Key exchange system, server, method, and program

Abstract

A key exchange system according to an embodiment includes: a key generation device that uses a quantum key distribution or a post-quantum key exchange to generate a key; a network device that uses the key to perform a cipher communication with another network device; and an intermediate server that is located between the key generation device and the network device. The intermediate server comprises: a status monitoring unit that transmits a request for status monitoring to the key generation device at predetermined time intervals; a notification unit that, upon receipt of a response to the request, provides, to the network device, a push notification of key information included in the response; and a key exchange unit that starts a key exchange between the network device and the key generation device in response to a request from the network device having received the push notification of the key information.

Description

[Technical field]

[0001] The present invention relates to a key exchange system, a server, a method, and a program. [Background technology]

[0002] Quantum key distribution (QKD) and post-quantum key exchange (PQKD) are known as technologies for secure communication even with quantum computers. A key generated by an XKD (QKD or PQKD) device is used as a group key, and secure encrypted communication can be realized within a group by encrypting data with the key. For example, Non-Patent Document 1 describes a communication network that exchanges keys by quantum key exchange. Also, for example, Non-Patent Document 2 describes group key exchange via a server. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Mikio Fujiwara, Masahide Sasaki, "3. Quantum Optical Network Technology 3-1 Current Status of Research and Development of Quantum Key Distribution Networks," National Institute of Information and Communications Technology Research Report Vol. 63 No. 1 (2017) [Non-Patent Document 2] Colin Boyd, Gareth T. Davies, Kristian Gjosteen, and Yao Jiang. Offline assisted group key exchange. Information Security, 2018. Springer. Summary of the Invention [Problem to be solved by the invention]

[0004] However, the conventional technology did not take into account the characteristics of the devices that perform the key exchange. Therefore, for example, when performing key exchange between devices with functional constraints, it was not possible to realize functions such as detecting abnormalities during key exchange or sending notifications to prevent delays in key exchange. In response to this, it is believed that by placing an intermediate server between the devices that functions as a buffer to absorb the characteristics of the devices that perform the key exchange, it will be possible to realize key exchange with the above-mentioned various functions even between devices with functional constraints.

[0005] An embodiment of the present invention has been made in consideration of the above points, and aims to realize key exchange via an intermediate server that functions as a buffer for device characteristics of the target of key exchange. [Means for solving the problem]

[0006] In order to achieve the above-mentioned object, a key exchange system according to one embodiment includes a key generation device that generates a key by quantum key exchange or quantum-post key exchange, a network device that performs encrypted communication with other network devices using the key, and an intermediate server disposed between the key generation device and the network device, wherein the intermediate server has a status monitoring unit that transmits a request for status monitoring to the key generation device at predetermined time intervals, a notification unit that, upon receiving a response to the request, pushes a notification of key information included in the response to the network device, and a key exchange unit that initiates key exchange between the network device and the key generation device in response to a request from the network device that has received the push notification of the key information. Effect of the Invention

[0007] The key exchange can be accomplished via an intermediate server that acts as a buffer for device characteristics for which the key is exchanged. [Brief description of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of an overall configuration of a key exchange system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of an optical device inter-connection server according to the present embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a key exchange system according to the present embodiment. [Figure 4] FIG. 2 is a sequence diagram showing an example of an overall process of the key exchange system according to the present embodiment. [Diagram 5] FIG. 11 is a sequence diagram showing a key exchange process in one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] An embodiment of the present invention will be described below. In this embodiment, a key exchange system 1 capable of realizing key exchange via an intermediate server that functions as a buffer for device characteristics of a key exchange target will be described.

[0010] <Overall configuration of key exchange system 1> The overall configuration of a key exchange system 1 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the key exchange system 1 according to this embodiment includes an optical device connection server 10, an XKD device 20, an optical packet transponder 30, and an administrator terminal 40. Furthermore, the optical device connection server 10 and the XKD device 20, the optical device connection server 10 and the optical packet transponder 30, and the optical device connection server 10 and the administrator terminal 40 are each communicatively connected via a communication network.

[0011] The optical device connection server 10 is a server disposed between the XKD device 20 and the optical packet transponder 30, and functions as an orchestrator for key exchange for the optical packet transponder 30 at its own base to perform encrypted communication with optical packet transponders at other bases. That is, the optical device connection server 10 obtains key information (e.g., key ID, key policy (key update time, expiration date, etc.), key exchange method (QKD or PQKD), etc.) by monitoring the status of the XKD device 20 at its own base, and pushes the key information to the optical packet transponder 30 at its own base and the administrator terminal 40. This enables the optical packet transponder 30 (and the administrator using the administrator terminal 40) to perform key exchange (including key update) with reduced delay.

[0012] The optical device interconnection server 10 includes a Trusted Execution Environment (TEE) 110 and a Root of Trust (RoT) 120.

[0013] The TEE 110 is a secure area having a function such as "the existence of an Enclave that cannot be tampered with." This ensures that information such as an OS (Operating System) in the Enclave will not be leaked outside the Enclave. In addition, the TEE realized by some processors further has functions such as "the existence of a secure module in the Enclave that does not leak private keys" and "establishment of an E2E (End-to-End) secure channel between the user and the Enclave" (RA: Remote Attestation). It is assumed that the TEE 110 provided in the optical device connection server 10 according to this embodiment has each of the above functions, and that the RA is used when exchanging keys between the XKD device 20 and the optical packet transponder 30 via the optical device connection server 10. Furthermore, the RA realizes an E2E secure channel by establishing a TLS (Transport Layer Security) session, and this TLS is assumed to exchange a common key using a key exchange algorithm that is safe even for quantum computers. This prevents man-in-the-middle (MitM) attacks and the like even if the owner of the physical server of the optical device interconnection server 10 is malicious.

[0014] The RoT 120 is a secure element (SE) that is the starting point of trust between the SE 200 included in the XKD device 20 and the SE 300 included in the optical packet transponder 30. The RoT 120 stores, for example, an attestation signature key and the like.

[0015] The XKD device 20 generates a key K using QKD or PQKD (collectively referred to as "XKD") to enable the optical packet transponder 30 at its own base to perform encrypted communication with optical packet transponders at other bases. This key K is shared with the XKD devices at the other bases via a secure communication path 50. Here, the XKD device 20 of this embodiment (and the XKD devices at the other bases) is assumed to be a dedicated device or equipment that does not have advanced functions such as a push notification function (in other words, it is assumed to be a device or equipment that has functional constraints as a characteristic of the XKD device 20).

[0016] The XKD device 20 includes an SE 200. The SE 200 stores, for example, its own signature key and the like.

[0017] The optical packet transponder 30 is a network device or equipment that performs encrypted communication (encrypted optical packet communication) with optical packet transponders 30 at other bases via a communication path 60 using a key K generated by the XKD device 20. The optical packet transponder 30 at its own base and the optical packet transponders at other bases correspond to clients in group key exchange. Here, the optical packet transponder 30 (and the optical packet transponders at other bases) according to this embodiment is assumed to be dedicated devices or equipment that do not have advanced functions such as a push notification function (in other words, devices or equipment that have functional constraints as a characteristic of the optical packet transponder 30 are assumed).

[0018] The optical packet transponder 30 includes an SE 300. The SE 300 stores, for example, its own signature key and the like.

[0019] The administrator terminal 40 is a terminal used by an administrator of the XKD device 20 and the optical packet transponder 30 .

[0020] Although not shown, there is also an optical device interconnection server at the other base, which functions as an orchestrator for key exchange between the XKD device and the optical packet transponder at the other base, similar to the optical device interconnection server 10 at the own base.

[0021] Although not shown, there is a public key infrastructure (PKI) that manages the public key corresponding to the attestation signature key and the public keys corresponding to the signature keys of the XKD device 20 and the optical packet transponder 30. Furthermore, it is assumed that this public key infrastructure supports a signature algorithm that is safe even for quantum computers.

[0022] <Hardware configuration of the optical device connection server 10> The hardware configuration of the optical device connection server 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the optical device connection server 10 according to this embodiment has an external I / F 11, a communication I / F 12, a processor 13, a memory device 14, and a RoT 120. In addition, each of these pieces of hardware are communicatively connected via a bus 15.

[0023] The external I / F 11 is an interface with an external device such as a recording medium 11a. Examples of the recording medium 11a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0024] The communication I / F 12 is an interface for connecting the optical device connection server 10 to a communication network. The processor 13 is, for example, various arithmetic devices such as a CPU (Central Processing Unit) capable of realizing the TEE 110. The memory device 14 is, for example, various storage devices such as a HDD (Hard Disk Drive), an SSD (Solid State Drive), a flash memory, a RAM (Random Access Memory), and a ROM (Read Only Memory).

[0025] The hardware configuration of the optical device connection server 10 shown in FIG. 1 is merely an example, and the optical device connection server 10 may have other input devices such as a keyboard, a mouse, a touch panel, etc., a display device such as a display, a display panel, etc., or various other hardware.

[0026] <Functional configuration of key exchange system 1> The functional configuration of the key exchange system 1 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the optical device connection server 10 according to this embodiment has a status monitoring unit 101, a push notification unit 102, and a key exchange processing unit 103. The XKD device 20 according to this embodiment has a key exchange processing unit 201. The optical packet transponder 30 according to this embodiment has a key exchange processing unit 301 and an encryption communication unit 302.

[0027] The status monitoring unit 101 monitors the status of the XKD device 20, and as a result of the status monitoring, obtains key information and the like from the XKD device 20. Furthermore, when the XKD device 20 generates key K by QKD, the status monitoring unit 101 also obtains information indicating the detection result of interception or eavesdropping (hereinafter also referred to as interception detection information) as a result of the status monitoring. Note that, as described in Non-Patent Document 1, QKD is capable of detecting interception and eavesdropping, so the XKD device 20 has an interception and eavesdropping detection function when generating key K by QKD.

[0028] The push notification unit 102 notifies the optical packet transponder 30 and the administrator terminal 40 of information (such as key information and interception detection information) obtained as a result of the status monitoring by the status monitoring unit 101 in a push manner.

[0029] The key exchange processing unit 103 performs various processes for exchanging the key K between the XKD device 20 and the optical packet transponder 30 (in other words, delivering the key K generated by the XKD device 20 to the optical packet transponder 30).

[0030] In response to a request from the optical device interconnection server 10, the key exchange processing unit 201 generates a key K and performs various processes for delivering the key K to the optical packet transponder 30. The key exchange processing unit 201 also performs various processes for delivering the key K to an XKD device at another base.

[0031] The key exchange processing unit 301 performs various processes for obtaining the key K generated by the XKD device 20. In addition, the key exchange processing unit 201 requests the optical device interconnection server 10 to perform key exchange based on information pushed from the optical device interconnection server 10. Note that when the optical packet transponder 30 holds the key K and updates the key K to a new key K, the key exchange may be called a key update.

[0032] The encryption communication unit 302 performs encrypted communication using a key K with optical packet transponders at other bases.

[0033] <Overall processing of key exchange system 1> The overall processing of the key exchange system 1 according to this embodiment will be described with reference to FIG.

[0034] The status monitoring unit 101 of the optical device interconnection server 10 monitors the status by polling the XKD device 20 for requests (i.e., sending requests at predetermined time intervals) (step S101). The status monitoring unit 101 sends requests asynchronously, for example, by Pub / Sub communication. The status monitoring unit 101 may send requests using, for example, a REST API (Representational State Transfer Application Programming Interface) provided by the XKD device 20.

[0035] The key exchange processing unit 201 of the XKD device 20 returns a response to the request from the optical device connection server 10 (step S102). This response includes, for example, key information. In addition, when the XKD device 20 generates the key K by QKD, it may also include interception detection information detected by an interception / wiretapping detection function.

[0036] The status monitoring unit 101 of the optical device interconnection server 10 caches the response returned in the above step S102 in the TEE 110 and also sends a push notification to the administrator terminal 40 and the optical packet transponder 30 (steps S103 to S104). After caching the response returned in the above step S102, the status monitoring unit 101 may immediately send a push notification to the administrator terminal 40 and the optical packet transponder 30, or may send a push notification to the administrator terminal 40 and the optical packet transponder 30 after a certain time has elapsed. The push notification to the optical packet transponder 30 may not include interception detection information. The status monitoring unit 101 may send a push notification to the optical packet transponder 30 by using, for example, an API called a TAI (Transponder Abstraction Interface) adapter provided by the optical packet transponder 30.

[0037] The administrator or the like who uses the administrator terminal 40 can know the key information and interception detection information by receiving the above-mentioned push notification from the optical device connection server 10. That is, the administrator or the like can know, for example, the key ID, the key policy (key update time, expiration date, etc.), the key exchange method (QKD or PQKD), whether interception or eavesdropping has been detected, etc. By knowing the key policy, the administrator can, for example, instruct the optical packet transponder 30 to update the key K held by the optical packet transponder 30.

[0038] The key exchange processing unit 301 of the optical packet transponder 30 caches the key information included in the push notification transmitted in the above step S104, and requests the optical device interconnection server 10 to perform key exchange (step S105). The key exchange processing unit 301 transmits the request asynchronously, for example, by Pub / Sub communication. That is, after caching the key information included in the push notification transmitted in the above step S104, the key exchange processing unit 301 may request the optical device interconnection server 10 to perform key exchange immediately, or may request key exchange after a certain time has elapsed.

[0039] Thereafter, a key exchange process is performed between the XKD device 20 and the optical packet transponder 30 via the optical device interconnection server 10 (step S106). Note that in this key exchange process, the keys are exchanged according to the QKD or PQKD protocol.

[0040] <Example of key exchange process> In the following, as one embodiment of the key exchange process in step S106 above, a case will be described in which key exchange based on NTRU cryptography (quantum-proof key exchange (PQKD)), which is a type of lattice-based cryptography, is performed.

[0041] ≪Preparation≫ First, prepare some symbols. For details of the symbols and various algorithms described below, see, for example, Reference 1.

[0042] ·Φn :=x n -1 ·Φ n ':=x 0 +x 1 +···+x n-1 mod(p,f):=Z p Operations on [x] / (f) D r := domain of parameter r D m := domain of parameter m Sample fg := Generator for f,g Sample rm :=r,m generator H1, H2:= cryptographic hash functions <Key exchange process> The key exchange process in one embodiment will be described with reference to FIG.

[0043] When the key exchange processing unit 103 of the optical device interconnection server 10 receives a key exchange request from the optical packet transponder 30, it generates and outputs a private key sk and a public key pk according to (sk, pk)←KeyGen(seed) (step S201).

[0044] Here, seed is a seed used for key generation, and the KeyGen algorithm generates a key pair (sk, pk) through the following Step 1-1 to Step 1-4.

[0045] Step1-1:((f,f p ,h q ),h)←NTRUKeyGen(seed) Step1-2:s← $ {0,1} 256 Step1-3: (sk, pk) ← ((f, f p ,h q ,s),h) Step1-4: Output (sk,pk) Here, s← $ {0,1} 256 is {0,1}256 The NTRUKeyGen algorithm is implemented as follows: p ,h q ),h) are generated and output.

[0046] Step2-1: (f, g) ← Sample fg (seed) Step2-2:f q ←f -1 mod(q,Φ n ') Step2-3: h←(3 g f q )mod(q,Φ n ) Step2-4:h q ←h -1 mod(q,Φ n ') Step2-5:f p ←f -1 mod(3,Φ n ') Step2-6: ((f,f p ,h q ),h) is output. Next, the key exchange processing unit 103 of the optical device interconnection server 10 transmits the public key pk to the XKD device 20 and the optical packet transponder 30 (steps S202 to S203). At this time, the key exchange processing unit 103 transmits the public key pk by RA after attaching a signature with the attestation signature key.

[0047] When the key exchange processing unit 201 of the XKD device 20 receives the public key pk from the optical device connection server 10, it verifies the signature, and if the verification is successful, it generates the key K and its encryption E(K) by (E(K), K) ← Encapsulate(pk) (step S204).

[0048] Here, the Encapsulate algorithm generates and outputs (E(K), K) through the following Steps 3-1 to 3-6.

[0049] Step3-1: coins← $ {0,1} 256 Step3-2: (r,m)←Sample rm (coins) Step3-3:c←NTRUEncrypt(pk,(r,m)) Step3-4: k←H1(r,m) Step3-5: (E(K),K)←(c,k) Step3-6: Output (E(K),K) Here, coins← $ {0,1} 256 is {0,1} 256 The NTRUEncrypt algorithm generates and outputs c by the following Step 4-1 to Step 4-3.

[0050] Step4-1: m'←Lift(m) Step4-2:c←(r·pk+m')mod(q,Φ n ) Step4-3: Output c.

[0051] Lift is a function or operation used in NTRU cryptography.

[0052] Then, the key exchange processing unit 201 of the XKD device 20 transmits E(K) generated in the above step S204 to the optical device interconnection server 10 (step S205). At this time, the key exchange processing unit 201 affixes a signature with its own signature key and transmits E(K) by RA.

[0053] When the key exchange processing unit 301 of the optical packet transponder 30 receives the public key pk from the optical device interconnection server 10, it verifies the signature, and if the verification is successful, generates the key r' and its encryption r'(K) by (E(r'), r') ← Encapsulate(pk) (step S206).

[0054] Here, the Encapsulate algorithm generates and outputs (E(r'), r') through the following Steps 5-1 to 5-6.

[0055] Step5-1: coins← $ {0,1} 256 Step5-2: (r,m)←Sample rm (coins) Step5-3:c←NTRUEncrypt(pk,(r,m)) Step5-4: k←H1(r,m) Step5-5: (E(r'),r')←(c,k) Step5-6: Output (E(r'),r') Then, the key exchange processing unit 301 of the optical packet transponder 30 transmits E(r') generated in the above step S205 to the optical device interconnection server 10 (step S207). At this time, the key exchange processing unit 201 attaches a signature with its own signature key and transmits E(r') by RA.

[0056] When the key exchange processing unit 103 of the optical device inter-connection server 10 receives E(K) and E(r') from the XKD device 20 and the optical packet transponder 30, respectively, it verifies each signature, and if the verification is successful, it decrypts E(K) and E(r') using K←Decapsulate(sk,E(K)) and r'←Decapsulate(sk,E(r')) (step S208).

[0057] Here, the Decapsulate algorithm generates K or r' by the following Steps 6-1 to 6-4. In the following, c is either E(K) or E(r').

[0058] Step6-1:(r,m,fail)←NTRUDecrypt((f,f p ,h q ),c) Step 6-2: k1←H1(r,m) Step 6-3: k2←H2(s,c) Step 6-4: If fail=0, output k1, otherwise output k2. As a result, if fail=0 (that is, if the decoding is successful), then if c is E(K), then k1=K, and if c is E(r'), then k1=r'.

[0059] Here, the NTRUDecrypt algorithm generates and outputs (r, m, fail) through the following Steps 7-1 to 7-6.

[0060] Step7-1: If c ≠ 0 mod(q,Φ n ), output (0,0,1) Step 7-2: a←(c·f)mod(q,Φ n ) Step7-3: m←(a·f p )mod(3,Φ n ') Step7-4: m'←Lift(m) Step7-5:r←((c-m'·h q ))mod(q,Φ n ') Step 7-6: If (r, m)∈D r ×D m If so, output (r,m,0), otherwise output (0,0,1) Next, the key exchange processing unit 103 of the optical device interconnection server 10 calculates r'K (step S209).

[0061] Then, the key exchange processing unit 103 of the optical device interconnection server 10 transmits r'K calculated in the above step S209 to the optical packet transponder 30 (step S210). At this time, the key exchange processing unit 103 transmits r'K by RA after attaching a signature with the attestation signature key.

[0062] When the key exchange processing unit 301 of the optical packet transponder 30 receives r'K from the optical device interconnection server 10, it decrypts r'K using r' held by itself to obtain K (step S211). This allows the encryption communication unit 302 of the optical packet transponder 30 to use this key K to perform encrypted communication with optical packet transponders at other bases.

[0063] <Summary> As described above, in the key exchange system 1 according to the present embodiment, the optical device interconnection server 10 equipped with the TEE 110 functions as a buffer (particularly, a buffer for key pooling and on-demand key exchange) that absorbs the characteristics of the XKD device 20 and the optical packet transponder 30, and distributes the key K generated by the XKD device 20 to the optical packet transponder 30 via the optical device interconnection server 10. This makes it possible to safely configure a key exchange protocol for honesty even under semi-honest assumptions. As a result, for example, even when a group key K is shared among a large number of optical packet transponders 30, the group key exchange protocol for this purpose does not become complicated, and a system configuration can be realized in which the calculation cost is reduced and no more information than necessary is passed to the optical device interconnection server 10. In particular, the calculation cost of each client (optical packet transponder) does not increase according to the number of clients, so scalability can be maintained.

[0064] Furthermore, even if the owner of the physical server of the optical device interconnection server 10 is malicious (for example, the OS is malicious), the TEE 110 cannot be accessed, and leakage of the private keys r' and K can be prevented.

[0065] Furthermore, by the optical device interconnection server 10 sending a push notification to the optical packet transponder 30 and the administrator terminal 40, it becomes possible to update the key at an appropriate timing with reduced delay, although not in real time.

[0066] In addition, when the XKD device 20 generates the key K by QKD, it becomes possible to notify the administrator of the results of any interception or eavesdropping detection.

[0067] In addition, since the quantum key exchange (QKD) has a low throughput (for example, the throughput is often only at the kbps level), it is necessary to constantly exchange keys and pool the keys, whereas the quantum-safe key exchange (PQKD) can exchange keys on demand in response to a request from a network device or equipment (the optical packet transponder 30 in this embodiment). Normally, in order to realize key pooling, the key exchange device (the XKD device 20 in this embodiment) needs to have a database, which requires consideration and implementation work, but by disposing the optical device-to-device connection server 10, it functions as a buffer, making it unnecessary to consider and implement the database. Thus, one of the main features of the key exchange system 1 according to this embodiment is that it has an intermediate server (the optical device-to-device connection server 10) that functions as a buffer according to the characteristics of each key exchange device.

[0068] In this embodiment, the optical packet transponder 30 is assumed as an example of a network device or equipment, but it goes without saying that the present invention is not limited to this and may be any network device or equipment. In this case, the optical device-to-device connection server 10 may be called, for example, a "network device-to-device connection server", simply a "server", or an "intermediate server".

[0069] [References] Reference 1:Post-Quantum Cryptography | CSRC, Internet<URL:https: / / csrc.nist.gov / Projects / post-quantum-cryptography / round-3-submissions> The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims. [Explanation of symbols]

[0070] 1. Key Exchange System 10 Optical device connection server 11 External I / F 11a Recording media 12 Communication I / F 13 Processors 14 Memory Devices 15 Bus 20 XKD equipment 30 Optical Packet Transponder 40 Administrator terminal 50 Communication Channel 60 Communication Channel 101 Status monitoring unit 102 Push notification section 103 Key exchange processing unit 110 TEE 120 RoT 200 SE 201 Key exchange processing unit 300 SE 301 Key Exchange Processing Unit 302 Encryption Department

Claims

1. A key exchange system including: a key generation device that generates a key by quantum key exchange or post-quantum key exchange; a network device that performs encrypted communication with another network device by using the key; and an intermediate server that is disposed between the key generation device and the network device, The intermediate server: a status monitoring unit that transmits a request for status monitoring to the key generation device at predetermined time intervals; a notification unit that, upon receiving a response to the request, notifies the network device of key information included in the response by push notification; a key exchange unit that initiates key exchange between the network device and the key generation device in response to a request from the network device that has received a push notification of the key information; A key exchange system having

2. the key exchange system includes the key generation device and an administrator terminal used by an administrator of the network device, The notification unit is The key exchange system according to claim 1 , wherein the key information is also notified to the administrator terminal by push notification.

3. The key generation device generates the key by the quantum key exchange; The notification unit is The key exchange system according to claim 2 , further comprising a push notification of the key information and information indicating a detection result of eavesdropping or interception detected by the key generating device to the administrator terminal.

4. The intermediate server comprises a TEE; The key exchange unit 4. The key exchange system according to claim 1, wherein key exchange is performed between the network device and the key generation device via a Remote Attestation that is a secure channel between the network device and an Enclave that represents a secure area provided by the TEE.

5. A server disposed between a key generation device that generates a key by quantum key exchange or post-quantum key exchange and a network device that performs encrypted communication with another network device using the key, a status monitoring unit that transmits a request for status monitoring to the key generation device at predetermined time intervals; a notification unit that, upon receiving a response to the request, notifies the network device of key information included in the response by push notification; a key exchange unit that initiates key exchange between the network device and the key generation device in response to a request from the network device that has received a push notification of the key information; A server having:

6. A method for use in a key exchange system including a key generation device that generates a key by quantum key exchange or post-quantum key exchange, a network device that performs encrypted communication with another network device using the key, and an intermediate server that is disposed between the key generation device and the network device, the method comprising: The intermediate server: a status monitoring step of transmitting a request for status monitoring to the key generation device at predetermined time intervals; a notification step of, when a response to the request is received, notifying the network device of key information included in the response by push notification; a key exchange procedure in which key exchange between the network device and the key generation device is started in response to a request from the network device that has received the push notification of the key information; How to do it.

7. A program for causing a computer to function as an intermediate server included in the key exchange system according to any one of claims 1 to 4.

Images