Quantum Safe Networking

Abstract

Methods, systems, and devices are provided for storing one or more data items in a quantum-secure (QS) network. The QS network includes one or more QS servers and a repository for storing and accessing the data items. Each QS server includes a hardware security module (HSM) for storing an identical set of quantum distribution (QD) keys. The identical set of QD keys is distributed to each of the QS servers in a quantum-secure manner. The QS servers are configured to securely communicate with each other and with the repository using one or more available QD keys from the identical QD key set. The QS servers generate a quantum reference (QREF) locator based on input data associated with the data item for storage and an available QD key selected from the set of QD keys, and transmit the QREF locator to the repository for storage along with the data item encrypted with the available QD key.

Description

[Technical Field]

[0001] This application relates to systems and methods for quantum-safe networking and applications therefor. [Background technology]

[0002] Cryptography is used to secure billions of transactions every day, from, but not limited to, Transport Layer Security (TLS) security for online shopping and banking to highly secure government communications. These transactions rely on a trusted and secure means for at least two or more transacting parties to share a private key, enabling data encryption by one party and subsequent decryption by another. The availability of commercially available general-purpose quantum computers will render a variety of these types of transactions, tasks, and applications vulnerable, including, but not limited to, digital banking, web certificates, know-your-own-client (KYC), digital asset transfers, and authentication. These transactions, tasks, and applications are currently provided using software systems that typically employ conventional encryption and / or cryptographic techniques and protocols that are not sufficiently resilient to withstand attacks from such quantum computers (QCs).

[0003] QC has the potential to break many conventional encryption codes almost effortlessly. Interest in quantum computing has also grown over the past year as a result of D-Wave's success in selling commercial systems. Furthermore, numerous breakthroughs in QC technology by technology companies, including but not limited to Microsoft®, IBM®, Intel®, Google®, and others, are expected to make general-purpose QC feasible in the near future (e.g., 5–10 years from now). QC is already a threat to the present, and in 2016, NIST reported on the impact of QC on common encryption algorithms in a report by L. Chen, S. Jordan, Y. Liu, D. Moody, R. Peralta, Ray Perlner, and D. Smith-Tone, “Report on Post-Quantum Cryptography,” NISTIR 8105, 2016 (https: / / nvlpubs.nist.gov / nistpubs / ir / 2016 / NIST.IR.8105.pdf). For example, NIST has determined that public key encryption algorithms, including but not limited to, those used for digital signatures and / or key exchange, are no longer secure: finite field cryptography, such as, but not limited to, the Digital Signature Algorithm (DSA); elliptic curve cryptography, such as, but not limited to, ECDSA and ECDH, Elliptic Curve Diffie-Hellman Ephemeral-Rivest / Shamir / Adelman (ECDHE-RSA), ECDHE-ECDSA, Rivest / Shamir / Adelman (RSA), and other ciphers. NIST has also determined that the following hash functions, including but not limited to, the Secure Hash Algorithm (SHA)-2 (384-bit) and SHA-3, may require large output or key sizes. NIST has also determined that the following encryption algorithms, including, but not limited to, the Advanced Encryption Standard (AES) (256-bit) Galois Counter Mode (GCM) when used for encryption, may require larger key sizes.

[0004] This means that cryptographic protocols using these cryptographic algorithms will be vulnerable and insecure. For example, such cryptographic protocols include, but are not limited to, Transport Layer Security (TLS), https, Secure Sockets Layer (SSL), and Secure Shell (SSH), used in search, certificate, and / or banking applications. For example, TLS using ECDHE-RSA, AES (128-bit) GCM, and SHA256 for search(es) / search engines will be broken or weakened. For example, TLS using ECDHE-RSA with AES (256-bit) GCM and SHA (384-bit) for banking applications, etc. will be broken or weakened. Server certificates, client certificates, and public key cryptography are presumed to be broken and insecure.

[0005] For example, current methods for exchanging encryption keys between two parties are vulnerable to quasi-cryptographic attacks. If the cryptographic primitives included in the key exchange protocol can be broken, the exchanged key is compromised and the encrypted data is exposed to an attacker. Classical key exchange protocols are based on the difficulty of factoring the discrete logarithm problem (e.g., Diffie-Hellman (DH)) or the discrete logarithm problem (e.g., elliptic curve DH (ECDH)). Neither of these problems is guaranteed to be robust, and both problems can be solved in polynomial time by quasi-cryptographic attacks. This is of particular concern for both large and small organizations and enterprises, as well as individual users of public and private networks (e.g., the Internet or corporate intranets). If key exchange cannot be performed reliably, all current transactions, tasks, and applications become vulnerable to quasi-cryptographic attacks.

[0006] The field of "quantum cryptography" aims to address these risks by developing both quantum-secure cryptographic algorithms (so-called quantum-safe algorithms) and quantum key distribution (QKD) techniques. While a combination of both offers the ultimate solution, QKD as a standalone technology still has much to offer and does not rely on the development of quantum-safe algorithms to become widely adopted. However, reliably implementing QKD at scale for a wide range of users, from large to small businesses and / or individuals, remains a costly and time-consuming endeavor.

[0007] For and / or with respect to any communications, transactions, tasks, and / or applications mentioned above that are vulnerable to quantum cyberattacks, a robust, secure, and cost-effective approach is desired to provide a quantum-safe solution for at least the communication, storage, and / or access of data items created for and generated by users performing such communications, transactions, tasks, and / or applications. Such a solution also provides protection against advanced non-quantum cyberattacks.

[0008] The embodiments described below are not limited to implementations that address any or all of the drawbacks of known approaches discussed above. Summary of the Invention

[0009] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter; modifications and alternative features that serve to facilitate the practice of the invention and / or to achieve substantially similar technical effects should be deemed to be within the scope of the invention as disclosed herein.

[0010] The present disclosure provides systems, apparatus, mechanisms, methods, and processes for combining a security layer with a data delivery layer over a QKD network to store and deliver data or data items via repositories or storage management systems based on distributed ledger technology, shared ledger technology, cloud storage technology, and / or centralized storage technology to provide a set of quantum-safe or quantum-resistant services, applications, and use cases to multiple different types of users (e.g., customers, consumers, large organizations or enterprises) related to verification, authenticity, authentication, value transfer, privacy, secure storage, and / or secure communication capabilities.

[0011] In a first aspect, the present disclosure provides a computer-implemented method for storing one or more data items in a quantum-secure (QS) network, the QS network comprising one or more QS servers and a repository for storing and accessing the data items, each QS server comprising a hardware security module (HSM) for storing an identical set of quantum distribution (QD) keys, the identical set of QD keys being distributed to each of the QS servers in a quantum-secure manner, the QS servers being configured to securely communicate with each other and with the repository using one or more available QD keys from the same set of QD keys, and a method performed by the QS servers comprising: generating a quantum reference “QREF” locator based on input data associated with the data item for storage and an available QD key selected from the set of QD keys; and transmitting the QREF locator to the repository along with the data item encrypted with the available QD key.

[0012] Preferably, the method further includes selecting an available QD key from a set of QD keys to encrypt the data item; generating a QREF locator for storing and accessing the data item based on input data associated with the data item and the selected available QD key, wherein the generated QREF locator is unique; linking the QREF locator to an available QD key from the set of QD keys; and transmitting the QREF locator and the encrypted data item to a repository for storage, wherein the encrypted data item is linked to the QREF locator when stored.

[0013] Preferably, the method further comprises receiving a set of QD keys from a quantum key distribution source or source using quantum secure key distribution.

[0014] Preferably, the input data associated with the data item further includes one or more input data from the group of: a device identifier, a manufacturer identifier, a user identifier, a user secret, a customer number, and an access control list of users for accessing the data item.

[0015] Preferably, the method further includes generating a QREF access token associated with the data item based on the QREF locator, and transmitting the QREF access token to a device of a user associated with the data item.

[0016] Preferably, the method further includes generating a QREF access token for accessing the data item based on the QREF locator using a non-reversible function, process, or operation, wherein the QREF access token is unique, and transmitting the QREF access token to the user's device to enable the user to access the data item.

[0017] Preferably, the method further includes receiving a QREF access token from a user's device requesting access to a data item stored in the repository; identifying a QREF locator based on the QREF access token and input data from the user; retrieving the data item from the repository in response to identifying the QREF locator, wherein the data item is decrypted using a QD key corresponding to the QREF locator; and providing the user with an access operation related to the decrypted data item.

[0018] In a second aspect, the present disclosure provides a computer-implemented method for quantum-secure (QS) storage in a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with a plurality of users, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: generating a quantum reference (QREF) locator associated with the data item based on input data associated with a first user of the plurality of users and an available QD key selected from the set of QD keys; and storing the data item encrypted with the available QD key in the repository, indexed with the QREF locator.

[0019] Preferably, the method further includes generating a QREF access token based on the QREF locator, the QREF access token enabling an access operation to be performed on a data item stored in the repository; transmitting the QREF access token to at least a first user of the plurality of users; and in response to receiving a QREF access token related to a data item stored in the repository from a second user of the plurality of users, identifying the QREF locator associated with the access token and the second user; and providing an access operation related to the encrypted data item of the repository based on the identified QREF locator and the identified second user.

[0020] In a third aspect, the present disclosure provides a computer-implemented method for quantum-secure (QS) storage and retrieval in a QS network, the QS network comprising one or more QS servers and a repository for storing and retrieving one or more data items by a plurality of users, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method performed by the QS servers in response to receiving a data item for storage comprises generating a quantum reference "QREF" locator based on a user secret of a first user and an available QD key selected from the set of QD keys, the QREF locator storing the data item encrypted with the selected QD key in the repository. and an identity of a first user; generating a QREF access token based on the QREF locator, the QREF access token enabling an access operation to be performed on the data item when stored in the repository; storing the data item in the repository indexed by the QREF locator; sending the QREF access token to the first user; and in response to receiving the QREF access token for the data item stored in the repository, identifying a QREF locator based on the QREF access token and the identity of a second user; and providing an access operation related to the encrypted data item in the repository to the second user based on the identified QREF locator.

[0021] Preferably, the first, second and third aspects further include receiving a request by the first user to store the data item.

[0022] Preferably, the first user and the second user are the same.

[0023] Preferably, the first user and the second user are different.

[0024] Preferably, the first, second, and third aspects are such that the QS network further includes one or more user devices, each user device comprising a hardware security module for storing a set of QD keys, and one or more of the one or more user devices and the QS server communicate using quantum key encryption based on the set of QD keys.

[0025] Preferably, the first, second and third aspects comprise a repository or storage system based on at least one from the group of: a distributed ledger technology or network, a shared ledger technology or network, a blockchain technology or network, a publish / subscribe, reply / request and / or real-time based digital storage cloud / repository technology, any other secure cloud storage system or platform, any other secure storage system or platform, and any other secure database management system.

[0026] Preferably, each set of QD keys is distributed to each of the QS devices based on at least one from the group of satellite quantum key distribution, fiber optic quantum key distribution, terrestrial quantum key distribution, optical quantum key distribution, and any other quantum key distribution system capable of distributing the same set of QD keys to each of the QS servers in the QS network.

[0027] Preferably, generating the QREF locator further includes receiving a user secret from the first user's device, receiving an available QD key selected from a set of QD keys from one of the QS servers, and generating a QREF locator based on a first set of cryptographic or mathematical operations related to data representing the user secret and the received QD key, wherein the QREF locator is unique.

[0028] Preferably, generating the QREF access token further includes generating the QREF access token based on a second set of cryptographic or mathematical operations related to the data representing the QREF locator, wherein the QREF access token is unique.

[0029] Preferably, generating the QREF locator based on the first set of cryptographic or mathematical operations further includes generating the QREF locator from the data representing the user secret and the received QD key based on any one or more cryptographic or mathematical operations from the group of one or more one-way functions, one or more hash functions, one or more hash-based message authentication code functions, one or more key derivation functions, one or more multiplications, subtractions, additions, divisions, factorizations, and / or any other mathematical operations, operable to generate data representing a unique QREF locator, obfuscate the received QD key and user secret, and provide an address for locating an associated data item for storage in a repository.

[0030] Preferably, generating the QREF access token based on the second set of cryptographic or mathematical operations further includes generating the QREF access token from the data representing the QREF locator based on any one or more cryptographic or mathematical operations from the group of one or more one-way functions, one or more hash functions, one or more hash-based message authentication code functions, one or more key derivation functions, one or more multiplications, subtractions, additions, divisions, factorizations, and / or any other mathematical operations, operable to generate data representing the QREF locator that is unique, obfuscating the data representing the QREF locator, and any other combination of mathematical operations that can be used by the QS server to identify the QREF to provide an address for locating an associated data item stored in a repository.

[0031] Preferably, the method further includes receiving a QREF access token from the user, identifying a QREF locator associated with the QREF access token, and in response to identifying the QREF locator, performing one or more access operations related to a data item stored in the repository corresponding to the QREF locator and the QREF access token.

[0032] Preferably, the method comprises storing an enrollment record for each user that stores a data item in the repository, each enrollment record including data representing the user identity of that user, the user secret of that user, an authentication challenge and response, a QREF locator associated with the data item, a data item reference identifier associated with the data item, a quantum key identifier associated with a QD key used to encrypt the data item, and an access control list associated with the data item; receiving a QREF access token associated with the data item from a second user; and retrieving one or more enrollment records associated with the second user. and for each retrieved entitlement record, generating a QREF access token based on the each retrieved entitlement record, identifying a QREF locator associated with the QREF access token by matching the generated QREF access token with the received QREF access token and identifying from the entitlement record a QREF locator associated with the generated QREF access token that matches the received QREF access token; and in response to identifying the QREF locator, performing one or more access operations related to a data item corresponding to the QREF locator and the QREF access token stored in the repository.

[0033] Preferably, the first, second, and third aspects relate to a QS network comprising one or more QS registration servers and a plurality of registration nodes, the QS registration server connecting to a set of registration nodes of the plurality of registration nodes, the one or more QS servers delivering one or more groups of QD keys from a set of QD keys to the QS registration server, each QS registration server delivering one or more QD keys from the group of QD keys to a corresponding set of registration nodes, and the method comprising receiving a registration record of a user from the QS registration server generating a registration record associated with the user, the user's device in communication with the registration node coupled to the QS registration server, the registration record being and storing in the repository a registration record for the user, the registration record including one or more user data representing each user's user identity, one or more device identifiers associated with the user, user credentials associated with logging into the QS system, a user secret for each such user, an authentication challenge and response, a QREF locator associated with a data item related to the user, a data item reference identifier associated with the data item, a QD key identifier associated with a QD key used to encrypt the data item, and an access control list associated with the data item.

[0034] Preferably, the method further includes receiving user credentials from a QS registration server associated with the user, wherein the user's device is in communication with a registration node coupled to the QS registration server; retrieving a registration record associated with the user based on the user credentials; receiving a QREF access token associated with the data item from the user; for each retrieved registration record, generating a QREF access token based on the each retrieved registration record, identifying a QREF locator associated with the QREF access token by matching the generated QREF access token with the received QREF access token and identifying from the retrieved registration record a QREF locator associated with the generated QREF access token that matches the received QREF access token; and in response to identifying the QREF locator, performing one or more access operations related to the data item corresponding to the QREF locator and the QREF access token stored in the repository.

[0035] Preferably, the repository further comprises a distributed ledger, and the QS network further comprises a plurality of QS servers, each QS server comprising an HSM having the same set of QD keys stored therein, and each QS server of the plurality of QS servers comprises a node for computing the distributed ledger, and the nodes of the plurality of QS servers form a QS distributed ledger network configured to provide storage and access to one or more data items stored in the distributed ledger, and the method further comprises receiving a QREF locator for storing the encrypted data item in the distributed ledger, and storing the encrypted data item in the distributed ledger using the QREF locator as an address for the location of the encrypted data item in the distributed ledger.

[0036] Preferably, the repository further comprises a shared ledger, and the QS network further comprises a plurality of QS servers, each QS server comprising an HSM having an identical set of QD keys stored therein, each QS server of the plurality of QS servers comprising a node for computing the shared ledger between corresponding nodes, the nodes of the plurality of QS servers forming a QS shared ledger network configured to provide storage and access to one or more data items stored in the shared ledger, and the method further comprises receiving a QREF locator for storing the encrypted data item in the shared ledger, and storing the encrypted data item in the shared ledger using the QREF locator as an address for the location of the encrypted data item in the shared ledger.

[0037] Preferably, the method further includes receiving a QREF access token from the second user to access an encrypted data item stored on the distributed or shared ledger, identifying the QREF access token and a QREF locator corresponding to the second user, and accessing the encrypted data item on the distributed or shared ledger using the identified QREF locator based on the access token.

[0038] Preferably, the repository further includes a digital storage platform that uses publish / subscribe, request / response, and / or real-time based messaging to store and access the data items, the QS network further comprising a plurality of QS servers, each QS server comprising an HSM having an identical set of QD keys stored therein, each QS server of the plurality of QS servers comprising a node for computing digital storage platform messaging between corresponding nodes, the nodes of the plurality of QS servers forming the digital storage platform as a QS distributed storage network configured to provide storage and access to one or more data items based on the digital storage platform messaging, and the method further comprises receiving a QREF locator for storing the encrypted data item in the distributed storage platform, and storing the encrypted data item on the shared ledger using the QREF locator as an address for the location of the encrypted data item in the distributed storage platform.

[0039] Preferably, the method further includes receiving a QREF access token from the second user to access an encrypted data item stored in the distributed storage platform, identifying the QREF access token and a QREF locator corresponding to the second user, and accessing the encrypted data item in the distributed storage platform using the identified QREF locator based on the access token.

[0040] Preferably, each QS server comprises a satellite receiver, and the method further includes receiving, at each of one or more QS servers of the QS network, a set of one or more QD keys from a satellite quantum key distribution system, the satellite quantum key distribution system comprising at least one satellite configured to generate and distribute the set of QD keys; and storing, at each of the one or more QS servers of the QS network, the received set of QD keys in a corresponding hardware security module, wherein after distribution of the set of QD keys to each of the QS servers, each of the QS servers stores the same set of QD keys internally.

[0041] Preferably, the QS network further includes one or more user devices, each user device comprising an HSM for storing a set of QD keys, one or more of the one or more user devices and the QS server communicating using quantum key encryption based on the set of QD keys, each QS user device comprising a satellite receiver, and the method further includes receiving, at one or more of the user devices, a set of one or more QD keys from a satellite quantum key distribution system, the satellite quantum key distribution system comprising at least one satellite configured to generate and distribute the set of one or more QD keys, and storing, at each of the one or more QS user devices of the QS network, the received set of QD keys in a corresponding HSM, wherein after distribution of the set of one or more QD keys to each of the QS user devices, each of the QS user devices stores the same set of QD keys internally.

[0042] Preferably, each QS server of the QS network includes a hardware security module (HSM) for storing a set of QD keys, each QD key in the set of QD keys being mapped to a corresponding QD key identifier based on a QD key identifier for identifying the respective QD key and data representing the respective QD key, and stored in the HSM, and each set of QD keys stored in each QS server of the QS network has an identical mapping between the QD key identifier and each QD key from the set of QD keys, and the method further includes receiving a set of QD keys from a quantum key distribution system, wherein each QD key in the set of QD keys is mapped to a corresponding QD key identifier, and storing data representing the set of QD keys and the corresponding QD key identifier.

[0043] Preferably, data representing a mapping of a QREF locator associated with a QD key is stored in the HSM based on data representing the QREF locator, the QD key associated with the QREF locator, and a QD key identifier identifying the selected QD key, and each set of QD keys stored in the HSM of each QS server in the QS network is updated based on data representing the mapping between the QD key identifier, the QREF locator, and the corresponding QD key, and the method further includes receiving a QREF locator and a QD key identifier associated with a QD key, the QD key being selected from the set of QD keys for use in generating the QREF locator and encrypting the associated data item, and storing data representing the mapping between the QREF locator, the QD key identifier, and the QD key in the HSM of the QS server.

[0044] Preferably, the repository further includes a plurality of records for storing one or more encrypted data items, each record including data representing a QREF locator associated with the encrypted data item and the encrypted data item, the data item being encrypted with a QD key associated with the QREF locator.

[0045] Preferably, each record further includes data representing one or more user identities authorized to access the encrypted data item of that record, and one or more permissions or actions associated with each of the one or more user identities in connection with accessing the encrypted data item.

[0046] Preferably, each record further includes data representing an access control list indicating one or more user identities authorized to access the encrypted data item and the corresponding permissions and / or actions associated with each user identity accessing the encrypted data item.

[0047] Preferably, the QREF locator further includes data representing a user secret, a customer number assigned to the user, a data item reference identifier assigned to the data item, and a QD key identifier of an available QD key in the set of QD keys used to encrypt the data item.

[0048] Preferably, the QREF locator further includes data representing a user identifier and an access control list for the data item.

[0049] Preferably, the method includes receiving a request to register a user, authenticating the user, and in response to positive authentication of the user, receiving user details for registering the user with the QS network, receiving a data item from the user for storage in a QS repository of the QS network, generating unique QREF locator-based data representing the received user details and data item, associating the generated QREF locator with the registered user details and further with the data item, generating a unique QREF access token based on data representing the QREF locator associated with the data item, storing the QREF locator and data item in a QS repository of the QS network, and sending the unique QREF access token to the user for use in accessing the data item in some manner.

[0050] Preferably, the method further includes receiving from the user a QREF access token associated with the data item; authenticating the user; identifying a QREF locator based on user registration details and the access token associated with the user; retrieving the data item associated with the QREF locator from the QS repository; checking that the user has permission to access the data item based on an access control list associated with the data item; and enabling user access operations on the data item in response to determining that the user has permission to access the data item.

[0051] Preferably, the method further comprises receiving a request to register a user; authenticating the user; and in response to positive authentication of the user, receiving user details for registering the user on the QS network; receiving a Know Your Customer "KYC" data item from the user for storage in a QS repository of the QS network, the KYC data item including data representing the user's identifying details; generating unique QREF locator-based data representing the received user details and KYC data item; associating the generated QREF locator with the registered user details and further with the KYC data item; generating a unique QREF access token based on data representing the QREF locator corresponding to the KYC data item and the KYC data item; storing the QREF locator and the KYC data item in the QS repository of the QS network; and transmitting the unique KYC QREF access token to the user for use in providing the user's KYC data to one or more service providers.

[0052] Preferably, the method further includes receiving from the user a QREF access token associated with the data item; authenticating the user; identifying a QREF locator based on the user registration details and the access token; retrieving the data item associated with the QREF locator from the QS repository; checking that the user has permission to access the data item based on an access control list associated with the data item; and enabling the user access to the data item in response to determining that the user has permission to access the data item.

[0053] Preferably, the method comprises receiving a request to register a user; authenticating the user; receiving user details for registering the user with the QS network in response to positive authentication of the user; receiving a certificate data item from the user for storing in a QS repository of the QS network, the certificate data item including data representing a web certificate for attesting to the authenticity of a website operated by the user; generating unique QREF locator-based data representing the received user details and certificate data item; associating the generated QREF locator with the registered user details and further with the certificate data item; generating a unique QREF access token based on data representing the QREF locator corresponding to the certificate data item and the certificate data item; storing the QREF locator and the certificate data item in a QS repository of the QS network; and sending the unique certificate QREF access token to the user for use by the website in providing the certificate QREF access token to a web browser of the user visiting the website.

[0054] Preferably, the method further comprises receiving from the user's web browser a certificate QREF access token associated with the certificate data item, identifying a QREF locator associated with the certificate data item based on the certificate data in the certificate QREF access token and user enrolment data associated with the certificate access token, retrieving the certificate data item associated with the QREF locator from the QS repository, checking that the certificate data item matches the received certificate details in the received certificate access token, and in response to the received certificate details matching the corresponding details of the certificate data item, confirming to the user's web browser that the certificate QREF access token is valid.

[0055] Preferably, the certificate data item is based on data representing a certificate according to the X509 standard and beyond.

[0056] Preferably, the method includes establishing a QS communication channel with a first device of a first user; receiving from the first device a QREF access token associated with a QD key selected from a set of QD keys, the QD key being for use in QS communication with a second device of a second user; retrieving from a repository the QD key selected from the set of QD keys based on the received QREF access token; and transmitting the retrieved QD key to the first device and the second device for use in QS communication between the first device and the second device.

[0057] Preferably, the method includes: establishing a first communication channel with a first device of a first user; receiving a request from the first device to communicate with a second device of a second user via a QS network; establishing a second communication channel with the second device of the second user; receiving a response from the second device of the second user to connect with the first device of the first user; establishing a QS communication channel through the QS network based on an available QD key selected from a set of QD keys; and connecting the first device of the first user with the second device of the second user via a communication path including the first communication channel, the QS communication channel, and the second communication channel.

[0058] Preferably, the first device has a first QD key from a set of QD keys stored internally for QS communication with the QS network, the second device has a second QD key stored internally for QS communication with the QS network, the first communication channel is a first QS communication channel connecting the QS network with the first device using the first QD key, and the second communication channel is a second QS communication channel connecting the QS network with the second device using the second QD key.

[0059] Preferably, the first device has a first QD key from a set of QD keys stored internally for QS communication with the QS network, and the second device has a second QD key stored internally for QS communication with the QS network, and the method further includes establishing a first QS communication channel with the first device using the first QD key, receiving a request for QS communication with the second device from the first device, establishing a second QS communication channel with the second device using the second QD key, receiving a response from the second device to establish QS communication with the first device, allocating a QD key from the set of QD keys for QS communication between the first and second devices, and transmitting a third QD key to the first and second devices, respectively, via the established first and second QS channels for use in QS communication between the first and second devices.

[0060] Preferably, the method further includes registering the device for use with the QS network, wherein registering the device further includes connecting with the device via a direct wired connection with a QS server of the QS network, selecting an available QD key from a set of QD keys for use by the device, uploading the selected QD key to secure storage on the device via the direct wired connection, and storing and registering an association between the device and the available QD key in a repository of the QS network.

[0061] Preferably, the method further includes registering the user with the QS network, wherein registering the user further includes associating the user with a device registered with the QS network for use, and storing and registering the association between the user and the registered device in a repository of the QS network.

[0062] Preferably, the method further includes registering a first user with the QS network and associating the first user with the first device, and registering a second user with the QS network and associating the second user with the second device.

[0063] Preferably, the method further includes allocating a further QD key from the set of QD keys for use in QS communication between the first device and the second device, wherein the further QD key is stored in the QS repository as a QD key data item; generating a QREF locator associated with the QD key data item and an available QD key for encrypting the QD key data item; generating a QREF access token associated with the QD key data item based on the QREF locator; linking the QREF locator to the available QD key; associating the QREF locator with registrations of the first user and the second user to form a communication pair; storing the QD key data item encrypted with the available QD key together with the QREF locator in the QS repository; and transmitting the QREF access token to the first device and the second device for use in QS communication between the first device and the second device.

[0064] Preferably, the method further includes selecting an available QD key for forming a communication pair between the first and second devices, and storing the available QD key as a QD key data item for use when the first and second devices request QS communication between the first and second devices.

[0065] Preferably, the method includes, in response to storing a QD key data item associated with a communication pair between a first device and a second device, generating a quantum reference "QREF" locator based on user secrets of the first and second users and an available QD key selected from a set of QD keys for encrypting the QD key data item, the QREF locator indicating a location in a repository of the QD key data item encrypted with the selected QD key; and generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the QD key data item stored in the repository. The method further includes providing a QREF locator to the repository to store the QD key data item in the repository; transmitting a QREF access token to a first device of the first user and a second device of the second user; receiving a QREF access token from the first user or the second user in response to receiving a request to access the QD key data item from the repository by the first or second user; identifying a QREF locator based on the QREF access token and the identity of the first or second user; and providing the first or second user with access to the encrypted QD key data item in the repository in response to identifying the QREF locator.

[0066] Preferably, the method includes: establishing a first QS communication channel with a first device using a first QD key; receiving from the first device a QREF access token corresponding to a QD key data item associated with a communication pair between a first user and a second user; identifying a QREF locator associated with the QREF access token based on the communication pair between the first and second users; and providing access to the decrypted QD key data item of the repository via the first QS communication channel with the first device of the first user in response to identifying the QREF locator. establishing a second QS communication channel with a second device of a second user using the QD key; receiving from the second device a QREF access token corresponding to a QD key data item associated with the communication pair between the first user and the second user; identifying a QREF locator associated with the QREF access token based on the communication pair between the first and second users; and providing access to the decrypted QD key data item of the repository via the second QS communication channel with the second device of the second user in response to identifying the QREF locator.

[0067] In a fourth aspect, the disclosure provides a computer-implemented method for quantum-secure (QS) storage and retrieval in a QS network, the QS network comprising one or more QS servers and a repository for storing and retrieving one or more data items by a plurality of users, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the method performed by a user's endpoint device transmitting the data item for storage to the repository of the QS network, wherein in response to receiving the data item, the QS server generates a quantum reference "QREF" locator based on the user's user secret and an available QD key selected from the set of QD keys, the QREF locator and generating a QREF access token based on a QREF locator, the QREF access token indicating a location for storing a data item encrypted with a selected QD key in a repository and an identity of a user, the QREF access token enabling an access operation to be performed on the data item when stored in the repository; storing the data item in the repository indexed by the QREF locator; and transmitting the QREF access token to a user's endpoint device.

[0068] In a fifth aspect, the disclosure provides a computer-implemented method for quantum-secure (QS) storage and retrieval in a QS network, the QS network comprising one or more QS servers and a repository for storing and retrieving one or more data items by a plurality of users, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the method performed by a user's endpoint device receiving a QREF access token corresponding to a data item stored in the repository of the QS system, the QS server, in response to receiving the data item, generating a quantum reference (QREF) locator based on a user secret of the user submitting the data item and an available QD key selected from the set of QD keys, the QREF locator a QS server configured to receive a QREF access token corresponding to the data item stored in the repository and user credentials, the QS server being configured to identify the QREF access token and the user's identity in response to receiving the QREF item; and receiving access related to the data item stored in the QS system when the QS server identifies the QREF locator.

[0069] In a sixth aspect, the present disclosure provides an apparatus comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and wherein the apparatus is configured to implement a computer-implemented method according to any of the first, second, third, fourth, and / or fifth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0070] In a seventh aspect, the present disclosure provides a computer-readable medium comprising code or computer instructions stored therein which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to any of the first, second, third, fourth, and / or fifth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0071] In an eighth aspect, the present disclosure provides an endpoint device comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and wherein the apparatus is configured to implement a computer-implemented method according to any of the fourth and / or fifth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0072] In a ninth aspect, the present disclosure provides a computer-readable medium comprising code or computer instructions stored therein which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to any of the fourth and / or fifth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0073] In a tenth aspect, the present disclosure provides a QS system comprising a QS network comprising at least two QS servers as described in the sixth aspect, each of the QS servers comprising a hardware security module (HSM) having an identical set of quantum delivery "QD" keys stored therein; a plurality of users having endpoint devices as described in the eighth aspect; and a repository for storing and accessing data items associated with the users of the endpoint devices, wherein the QS servers communicate securely with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

[0074] In an eleventh aspect, the present disclosure provides a computer-implemented method for quantum secure (QS) communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers communicating securely with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys. and a computer-implemented method including: establishing a QS communication channel with a first device of a first user; receiving from the first device a QREF access token associated with a QD key selected from a set of QD keys, the QD key being for use in QS communication with a second device of a second user; retrieving from a repository the QD key selected from the set of QD keys based on the received QREF access token; and transmitting the retrieved QD key to the first and second devices for use in QS communication between the first and second devices.

[0075] In a twelfth aspect, the present disclosure provides a computer-implemented method of quantum secure (QS) communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: A computer-implemented method is provided, comprising: establishing a first communication channel; receiving a request from a first device to communicate with a second device of a second user via a QS network; establishing a second communication channel with the second device of the second user; receiving a response from the second device of the second user to connect with the first device of the first user; establishing a QS communication channel through the QS network based on an available QD key selected from a set of QD keys; and connecting the first device of the first user with the second device of the second user via a communication path including the first communication channel, the QS communication channel, and the second communication channel.

[0076] Preferably, the first device has a first QD key from a set of QD keys stored internally for QS communication with the QS network, the second device has a second QD key stored internally for QS communication with the QS network, the first communication channel is a first QS communication channel connecting the QS network with the first device using the first QD key, and the second communication channel is a second QS communication channel connecting the QS network with the second device using the second QD key.

[0077] Preferably, the first device has a first QD key from a set of QD keys stored internally for QS communication with the QS network, and the second device has a second QD key stored internally for QS communication with the QS network, and the method further includes establishing a first QS communication channel with the first device using the first QD key, receiving a request for QS communication with the second device from the first device, establishing a second QS communication channel with the second device using the second QD key, receiving a response from the second device to establish QS communication with the first device, allocating a QD key from the set of QD keys for QS communication between the first and second devices, and transmitting a third QD key to the first and second devices, respectively, via the established first and second QS channels for use in QS communication between the first and second devices.

[0078] Preferably, the method further includes registering the device for use with the QS network, wherein registering the device further includes connecting with the device via a direct wired connection with a QS server of the QS network, selecting an available QD key from a set of QD keys for use by the device, uploading the selected QD key to secure storage on the device via the direct wired connection, and storing and registering an association between the device and the available QD key in a repository of the QS network.

[0079] Preferably, the method further includes registering the user with the QS network, wherein registering the user further includes associating the user with a device registered with the QS network for use, and storing and registering the association between the user and the registered device in a repository of the QS network.

[0080] Preferably, the method further includes registering a first user with the QS network and associating the first user with the first device, and registering a second user with the QS network and associating the second user with the second device.

[0081] Preferably, the method further includes allocating a further QD key from the set of QD keys for use in QS communication between the first device and the second device, wherein the further QD key is stored in the QS repository as a QD key data item; generating a QREF locator associated with the QD key data item and an available QD key for encrypting the QD key data item; generating a QREF access token associated with the QD key data item based on the QREF locator; linking the QREF locator to the available QD key; associating the QREF locator with registrations of the first user and the second user to form a communication pair; storing the QD key data item encrypted with the available QD key together with the QREF locator in the QS repository; and transmitting the QREF access token to the first device and the second device for use in QS communication between the first device and the second device.

[0082] Preferably, the method further includes selecting an available QD key for forming a communication pair between the first and second devices, and storing the available QD key as a QD key data item for use when the first and second devices request QS communication between the first and second devices.

[0083] Preferably, the method includes, in response to storing a QD key data item associated with a communication pair between a first device and a second device, generating a quantum reference "QREF" locator based on user secrets of the first and second users and an available QD key selected from a set of QD keys for encrypting the QD key data item, the QREF locator indicating a location in a repository of the QD key data item encrypted with the selected QD key; and generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the QD key data item stored in the repository. The method further includes providing a QREF locator to the repository to store the QD key data item in the repository; transmitting a QREF access token to a first device of the first user and a second device of the second user; receiving a QREF access token from the first user or the second user in response to receiving a request to access the QD key data item from the repository by the first or second user; identifying a QREF locator based on the QREF access token and the identity of the first or second user; and providing the first or second user with access to the encrypted QD key data item in the repository in response to identifying the QREF locator.

[0084] Preferably, the method includes: establishing a first QS communication channel with a first device using a first QD key; receiving from the first device a QREF access token corresponding to a QD key data item associated with a communication pair between a first user and a second user; identifying a QREF locator associated with the QREF access token based on the communication pair between the first and second users; and providing access to the decrypted QD key data item of the repository via the first QS communication channel with the first device of the first user in response to identifying the QREF locator. establishing a second QS communication channel with a second device of a second user using the QD key; receiving from the second device a QREF access token corresponding to a QD key data item associated with the communication pair between the first user and the second user; identifying a QREF locator associated with the QREF access token based on the communication pair between the first and second users; and providing access to the decrypted QD key data item of the repository via the second QS communication channel with the second device of the second user in response to identifying the QREF locator.

[0085] In a thirteenth aspect, the present disclosure provides a computer-implemented method of quantum secure (QS) communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being performed by a first device, the method comprising: and transmitting a QREF access token associated with a QD key selected from a set of QD keys for use in QS communications with a second device of a second user; receiving a retrieved QD key from a QS server therebetween for use in QS communications with the second device; and establishing a third QS communication channel with the second device of the second user based on the received QD key, wherein before establishing the third QS communication channel, the second device receives the retrieved QD key by establishing a second QS communication channel with a second QS server of the QS network; and transmitting a QREF access token corresponding to the QD key.

[0086] In a fourteenth aspect, the present disclosure provides a computer-implemented method of quantum secure (QS) communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the method being performed by the first device and the second device. and establishing a first QS communication channel with a first QS server; transmitting a request to the first QS server to communicate with the second device of the second user; establishing a second communication channel with the second device of the second user; receiving a response from the second device of the second user to connect with the first device of the first user; establishing a QS communication channel through the QS network based on an available QD key selected from a set of QD keys; and communicating with the second device of the second user based on a communication path including the first communication channel, the QS communication channel through the QS network, and the second communication channel between the second device and the QS network.

[0087] In a fifteenth aspect, the present disclosure provides a computer-implemented method of quantum secure (QS) communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers performing quantum encryption based on one or more available QD keys from the set of QD keys. A computer-implemented method is provided for securely communicating with each other and with a repository using a QS network, the method being performed by a first device and including: establishing a first QS communication channel with a first QS server of a QS network; receiving a connection request from a second device of a second user from the first QS server; and, in response to accepting the connection request, communicating with the second device of the second user based on a communication path including the first communication channel, a QS communication channel through the QS network, and a second communication channel between the second device and the QS network.

[0088] Preferably, the thirteenth, fourteenth, and / or fifteenth aspects relate to a first device having a first QD key from a set of QD keys stored internally for QS communication with a QS network, a second device having a second QD key stored internally for QS communication with the QS network, the first communication channel being a first QS communication channel connecting the QS network with the first device using the first QD key, and the second communication channel being a second QS communication channel connecting the QS network with the second device using the second QD key.

[0089] Preferably, the first device has a first QD key from a set of QD keys stored internally for QS communication with the QS network, and the second device has a second QD key stored internally for QS communication with the QS network, and the method further includes establishing a first QS communication channel with a first QS server using the first QD key, transmitting a request for QS communication with the second device to the first QS server, and receiving a third QD key from the first QS server via the established first QS channel for use in QS communication with the second device, wherein the second device receives the third QD key from the second QS server via the established second QS channel in response to the request.

[0090] Preferably, the method further includes registering the user's device for use with the QS network, wherein registering the device further includes connecting the device to a QS server of the QS network via a direct wired connection, downloading available QD keys from the set of QD keys to secure storage on the device for use by the device in QS communications with the QS network, and registering an association between the device and the user for storage in a repository of the QS network.

[0091] Preferably, registering the user with the QS network, and registering the user further includes providing user credentials and a device identifier for the device to register the user and associated device for use with the QS network.

[0092] Preferably, the method further comprises receiving a QREF access token corresponding to a further QD key for use in QS communication between the first device and the second device, and the QS server allocates a further QD key from the set of QD keys for use in QS communication between the first device and the second device, the further QD key being stored in the QS repository as a QD key data item; generating a QREF locator associated with the QD key data item and an available QD key for encrypting the QD key data item; generating a QREF access token associated with a QD key data item based on the QREF locator; linking the QREF locator to an available QD key; associating the QREF locator with registrations of the first and second users to form a communication pair; storing the QD key data item encrypted with the available QD key together with the QREF locator in a QS repository; and transmitting the QREF access token to the first and second devices for use in QS communication between the first and second devices.

[0093] Preferably, the QS network is configured to select an available QD key for forming a communication pair between the first and second devices and store the available QD key as a QD key data item for use when the first and second devices request QS communication between the first and second devices, and the method further includes sending a request for QS communication with a second device of a second user, receiving a QD key for use in QS communication with the second device, and establishing QS communication with the second device based on the received QD key.

[0094] Preferably, the method further includes transmitting a QREF access token for accessing a QD key data item from the repository for use in QS communication between a first device of a first user and a second device of a second user; receiving access to the QD key data item, wherein the QD key data item includes data representing a QD key selected from a set of QD keys for use by the first and second devices in QS communication between the first and second devices; and establishing QS communication with the second device using the QD key, wherein the second device receives access to the QD key data item by transmitting a QREF access token for accessing the QD key data item.

[0095] Preferably, the method further includes establishing a first QS communication channel with a first QS server using the first QD key; transmitting to the first QS server a QREF access token corresponding to a QD key data item associated with a communication pair between the first user and the second user; receiving access to the decrypted QD key data item of the repository via the first QS communication channel with the first QS server in response to the first QS server identifying a QREF locator associated with the QREF access token; and establishing a QS communication channel with a second device of the second user using the decrypted QD key, wherein the second device of the second user receives access to the decrypted QD key data item of the repository via a second QS communication channel with the second QS server in response to the first QS server identifying a QREF locator associated with the QREF access token.

[0096] In a sixteenth aspect, the present disclosure provides an apparatus comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and wherein the apparatus is configured to implement a computer-implemented method according to any of the eleventh and / or twelfth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0097] In a seventeenth aspect, the present disclosure provides a computer-readable medium comprising code or computer instructions stored therein, which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to any of the eleventh and / or twelfth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0098] In an eighteenth aspect, the present disclosure provides an endpoint device comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and wherein the apparatus is configured to implement a computer-implemented method according to any of the thirteenth, fourteenth, and / or fifteenth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0099] In a nineteenth aspect, the present disclosure provides a computer-readable medium comprising code or computer instructions stored therein, which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to any of the eleventh, twelfth, thirteenth, fourteenth, and / or fifteenth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0100] In a twentieth aspect, the present disclosure provides a QS system, a QS network comprising at least two QS servers according to the apparatus of the sixteenth aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein, wherein each of the QS servers comprises a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein; and a plurality of endpoint devices according to the eighteenth aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein, and a repository for storing and accessing data items associated with users of the endpoint devices, wherein the QS servers securely communicate with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

[0101] In a twenty-first aspect, the present disclosure provides a computer-implemented method of quantum secure (QS) communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the first device having a first QD key from the set of QD keys stored therein, and the second device having a first QD key from the set of QD keys stored therein. and a second QD key from a set of QD keys, the method including: establishing a first QS communication channel with a first device using the first QD key; receiving from the first device a request for QS communication with the second device; establishing a second QS communication channel with the second device using the second QD key; receiving from the second device a response to establish QS communication with the first device; allocating a third QD key from the set of QD keys for QS communication between the first and second devices; and transmitting the third QD key to the first and second devices via the established first and second QS channels, respectively, for use in QS communication between the first and second devices.

[0102] Preferably, the method further includes registering the device for use with the QS network, wherein registering the device further includes connecting with the device via a direct wired connection with a QS server of the QS network, selecting an available QD key from a set of QD keys for use by the device, uploading the selected QD key to secure storage of the device via the direct wired connection, and storing and registering an association between the device and the selected available QD key in a repository of the QS network.

[0103] Preferably, the method further includes registering the user with the QS network, wherein registering the user further includes associating the user with a device registered with the QS network for use, and storing and registering the association between the user and the registered device in a repository of the QS network.

[0104] Preferably, the method further includes registering a first user with the QS network and associating the first user with the first device, and registering a second user with the QS network and associating the second user with the second device.

[0105] In a twenty-second aspect, the present disclosure provides a computer-implemented method for quantum secure (QS) transaction or message signing using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the method comprising receiving from a user's device a transaction or message requiring application of a digital signature associated with the user, and receiving from the user's device a transaction or message requiring application of a digital signature associated with the user, the transaction or message being signed by the user, the message being stored in the repository, and the message being signed by the user. receiving a QREF access token associated with a system, the data item being associated with a signing key for use in digitally signing a received transaction or message; identifying a QREF locator based on the QREF access token and input data from a user; retrieving the data item from a repository in response to identifying the QREF locator, the data item being decrypted using a QD key corresponding to the QREF locator; digitally signing the received transaction or message using a digital signature algorithm based on the retrieved data item; and transmitting the digitally signed transaction or message.

[0106] Preferably, the method further includes generating a quantum reference "QREF" locator based on input data associated with the data item for storage and an available QD key selected from a set of QD keys, wherein the data item is associated with a signing key from the set of signing keys and the generated QREF locator is unique, and transmitting the QREF locator to a repository along with the data item encrypted with the available QD key.

[0107] Preferably, the method further includes generating a QREF access token for accessing the data item based on the QREF locator using a non-reversible function, process, or operation, wherein the QREF access token is unique, and transmitting the QREF access token to the user's device.

[0108] Preferably, the method comprises receiving a set of signing keys associated with a user of the endpoint device; and for each key in the set of signing keys, generating a QREF locator based on user data of the user and an available QD key from the set of QD keys, wherein the set of QREF locators is generated corresponding to the set of signing keys; linking each QREF locator in the set of QREF locators to a corresponding available QD key from the set of QD keys; and for each QREF locator in the set of QREF locators, generating a QREF access token based on the respective QREF locator, wherein the access token is stored in a secure location. The method further includes generating a set of QREF access tokens, wherein a set of QREF locators is generated corresponding to a set of signing keys; for each QREF locator in the set of QREF locators, sending the respective QREF locator and an encrypted data item to a repository for storage, the encrypted data item representing a key from the set of signing keys corresponding to the respective QREF locator and including a data item encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; and sending a set of QREF access tokens to a device of the user associated with the set of signing keys.

[0109] Preferably, receiving a set of signing keys associated with a user of the endpoint device further includes generating the set of signing keys associated with the user based on one or more available QD keys from the set of QD keys.

[0110] Preferably, the method further comprises sending the digitally signed transaction or the digitally signed message to the user's device.

[0111] Preferably, the method further comprises sending the digitally signed transaction or the digitally signed message to another device of another user that is a counterparty to the transaction or that is addressed to receive the digitally signed message, and the request is for the transaction to be signed.

[0112] Preferably, the method further comprises transmitting the digitally signed transaction or the digitally signed message to a system configured to process and / or store the digitally signed transaction or the digitally signed message on behalf of the user's device.

[0113] Preferably, the method further comprises sending the digitally signed transaction or the digitally signed message to a DLT system configured to process and / or store the digitally signed transaction or the digitally signed message on behalf of the user's device.

[0114] Preferably, the system comprises a system or service based on at least one from the group of distributed ledger technology, shared ledger technology, and blockchain technology.

[0115] Preferably, the system or service comprises a system or service that uses a consensus method or process to verify whether one or more digitally signed transactions are stored on a distributed ledger, shared ledger, and / or blockchain associated with the system or service.

[0116] Preferably, the method performed by the QS server of the QS network further comprises performing QS storage and / or access of data items according to any of the first, second, third, fourth and / or fifth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof and / or based on a computer-implemented method as described herein, wherein the data items correspond to one or more signature keys.

[0117] Preferably, the method further includes registering permissions for one or more users to access the data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys stored in the repository.

[0118] Preferably, the method further includes transmitting one or more QREF access tokens to devices associated with one or more users.

[0119] Preferably, the method further includes transmitting the set of signing keys via a QS network to one or more load-balanced, geographically located HSMs, where the set of signing keys is stored in a repository accessible by the HSMs via the QS network, and sending a corresponding QREF access token associated with the set of signing keys to one or more devices of users who have permission to use the QREF access token.

[0120] Preferably, the set of signing keys is a set of master keys or secrets associated with two or more systems requiring interoperability, and the method further includes registering authorization for one or more devices or apparatuses of the two or more systems to access data items based on one or more QREF access tokens corresponding to one or more data items representing the one or more master keys or secrets stored in the repository.

[0121] Preferably, the method further comprises sending one or more QREF access tokens to the device.

[0122] Preferably, the set of signing keys is a set of master keys, and the method further comprises registering authorization for one or more users to access the data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys stored in the repository.

[0123] Preferably, the method further includes transmitting one or more QREF access tokens to devices associated with one or more users.

[0124] Preferably, the method further includes transmitting the set of master keys to one or more load-balanced, geographically located HSMs via a QS network, where the set of master keys is stored in a repository accessible by the HSMs via the QS network, and sending a corresponding QREF access token associated with the set of master keys to one or more devices of users who have permission to use the QREF access token.

[0125] In a twenty-third aspect, the present disclosure provides a computer-implemented method for quantum secure (QS) transaction or message signing using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, and a method performed by a user's device for signing a transaction or message that requires applying a digital signature associated with the user. a digital signature algorithm based on the data item; transmitting the digitally signed transaction or message; and a QREF access token associated with a data item stored in a repository, the data item including a signing key for use in digitally signing the transaction or message; receiving a digitally signed transaction or message including a transaction or message digitally signed using a digital signature algorithm based on the data item; transmitting the digitally signed transaction or message for further processing or storage; and indicating to a user of the device that the QREF access token was used.

[0126] Preferably, the digitally signed transaction or digitally signed message corresponds to a transaction or message processed by a QS server of the QS network configured to identify a QREF locator based on a QREF access token and input data from a user, and the QS server is configured to, in response to identifying the QREF locator, retrieve a data item from a repository, where the data item is decrypted using a QD key corresponding to the QREF locator, digitally sign the received transaction or message using a digital signature algorithm based on the retrieved data item, and transmit the digitally signed transaction or digitally signed message.

[0127] Preferably, the method further includes transmitting a set of signing keys associated with a user of the endpoint device, and receiving a set of QREF access tokens associated with the set of signing keys.

[0128] Preferably, the method further includes transmitting a request for a set of signing keys associated with a user of the endpoint device; and receiving a set of QREF access tokens associated with the generated set of signing keys, wherein the set of generated signing keys is stored in encrypted form in a repository, each key in the set of signing keys is linked to a QREF locator corresponding to a QREF access token in the set of QREF access tokens, and the QREF access tokens are generated by a non-reversible operation or function based on the QREF locator.

[0129] Preferably, the set of generated signing keys is generated by an HSM based on one or more available QD keys from the set of QD keys.

[0130] Preferably, the QS server is configured to generate a set of QREF access tokens, and the QS server generates, for each key in the set of signing keys, a QREF locator based on user data of the user and an available QD key from the set of QD keys, where the set of QREF locators is generated corresponding to the set of signing keys; links each QREF locator in the set of QREF locators to a corresponding available QD key from the set of QD keys; and generates, for each QREF locator in the set of QREF locators, a QREF access token based on the respective QREF locator, where the set of QREF access tokens is generated corresponding to the set of signing keys. The system is configured to: generate, for each QREF locator in the set of QREF locators, a set of signature keys corresponding to the set of signature keys; send, for each QREF locator in the set of QREF locators, the respective QREF locator and an encrypted data item to a repository for storage, the encrypted data item representing a key from the set of signature keys corresponding to the respective QREF locator and including a data item encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; and send, to a device associated with the user, a set of QREF access tokens associated with the set of signature keys.

[0131] Preferably, the method further comprises receiving the digitally signed transaction or the digitally signed message at the user's device.

[0132] Preferably, the method further comprises sending the digitally signed transaction or the digitally signed message to another device of another user that is a counterparty to the transaction or that is addressed to receive the digitally signed message, and the request is for the transaction to be signed.

[0133] Preferably, the method further comprises transmitting the digitally signed transaction or the digitally signed message to a system configured to process and / or store the digitally signed transaction or the digitally signed message on behalf of the user's device.

[0134] Preferably, the method further comprises sending the digitally signed transaction or the digitally signed message to a DLT system configured to process and / or store the digitally signed transaction or the digitally signed message on behalf of the user's device.

[0135] Preferably, the system comprises a system or service based on at least one from the group of distributed ledger technology, shared ledger technology, and blockchain technology.

[0136] Preferably, the method comprises performing quantum secure communication with a QS server or another device or system according to any of the eleventh, twelfth, thirteenth, fourteenth and / or fifteenth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or based on a computer-implemented method as described herein.

[0137] Preferably, the method is performed by a client DLT application running on a user's device, the client application being configured to sign DLT transactions and send the signed DLT to the DLT system.

[0138] In a twenty-fourth aspect, the present disclosure provides an apparatus comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and wherein the apparatus is configured to implement a computer-implemented method according to any of the twenty-second and / or twenty-third aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0139] In a twenty-fifth aspect, the present disclosure provides a computer-readable medium comprising code or computer instructions stored therein, which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to any of the twenty-second and / or twenty-third aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0140] In a twenty-sixth aspect, the present disclosure provides an endpoint device comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and wherein the endpoint device or apparatus is configured to implement a computer-implemented method according to any of the twenty-third aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0141] Preferably, the endpoint device further comprises a secure enclave for implementing a computer-implemented method according to any of the twenty-second and / or twenty-third aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0142] In a twenty-seventh aspect, the present disclosure provides a computer-readable medium comprising code or computer instructions stored therein, which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to any of the twenty-second and / or twenty-third aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0143] In a 28th aspect, the present disclosure provides a QS system, a QS network comprising at least two QS servers according to the apparatus of the 24th aspect, one or more features herein, combinations thereof, modifications thereof, and / or as described herein, each of the QS servers comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein; and a plurality of endpoint devices according to the 26th aspect, one or more features herein, combinations thereof, modifications thereof, and / or as described herein; and a repository for storing and accessing data items associated with users of the endpoint devices, wherein the QS servers securely communicate with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

[0144] In a twenty-ninth aspect, the present disclosure provides a computer-implemented method for quantum-secure (QS) cryptographic processing of a data item, transaction, or message using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the method comprising: receiving a data item, transaction, or message requiring cryptographic processing associated with a user or system; and transmitting a QREF access token associated with the data item stored in the repository. a QREF access token and input data from a user or system; retrieving a data item from a repository in response to identifying the QREF locator, wherein the data item is decrypted using a QD key corresponding to the QREF locator; and processing the received data item, transaction, or message using one or more cryptographic operations based on the retrieved data item; and transmitting the cryptographically processed data item, transaction, or message.

[0145] Preferably, the method further includes generating a quantum reference (QREF) locator based on input data associated with the data item for storage and an available QD key selected from a set of QD keys, wherein the data item is associated with a cryptographic key from the set of cryptographic keys and the generated QREF locator is unique, and transmitting the QREF locator to a repository together with the data item encrypted with the available QD key.

[0146] Preferably, the method further includes generating a QREF access token for accessing the data item based on the QREF locator using a non-reversible function, process, or operation, wherein the QREF access token is unique, and transmitting the QREF access token to the user's device.

[0147] Preferably, the method comprises receiving a set of cryptographic keys associated with a system or a user of an endpoint device, and for each key in the set of cryptographic keys, generating a QREF locator based on system data of the system or user data of the user and an available QD key from the set of QD keys, wherein the set of QREF locators is generated corresponding to the set of cryptographic keys; linking each QREF locator in the set of QREF locators to a corresponding available QD key from the set of QD keys; and generating, for each QREF locator in the set of QREF locators, a QREF access token based on the respective QREF locator, wherein the QREF access token is generated corresponding to the set of cryptographic keys. The method further includes generating a set of access tokens corresponding to the set of encryption keys, generating a set of access tokens corresponding to the set of encryption keys, and for each QREF locator in the set of QREF locators, sending the respective QREF locator and an encrypted data item to a repository for storage, the encrypted data item representing a key from the set of encryption keys corresponding to the respective QREF locator and including a data item encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored, and sending the set of QREF access tokens to a system or a user device associated with the set of encryption keys.

[0148] Preferably, receiving a set of encryption keys associated with the system or a user of the endpoint device further includes generating a set of encryption keys associated with the system or user based on one or more available QD keys from the set of QD keys.

[0149] Preferably, the method further comprises transmitting the cryptographically processed transaction or cryptographically signed message to the system or to a user's device.

[0150] Preferably, the method further comprises transmitting the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message to another system or another device of another user that is a counterparty to the transaction or that is addressed to receive the cryptographically processed message.

[0151] Preferably, the method further comprises transmitting the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message to the system or another system configured to use, process and / or store the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message.

[0152] Preferably, the method further comprises transmitting the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message to a DLT system configured to use, process and / or store the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message on behalf of the user's device.

[0153] Preferably, the system comprises a system or service based on at least one from the group of distributed ledger technology, shared ledger technology, and blockchain technology.

[0154] Preferably, the system or the other system is configured to use an agreement method or process to verify whether one or more cryptographically processed data items, cryptographically processed transactions, or cryptographically processed messages are stored in a distributed ledger, shared ledger, or blockchain associated with the system or the other system.

[0155] Preferably, the method performed by the QS server of the QS network further comprises performing QS storage and / or access of data items according to any of the first, second, third, fourth and / or fifth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof and / or based on a computer-implemented method as described herein, wherein the data items correspond to one or more signature keys.

[0156] Preferably, the cryptographic operations include one or more cryptographic operations from the group of encryption, digital signature, decryption, authentication, hashing, and authenticated encryption.

[0157] Preferably, the cryptographic keys include one or more cryptographic keys for use with said one or more cryptographic operations.

[0158] Preferably, the set of cryptographic keys is a set of cryptographic signing keys associated with the system or user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more digital signature cryptographic operations or algorithms associated with digitally signing one or more data items, transactions or messages using a signing key associated with the QREF access token, and the set of cryptographic keys is a set of signing keys.

[0159] Preferably, the method further includes registering permissions for one or more systems or one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys of the set of signing keys stored in the repository.

[0160] Preferably, the method further includes transmitting one or more QREF access tokens to one or more systems or one or more devices associated with one or more users.

[0161] Preferably, the method further includes transmitting the set of signing keys via a QS network to one or more load-balanced, geographically-located HSMs, where the set of signing keys is stored in a repository accessible by the HSMs via the QS network, and sending a corresponding QREF access token associated with the set of signing keys, along with authorization to use the QREF access token, to one or more systems or one or more devices of users located in association with the geographically-located HSMs.

[0162] Preferably, the set of signing keys is a set of master keys or secrets associated with two or more systems requiring interoperability, and the method further includes registering authorization for the two or more systems to access the data items based on one or more QREF access tokens corresponding to the one or more data items representing the one or more master keys or secrets stored in the repository for use in cryptographic operations on one or more received data items, received transactions, or messages that enable interoperability between the two or more systems.

[0163] Preferably, the method further includes transmitting one or more QREF access tokens to two or more systems and / or devices of users associated with the two or more systems.

[0164] Preferably, the set of cryptographic keys is a set of master keys, and the method further includes registering authorization for one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more master keys stored in the repository, for use in a cryptographic operation on one or more received data items, received transactions, or messages using the one or more master keys corresponding to the one or more QREF access tokens.

[0165] Preferably, the method further includes transmitting one or more QREF access tokens to devices or systems associated with one or more users.

[0166] Preferably, the set of master keys is a set of master hierarchical deterministic (HD) keys, and further includes sending one or more QREF access tokens to devices or systems associated with one or more users.

[0167] Preferably, the set of cryptographic keys includes a set of cryptographic keys associated with the system or user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more cryptographic operations or algorithms associated with encrypting one or more data items, transactions, or messages using a cryptographic key corresponding to the QREF access token.

[0168] Preferably, the set of cryptographic keys includes a set of decryption cryptographic keys associated with the system or user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more decryption cryptographic operations or algorithms associated with decrypting one or more encrypted data items, encrypted transactions, or encrypted messages using the decryption cryptographic key corresponding to the QREF access token.

[0169] Preferably, the one or more data items include data representing a set of data that needs to be backed up and / or archived, and the set of cryptographic keys includes a set of cryptographic keys associated with a system or user for use with the one or more cryptographic operations to encrypt the one or more data items.

[0170] In a thirtieth aspect, the present disclosure provides a computer-implemented method for quantum-secure (QS) cryptographic processing of data items, transactions, or messages using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein, the QS servers securely communicating with each other and with the repository using quantum cryptography based on one or more available QD keys from the set of QD keys, the method requiring cryptographic processing associated with a user or system. a cryptographically processed data item, transaction, or message that is cryptographically processed using one or more cryptographic operations based on the other data item; transmitting data representing the received data item, transaction, or message and a QREF access token associated with another data item stored in a repository, the other data item including a cryptographic key for use in cryptographically processing the received data item, transaction, or message; and receiving a cryptographically processed data item, transaction, or message that is cryptographically processed using one or more cryptographic operations based on the other data item.

[0171] Preferably, the method further comprises transmitting the cryptographically processed data item, transaction, or message to a user having a system or device for further processing or storage.

[0172] Preferably, the cryptographically processed data item, transaction, or message corresponds to a transaction or message cryptographically processed by a QS server of the QS network, the QS server being configured to identify a QREF locator based on the QREF access token and input data from the user, and the QS server being configured to, in response to identifying the QREF locator, read another data item from the repository, where the read data item is decrypted using a QD key corresponding to the QREF locator; process the received data item, transaction, or message using one or more cryptographic operations based on the read data item; and transmit the cryptographically processed data item, cryptographically processed transaction, or cryptographically processed message.

[0173] Preferably, the method further includes transmitting a set of signing keys associated with the system or a user of the endpoint device, and receiving a set of QREF access tokens associated with the set of encryption keys.

[0174] Preferably, the method further includes transmitting a request for a set of cryptographic keys associated with the system, or a user of the endpoint device, and receiving a set of QREF access tokens associated with the generated set of cryptographic keys, wherein the generated set of cryptographic keys is stored in encrypted form in a repository, each key in the set of cryptographic keys is linked to a QREF locator corresponding to a QREF access token in the set of QREF access tokens, and the QREF access tokens are generated by a non-reversible operation or function based on the QREF locator.

[0175] Preferably, the set of generated cryptographic keys is generated by an HSM based on one or more available QD keys from the set of QD keys.

[0176] Preferably, the QS server is configured to generate a set of QREF access tokens, and the QS server generates, for each key in the set of encryption keys, a QREF locator based on user data of the user and an available QD key from the set of QD keys, wherein the set of QREF locators is generated corresponding to the set of encryption keys; links each QREF locator in the set of QREF locators to a corresponding available QD key from the set of QD keys; and generates, for each QREF locator in the set of QREF locators, a QREF access token based on the respective QREF locator, wherein the set of QREF access tokens is generated corresponding to the set of encryption keys. and for each QREF locator in the set of QREF locators, transmitting the respective QREF locator and an encrypted data item to a repository for storage, the encrypted data item representing a key from a set of encryption keys corresponding to the respective QREF locator and including a data item encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; and transmitting a set of QREF access tokens associated with the set of encryption keys to a system or a device associated with the user.

[0177] Preferably, the method further comprises receiving, at the user's device, the cryptographically processed data item, transaction or message.

[0178] Preferably, the method further comprises transmitting the cryptographically processed data item, transaction or message to one or more of the following groups: another system for processing or storage, another user's device with which the transaction is made, another user's device or system addressed to receive the cryptographically processed data item, transaction or message.

[0179] Preferably, the method further comprises transmitting the cryptographically processed data item, transaction or message to a system configured to process and / or store the cryptographically processed data item, transaction or message.

[0180] Preferably, the method further comprises transmitting the cryptographically processed data item, transaction or message to a DLT system configured to process and / or store the cryptographically processed data item, transaction or message.

[0181] Preferably, the system or another system comprises a system or service based on at least one from the group of distributed ledger technology, shared ledger technology, and blockchain technology.

[0182] Preferably, the method comprises performing quantum secure communication with a QS server or another device or system according to any of the eleventh, twelfth, thirteenth, fourteenth and / or fifteenth aspects, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or based on a computer-implemented method as described herein.

[0183] Preferably, the method is performed by a client DLT application running on a user's device, the client application being configured to sign DLT transactions and send the signed DLT to the DLT system.

[0184] Preferably, the set of cryptographic keys is a set of cryptographic signing keys associated with the system or user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more digital signature cryptographic operations or algorithms associated with digitally signing one or more data items, transactions or messages using a signing key associated with the QREF access token.

[0185] Preferably, the method further includes registering permissions for one or more systems or one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys of the set of signing keys stored in the repository.

[0186] Preferably, the method further includes transmitting one or more QREF access tokens to one or more systems or one or more devices associated with one or more users.

[0187] Preferably, the QS server is configured to transmit the set of signing keys to one or more load-balanced, geographically-located HSMs via the QS network, and the set of signing keys is stored in a repository accessible by the HSMs via the QS network, and the method includes receiving the set of signing keys for one or more systems or corresponding QREF access tokens associated with one or more devices of the user located in association with the geographically-located HSMs, along with authorization to use the QREF access token.

[0188] Preferably, the set of signing keys is a set of master keys or secrets associated with two or more systems requiring interoperability, and the method further includes registering authorization for the two or more systems to access the data items based on one or more QREF access tokens corresponding to one or more data items representing one or more master keys or secrets stored in the repository for use in cryptographic operations on one or more received data items, received transactions, or messages that enable interoperability between the two or more systems.

[0189] Preferably, the method further includes receiving one or more QREF access tokens at the two or more systems and / or at devices of users associated with the two or more systems.

[0190] Preferably, the set of cryptographic keys is a set of master keys, and the method further includes registering authorization for the system or one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more master keys stored in the repository, for use in a cryptographic operation on one or more received data items, received transactions, or messages using one or more master keys corresponding to the one or more QREF access tokens.

[0191] Preferably, the method further includes receiving, at the system or at a device or system associated with one or more users, one or more QREF access tokens.

[0192] Preferably, the set of master keys is a set of master hierarchical deterministic (HD) keys, and further includes sending one or more QREF access tokens to devices or systems associated with one or more users.

[0193] Preferably, the set of cryptographic keys includes a set of cryptographic keys associated with the system or user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more cryptographic operations or algorithms associated with encrypting one or more data items, transactions, or messages using a cryptographic key corresponding to the QREF access token.

[0194] Preferably, the set of cryptographic keys includes a set of decryption cryptographic keys associated with the system or user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more decryption cryptographic operations or algorithms associated with decrypting one or more encrypted data items, encrypted transactions, or encrypted messages using the decryption cryptographic key corresponding to the QREF access token.

[0195] Preferably, the method further includes transmitting one or more data items including data representing a set of data that needs to be backed up and / or archived, and the set of cryptographic keys includes a set of cryptographic keys associated with the system or user for use with the one or more cryptographic operations to encrypt the one or more data items.

[0196] In a thirty-first aspect, the present disclosure provides an apparatus comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and the apparatus is configured to implement a computer-implemented method according to the twenty-ninth aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0197] In a thirty-second aspect, the present disclosure provides a computer-readable medium including code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer-implemented method according to the twenty-ninth aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0198] In a thirty-third aspect, the present disclosure provides an endpoint device comprising a processor unit, a memory unit, and a communication interface, wherein the processor unit is connected to the memory unit and the communication unit, and the apparatus is configured to implement a computer-implemented method according to the thirtieth aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0199] Preferably, the endpoint device further comprises a secure enclave for implementing a computer-implemented method according to the 30th aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0200] In a thirty-fourth aspect, the present disclosure provides a computer-readable medium including code or computer instructions stored therein, which, when executed by a processor unit, causes the processor unit to perform a computer-implemented method according to the thirtieth aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein.

[0201] In a thirty-fifth aspect, the present disclosure provides a QS system, a QS network comprising at least two QS servers according to the apparatus of the thirty-first aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein, wherein each of the QS servers comprises a hardware security module (HSM) having an identical set of quantum distribution (QD) keys stored therein; and a plurality of endpoint devices according to the thirty-third aspect, one or more features thereof, one or more features herein, combinations thereof, modifications thereof, and / or as described herein, and a repository for storing and accessing data items associated with users of the endpoint devices, wherein the QS servers securely communicate with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

[0202] The methods described herein may be performed by software in machine-readable form on a tangible storage medium, for example, in the form of a computer program comprising computer program code means adapted to perform all of the steps of the methods described herein when the program is run on a computer and the computer program is embodied on a computer-readable medium. Examples of tangible (or non-transitory) storage media include disks, thumb drives, memory cards, etc., but do not include propagated signals. The software may be suitable for execution on a parallel or serial processor, such that the steps of the methods may be performed in any suitable order, or simultaneously.

[0203] This application recognizes that firmware and software may have value and be separately tradable commodities. It is intended to encompass software that runs on or controls "dumb" or standard hardware to perform a desired function. It is also intended to encompass software that "describes" or defines the configuration of hardware to perform a desired function, such as HDL (Hardware Description Language) software used to design silicon chips or configure universal programmable chips.

[0204] The preferred features may be combined as appropriate and combined with any aspect of the present invention, as will be apparent to one skilled in the art.

[0205] Embodiments of the present invention will now be described, by way of example, with reference to the following drawings, in which: [Brief explanation of the drawings]

[0206] [Figure 1a] 1 is a schematic diagram illustrating an exemplary quantum safe (QS) system in accordance with the present invention. [Figure 1b] 4 is a flow diagram illustrating an exemplary process for storing a data item in a QS system in accordance with the present invention. [Figure 1c]10 is a flow diagram illustrating another exemplary process for storing data items in a QS system according to the present invention. [Figure 1d] 4 is a flow diagram illustrating an exemplary process for accessing data items stored in a QS system in accordance with the present invention. [Figure 1e] 10 is a flow diagram illustrating another exemplary process for accessing a data item in a QS system according to the present invention. [Figure 1f] 1b is a flow diagram illustrating an exemplary process for storing data items using the QS system of FIG. 1a in accordance with the present invention. [Figure 1g] 1b is a flow diagram illustrating an exemplary process for accessing a data item using the QS system of FIG. 1a in accordance with the present invention. [Figure 1h] FIG. 10 is another schematic diagram illustrating another exemplary QS system according to the present invention. [Figure 1i] FIG. 2 is another schematic diagram illustrating a preferred exemplary QS system using satellite quantum key distribution (SQKD) in accordance with the present invention. [Figure 1j] FIG. 1 is another schematic diagram illustrating the exemplary QS system of FIGS. 1a-1i using SQKD and configured with a registration server and nodes according to the present invention. [Figure 1k] FIG. 1 is another schematic diagram illustrating another preferred exemplary QS system of FIGS. 1a-1j using SQKD and configured with a registration server and nodes according to the present invention. [Figure 1l] FIG. 2 is a further schematic diagram illustrating an exemplary preferred QS system using terrestrial quantum key distribution in accordance with the present invention. [Figure 2a] FIG. 1 is a schematic diagram illustrating a quantum reference locator engine for use in the QS system illustrated in FIGS. 1a-1l, in accordance with the present invention. [Figure 2b] FIG. 1 is a schematic diagram illustrating a QREF access token engine for use in the QS system illustrated in FIGS. 1a-1l in accordance with the present invention. [Figure 2c]1 is a flow diagram illustrating a process for accessing a data item using a QREF access token in the QS system illustrated in FIGS. 1a-1l in accordance with the present invention. [Figure 3a] FIG. 1 is a flow diagram illustrating a process for storing and retrieving data items using the exemplary QS system illustrated in FIGS. 1a-1l when configured with distributed ledger technology (DLT) in accordance with the present invention. [Figure 3b] 1c is a flow diagram illustrating the process of a web certification service using the preferred exemplary QS system of FIG. 1e in accordance with the present invention. [Figure 3c] 1c is a flow chart illustrating a process of KYC service using the preferred exemplary QS system of FIG. 1e in accordance with the present invention. [Figure 4a] 1c is a flow chart illustrating the process of another exemplary data storage and retrieval service using the preferred exemplary QS system of FIG. 1e in accordance with the present invention. [Figure 4b] 1c is a flow diagram illustrating the process of another exemplary Web certification service using the preferred exemplary QS system of FIG. 1e in accordance with the present invention. [Figure 5a] FIG. 1 is a schematic diagram illustrating an example of quantum-safe endpoint communication using a QS system according to the present invention. [Figure 5b] 4 is a flow diagram illustrating an exemplary QS communication endpoint registration process using the QS system according to the present invention. [Figure 5c] 1 is a flow diagram illustrating an exemplary endpoint registration process for QS communications using a QS system in accordance with the present invention. [Figure 5d] 1 is a flow diagram illustrating an exemplary user registration process for QS communications using a registered endpoint-based QS system in accordance with the present invention. [Figure 5e] 1 is a flow diagram illustrating an exemplary QS communication setup process between at least two devices using a QS system in accordance with the present invention. [Figure 5f]10 is a flow diagram illustrating another exemplary QS communication setup process between at least two devices using a QS system in accordance with the present invention. [Figure 5g] 5 is a flow diagram illustrating an exemplary QS key assignment process 550 for use in establishing a QS communication channel between at least two endpoint devices in accordance with the present invention. [Figure 5h] 5g is a flow diagram illustrating a QD key update process after an additional QD key is assigned during the process of FIG. 5g in accordance with the present invention. [Figure 5i] 4 is a signal flow diagram illustrating an exemplary QS communication establishment process in accordance with the present invention. [Figure 5j] FIG. 10 is a signal flow diagram illustrating another exemplary QS communication establishment process according to the present invention. [Figure 6a] 1 is a flow diagram illustrating an exemplary QS key agreement / transaction signing process using a QS system in accordance with the present invention. [Figure 6b] 10 is another flow diagram illustrating another exemplary QS key agreement / transaction signing process using a QS system in accordance with the present invention. [Figure 6c] 10 is a further flow diagram illustrating a further exemplary QS key agreement / transaction signing DLT process using a QS system in accordance with the present invention. [Figure 6d] 4 is a flow diagram illustrating an exemplary QS encryption process for performing QS encryption of a data item in accordance with the present invention. [Figure 7a] 1 is a schematic diagram of a computing device according to the present invention; [Figure 7b] FIG. 2 is a schematic diagram of another exemplary QS system according to the present invention.

[0207] Common reference numbers are used throughout the drawings to denote like features. DETAILED DESCRIPTION OF THE INVENTION

[0208] Embodiments of the present invention are described below by way of example only. These examples are not the only ways in which the invention can be achieved, but represent the best ways of practicing the invention currently known to the applicant. The specification describes the functions of the examples and the sequence of steps for constructing and operating the examples. However, the same or equivalent functions and arrangements may be achieved by different examples.

[0209] The present disclosure provides methods, apparatus, and systems for quantum-secure (QS) storage, retrieval, access, use, or application of data items or data, and QS and / or quantum-safe communication using a QS system, the QS system comprising a quantum key distribution layer and a transaction layer, the transaction layer being separated from the key distribution layer. The transaction layer includes multiple QS servers / nodes and one or more repositories and / or ledgers, etc. that store, manage, retrieve, and / or use data items, and / or sets up one or more QS communication channels, etc., and the QS servers / nodes (referred to herein as QS servers) communicate with each other in a quantum-secure manner. Each QS server includes a set of identical securely stored quantum distribution (QD) keys, which are used by the QS servers to communicate with each other and with the repositories and / or ledgers, etc., in a quantum-secure manner. The key distribution layer includes multiple quantum key distribution (QKD) sources, each distributing an identical set of quantum key distribution (QKD) keys to each QS server using a group quantum key distribution (QKD) or multicast QKD protocol in a quantum-safe manner. A QKD key or quantum key may include or represent data representing keys and / or encryption keys distributed from a QKD source using a QKD protocol in a quantum-safe manner. A quantum-safe (QS) communication channel or QS channel may include or represent an encrypted communication channel encrypted by one or more QD keys such that the encrypted communication channel is quantum safe.

[0210] One or more of the QS servers include components configured to perform and / or control user registration, storage, retrieval, access, and / or use or application of data items, and / or QS communications between endpoints, such as, but not limited to, devices, servers, or users and / or customers. Users of endpoint devices, servers, communication devices may connect with and / or register with the QS system through one or more QS servers to register, store, retrieve, access, or use applications associated with data items stored in repositories and / or ledgers, and / or to establish QS communication channels with the QS network and / or other devices of users registered on the QS network, and / or at the request of applications. Additionally or alternatively, for example, but not by way of limitation, users of endpoint devices, servers, communication devices may be configured to connect with and / or register with the QS system via one or more QS servers in order to register, store, retrieve, access, use applications associated with data items stored in the repository and / or ledger, and / or to establish QS communication channels with the QS network and / or other devices registered with the QS network, etc., and / or as required by applications.

[0211] The one or more repositories or repository storage systems may include or represent any type of storage system or platform for storing and / or accessing data items stored therein. The storage system or platform may be based on, for example, but not limited to, distributed storage technologies, centralized storage technologies, and / or both, depending on the requirements of the application. Examples of repositories, storage systems, and / or platforms described herein in accordance with the present invention may include, but are not limited to, one or more storage systems or platforms based on one or more from the group of, for example, distributed ledger technologies and / or networks, shared ledger technologies and / or networks, blockchain technologies and / or networks, cloud storage technologies and / or platforms, distributed storage servers, centralized storage servers, content delivery networks, geographically distributed networks of servers and / or data centers, PUSH Technology (RTM) style digital repository / cloud technologies, publish / subscribe, request / response, and / or real-time based digital storage and / or data access platforms, cloud / repository platforms and / or systems, publish / subscribe, request / response, and / or real-time based digital distributed storage and / or data access platforms, database management systems, secure cloud storage systems, secure storage systems or platforms, secure database management systems, and / or any other systems for storing and accessing data items, etc., and / or as required by applications.

[0212] A quantum channel or quantum communication channel may include or represent a communication channel capable of transmitting and / or receiving at least quantum information. Examples of quantum channels or quantum communication channels or quantum channels that may be used in accordance with the present invention may include or be based on one or more types of quantum communication channels associated with the following group: optical quantum communication, free-space optical quantum communication, optical fiber quantum communication, optical laser quantum communication, communication using electromagnetic waves, such as, but not limited to, radio, microwave, infrared, gigahertz, terahertz, and / or any other type of electromagnetic wave communication, communication based on electron spin, etc., any other type of quantum communication for transmitting and receiving data over a quantum communication channel between devices. It should be noted that one or more types of quantum communication channels may be capable of transmitting and / or receiving non-quantum or classical information.

[0213] A communication channel, or standard, classical, or non-quantum communication channel, may include or represent any communication channel between two devices that is capable of transmitting and / or receiving at least non-quantum information. Examples of communication channels and / or standard, classical, and / or non-quantum communication channels according to the present invention include, but are not limited to, any one or more physical communication channels, such as optical communication channels, free-space optical communication channels, wireless communication channels, wired communication channels, radio communication channels, microwave communication channels, satellite communication channels, terrestrial communication channels, fiber optic communication channels, optical laser communication channels, telecommunication channels, 2G to 6G and beyond communication channels, logical channels such as, but not limited to, Internet Protocol (IP) channels, any other type of logical channel provided over any standard, classical, or non-quantum physical communication channel, such as, but not limited to, avian carriers, paper, sealed The communication channel may include or be based on one or more types of communication channels from the group of one or more other physical communication or data carriers, such as a briefcase, courier, or other delivery service; any other type of one or more optical, wireless, and / or wired communication channels for transmitting data between devices; two or more optical, wireless, and / or wired communication channels forming a composite communication channel for transmitting data between devices; and / or any combination, combination, or modification thereof, of two or more standard, classical, or non-quantum communication channels forming a composite communication channel for transmitting and / or carrying data between devices, and / or as described herein and / or for other applications. Note that one or more types of communication channels, standard, classical, or non-quantum communication channels, may be capable of transmitting and / or receiving quantum information. As described, a quantum-secure (QS) communication channel includes or refers to a communication channel encrypted using a quantum-safe key or a quantum distribution (QD) encryption key or QD key.

[0214] The QS server, the set of identical QD keys, and the repository / ledger are combined and configured in a manner that allows, for example, but not limited to, secure collection, storage, transmission, secure communication with, and even interaction with data items by its users. For example, for each stored data item, the QS server may be configured to generate a unique quantum reference (QREF) locator, which may be based on input data associated with the data item, and assign an available or usable QD key from the set of QD keys to encrypt the data item. The encrypted data item may be stored in the repository / ledger of the QS system along with the QREF locator. Each assigned QD key is mapped to a corresponding QREF locator. A QREF access token may be generated based on the QREF locator and / or input data using an irreversible or one-way function, operation, and / or process. The QREF access token may be distributed to allow the user to access the data item in some manner. Submission of the QREF access token along with identification / authentication data from the user may enable the QS system to identify the QREF locator and allow the user to access and / or perform access operations in some manner depending on the QREF access token, data item. The QS system according to the present invention enables a multitude of applications to be deployed to users, from QS certificates, QS KYC, QS depositories, to quantum safe and / or QS end-to-end communications between users' endpoint devices registered with the QS system.

[0215] For example, accessing a data item in some manner may include, but is not limited to, allowing a user, via a user device, to perform one or more access operations associated with accessing the data item, including, but not limited to, a direct access operation on the data item, a read access operation on the data item, a write access operation on the data item, an indirect write access operation on the data item, and a query access operation, e.g., where the user is only permitted to query the data item using a QREF access token rather than directly accessing it (e.g., avoiding transmission of the data item over an insecure network). The user's access to the data item may be based on the QREF access token. The QREF access token may further be used to define and / or provide access permissions for the user in relation to the data item, including, but not limited to, one or more geographic location access permissions that comply with geographic location rules associated with the data item that ensure the data item is accessible and / or viewable, e.g., but not limited to, read access, write access, query access, and / or geographic location access permissions that comply with geographic location rules associated with the data item that ensure the data item is accessible and / or viewable, e.g., only in certain geographic locations / geographic conditions, etc., and / or as required by an application.

[0216] The QS system is configured to receive, at each QS server, an identical set of QD keys distributed from the QKD source in a quantum-secure manner. For example, for QS servers located or positioned in a large geographic region (e.g., one or more of multiple QS servers located in multiple geographic regions / countries / jurisdictions around the world to form a worldwide QS network), the QKD source may use satellite quantum key distribution to distribute the identical set of QD keys to each of the multiple QS servers and / or one or more subsets of the multiple QS servers using group and / or multicast QKD protocols. Additionally, a QS system may employ a repository / ledger configured to store and / or retrieve one or more data items using distributed ledger technology (e.g., shared ledger software technology), with multiple QS servers including DLT node functionality to provide a quantum-safe or "provably secure" method for the secure storage, collection, retrieval, and transmission of data items, and / or for applications associated with, and users of, the data items stored in the QS network, forming a DLT repository / ledger within the QS system / network. Use cases for a QS system range from quantum-safe communication between endpoint devices to quantum safety, from messaging to web authentication, from authentication to digital asset storage and / or trading, data or document repositories, from DLT signatures and verification for DLT / blockchain systems to digital wallets, and many others.

[0217] For example, an advantage of the configuration of a QS system according to the present invention is that it allows two users to quickly and remotely establish a quantum-safe and / or at least quantum-resistant communication channel between them using any communication device, endpoint device, or computing device, such as, but not limited to, a laptop, desktop computer, personal computer, mobile phone, smartphone, or Internet of Things (IoT) device, a user server, and / or any other computing or communication device. For example, two parties or users who were previously unknown to each other and not pre-connected may use the QS system to quickly and remotely establish a quantum-safe communication channel between them using any endpoint device. In another example, two parties or users who were previously known to each other and pre-connected may use the QS system to quickly and remotely establish a quantum-safe communication channel between them using their endpoint devices as well. In another example, at least two different IoT devices that were previously unknown to each other and not pre-connected may use the QS system to quickly and remotely establish a quantum-safe communication channel between them (e.g., quantum-safe communication between a first IoT device and a second IoT device, a server, and / or any other device). In another example, at least two IoT devices that were previously known to each other and pre-connected may similarly use the QS system to quickly and remotely establish a quantum-safe communication channel between them. IoT devices may be associated with defined control or reporting systems in cloud computing, FOG computing architectures, and / or FOG networking architectures, and the like, depending on the application, and / or any other system that uses IoT devices that require quantum-safe communication between them.While user endpoint devices and / or user-involved computing / communication devices are described, this is for simplicity and by way of example only; the present invention is not so limited; it should be recognized by those skilled in the art that user endpoint devices or user-involved communication devices are merely exemplary devices that may operate with a QS system to enable the QS communication and / or other use cases described herein; and those skilled in the art will recognize that any user endpoint device and examples thereof may be applicable to any other device, with or without a user or operator / control system, that is capable of communicating via a communication channel with one or more other devices, such as, but not limited to, IoT devices, sensor devices, robotics devices, smart devices, laptops, desktop computers, personal computers, mobile phones, and / or any other computing or communication device depending on the application.

[0218] In another example, an advantage of the configuration of the QS system according to the present invention is that it enables the deposit, storage, and / or retrieval / access of data items, and / or the use and / or application of data items in a quantum-safe manner. For example, registered users of the QS system, such as customers, individual users, and / or corporate users of the QS system, can deposit and store data items / data (e.g., identity records, documents, and / or any data and / or information of value to the user) within the QS network of the QS system in a quantum-safe (QS) manner. Once stored in the QS network (e.g., in the QS network's repository / ledger), these data items / data can be queried, read, accessed, and / or used in applications by users and / or third parties in a quantum-safe manner. For example, counterparties can direct, execute, and settle transfers of digital assets entirely in a quantum-safe manner.

[0219] In another example, one or more QS servers of the QS system may include a QS DLT signing / verification mechanism / application that uses QD keys (e.g., unbreakable QD keys) from the same set of QD keys delivered by the QS server using QKD and stored in QS fashion, thereby enabling, for example, but not limited to, submitting user transactions to the QS system for QS DLT signing prior to submission to the transaction counterparty and / or prior to submission to an external DLT and / or blockchain system. The QS system eliminates the need or requirement for users to store private / public keys for blockchain / DLT transaction signing / verification on their endpoint devices, but rather allows users to securely store and access, in QS fashion, their private / public keys and / or even sets of private / public QD keys assigned from the set of QD keys on the QS server. This enables QS signing / verification of blockchain / DLT transactions, significantly mitigating malicious actors or hackers from misusing / stealing transactions or digital assets, or submitting erroneous transactions from private / public keys stolen from users' endpoint devices or traditional digital wallets.

[0220] An exemplary QS system according to the present invention will now be briefly described. While certain specific components, devices, mechanisms, apparatuses, systems, and / or elements are described in the exemplary QS system below, this is by way of example only; the present invention is not so limited; and those skilled in the art will understand that the exemplary QS system below may include other elements, components, etc., and / or be combined, merged, and / or modified with other exemplary QS systems, use cases, etc., described with reference to the figures and / or described herein. An example QS system according to the present invention may include, for example, but not be limited to, the following components and / or elements: The exemplary QS system includes a QS network formed by multiple QS servers and / or QS repositories / ledger storage systems communicating with each other over a communication channel using the same set of QD keys in a quantum-safe manner.

[0221] For example, a QS system may store data items / data in a decentralized manner in a repository / ledger storage system using, for example, but not limited to, a redundant array of inexpensive / independent disks or drives (RAID) systems coupled with a distributed ledger of geographically distributed QS servers with DLT node functionality. Each QS server in the QS network may include a QKD communication system configured to enable distribution of the same set of quantum distribution (QD) keys, or so-called identical QD key sets, from a QKD source using, for example, a quantum channel. For example, each QS server in the QS network may include a satellite QKD (SQKD) communication system (e.g., a terrestrial communications satellite receiver) connected to a satellite network that enables the QKD communication system to receive the same set of quantum-generated random number encryption keys, or so-called identical QD key sets, from other QS servers from satellites in the satellite network via QKD multicast or group mode (or protocol). The QKD keys may be distributed using QKD via a satellite quantum optical channel from the satellite. In another example, each QS server in the QS network may include a terrestrial QKD communication system (e.g., an optical fiber communication receiver) connected to the QS optical fiber network configured to enable reception from a QKD source connected to the optical fiber network of a set of quantum-generated random encryption keys, so-called QD keys, from the QKD source via the optical fiber network via an optical fiber quantum channel. While SQKD and terrestrial QKD have been described, it should be understood by those skilled in the art that, as described herein, by way of example only and not by way of limitation, the QKD source may be one or more QKD sources of any other type configured to deliver the same or similar sets of QD keys to each of the QS servers in the QS network, such as depending on the application.

[0222] The QD key may be paired with a quantum-safe and / or symmetric algorithm, such as, but not limited to, one-time pad (OTP), bit-flipping key encapsulation (BIKE) and its variants, other provably secure cryptographic algorithms from the National Institute of Standards and Technology (NIST) and / or any other similar cryptographic standards organization, such as AES 512, and / or any other provably secure encryption algorithm in a post-quantum world that can ensure the setup of a quantum-safe communication channel (even a communication channel via a standard telecommunications link) between QS servers of the QS network, which can be configured to be provably secure and quantum-safe. It should be understood by those skilled in the art that the encryption algorithm used with the QD key (also referred to as a quantum key) to form the QS communication channel may be any suitable encryption algorithm that is provably secure and / or quantum-safe. In a QS system, multiple QS servers or a majority or subset of QS servers of the QS network may form a private or intranet-type QS network and are configured not to be directly internet-accessible or publicly accessible. That is, QS servers in a private QS network can only communicate with other QS servers over the meshed QKD-connected private lines, and that communication occurs only over quantum-secure communication channels (or QS channels), which are telecommunications or communication channels in the communication network encrypted using one or more provably secure cryptographic algorithms with one or more available or usable QD keys (or quantum keys) from a set of QD keys distributed from the QKD source to each QS server in the QS network. The "private" QS network creates a "quantum-secure boundary" where data items are stored and accessible in a quantum-secure manner.To enable users and / or customers to store and / or access data items within the QS network, one or more of the QS servers may function as or include at least a QS registration server. The QS registration server may be connected to one or more registration nodes via a quantum-secure channel, to which users or customers may register and store and / or deposit data in the QS system. The QS registration server may be coupled to one or more registration nodes (or registered computing devices) via a quantum-secure channel. Each registration node may be assigned or allocated an available QD key from a set of QD keys to establish a QS communication channel with the corresponding QS registration server in a quantum-secure manner. Alternatively or additionally, each QS server / node may include QS registration server functionality and even gateway functionality, with the QS registration server connected to one or more registration nodes, etc. via the gateway functionality. The gateway functionality provides a secure interface between the QS registration server and one or more registration nodes, etc.

[0223] A registration node may be accessible to users of the QS system either via a communication channel over the internet and / or a public network, or via a direct visit to the registration node. For example, a user may be required to visit a registration node to securely register themselves as a user of the QS system, securely receive one or more QS system applications or software for operating their endpoint device in a QS manner with the QS system, and securely receive one or more assigned QD keys from a set of QD keys, for example, but not limited to, to securely submit data items / digital data for storage in a secure enclave on their endpoint device for use in quantum-safe communication with the QS system over a public network and / or via a direct secure physical link with the registration node.

[0224] As mentioned, a repository / ledger storage system, which may be implemented using a QS server and / or by a separate QS storage server, may use, but is not limited to, a RAID format or variations thereof for storing data items identifiable by unique addresses or locator values, so-called QREF locators, generated or created by an algorithm using input data associated with the data item and / or user and an assigned QD key for encrypting the data item. The assigned QD key is extracted from available QD keys in a set of QD keys securely stored in the QS server, such as, but not limited to, a hardware security module (HSM). Each QS server has the same set of QD keys stored in its corresponding HSM, in which case the QS network forms a meshed HSM or HSM mesh. As an example, an SQKD system may distribute the same set of QD keys to each QS server for storage in the QS server's corresponding HSM. This can be achieved by a satellite-based group or multicast QKD protocol that stores the same set of QD keys and unicasts data representing the same set of QD keys to each QS server as it passes through. Once all required QS servers have received the data representing the same set of QD keys, the satellite deletes or erases the data representing the same set of QD keys. This can be repeated as needed to update each QS server with further sets of identical QKD keys.

[0225] For example, the input data may include, but is not limited to, a user's private key or user secret and an assigned QD key extracted from a meshed HSM in the QS network, which are combined using the QREF algorithm to generate a unique QREF locator for storing the encrypted data item (encrypted with the assigned QD key) in the repository / ledger system of the QS network. The linking or mapping of the QREF locator to the QD key assigned to the data item is stored in each HSM in the QS network, i.e., the meshed HSMs. The mapping between the assigned QD key and the QREF locator stored in the meshed HSM, and the storage of the encrypted data item in the QS repository / ledger system of the QS system using the QREF locator, creates a QS "locker" or storage location for the data item. The encrypted data item is stored in the QS system in a manner such that it can be read, accessed, decrypted, and / or used, etc., only with knowledge of the QREF locator used to store it. A data item's QS "locker" or storage location can only be accessed using the corresponding QREF locator. Thus, the QS system stores only data representing the QREF locator linked with the assigned QD key in the HSMs of the QS servers of the QS network. Thus, the QREF locator is securely stored in the HSMs of the QS servers of the QS network and is not distributed or accessible otherwise. That is, the QREF locator is inaccessible to users of the QS system and is not distributed outside the meshed HSMs of the QS system, nor even outside the QS boundary of the QS network.

[0226] The HSM of a QS server may include or represent a physical computing device, component, or apparatus configured to protect and manage, for example, but not limited to, cryptographic or QD keys, and provide secure execution of core modules / components, such as, but not limited to, key instructions, code, computer-implemented methods / processes, etc., that implement the core functionality of the QS server, for example, but not limited to, associated with, for example, but not limited to, generating a QREF locator, a QREF access token, identifying a QREF locator from a QREF access token, and / or encryption / decryption operations and / or secure storage of a set of QD keys and one or more sets of data items. The HSM includes tamper-resistant technology that may wipe private / QD keys, etc., for example, but not limited to, in the event of a physical and / or software compromise, etc.

[0227] A user or customer endpoint device or devices may include or represent any device, computing device, and / or communication device capable of communicating over a communication network, where the device / computing device and / or communication device is associated with the user or customer. Examples of endpoint devices and / or devices may include, but are not limited to, a user server, a customer server, and / or any other computing or communication device, such as, for example, a laptop, desktop computer, personal computer, mobile phone, smartphone, or Internet of Things (IoT) device. The user and / or customer endpoint device and / or communication device may establish an end-to-end quantum-secure communication channel with the QS system and / or with other user and / or customer endpoint devices within the QS system. This may be accomplished through the endpoint device connecting to a QS server and / or a corporate network hosting the QS server, including, for example, but not limited to, an SKQD system, and thus having a set of QD keys, one or more of which may be assigned to the user's endpoint device and stored in a secure enclave or secure memory on the endpoint device. An endpoint device can use one or more assigned QD keys to establish a QS channel with the QS system, and therefore to one or more other similarly configured endpoint devices, and so on.

[0228] Alternatively or additionally, one or more endpoint devices may be registered with the QS system via a registration process (e.g., a QREF device registration process), in which one or more QD keys from a set of QD keys may be assigned and / or installed in the endpoint device's secure memory / enclave. The QD keys assigned to the endpoint device may be stored as one or more data items in the QS system's QS repository, along with a QREF locator corresponding to each data item. When a user receives an endpoint device with installed QD keys, the user may register through the QS system's QS registration server (e.g., via a web portal and / or web interface) or directly at a registration node, in which case the QS system updates the registry with the endpoint device as associated with the registered user. The user of the endpoint device may then use a QREF application to establish a quantum-secure communication channel between the endpoint device and the QS system using the previously assigned QD keys stored in the endpoint device's secure enclave. Each user signs in to the QS system via an endpoint device and, upon establishing a QS channel, may request a call or connection with one or more other users of the QS system, in which case the user's endpoint device also establishes a quantum-secure communication channel with the QS system, and the QS system may thus facilitate the establishment of a quantum-secure communication pipe (series of channels) through the QS network to each endpoint device in association with the requested call or connection. Thus, the QS system may build a user directory or registry and, over time, establish a user connection or contact list for each user, enabling each such user to contact other users in a quantum-secure manner.

[0229] Another aspect of the QS system includes generating a QREF access token when a QREF locator is generated during storage of a data item in a QS repository / ledger of the QS network / system. The QREF locator may be linked in the HSM to users authorized to access the data item in some manner. When a QREF locator is generated in association with a data item to be accessed or used by one or more users, a QREF access token is generated based on the QREF locator using an irreversible or one-way function, operation, and / or process (e.g., a hash of the QREF access token). The QREF access token can be delivered to users of the QS system, allowing users with authorization to access the data item in some manner to do so by presenting the QREF access token to the QS system. Upon presenting the QREF access token to the QS system (e.g., a QS registration server and / or registration node), the user is required to register (if not already registered with the QS system) and / or log in to the QS system, which requires user credentials / authentication data / password and / or other input data that may be associated with generating the QREF locator and / or associated with the user having permission to access the data item in some manner. Thus, upon submitting the QREF access token along with identification / authentication data from the user, the QS server may use a securely executed QREF identification algorithm to identify the QREF locator associated with the QREF access token, while simultaneously checking that the user is who they claim to be and that they will be able to access or have permission to access the data item corresponding to the identified QREF locator. Once this is verified, the user is authorized to access the data item corresponding to the identified QREF locator in some manner according to the QREF access token and the permissions granted to the user.For example, the QREF identification algorithm may be configured to identify the user submitting the QREF access token by requesting the user's user credentials.

[0230] While the QREF access token may be transmitted over a quantum-secure channel to a user of an endpoint device already registered with the QS system, as outlined above, there are also various applications in which the QREF access token may simply be transmitted to a user of an endpoint device over a non-quantum-secure channel. That is, the QREF access token is designed so that it cannot be used by anyone other than a user who has permission to use it. Furthermore, while the QREF access token is derived from a QREF locator, the QREF access token is created or generated in such a way that the QREF locator cannot be determined from the QREF access token. Thus, the QREF access token may be transmitted over a traditional communications network to third parties or other users, who may have limited access or permission to use or query the corresponding data items stored in the QS system.

[0231] If a user or customer of the QS system wishes to access a data item in the future, or to authorize a third party to access the data item, or to perform any transaction on the data item, that user, customer, and / or third party can do so only if they have a QREF access token associated with the data item. This may be generated by the QS system as described above, or upon request by the user and / or customer of the QS system who submitted the original data item for QS storage and access in the QS system. At a later stage or time, the user, customer, and / or third party may then deliver their QREF access token, along with their private key and certificate, to the QS system, e.g., via one or more QS registration servers or nodes. The QS system then uses a QREF identification algorithm to infer the QREF locator (or address) from the QREF access token (e.g., a one-way hash of the QREF locator), thus recovering the QD key from the QS server's HSM that was used to encrypt the data item. This allows the QS system to use the identified QREF locator to reference the data item stored in the QS repository / ledger system and access this data item for the requested purpose (e.g., querying the data item and / or returning the answers required for any other access operations configured by the original user).

[0232] In some applications, the QREF access token is presented to all QS servers operating nodes in the QS system's distributed ledger network, all of which have access to the same QD key (e.g., the same quantum key), and each node is configured to operate to deduce a QREF locator from the QREF access token, and the nodes reach consensus by performing the same operation on the QREF access token to verify that the resulting QREF locator is correct and the request is valid. In some applications, the hash is presented to all nodes in the QS system's distributed ledger network, all of which have access to the same quantum key, and the nodes reach consensus by performing the same operation on the hash to verify that the request is valid. This approach over what is already quantum-safe computation offers computational and network reliability advantages.

[0233] The QS system according to the present invention enables the deployment of a multitude of applications to users, from QS certificates, QS KYC, QS depositories, to quantum-safe and / or QS end-to-end communications between users' endpoint devices registered in the QS system.

[0234] FIG. 1a is a schematic diagram illustrating another exemplary quantum-secure (QS) system 100 and QS network 101 in accordance with the present invention. It should be understood by those skilled in the art that QS system 100 may be adapted, modified, and / or combined with one or more other QS systems described herein with reference to the figures and / or described herein. Referring to FIG. 1a, the QS system includes a QS network 101 and a non-QS network 102. QS network 101 is formed by a plurality of quantum-secure (QS) servers 103a-103l and a QS repository 107 for storing and accessing data items associated with a first plurality of users 104a-104m and a second plurality of users 105a-105n. The QS network 101 requires that each of the QS servers 103a-103l includes a plurality of Hardware Security Modules (HSMs) 106a-106l, each of which includes at least a set of quantum distribution (QD) keys (also referred to as quantum keys) stored therein that enable the QS servers to communicate securely in a quantum-safe manner with each other, with the QS repository 107, and / or with one or more user devices using one or more available QD keys from the same set of QD keys stored in each HSM 106a-106l.

[0235] As described, each of the QS servers 103a-103l has an HSM 106a-106l that includes an internally stored set of QD keys. The set of QD keys stored in each of the HSMs 106a-106l may be the same internally stored set of QD keys, thereby enabling the QS servers 103c-103l to communicate with each other over quantum-secure (QS) communication channels 108a-108p (e.g., using symmetric cryptography). For example, each of the QS servers 103a-103l uses a QD key from the set of QD keys to form a QS communication channel with one or more of the other QS servers 103a-103l and the QS repository 107 by using the QD key to encrypt a communication channel (e.g., an IP channel) in a communication network (e.g., the Internet or any other communication network). Thus, when QS servers 103a-103l and QS repository 107 are connected to and / or communicate with each other via QS channels, they form QS network 101. Alternatively or additionally, each of HSMs 106a-106l may have a set of QD keys stored therein, where a subset of the set of QD keys is identical to a corresponding set of QD keys in one or more of the other HSMs 106a-106l, and the identical QD keys of the subset may be used for quantum-secure communications over the communications network using QS channels 108a-108p. In any event, each of the HSMs 106a-106l includes an identical set of QD keys or an identical subset of QD keys stored therein that enables the QS servers 103a-103l to communicate securely with each other, with the QS repository 107, and / or with one or more user devices in a quantum-secure manner over one or more QS channels 108a-108p using one or more available QD keys from the same set / subset of QD keys. The QS servers 103a-103l, when communicating over quantum-secure communication channels, form a QS network 101 having a quantum-secure boundary within which quantum-secure communications occur between the QS servers 103a-103l, the repository 107, and / or one or more user QS servers, devices, etc. within the QS network 101.Additionally, each of the QS servers or devices of the first plurality of users 104a-104m may also have a hardware security module (HSM) that also includes an identical set / subset of QD keys stored therein, enabling these user QS servers or devices to communicate securely, in a quantum-safe manner, with the QS servers 103a-103l and / or QS repository 107 of the QS network 101 using one or more available QD keys from the set / subset of QD keys.

[0236] Alternatively or additionally, each HSM 106a-106l may receive a set of QD keys based on a quantum key distribution (QKD) protocol / process, etc., where each set of QD keys includes at least a set of QD keys identical to one or more other sets of QD keys received by one or more other HSMs. Each HSM may file or submit its set of QD keys for storage to the QS repository 107. Each unique QD key may be stored in the QS repository 107 and assigned a corresponding unique quantum key identifier (e.g., QKID). When a set of QD keys is submitted or filed, these QD keys may be compared with previously submitted sets of QD keys so that duplicate QD keys are discarded and only unique QD keys are stored against their unique quantum key identifiers in the QS repository 107. The unique quantum key identifiers may be used or transmitted to one or more QS servers that require quantum-secure communication channels with each other or other devices over a communication network. The QS server uses the unique quantum key identifier to retrieve the corresponding QD key from the QS repository 107 and / or the corresponding HSM 106a-106l to set up the quantum secure communication channel.

[0237] The quantum secure (QS) devices / nodes or servers 103a-103l may include or represent any computing device, node, apparatus, hardware, or server configured with a set of QD keys (or quantum keys) stored therein and capable of conducting quantum secure (QS) communications with each other and / or one or more user devices over a communications network, and / or capable of receiving one or more sets of QD keys from a QKD source using a QKD quantum channel (e.g., a channel that transmits quantum information), etc. For example, a QS server may be configured, by way of example only and not by way of limitation, to service and / or deliver QD keys to one or more user devices via a quantum-secure communication channel (e.g., a communication channel encrypted by a QD key) over a communication network that enables such user devices to communicate in a quantum-secure manner, service and / or process one or more user requests associated with registering, storing, and / or accessing data items within the QS network, service and / or process one or more user requests for quantum-secure communication between users' user devices, such as the QS network and / or the QS server, and the receiver and / or process data representing the one or more QD keys (or QD keys) delivered in a quantum-secure manner form a QKD source using a QKD protocol and / or quantum channel, etc.

[0238] Each of the HSMs 106a-106l may be configured to securely manage and / or store cryptographic keys, such as, for example, but not limited to, a QD key or set of QD keys, such that any unauthorized attempts to extract the QD key are thwarted and / or detected. The HSM may include, by way of example only and not limitation, one or more tamper-resistant and / or tamper-detection sensors, such as a wire cage surrounding an encapsulated memory module, over- or under-voltage and / or temperature detection, or other sensors or software for detecting tampering and / or unauthorized access to the QD key or the like. The HSM may also be configured to provide a restricted and authenticated communications interface to an end-user's cryptographic system, such as a QS server of the QS network. Essentially, the HSMs 106a-106l include or represent a computing device or apparatus configured to at least securely store one or more cryptographic or digital keys for use in, for example, authentication and / or cryptographic operations / processes.Examples of HSMs that may be used in accordance with the inventions described herein include, by way of example only and not by way of limitation, any apparatus, hardware, cryptographic module, memory unit, platform, device, and / or processor configured to at least securely store, manage, and / or protect cryptographic keys and / or digital keys and the like; dedicated cryptographic hardware comprising one or more processors, processing units, chips, modules, and / or memories having tamper-resistant, tamper-evident, or tamper-responsive functionality and / or packaging for securely storing cryptographic keys and / or digital keys; apparatus or hardware comprising one or more secure cryptographic processors configured to prevent tampering and / or probing while storing, protecting, and / or managing one or more cryptographic keys stored therein; apparatus or hardware including one or more processors or processor units (e.g., microprocessors, etc.) of a module that is protected by tamper-evident, tamper-resistant, or tamper-responsive packaging; 140, and / or one or more modifications thereof, one or more combinations thereof, etc., and / or any other hardware or device configured to at least securely store, manage, and / or protect cryptographic keys and / or digital keys and the like that comply with or are internationally recognized in one or more computer security standards, such as IEEE 802.11b, IEEE 802.11c, IEEE 802.11d, IEEE 802.11b, IEEE 802.11b, IEEE 802.11c, IEEE 802.11d, IEEE 802.11b, IEEE 802.11b, IEEE 802.11c, IEEE 802.11b ...b, IEEE 802.11b, IEEE 802.11b, IEEE 802.11c, IEEE 802.11b, IEEE 802.11b, IEEE 802.

[0239] The QS network 101 may further include a QD key or quantum key allocation mechanism, component, and / or controller (shown here) configured and / or operable to ensure that each of the QS servers 103a-103l requesting one or more available QD keys from a set of identical QD keys stored in a corresponding HSM 106a-106l and / or QS repository 107 is not already in use. For example, each QD key in the set of identical QD keys stored in each HSM 106a-106l and / or QS repository 107 may be assigned a unique quantum key identifier (e.g., QKID), and the QD key allocation mechanism / controller manages the allocation of QD keys from the set of QD keys based on the quantum key identifier in response to requests for one or more available QD keys. Thus, a QS server 103a-103l can request one or more available QD keys, and the QD key allocation mechanism / controller allocates one or more quantum key identifiers for the available QD keys that the QS server can use. The HSMs 106a-106l of the QS servers 103a-103l can provide access to the QD keys that correspond to the allocated quantum key identifiers.

[0240] For example, the QS servers 103a-103l may use the same set of QD keys stored in their corresponding HSMs 106a-106l or QS repository 107 to set up quantum-secure communication channels with each other and with the QS repository 107 using quantum encryption based on one or more available QD keys from the set of QD keys. The set of QD keys is distributed to each of the QS servers 103a-103l in a quantum-secure manner, by way of example only and not limitation, satellite quantum key distribution, optical quantum key distribution, fiber optic quantum key distribution, and / or any other quantum key distribution scheme capable of distributing the set of QD keys to the multiple QS servers 103a-103l in a quantum-secure manner. Whatever QKD scheme is used, updated sets of QD keys may be distributed as needed, and / or according to a schedule, etc., and / or depending on the application.

[0241] Each of the first plurality of users 104a-104m has, without limitation, a QS server and / or QS device that is part of the QS network 101. The QS servers and / or devices of the first plurality of users 104a-104m may include an HSM having a set of QD keys (or a set of quantum keys) stored therein, the set of QD keys being distributed to these devices using the QKD scheme that was used to distribute the set of QD keys to the QS servers 103a-103l of the QS network 101. For example, the QS server and / or QS device of each of the first plurality of users 104a-104m may communicate securely in a quantum-safe manner with the QS servers 103a-103l and / or the QS repository 107 using one or more available QD keys from the set of QD keys.

[0242] Each of the second plurality of users 105a-105m has a user server, user device, endpoint device, and / or communication device that is part of, but is not limited to, the non-QS network 102. The non-QS network 102 includes, by way of example only and not limitation, any communication network outside the QS network 101, such as the Internet, a public network, a telecommunications network, or a traditional private network, which typically uses conventional cryptographic techniques to secure communications. The user devices of the second plurality of users 105a-105m may communicate with one another via the non-QS network 102. The user devices of the second plurality of users 105a-105m may also communicate and / or transact with one or more QS servers 103a-103l located on the edge or boundary of the QS network 101, related to data items stored in the QS repository 107. These one or more QS servers 103a-103l form a QS boundary or region.

[0243] The QS system 100 is configured to enable secure storage, access, and / or retrieval of data items by one of multiple users 104a-104m and / or 105a-105n in a manner that prevents any non-QS user from directly accessing the data items stored in the QS repository 107. Data items are stored in the QS repository 107 using available QD keys from a set of QD keys to encrypt each data item. Because the QS repository 107 is stored in a QS network 101 with QS servers 103a-103l connected exclusively by quantum-secure communication channels, data items held in the QS repository are not publicly accessible via a non-QS network 102, such as, but not limited to, the Internet or other public network. Thus, the QS system 100 manages the secure storage and access and / or retrieval of data items stored in the QS repository 107 via the QS network 101 while ensuring that the data items remain quantum-secure.

[0244] In particular, the QS system 100 manages the storage of data items in the QS repository 107 using a so-called unique quantum reference (QREF) locator for each data item. The unique QREF locator is generated using one or more cryptographic primitives and / or cryptographic operations on at least a portion of the data representing an available QD key used to encrypt the data item for storage in the QS repository 107 and the user secret of the user requesting storage of the data item. The QREF locator is used as an address for storing the data item within the QS repository 107 and is also used to identify the identity of the user associated with the data item and / or the user provided with permission to access the data item. The QREF locator is stored in QS format in one or more of the QS servers 103a-103l of the QS network 101. The QS system 100 also manages access, access operations, and / or retrieval of one or more data items stored in the QS repository 107 using a so-called access token associated with each data item stored in the QS repository 107. An access token for a data item is generated based on the QREF locator used to store the data item in the QS repository 107. The access token is unique and generated in a one-way manner such that the data representing the QREF locator cannot be derived or determined. The access token may be provided to the user of the data item and / or other users of the first and / or second plurality of users 104a-104m and / or 105a-105n to enable those users to, without limitation, access or perform access operations and / or read the data item from the QS repository 107.

[0245] 1b is a flow diagram illustrating an exemplary QS storage process 110 for storing data items in the QS system 100 using the QS network 101 of FIG. 1a in accordance with the present invention. The QS network 101, including multiple QS servers 103a-103l and a QS repository 107, is used to store data items for one or more of multiple users 104a-104m and 105a-105n in a quantum-secure manner. Each of the QS servers 103a-103l may include a secure memory (not shown) (e.g., a hardware security module) for storing an identical set of quantum distribution (QD) keys, which have been distributed to each of the QS servers in a quantum-secure manner, and the QS servers 103a-103l are configured to securely communicate with each other and the QS repository 107 over one or more QS channels using one or more available QD keys from the same QD key set.

[0246] The QS storage process 110, which may be performed by one or more of the QS servers 103a-103l, etc., may include one or more of the following steps: In step 112, receive a data item for storage in a QS repository; In step 114, generate a quantum reference (QREF) locator item based on input data associated with the data item for storage and an available QD key selected from a set of QD keys. The QREF locator is a unique identifier that can be used as a logical address for storing the data item in the QS repository; In step 116, transmit the QREF locator, along with the data item encrypted with the available QD key, to the QS repository using the one or more QS channels.

[0247] 1c is another flow diagram illustrating another exemplary QS storage process 120 for storing data items in the QS system 100 using the QS network 101 of FIG. 1a in accordance with the present invention. The QS network 101, including multiple QS servers 103a-103l and a QS repository 107, is used to store data items of one or more of multiple users 104a-104m and 105a-105n in a quantum-secure manner. Each of the QS servers 103a-103l may include a secure memory (not shown) (e.g., a hardware security module or a secure processor enclave, such as Intel Software Guard Extensions on an Intel x86 processor) for storing an identical set of quantum distribution (QD) keys, which set of QD keys has been distributed to each of the QS servers in a quantum-safe manner, and the QS servers 103a-103l are configured to communicate securely with each other and with the QS repository 107 via one or more QS channels using one or more available QD keys from the same set of QD keys.

[0248] The QS storage process 120, which may be performed by one or more of the QS servers 103a-103l, may include one or more of the following steps: In step 122, receive a data item for storage in the QS repository. The data item may be associated with a user and / or a QS server on behalf of the user and / or one or more components, such as a QS server. In step 123, select an available QD key from a set of QD keys for encrypting the data item. In step 124, generate a quantum reference (QREF) locator item based on input data associated with the data item for storage and the available QD key selected from the set of QD keys. The QREF locator is a unique identifier that may be used as a logical address for storing the data item in the QS repository.

[0249] In step 125, the QREF locator is mapped to a QD key, and the QREF locator is mapped to a data item when it is encrypted with the selected QD key and stored in the QS repository, thereby enabling the encrypted data item to be located based on the QREF locator and for decrypting the encrypted data item.

[0250] In step 125a, the QREF locator is linked to an available QD key from the set of QD keys. This may involve mapping the QREF locator to a QD key from the set of QD keys. For example, this may be done by having a QREF-QD key data structure, schema, table, or list that includes multiple records, each record including, for example, but not limited to, a QREF locator field and a QD key identifier field. The QREF locator may be mapped to a QD key by populating the record by inserting the QREF locator into the QREF locator field and inserting the QD key identifier of a selected QD key from the set of QD keys. In this way, the QREF locator may be mapped to the selected QD key. The QREF-QD key data structure may be stored in secure memory along with the set of QD keys in each of the QS servers 103a-103l.

[0251] In step 125b, the QREF locator is linked to the encrypted data item as it is stored in the QS repository, which may include storing a QREF-data item data structure, schema, list, or table by the QS repository, where the QREF locator is mapped to the data item. For example, the QREF locator may be mapped to a physical address where the data item is stored in the QS repository.

[0252] In step 126, the data item is encrypted using the selected QD key, and in step 127, the QREF locator and the encrypted data item are sent via one or more QS channels to a QS repository for storage, with the encrypted data item being linked / mapped to the QREF locator when stored.

[0253] FIG. 1d is a flow chart illustrating an exemplary process 130 for accessing a data item stored in a QS system using process 110 according to the present invention. It is assumed that a QREF locator has already been generated in association with the data item, for example, but not limited to, as described in processes 110 and 120. Process 130 for enabling access to a data item when stored in a QS repository with a QS locator may include the following steps: In step 132, a QREF access token for accessing the data item based on the QREF locator is generated using an irreversible function, process, or operation. The QREF access token is a unique number from which a QREF locator cannot be derived. In step 134, the generated QREF access token is sent to the user's device to enable the user to access the data item. The user can submit the QREF access token to the QS system, and the QS system can identify a QREF locator corresponding to the QREF access token based on user verification and / or authentication, etc. The QS system may then retrieve the data item associated with the identified QREF locator and provide access operations to the user in relation to this data item.

[0254] 1e is a flow diagram illustrating another exemplary process 140 for accessing a data item in a QS system in connection with processes 110 and / or 120 according to the present invention. It is assumed that a QREF locator has already been generated in connection with storing the data item, for example, but not limited to, in processes 110 and 120. It is also assumed that a QREF access token has been generated and delivered to a user, for example, but not limited to, in process 130. Process 140 for retrieving or accessing a data item as stored in a QS repository with a QREF locator may include the following steps: In step 142, receive a QREF access token from a user's device requesting access to a data item stored in the repository; and in step 144, identify a QREF locator based on the QREF access token and input data from the user. This may include, for example, but not limited to, identifying a set of QREF locators that may be associated with the user. For each QREF locator in the set of QREF locators, a temporary QREF access token may be generated using that QREF locator using the same process used to create the received access token. Each temporary QREF access token is compared to the received QREF access token, and the QREF locator corresponding to the temporary QREF access token that matches the received QREF access token is the identified QREF locator. In step 144, it is determined whether the QREF locator associated with the QREF access token has been identified. In response to identifying the QREF locator (e.g., yes), proceed to step 145. In response to not identifying the QREF locator (e.g., no), proceed to step 147. In step 145, the encrypted data item is retrieved from the QS repository, and the data item is decrypted using the QD key corresponding to the QREF locator.The data item may be decrypted in the secure memory of the QS server to prevent the data item from being exposed or revealed to non-secure memory and / or other processes, etc. In step 146, the user is provided with an access operation related to the decrypted data item. For example, the access operation may include, but is not limited to, simply verifying that the data item exists, providing an answer to a query associated with the data item (the query may be submitted together with or as part of the QREF access token, or separately, etc.), retrieving and transmitting the data item to the user (e.g., using QS communication or quantum-safe communication), any other processing operation performed on the data item that provides an output to the user, and any other processing operation performed on the data item that provides an output to the user without exposing the data item. In step 147, the QREF locator is not identified from the access token, which may mean that the user was unable to verify and / or authenticate themselves and may therefore have been a malicious actor. In this case, a notification is issued in connection with the attempted access to the data item associated with the QREF access token. This may involve sending a notification to one or more users associated with the QREF access token.

[0255] 1f is a flow diagram illustrating another exemplary QS storage process 150 for storing data items in the QS system 100 using the QS network 101 of FIG. 1a in accordance with the present invention. The QS network 101, including multiple QS servers 103a-103l and a QS repository 107, is used to store data items of one or more of multiple users 104a-104m and 105a-105n in a quantum-secure manner. The QS storage process 150 may include one or more of the following steps:

[0256] In step 151, a request to store a data item by a first user of a plurality of users 104a-104m and / or 105a-105m is received.

[0257] In step 152, in response to receiving a request to store a data item by a first user, a QREF locator is generated based on the first user's user secret and an available QD key selected from the set of QD keys. The first user may be, by way of example only and not limitation, an enterprise user and / or a public user, such as an Internet user. For example, an enterprise user may have access to a QS server and / or a QS device that connects directly within the QS network. For example, a public user may have access to a computing device or endpoint that can connect to a QS server in the QS network through a public communications network. The QREF locator indicates data representing at least the location of the data item encrypted with the selected QD key in the QS repository 107 and the identity of the first user. The first user may be an enterprise user using a QS server within the QS network 101 and / or a user using a computing device via a non-QS network 102.

[0258] The registration data for the first user may include, but is not limited to, for example, a QREF locator, an identifier and / or customer number for the first user, a user secret for the first user, an identifier for the data item, access control data such as permitted access actions and / or access permissions, including, but not limited to, for example, identifiers of one or more other users authorized to access the data item, and / or any other data associated with the user and / or data item, except for the data item itself, which may be stored in a user record associated with the first user in a user registry or database in the QS repository 107 and / or one or more QS servers 103a-103l of the QS network 101. The user registry or database is accessible only by the QS servers 103a-103l of the QS network 101 and is used to identify a QREF locator associated with the data item based on a QREF access token used to access the data item in a quantum-secure manner.

[0259] In step 153, a QREF access token is generated based on the QREF locator, where the QREF access token enables an access operation to be performed on the data item stored in the QS repository 107. The access operation may include, for example, but is not limited to, a query related to the data item, an update related to the data item, retrieving information associated with the data item, answering a query related to the data item, and / or any other type of access operation associated with the data item.

[0260] For example, a QREF access token may be provided by a user to the QS network 101 via the QS server 103a. The registration user data may be used to identify a QREF locator corresponding to the access token. For example, if the user is a first user, the QS server 103a may retrieve and / or search the first user's registration data to identify a set of one or more registration records associated with the first user. Each registration record in the set includes a QREF locator corresponding to a data item that the first user has stored in the QS repository 107 or has provided the QS repository 107 with permission to access. The set of one or more registration records may also be linked to one or more other users who also have permission to access the data items pointed to by the corresponding QREF locators in the registration records. Each registration record in the set of registration records associated with the first user is used to generate an access token, and the registration record that generates a QREF access token that matches the received QREF access token is used to identify the encrypted data item stored in the QS repository 107 that is associated with the QREF locator and, therefore, the received access token. At the same time, the enrollment record is used to check whether the user presenting the QREF access token is authorized to access the data item in some manner.

[0261] In step 154, the QREF locator and encrypted data item are provided to the QS repository 107 for storage along with the encrypted data item in the QS repository 107. One or more QS servers 103a-103l of the QS network 101, upon receiving the QREF access token associated with the data item, use a user registry or database to determine whether the user providing the QREF locator corresponding to the data item, and therefore the location where the data item is stored in the QS repository 107, and / or the QREF access token, is authorized to access, read, and / or perform access operations on the corresponding data item, for example, but not limited to, or depending on the application.

[0262] In step 155, the generated QREF access token associated with the data item is transmitted to the first user's device. The first user may use the QREF access token to access the data item in the QS repository 107 and / or provide the QREF access token to one or more other users among the plurality of users 104a-104m or 105a-105n to access or perform access operations on the data item, etc. In this case, the first user may be granting registrations or updating registrations of multiple users in connection with the data item using access controls associated with the one or more other users to whom the multiple users have provided the QREF access token. This enables the QS system 100 and QS network 101 to determine whether the user is authorized to use the QREF access token in connection with data items stored in QS format in the QS repository 107.

[0263] FIG. 1g is a flowchart illustrating an exemplary QS access process 160 for accessing data items of the QS system 100 using the QS network 101 of FIG. 1a according to the present invention. The QS network 101 including a plurality of QS servers 103a-103l and a QS repository 107 is used to store and enable access to data items of one or more of a plurality of users 104a-104m and 105a-105n in a quantum-safe manner. The QS access process 160 may include one or more of the following steps.

[0264] In step 161, a request for accessing a data item stored in the QS repository 107 is received by a second user among the plurality of users 104a - 104m and 105a - 105m based on the QS storage processes 110, 120, and / or 150. The request may include a QREF access token associated with the data item stored in the QS repository 107 based on the QS storage processes 110, 120, and / or 150. The second user may be the same as the first user described in the QS storage processes 120 and / or 150. Alternatively or additionally, the second user may be a different user from the first user as described in the QS storage processes 120 and / or 150. For example, the first user of the QS storage process 110 may be a company or a corporate user that stores data items in the QS repository 107 in a QS manner. Then, the first user can access using the encrypted data item stored in the QS repository in a QS manner, or provide the QREF access token to those other users (e.g., employees or other users) that the first user desires to have the form of access / access operations. Thus, the QREF access token may be distributed by the first user to one or more other users of the QS system 100. In any case, the QS server 103a of the QS network 101 receives the QREF access token from the second user corresponding to the data item stored in the QS repository 107.

[0265] In step 162, the QS server 103a is configured to identify a QREF locator based on the received QREF access token and the identity of the second user. The user who stored the data item in the QS repository 107 has a user registration record or data stored in the QS network 101 or the QS repository 107, which may include, for example, but not limited to, data representing the QREF locator, access control data such as, for example, but not limited to, the QREF locator, an identifier or customer number of the first user, a user secret of the first user, authorized access actions and / or access permissions including identifiers of one or more users authorized to access the data item, and / or any other data associated with the user and / or data item, except that the data item itself may be stored in a user record associated with the first user in a user registry or database in the QS repository 107 of the QS network 101 and / or one or more QS servers 103a-103l. The QS server 103a may retrieve all user registration records associated with the second user and use this information to determine the QREF locator associated with the received QREF access token and whether the second user has permissions to access the data item stored in the QS repository 107 and / or permissions associated with using the data item, such as, but not limited to, permissions to read, write, update, erase, query, retrieve, and / or any type of access or usage permission associated with and / or depending on the use of the data item.

[0266] For example, a QREF access token may be provided to the QS network 101 by the second user via the QS server 103a. Assuming that registered user data is stored each time a user submits or requests storage of a data item and associated access permissions in the QS repository 107, the registered user data may be used to identify a QREF locator corresponding to the access token. For example, if the second user is the first user, the QS server 103a may retrieve and / or search the first user's registration data to identify a set of one or more registration records associated with the first user. If the second user is another user other than the first user, the QS server 103a may retrieve a set of registered user records associated with the second user. Each enrollment record in the set of enrollment records includes a QREF locator corresponding to a data item that a first user stored in the QS repository 107 and provided a second user with permission to access the data item, or a QREF locator corresponding to a data item that a second user stored in the QS repository 107 and has permission to access. One or more enrollment records may also be linked to one or more other users who also have permission to access the data item pointed to by the corresponding QREF locator in the enrollment record. In either case, each enrollment record in the set of retrieved enrollment records associated with the second user is used to generate a QREF access token, and the enrollment record that generates a QREF access token that matches the received QREF access token is used to identify the QREF locator and, therefore, the encrypted data item stored in the QS repository 107 that is associated with the received access token. At the same time, the enrollment record is used to check whether the second user presenting the QREF access token is authorized to access the data item in some manner.

[0267] In step 162a, it is determined whether a QREF locator associated with the QREF access token is identified and whether the user has permission to access the encrypted data item stored in the QS repository 107. If a QREF locator corresponding to the QREF access token is identified and the user has permission to access the encrypted data item (e.g., Y), process 120 proceeds to step 123. On the other hand, if a QREF locator corresponding to the QREF access token is not identified or the user does not have permission to access the encrypted data item (e.g., N), process 120 proceeds to step 124.

[0268] In step 163, access / access operations to the encrypted data item of the repository may be provided to the second user in some manner in response to identifying the QREF locator. For example, the encrypted data item may be decrypted using the associated QD key, and access and / or access operations may be granted by the user to the decrypted data item.

[0269] In step 164, access is not provided to the user because the QREF locator is not identified or the user does not have permission to access the encrypted data item associated with the QREF locator and access token. An error message may be sent to the user's device to notify the user that access is not provided. Alternatively, or additionally, a notification to the user associated with the data item may be generated to inform the user who attempted to access the data item and / or to give the user an opportunity to grant permission to grant access to the data item. Alternatively, or additionally, a notification may be sent to the data item owner and / or user that an invalid attempt to access the data item has been made.

[0270] Figure 1h is a schematic diagram illustrating another exemplary QS system 165 including a QS network 101 for use with QS storage processes 110, 120, and / or 150 of Figures 1b, 1c, and / or 1f, and / or QS access processes 130, 140, and / or 160 of Figures 1d, 1e, and / or 1f, in accordance with the present invention. For simplicity, reference numbers used in Figure 1a for similar or identical features, components, or items are reused in Figure 1h. The QS network 101 is formed using at least QS channels 108a-108c between multiple quantum-secure (QS) servers 103a-103c, with the QS repository 107 of FIG. 1a replaced by a QS distributed ledger technology network (DLT) 167 (or distributed ledger network and / or shared ledger network) for storing and accessing data items associated with a first plurality of users 104a-104m and a second plurality of users 105a-105n. In this example, the multiple QS servers 103a-103c include multiple DLT nodes 166a-166c, and / or the user server of user 104a includes DLT node 166d, which operate to form the QS DLT network 167 (referred to as QS DLT) for storing and / or accessing data items, etc. The QS DLT 167 may be based on at least one or more DLTs from the group including, but not limited to, distributed ledgers, shared ledgers, blockchains, publish / subscribe and / or response / request management systems or platforms, and / or any other secure distributed database management systems, depending on the application.In this example, the QS DLT 167 may include, by way of example only and not limitation, a distributed ledger and / or shared ledger for storing data items such as a plurality of users 104a-104m and / or 105a-105n, data items associated with a plurality of users 104a-104m and / or 105a-105n, registered data items associated with a plurality of users 104a-104m and / or 105a-105n, any other data items associated with a plurality of users 104a-104m, 105a-105n, and / or a QS server 103a-103c for maintaining and / or operating the QS system 130, etc. Essentially, a distributed ledger creates an identical copy of the ledger for every node 166a-d in the system by operating a consensus among the nodes 166a-d (or a subset of the nodes 166a-d), and newly created data or data items are always approved and stored equally. All nodes 166a-d have visibility to all data and / or data items. A shared ledger broadcasts copies of the data or data items only to those of the multiple nodes 166a-d involved in the transaction, plus any required notarization nodes, and different nodes of the multiple nodes 166a-d can see different subsets of the data / data items, such as, by way of example only and not by way of limitation, through a permissioning engine or other type of permissioning system.

[0271] An advantage of using a DLT network based on the QS DLT 167 (referred to as the QS DLT) rather than a centralized QS repository is that the QS system 100 and QS network can be easily scaled up with an increasing number of users 104a-104, 105a-105n and / or QS servers 103a-103c storing data items and accessing data items stored in the QS DLT 167. The QS DLT 167 also adds an extra layer of security when storing and / or accessing data items to / from the QS DLT 167, which typically requires agreement from a majority of the multiple DLT nodes 166a-166d and / or a set of jury or notary nodes, such as multiple DLT nodes 166a-166d, thereby enhancing data integrity, security, and access authorization. Jury nodes and / or notarization nodes may be a trusted subset of DLT nodes 166a-166d that have the functionality to reach consensus regarding, for example, storing and / or accessing one or more data items. Additional benefits of using DLT include, but are not limited to, for example: 1) enabling an added layer of security to the registration and data retrieval process through the operation of a consensus system, whereby a majority of nodes must simultaneously agree or approve a transaction that is extremely difficult to spoof in real time; 2) enabling multiple parties together to operate an application of the QS storage / access process (e.g., also known as a QRef application) of the QS system 130 in accordance with the present invention when the parties do not wish to place the QRef application and / or QS system 130 under the control of a single central actor; and / or 3) the efficiency with which multiple nodes 166a-166d can be used to host multiple different instantiations and / or applications of the QS system and / or QRef application, such as by multiple DLT node infrastructure operators.

[0272] 1d, in this regard, each QS server 103a of the plurality of QS servers 103a-103c of the QS network 101 includes a hardware security module (HSM) 106a having an identical set of QD keys stored therein, and each QS server 103a of the plurality of QS servers 103a-103c includes a distributed ledger technology (DLT) node 166a, or functionality for operating a QS DLT 167, e.g., for operating a distributed and / or shared ledger to store and / or access encrypted data items. In essence, the DLT nodes 166a-166b of the plurality of QS servers 103a-103c form the QS DLT network 167 configured to provide secure storage and access to one or more data items stored, for example, but not limited to, on a distributed and / or shared ledger. Process 150 of Figure 1f in step 154 ​​of providing a QREF locator may be further modified to include receiving a QREF locator for storing an encrypted data item on the distributed and / or shared ledger of QS DLT 167 and storing the encrypted data item on the distributed and / or shared ledger using the QREF locator as an address of the location of the encrypted data item on the distributed and / or shared ledger. Additionally, process 160 of Figure 1g in steps 161-162 may be further modified to include receiving a QREF access token from a second user for accessing an encrypted data item stored on the distributed and / or shared ledger of QS DLT 167, identifying the QREF access token and a QREF locator corresponding to the second user, and using the identified QREF locator associated with the QREF access token to access the encrypted data item on the distributed and / or shared ledger of QS DLT 167.

[0273] The QS network 101 requires that the hardware security modules (HSMs) 106a-106c of each of the QS servers 103a-103c contain at least an identical subset of QD keys or an identical set of QD keys stored internally that enables the QS servers to communicate securely in a quantum-safe manner with each other and the QS DLT 167 using one or more available QD keys from the set of QD keys. For example, the QS servers 103a-103c can use the same subset of QD keys to set up quantum-safe communication channels (e.g., using symmetric cryptography) with each other and the QS DLT 167 using quantum encryption based on one or more available QD keys from the subset of QD keys. The same set of QD keys, or at least a subset of the same QD keys, is distributed to each of the QS servers 103a-103c in a quantum-secure manner using quantum key distribution (QKD) based, by way of example only and not limitation, on satellite quantum key distribution (SQKD), optical quantum key distribution, fiber optic quantum key distribution, and / or any other quantum key distribution scheme capable of distributing the same set or subset of QD keys to the multiple QS servers 103a-103c in a secure and / or quantum-secure manner. Whatever QKD scheme is used, the updated set or subset of QD keys can be distributed to each of the QS servers 103a-103c and / or users 104a-104m as needed, and / or according to a schedule, etc., and / or depending on the application.

[0274] Additionally, each of the first set of users 104a-104m may also have a QS server and / or QS device that is part of the QS network 101, without limitation. The QS server and / or QS device of each of the first set of users 104a-104m may include functionality of a QS registration server / node. The QS server and / or QS device of each of the first set of users 104a-104m may include functionality associated with a QKD scheme for receiving a set of QD keys from a QKD source, such as over a quantum channel. The QS server and / or device of the first set of users 104a-104m may include an HSM having a set of QD keys stored therein, the set of QD keys being distributed to these devices using the QKD scheme used to distribute the set of QD keys to the QS servers 103a-103c of the QS network 101. For example, each QS server and / or QS device of the set of first users 104a-104m may communicate securely with QS server 103a-103c in a quantum-secure manner. One or more of the set of first users 104a-104m may also include a DLT node 166d and form part of a DLT network 167, which may cooperate with DLT node functionality when encrypted data items are stored and / or accessed from the QS DLT 167.

[0275] The QS system 165 includes a QS DLT 167, where the QS servers 103a-103c are configured to operate, for example, but not limited to, a distributed and / or shared ledger network, although those skilled in the art will recognize that other distributed and / or cloud-based technologies may be used to store and / or access data items, as described with reference to FIG. 1h and / or as described herein with reference to one or more of FIGS. 1a-7b. For example, the QS DLT 167 may be a repository system and / or storage system based on a digital storage platform using, for example, but not limited to, publish / subscribe, request / response, and / or real-time-based messaging (e.g., Diffusion Platform Messaging with PUSH Technology (RTM)). The QS network 101 further includes multiple QS servers 103a-103c, each including an HSM with the same set of QD keys stored therein. In this example, each QS server of the plurality of QS servers 103a-103c may include a digital storage platform node for computing / communicating digital storage platform messaging between corresponding nodes for storing / accessing data items. The digital storage platform nodes of the plurality of QS servers 103a-103c effectively form a distributed digital storage platform, and because QS communication channels are used between the QS servers 103a-103c, this forms a QS distributed storage network (e.g., a network powered by QS Diffusion) configured to provide storage and access to one or more data items based on digital storage platform messaging.

[0276] Thus, storing a data item in the QS decentralized storage network of the decentralized storage platform may include receiving a QREF locator for storing the encrypted data item in the node, the decentralized storage platform, and storing the encrypted data item in the shared ledger using the QREF locator as an address of the location of the encrypted data item in the decentralized storage platform. Accessing a data item in the QS decentralized storage network of the decentralized storage platform may include receiving a QREF access token from a second user for accessing the encrypted data item stored in the decentralized storage platform, identifying the QREF access token and a QREF locator corresponding to the second user, and accessing the encrypted data item in the decentralized storage platform using the identified QREF locator based on the access token.

[0277] Figure 1i is another schematic diagram illustrating a preferred exemplary QS system 165 and QS network 101 for use with the QS storage processes 110, 120, 150 of Figures 1b, 1c, and 1f and / or the QS access processes 130, 140, 160 of Figures 1d, 1e, and 1g in accordance with the present invention. For simplicity, reference numbers used in Figures 1a-1h for similar or identical features, components, or items are reused in Figure 1i. In this example, the QS system 170 uses both a QS DLT 167 for storing and / or accessing encrypted data items, as well as satellite quantum key distribution (SQKD) using multiple QS satellites 171a-171c configured to generate and distribute a set of one or more QD keys to QS servers 103a-103c of the QS network 101 and / or to QS servers and / or devices of a first plurality of users 104a-104c. Each of the QS servers 103a-103c and the QS servers or devices of the first plurality of users 104a-104c further includes one of a plurality of QS terrestrial satellite receivers or QS terrestrial receiver complexes (OGRCs) 172a-172f for receiving sets of QD keys distributed to the QS servers 103a-103c and the QS servers or devices of the first plurality of users 104a-104c from one or more of the QS satellites 171a-171c. For example, the QS server 103a includes an HSM 106a, a DLT node 166a, and an OGRC 172a coupled together.

[0278] Each of the QS servers 103a-103c has a hardware security module (HSM) 106a-106c that includes a set of QD keys stored therein. Each of the HSMs 106a-106c may have the same set of QD keys stored therein. Alternatively or additionally, each of the HSMs 106a-106c may have a set of QD keys stored therein where a subset of the set of QD keys is identical to a corresponding set of QD keys in one or more of the other HSMs 106a-106c. In any event, each of the HSMs 106a-106c contains the same set of QD keys or the same subset of QD keys stored therein, and the QD keys enable the QS servers 103a-103c to communicate securely in a quantum-safe manner with each other and with the QS DLT 167 using one or more available QD keys from the same set / subset of QD keys to form a QS network 101 having a quantum-safe boundary within which quantum-safe communication takes place between the QS servers 103a-103c, the QS DLT 167, etc. Additionally, each of the QS servers or devices of the first plurality of users 104a-104c may also have hardware security modules (HSMs) 106d-106f that also include an identical set / subset of QD keys stored therein, enabling those QS servers or devices to communicate securely, in a quantum-secure manner, with the QS servers 103a-103c and / or the QS DLT 167 of the QS network 101 using one or more available QD keys from the set / subset of QD keys. For example, the QS servers 103a-103c may use the identical set / subset of QD keys to set up quantum-secure communication channels with each other and with the QS DLT 167 using quantum encryption (e.g., symmetric encryption) based on one or more available QD keys from the set of QD keys. The set of identical QD keys is generated and distributed from one or more of the QS satellites 171a-171c using, for example, but not limited to, a group QKD protocol in which at least the QS servers 103a-103c of the QS network 101 have been distributed to them the set or subset of identical QD keys.The set of QD keys is deleted from the QS satellites 171a-171c once the QD keys have been distributed to all of the required QS servers 103a-103c of the QS system 170.

[0279] For example, the SQKD technology may include one or more QS satellites 171a-171c, which may be low-earth orbit satellites that pass over the geographic locations where the QS servers 103a-103c and / or the QS servers and / or devices of the users 104a-104c of the QS system 140 are located. The QS satellite 171a generates a set of one or more QD keys for delivery to each of the required QS servers 103a-103c and / or 104a-104c, etc. As the QS satellite 171a passes each QS server 103a-103c and / or 104a-104c, the QS satellite 171a may deliver the same set of QD keys (or a subset of QD keys) to each of the HSMs 106a-106f of the QS servers 103a-103c and / or 104a-104c via the terrestrial receiver complexes (OGRCs) 172a-172f. Each of the QS servers 103a-103c may include, for example, one of the OGRCs 172a-172c, HSMs 106a-106c, and DLT nodes 166a-166c, and one or more QS applications capable of storing and / or accessing data items associated with at least multiple users 104a-104c and 105a-105n. Each of the OGRCs 172a-172c may also include, for example, but not limited to, a terrestrial receiver (OGR) and / or a photon controller for communicating with one of the satellites 171a-171c when executing a QKD protocol, for example, but not limited to, receiving a QD key. The QS application may serve as an interface between the users 104a-104c and 105a-105n and the QS DLT 167 network of the QS network 101. The QS servers 103a-103c form the backbone of the QS network 101 and may be operated by a QS network provider. Each of the OGRCs 172d-172f of the QS server / devices of the first plurality of users 104a-104c may also include, for example, but not limited to, an OGR, a photon controller for communicating with one of the satellites 171a-171c when executing a QKD protocol, for example, but not limited to, receiving a QD key.Each of the QS servers / devices of the first plurality of users 104a-104c includes one of an OGRC 172d-172f, an HSM 106d-106e, and a DLT node 166d-166f coupled together.

[0280] The SQKD of the QS system 170 uses a group quantum key distribution (GQKD) protocol (also called a multicast protocol) that allows a single QD key, a set of identical QD keys, and / or a subset of identical QD keys to be distributed in a quantum-secure manner among the QS servers 103a-103c and / or the QS servers or QS devices of the users 104a-104c located at many individual / different geographic locations or sites. In particular, the purpose of the GQKD protocol may be for key sharing, such as, but not limited to, sharing the same set of QD keys or multiple QD keys with two or more or multiple QS servers 103a-103c and / or 104a-104c and / or QS-enabled devices. The GQKD protocol is effectuated by a QS system 170, in which a QS satellite 171a generates and establishes one or more QD keys or sets of identical QD keys between the QS satellite 171a and one or more QS servers 103a-103c or QS servers of users 104a-104c. For example, QS satellite 171a stores a digital copy of a QD key, then distributes the QD key or set of QD keys in a quantum-secure manner to a first QS server 103a, and then distributes the same QD key or set of identical QD keys distributed to the first QS server 103a to one or more subsequent QS servers 103b-103c and / or the QS servers of one or more users 104a-104c as QS satellite 171a passes through or comes within range of those subsequent QS servers 103b-103c and / or the QS servers of one or more users 104a-104c. The QD key or set of QD keys stored on QS satellite 171a is deleted once all intended QS servers 103a-103c and / or the QS servers / devices of users 104a-104c have received it.

[0281] The QS network 101 is formed by multiple QS servers 103a-103c, the QS servers and / or devices of a first plurality of users 104a-104c, and a QS distributed ledger technology (DLT) 167 for storing and accessing data items associated with the first plurality of users 104a-104c and a second plurality of users 105a-105n. The QS network 101 requires that each Hardware Security Module (HSM) 106a-106e of the QS servers 103a-103c and / or the QS servers and / or devices of the first plurality of users 104a-104c includes a set of QD keys stored therein, with at least a subset of the QD keys being identical to corresponding subsets of QD keys on other HSMs. This allows the QS servers / devices to communicate securely with each other and the QS DLT 167 in a quantum-safe manner (e.g., using symmetric quantum-safe cryptography) using one or more available QD keys from the set of QD keys. For example, QS servers 103a-103c may use the same set of QD keys, each associated with a unique QD key identifier that is the same for each HSM, so as to set up quantum-safe communication channels with each other and the QS DLT 167 using quantum cryptography and / or encryption algorithms based on one or more available QD keys from the set of QD keys.

[0282] The QS DLT 167 may be a distributed and / or shared ledger for storing data items, such as, but not limited to, multiple users 104a-104c and / or 105a-105n. Each QS server 103a of the multiple QS servers 103a-103c of the QS network 101 includes a hardware security module (HSM) 106a having the same set of QD keys (or the same subset of QD keys) stored therein, and each QS server 103a of the multiple QS servers 103a-103c includes a distributed ledger technology (DLT) node 166a, or functionality for computing the QS DLT 167 when storing and / or accessing encrypted data items stored in the QS DLT 167. In this example, in addition to the DLT nodes 166a-166c or QS servers 103a-103c that include DLT node functionality for computing the QS DLT 167, each of the first set of users 104a-104c may also have, without limitation, QS servers and / or QS devices that are part of the QS network 101. The QS servers and / or devices of the first set of users 104a-104c may include HSMs 106d-106e having a set of QD keys stored therein, and DLT nodes 166d-166e. Thus, the QS servers 103a-103c include DLT nodes 166a-166c or DLT node functionality for computing the QS DLT 167, and each of the first set of users 104a-104c includes a DLT node 166d-166f or DLT node functionality for computing the QS DLT 167, and thus forming a QS DLT network. In essence, the DLT nodes 166a-166f of the multiple QS servers 103a-103c and 104a-104c form a QS DLT network 167 configured to provide secure storage and access to one or more data items stored in a distributed and / or shared ledger.

[0283] By way of example, distributed ledger (DLT) nodes 166a-166f are configured to form QS DLT 167 of QS network 101 of QS system 140, and corresponding QS servers 103a-103c and 104a-104c form QS network 101 because they are connected via QS communication channels using satellite quantum key distribution (SQKD) keys (e.g., QSD keys) to create QS communication channels for DLT nodes 166a-166f to communicate through. Thus, QS servers 103a-103c and 104a-104c may communicate with each other via these QS communication channels to form QS network 101. The QS DLT 167 is secured using SQKD, enabling the QS servers 103a-103c and / or 104a-104c of DLT nodes 166a-166f to operate QS dynamic communication channels. All of the QS servers 103a-103c and 104a-104c form the QS network 101, and any communication between the QS servers 103a-103c, 104a-104c is secured by the QS communication channel, meaning that data in transit within the QS network 101 or stored within the QS DLT 167 (essentially stored in a distributed / shared ledger on the DLT nodes 166a-166e) is protected and quantum safe.

[0284] The second plurality of users 105a-105n may be subscribers to one or more of the QS applications provided by the QS servers 103a-103c that use the QS DLT 167 to store, retrieve, and / or access data items stored in the QS DLT 167. The devices and / or servers used by the second plurality of users 105a-105n are not QS because these devices are typically not capable of QKD, particularly SQKD using the QS satellites 171a-171c. Thus, the devices / servers of the plurality of users 105a-105n may operate on a non-QS network 102 (e.g., the Internet, a public network with unencrypted traffic and / or using non-QS encrypted traffic, etc.) and interface with the QS network 101 via QS applications running on one or more of the QS servers 103a-103c of the QS network. A QS server 103a-103c that interfaces with one or more devices of users 105a-105n, for example via a QS application, may be considered to be on the "quantum secure boundary" of the QS network 101.

[0285] The QS system 170 provides the advantage of mitigating the risk of denial-of-service attacks against individual terrestrial QS servers and / or individual quantum receivers (e.g., OGRs) because there will be many QS servers 103a-103c and / or QS servers of users 104a-104c with identical SQKD infrastructure, making simultaneous attacks on the QS system 170 and / or QS network 101 impractical for most, if not all, attackers. Furthermore, denial-of-service attacks are only practically possible by physically hiding the terrestrial receivers (e.g., OGRs) of the QS servers 103a-103c and / or QS servers of users 104a-104c and their ability to see the QS satellites 171a-171c. However, even if the OGRs could be hidden, this would be immediately apparent to the QS providers of the QS network 101 and could be further mitigated by the use of cameras and tamper switches built into each OGR, and / or manual human or drone access control and inspection of the OGRs of each QS server 103a-103c and / or user 104a-104c's QS servers. Furthermore, given that most, if not all, QS servers 103a-103c have DLT nodes 166a-166c, this would create large-scale duplication of DLT records and / or data items stored in the QS DLT 167 across many DLT nodes 166a-166c. This would also make simultaneous, comprehensive DoS attacks impractical.

[0286] QS systems 100, 165, and 170 may be further modified such that each QREF locator is divided or subdivided into multiple atomic units, with each atomic unit of the QREF locator being stored on a different QS server 103a-103c of QS network 101. For example, a QREF locator may be subdivided into three atomic units, with QS DLT 167 configured to operate such that each atomic unit of the QREF locator is stored on a different subset of DLT nodes 166a-166f of QS servers 103a-103c or 104a-104e of QS DLT 167. For example, in the case of a QREF locator divided into atomic units A, B, and C, by way of example only and not by way of limitation, the QS DLT 167 may include a network of, for example, but not by way of limitation, 99 DLT nodes, and the atomization is replicated so that 33 of the DLT nodes store unit atomic A, 33 of the DLT nodes store atomic unit C, and 33 of the DLT nodes store atomic unit C. Thus, in the style of the RAID5(RTM) concept, the QS DLT 167 is configured such that in every third atomic unit (A, B, or C) it stores a hash of one of the other atomic units (A, B, or C), and each atomic unit requires a unique QKD code or QD key. While dividing QREF locators into atomic units is described, this is by way of example only, and the invention is not so limited; those skilled in the art will recognize that securely storing and / or accessing QREF locators as atomic units may be implemented in various ways and / or based on RAID concepts (e.g., RAID 0-6), parity functions and / or methods, single parity systems and / or general parity systems and / or methods, methods for delivering, replicating, and securely storing data as chunks, combinations thereof, modifications thereof, etc., and / or as described herein and / or depending on the application.

[0287] Figure 1j is another schematic diagram illustrating the exemplary QS system 175 of Figures 1a-1i using SQKD and configured with registration servers and nodes in accordance with the present invention. QS system 175 and QS network 101 may be configured for use with QS storage processes 110, 120, 150 of Figures 1b, 1c, and 1f and / or QS access processes 130, 140, 160 of Figures 1d, 1e, and 1g in accordance with the present invention. For simplicity, reference numbers used in Figures 1a-1i for similar or identical features, components, or items are reused in Figure 1j. In this example, the QS system 175 uses both a QS DLT 167 for storing and / or accessing encrypted data items, and also satellite quantum key distribution (SQKD) using multiple QS satellites (not shown) configured to generate and distribute one or more sets of QD keys to multiple QS servers 103a-103c and 176a-176b of the QS network 101. Each of the QS servers 103a-103c and 176a-176b further includes, for example but not limited to, one of multiple QS terrestrial satellite receivers (not shown) for receiving the same sets of QD keys distributed to the QS servers 103a-103c and 176a-176b from one or more of the QS satellites.

[0288] In this example, some of the QS servers 103a-103c and 176a-176b are configured to be registration servers, which may be QS servers with HSMs and further registration modules / storage and / or applications. For example, QS servers 176a and 176b are configured to be registration servers 176a-176b that handle, for example, but not limited to, the registration, maintenance, verification, and authentication of registered users 105a-105n and their corresponding user accounts in QS system 175. Registration server 176a is communicatively coupled to multiple registration nodes 177a-177p, and registration server 176b is communicatively coupled to multiple registration nodes 178a-178r. Registration nodes 177a-177p and 178a-178r and registration servers 176a and 176b are configured to handle, for example, but not limited to, at least the setup of user accounts and the registration of users in QS system 175. Similarly, when data items associated with a user are stored in QS DLT 167, the corresponding QREF locators associated with the data items are linked or issued to the user account. Thus, whenever a user submits data items for storage, or when the user grants permission for someone else to access the data items in some manner, the corresponding QREF locators associated with those data items are linked to the user account. That is, the user is issued a QREF locator for the registered account. This enables the QS server or registration server to identify all of the QREF locators associated with the user and perform QREF locator identification using a secure memory or hardware security module, as described with reference to access processes 130, 140, 150, and 160 with reference to FIGS. 1d-1g. Essentially, each of the registration servers 176a-176b provides a first point of contact or communication for each of one or more registered users of the plurality of users 105a-105n external to the QS system 175 and the QS network 101.

[0289] In addition to issuing or linking QREF locators to user accounts in association with data items associated with registered users stored in the QS DLT 167, registration nodes 177a-177p and / or 178a-178r and registration servers 176a-176b are used to identify registered users who have their accounts in the QS system and subsequently issue data items associated with the registered users if the users have permission to do so. For example, when a user submits one or more QREF access tokens to access data items requested by the user from the QS DLT 167, registration server 176a of QS system 175 is configured to perform authentication and / or verification of the user submitting the QREF access token, which may include two-factor authentication, etc., first to securely identify the user and the user's account and verify that the user is a user registered with the QS system 175, and second to identify the set of one or more QREF locators issued to the registered user. This set of one or more QREF locators may be used to identify a QREF locator that generates a submitted QREF access token, as described herein. Data items corresponding to the QREF locators may be retrieved and / or accessed, and users may be issued access to the data items in connection with their registration.

[0290] Thus, the QS network 101 is formed by multiple QS servers 103a-103c, registration servers 176a-176b, registration nodes 177a-177p and 178a-178r, and a QS distributed ledger technology (DLT) 167 for storing and accessing data items associated with a first plurality of users (not shown) and a second plurality of users 105a-105n. The QS network 101 requires that the hardware security module (HSM) of each of the QS servers 103a-103c and / or registration servers 176a-176b includes a set of QD keys stored therein, with at least a subset of the QD keys being identical to corresponding subsets of QD keys on other HSMs. This enables the QS servers / registration servers and registration nodes to securely communicate with each other in a quantum-safe manner (e.g., using symmetric quantum-safe cryptography). Note that registration servers 176a-176b act as secure gateways between QS DLT 167 and multiple registration nodes 177a-177p and 178a-178r. Thus, only QS servers 103a-103l and registration servers 176a-176b can directly connect to QS DLT 167 using one or more available QD keys from the set of QD keys. For example, QS servers 103a-103l can use the same set of QD keys, each associated with a unique quantum key identifier that is the same for each HSM, to set up quantum-secure communication channels with each other and with QS DLT 167 using quantum encryption based on one or more available QD keys from the set of QD keys. Similarly, the registration servers 176a-176b may use the same set of QD keys as those used by the QS servers 103a-103l, each associated with a unique quantum key identifier that is the same for each HSM so as to set up quantum-secure communication channels with each other and with the QS DLT 167, and also with one or more QS servers 103a-103l using quantum encryption based on one or more available QD keys from the set of QD keys.

[0291] Furthermore, registration servers 176a-176b are each connected to multiple registration nodes 177a-177p and 178a-178r, respectively. Registration nodes 177a-177p are connected to registration server 176a via QS channels. Registration server 176a uses its HSM to provide each of registration nodes 177a-177p with an available QD key from the set of QD keys. Thus, once deployed, each registration node 177a-177p can form a QS communication channel to the corresponding registration server 176a. Similarly, registration server 176b is each connected to multiple registration nodes 178a-178r. Registration nodes 178a-178r are connected to registration server 176b via QS channels. Registration server 176b can use its HSM to provide each of registration nodes 178a-178r with an available QD key from the set of QD keys. Thus, once deployed, each registration node 178a-178r can form a QS communication channel to the corresponding registration server 176b. Registration nodes 177a-177p and 178a-178r may form part of the QS boundary separating users 105a-105n from the QS network 101 and QS system. Alternatively or additionally, prior to deployment, one or more of registration nodes 177a-178r may be directly connected to QS server 103a-103l and / or registration server 176a or 176b for configuration and uploading of one or more available QD keys from the same set of QD keys stored in the HSM of each of QS servers 103a-103l and / or registration servers 176a-176b. Thus, once registered nodes 177a-177p and / or 178a-178r are deployed, these registered nodes can connect over the public telecommunications network and form a QS channel using the QD key provided during configuration.

[0292] Each of the registration nodes 177a-177p or 178a-178r may be located in different locations, e.g., stores and / or buildings to which users may connect in myriad ways. For example, the registration node may be used to perform a registration process to register a device with the QS system 175 prior to deployment of the device to the corresponding user. Additionally, as part of the registration process, the registration node 177a-177p or 178a-178r may be configured to physically connect to the device and upload one or more QD keys from a set of QD keys to a secure memory area (e.g., a secure enclave) on the device, where the one or more QD keys are registered against the device identifier. Thus, the device may be able to set up a QS communication channel with the registration node and / or registration server after the QD key is delivered to the user. This allows QS communication to be achieved securely for the device user, who can use the QS system 175 described herein in a QS manner.

[0293] The registration process may be performed at the time of device shipment, such as, but not limited to, at the manufacturer, which may have a QS server and / or registration node that allows devices to be registered before shipment. Alternatively or additionally, the registration process may be performed at the point of sale or prior to deployment, such as, but not limited to, at a retail store that has a QS server and / or registration node. In either case, these locations (e.g., the manufacturer and / or retail shipment) may be referred to as registration locations, and each registration location (e.g., a registration node) is required to have access to a set of QD keys. In this case, either the registration nodes have the capabilities of the QS servers 103a-103l, effectively making them registration servers, or the registration nodes may be deployed with a set of QD keys to enable them to communicate with the registration server and / or QS server over the QS channel, and thus may have the set of QD keys distributed at regular intervals or schedules, etc. During the registration process, the device is connected to the registration node 177a or registration server 176a via a physical connection that allows the registration node 177a or server 176a to deposit (or upload) one or more QD keys into the device's secure memory (e.g., secure enclave). At this point, the registration node 177a or server 176a may also upload or preload a QS or QREF application that configures the device to establish a QS communication channel with the QS system via one or more registration nodes 177a-177p or 178a-178r, registration servers 176a-176b, and / or QS servers 103a-103l using the one or more QD keys stored in the secure memory. The QREF application may enable the device's user to establish a QS communication channel and store and access data items in the QS system 175.

[0294] Once the device is received by the user 105i, the user 105i can use the device to establish a QS connection with the QS system via registration node 177p using the previously uploaded QD key. Once connected, the user can register themselves and obtain a QREF account that is set up by registration server 176a. The QREF account can be associated with the device via a device identifier such that the QD key on the device is registered with the user's QREF account. Alternatively or additionally, the QREF account can be associated with a QREF application loaded on the device. Once the user registers with the QS system 175 and has a QREF account, the user can use the QREF application to retrieve the QD key stored in the device's secure memory to establish a QS communication channel with the QS system 175, and use the QD key with a symmetric algorithm hosted within the QREF application to establish a quantum-secure communication channel with the QS system 175. The established quantum-secure channel may be used by users engaged in any use case and / or application related to the QS system (e.g., access data items, store data items, KCY, QREF certificates, depositories, quantum-secure communication with registered users of the QS system).

[0295] In another example, one or more registration nodes 177a-177p and / or registration server 176a may be configured to retroactively configure a user's (e.g., a mobile phone user's) device to be able to install QREF application or firmware modifications that enable the user to operate the device to establish a QS communication connection with the QS system 175 and / or QS network 101 and access and / or use the QS system 175 in a quantum-safe or at least quantum-resistant manner.

[0296] In another example, user 105a may be required to visit a store or retail outlet (e.g., a QREF-enabled store) that has registration node 177a in order for user 105a to register with the QS system and / or receive a device capable of establishing a QS connection with the QS system over a public network. The registration node may be a secure, single-purpose device including an HSM with a single physical output connection (e.g., a single USB port output (output only)) with a simple user interface screen. In some embodiments, the registration node may be configured to only allow an operator to press a button to export numbered QD keys from the set of QD keys on the HSM via the physical output connection to the user device. In this manner, the device may be preloaded with a finite number of pre-agreed QD keys. This allows user 105a to purchase and receive a device from a store that has registration node 177a; in this case, because the device is preloaded with QD keys, the user can use the device to set up a general QS channel; the user can then register with the QS system and establish a QREF account associated with the user. Alternatively or additionally, a user may bring their device to a store with registration node 176a, where they may upload several one or more QD keys to the device via a physical output connection of registration node 177a. The device user can then operate the device to establish a quantum-secure channel using the uploaded one or more QD keys, within which user 105a sets up a QREF account in QS system 175 associated with user 105a. The user may then use the QS channel to retrieve further personalized QD keys, etc.

[0297] In another example, rather than requiring the user 105a to visit a retailer or store having the registration server 177a, a secure storage medium having one or more QD keys stored therein may be shipped to the user. The secure storage medium may be shipped via, for example, but not limited to, the postal system, mail, courier and / or delivery services, secure data delivery services, and / or any other suitable secure data delivery, transportation and / or logistics support infrastructure for delivering confidential and / or sensitive material, data, etc. For example, the secure storage medium may be, for example, but not limited to, a single-use dongle, a secure digital (SD) card, etc., a secure USB stick, a mobile phone SIM card, a password-encrypted flash drive, a portable HSM, and / or any suitable secure storage medium and / or storage medium and / or tamper-proof or tamper-resistant storage medium that can be secured and tamper-proof, such as depending on the application. In any case, the user 105a receives the secure storage medium having one or more QD keys stored therein.

[0298] The secure storage medium may be configured for single use with a one-time generic QD key stored therein, which would enable the user 105a to connect the secure storage medium to their device and set up a quantum-secure channel using the one-time generic QD key and / or various two-factor authentication and / or other authentication mechanisms for use in, for example, but not limited to, registering their user account, registering their device, and / or uploading / downloading their device's QREF application and a set of one or more additional QD keys assigned by the registration server 176a and transmitted to their device via the registration node 177a over a QS channel.

[0299] In a further example, user 105b's device may be enrolled in the QS system using a quantum-safe pathway based on the use of two-factor authentication and / or any other secure multi-path and / or encrypted authentication protocol / mechanism. In this case, the QS system 175, via one or more components or modules of QS servers 103a-103l and / or registration servers 176a-176b, may include, for example, but not limited to, a quantum random number generator, a cryptographically secure pseudorandom number generator (CSPRNG), a CSPRNG called NIST Light (RTM), any other suitable CSPRNG, etc., depending on the application. Furthermore, client QS application software (e.g., a QREF application) may be installed on user 105b's device to enable user 105b to establish a QS channel with the QS system 175, such as via registration node 177b and / or registration servers 176a-176b. The client QS application software may include additional functionality such as, but not limited to, a random number generator suitable for the device, such as, for example, the client CSPRNG and / or the CSPRNG called NIST Light, and / or any other suitable CSPRNG for use on the device of user 105b.

[0300] Once the QREF application is installed, the CSPRNG of user 105b's device may have a corresponding CSPRNG running within QS system 175. In particular, the QREF application may include an application programming interface (API) that allows CSRNG functionality to be installed in the secure memory / processing unit of user 105b's device. For example, the API may utilize, for example, but not limited to, Software Guard Extension (SGX) (RTM) and / or other client HSM-type solutions suitable for user 105b's device that allow the API to embed CSRNG functionality in the device's secure memory / processing unit. For example, once installed on user 105b's device, the QREF application may be configured to embed, for example, but not limited to, a CSRNG NIST Lite random number generator in a secure memory / processing unit, such as a secure chipset or secure enclave in user 105b's device's chipset (e.g., Intel chipsets with Intel Software Guard Extensions (SGX) are considered highly secure by security / cryptography officials). Intel (RTM) SGX includes an instruction set or code for increasing the security of application software and data, providing increased protection against disclosure, modification, and / or tampering, etc. Sensitive information may be partitioned into one or more enclaves, which are dedicated execution regions in memory with increased security protection. The secure memory / processing unit may include a secure enclave or secure chipset, such as an Intel chipset with SGX, as described herein, but this is by way of example only and the invention is not so limited, and the secure memory / processing unit may be implemented using any other suitable type of secure chipset / memory / system / enclave / HSM / component, etc., depending on the application, etc.

[0301] The registration process may include the following steps: User 105a may use a device to browse the public Internet and access a secure website and / or secure web server that cooperates with registration node 177b and / or registration server 176a to register an account with QS system 175, and may also configure and / or set up the user's device for QS communication, QS storage and access, and / or any other use case suitable for cooperation with QS system 175. During registration via the web server, the user simultaneously communicates with the QS system via another second one or more transmission paths (e.g., making a mobile call from the user's device or another device, e.g., a mobile phone or landline) to deliver two-factor authentication of or from the user to QS system 175 during the user's registration and setup of the user account in QS system 175. User 105b's device is registered with the user account. Two-factor authentication may be delivered by the user using voice commands during communication via the second one or more transmission paths.

[0302] The registration node 177b or registration server 176a may be configured to process the 2FA factor from the user 105b and display the number displayed on the website on the screen of the user's 105b's device. This may be used to verify the user's 105b's identity and arrange for the device to receive a QREF application that enables the user 105b to use the device to establish a QS communication channel with the QS system 175. The registration server 176a or QS servers 103a-103l may assign the user 105a a QD key for use with the user's device. The assigned QD key is embedded in the device's QREF application and / or delivered to the user's 105b's device along with the QREF application download. Once the device receives the QREF application download from the web server and / or the registration node 177b or registration server 176a, the QREF application operates to install or embed a CSPRNG (e.g., CSPRNG NIST Lite) in the device's secure memory. For example, if the device has a suitable Intel (RTM) chip, the QREF application inserts the CSPRNG NISL Lite (RTM) into the device's Software Guard extension. The QREF application is then configured to insert or input the QD key into the CSPRNG embedded in the device's secure memory / processor.

[0303] The QS system 175 also transmits a QR code or image to the user 105a's device and / or another device of the user 105a for display on the device's screen. The QR code or image represents the user's two-factor authentication. The user inputs data representing the QR code or image into a CSRNG embedded in a secure memory / processor. The CSRNG processes the input QD key and the input data representing the QR code or image. For example, the user 105b may see a QR code on the screen of the user's device that represents the user's 2FA. For example, but not by way of limitation, the user 105b may take a photograph of the QR code displayed on the screen, take a screenshot, or create an image of the QR code displayed on the screen in a suitable manner. The user 105b inputs the photo of the QR code into a QREF application, which inserts the QR code and QD key into a CSRNG in secure memory (e.g., a secure enclave). The CSRNG outputs a new QREF key or number. Simultaneously, or in a similar manner, QS servers 103a-103l, registration servers 176a-176b, and / or registration nodes 177a-177p and / or 178a-178r may be configured to input data representing user 105b's 2FA and the QD key assigned to the QREF application on user 105b's device into a corresponding CSRNG and output a new QREF key or number associated with user 105b's user account.

[0304] The CSRNG embedded in the device and the corresponding CSRNG in the QS system 175 both generate the same QREF key or number. Given this, the QREF application is configured to establish a quantum-secure communication channel with the QS system 175 using the output QREF key or number. This is performed by the QREF application logging user 105b into the QS system 175 via registration node 177b, which can retrieve the user account details and the associated QREF key or number previously calculated by the QS system 175, which is the same as the QREF key or number calculated by the CSRNG embedded in user 105b's device. This then allows registration node 177b and user 105b's device to establish a QS communication channel with both sides using the same QREF key or number. The channel can be encrypted using a symmetric cipher using the QREF key or number.

[0305] Once a QS channel is established between the device and registration node 177b of QS system 175, one or more new dedicated QD keys for user 105b's device, or even a set of dedicated QD keys for user 105b's device, are created and / or assigned from the set of QD keys of the HSM mesh of QS servers 1034a-1031. The one or more new dedicated QD keys may be assigned or mapped to a user account or associated with user 105b for use in current / future QS communications between the device and QS system 175. The one or more new dedicated QD keys and / or set of dedicated QD keys are transmitted via the established QS communication channel to a QREF application running on user 105b's device. The QREF application is configured to receive the one or more new dedicated QD keys and deposit these new dedicated QD keys into a secure memory / processor (or secure enclave, etc.) of user 105b's device. For example, the QS system 1765 may send one or more new dedicated QD keys inside a QS communication channel to the device of user 105b if the device has an Intel chipset and deposit these new dedicated QD keys in the Software Guard extension. The QREF application may be configured to establish a more secure QS communication channel with the QS system 175 (e.g., via registration nodes 177a-177p or 178a-178r) using the one or more new dedicated QD keys.

[0306] 1a-1j, where SQKD is used and the QS system 180 is configured to include a QS security gateway / registration server 182 and registration nodes 184a-184p. In this example, the QS system 180 includes multiple QS servers 103a-103l associated with the QS system 180, multiple QS servers operated by users 104a-104c (e.g., businesses, customers requiring QS servers), a QS security gateway / registration server 182, a distributed ledger 167, and multiple satellites 171a-172c, including, but not limited to, a low-earth-orbit satellite constellation. These are connected together via QS channels to create a QS network 101, such as over a public communications infrastructure or other network and / or dark fiber. The QS network 101 is considered a QS domain. Each QS server 103a of the multiple QS servers 103a-103l and / or the QS servers operated by users 104a-104c may include a DLT node 166a-166l, one or more registration applications, a terrestrial receiver or OGRC 172a-172l, and an SQKD on an HSM (not shown). As described with reference to Figure 1i, this enables the QS servers 103a-103l and the QS servers operated by users 104a-104c to receive a set of one or more identical QD keys multicast from one of the satellites 171a of the satellite constellation to the corresponding OGRC 172a-172l as the satellite 171a passes through that OGRC 172a-172l of each QS server 103a-103l.

[0307] Multiple users 105a-105n may operate devices over a public network 102 (e.g., the Internet and / or any other type of communications network) or a non-QS network / domain 102. Multiple users 105a-105n may register with QS system 180 via registration nodes 184a-184p and security gateway / registration server 182. Security gateway / registration server 182 is configured to provide necessary network security (e.g., user authentication, verification, 2FA, etc.) to ensure that only those users 105a-105l who are registered users of QS system 180 can access the services and / or applications of QS system 180 and to prevent other users from accessing QS system 180 and / or the services / applications. Such users will be required to register a user account with QS system 180 via registration nodes 184a-184p. Once registered, each user 105a of the plurality of users 105a-105n and / or one or more devices of each user 105a may be associated with a user account stored in the DLT 167 of the QS system 180. Using the registered device, the user 105a may enter the user's credentials into a QS website or QS web server operated by one or more associated registration nodes 184a-184p. In a similar manner, the QS system 180 may be operated and / or used as described with reference to Figures 1a-1j and / or as described herein.

[0308] There are various types of users that may use the QS system 180. For example, users 104a-104c may operate QS servers / devices that include OGRCs 172m-172o installed at their endpoints and thus receive sets of QD keys to operate over QS channels within the QS network 101 of the QS system 180. These may be large customers, such as organizations, businesses, or the like, that may operate the technology and equipment required to be part of the QS network 101. These users 104a-104c that host OGRCs 172m-172o and / or HSMs (not shown) may use them for registration and QD key distribution via satellites 171a-172c and / or via QS servers 103a-103l of the QS network 101. The endpoints / servers of users 104a-104c may also include DLT nodes 166m-166o, which may assist in computing / forming the QS DLT 167.

[0309] Users 105a-105n may interact with the QS network 101 or public network 102 outside the QS domain. Such users 105a-105n may use user or customer endpoint devices, such as, but not limited to, mobile phones, smartphones, laptops, servers, IoT devices, and / or computing / communications equipment and / or devices, but do not have the capabilities or equipment required to operate an OGRC and / or HSM, etc., and therefore rely on registration nodes 184a-184p for registration and delivery of dedicated QD keys to establish a QS communication channel with the QS system 180 and / or QS network 101. In contrast, users 104a-104c are essentially guaranteed (because they can form QS channels) that their devices / servers, etc. can utilize QS communications, QREF locators, and access tokens to QS storage and / or access to data items, and / or other QREF locator / access token use cases, combinations thereof, modifications thereto, and / or as described herein, except that users 105a-105n and / or their corresponding devices must be registered with QS system 180 and / or have access to corresponding QD keys, etc., in a quantum-secure manner before they can utilize QS communications, etc.

[0310] As discussed above with reference to FIG. 1j, there are several options for users 105a-105n to register with the QS system 180 and the QS network 101 and ensure that their devices have the capabilities for QS communication, QREF locators and access tokens, QS storage and / or access to data items, and / or other QREF locator / access token use cases, combinations thereof, modifications thereto, and / or other QREF locator / access token use cases described herein. One option is to receive a device or endpoint device shipped from a manufacturer or retailer preloaded with a QREF application and / or one or more QD keys from a set of QD keys to establish QS communication with the QS system. Another option is for user 105b's device (or endpoint device) to download, for example, but not limited to, a QREF application and / or software configured to register user 105b and / or establish QS communication with the QS system. A further option may be, for example, but not limited to, a retail store or other service / outlet hosting an HSM that is used to inject or preload the QREF application and / or one or more QD keys into a user device or user endpoint device via a hardwired connection. This may be accomplished using a retail store device with the user device connected to the retail store device by a hardwired connection. The retail store device may be a tamper-proof and / or tamper-resistant device and may include, but is not limited to, an operator button (e.g., a simple push button) that a retail store operator or user presses / pushes, causing the retail store device to perform only one task: the injection of one or more QD keys and / or QREF applications into the secure storage / processing unit (e.g., a secure enclave or Intel SGX (RTM)) of the user device and / or endpoint device.One task button and retail device is designed to prevent an operator or other malicious actor from accessing or attempting to access the QD key and / or QREF application when inserted / downloaded into a user device or endpoint device.

[0311] For example, as discussed above with reference to FIG. 1j, a device for user 105a of multiple users 105a-105n may optionally be shipped new from the manufacturer with the QREF application preloaded on the device's operating system. The device may be configured to have a secure enclave with a QD key stored therein, which the QREF application may use within the secure enclave to establish a QS communication channel with registration node 184a of QS system 180. Thus, when the device is shipped to user 105a, it is configured to run the QREF application via the secure enclave on the device, using the QD key, etc., to establish an anonymous preliminary QS communication channel between the user's device and registration node 184a. This QS communication channel allows user 105a of the device to register and / or set up a QS user account with QS system 180 using the preliminary QS secure channel. From this, user 105a may be assigned a QD key, etc., that is associated with the user's user account in QS system 180 and downloaded to a secure enclave on the device via a preliminary QS channel, thereby enabling user 105a to establish a QS channel with the QS system, enabling the user to use their device in, for example, but not limited to, QS communications, QS storage and / or access to data items using QREF locators and access tokens, and / or other QREF locator / access token use cases according to the present invention and / or described with reference to Figures 1a-7c, combinations thereof, modifications thereto, and / or described herein.

[0312] Further, as discussed above with reference to FIG. 1j, in the above alternative, the registration process may involve, for example, but not limited to, user 105b's device downloading a QREF application or software configured to establish a QS channel between user 105b's device and QS system 180 and register user 105b with QS system 180. User 105b's device may connect to registration node 184a and download the QREF application for registering and establishing a QS connection with QS system 180. Once user 105b's device downloads the QREF application, user 105b's device is configured to combine use of the quantum-secure channel created in the QREF application with a set of two-factor authentication (2FA) challenges to create a new quantum-secure channel. Given that downloading a QREF application is typically not quantum-secure, the establishment of the new quantum-secure channel is quantum-secure because it uses a combination of 2FA (e.g., voice commands) and temporary user enrollment data provided by user 105b during registration and the 2FA setup and authentication process. The QREF application and 2FA challenge may be used to create a symmetric QREF key at the device and also create the same QREF key at the QS system 180 so that a QS channel may be established between the user's 105b device and the QS network, such as via registration node 184a and security gateway / registration server 182, using symmetric cryptography using the same QREF key.This allows user 105a to use an existing device with a secure enclave and / or secure memory / processor to establish a QS channel with the QS system, enabling the user to use their device for, for example, but not limited to, QS communication, QS storage and / or access to data items using QREF locators and access tokens, and / or other QREF locator / access token use cases according to the present invention and / or described with reference to Figures 1a-7c, combinations thereof, modifications thereto, and / or described herein.

[0313] 11 is a further schematic diagram illustrating an exemplary QS system 190 using terrestrial quantum key distribution in accordance with the present invention. The QS system 190 includes multiple QS servers 103a-103c, a QS DLT repository 167, one or more security gateway / registration servers 182a-182m, and multiple registration nodes 184a-184m, connected together via QS channels established using multiple QD keys from a set of QD keys stored in one or more HSMs (not shown) within one or more QS servers 103a-103c, and / or one or more security gateway / registration servers 182a-182m, etc. The QS network 101, having QS channels formed between multiple QS servers 103a-103c, a QS DLT repository 167, one or more security gateway / registration servers 182a-182m, and multiple registration nodes 184a-184m, forms a QS boundary within which QS communications occur between at least multiple QS servers 103a-103c and the QS DLT repository. The multiple registration nodes 184a-184m form the edge of the QS network 101 and are the contact points for multiple users 105a-105n who operate devices within a public telecommunications infrastructure, a so-called non-quantum-secure network 102, such as, but not limited to, the public Internet, a telecommunications network, or a public service telecommunications network.

[0314] Rather than having a satellite constellation with multiple satellites 171a-171c as described with reference to Figures 1i-1k, the QS system 190 forms a QS network 101 based on at least multiple QS servers 103a-103c, each of which includes a terrestrial QKD transceiver 193a-193c for creating and delivering a set of one or more QD keys to its HSM (not shown) across a QS channel via a public infrastructure, such as, but not limited to, the Internet and / or a dark fiber network. Dark fiber is preferably used for communication between the QS servers 103a-103c and / or the QS DLT repository 167. This not only reuses already deployed but unused optical fiber resources, but also enables the use of quantum key exchange, such as using photons, to generate sets of QD keys for use by the QS system 190. Terrestrial QS system 190 uses terrestrial QKD transceivers 192a-192c across dark fiber, which can limit the transmission distance of the dark fiber between data centers, such as QS network 101. Thus, terrestrial QS system 190 may be deployed in metropolitan areas and / or urban centers, etc., until future improved dark fiber allows for longer or greater transmission distances and / or can be extended to larger areas / regions, etc., using secure repeaters / routers. Alternatively or additionally, while terrestrial QS system 190 is described with reference to using terrestrial QKD transceivers and establishing QS channels over a dark fiber communications infrastructure, this is by way of example only, and it should be recognized by those skilled in the art that terrestrial QS system 190 may be combined and / or modified to use one or more features of one or more other QS systems 100, 165, 170, 175, 180, as described with reference to FIGS. 1a-1k and / or depending on the application.

[0315] Users 105a-105l may register and / or use the QS system 190 in a similar or identical manner as described with reference to Figures 1a-1k by connecting to one or more registration nodes 184a-184m or, if possible, one or more registration servers and / or QS servers, which may include registration node and / or registration server applications for establishing connections with devices of the one or more users 105a-105l. Preferably, user devices or endpoint devices of users 105a-105l may connect to the QS system by connecting to registration nodes of multiple registration nodes 184a-184m to perform, for example, but not limited to, QS communications, QS storage and / or access to data items using QREF access tokens described herein, and / or other QREF access token use cases according to the present invention and / or described with reference to Figures 1a-7c, combinations thereof, modifications thereto, and / or described herein. Registration nodes 184a-184m connect to and communicate with a registration server via QS communication channels, and the registration server communicates with the HSMs of the DLT nodes and / or QS servers to store and / or access data items stored in the DLT network / distributed ledger and / or to perform, for example but not limited to, QS communication, QS storage and / or access to data items using the QREF locators and access tokens described herein, other QREF locator / access token use cases according to the present invention and / or as described with reference to Figures 1a-7c, combinations thereof, modifications thereto, and / or as described herein.

[0316] Thus, as described with reference to Figures 1a-1k, user 105a of multiple users 105a-105l may, for example, but not limited to, use a device or endpoint device having a secure enclave and / or secure memory / processor to establish a QS communication channel with a QS system and perform, for example, but not limited to, QS communication, QS storage and / or access to data items using the QREF locators and access tokens described herein, other QREF locator / access token use cases according to the present invention and / or described with reference to Figures 1a-7c, combinations thereof, modifications thereto, and / or described herein.

[0317] 2a and 2b are schematic diagrams illustrating an exemplary QREF locator system 200 and a QREF access token system 205 for generating QREF locators and access tokens, respectively, for storing and accessing data items in some manner in accordance with the present invention. For simplicity, reference numerals from FIGS. 1a-1l may be referenced in FIGS. 2a and 2b and used for similar or identical components and / or for illustrative purposes.

[0318] 2a, the QREF locator system 200 generates a QREF locator 203 by receiving data representing, for example, but not limited to, at least a user secret 201a from a device of a user submitting a data item for storage in the QS repository 107 of the QS network 101 and an available QD key selected from a set of QD keys from one of the QS servers 103a-103l of the QS system. The QREF locator engine 202 is configured to generate the unique QREF locator 203 based on one or more of a first set of cryptographic or mathematical operations performed on the data representing at least the received user secret 201a and the received QD key 201n (e.g., QS_KEY). While a user secret 201a and a QD key 201n (e.g., QS_KEY) are described for simplicity and by way of example only, and the invention is not so limited, it will be appreciated by those skilled in the art that any other information depending on the application may be input to QREF locator engine 202, such as, for example, a user secret, a customer number assigned to a user, a data item reference identifier assigned to a data item associated with the generated QREF locator 203, a received QD key, a QD key identifier of the received QD key, a user identifier, and / or an access control list for the data item, and / or any other information useful or suitable for generating a QREF locator. While some examples of cryptographic or mathematical operations of QREF locator engine 202 are provided, these are by way of example only, and the invention is not so limited, it will be appreciated by those skilled in the art that the cryptographic or mathematical operations of QREF locator engine 202 may be modified depending on the use case and / or service / application process using a QS system in accordance with the present invention. For example, the QREF locator engine 202 may be a plug-in module or software that can be selected from a set of QREF locator engines depending on the use case.Depending on the use case, each QREF engine 202 from the set of QREF locator engines may have a different set of cryptographic or mathematical operations and / or different input data to generate the QREF locator associated with that use case.

[0319] The QREF locator engine 202 is configured to generate a QREF locator 203 based on a first set of cryptographic or mathematical operations on QREF locator input data representing, for example but not limited to, at least a received user secret 201a and a received QD key 201n, or any other input data associated with a user, data item, and / or QD key, such as, by way of example only and not by way of limitation, a user secret, a customer number, a user identifier, a data item reference, a quantum key identifier, a QD key, etc., depending on the application. The QREF locator engine 202 processes the input data using any one or more cryptographic operations, mathematical operations and / or functions, and / or combinations thereof, such as, but not limited to, one or more cryptographic operations, mathematical operations and / or functions, and / or combinations thereof from the group of one or more one-way functions, one or more hash functions, one or more hash-based message authentication code functions, one or more key derivation functions, multiplication, subtraction, addition, division, factorization, and / or any other mathematical operations, any other one or more cryptographic functions, mathematical operations, and / or combinations thereof that are operable to generate from the input data data representing a QREF locator 203 that is unique and that obfuscates the received QD key 201n and / or received user secret 201a and / or other input data, and that provides an address for locating an associated data item for storage in, for example, but not limited to, the QS repository 107 and / or the QS DLT 167, etc. As an example, the QREF locator engine 202 may perform a one-way hash on input data such as, but not limited to, data representing at least the received user secret 201 a and the received QD key 201 n. In another example, the QREF locator engine 202 may perform a one-way hash on input data such as, but not limited to, data representing at least the received user secret 201 a and the received QD key 201 n.In another example, the QREF locator engine 202 may perform a one-way hash on received input data, such as, but not limited to, a customer number (or user identifier), a customer data item reference (e.g., a reference or name of a data item for storage), and data representing a quantum key identifier for the received QD key 201n.

[0320] 2b, the QREF access token system 205 is configured to generate a unique QREF access token 207 by receiving the QREF locator 203. The QREF access token engine 206 is configured to generate the unique QREF access token 207 based on a second set of cryptographic or mathematical operations performed on the received QREF locator 203. The QREF access token engine 206, configured to generate the QREF access token 207 based on the second set of cryptographic and / or mathematical operations, may perform one or more of one-way functions, one or more hash functions, one or more one-way forward hash functions, one or more hash-based message authentication code functions, one or more key derivation functions, multiplication, subtraction, addition, division, factorization, and / or any other mathematical operations to generate a unique QREF access token 207, obfuscate data representing the QREF locator 203, and to provide a secure connection to, for example, but not limited to, the QS repository 107 or the QS The method may further include generating the QREF access token 207 from the data representing the QREF locator 203 based on any one or more cryptographic operations, mathematical operations, functions, and / or combinations thereof from the group of any one or more cryptographic operations, mathematical operations, functions, and / or combinations thereof, operable to generate data representing the QREF access token 207, which can be used by the QS servers 103a-103l to identify the QREF locator 203 to provide an address for locating the associated data item stored in the DLT 167. Preferably, the second set of cryptographic and / or mathematical operations used to generate the QREF access token 207 from the QREF locator 203 is an irreversible process such that the QREF locator 203 cannot be derived from the data representing the QREF access token 207. In a preferred example, the QREF access token is calculated using a one-way hash of the QREF locator.

[0321] While hash functions for computing a QREF locator from input data and / or a QREF access token from a QREF locator are described herein, this is by way of example only, and it should be recognized by those skilled in the art that any variation or one or more of cryptographic operations or algorithms, mathematical operations or algorithms, functions, and / or combinations thereof may be used to generate a QREF locator and / or a QREF access token having the above properties as described above. For example, there are several operations and / or algorithms that can be used to compute a QREF locator and / or a QREF access token, including, but not limited to, one or more cryptographic operations or algorithms from the group including, for example, but not limited to, lattice-based cryptography, multivariate cryptography, code-based cryptography, supersingular elliptic curve isogeny cryptography, etc., may be used using the input data as a seed.

[0322] FIG. 2c is a flow diagram illustrating an exemplary QS access process 210 for a user to request access to a data item using the QREF access token generated in FIG. 2b. For simplicity, reference numerals from FIGS. 1a-1l may be referenced and used for similar or identical components and / or for illustrative purposes in FIG. 2c. During storage of a data item in the QS repository 107 or DLT 131, the QS server 103a may generate an enrollment record for the user storing the data item in the QS repository 107 or QS DLT 167. Each user enrollment record may include data representing, for example, but not limited to, the user's user identity, the user's user secret, a quantum reference (QREF) locator 203 associated with the data item, a data item reference identifier associated with the data item, a quantum key identifier associated with the QD key used to encrypt the data item, the user identity of the user granted access to the data item, and / or an access control list associated with the data item, which may include any other data. The QS access process 210 may include the following steps. In step 211, a QREF access token associated with the data item is received from a user's device, which may not be the same user that stored the data item in the QS repository 107 or QS DLT 167. In step 212, one or more enrollment records associated with the user are retrieved.

[0323] In step 213, identify a QREF locator associated with the QREF access token by performing the following steps: In step 214, for each retrieved enrollment record, generate a QREF access token based on the data in the retrieved enrollment record; In step 215, for each retrieved enrollment record, determine whether the generated QREF access token matches the received access token; In step 216, identify a QREF locator from the retrieved enrollment record that corresponds to the generated QREF access token that matches the received access token; In step 216, output the QREF locator from the retrieved record that generated the matching access token.

[0324] In step 217, in response to identifying the QREF locator, perform one or more access operations or actions, etc., associated with the data item corresponding to the identified QREF locator and the access token stored in the repository. The access operations or actions depend on the use case.

[0325] 3a is a flow diagram illustrating an exemplary service / application process 300 for storing and / or accessing data items in a QKD system, such as, but not limited to, QS systems 165, 170, 175, and 180 described with reference to FIGS. 1j-1k. For simplicity, reference numbers from FIGS. 1j-1k may be used for the same or similar components. QS systems 165, 170, 175, and 180 combine QKD or SQKD with a QS DLT 167 to enable quantum-secure (QS) storage and retrieval of publicly accessible data in a manner that is considered quantum-secure. As described, the QS systems 170, 175, and 180 use, for example, but not limited to, 1) quantum-secure or QD keys delivered to the HSMs 106a-106c by a QS satellite system including multiple QS satellites 171a-171c, and 2) a user / customer's public key or shared secret to create a unique QREF number or locator through operation of a QREF locator algorithm. The QREF locator is used as a locator to the location of a data item (or DLT data record or data locker) stored in the QS DLT 167, which may be a distributed ledger and / or a shared ledger. The QS DLT 167 is stored in the QS network 101 using DLT nodes 166a-166d that are exclusively connected by quantum-secure communication channels, and the DLT nodes 166a-166d may use quantum keys from a set of quantum-secure keys stored in each HSM 106a-106c of the QS servers 103a-103c. The QS DLT 167 is not publicly accessible via the non-quantum-secure network 102 (e.g., a public network or the Internet). When the DLT nodes 166a-166d exchange information to store information in the QS DLT 167, to generate queries or updates, or to retrieve information or responses to queries, such information stored in the QS DLT 167 is always quantum-secure.

[0326] In this example, one of users 104a-104c is a customer of the QS provider of QS systems 165, 170, 175, 180 and may use QS systems 165, 170, 175, 180 for a variety of applications and / or use cases. As described, user 104a has a QS server that may be configured for use with the SQKD system, for example, but not limited to, by including OGRC 172d, HSM 106d, and / or DLT node functionality 166d. User 104a's QS server connects to QS servers 103a-103c and / or QS DLT 167 using quantum-secure channels within QS network 101. User 104a may use service / application process 300 to store the user's data items in QS fashion via DLT records (or "lockers") on a distributed and / or shared ledger operated by QS DLT 167 and DLT nodes 166a-166f, based on the following steps:

[0327] In step 301, a user 104a using a QS server / device connects to one of the QS servers 103a-103c with DLT nodes 166a-166c using a QS communication channel initiated using a QD key set up with the associated QS server 103a with DLT node 166a.

[0328] In step 302, user 104a may provide the user's public / private key (eg, user secret or customer secret) to QS server 103a-103c (as directed by the service).

[0329] In step 303, the QS server 103a retrieves an available QD key from the set of QD keys (e.g., quantum keys) stored in the HSM 106a of the QS server 103a and injects the retrieved QD key, along with the user secret or the user's private key along with the customer's private key, into a QREF locator engine (e.g., QREF locator engine 202 of FIG. 2a) for generating a QREF locator associated with the data item that the user 104a requires to be stored in the QS DLT 167. The QREF locator generation engine generates a "locator" or unique reference number that indicates the location or address of the DLT record (or "locker") where the data item will be stored in the distributed or shared ledger of the QS DLT 167.

[0330] In step 304, the data item of user 104a is stored in a DLT record (or "locker") that includes data representing the data item and also a QREF locator, which may be used, for example but not limited to, as an index or location of the data item stored in the QS DLT.

[0331] In step 305, the QS server 103a also generates a QREF access token for the user 104a (e.g., the QREF access token engine 206 of FIG. 2a), which allows anyone with the QREF access token to access the data item stored in the QS DLT 167. For example, the QREF access token engine 205 can be a simple hash function, where the QREF access token is a hash of the QREF locator that corresponds to the data item.

[0332] In step 306, user 104a receives a QREF access token corresponding to the data item stored by QS DLT 167. User 104a may use the QREF access token publicly and may also use the access token to direct other users 104b-105n to the data item.

[0333] Thus, once the data item is securely stored in QS format in the QS DLT 167, user 104a can share information related to a QREF locator with one or more users 104b-105n for any given application by providing a QREF access token hash of the locator that combines a reference number with the HSM QKD key used plus the user's 104a private key, which is delivered in a certificate or token.

[0334] Given that a QS DLT 167 is used, all QS servers 103a-103c with DLT nodes 166a-166c of a QS system 165, 170, 175, or 180 will be updated as necessary regarding the location of the data item and the QREF locator of the user 104a. Thus, any request for access to a data item based on a QREF access token received by any QS server 103a-103c can use the QREF access token to locate the data item. The QS system 165, 179, 175, or 180 can be queried to generate a summary of the data item, a partial record associated with the data item, or a Boolean value to a query associated with the data item, and / or any of a variety of results generated as needed by a given application related to the data item.

[0335] It is apparent that the QS system provides various advantages, including processing data items in a quantum-secure manner, since all communications between the QS servers 103a-103c and / or the QS servers of users 104a-104c are quantum-secure, for example, but not limited to, based on SQKD. Another advantage is that users 105a-105n with devices operating in a non-quantum-secure network 102 outside the quantum-secure boundary of the QS network 101 are not required to perform any authentication in the application under consideration, and therefore do not require quantum safety from the users. These users are not party to any secrets or QD keys of the QS system, and therefore cannot compromise data items held in the QS DLT 167. For example, depending on the purpose and use of the access tokens and permissions for one or more data items held in the QS DLT 167, users 105a-105n outside the quantum-safe boundary of the QS network 101 can only use the QREF access token to obtain Boolean answers or partial data strings associated with the data items held in the QS DLT 167 and therefore cannot compromise the data items held in the ledger of the QS DLT 167. Additionally, all QS servers 103a-103c with DLT nodes 166a-166c operating the QS DLT 167 are quantum-safe even when information is passed between users over IP over the public internet as raw encrypted data encrypted using QD keys from a set of QD keys delivered to each QS server 103a-103c via QSKD and / or other suitable QKD techniques. Such encrypted data can only be read by the intended recipient QS server 103a-103c using the associated QD key.

[0336] FIG. 3b is a flow diagram illustrating another exemplary service / application process 310 for implementing web certificates with certificate data items stored and accessed using an SQKD system, such as, but not limited to, QS systems 170, 175, or 180 described with reference to FIGS. 1i-1k. For simplicity, reference numerals from FIGS. 1i-1k may be used for the same or similar components. As described with reference to FIGS. 1a-3a, QS systems 170, 175, or 180 combine SQKD with QS DLT 167 to enable quantum-secure (QS) storage and retrieval of publicly accessible data in a manner that is considered quantum-secure. Using the QREF locator, user 104a, having a QS server hosting a website, may provide a QS web certificate service that can be used to authenticate the user's website to users 105a-105n, etc. Service / application process 310 may include the following steps.

[0337] In step 311, a request is received from a user 104a of a QS server hosting a website to set up a QREF locator using a QS server 103a configured to provide web certification services, which may include, but is not limited to, for example, the user 104a of a QS server hosting a website providing know-your-customer (KYC) details or KYC data of the user (e.g., company details for a company website) for forming and / or storing a KYC data item.

[0338] In step 312, a QREF locator is created / generated based on the user secret associated with the user 104a and the available QD key provided by the HSM 106a of the QS server 103a.

[0339] In step 313, the user KYC data / details together with the QREF locator are stored as a KYC data item in a DLT record (or "locker") in the QS DLT 167, which is replicated on all QS servers 103a-103c having DLT node functionality 166a-166c using the SQKD secure communication channel (or QS channel).

[0340] In step 314, a certificate QREF access token is generated using a hash of the QREF locator, and at least a portion of the user's KYC data may be included in the certificate access token.

[0341] In step 315, when a web browser of user 105a on a non-QS network 102 (e.g., the Internet or a public network) wants to verify that user 104a's website is authentic, the web browser of user 105a receives a certificate access token from user 104a's website and sends the received certificate access token to QS server 103a of QS system 140 to determine whether user 104a's website is authentic.

[0342] In step 316, the QS server 103a obtains the certificate access token, identifies that the certificate access token is associated with the user 104a (e.g., based on identifying a QREF locator from the QREF access token, as described herein with reference to Figures 1a-7b), and retrieves therefrom a QREF locator corresponding to the KYC data item.

[0343] In step 317, the QS server 103a reads the KYC data item from the QS DLT 167 using the QREF locator and checks that the KYC information from the QS DLT 167 matches the KYC data in the certificate access token.

[0344] In step 318, a confirmation is returned to the web browser as to whether the website is authentic. For example, if there is a match, the QS server 103a returns a confirmation (e.g., yes) to the web browser of the user 105a indicating that there is a match and that the website the user 105a is visiting is authentic. If there is no match, the QS server 103a returns a confirmation (e.g., no) to the web browser of the user 105a indicating that there is no match and that the website the user 105a is visiting is not authentic.

[0345] FIG. 3c is a flow diagram illustrating another exemplary KYC service / application process 320 for provision of KYC data stored and accessed using an SQKD system, such as, but not limited to, the QS systems 170, 175, or 180 described with reference to FIGS. 1i-1k. For simplicity, reference numerals from FIGS. 1i-1k may be used for the same or similar components. As described with reference to FIGS. 1a-3a, the QS systems 170, 175, or 180 combine SQKD with the QS DLT 167 to enable quantum-secure (QS) storage and retrieval of publicly accessible data in a manner that is deemed quantum-secure. The QREF locators may be used to provide QS KYC services to users 104a-104c and / or users 105a-105n. In this example, the QREF locator and KYC access token associated with user 105a's KYC data items from multiple users 105a-105n are used to control user 105a's provision of KYC data. For example, user 105a may need to provide comprehensive KYC data to a service provider, and user 105a may provide the service provider with the user's KYC access token and modify the access token access control list to allow the service provider to access the required KYC data for user 105a stored in QS DLT 167. This allows the service provider to access and use the KYC data to subscribe user 105a to the service provider's services, etc. The KYC service / application process 320 may include the following steps:

[0346] In step 321, user 105a registers the user's KYC information (e.g., passport, DVLC, credit card, facial recognition scan, phone, address details, biometrics, and / or any other KYC data of user 105a) in a KYC depository operated by QS server 103a, which may be configured to provide a KYC service that enables users 105a-105n to store their KYC information in KYC DLT records (or "lockers") in the QS DLT 167 of the QS network 101. This will enable user 105a to prove their identity in the future by providing the KYC access token to the service provider, avoiding the need to go through the traditional cumbersome KYC process for each new contract or service.

[0347] In step 322, the QS server 103a generates a QREF locator as described herein, and the QREF locator is associated with the KYC data item for the user 105a. The KYC data item and the QREF locator are stored in a KYC DLT record in the QS DLT 167 of the QS network 101.

[0348] In step 323, the QS server 103a is also configured to generate a KYC access token based on the hash of the QREF locator corresponding to the KYC data item and provide the KYC access token to the user 105a (e.g., the QS server 103a may deliver the KYC access token to a QS wallet such as the user 105a).

[0349] The KYC data items stored in the QS DLT 167 may include complete address and biographical data in a standard field form that can be easily transferred to a standard service provider application form (e.g., a credit card application). The KYC access token may function as a locator such that in the future, when the user 105a wants to provide KYC data to a new service provider, the user 105a can provide the KYC access token to the service provider, allowing the service provider to access the KYC data items of the user 105a stored in the QS DLT 167.

[0350] To verify that the user 105a is genuine and not being impersonated, the QS The QS server 103a hosting the KYC service may provide the user 105a with challenge questions such as, but not limited to, challenge questions requiring an answer based on data known to the user 105a, where the data known to the user 105a includes, but is not limited to, data associated with a word or sentence known to the user 105a, and / or data associated with a word, number, sentence, symbol known to the user such as, but not limited to, for example, mother's maiden name, any other name, town, city of birth, favorite pizza, favorite number, series of numbers, important dates, favorite places, or any other favorite thing or thing known to the user 105a, any word or sentence made by or known to the user 105a, depending on the application, any word, sentence, number, symbol associated with other personal data or experiences known to the user 105a, such as, for example, take a picture of your face now and enter it here, thumbprint your phone now, and / or any other type of challenge question. For example, the challenge question associated with data known to the user 105a may include, but is not limited to, requesting a set of random letters, symbols, or numbers from the user 105a. For example, a random set of characters may be requested from the user 105a, such as the mother's maiden name or any other data known to the user. For example, the first and last characters of the mother's maiden name or any other data known to the user, or the second and third characters of the maiden name or other data known to the user. Similarly, the QS server 103a may also request that a service provider register with the QS system and provide a challenge question to verify the service provider's identity.Additionally, user 105a may provide the KYC DLT record with data representing an access control list and corresponding permissions / levels of access to the asset, where the access control list may include or list data representing, for example, but not limited to, those service providers authorized to access the KYC data item and / or any other users authorized to access the KYC data item, and the permissions / levels of access to the asset (KYC data item) may include, for example, but not limited to, read access, write access, create access, update access, and / or any other type of access level, etc. Each service provider or user authorized to access the KYC data item may be assigned a specific set of permissions / levels of access to the asset (KYC data item). Thus, when a service provider provides a KYC access token for user 105a to the QS server 103a hosting the QS KYC service, the QS server 103a first challenges the service provider to verify that the user is who they claim to be, and then, when the KYC DLT record is retrieved, checks whether user 105a has granted permission using the access control list information and / or permission / level of access information in the KYC DLT record to determine whether the service provider is authorized to access the KYC data. Thus, upon passing the service provider's challenge and also being on the access control list and having the required permission / access level, the consumer KYC data may be provided to the service provider with the appropriate access rights to the consumer KYC data (or document) as dictated by the consumer (or document owner) when access is granted.

[0351] The QS system 170, 175, or 180 may require periodic updates of KYC data from the users 105a-105n, such as utility bills for less than three months. Alternatively, or additionally, the provision of this KYC data may be automated directly with the service provider (e.g., from a utility provider such as BT(RTM)). This may also be based on open banking protocols, etc.

[0352] While several QS applications and / or use cases have been described, this is for simplicity and by way of example only, and it should be understood by those skilled in the art that many other QS applications and / or use cases using the QREF locators and access tokens described with reference to QS systems 100, 165, 170, 175, 180, and / or 190, Figures 1a-3d, and / or described herein, are applicable depending on the application. Such QS applications and / or use cases may include, but are not limited to, quantum-secure (QS) web certification services for verifying the authenticity of website certificates in a QS manner, QS global delivery of digital assets, QS delivery of facts, QS authentication credentials, QS document storage and retrieval, QS data querying, and any other variety of applications and / or use cases depending on the application.

[0353] An exemplary schema is now described for use in connection with or with, for example, but not by way of limitation, QS systems 100, 165, 170, 175, 180, and / or 190 described with reference to Figures 1a-1l. Each HSM 106a-106c of QS servers 103a-103c may store a set of QD keys based on, for example, but not by way of limitation, data representing a one-to-one mapping of a set of quantum key identifiers (e.g., QSKD_KEY_ID) mapped to a set of QD keys (e.g., QSKD_KEY) delivered from one or more QKD sources and / or QS satellites 171a-171c. This may be stored in each of HSMs 106a-106c as a quantum key record, which may include, for example, but not be limited to, a quantum key identifier (e.g., an HSM keystore key number, or any other unique identifier assigned to the QD key) and a QD key (e.g., a key generated by SQKD). For example, an exemplary quantum key record schema for each QD key in the set of QD keys stored in HSM 106a may be based on the following: [Table 1]

[0354] Each DLT node 166a-166f of the QS servers 103a-103c, and / or the QS servers of the users 104a-104c, may store and / or access the encrypted data items of the QS DLT records addressed using the QREF locators generated by the QS servers 103a-103c while the data items are stored in the QS DLT 167. A DLT record for storing a data item in QS DLT 167 may include, but is not limited to, data representing, for example, a QREF locator (e.g., QREF) generated for the data item, the data item (e.g., DATA_ITEM) or encrypted data item with an available QD key (e.g., QSKD_KEY) from a set of QD keys, access permissions such as create, read, write, modify, and any other access permission type (e.g., ACL_ROLE_ID), access control data (e.g., ACL_ID) such as a user identifier (e.g., USER_ID or CUSTNUM) of a user who has permission to access the data item in some manner, and / or any other data required to store the data item in QS DLT 167.

[0355] For example, an exemplary DLT record schema for each data item and the corresponding QREF locator stored in the QS DLT 167 may be based on, for example, but not limited to, the following: [Table 2]

[0356] While the QS DLT record schema for each record in the QS DLT 167 is described, it should be recognized by those skilled in the art that the DLT record schema may be used by any type of repository, such as, but not limited to, repository 107, as described herein with reference to FIG. 1a and QS system 100, and / or depending on the application, by way of example only and not by way of limitation.

[0357] Additionally, the QS servers 103a-103c and / or registration servers 176a-176b, 182, or 182a-182m may operate a QS registry stored in the QS DLT 167 to register users 104a-104c and / or 105a-105n (or customers of the QS system 140) and their associations with one or more data items stored in the QS DLT 167. The QS registry includes a plurality of QS registration records, each of which may include, but is not limited to, one or more data fields and values ​​representing, for example, a user identity (e.g., customer number / CUSTNUM or USER_ID) for each such user, a user secret associated with each user, a QREF locator (e.g., QREF or QREF_VALUE), if any, associated with a data item stored by the user or a QREF locator (e.g., QREF) associated with a data item to which the user is authorized to access in some manner, a data item reference identifier associated with the data item, a quantum key identifier (e.g., QSKD_KEY_ID) associated with a QD key (e.g., QSKD_KEY) available for use in encrypting the data item prior to storage / decrypting the encrypted data item during access, and an access control list (e.g., ACL) associated with the data item, which may include, by way of example only and not by way of limitation, an identifier (e.g., CUSTNUM) of a user to whom the user has given permission to access the data item in some manner. Note that the CUSTNUM or USER_ID may be a customer / user counter that provides a unique number (e.g., 12 or more digits) for each customer / user of a QS system (e.g., QS system 100, 165, 170, 175, 180, or 190).Each new customer / user of a QS system (e.g., QS system 100, 165, 170, 175, 180, or 190) is assigned a different customer / user number, which allows a single customer / user to have multiple data items stored / accessible in a QS system (e.g., QS system 100, 165, 170, 175, 180, or 190). The QS DLT user registry record schema for each user / customer data item stored in the QS DLT 167 may be based, for example, but not limited to, the following: [Table 3]

[0358] In addition to the QD keys from the same set of QD keys stored by the HSMs 106a-106c of the QS servers 103a-103c for storing data items and / or creating QS dynamic communication channels in the QS network 101, the QS devices in the QS system 140 may also be further protected using a QS provider / operator's hidden secret or key (e.g., QS_PROVIDER_SECRET). The secret or key hidden by the QS provider is known only by the QS provider and is used only within the QS network 101 or QS network domain. This secret is not shared with anyone other than the QS servers 103a-103c and / or other devices of the QS provider for providing the QS network 101 and / or QS DLT 167, etc.

[0359] In addition to each user's data items being encrypted with an available QD key from the set of QD keys stored in HSMs 106a-106c, the data items of users 104a-104c and / or 105a-105n may be further protected using a user secret, or a corporate secret (CORPORATE_SECRET) if the user is a corporate user (e.g., users 104a-104c). The user secret or corporate secret may be used, for example, but not limited to, by only one of users 104a-104c that has an OGR and HSM to receive the set of QD keys and / or one of users 105a-105n that has the user secret. The user or corporate secret is inserted into the data item by the user or corporate user for additional security so that the QS provider, or anyone else for that matter, does not have the ability to decrypt and access the user's or corporate user's data items stored in QS DLT 167.

[0360] While the above schema has been described with reference to QS DLT 167 of QS system 165, 170, 175, 180, or 190 with reference to Figures 1h-1k, it will be recognized by those skilled in the art that this is by way of example only and not limited to these QS systems, and that the schema may be used by any type of QS system, such as, but not limited to, QS system 100, for example, as described herein with reference to Figure 1a, and / or depending on the application.

[0361] FIG. 4a is a flow diagram illustrating an exemplary QS data storage and access service / application or use case 400 for a user 104a-105n using, for example, but not limited to, a QS system 170, 175, or 180 in accordance with the present...

Claims

1. A computer-implemented method of storing one or more data items in a quantum-safe "QS" network, the QS network comprising one or more QS servers and a repository for storing and accessing the data items, each QS server comprising a Hardware Security Module "HSM" for storing an identical set of quantum distribution "QD" keys, the identical set of QD keys being distributed to each of the QS servers in a quantum-safe manner, the QS servers being configured to securely communicate with each other and with the repository using one or more available QD keys from the identical set of QD keys, the method being performed by the QS servers and comprising: generating a quantum reference "QREF" locator based on input data associated with the data item for storage and an available QD key selected from the set of QD keys; and transmitting the QREF locator to the repository along with the data item encrypted with the available QD key.

2. The method further comprising: selecting an available QD key from said set of QD keys for encrypting a data item; generating the QREF locator for storing and accessing the data item based on input data associated with the data item and the selected available QD key, wherein the generated QREF locator is unique; Linking the QREF locator to the available QD key of the set of QD keys; 2. The computer-implemented method of claim 1, further comprising: transmitting the QREF locator and the encrypted data item to the repository for storage, the encrypted data item being linked to the QREF locator when stored.

3. The computer-implemented method of claim 1 or 2, wherein the method further comprises receiving a set of QD keys from a quantum key distribution source or source using quantum-safe key distribution.

4. The input data associated with the data item is Device identifiers, Manufacturer Identifier, User identifier, User Secrets, Customer number, and The computer-implemented method of any one of claims 1 to 3, further comprising one or more input data from a group of: an access control list of users for accessing said data item.

5. The method further comprising: generating a QREF access token associated with the data item based on the QREF locator; The computer-implemented method of claim 1 , further comprising: transmitting the QREF access token to a device of a user associated with the data item.

6. The method further comprising: generating, using a non-reversible function, process, or operation, a QREF access token for accessing the data item based on the QREF locator, wherein the QREF access token is unique; The computer-implemented method of claim 1 , further comprising: transmitting the QREF access token to a device of the user to enable the user to access the data item.

7. The method further comprising: receiving a QREF access token from a user's device requesting access to a data item stored in the repository; Identifying a QREF locator based on the QREF access token and input data from the user; In response to identifying the QREF locator, Retrieving the data item from the repository, wherein the data item is decrypted using the QD-Key corresponding to the QREF locator; The computer-implemented method of any one of claims 1 to 6, further comprising: providing to the user an access operation related to the decrypted data item.

8. A computer-implemented method of quantum secure "QS" storage in a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with a plurality of users, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: generating a quantum reference "QREF" locator associated with the data item based on input data associated with a first user of the plurality of users and an available QD key selected from the set of QD keys; and storing the data item encrypted with the available QD key in the repository indexed with the QREF locator.

9. generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the data items stored in the repository; transmitting the QREF access token to at least the first user of the plurality of users; in response to receiving, from a second user of the plurality of users, a QREF access token associated with a data item stored in the repository; identifying a QREF locator associated with the access token and the second user; 9. The computer-implemented method of claim 8, further comprising: providing an access operation related to the encrypted data item of the repository based on the identified QREF locator and the identified second user.

10. A computer-implemented method of quantum secure "QS" storage and retrieval in a QS network, the QS network comprising one or more QS servers and a repository for storing and retrieving one or more data items by a plurality of users, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being performed by the QS servers: In response to receiving a data item for storage, generating a quantum reference "QREF" locator based on a user secret of a first user and an available QD key selected from the set of QD keys, the QREF locator indicating a location for storing the data item encrypted with the selected QD key in the repository and an identity of the first user; generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the data item as stored in the repository; storing said data items in said repository indexed by said QREF locator; Sending the QREF access token to the first user; in response to receiving a QREF access token for a data item stored in the repository; Identifying a QREF locator based on the QREF access token and the identity of a second user; and providing the second user with an access operation related to the encrypted data item of the repository based on the identified QREF locator.

11. The computer-implemented method of any one of claims 1 to 10, further comprising receiving a request by a first user to store the data item.

12. The computer-implemented method of claim 10 or 11, wherein the first user and the second user are the same.

13. The computer-implemented method of claim 10 or 11, wherein the first user and the second user are different.

14. The computer-implemented method of any one of claims 1 to 13, wherein the QS network further comprises one or more user devices, each user device comprising a hardware security module for storing a set of QD keys, and one or more of the one or more user devices and the QS server communicate using quantum key encryption based on the set of QD keys.

15. The repository: Distributed ledger technology or network; Shared ledger technology or network; Blockchain technology or networks; Publish / subscribe, response / request, and / or real-time based digital storage cloud / repository technologies; any other secure cloud storage system or platform; Any other secure storage system or platform, and 15. The computer implemented method of claim 1, further comprising a repository or storage system based on at least one from the group of: any other secure database management system.

16. Each set of QD keys is satellite quantum key distribution, Fiber-optic quantum key distribution, Terrestrial quantum key distribution, Photonic quantum key distribution, and 16. The computer-implemented method of claim 1 , wherein the set of QD keys is distributed to each of the QS devices based on at least one from a group of: any other quantum key distribution system capable of distributing the same set of QD keys to each of the QS servers in the QS network.

17. generating the QREF locator receiving a user secret from a device of a first user; receiving an available QD key selected from the set of QD keys from one of the QS servers; 17. The computer-implemented method of claim 1, further comprising: generating the QREF locator based on a first set of cryptographic or mathematical operations related to the user secret and data representing the received QD key, wherein the QREF locator is unique.

18. 18. The computer-implemented method of claim 1, wherein generating the QREF access token further comprises generating the QREF access token based on a second set of cryptographic or mathematical operations related to data representing the QREF locator, wherein the QREF access token is unique.

19. generating the QREF locator based on the first set of cryptographic or mathematical operations; one or more one-way functions; one or more hash functions, one or more hash-based message authentication code functions; one or more key derivation functions; one or more of multiplication, subtraction, addition, division, factorization, and / or any other mathematical operation; The computer-implemented method of claim 17 or 18, further comprising generating the QREF locator from the data representing the user secret and the received QD key based on any one or more cryptographic or mathematical operations from a group of one or more cryptographic functions, any other combination of mathematical operations, operable to generate data representing a unique QREF locator, capable of obfuscating the received QD key and user secret, and providing an address for locating the associated data item for storage in a repository.

20. generating the QREF access token based on the second set of cryptographic or mathematical operations; one or more one-way functions; one or more hash functions, one or more hash-based message authentication code functions; one or more key derivation functions; one or more of multiplication, subtraction, addition, division, factorization, and / or any other mathematical operation; 20. The computer-implemented method of claim 17, further comprising: generating a QREF access token from data representing the QREF locator based on any one or more cryptographic or mathematical operations from a group of one or more cryptographic functions, any other combination of mathematical operations, operable to generate data representing the QREF locator that is unique, and that can be used by a QS server to identify the QREF to provide an address for locating the associated data item stored in a repository, to obfuscate the data representing the QREF locator.

21. The method further comprising: Receiving a QREF access token from a user; Identifying the QREF locator associated with the QREF access token; 21. The computer-implemented method of claim 1, further comprising: in response to identifying the QREF locator, performing one or more access operations associated with the data item stored in the repository corresponding to the QREF locator and the QREF access token.

22. The method further comprising: storing an enrollment record for each user who stores a data item in the repository, each enrollment record comprising: a user identity for each of said users; and a user secret for each of said users; and Authentication challenge and response; the QREF locator associated with the data item; a data item reference identifier associated with said data item; A quantum key identifier associated with the QD key used to encrypt the data item; and an access control list associated with said data item; receiving a QREF access token associated with the data item from a second user; Retrieving one or more enrollment records associated with the second user; and for each retrieved entitlement record, generating a QREF access token based on said each retrieved entitlement record; Matching the generated QREF access token with the received QREF access token; and identifying the QREF locator associated with the QREF access token by identifying, from the enrollment record, the QREF locator associated with the generated QREF access token that matches the received QREF access token; 22. The computer-implemented method of claim 21, further comprising: in response to identifying the QREF locator, performing one or more access operations associated with the data item stored in the repository corresponding to the QREF locator and the QREF access token.

23. The QS network comprises one or more QS registration servers and a plurality of registration nodes, the QS registration server connects to a set of registration nodes among the plurality of registration nodes, the one or more QS servers distribute one or more groups of QD keys from the set of QD keys to the QS registration server, and each QS registration server distributes one or more QD keys from the group of QD keys to a corresponding set of registration nodes, and the method includes: receiving an enrollment record for a user from a QS enrollment server that generates an enrollment record associated with the user, the user's device being in communication with a enrollment node coupled to the QS enrollment server, the enrollment record comprising: a user identity for each of said users; and one or more device identifiers associated with the user; User credentials associated with a login to the QS system; a user secret for each of said users; and Authentication challenge and response; a QREF locator associated with a data item related to said user; a data item reference identifier associated with said data item; A QD key identifier associated with the QD key used to encrypt the data item; and and receiving, including one or more user data representative of an access control list associated with the data item; 23. The computer-implemented method of claim 22, further comprising storing the enrollment record of the user in the repository.

24. The method further comprising: receiving user credentials from a QS registration server associated with a user, the user's device being in communication with a registration node coupled to the QS registration server; retrieving the enrollment record associated with the user based on the user credentials; receiving a QREF access token associated with a data item from the user; for each retrieved entitlement record, generating a QREF access token based on said each retrieved entitlement record; Matching the generated QREF access token with the received QREF access token; and identifying the QREF locator associated with the QREF access token by identifying the QREF locator associated with the generated QREF access token that matches the received QREF access token from the retrieved enrollment record; 24. The computer-implemented method of claim 23, further comprising: in response to identifying the QREF locator, performing one or more access operations associated with the data item stored in the repository corresponding to the QREF locator and the QREF access token.

25. the repository further comprises a distributed ledger; the QS network further comprises a plurality of QS servers, each QS server comprising an HSM having an identical set of QD keys stored therein, each QS server of the plurality of QS servers comprising a node for computing the distributed ledger, the nodes of the plurality of QS servers forming a QS distributed ledger network configured to provide storage and access to one or more data items stored in the distributed ledger, the method further comprising: receiving a QREF locator for storing an encrypted data item in the distributed ledger; 25. The computer-implemented method of claim 1, further comprising: storing the encrypted data item in the distributed ledger using the QREF locator as an address for a location of the encrypted data item in the distributed ledger.

26. the repository further comprises a shared ledger; the QS network further comprises a plurality of QS servers, each QS server comprising an HSM having an identical set of QD keys stored therein, each QS server of the plurality of QS servers comprising a node for computing the shared ledger between corresponding nodes, the nodes of the plurality of QS servers forming a QS shared ledger network configured to provide storage and access to one or more data items stored in the shared ledger, the method further comprising: receiving a QREF locator for storing the encrypted data item in the shared ledger; 26. The computer-implemented method of claim 1, further comprising: storing the encrypted data item in the shared ledger using the QREF locator as an address for the location of the encrypted data item in the shared ledger.

27. The method further comprising: receiving a QREF access token from the second user for accessing encrypted data items stored on the distributed or shared ledger; Identifying a QREF locator corresponding to the QREF access token and a second user; 27. The computer-implemented method of claim 25 or 26, further comprising: accessing the encrypted data item in the distributed or shared ledger using the identified QREF locator based on the access token.

28. the repository further comprises a digital storage platform using publish / subscribe, request / response, and / or real-time based messaging to store and access data items, the QS network further comprises a plurality of QS servers, each QS server comprising an HSM having an identical set of QD keys stored therein, each QS server of the plurality of QS servers comprising a node for computing digital storage platform messaging between corresponding nodes, the nodes of the plurality of QS servers forming the digital storage platform as a QS distributed storage network configured to provide storage and access to one or more data items based on the digital storage platform messaging, the method further comprising: receiving a QREF locator for storing the encrypted data item in the distributed storage platform; 28. The computer-implemented method of claim 1, further comprising: storing the encrypted data item in the shared ledger using the QREF locator as an address for a location of the encrypted data item in the distributed storage platform.

29. The method further comprising: receiving a QREF access token from the second user for accessing encrypted data items stored in the distributed storage platform; Identifying a QREF locator corresponding to the QREF access token and a second user; 30. The computer-implemented method of claim 28, further comprising: accessing the encrypted data item in the distributed storage platform using the identified QREF locator based on the access token.

30. Each QS server comprises a satellite receiver, and the method comprises: receiving, at each of the one or more QS servers of the QS network, a set of one or more QD keys from a satellite quantum key distribution system, the satellite quantum key distribution system comprising at least one satellite configured to generate and distribute a set of QD keys; 30. The computer-implemented method of claim 1, further comprising: storing the received set of QD keys in a corresponding hardware security module at each of the one or more QS servers of the QS network, wherein after delivery of the set of QD keys to each of the QS servers, each of the QS servers stores an identical set of QD keys internally.

31. The QS network further includes one or more user devices, each user device comprising an HSM for storing a set of QD keys, one or more of the one or more user devices and the QS server communicate using quantum key encryption based on the set of QD keys, each QS user device comprises a satellite receiver, and the method further comprises: receiving, at one or more of the user devices, a set of one or more QD keys from the satellite quantum key distribution system, the satellite quantum key distribution system comprising at least one satellite configured to generate and distribute the set of one or more QD keys; 31. The computer-implemented method of claim 30, further comprising: storing the received set of QD keys in a corresponding HSM at each of the one or more QS user devices of the QS network, wherein after delivery of the set of one or more QD keys to each of the QS user devices, each of the QS user devices stores an identical set of QD keys internally.

32. Each QS server of the QS network includes a Hardware Security Module "HSM" for storing a set of QD keys, each of the QD keys in the set of QD keys being: The QD key identifier for identifying each of the QD keys; Each QD key is mapped to a corresponding QD key identifier based on data representative of the QD key and stored in the HSM; each set of QD keys stored in each of the QS servers of the QS network has an identical mapping between the QD key identifier and each QD key from the set of QD keys, and the method further comprises: receiving a set of QD keys from a quantum key distribution system, where each QD key in the set of QD keys is mapped to a corresponding QD key identifier; 32. The computer-implemented method of claim 1, further comprising storing data representing the set of QD keys and corresponding QD key identifiers.

33. The data representing the mapping of the QREF locator associated with the QD key is the QREF locator; The QD key associated with the QREF locator; and The QD key identifier that identifies the selected QD key is stored in the HSM based on data representing the selected QD key, Each set of QD keys stored in an HSM of each of the QS servers of the QS network is updated based on the data representing the mapping between the QD key identifier, the QREF locator, and a corresponding QD key, and the method further comprises: receiving a QREF locator and a QD key identifier associated with a QD key, the QD key being selected from the set of QD keys for use in generating the QREF locator and encrypting an associated data item; 33. The computer-implemented method of claim 32, further comprising storing data representing the mapping between the QREF locator, a QD key identifier, and a QD key in the HSM of a QS server.

34. The repository further comprises a plurality of records for storing one or more encrypted data items, each record comprising: a QREF locator associated with the encrypted data item; 34. The computer-implemented method of claim 1, further comprising: data representing the encrypted data item, the data item being encrypted with a QD-key associated with the QREF locator.

35. Each record is one or more user identities authorized to access the encrypted data items of each of said records; 35. The computer-implemented method of claim 34, further comprising data representing one or more permissions or actions associated with each of the one or more user identities with respect to accessing the encrypted data item.

36. 36. The computer-implemented method of claim 34 or 35, wherein each record further includes data representing an access control list indicating one or more user identities authorized to access the encrypted data item and corresponding permissions and / or actions associated with each user identity accessing the encrypted data item.

37. The QREF locator is said user secret; A customer number assigned to the user; and a data item reference identifier assigned to said data item; 37. The computer-implemented method of claim 1, further comprising data representing a QD key identifier of the available QD key of the set of QD keys used to encrypt the data item.

38. The QREF locator is A user identifier; 40. The computer-implemented method of claim 37, further comprising data representing an access control list for the data item.

39. The method further comprising: Receiving a request to register a user; authenticating the user; receiving user details for registering the user with the QS network in response to positive authentication of the user; receiving a data item from the user for storage in a QS repository of the QS network; generating a unique QREF locator based data representative of said received user details and said data item; associating said generated QREF locator with said registered user details and further with said data item; generating a unique QREF access token based on data representing the QREF locator associated with the data item; storing the QREF locator and the data item in the QS repository of the QS network; and transmitting the unique QREF access token to the user for use in accessing the data item in some manner.

40. Receiving a QREF access token from a user associated with a data item; authenticating the user; identifying the QREF locator based on the user registration details and the access token associated with the user; Retrieving the data item associated with the QREF locator from the QS repository; checking that the user has permission to access the data item based on an access control list associated with the data item; 40. The computer-implemented method of claim 39, further comprising: in response to determining that the user has permission to access the data item, enabling a user access operation on the data item.

41. The method further comprising: Receiving a request to register a user; authenticating the user; receiving user details for registering the user with the QS network in response to positive authentication of the user; receiving from the user a identity verification "KYC" data item for storage in a QS repository of the QS network, the KYC data item including data representative of the user's identity details; generating unique QREF locator based data representative of said received user details and said KYC data items; associating said generated QREF locator with said registered user details and further with said KYC data item; generating a unique QREF access token based on data representative of the QREF locator and the KYC data item corresponding to the KYC data item; storing the QREF locator and the KYC data item in the QS repository of the QS network; 39. The computer-implemented method of any one of claims 34 to 38, further comprising: sending the unique KYC QREF access token to the user for use in providing the user's KYC data to one or more service providers.

42. Receiving a QREF access token from a user associated with a data item; authenticating the user; identifying the QREF locator based on the user registration details and the access token; Retrieving the data item associated with the QREF locator from the QS repository; checking that the user has permission to access the data item based on an access control list associated with the data item; 42. The computer-implemented method of claim 41, further comprising: in response to determining that the user has permission to access the data item, enabling user access to the data item.

43. The method further comprising: Receiving a request to register a user; authenticating the user; receiving user details for registering the user with the QS network in response to positive authentication of the user; receiving from the user a credential data item for storage in a QS repository of the QS network, the credential data item including data representing a web certificate for attesting to authenticity of a web site operated by the user; generating a unique QREF locator based data representative of said received user details and said certificate data items; associating said generated QREF locator with said registered user details and further with said certificate data item; generating a unique QREF access token based on data representative of the QREF locator and the credential data item corresponding to the credential data item; storing said QREF locator and said certificate data item in said QS repository of said QS network; and transmitting the unique certificate QREF access token to the user for use by the website in providing the certificate QREF access token to a web browser of the user visiting the website.

44. receiving from a user's web browser a certificate QREF access token associated with a certificate data item; identifying the QREF locator associated with the certificate data item based on certificate data in the certificate QREF access token and the user enrollment data associated with the certificate access token; Retrieving the certificate data item associated with the QREF locator from the QS repository; checking that the certificate data item matches the received certificate details of the received certificate access token; 44. The computer-implemented method of claim 43, further comprising: in response to the received certificate details matching corresponding details of the certificate data item, confirming to the web browser of the user that the certificate QREF access token is valid.

45. 45. A computer-implemented method according to claim 43 or 44, wherein the certificate data items are based on data representing certificates in accordance with the X509 standard and beyond.

46. The method further comprising: Establishing a QS communication channel with a first device of a first user; receiving, from the first device, a QREF access token associated with a QD key selected from the set of QD keys, the QD key being for use in QS communication with a second device of a second user; Retrieving the selected QD key from the set of QD keys from the repository based on the received QREF access token; and transmitting the retrieved QD key to the first device and the second device for use in QS communication between the first device and the second device.

47. The method further comprising: Establishing a first communication channel with a first device of a first user; receiving a request from the first device to communicate with a second device of a second user via the QS network; establishing a second communication channel with the second device of the second user; receiving a response from the second device of the second user to connect with the first device of the first user; establishing a QS communication channel through the QS network based on an available QD key selected from the set of QD keys; and connecting the first device of the first user with the second device of the second user via a communication path including the first communication channel, the QS communication channel, and the second communication channel.

48. The first device has a first QD key from the set of QD keys stored therein for QS communication with the QS network, and the second device has a second QD key stored therein for QS communication with the QS network; the first communication channel is a first QS communication channel that connects the QS network with the first device using the first QD key; 48. The computer-implemented method of claim 47, wherein the second communication channel is a second QS communication channel that connects the QS network with the second device using the second QD key.

49. a first device has a first QD key from the set of QD keys stored therein for QS communication with the QS network, a second device has a second QD key stored therein for QS communication with the QS network, and the method further comprises: Establishing a first QS communication channel with the first device using the first QD key; receiving the request for QS communication with the second device from the first device; establishing a second QS communication channel with the second device using the second QD key; receiving a response from the second device to establish a QS communication with the first device; Allocating a QD key from the set of QD keys for QS communication between the first and second devices; The computer-implemented method of any one of claims 34-38 or 46, further comprising: transmitting the third QD key to the first and second devices via the established first and second QS channels, respectively, for use in QS communication between the first and second devices.

50. The method further includes registering a device for use with the QS network, wherein registering the device comprises: connecting said device via a direct wired connection to a QS server of said QS network; selecting an available QD key from the set of QD keys for use by the device; uploading the selected QD key to a secure storage of the device via the direct wired connection; 50. The computer-implemented method of claim 46 or 49, further comprising storing and registering an association between the device and the available QD key in the repository of the QS network.

51. The method further includes registering a user with the QS network, wherein registering the user comprises: Associating said user with a device registered for use with said QS network; 51. The computer-implemented method of claim 50, further comprising storing and registering the association between the user and the registered device in the repository of the QS network.

52. The method further comprising: registering the first user with the QS network and associating the first user with the first device; 52. The computer-implemented method of claim 51, further comprising: registering the second user with the QS network and associating the second user with the second device.

53. The method further comprising: Allocating a further QD key from the set of QD keys for use in QS communications between the first device and the second device, the further QD key being stored in the QS repository as a QD key data item; generating a QREF locator associated with the QD-key data item and an available QD-key for encrypting the QD-key data item; generating a QREF access token associated with the QD key data item based on the QREF locator; Linking the QREF locator to the available QD key; associating the QREF locator with the registrations of the first user and the second user to form a communication pair; storing the QD key data item encrypted with the available QD key in the QS repository together with the QREF locator; 53. The computer-implemented method of claim 46, further comprising: transmitting the QREF access token to the first device and the second device for use in QS communication between the first device and the second device.

54. The method further comprising: Selecting an available QD key for forming a communication pair between the first and second devices; 54. The computer-implemented method of any one of claims 46 to 53, further comprising: storing the available QD key as a QD key data item for use when the first and second devices request QS communication between the first and second devices.

55. The method further comprising: In response to storing a QK key data item associated with a communication pair between the first device and the second device, generating a quantum reference "QREF" locator based on user secrets of the first and second users and an available QD key selected from the set of QD keys for encrypting the QD key data item, the QREF locator indicating a location in the repository of the QD key data item encrypted with the selected QD key; generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the QD key data items stored in the repository; providing said QREF locator to said repository for storing said encrypted QD key data item in said repository; sending the QREF access token to the first device of the first user and to the second device of the second user; In response to receiving a request by the first or second user to access the QD key data item from the repository, receiving a QREF access token from the first user or the second user; Identifying a QREF locator based on the QREF access token and the identity of the first user or the second user; 55. The computer-implemented method of claim 54, further comprising: in response to identifying the QREF locator, providing the first user or the second user with access to the encrypted QD key data item of the repository.

56. The method further comprising: Establishing a first QS communication channel with the first device using the first QD key; receiving, from the first device, a QREF access token corresponding to a QD key data item associated with a communication pair between the first user and the second user; identifying the QREF locator associated with the QREF access token based on the communication pair between the first and second users; providing access to a decrypted QD-key data item of the repository via the first QS communication channel with the first device of the first user in response to identifying the QREF locator; establishing a second QS communication channel with the second device of the second user using the second QD key; receiving from the second device a QREF access token corresponding to a QD key data item associated with a communication pair between the first user and the second user; identifying the QREF locator associated with the QREF access token based on the communication pair between the first and second users; 56. The computer-implemented method of any one of claims 46 to 55, further comprising: in response to identifying the QREF locator, providing access to the decrypted QD key data item of the repository via the second QS communication channel with the second device of the second user.

57. A computer-implemented method of quantum secure "QS" storage and retrieval in a QS network, the QS network comprising one or more QS servers and a repository for storing and retrieving one or more data items by a plurality of users, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being executed by users' endpoint devices, the method comprising: transmitting a data item for storage in a repository of the QS network, wherein in response to receiving the data item, a QS server: generating a quantum reference "QREF" locator based on a user secret of the user and an available QD key selected from the set of QD keys, the QREF locator indicating a location for storing the data item encrypted with the selected QD key in the repository and an identity of the user; generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the data item as stored in the repository; storing said data items in said repository indexed by said QREF locator; and transmitting the QREF access token to the endpoint device of the user; receiving a QREF access token corresponding to the data item stored in the repository; and storing the QREF access token for use in accessing the data items stored in the QS system.

58. A computer-implemented method of quantum secure "QS" storage and retrieval in a QS network, the QS network comprising one or more QS servers and a repository for storing and retrieving one or more data items by a plurality of users, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being executed by users' endpoint devices, the method comprising: receiving a QREF access token corresponding to a data item stored in the repository of the QS system, the QS server in response to receiving the data item: generating a quantum reference "QREF" locator based on a user secret of a user submitting the data item and an available QD key selected from the set of QD keys, the QREF locator indicating a location for storing the data item encrypted with the selected QD key in the repository and an identity of the user submitting the data item; and generating a QREF access token based on the QREF locator, the QREF access token enabling an access operation to be performed on the data item as stored in the repository; sending the QREF access token corresponding to the data item stored in the repository and user credentials to the QS system, wherein a QS server in response to receiving the QREF item: configured to identify a QREF locator based on the QREF access token and the identity of the user; receiving an access associated with the data item stored in the QS system when the QS server identifies the QREF locator.

59. An apparatus comprising a processor unit, a memory unit and a communication interface, said processor unit being connected to said memory unit and said communication unit, said apparatus being configured to implement the computer-implemented method of any one of claims 1 to 58.

60. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 1 to 58.

61. 60. An endpoint device comprising a processor unit, a memory unit and a communication interface, the processor unit being connected to the memory unit and the communication interface, the apparatus being configured to implement the computer-implemented method of claim 57 or 58.

62. 59. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform the computer implemented method of claim 57 or 58.

63. A QS system, A QS network comprising at least two QS servers according to the apparatus of claim 59, each of said QS servers comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein; A plurality of users each having an endpoint device according to claim 61; a repository for storing and accessing data items associated with a user of the endpoint device; A QS system in which the QS servers communicate securely with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

64. A computer-implemented method of quantum secure "QS" communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: Establishing a QS communication channel with the first device of a first user; receiving, from the first device, a QREF access token associated with a QD key selected from the set of QD keys, the QD key being for use in QS communication with a second device of a second user; Retrieving the selected QD key from the set of QD keys from the repository based on the received QREF access token; and transmitting the retrieved QD key to the first and second devices for use in QS communication between the first and second devices.

65. A computer-implemented method of quantum secure "QS" communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: Establishing a first communication channel with a first device of a first user; receiving a request from the first device to communicate with a second device of a second user via the QS network; establishing a second communication channel with the second device of the second user; receiving a response from the second device of the second user to connect with the first device of the first user; establishing a QS communication channel through the QS network based on an available QD key selected from the set of QD keys; and connecting the first device of the first user with the second device of the second user via a communication path including the first communication channel, the QS communication channel, and the second communication channel.

66. The first device has a first QD key from the set of QD keys stored therein for QS communication with the QS network, and the second device has a second QD key stored therein for QS communication with the QS network; the first communication channel is a first QS communication channel that connects the QS network with the first device using the first QD key; 66. The computer-implemented method of claim 64 or 65, wherein the second communication channel is a second QS communication channel that connects the QS network with the second device using the second QD key.

67. The first device has a first QD key from the set of QD keys stored therein for QS communication with the QS network, the second device has a second QD key stored therein for QS communication with the QS network, and the method further comprises: Establishing a first QS communication channel with the first device using the first QD key; receiving the request for QS communication with the second device from the first device; establishing a second QS communication channel with the second device using the second QD key; receiving a response from the second device to establish a QS communication with the first device; Allocating a QD key from the set of QD keys for QS communication between the first and second devices; 67. The computer-implemented method of any one of claims 64 to 66, further comprising: transmitting the third QD key to the first and second devices via the established first and second QS channels, respectively, for use in QS communication between the first and second devices.

68. The method further includes registering a device for use with the QS network, wherein registering the device comprises: connecting said device via a direct wired connection to a QS server of said QS network; selecting an available QD key from the set of QD keys for use by the device; uploading the selected QD key to a secure storage of the device via the direct wired connection; 68. The computer-implemented method of any one of claims 64 to 67, further comprising storing and registering an association between the device and the available QD key in the repository of the QS network.

69. The method further includes registering a user with the QS network, wherein registering the user comprises: Associating said user with a device registered for use with said QS network; 69. The computer-implemented method of claim 68, further comprising storing and registering the association between the user and the registered device in the repository of the QS network.

70. The method further comprising: registering the first user with the QS network and associating the first user with the first device; 70. The computer-implemented method of claim 69, further comprising: registering the second user with the QS network and associating the second user with the second device.

71. The method further comprising: Allocating a further QD key from the set of QD keys for use in QS communications between the first device and the second device, the further QD key being stored in the QS repository as a QD key data item; generating a QREF locator associated with the QD-key data item and an available QD-key for encrypting the QD-key data item; generating a QREF access token associated with the QD key data item based on the QREF locator; Linking the QREF locator to the available QD key; associating the QREF locator with the registrations of the first user and the second user to form a communication pair; storing the QD key data item encrypted with the available QD key in the QS repository together with the QREF locator; 70. The computer-implemented method of claim 64, further comprising: transmitting the QREF access token to the first device and the second device for use in QS communication between the first device and the second device.

72. The method further comprising: Selecting an available QD key for forming a communication pair between the first and second devices; 71. The computer-implemented method of any one of claims 64 to 70, further comprising: storing the available QD key as a QD key data item for use when the first and second devices request QS communication between the first and second devices.

73. The method further comprising: In response to storing a QK key data item associated with a communication pair between the first device and the second device, generating a quantum reference "QREF" locator based on user secrets of the first and second users and an available QD key selected from the set of QD keys for encrypting the QD key data item, the QREF locator indicating the location in the repository of the QD key encrypted with the selected QD key; generating a QREF access token based on the QREF locator, the QREF access token enabling access operations to be performed on the QD key data items stored in the repository; providing said QREF locator to said repository for storing said encrypted QD key data item in said repository; sending the QREF access token to the first device of the first user and to the second device of the second user; In response to receiving a request by the first or second user to access the QD key data item from the repository, receiving a QREF access token from the first user or the second user; Identifying a QREF locator based on the QREF access token and the identity of the first user or the second user; 73. The computer-implemented method of claim 72, further comprising: in response to identifying the QREF locator, providing the first user or the second user with access to the encrypted QD key data item of the repository.

74. The method further comprising: Establishing a first QS communication channel with the first device using the first QD key; receiving, from the first device, a QREF access token corresponding to a QD key data item associated with a communication pair between the first user and the second user; identifying the QREF locator associated with the QREF access token based on the communication pair between the first and second users; providing access to a decrypted QD-key data item of the repository via the first QS communication channel with the first device of the first user in response to identifying the QREF locator; establishing a second QS communication channel with the second device of the second user using the second QD key; receiving from the second device a QREF access token corresponding to a QD key data item associated with a communication pair between the first user and the second user; identifying the QREF locator associated with the QREF access token based on the communication pair between the first and second users; 74. The computer-implemented method of claim 73, further comprising: in response to identifying the QREF locator, providing access to the decrypted QD key data item of the repository via the second QS communication channel with the second device of the second user.

75. A computer-implemented method of quantum secure "QS" communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being executed by the first device, the method comprising: establishing a first QS communication channel with a first QS server of the QS network; Transmitting a QREF access token associated with a QD key selected from the set of QD keys for use in QS communications with a second device of a second user; receiving the retrieved QD key from the QS server for use in QS communication with the second device therebetween; A computer-implemented method comprising: establishing a third QS communication channel with the second device of the second user based on the received QD key, wherein before establishing the third QS communication channel, the second device receives the read QD key by establishing a second QS communication channel with a second QS server of the QS network; and transmitting the QREF access token corresponding to the QD key.

76. A computer-implemented method of quantum secure "QS" communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being executed by the first device, the method comprising: Establishing a first communication channel with a first QS server of the QS network; transmitting to the first QS server a request to communicate with a second device of a second user; establishing a second communication channel with the second device of the second user; receiving a response from the second device of the second user to connect with the first device of the first user; establishing a QS communication channel through the QS network based on an available QD key selected from the set of QD keys; and communicating with the second device of the second user based on a communication path including the first communication channel, a QS communication channel through the QS network, and a second communication channel between the second device and the QS network.

77. A computer-implemented method of quantum secure "QS" communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being executed by the first device, the method comprising: establishing a first communication channel with the first QS server of the QS network; receiving a connection request from the second device of the second user from the first QS server; In response to accepting the connection request, communicating with the second device of the second user based on a communication path including the first communication channel, a QS communication channel through the QS network, and a second communication channel between the second device and the QS network.

78. The first device has a first QD key from the set of QD keys stored therein for QS communication with the QS network, and the second device has a second QD key stored therein for QS communication with the QS network; the first communication channel is a first QS communication channel that connects the QS network with the first device using the first QD key; 80. The computer-implemented method of claim 76 or 77, wherein the second communication channel is a second QS communication channel that connects the QS network with the second device using the second QD key.

79. The first device has a first QD key from the set of QD keys stored therein for QS communication with the QS network, the second device has a second QD key stored therein for QS communication with the QS network, and the method further comprises: Establishing a first QS communication channel with the first QS server using the first QD key; transmitting to the first QS server a request for QS communication with the second device; The computer-implemented method of any one of claims 75 to 78, further comprising receiving the third QD key from the first QS server via the established first QS channel for use in QS communication with the second device, wherein the second device receives the third QD key from a second QS server via the established second QS channel in response to the request.

80. The method further includes registering a user's device for use on the QS network, wherein registering the device includes: connecting said device to a QS server of said QS network via a direct wired connection; downloading available QD keys from the set of QD keys to secure storage on the device for use by the device in QS communications with the QS network; 80. The computer-implemented method of any one of claims 75 to 79, further comprising: registering the association between the device and the user for storage in the repository of the QS network.

81. 81. The computer-implemented method of claim 80, wherein the method further includes registering the user with the QS network, and wherein registering the user further includes providing user credentials and a device identifier for the device to register the user and an associated device for use with the QS network.

82. The method further comprising: and receiving a QREF access token corresponding to a further QD key for use in QS communication between the first device and the second device, wherein the QS server: allocating a further QD key from the set of QD keys for use in QS communications between the first device and the second device, the further QD key being stored in the QS repository as a QD key data item; generating a QREF locator associated with the QD-key data item and an available QD-key for encrypting the QD-key data item; generating a QREF access token associated with the QD key data item based on the QREF locator; linking the QREF locator to the available QD key; associating the QREF locator with the registrations of the first and second users to form a communication pair; storing the QD-key data item encrypted with the available QD-key in the QS repository together with the QREF locator; and transmitting the QREF access token to the first device and to the second device for use in QS communication between the first device and the second device.

83. The QS network is configured to select an available QD key for forming a communication pair between the first and second devices, and to store the available QD key as a QD key data item for use when the first and second devices request QS communication between the first and second devices, and the method further comprises: Sending a request for QS communication with a second device of a second user; receiving a QD key for use in QS communications with the second device; 83. The computer-implemented method of any one of claims 75 to 82, further comprising: establishing a QS communication with the second device based on the received QD key.

84. The method further comprising: transmitting a QREF access token for accessing a QD key data item from the repository for use in QS communication between the first device of the first user and the second device of a second user; receiving access to the QD key data item, the QD key data item including data representative of a QD key selected from a set of QD keys for use by the first and second devices in a QS communication between the first and second devices; 84. The computer-implemented method of claim 83, further comprising: establishing a QS communication with the second device using the QD key, wherein the second device receives access to the QD key data item by transmitting the QREF access token for accessing the QD key data item.

85. The method further comprising: Establishing a first QS communication channel with the first QS server using the first QD key; Transmitting to the first QS server a QREF access token corresponding to a QD key data item associated with a communication pair between the first user and the second user; receiving access to the repository's decrypted QD key data item via the first QS communication channel with the first QS server in response to the first QS server identifying the QREF locator associated with the QREF access token; 85. The computer-implemented method of claim 84, further comprising: establishing a QS communication channel with the second device of the second user using the decrypted QD key, wherein the second device of the second user receives access to the decrypted QD key data item of the repository via a second QS communication channel with a second QS server in response to the first QS server identifying the QREF locator associated with the QREF access token.

86. An apparatus comprising a processor unit, a memory unit and a communication interface, said processor unit being connected to said memory unit and said communication unit, said apparatus being configured to implement the computer-implemented method of any one of claims 64 to 74.

87. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 64 to 74.

88. 86. An endpoint device comprising a processor unit, a memory unit and a communication interface, the processor unit being connected to the memory unit and the communication unit, the apparatus being configured to implement a computer-implemented method according to any one of claims 75 to 85.

89. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 75 to 85.

90. A QS system, A QS network comprising at least two QS servers according to the apparatus of claim 86, each of said QS servers comprising a Hardware Security Module "HSM" having an identical set of quantum delivery "QD" keys stored therein; A plurality of endpoint devices according to claim 88; a repository for storing and accessing data items associated with a user of the endpoint device; A QS system in which the QS servers communicate securely with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

91. 1. A computer-implemented method of quantum secure "QS" communication between a first device and a second device using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of the first and second devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicate with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the first device having a first QD key from the set of QD keys stored therein and the second device having a second QD key from the set of QD keys stored therein, the method comprising: Establishing a first QS communication channel with the first device using the first QD key; receiving a request for QS communication with the second device from the first device; establishing a second QS communication channel with the second device using the second QD key; receiving a response from the second device to establish a QS communication with the first device; Allocating a third QD key from the set of QD keys for QS communication between the first and second devices; and transmitting the third QD key to the first and second devices via the established first and second QS channels, respectively, for use in QS communication between the first and second devices.

92. The method further includes registering a device for use with the QS network, wherein registering the device comprises: connecting said device via a direct wired connection to a QS server of said QS network; selecting an available QD key from the set of QD keys for use by the device; uploading the selected QD key to a secure storage of the device via the direct wired connection; 92. The computer-implemented method of claim 91, further comprising storing and registering an association between the device and the selected available QD key in the repository of the QS network.

93. The method further includes registering a user to the QS network, wherein registering the user comprises: Associating said user with a device registered for use with said QS network; 93. The computer-implemented method of claim 91 or 92, further comprising storing and registering the association between the user and the registered device in the repository of the QS network.

94. The method further comprising: registering the first user with the QS network and associating the first user with the first device; 94. The computer-implemented method of any one of claims 91 to 93, further comprising: registering the second user with the QS network and associating the second user with the second device.

95. 1. A computer-implemented method of quantum secure "QS" transaction or message signing using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: Receiving a transaction or message from a user's device that requires application of a digital signature associated with said user; receiving, from a user's device, a QREF access token associated with a data item stored in the repository, the data item being associated with a signing key for use in digitally signing the received transaction or message; Identifying a QREF locator based on the QREF access token and input data from the user; In response to identifying the QREF locator, Retrieving the data item from the repository, wherein the data item is decrypted using the QD-Key corresponding to the QREF locator; digitally signing the received transaction or message using a digital signature algorithm based on the retrieved data items; and transmitting the digitally signed transaction or digitally signed message.

96. The method further comprising: generating a quantum reference "QREF" locator based on input data associated with a data item for storage and an available QD key selected from the set of QD keys, wherein the data item is associated with a signing key from a set of signing keys, and the generated QREF locator is unique; 96. The computer-implemented method of claim 95, further comprising: transmitting the QREF locator to the repository along with the data item encrypted with the available QD key.

97. The method further comprising: generating, using a non-reversible function, process, or operation, a QREF access token for accessing the data item based on the QREF locator, wherein the QREF access token is unique; 97. The computer-implemented method of claim 95 or 96, further comprising: transmitting the QREF access token to a user's device.

98. The method further comprising: receiving a set of signing keys associated with a user of the endpoint device; For each key in the set of signing keys, generating a QREF locator based on user data of the user and an available QD key from the set of QD keys, where a set of QREF locators is generated corresponding to the set of signing keys; linking each QREF locator in the set of QREF locators to the corresponding available QD key in the set of QD keys; generating, for each QREF locator in the set of QREF locators, a QREF access token based on the each QREF locator, wherein a set of QREF access tokens is generated corresponding to the set of signing keys; for each QREF locator in the set of QREF locators, transmitting to the repository for storage the respective QREF locator and an encrypted data item, the encrypted data item including a data item representing a key from the set of signing keys corresponding to the respective QREF locator and encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; 98. The computer-implemented method of any one of claims 95 to 97, further comprising: transmitting the set of QREF access tokens to a device of the user associated with the set of signing keys.

99. 99. The computer-implemented method of claim 98, wherein receiving a set of signing keys associated with a user of an endpoint device further comprises generating a set of signing keys associated with the user based on one or more available QD keys from the set of QD keys.

100. 100. The computer-implemented method of any one of claims 95 to 99, wherein the method further comprises sending the digitally signed transaction or digitally signed message to the device of the user.

101. 101. The computer-implemented method of any one of claims 95 to 100, wherein the method further comprises sending the digitally signed transaction or digitally signed message to another device of another user that is a counterparty to the transaction or addressed to receive the digitally signed message, and wherein the request is for signing the transaction.

102. 102. The computer-implemented method of any one of claims 95 to 101, the method further comprising sending the digitally signed transaction or digitally signed message to a system configured to process and / or store the digitally signed transaction or digitally signed message on behalf of the device of the user.

103. 103. The computer-implemented method of any one of claims 95 to 102, wherein the method further comprises sending the digitally signed transaction or digitally signed message to a DLT system configured to process and / or store the digitally signed transaction or digitally signed message on behalf of the device of the user.

104. The system further comprises: distributed ledger technology, Shared ledger technology, and 104. The computer-implemented method of claim 102 or 103, comprising a system or service based on at least one from the group consisting of: blockchain technology.

105. 105. The computer-implemented method of claim 104, wherein the system comprises a system or service that uses a consensus method or process to verify whether one or more digitally signed transactions are stored in the distributed ledger, shared ledger, and / or blockchain associated with the system or service.

106. A computer-implemented method as claimed in any one of claims 95 to 105, wherein the method performed by a QS server of the QS network further comprises performing QS storage and / or access of the data items based on a computer-implemented method as claimed in any one of claims 1 to 58, the data items corresponding to one or more signature keys.

107. 107. The computer-implemented method of any one of claims 95 to 106, further comprising registering authorization for one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys stored in the repository.

108. 108. The computer-implemented method of claim 107, further comprising transmitting the one or more QREF access tokens to the devices associated with the one or more users.

109. transmitting the set of signing keys to one or more load-balanced, geographically-located HSMs via the QS network, where the set of signing keys is stored in the repository accessible by the HSMs via the QS network; 109. The computer-implemented method of claim 107 or 108, further comprising: sending the corresponding QREF access token associated with the set of signing keys to one or more devices of a user having authorization to use the QREF access token.

110. 107. The computer-implemented method of any one of claims 95 to 106, wherein the set of signing keys is a set of master keys or secrets associated with two or more systems requiring interoperability, and further comprising registering authorization for one or more devices or apparatus of the two or more systems to access data items based on one or more QREF access tokens corresponding to one or more data items representing the one or more master keys or secrets stored in the repository.

111. 108. The computer-implemented method of claim 107, further comprising transmitting the one or more QREF access tokens to the device.

112. 112. The computer-implemented method of any one of claims 95 to 111, wherein the set of signing keys is a set of master keys, the method further comprising registering authorization for one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys stored in the repository.

113. 113. The computer-implemented method of claim 112, further comprising transmitting the one or more QREF access tokens to the devices associated with the one or more users.

114. transmitting the set of master keys to one or more load-balanced, geographically-located HSMs via the QS network, where the set of master keys is stored in the repository accessible by the HSMs via the QS network; 114. The computer-implemented method of claim 112 or 113, further comprising: transmitting the corresponding QREF access token associated with the set of master keys to one or more devices of a user having authorization to use the QREF access token.

115. A computer-implemented method of quantum secure "QS" transaction or message signing using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method being executed by a user's device, the method comprising: receiving a transaction or message requiring application of a digital signature associated with the user; transmitting data representing the received transaction or message and a QREF access token associated with a data item stored in the repository, the data item including a signing key for use in digitally signing the transaction or message; receiving a digitally signed transaction or a digitally signed message, the transaction or message being digitally signed using a digital signature algorithm based on the data item; transmitting the digitally signed transaction for further processing or storage; and and indicating to the user of the device that the QREF access token was used.

116. said digitally signed transaction or digitally signed message; Corresponding to the transaction or message processed by a QS server of the QS network configured to identify a QREF locator based on the QREF access token and input data from the user; in response to the QS server identifying the QREF locator, Retrieving the data item from the repository, the data item being decrypted using the QD key corresponding to the QREF locator; digitally signing the received transaction or message using a digital signature algorithm based on the retrieved data items; and transmitting the digitally signed transaction or digitally signed message.

117. The method further comprising: transmitting a set of signing keys associated with the user of the endpoint device; 117. The computer-implemented method of claim 115 or 116, further comprising receiving a set of QREF access tokens associated with the set of signing keys.

118. The method further comprising: transmitting a request for a set of signing keys associated with the user of the endpoint device; 118. The computer-implemented method of any one of claims 115 to 117, further comprising: receiving a set of QREF access tokens associated with a set of generated signing keys, the set of generated signing keys being stored in the repository in encrypted form, each key in the set of signing keys being linked to a QREF locator corresponding to a QREF access token in the set of QREF access tokens, and the QREF access tokens being generated by a non-reversible operation or function based on the QREF locator.

119. 119. The computer-implemented method of claim 118, wherein the set of generated signing keys is generated by an HSM based on one or more available QD keys from the set of QD keys.

120. A QS server is configured to generate the set of QREF access tokens, the QS server comprising: For each key in the set of signing keys, generating a QREF locator based on user data of the user and an available QD key from the set of QD keys, where a set of QREF locators is generated corresponding to the set of signing keys; linking each QREF locator in the set of QREF locators to the corresponding available QD key in the set of QD keys; generating, for each QREF locator in the set of QREF locators, a QREF access token based on the each QREF locator, wherein a set of QREF access tokens is generated corresponding to the set of signing keys; for each QREF locator in the set of QREF locators, transmitting to the repository for storage the respective QREF locator and an encrypted data item, the encrypted data item including a data item representing a key from the set of signing keys corresponding to the respective QREF locator and encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; and transmitting the set of QREF access tokens associated with the set of signing keys to a device associated with the user.

121. 121. The computer-implemented method of any one of claims 115 to 120, the method further comprising receiving the digitally signed transaction or digitally signed message at the device of the user.

122. 122. The computer-implemented method of any one of claims 115 to 121, the method further comprising sending the digitally signed transaction or digitally signed message to another device of another user that is a counterparty to the transaction or addressed to receive the digitally signed message, and the request is for signing the transaction.

123. 123. The computer-implemented method of any one of claims 115 to 122, the method further comprising sending the digitally signed transaction or digitally signed message to a system configured to process and / or store the digitally signed transaction or digitally signed message on behalf of the device of the user.

124. 124. The computer-implemented method of any one of claims 115 to 123, the method further comprising sending the digitally signed transaction or digitally signed message to a DLT system configured to process and / or store the digitally signed transaction or digitally signed message on behalf of the device of the user.

125. The system further comprises: distributed ledger technology, Shared ledger technology, and 125. The computer-implemented method of claim 123 or 124, comprising a system or service based on at least one from the group consisting of: blockchain technology.

126. A computer-implemented method according to any one of claims 115 to 125, comprising performing the quantum safe communication with a QS server or another device or system based on a computer-implemented method according to any one of claims 75 to 85.

127. 127. The computer-implemented method of any one of claims 115 to 126, wherein the method is performed by a client DLT application running on the device of the user, the client application configured to sign a DLT transaction and send the signed DLT to a DLT system.

128. An apparatus comprising a processor unit, a memory unit and a communication interface, said processor unit being connected to said memory unit and said communication unit, said apparatus being configured to implement a computer-implemented method according to any one of claims 95 to 114.

129. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 95 to 114.

130. 128. An endpoint device comprising a processor unit, a memory unit and a communication interface, the processor unit being connected to the memory unit and the communication unit, the apparatus being configured to implement a computer-implemented method according to any one of claims 115 to 127.

131. An endpoint device according to claim 130, further comprising a secure enclave for implementing the computer implemented method according to any one of claims 115 to 127.

132. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 115 to 127.

133. A QS system, A QS network comprising at least two QS servers according to the apparatus of claim 128, each of said QS servers comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein; A plurality of endpoint devices according to claim 130 or 131; a repository for storing and accessing data items associated with a user of the endpoint device; A QS system in which the QS servers communicate securely with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

134. 1. A computer-implemented method of quantum secure "QS" cryptographic processing of data items, transactions or messages using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: receiving a data item, transaction, or message requiring cryptographic processing associated with a user or system; receiving a QREF access token associated with a data item stored in the repository, the data item being associated with a cryptographic key for use in cryptographically processing the received data item, transaction, or message; Identifying a QREF locator based on the QREF access token and input data from the user or system; In response to identifying the QREF locator, Retrieving the data item from the repository, wherein the data item is decrypted using the QD-Key corresponding to the QREF locator; processing a received data item, transaction, or message using one or more cryptographic operations based on the retrieved data item; transmitting the cryptographically processed data item, cryptographically processed transaction, or cryptographically processed message.

135. The method further comprising: generating a quantum reference "QREF" locator based on input data associated with a data item for storage and an available QD key selected from the set of QD keys, wherein the data item is associated with a cryptographic key from a set of cryptographic keys, and the generated QREF locator is unique; 135. The computer-implemented method of claim 134, further comprising: transmitting the QREF locator to the repository along with the data item encrypted with the available QD key.

136. The method further comprising: generating, using a non-reversible function, process, or operation, a QREF access token for accessing the data item based on the QREF locator, wherein the QREF access token is unique; 136. The computer-implemented method of claim 134 or 135, further comprising: transmitting the QREF access token to a user's device.

137. The method further comprising: receiving a set of cryptographic keys associated with the system or the user of an endpoint device; For each key in the set of signing keys, generating a QREF locator based on system data of the system or user data of the user and an available QD key from the set of QD keys, where the set of QREF locators is generated corresponding to the set of encryption keys; linking each QREF locator in the set of QREF locators to a corresponding available QD key in the set of QD keys; generating, for each QREF locator in the set of QREF locators, a QREF access token based on the respective QREF locator, wherein a set of QREF access tokens is generated corresponding to the set of cryptographic keys; for each QREF locator in the set of QREF locators, transmitting to the repository for storage the respective QREF locator and an encrypted data item, the encrypted data item including a data item representing a key from the set of encryption keys corresponding to the respective QREF locator and encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; 137. The computer-implemented method of any one of claims 134 to 136, further comprising: transmitting the set of QREF access tokens to the system or to a device of the user associated with the set of cryptographic keys.

138. 138. The computer-implemented method of claim 137, wherein receiving a set of encryption keys associated with a system or a user of an endpoint device further comprises generating a set of encryption keys associated with the system or the user based on one or more available QD keys from the set of QD keys.

139. 139. The computer-implemented method of any one of claims 134 to 138, the method further comprising transmitting the cryptographically processed transaction or cryptographically signed message to the system or to a device of the user.

140. A computer-implemented method according to any one of claims 134 to 139, further comprising transmitting the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message to another system, or another device of another user, that is a counterparty to the transaction or is addressed to receive the cryptographically processed message.

141. 141. A computer-implemented method according to any one of claims 134 to 140, the method further comprising transmitting the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message to the system or another system configured to use, process and / or store the cryptographically processed data item, cryptographically processed transaction or cryptographically processed message.

142. 142. The computer-implemented method of any one of claims 134 to 141, the method further comprising transmitting the cryptographically processed data item, cryptographically processed transaction, or cryptographically processed message to a DLT system configured to use, process, and / or store the cryptographically processed data item, cryptographically processed transaction, or cryptographically processed message on behalf of the device of the user.

143. The system further comprises: distributed ledger technology, Shared ledger technology, and 143. The computer-implemented method of claim 141 or 142, comprising a system or service based on at least one from the group consisting of: blockchain technology.

144. 144. The computer-implemented method of claim 142 or 143, wherein the system or another system is configured to use a consensus method or process for verifying whether one or more cryptographically processed data items, cryptographically processed transactions, or cryptographically processed messages are stored in a distributed ledger, shared ledger, and / or blockchain associated with the system or the other system.

145. A computer-implemented method as claimed in any one of claims 134 to 144, wherein the method performed by a QS server of the QS network further comprises performing QS storage and / or access of the data items based on a computer-implemented method as claimed in any one of claims 1 to 58, the data items corresponding to one or more cryptographic keys.

146. 146. The computer-implemented method of any one of claims 134 to 145, wherein the cryptographic operations include one or more cryptographic operations from the group of: encryption, digital signature, decryption, authentication, hashing, and authenticated encryption.

147. 147. The computer-implemented method of any one of claims 134 to 146, wherein the cryptographic keys comprise one or more cryptographic keys for use with the one or more cryptographic operations.

148. 148. The computer-implemented method of any one of claims 134 to 147, wherein the set of cryptographic keys is a set of cryptographic signing keys associated with the system or the user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more digital signature cryptographic operations or algorithms associated with digitally signing one or more data items, transactions, or messages using a signing key associated with a QREF access token.

149. 149. The computer-implemented method of claim 148, further comprising registering permissions for one or more systems or one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys of the set of signing keys stored in the repository.

150. 150. The computer-implemented method of claim 149, further comprising transmitting the one or more QREF access tokens to one or more devices associated with the one or more systems or the one or more users.

151. transmitting the set of signing keys to one or more load-balanced, geographically-located HSMs via the QS network, where the set of signing keys is stored in the repository accessible by the HSMs via the QS network; 109. The computer-implemented method of claim 107 or 108, further comprising: transmitting the corresponding QREF access token associated with the set of signing keys along with authorization to use the QREF access token to one or more systems or one or more devices of a user located in association with the geographically located HSM.

152. 107. The computer-implemented method of any one of claims 95 to 106, wherein the set of signing keys is a set of master keys or secrets associated with two or more systems requiring interoperability, and further comprising registering authorization for the two or more systems to access data items based on one or more QREF access tokens corresponding to one or more data items representing the one or more master keys or secrets stored in the repository, for use in cryptographic operations on one or more received data items, received transactions, or messages that enable interoperability between the two or more systems.

153. 108. The computer-implemented method of claim 107, further comprising transmitting the one or more QREF access tokens to the two or more systems and / or to a device of a user associated with the two or more systems.

154. 112. The computer-implemented method of any one of claims 95 to 111, wherein the set of cryptographic keys is a set of master keys, the method further comprising registering authorization for one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more master keys stored in the repository, for use in a cryptographic operation on one or more received data items, received transactions, or messages using one or more master keys corresponding to the one or more QREF access tokens.

155. 155. The computer-implemented method of claim 154, further comprising transmitting the one or more QREF access tokens to the devices or systems associated with the one or more users.

156. 156. The computer-implemented method of claim 154 or 155, wherein the set of master keys is a set of master hierarchical deterministic "HD" keys, and further comprising transmitting the one or more QREF access tokens to the devices or systems associated with the one or more users.

157. 157. The computer-implemented method of any one of claims 134 to 156, wherein the set of cryptographic keys includes a set of encryption cryptographic keys associated with the system or the user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more encryption cryptographic operations or algorithms associated with encrypting one or more data items, transactions, or messages using an encryption cryptographic key corresponding to a QREF access token.

158. 158. The computer-implemented method of any one of claims 134 to 157, wherein the set of encryption keys includes a set of decryption encryption keys associated with the system or the user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more decryption cryptographic operations or algorithms associated with decrypting one or more encrypted data items, encrypted transactions, or encrypted messages using a decryption encryption key corresponding to a QREF access token.

159. 159. A computer-implemented method according to any one of claims 134 to 158, wherein the one or more data items include data representing a set of data that needs to be backed up and / or archived, and the set of cryptographic keys includes a set of encryption cryptographic keys associated with the system or the user for use with the one or more cryptographic operations to encrypt the one or more data items.

160. 1. A computer-implemented method of quantum secure "QS" cryptographic processing of data items, transactions or messages using a QS network, the QS network comprising at least two QS servers and a repository for storing and accessing data items associated with users of one or more endpoint devices, each QS server comprising a Hardware Security Module "HSM" having an identical set of quantum distribution "QD" keys stored therein, the QS servers securely communicating with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys, the method comprising: receiving a data item, transaction, or message requiring cryptographic processing associated with a user or system; transmitting data representative of the received data item, transaction, or message and a QREF access token associated with another data item stored in the repository, the other data item including a cryptographic key for use in cryptographically processing the received data item, transaction, or message; receiving a cryptographically processed data item, transaction, or message, the received data item, transaction, or message comprising the received data item, transaction, or message that has been cryptographically processed using one or more cryptographic operations based on the other data items.

161. 161. The computer-implemented method of claim 160, further comprising transmitting the cryptographically processed data item, transaction, or message to a user having a system or device for further processing or storage.

162. the cryptographically processed data item, transaction or message corresponds to the transaction or message being cryptographically processed by a QS server of the QS network, the QS server configured to identify a QREF locator based on the QREF access token and input data from the user; in response to the QS server identifying the QREF locator, Retrieving the other data item from the repository, the retrieved data item being decrypted using the QD-Key corresponding to the QREF locator; processing a received data item, transaction, or message using one or more cryptographic operations based on the retrieved data item; and transmitting the cryptographically processed data item, cryptographically processed transaction, or cryptographically processed message.

163. The method further comprising: transmitting a set of signing keys associated with the system or a user of the endpoint device; 163. The computer-implemented method of any one of claims 160 to 162, further comprising: receiving a set of QREF access tokens associated with the set of cryptographic keys.

164. The method further comprising: transmitting a request for a set of cryptographic keys associated with the system or a user of the endpoint device; 164. The computer-implemented method of any one of claims 160 to 163, further comprising receiving a set of QREF access tokens associated with a set of generated cryptographic keys, the set of generated cryptographic keys being stored in the repository in encrypted form, each key in the set of cryptographic keys being linked to a QREF access token of the set of QREF access tokens, the QREF access tokens being generated by a non-reversible operation or function based on the QREF locator.

165. 165. The computer-implemented method of claim 164, wherein the generated set of encryption keys is generated by an HSM based on one or more available QD keys from the set of QD keys.

166. A QS server is configured to generate the set of QREF access tokens, the QS server comprising: For each key in the set of encryption keys, generating a QREF locator based on user data of the user and an available QD key from the set of QD keys, where a set of QREF locators is generated corresponding to the set of encryption keys; linking each QREF locator in the set of QREF locators to the corresponding available QD key in the set of QD keys; generating, for each QREF locator in the set of QREF locators, a QREF access token based on the respective QREF locator, wherein a set of QREF access tokens is generated corresponding to the set of cryptographic keys; for each QREF locator in the set of QREF locators, transmitting to the repository for storage the respective QREF locator and an encrypted data item, the encrypted data item including a data item representing a key from the set of encryption keys corresponding to the respective QREF locator and encrypted with a QD key corresponding to the respective QREF locator, the encrypted data item being linked to the QREF locator when stored; and transmitting the set of QREF access tokens associated with the set of cryptographic keys to the system or a device associated with the user.

167. 167. A computer-implemented method according to any one of claims 160 to 166, the method further comprising receiving at the device of the user the cryptographically processed data item, transaction or message.

168. The method further comprises: Another system for processing or storage, a device of another user who is the other party to the transaction; 168. A computer-implemented method according to any one of claims 160 to 167, further comprising transmitting the cryptographically processed data item, transaction or message to one or more from a group of devices, or systems, of other users that are addressed to receive the cryptographically processed data item, transaction or message.

169. 169. A computer-implemented method according to any one of claims 160 to 168, the method further comprising transmitting the cryptographically processed data item, transaction or message to a system configured to process and / or store the cryptographically processed data item, transaction or message.

170. 170. A computer-implemented method according to any one of claims 160 to 169, the method further comprising transmitting the cryptographically processed data item, transaction or message to a DLT system configured to process and / or store the cryptographically processed data item, transaction or message.

171. The system or the other system, distributed ledger technology, Shared ledger technology, and 171. The computer-implemented method of claim 169 or 170, comprising a system or service based on at least one from the group of: blockchain technology.

172. A computer-implemented method according to any one of claims 160 to 171, comprising performing the quantum safe communication with a QS server or another device or system based on a computer-implemented method according to any one of claims 75 to 85.

173. 173. The computer-implemented method of any one of claims 160 to 172, wherein the method is performed by a client DLT application running on the device of the user, the client application configured to sign a DLT transaction and send the signed DLT to a DLT system.

174. 174. The computer-implemented method of any one of claims 160 to 173, wherein the set of cryptographic keys is a set of cryptographic signing keys associated with the system or the user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more digital signature cryptographic operations or algorithms associated with digitally signing one or more data items, transactions, or messages using a signing key associated with a QREF access token.

175. 175. The computer-implemented method of claim 174, further comprising registering permissions for one or more systems or one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more signing keys of the set of signing keys stored in the repository.

176. 176. The computer-implemented method of claim 175, further comprising transmitting the one or more QREF access tokens to one or more devices associated with the one or more systems or the one or more users.

177. 177. The computer-implemented method of claim 175 or 176, wherein the QS server is configured to transmit the set of signing keys to one or more load-balanced, geographically-located HSMs via the QS network, the set of signing keys being stored in the repository accessible by the HSMs via the QS network, and the method includes receiving the set of signing keys for one or more systems or corresponding QREF access tokens associated with one or more devices of a user located in association with the geographically-located HSMs, along with authorization to use the QREF access token.

178. 174. The computer-implemented method of any one of claims 160 to 173, wherein the set of signing keys is a set of master keys or secrets associated with two or more systems requiring interoperability, and further comprising registering authorization for the two or more systems to access data items based on one or more QREF access tokens corresponding to one or more data items representing the one or more master keys or secrets stored in the repository, for use in cryptographic operations on one or more received data items, received transactions, or messages that enable interoperability between the two or more systems.

179. 179. The computer-implemented method of claim 178, further comprising receiving the one or more QREF access tokens at the two or more systems and / or at a device of a user associated with the two or more systems.

180. 174. The computer-implemented method of any one of claims 160 to 173, wherein the set of cryptographic keys is a set of master keys, the method further comprising registering authorization for a system or one or more users to access data items based on one or more QREF access tokens corresponding to one or more data items representing one or more master keys stored in the repository, for use in a cryptographic operation on one or more received data items, received transactions, or messages using one or more master keys corresponding to the one or more QREF access tokens.

181. 155. The computer-implemented method of claim 154, further comprising receiving, at the system or a device or system associated with the one or more users, the one or more QREF access tokens.

182. 182. The computer-implemented method of claim 180 or 181, wherein the set of master keys is a set of master hierarchical deterministic "HD" keys, and further comprising transmitting the one or more QREF access tokens to the devices or systems associated with the one or more users.

183. 174. A computer-implemented method according to any one of claims 160 to 173, wherein the set of cryptographic keys comprises a set of cryptographic encryption keys associated with the system or the user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more cryptographic operations or algorithms associated with encrypting one or more data items, transactions or messages using an encryption encryption key corresponding to a QREF access token.

184. 184. The computer-implemented method of any one of claims 160-173 or 183, wherein the set of encryption keys includes a set of decryption encryption keys associated with the system or the user for use with the one or more cryptographic operations, the one or more cryptographic operations corresponding to one or more decryption cryptographic operations or algorithms associated with decrypting one or more encrypted data items, encrypted transactions, or encrypted messages using a decryption encryption key corresponding to a QREF access token.

185. 185. The computer-implemented method of claim 183 or 184, further comprising transmitting one or more data items including data representing a set of data that needs to be backed up and / or archived, wherein the set of encryption keys comprises a set of encryption encryption keys associated with the system or the user for use with the one or more cryptographic operations to encrypt the one or more data items.

186. An apparatus comprising a processor unit, a memory unit and a communication interface, said processor unit being connected to said memory unit and said communication unit, said apparatus being configured to implement a computer-implemented method according to any one of claims 134 to 159.

187. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 134 to 159.

188. 186. An endpoint device comprising a processor unit, a memory unit and a communication interface, the processor unit being connected to the memory unit and the communication unit, the apparatus being configured to implement a computer-implemented method according to any one of claims 160 to 185.

189. 189. An endpoint device according to claim 188, further comprising a secure enclave for implementing the computer implemented method according to any one of claims 160 to 185.

190. A computer readable recording medium having code or computer instructions stored therein, the code or computer instructions, when executed by a processor unit, causing the processor unit to perform a computer implemented method according to any one of claims 160 to 185.

191. A QS system, A QS network comprising at least two QS servers according to the apparatus of claim 186, each of said QS servers comprising a Hardware Security Module "HSM" having an identical set of quantum delivery "QD" keys stored therein; A plurality of endpoint devices according to claim 188 or 189; a repository for storing and accessing data items associated with a user of the endpoint device; A QS system in which the QS servers communicate securely with each other and with the repository using quantum encryption based on one or more available QD keys from the set of QD keys.

Images