Encryption key sharing system

Abstract

To provide an encryption key sharing system capable of generating a safe encryption key according to the actual environment of a line-of-sight communication path.SOLUTION: An encryption key sharing system 1 includes: at least one measuring device that measures the atmospheric environment of a line-of-sight communication path 2; a leaked information amount estimating device 40 that estimates an amount of leaked information from a measurement value output by the measuring device using a model learned in advance by machine learning; a transmitting device 10 that transmits a random number bit string as an optical signal to the line-of-sight communication path 2; a receiving device 20 that receives an optical signal; and key distillation processing units 110 and 210 that perform key distillation from the random number bit string at a compression rate that corresponds to the amount of leaked information to generate an encryption key.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an encryption key sharing system that uses optical signals propagating through line-of-sight communication paths to share information-theoretically secure encryption keys. [Background technology]

[0002] Physical layer encryption is known as a technique for sharing an information-theoretically secure encryption key by using optical signals generated by highly directional laser beams that propagate through line-of-sight communication paths (see Non-Patent Documents 1 to 4).

[0003] Unlike computationally secure cryptographic techniques such as public key cryptography, physical layer cryptography using this line-of-sight communication path generates a cryptographic key that can only be known between the legitimate sender and receiver based on signal processing that utilizes the physical layer of communication, i.e., the physical properties and behavior of light propagating through the line-of-sight communication path, and the optical transmitter, receiver, and line-of-sight communication path. The encryption key generated in this way has the advantage that its security is mathematically supported based on information theory. When encrypting and transmitting plaintext, if an encryption key of the same length as the plaintext is used only once (one-time pad), it is theoretically impossible to break the encryption.

[0004] To generate an encryption key in physical layer encryption, a random bit string, which is the source of the encryption key, is first transmitted from the sender to the receiver in the form of light. Because a highly directional laser beam is used in line-of-sight communication paths, it is practically extremely difficult for an eavesdropper to install an eavesdropping device at the center of the laser beam without being detected by the sender or receiver, and then perform some kind of processing on all received optical signals before retransmitting them. Therefore, eavesdroppers have no choice but to use light leaking from line-of-sight communication channels due to atmospheric turbulence, etc., to avoid being in the field of view of the sender and receiver. Atmospheric turbulence refers to the phenomenon in which the refractive index of the atmosphere changes randomly and is distributed due to heat. This phenomenon also gives rise to the concept of "state," such as changes in reception strength over time, in optical space communications.

[0005] In line-of-sight communication channels, atmospheric turbulence causes fluctuations in received signal strength, but at the same time, it can also be a factor in leaking information to eavesdroppers outside the laser beam's irradiation range due to photon scattering, fluctuations in the angle of arrival, and expansion of the laser beam diameter. Note that fluctuations in received signal strength in line-of-sight communication channels are not limited to atmospheric turbulence, but can also be affected by any physical phenomenon, such as changes in solar radiation, wind speed, air pressure, temperature, and humidity. Thus, it is clear that disturbances in the natural environment, including atmospheric turbulence, cannot be secretly and intentionally controlled by an eavesdropper.

[0006] For these reasons, it is considered reasonable to assume an eavesdropping model in which, in line-of-sight communication channels using laser beams, an eavesdropper can only passively obtain information from leaking optical signals. In this case, if the amount of information leaked to an eavesdropper can be properly evaluated and the value is within an acceptable range, a secure encryption key can be shared between the sender and receiver.

[0007] Therefore, in conventional physical layer cryptography, the amount of information leaked to an eavesdropper is evaluated, and the evaluated amount of information leaked is set as the upper bound. A secure cryptographic key is extracted from the random bit string that may have been partially leaked by a series of signal processing steps (key distillation process) including privacy amplification.

[0008] Here, the relationship between the sender, receiver, and eavesdropper in conventional physical layer encryption will be described with reference to Figures 7 and 8. Figure 7 is a diagram showing a typical embodiment of physical layer encryption using a moving object. Figure 7 schematically shows a state in which an optical signal emitted by a laser beam L from a transmitter S of a sender equipped on an airplane is received by a receiver R of a receiver equipped on a drone, and eavesdropped by a receiver R2 of an eavesdropper. As shown in Figure 7, a transmitter S transmits information by modulating a highly directional laser beam L. The authorized receiver is positioned at the center of the spread of the laser beam L using a receiver R to receive and demodulate the optical signal. Meanwhile, an eavesdropper attempts to steal this optical signal, but to avoid being discovered by the sender and receiver, they do so by using a highly sensitive receiver R2 from a position away from the center of the spread of the laser beam L, such as behind the receiver. It is difficult to directly estimate the amount of information leaked to the eavesdropper's receiving device R2. Therefore, in order to estimate the amount of leaked information, the legitimate receiver sets up a physical security area G around himself and places a receiving device R3 simulating an eavesdropper very close to the boundary of that area. Conventionally, the amount of information received by the receiving device R3 is treated as the upper limit of the amount of leaked information.

[0009] FIG. 8 is a diagram showing a communication path model for evaluating the bit error rate and the amount of leaked information in the embodiment of FIG. The communication channel between the sender and the authorized receiver is modeled as the main channel M, and the communication channel between the sender and the eavesdropper is modeled as the estimated channel. These channels are characterized by transition probabilities and a completely-positive trace-preserving (CPTP) map. That is, the symbol changes of information passing through these channels are described by these probabilities and maps, and the performance of the physical layer encryption is revealed from these probabilities and maps. These probabilities and maps are determined by the atmospheric conditions through which the laser beam propagates, the positions of the transmitter, the authorized receiver, and the receiver simulating an eavesdropper, as well as the signal demodulation method. [Prior art documents] [Non-patent literature]

[0010] [Non-Patent Document 1] Z.Pan et al., “Secret-key distillation across a quantum wiretap channel under restricted eavesdropping,”Phys.Rev.Applied,vol.14,no.2,024044,2020. [Non-patent document 2] H.Endo,et al.,OSA Continuum 3 pp.2525-2543,2020. [Non-patent document 3] M. Legre and B. Huttner, “Apparatus and method for quantum enhanced physical layer security,” EP 3337063 A1, 2016. [Non-patent document 4] EJALing, R. Bedington, and JAGrieve, “Single photons source and key distribution,” WO 2019 / 139544 A1, 2019. Summary of the Invention [Problem to be solved by the invention]

[0011] In conventional technologies, due to fluctuations in the atmospheric environment of a line-of-sight communication path and statistical variations in the evaluation value for that environment, it is difficult to properly evaluate the amount of information leaked to an eavesdropper, and the security of the encryption key extracted by key distillation processing is not optimized. More specifically, when the amount of leaked information is estimated to be smaller than the actual value, an encryption key that is not necessarily secure is generated at a high speed, while when the amount of leaked information is estimated to be larger than the actual value, the generated encryption key is secure but is generated only at a low speed. Furthermore, conventional technologies do not understand the correlation between the state of a line-of-sight communication path and the amount of leaked information, which makes it difficult to predict the performance of physical layer encryption (security of encryption keys, generation efficiency, etc.) under the actual conditions of a line-of-sight communication path and to optimize the operation of the device.

[0012] Therefore, an object of the present invention is to provide an encryption key agreement system that can estimate the correlation between the state of a line-of-sight communication channel and the amount of leaked information, and generate a secure encryption key that is adapted to the actual environment of the line-of-sight communication channel. More specifically, an object of the present invention is to provide an encryption key agreement system that can generate an encryption key that is guaranteed to be highly secure at an optimized speed. [Means for solving the problem]

[0013] In order to solve the above problems, the encryption key sharing system of the present invention is an encryption key sharing system that shares an encryption key between a transmitting device and a receiving device using an optical signal propagating through a line-of-sight communication path, and is configured to include a plurality of measurement devices, a leaked information amount estimation device, a transmitting device equipped with an optical signal transmitting unit and a first key distillation processing unit, and a receiving device equipped with an optical signal receiving unit and a second key distillation processing unit.

[0014] In such a configuration, the encryption key sharing system measures the atmospheric environment (atmospheric turbulence, amount of solar radiation, etc.) of the line-of-sight communication path using at least one measurement device. The encryption key sharing system then uses a leaked information amount estimation device to estimate the amount of information leaked to an eavesdropper from the measurements output by the measurement device using a model previously trained by machine learning. This makes it possible to estimate the amount of leaked information with a high likelihood from the actual environment of a line-of-sight communication path, unlike conventional techniques. In addition, the encryption key sharing system uses an optical signal transmitting unit in the transmitting device to encode a random bit string, which is the source of the encryption key, into an optical signal and transmits it over a line-of-sight communication path. In addition, the encryption key sharing system uses an optical signal receiving unit in the receiving device to receive the optical signal over the line-of-sight communication path and decode it into a random bit string.

[0015] The encryption key agreement system then generates an encryption key from a random bit string by key distillation via a public communication channel using a first key distillation processing unit in the transmitting device and a second key distillation processing unit in the receiving device. At this time, the first key distillation processing unit and the second key distillation processing unit perform compression processing at a compression rate according to an estimated value of the amount of leaked information on the random bit string, the identity of which has been confirmed between the sender and receiver through error correction processing. This allows the encryption key agreement system to generate an encryption key whose security is ensured according to the amount of leaked information. More specifically, by performing privacy amplification based on an estimate with a high likelihood of the amount of leaked information, it is possible to efficiently generate an encryption key whose security is guaranteed with a high degree of certainty.

[0016] To learn a model for estimating the amount of leaked information, the encryption key sharing system may be configured to further include a device for measuring the amount of leaked information and a learning device.

[0017] In such a configuration, the encryption key sharing system measures the amount of leaked information of the optical signal leaking from the line-of-sight communication path using the leaked information amount measurement device. The encryption key sharing system then inputs the measurement values ​​output by the measurement device to the learning device, and learns a model through supervised machine learning using the amount of leaked information measured by the leaked information amount measurement device as training data. [Effects of the Invention]

[0018] According to the present invention, it is possible to estimate the correlation between the state of a line-of-sight communication path and the amount of leaked information, and generate a secure encryption key that is adapted to the actual environment of the line-of-sight communication path. [Brief explanation of the drawings]

[0019] [Figure 1] 1 is a configuration diagram showing the overall configuration of an encryption key sharing system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing the internal configuration of the key distillation processing unit in FIG. [Figure 3]2 is a configuration diagram of a neural network showing an example of a model stored in a model storage unit of FIG. 1. FIG. [Figure 4] FIG. 10 is a sequence diagram showing the operation of the encryption key sharing system according to the embodiment of the present invention in a learning mode. [Figure 5] FIG. 10 is a sequence diagram showing the operation of the encryption key sharing system according to the embodiment of the present invention in an estimation mode. [Figure 6] FIG. 10 is a configuration diagram showing a modified example of an encryption key sharing system according to an embodiment of the present invention. [Figure 7] FIG. 1 illustrates a typical prior art implementation of physical layer encryption by a mobile entity. [Figure 8] FIG. 8 is a diagram showing a communication path model for evaluating a bit error rate and an amount of leaked information in the conventional embodiment of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0020] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of an encryption key sharing system according to the present invention will be described in detail below with reference to the accompanying drawings.

[0021] [Configuration of encryption key sharing system] The configuration of an encryption key sharing system 1 according to an embodiment of the present invention will be described with reference to Fig. 1. Fig. 1 is a diagram showing the overall configuration of an encryption key sharing system 1 according to an embodiment of the present invention.

[0022] The encryption key sharing system 1 is a system in which an encryption key is shared between a transmitting device and a receiving device by using an optical signal propagating through a line-of-sight communication path. The encryption key agreement system 1 has two operating modes: a learning mode in which a model for estimating the amount of information leaked from a line-of-sight communication channel (amount of leaked information) is learned based on the results of environmental measurement, and an estimation mode in which the learned model is used to estimate the amount of leaked information from the results of environmental measurement and generate an encryption key. Note that the encryption key agreement system 1 may be operated in the learning mode again even after operating in the estimation mode. This allows the encryption key agreement system 1 to re-learn and update the model.

[0023] The encryption key sharing system 1 includes a transmitting device 10, a receiving device 20, an environment measuring device 30, a leaked information amount estimating device 40, and a leaked information amount measuring device 50. A transmitting device 10 and a receiving device 20 transmit and receive a random number bit string as an optical signal via a line-of-sight communication path 2. The line-of-sight communication path 2 is a free-space communication path for line-of-sight communication in which optical signals propagate directly. Here, line-of-sight communication refers to communication in which there are no obstructions between the sender and receiver and they can see each other. Examples of line-of-sight communication include optical communication between a low-orbit satellite and a ground station, and optical communication between a high-altitude geostationary orbit satellite and a ground station.

[0024] Furthermore, the transmitting device 10 and the receiving device 20 perform a key distillation process via the public communication channel 3 to generate an encryption key from the random number bit string propagated via the line-of-sight communication channel 2 . The public communication channel 3 is, for example, an authenticated communication channel such as the Internet. The receiving device 20, the environment measuring device 30, the leaked information amount estimating device 40, and the leaked information amount measuring device 50 are connected to each other by dedicated lines (either wired or wireless).

[0025] [Transmitting device] The transmitting device 10 transmits a random number bit string as an optical signal to the receiving device 20, and shares an encryption key with the receiving device 20 by performing key distillation processing. The transmitting device 10 includes an optical signal transmitting unit 100 and a key distillation processing unit 110.

[0026] The optical signal transmitting unit 100 encodes a random bit string, which is the source of an encryption key, into an optical signal and transmits it to the line-of-sight communication path 2. The optical signal transmitting unit 100 includes a light emitting unit 101, a light intensity adjusting unit 102, an encoding unit 103, and a light transmitting unit 104.

[0027] The light emitting unit 101 emits a train of optical pulses. Here, the light emitting unit 101 uses a laser light source that emits a highly directional light beam. The light intensity adjusting unit 102 adjusts the intensity of the optical pulse train output from the light emitting unit 101 to a level suitable for optical communications. For example, the light intensity adjusting unit 102 adjusts the intensity of the optical pulse train at a level instructed from an external device. Furthermore, for example, the light intensity adjusting unit 102 may acquire a scintillation index measured in the line-of-sight communication path 2 from the receiving device 20, and adjust the intensity of the optical pulse train according to the value of the scintillation index.

[0028] The encoding unit 103 modulates the optical pulse train whose level has been adjusted by the optical intensity adjusting unit 102 based on a random number bit string of a predetermined bit length, which is generated by a random number generator (not shown) and serves as the basis of an encryption key, and encodes the optical pulse train as an optical signal corresponding to the random number bit string. For example, the encoding unit 103 encodes the random number bit string for each bit in an orthogonal polarization direction. In this way, the encoding unit 103 generates an optical signal (optical pulse) encoded as "0" or "1" for each photon index. Note that the encoding unit 103 may also encode the random number bit string by a method that demodulates the random number bit string to one of the bits on the receiving side, for example, by on-off modulation. The encoding unit 103 outputs the generated optical signal to the light transmitting unit 104 and also outputs the random number bit string used for modulation to the key distillation processing unit 110 . The light transmitting unit 104 transmits the optical signal encoded by the encoding unit 103. The light transmitting unit 104 transmits the optical signal to the light receiving unit 201 of the receiving device 20 through the line-of-sight communication path 2 in free space.

[0029] The key distillation processing unit (first key distillation processing unit) 110 generates an encryption key from a random number bit string by key distillation processing via the public communication channel 3. The key distillation processing unit 110 generates a bit string that is consistent between transmission and reception from the random number bit string between the key distillation processing unit 210 and the key distillation processing unit 210 via the public communication channel 3, and further generates a privacy-amplified encryption key by compressing the bit string according to the amount of leaked information notified by the key distillation processing unit 210. Note that in the learning mode, the key distillation processing unit 110 notifies the key distillation processing unit 210 of the random number bit string via the public communication channel 3. The encryption key generated by this key distillation processing unit 110 is used when encrypting plaintext data by encryption means (not shown) of the transmission device 10. The detailed configuration of the key distillation processing unit 110 will be described later together with the explanation of the key distillation processing unit 210. This allows the transmitting device 10 to generate an encryption key with improved security according to the amount of leaked information and share it with the receiving device 20. More specifically, based on an estimated value with a high likelihood of the amount of leaked information, an encryption key with guaranteed security can be generated and shared with the receiving device 20.

[0030] [Receiving device] The receiving device 20 receives the random number bit string as an optical signal from the transmitting device 10, and shares an encryption key with the transmitting device 10 by performing key distillation processing. The receiving device 20 includes an optical signal receiving unit 200 and a key distillation processing unit 210.

[0031] The optical signal receiving unit 200 receives an optical signal via the line-of-sight communication path 2 and decodes it into a bit string. The optical signal receiving unit 200 includes a light receiving unit 201, an opto-electrical conversion unit 202, and a decoding unit 203. The light receiving unit 201 receives the encoded optical signal (optical pulse train) transmitted from the transmitting device 10. This light receiving unit 201 receives the optical signal propagated through the line-of-sight communication path 2 in free space. The light receiving unit 201 is composed of, for example, a receiving telescope for receiving light, a coarse tracking system that changes the attitude of the receiving telescope in accordance with changes in the relative positions of the transmitting device 10 and the receiving device 20, and a fine tracking system that corrects small changes in the beam position caused by atmospheric turbulence, etc. The light receiving unit 201 outputs the received optical signal to the photoelectric conversion unit 202. Here, the light receiving unit 201 also outputs the intensity of the received optical signal to an optical signal intensity acquisition device 36 of the environment measuring device 30, which will be described later. Note that if the environment measuring device 30 is configured without the optical signal intensity acquisition device 36, the light receiving unit 201 will not output the intensity of the optical signal. The photoelectric conversion unit 202 converts the optical signal received by the light receiving unit 201 into an electrical signal. The photoelectric conversion unit 202 outputs the converted electrical signal to the decoding unit 203.

[0032] The decoding unit 203 decodes the electrical signal converted by the photoelectric conversion unit 202 into a random bit sequence. For example, if the encoding unit 103 encodes the random bit sequence by a method of encoding each bit in an orthogonal polarization direction, the decoding unit 203 determines whether the signal can be identified for each bit according to the polarization direction and decodes the bit value. In this case, the decoding unit 203 outputs, to the key distillation processing unit 210, index information indicating the position in the bit sequence of the signal that has been successfully identified, along with the decoded random bit sequence. In addition, when the encoding unit 103 encodes the random number bit string, if a method is adopted in which the random number bit string is always demodulated to one of the bits without defining a signal identification failure on the receiving side, the decoding unit 203 outputs the decoded random number bit string to the key distillation processing unit 210.

[0033] The key distillation processing unit (second key distillation processing unit) 210 generates an encryption key from a random number bit string by key distillation processing via a public communication channel. The key distillation processing unit 210 generates a bit string that is consistent between transmission and reception from the random bit string between the key distillation processing unit 110 and the key distillation processing unit 110 via the public communication channel 3, and further generates a privacy-amplified encryption key by compressing the bit string at a compression rate based on the value of the amount of leaked information estimated by the leaked information amount estimation device 40. Here, the key distillation processing unit 210 notifies the key distillation processing unit 110 of the transmitting device 10 of the amount of leaked information, thereby compressing the bit string at the same compression rate and sharing the encryption key. This compression rate is set to a higher rate as the amount of leaked information increases. This allows the receiving device 20 to generate an encryption key with increased security according to the amount of leaked information and share it with the receiving device 20. More specifically, privacy amplification can be performed based on an estimated value with a high likelihood of the amount of leaked information. As a result, the transmitting device 10 and the receiving device 20 can efficiently share an encryption key with a high degree of security guaranteed. In the learning mode, the key distillation processing unit 210 outputs the random number bit string notified from the key distillation processing unit 110 via the public communication channel 3 to the leaked information amount measurement device 50 .

[0034] Here, the configuration for performing the key distillation process of the key distillation process unit 110 and the key distillation process unit 210 will be described with reference to FIG. 2 (and also with reference to FIG. 1 as appropriate). The key distillation processing unit 110 includes a sifting unit 111, a bit error rate estimation unit 112, an information matching unit 113, and a privacy amplification unit 114. Furthermore, the key distillation processing unit 110 includes a random number transmission unit (not shown) that transmits a random number bit string to the key distillation processing unit 210 via the public communication channel 3 in the learning mode. The key distillation processing unit 210 includes a sifting unit 211, a bit error rate estimation unit 212, an information matching unit 213, and a privacy amplification unit 214. Furthermore, the key distillation processing unit 210 includes a random number receiving unit (not shown) that receives a random number bit string from the key distillation processing unit 110 via the public communication channel 3 in the learning mode and outputs it to the leaked information amount measurement device 50.

[0035] <Shifting> The shifting units 111 and 211 perform a shifting process to extract bits that have been successfully identified by the receiving side from the random number bit strings on the transmitting and receiving sides by notifying the transmitting side of index information that indicates that the receiving side has successfully identified the signal.

[0036] The sifting unit 211 on the receiving side extracts bits that have been successfully identified from the random number bit string decoded by the decoding unit 203 based on the index information generated by the decoding unit 203, and generates a sifted key (key length: N sift ) The sifting unit 211 notifies the key distillation processing unit 110 on the transmitting side of the index information via the public communication path 3. The sifting unit 211 also outputs the generated sifted key to the bit error rate estimating unit 212.

[0037] The sifting unit 111 on the transmitting side extracts bits that have been successfully identified from the random number bit string coded by the coding unit 103 based on the index information notified from the key distillation processing unit 210 on the receiving side via the public communication channel 3, and generates a sifted key (key length: N sift ) The sifting unit 111 outputs the generated sifted key to the bit error rate estimation unit 112 . In addition, if the encoding unit 103 always demodulates the random number bit string to one of the bits on the receiving side, that is, if the encoding unit 103 encodes using a method that does not define a failure in signal identification, the key distillation processing units 110 and 210 do not perform a shifting process, and the shifting units 111 and 211 are omitted from the configuration.

[0038] <Bit error rate estimation> The bit error rate estimating units 112 and 212 estimate the bit error rate by comparing bit strings sampled and extracted from the sifted key between the transmitting and receiving units.

[0039] The bit error rate estimation unit 212 on the receiving side extracts a bit string from the sifted key generated by the sifting unit 211 by Bernoulli sampling, and generates a test bit string (key length: N test ) is generated. The bit error rate estimation unit 212 extracts the test bit string from the sifted key to generate a new sifted key (key length: N ′ sift =N sift -N test ) The bit error rate estimation unit 212 notifies the key distillation processing unit 110 on the transmitting side via the public communication channel 3 of the generated test bit string and index information indicating the bit position of the test bit string in the sifted key. Furthermore, the bit error rate estimation unit 212 outputs the generated sifted key to the information matching unit 213 .

[0040] The bit error rate estimation unit 112 on the transmitting side extracts a bit string from the sifted key based on the index information notified from the key distillation processing unit 210 on the receiving side via the public communication path 3, and generates a test bit string (key length: N test) is generated. The bit error rate estimation unit 112 extracts the test bit string from the sifted key to generate a new sifted key (key length: N ′ sift =N sift -N test ) The bit error rate estimation unit 112 estimates the bit error rate by comparing the generated test bit sequence with the test bit sequence on the receiving side notified via the public communication channel 3. Hereinafter, the estimated value of the bit error rate is referred to as p * bit Let's say. The bit error rate estimation unit 112 calculates the generated sifted key and the estimated bit error rate p * bit and output to the information matching unit 113.

[0041] <Information matching> The information matching units 113 and 213 share error correction information (parity information) required to correct bit errors based on the estimated value of the bit error rate, and match the sifted keys. The information matching units 113 and 213 predetermine a plurality of error correction codes with different error correction capabilities.

[0042] The information matching unit 113 on the transmitting side calculates the estimated value p of the bit error rate. * bit Based on the size of the error correction code, an error correction code is selected and parity information required for error correction of the sifted key is generated. The length of the parity information is N IR =N ′ sift (1-f(p * bit )I(X;Y)). where f(p * bit ) is a parameter that indicates the deviation of the error-correcting code used from the Shannon limit and is a value of 1 or less. In addition, I(X;Y) is the mutual information between the transmitter and receiver, and indicates the proportion of random bits that can be corrected when an ideal error correction code (= an error correction code at the Shannon limit) is used. The bit error is calculated as the estimated value p * bitWhen modeled as a two-way symmetric channel, I(X;Y)=1-h2(p * bit ), where h2(·) is the binary entropy function.

[0043] The information matching unit 113 notifies the key distillation processing unit 210 of the selected error correcting code via the public communication channel 3, and also notifies the key distillation processing unit 210 of the parity information. The information matching unit 113 converts the shift key directly into a correction key (key length: N ′ sift ) to the privacy amplifier 114.

[0044] The information matching unit 213 on the receiving side receives the parity information from the key distillation processing unit 110 on the transmitting side via the public communication path 3 . The information matching unit 213 corrects the sifted key with the selected error correction code using the parity information, and generates a correction key (key length: N ′ sift The correction key generated in this way will match the correction key managed by key distillation processing unit 110 on the transmitting side with a very high probability. The information matching unit 213 outputs the generated correction key to the privacy amplification unit 214.

[0045] <Confidentiality Augmentation> The privacy amplifiers 114 and 214 compress the correction key based on the amount of leaked information estimated by the leaked information amount estimation device 40 to generate an encryption key with enhanced privacy.

[0046] The privacy amplifier 214 on the receiving side notifies the key distillation processor 110 on the transmitting side of the amount of leaked information estimated by the leaked information amount estimation device 40 via the public communication channel 3 . The privacy amplifier 214 generates an encryption key by deleting and compressing the correction key generated by the information matching unit 213 by a number of bits according to the amount of leaked information. That is, the key length of the correction key is N ′ sift , when the amount of leaked information is I(Y;Z), the privacy amplifier 214 obtains a length N PA =N′ sift The number of bits of I(Y;Z) is deleted to generate a compressed encryption key. ′ sift From N ′ sift -N IR -N PA The function to compress the data is assumed to be shared between the sender and receiver in advance.

[0047] The privacy amplifier 114 on the transmitting side generates an encryption key by compressing the correction key, similar to the privacy amplifier 214, based on the estimated amount of leaked information notified by the key distillation processor 210 on the receiving side via the public communication channel 3. As described above, the key distillation processing unit 110 and the key distillation processing unit 210 obtain the final length N fin But, N fin =N ′ sift -N IR -N PA =N ′ sift (f(p * bit )I(X;Y)-I(Y;Z)) is generated. This is because the correction key has a compression ratio (f(p * bit )I(X;Y)-I(Y;Z)) to generate the final encryption key. At this time, the key distillation processing unit 110 and the key distillation processing unit 210 calculate the number N of transmitted optical pulses. tot The length of the final encryption key for fin Ratio of (N fin / N tot ) can generate encryption keys at a key generation rate of

[0048] In addition to the four basic processes (sifting, bit error rate estimation, information matching, and privacy amplification), some key distillation protocols may also disclose additional parity information to confirm the success or failure of information matching. In this case, the number of bits to be deleted by privacy amplification must be increased, which changes the formulas for the compression rate and key generation rate mentioned above. Returning to FIG. 1, the configuration of the encryption key sharing system 1 will be further described.

[0049] [Environmental measurement device] The environmental measurement device 30 measures the atmospheric environment of the line-of-sight communication path 2. The environmental measurement device 30 is composed of multiple measurement devices that measure the atmospheric environment of the line-of-sight communication path 2. Here, the environmental measurement device 30 includes an atmospheric fluctuation measurement device 31, a solar radiation measurement device 32, an anemometer 33, a barometer 34, a thermo-hygrometer 35, and an optical signal intensity acquisition device 36. Note that it is not necessary to include all of these multiple devices. Also, the same measurement device may be placed at multiple locations.

[0050] It is sufficient that the environmental measuring device 30 includes at least the atmospheric fluctuation measuring device 31. For example, if only the atmospheric fluctuation measuring device 31 is included, the leaked information amount estimation device 40 will estimate the amount of leaked information based only on the measured values ​​of the atmospheric fluctuation measuring device 31. Of course, by including measuring devices that measure a wide variety of environments in addition to the atmospheric fluctuation measuring device 31, it becomes possible to more accurately estimate the amount of leaked information that accompanies environmental changes.

[0051] The atmospheric fluctuation measurement device 31 measures quantities caused by atmospheric fluctuations in the line-of-sight communication path 2. For example, the atmospheric fluctuation measurement device 31 measures the scintillation index as a quantity caused by atmospheric fluctuations. The phenomenon in which the intensity of light fluctuates over time due to atmospheric fluctuations is called scintillation, and the scintillation index indicates the variance of that fluctuation. To measure the scintillation index between the transmitting device 10 and the receiving device 20, a probe light irradiator (not shown) that irradiates probe light may be provided on the transmitting device 10 side. Then, the atmospheric fluctuation measuring device 31 provided on the receiving device 20 side may measure the scintillation index from the probe light irradiated by the probe light irradiator. The atmospheric fluctuation measuring device 31 outputs the measured scintillation index to the leaked information amount estimating device 40 .

[0052] The solar radiation measurement device 32 measures the amount of solar radiation on the line-of-sight communication path 2. For example, the solar radiation measurement device 32 measures the amount of global solar radiation. The solar radiation measurement device 32 outputs the measured amount of global solar radiation to the leaked information amount estimation device 40. The anemometer 33 measures the wind speed on the line-of-sight communication path 2. The anemometer 33 outputs the measured wind speed to the leaked information amount estimation device 40. The barometer 34 measures the air pressure in the line-of-sight communication path 2. The barometer 34 outputs the measured air pressure to the leaked information amount estimation device 40. The thermo-hygrometer 35 measures the temperature and humidity of the line-of-sight communication path 2. The thermo-hygrometer 35 outputs the measured temperature and humidity to the leaked information amount estimation device 40. Note that the thermo-hygrometer 35 may use separate measuring devices for the thermometer and the hygrometer.

[0053] The optical signal intensity acquisition device 36 acquires the intensity of the optical signal received by the receiving device 20 via the line-of-sight communication path 2. The optical signal intensity acquisition device 36 outputs the acquired optical signal intensity to the leaked information amount estimation device 40. This allows the environment measuring device 30 to notify the leaked information amount estimating device 40 of measurement values ​​obtained by measuring a wide variety of environments of the line-of-sight communication path 2.

[0054] [Device for estimating the amount of leaked information] The leaked information amount estimation device 40 estimates the amount of information leaked to an eavesdropper from the line-of-sight communication path 2 (amount of leaked information) based on the environmental measurement value in the environment measurement device 30. The leaked information amount estimation device 40 has two operation modes: a learning mode for learning a model for estimating the amount of leaked information, and an estimation mode for estimating the amount of leaked information from environmental measurement values ​​using the learned model. The leaked information amount estimation device 40 includes a learning unit 41, a model storage unit 42, and an estimation unit 43. When an operation mode is instructed from outside to be a learning mode, the leaked information amount estimation device 40 operates the learning unit 41, and when an estimation mode is instructed, the device operates the estimation unit 43.

[0055] The learning unit (learning device) 41 learns a machine learning model that uses a plurality of environmental measurement values ​​as a vector of explanatory variables and the amount of leaked information as a response variable. The learning unit 41 inputs multiple measurement values ​​(explanatory variable vectors) measured by each measuring device of the environmental measuring device 30, and learns a model by supervised machine learning using the amount of leaked information measured by the leaked information amount measuring device 50 as training data. This supervised machine learning algorithm can use algorithms such as neural networks such as deep learning, nearest neighbor methods, linear models, naive Bayes classifiers, and decision trees.

[0056] For example, when the learning unit 41 uses a neural network as a supervised machine learning algorithm, it learns the parameters of the model 400 using a feed forward neural network (FFNN) consisting of an input layer 401, an intermediate layer 402, and an output layer 403, as shown in FIG. 3. In the model 400, an explanatory variable vector such as a scintillation index is input to each node of the input layer 401, and in the intermediate layer 402, a weight is added to the value of each element of the explanatory variable vector input to the input layer 401 and propagated, and the amount of leaked information (a value between 0 and 1) is output from the output layer 403.

[0057] The learning unit 41 learns the weights of each layer of the model 400 as parameters so that an explanatory variable vector is input to the input layer 401 and the amount of leaked information measured by the leaked information amount measuring device 50 is output from the output layer 403. For example, the error back propagation method can be used to learn the model 400. The learning unit 41 writes and stores the learned model, specifically the model parameters, in the model storage unit 42.

[0058] If the environment measuring device 30 is equipped with multiple measuring devices of the same type, the learning unit 41 can use the average of the measurement values ​​of the measuring devices of the same type as one element of the explanatory variable vector. Alternatively, the measurement values ​​of multiple measuring devices may be used as elements of independent explanatory variable vectors. Moreover, although the learning unit 41 is configured to be provided inside the leaked information amount estimation device 40 here, it may be configured to be provided separately as a learning device outside the leaked information amount estimation device 40.

[0059] The model storage unit 42 stores a trained model for estimating the amount of leaked information from a plurality of environmental measurement amounts. The model storage unit 42 can be configured with a general storage medium such as a semiconductor memory. Here, the model storage unit 42 learns the model learned by the learning unit 41, and the estimation unit 43 refers to this model.

[0060] The estimation unit 43 estimates the amount of leaked information from a plurality of environmental measurement values. The estimation unit 43 uses the trained model stored in the model storage unit 42 to estimate the amount of leaked information from a plurality of measurement values ​​measured by each measurement device of the environment measuring device 30. For example, the estimation unit 43 inputs an explanatory variable vector such as a scintillation index to each node of the input layer 401 of the model 400 shown in FIG. 3, and estimates the value output from the output layer 403 as the amount of leaked information. The estimation unit 43 outputs the estimated amount of leaked information to the receiving device 20 (key distillation processing unit 210).

[0061] This allows the leaked information amount estimation device 40 to learn a model for estimating the amount of leaked information from a plurality of environmental measurement values ​​in the learning mode. Also, the leaked information amount estimation device 40 can estimate the amount of leaked information from a plurality of environmental measurement values ​​using the trained model in the estimation mode.

[0062] In this way, the leaked information amount estimation device 40 performs statistical learning using multiple environmental measurement values, thereby averaging and eliminating factors that are difficult to observe and that cause variations in the estimates. This enables the leaked information amount estimation device 40 to estimate the amount of information leaked to an eavesdropper with a high likelihood from a combination of environmental measurement values ​​of the line-of-sight communication channel 2.

[0063] [Leaked information amount measuring device] The leaked information amount measuring device 50 simulates an eavesdropper and measures the amount of information leaked from the line-of-sight communication path 2 (amount of leaked information). The leaked information amount measuring device 50 is installed near a security area (see FIG. 7) that the receiver has predetermined around the receiving device 20. The security area is an area in which the receiver can confirm in advance that there is no eavesdropper. The leaked information amount measuring device 50 includes a light receiving unit 51, a photoelectric conversion unit 52, a decoding unit 53, and a leaked information amount calculation unit .

[0064] The light receiving unit 51 receives an optical signal (leaked optical signal) leaked from the line-of-sight communication path 2. The light receiving unit 51 can have the same configuration as the light receiving unit 201. The light receiving section 51 outputs the received optical signal to the photoelectric conversion section 52 . The photoelectric conversion unit 52 converts the optical signal received by the light receiving unit 51 into an electrical signal. The photoelectric conversion unit 52 outputs the converted electrical signal to the decoding unit 53. The decoding unit 53 decodes the electrical signal converted by the photoelectric conversion unit 52 into a bit string. The decoding unit 53 performs decoding using the same method as the decoding unit 203, thereby attempting to decode the bit string of the random number sequence. The decoding unit 53 outputs the decoded bit string to the leaked information amount calculation unit 54.

[0065] The leaked information amount calculation unit 54 calculates the amount of leaked information by comparing the raw key bit string, i.e., the random number bit string obtained from the key distillation processing unit 210, with the bit string decrypted by the decryption unit 53. As a specific example, the leaked information amount calculation unit 54 calculates the hit rate (the rate at which bit values ​​are the same) of the decrypted bit string with respect to the bit string of the raw key as the amount of leaked information. The leaked information amount calculation unit 54 outputs the calculated amount of leaked information to the leaked information amount estimation device 40. This amount of leaked information becomes training data for the learning unit 41 in the learning mode. This allows the leaked information amount measuring device 50 to simulate an eavesdropper, measure the amount of leaked information corresponding to environmental changes, and generate training data for learning a model.

[0066] With the above-described configuration, the encryption key sharing system 1 can estimate with a high likelihood the amount of information leaked to an eavesdropper from the state of the line-of-sight communication channel 2, and generate an encryption key with enhanced security in accordance with the amount of leaked information. More specifically, by performing privacy amplification based on the obtained estimate, it is possible to generate an encryption key whose security is guaranteed with a high degree of certainty.

[0067] [Operation of encryption key sharing system] Next, the operation of the encryption key sharing system according to the embodiment of the present invention will be described with reference to Fig. 4 and Fig. 5. Fig. 4 is a sequence diagram showing the operation of the encryption key sharing system according to the embodiment of the present invention in the learning mode. Fig. 5 is a sequence diagram showing the operation of the encryption key sharing system 1 according to the embodiment of the present invention in the estimation mode.

[0068] [Learning Mode] First, the operation of the encryption key sharing system 1 in the learning mode will be described with reference to FIG. 4 (and for the configuration, refer to FIG. 1 as appropriate).

[0069] In step S1, each measuring device (31, 32, . . . , 36) of the environment measuring device 30 measures various environmental measurement values ​​in free space including the line-of-sight communication path 2. The environmental measurement values ​​measured by the environment measuring device 30 are measured in time series, and become values ​​of an explanatory variable vector for the leaked information amount estimating device 40 to learn a model in step S11, which will be described later.

[0070] In step S2, the transmitting device 10 encodes the random number bit string into an optical signal as a raw key bit string. Here, the transmitting device 10 adjusts the intensity of the laser light emitted by the light emitting unit 101 using the light intensity adjusting unit 102. Then, the transmitting device 10 modulates and encodes the intensity-adjusted optical signal using the encoding unit 103 based on a random number bit string.

[0071] In step S3, the transmitting device 10 causes the light transmitting unit 104 to transmit the random number bit string encoded in step S2 to the line-of-sight communication path 2 in free space. In step S4, the transmitting device 10 transmits the random number bit string encoded in step S2 by the key distillation processing unit 110 as a raw key bit string to the key distillation processing unit 210 of the receiving device 20 via the public communication path 3.

[0072] In step S5, the receiving device 20 receives, via the public communication path 3, the bit string of the raw key transmitted in step S4 by the key distillation processing unit 210. In step S6, the receiving device 20 causes the key distillation processing unit 210 to transmit the bit string of the raw key received in step S5 to the leaked information amount measurement device 50. In addition, if the environmental measuring device 30 is equipped with an optical signal intensity acquisition device 36, the receiving device 20 receives the optical signal sent by the light receiving unit 201 in step S3 and notifies the optical signal intensity acquisition device 36 (not shown as a step).

[0073] In step S7, the leaked information amount measuring device 50 receives, by the light receiving unit 51, the optical signal leaked from the line-of-sight communication path 2 (leaked optical signal). In step S8, the leaked information amount measuring device 50 attempts to decode the random number bit string from the optical signal received in step S7. Here, the leaked information amount measuring device 50 converts the optical signal received in step S7 into an electrical signal by the photoelectric conversion unit 52, and decodes it into a random number bit string by the decoding unit 53.

[0074] In step S9, the leaked information amount measuring device 50 receives, via the leaked information amount calculating unit 54, the bit string of the raw key transmitted in step S6. In step S10, the leaked information amount measurement device 50 calculates the amount of leaked information by comparing the random number bit string decrypted in step S8 with the bit string of the raw key received in step S9 using the leaked information amount calculation unit 54, and transmits the amount of leaked information to the leaked information amount estimation device 40.

[0075] In step S11, the leaked information amount estimation device 40 receives the various measurement values ​​transmitted in step S1 and the amount of leaked information transmitted in step S10, and trains a model using the learning unit 41. Here, the learning unit 41 trains a machine learning model by supervised machine learning using the various measurement values ​​as explanatory variable vectors and the amount of leaked information as training data. The trained model is stored in the model storage unit 42. By the above operation in the learning mode, the encryption key sharing system 1 can learn the correlation between the state of the line-of-sight communication path 2 and the amount of leaked information.

[0076] [Estimation mode] Next, with reference to Fig. 5 (and for the configuration, refer to Fig. 1 as appropriate), the operation of the estimation mode of the encryption key sharing system 1 will be described. It is assumed that the model storage unit 42 of the leaked information amount estimation device 40 stores a trained model that estimates the amount of leaked information from a plurality of environmental measurement values, which has been trained by the operation of the learning mode described with reference to Fig. 4.

[0077] In step S20, each measuring device (31, 32, . . . , 36) of the environment measuring device 30 measures a plurality of environment measurement values ​​in free space including the line-of-sight communication path 2. The environmental measurement values ​​measured by the environment measuring device 30 are measured in time series and are received at the timing when the leaked information amount estimation device 40 estimates the amount of leaked information in step S25 described later.

[0078] In step S21, the transmitting device 10 encodes the random number bit string as an optical signal. Here, the transmitting device 10 adjusts the intensity of the laser light emitted by the light emitting unit 101 using the light intensity adjusting unit 102. Then, the transmitting device 10 modulates and encodes the intensity-adjusted optical signal using the encoding unit 103 based on a random number bit string. In step S22, the transmitter 10 causes the light transmitting unit 104 to transmit the optical signal encoded in step S21 to the line-of-sight communication path 2 in free space.

[0079] In step S23, the receiving device 20 receives the optical signal transmitted to the line-of-sight communication path 2 in step S22 by the light receiving unit 201. If the environmental measuring device 30 is equipped with an optical signal intensity acquisition device 36, the receiving device 20 notifies the optical signal intensity acquisition device 36 of the intensity of the received optical signal (not shown as a step). In step S24, the receiving device 20 decodes the random number bit string from the optical signal received in step S23. Here, the receiving device 20 converts the optical signal received in step S22 into an electrical signal by the photoelectric conversion unit 202, and decodes it into a random number bit string by the decoding unit 203.

[0080] In step S25, the leaked information amount estimation device 40 receives, via the estimation unit 43, the plurality of environmental measurement values ​​transmitted in step S20. In step S26, the leaked information amount estimation device 40 uses the model stored in the model storage unit 42 to estimate the amount of leaked information from the plurality of environmental measurement values ​​received in step S25, using the estimation unit 43. In step S27, the leaked information amount estimation device 40 causes the estimation unit 43 to transmit the leaked information amount estimated in step S26 to the receiving device 20. In step S28, the receiving device 20 receives, via the key distillation processing unit 210, the amount of leaked information transmitted in step S27.

[0081] In step S29 (S29A, S29B), the key distillation processing unit 110 of the sending device 10 and the key distillation processing unit 210 of the receiving device 20 perform key distillation processing to generate an encryption key and share the key. Here, the key distillation processing units 110 and 210 generate a key that matches between the sender and the receiver from the original random number bit string encoded in step S21 by performing shifting processing by the shifting units 111 and 211, bit error rate estimation processing by the bit error rate estimation units 112 and 212, and information matching processing by the information matching units 113 and 213. Then, the key distillation processing units 110 and 210 generate an encryption key by compressing the key that has undergone information matching using the privacy amplifiers 114 and 214 at a compression rate according to the amount of leaked information received in step S28.

[0082] By the above operation in the estimation mode, the encryption key sharing system 1 can estimate the amount of leaked information according to the state of the line-of-sight communication path 2, and generate an encryption key according to the amount of leaked information. As a result, the encryption key sharing system 1 can generate an encryption key with enhanced security according to the amount of leaked information in accordance with the state of the line-of-sight communication channel 2, and share the encryption key between the transmitting device 10 and the receiving device 20. More specifically, the encryption key sharing system 1 can generate, at an optimal speed, an encryption key whose security is guaranteed with a high degree of certainty by performing privacy amplification based on an estimate with a high likelihood of the amount of leaked information.

[0083] Although the configuration and operation of the encryption key sharing system 1 according to the embodiment of the present invention have been described above, the present invention is not limited to this embodiment. Here, the system is configured to include one leaked information amount measuring device 50 that simulates an eavesdropper. However, a plurality of leaked information amount measurement devices 50 may be provided outside the line-of-sight communication path 2. In this case, the learning unit 41 of the leaked information amount estimation device 40 uses, for example, the largest value of the amount of leaked information measured by the plurality of leaked information amount measurement devices 50 as training data.

[0084] Also, the encryption key sharing system 1 has been described here as a system that can operate by switching between a learning mode and an estimation mode. However, if a pre-trained model is stored in the model storage unit 42, it is not necessarily required to operate in the learning mode. In this case, the leaked information amount measuring device 50 may be omitted from the encryption key sharing system 1, and the learning unit 41 may be omitted from the leaked information amount estimating device 40, resulting in an encryption key sharing system 1B shown in FIG. [Explanation of symbols]

[0085] 1. Cryptographic key sharing system 10 Transmitting device 100 Optical signal transmitter 101 Light-emitting part 102 Light intensity adjustment unit 103 Encoding section 104 Light transmitting unit 110 Key distillation processing unit (first key distillation processing unit) 111 Shifting section 112 Bit Error Rate Estimation Unit 113 Information Integration Department 114 Privacy Amplification Unit 20 Receiving device 200 Optical signal receiving unit 201 Light receiving section 202 Photoelectric conversion unit 203 Decoding Unit 210 Key distillation processing unit (second key distillation processing unit) 211 Shifting section 212 Bit Error Rate Estimation Unit 213 Information Integration Department 214 Privacy Amplification Unit 30 Environmental measurement device 31 Atmospheric Fluctuation Measurement Device 32 Solar radiation measuring device 33 Anemometer 34 Barometer 35 Thermohygrometer 36 Optical signal strength acquisition device 40. Leaked Information Amount Estimation Device 41 Learning unit (learning device) 42 Model memory section 43 Estimation part 50 Leaked information amount measuring device 51 Light receiving part 52 Photoelectric conversion unit 53 Decoding section 54 Leaked information amount calculation unit

Claims

1. An encryption key sharing system in which an encryption key is shared between a transmitting device and a receiving device by using an optical signal propagating through a line-of-sight communication path, At least one measurement device for measuring the environment of the line-of-sight communication path; a leaked information amount estimation device that estimates the amount of information leaked to an eavesdropper from the measurement values ​​output by the measurement device using a model previously trained by machine learning; the transmitting device including an optical signal transmitting unit that encodes a random number bit string that is a source of the encryption key into the optical signal and transmits the encoded optical signal to the line-of-sight communication path, and a first key distillation processing unit that generates the encryption key from the random number bit string by key distillation processing via a public communication path; the receiving device including an optical signal receiving unit that receives the optical signal via the line-of-sight communication path and decodes it into a random number bit string, and a second key distillation processing unit that generates the encryption key from the decoded random number bit string by key distillation processing via the public communication path, The encryption key sharing system is characterized in that the first key distillation processing unit and the second key distillation processing unit perform key distillation at a compression rate according to the amount of leaked information.

2. a leaked information amount measuring device for measuring the amount of leaked information of the optical signal leaking from the line-of-sight communication path; a learning device that receives a measurement value output by the measuring device and learns the model by supervised machine learning using the amount of leaked information measured by the leaked information amount measuring device as training data; The encryption key sharing system according to claim 1, further comprising:

3. In the learning mode, the transmitting device transmits the random number bit string to the receiving device via the public communication path, and the receiving device notifies the leaked information amount measurement device of the random number bit string; 3. The encryption key sharing system according to claim 2, wherein the leaked information amount measurement device measures the amount of leaked information by comparing a bit string obtained by decrypting an optical signal leaked from the line-of-sight communication path with a random number bit string notified by the receiving device.

4. 4. The encryption key sharing system according to claim 1, wherein the first key distillation processing unit and the second key distillation processing unit generate the encryption key by increasing the compression rate as the amount of leaked information increases.

5. 5. The encryption key sharing system according to claim 1, wherein the measurement values ​​include an intensity of the optical signal received by the optical signal receiving unit.

Images