first and second locations, using the quantum key information of the quantum key generated by QKD (Quantum Key Distribution) at the first location and used for encrypted transfer of the application key, and the quantum key information of the quantum key generated by QKD at the second location and used for decryption of the encrypted transfer of the application key. A monitoring device equipped with the following features. Technical proposal 2 The key quantity information of the application key includes at least one of the storage amount of the application key, the generation speed of the application key, and the consumption speed of the application key. The key quantity information of the quantum key includes at least one of the storage amount of the quantum key, the generation rate of the quantum key, and the consumption rate of the quantum key. The monitoring device described in Technical Proposal 1. Technical proposal 3 The key quantity information of the aforementioned quantum key includes the generation rate of the quantum key. The processing unit confirms the consistency of the quantum key generation rate based on the quantum key generation rates of the first and second sites and the estimated value of the quantum key generation rate. A monitoring device as described in Technical Proposal 1 or 2. Technical proposal 4 The processing unit calculates an estimated value of the quantum key generation speed from the number of bits in the output data of the privacy enhancement process performed to generate the quantum key, and the time taken to generate the output data. The monitoring device described in Technical Proposal 3. Technical proposal 5 The processing unit calculates an estimated value of the quantum key generation speed from the QbER (Quantum bit Error Rate) of the QKD link used in the QKD, the optical system information of the QKD link, and the coded data length and redundant data length of the error correction process performed to generate the quantum key. The monitoring device described in Technical Proposal 3. Technical plan 6 The key quantity information of the aforementioned application key includes the generation speed of the aforementioned application key. The processing unit confirms the consistency of the application key generation speed based on the application key generation speed of the first and second locations and the estimated value of the application key generation speed. The monitoring device described in Technical Proposal 2. Technical proposal 7 The key quantity information of the aforementioned quantum key includes the consumption rate of the aforementioned quantum key. The processing unit uses the quantum key consumption rate as an estimate of the application key generation rate. The monitoring device described in Technical Proposal 6. Technical proposal 8 The processing unit uses the communication speed of the network used for sharing the application key as an estimate of the application key generation speed. A monitoring device as described in Technical Proposal 6 or 7. Technical proposal 9 The key quantity information of the quantum key includes the amount of the quantum key stored, If the amount of quantum keys stored is greater than the first amount of storage, the processing unit uses the maximum communication speed of the network used for sharing the application keys as an estimate of the application key generation speed. A monitoring device as described in any one of Technical Proposals 6 to 8. Technical proposal 10 The first storage amount is the size of the quantum key used for encrypted transfer of the application key, or the size of the quantum key used for decrypting the encrypted application key, during the period from the start to the end of measuring the application key generation speed. The monitoring device described in Technical Proposal 9. Technical proposal 11 The encryption process of the application key using the aforementioned quantum key is divided into multiple slots, The first storage amount is the size of the quantum key used to perform encryption processing for one slot. The monitoring device described in Technical Proposal 9. Technical proposal 12 The key quantity information of the quantum key includes the storage amount of the quantum key and the generation speed of the quantum key. The processing unit, when the amount of stored quantum keys is less than the second amount of stored quantum keys, uses the quantum key generation speed as an estimate of the application key generation speed. A monitoring device as described in any one of Technical Proposals 6 to 11. Technical proposal 13 The encryption process of the application key using the aforementioned quantum key is divided into multiple slots, The second storage amount is the size of the quantum key used to perform the encryption process for one slot. The monitoring device described in Technical Proposal 12. Technical proposal 14 The processing unit determines that the key amount information of the application keys at the first and second locations is consistent if the difference between the key amount information of the application key at the first location and the key amount information of the application key at the second location is smaller than the first difference. If the difference between the key size information of the application key at the first location and the key size information of the application key at the second location is greater than or equal to the first difference, it is determined that the key size information of the application keys at the first and second locations are inconsistent. If the difference between the key quantity information of the quantum key at the first site and the key quantity information of the quantum key at the second site is smaller than the first difference, it is determined that the key quantity information of the quantum keys at the first and second sites are consistent. If the difference between the key quantity information of the quantum key at the first location and the key quantity information of the quantum key at the second location is greater than or equal to the first difference, it is determined that the key quantity information of the quantum keys at the first and second locations are inconsistent. A monitoring device as described in any one of Technical Proposals 1 to 13. Technical proposal 15 If the processing unit finds that the key amount information of the application keys at the first and second locations is inconsistent, it outputs an anomaly notification indicating that the key amount information of the application keys at the first and second locations is inconsistent to at least one of the display device, the first and second key management devices, and the control device that controls the QKD device that generates the quantum keys by QKD. If there is inconsistency in the key quantity information of the quantum keys at the first and second locations, an anomaly notification indicating the inconsistency in the key quantity information of the quantum keys at the first and second locations is output to at least one of the display device, the first and second key management devices, and the control device. The monitoring device described in Technical Proposal 14. Technical proposal 16 A monitoring device described in any one of Technical Proposals 1 to 15, A first key management device that transmits key amount information of the application key of the first site and key amount information of the quantum key of the first site to the monitoring device, A second key management device that transmits key amount information of the application key at the second site and key amount information of the quantum key at the second site to the monitoring device, A quantum cryptography communication system equipped with [the necessary components]. Technical proposal 17 The monitoring device uses the key amount information of the application key used by the first application at the first site to encrypt communications and the key amount information of the application key used by the second application at the second site to decrypt encrypted communications to verify the consistency of the key amount information of the application keys at the first and second sites. The monitoring device verifies the consistency of the quantum key information at the first and second locations using the quantum key information of the quantum key generated at the first location by QKD (Quantum Key Distribution) and used for encrypted transfer of the application key, and the quantum key information of the quantum key generated at the second location by QKD and used for decryption of the encrypted transfer of the application key. Monitoring method. Technical proposal 18 On the computer, The consistency of the application key information of the first and second locations is verified using the key amount information of the application key used by the first application at the first location to encrypt communications and the key amount information of the application key used by the second application at the second location to decrypt encrypted communications. The system verifies the consistency of the quantum key information at the first and second locations by using the quantum key amount information of the quantum key generated by QKD (Quantum Key Distribution) at the first location and used for encrypted transfer of the application key, and the quantum key amount information of the quantum key generated by QKD at the second location and used for decryption of the encrypted transfer of the application key. program. [Explanation of Symbols]

[0176] 1 QKD device 2 Control device 3 Key management device 4. Encryption communication device 5 Monitoring device 21 Processing Unit 22 Communications Department 31 Processing Unit 32 Communications Department 41 Communications Department 51 Processing Unit 52 Communications Department 100 Quantum Cryptography Communication Systems 211 Sifting Processing 212 EC Processing Unit 213 PA Processing Unit 214 Collection Department 301 Control device 302 Main storage 303 Auxiliary storage device 304 Display device 305 Input device 306 Quantum Communication IF 307 Classical Communication IF 310 Bus 401 Control Unit 402 Main storage 403 Auxiliary storage 404 Display device 405 Input device 406 Communication IF 410 Bus 511 Calculation Department 512 Verification Section 521 KM Communications Department 522 Control and Communication Unit

Claims

1. Using the key amount information of the application key used by the first application at the first site to encrypt communications, and the key amount information of the application key used by the second application at the second site to decrypt encrypted communications, the consistency of the key amount information of the application keys at the first and second sites is confirmed. A processing unit that uses the key amount information of the quantum key generated by QKD (Quantum Key Distribution) at the first site and used for encrypted transfer of the application key, and the key amount information of the quantum key generated by QKD at the second site and used for decryption of the encrypted transfer of the application key, to verify the consistency of the key amount information of the quantum key at the first and second sites. A monitoring device equipped with the following features.

2. The key quantity information of the application key includes at least one of the storage amount of the application key, the generation speed of the application key, and the consumption speed of the application key. The key quantity information of the quantum key includes at least one of the storage amount of the quantum key, the generation rate of the quantum key, and the consumption rate of the quantum key. The monitoring device according to claim 1.

3. The key quantity information of the aforementioned quantum key includes the generation rate of the quantum key. The processing unit confirms the consistency of the quantum key generation speed based on the quantum key generation speeds of the first and second sites and the estimated value of the quantum key generation speed. The monitoring device according to claim 2.

4. The processing unit calculates an estimated value of the quantum key generation speed from the number of bits in the output data of the privacy enhancement process performed to generate the quantum key, and the time taken to generate the output data. The monitoring device according to claim 3.

5. The processing unit calculates an estimated value of the quantum key generation speed from the QbER (Quantum bit Error Rate) of the QKD link used in the QKD, the optical system information of the QKD link, and the coded data length and redundant data length of the error correction process performed to generate the quantum key. The monitoring device according to claim 3.

6. The key quantity information of the aforementioned application key includes the generation speed of the aforementioned application key. The processing unit confirms the consistency of the application key generation speed based on the application key generation speed of the first and second locations and the estimated value of the application key generation speed. The monitoring device according to claim 2.

7. The key quantity information of the aforementioned quantum key includes the consumption rate of the aforementioned quantum key. The processing unit uses the quantum key consumption rate as an estimate of the application key generation rate. The monitoring device according to claim 6.

8. The processing unit uses the communication speed of the network used for sharing the application key as an estimate of the application key generation speed. The monitoring device according to claim 6.

9. The key quantity information of the quantum key includes the amount of the quantum key stored, If the amount of the quantum key stored is greater than the first amount of storage, the processing unit uses the maximum communication speed of the network used for sharing the application key as an estimate of the application key generation speed. The monitoring device according to claim 6.

10. The first storage amount is the size of the quantum key used for encrypted transfer of the application key, or the size of the quantum key used for decrypting the encrypted application key, during the period from the start to the end of measuring the application key generation speed. The monitoring device according to claim 9.

11. The encryption process of the application key using the aforementioned quantum key is divided into multiple slots, The first storage amount is the size of the quantum key used to perform encryption processing for one slot. The monitoring device according to claim 9.

12. The key quantity information of the quantum key includes the storage amount of the quantum key and the generation speed of the quantum key. If the amount of the quantum key stored is less than the second amount of the quantum key stored, the processing unit uses the quantum key generation speed as an estimate of the application key generation speed. The monitoring device according to claim 6.

13. The encryption process of the application key using the aforementioned quantum key is divided into multiple slots, The second storage amount is the size of the quantum key used to perform the encryption process for one slot. The monitoring device according to claim 12.

14. The processing unit determines that the key amount information of the application keys at the first and second locations is consistent if the difference between the key amount information of the application key at the first location and the key amount information of the application key at the second location is smaller than the first difference. If the difference between the key size information of the application key at the first location and the key size information of the application key at the second location is greater than or equal to the first difference, it is determined that the key size information of the application keys at the first and second locations are inconsistent. If the difference between the key quantity information of the quantum key at the first site and the key quantity information of the quantum key at the second site is smaller than the first difference, it is determined that the key quantity information of the quantum keys at the first and second sites are consistent. If the difference between the key quantity information of the quantum key at the first location and the key quantity information of the quantum key at the second location is greater than or equal to the first difference, it is determined that the key quantity information of the quantum keys at the first and second locations are inconsistent. The monitoring device according to claim 1.

15. If the processing unit finds that the key amount information of the application keys at the first and second locations is inconsistent, it outputs an abnormality notification indicating that the key amount information of the application keys at the first and second locations is inconsistent to at least one of the display device, the first key management device at the first location, the second key management device at the second location, and the control device that controls the QKD device that generates the quantum keys by QKD. If there is inconsistency in the key quantity information of the quantum keys at the first and second locations, an anomaly notification indicating the inconsistency in the key quantity information of the quantum keys at the first and second locations is output to at least one of the display device, the first key management device, the second key management device, and the control device. The monitoring device according to claim 14.

16. A monitoring device according to any one of claims 1 to 15, A first key management device that transmits key amount information of the application key of the first site and key amount information of the quantum key of the first site to the monitoring device, A second key management device that transmits key amount information of the application key of the second site and key amount information of the quantum key of the second site to the monitoring device, A quantum cryptography communication system equipped with [the necessary components].

17. The monitoring device uses the key amount information of the application key used by the first application at the first site to encrypt communications and the key amount information of the application key used by the second application at the second site to decrypt encrypted communications to verify the consistency of the key amount information of the application keys at the first and second sites. The monitoring device verifies the consistency of the quantum key information at the first and second locations using the quantum key amount information of the quantum key generated at the first location by QKD (Quantum Key Distribution) and used for encrypted transfer of the application key, and the quantum key amount information of the quantum key generated at the second location by QKD and used for decryption of the encrypted transfer of the application key. Monitoring method.

18. On the computer, The consistency of the application key information of the first and second locations is verified using the key amount information of the application key used by the first application at the first location to encrypt communications and the key amount information of the application key used by the second application at the second location to decrypt encrypted communications. The system verifies the consistency of the quantum key information at the first and second locations by using the quantum key amount information of the quantum key generated at the first location by QKD (Quantum Key Distribution) and used for encrypted transfer of the application key, and the quantum key amount information of the quantum key generated at the second location by QKD and used for decryption of the encrypted transfer of the application key. program.

Images