Encryption key sharing system

Abstract

To provide an encryption key sharing system that can switch from multiple line-of-sight channels to a secure line-of-sight channel and share encryption keys.SOLUTION: An encryption key sharing system 1 includes a measurement device that measures the atmospheric environment for each line-of-sight communication channel 2, a leaked information amount estimating device 30 that estimates the leaked information amount from the measured values output by the measurement device using a model learned in advance by machine learning, a transmitting device 10 that switches the line-of-sight channel 2 on the basis of the amount of leaked information and sends a random number bit string to the line-of-sight communication channel 2 as an optical signal, and a receiving device 20 that receives the optical signal and performs key distillation from the random number bit string with the transmitting device 10 at a compression rate according to the amount of leaked information to generate an encryption key.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a technology for sharing an information-theoretically secure encryption key using an optical signal propagating through a line-of-sight communication path, and to a site diversity encryption key sharing system that switches line-of-sight communication paths. [Background technology]

[0002] Physical layer cryptography is known as a technology for sharing information-theoretically secure cryptographic keys using optical signals generated by highly directional laser beams that propagate through line-of-sight communication paths (see Patent Documents 1 and 2, and Non-Patent Documents 1 and 2). This physical layer cryptography is particularly effective in quantum communication networks based on satellite relays. As a quantum communication network based on satellite relays, technologies have been disclosed that appropriately switch multiple communication paths between one or multiple satellites and multiple ground stations (see Patent Documents 3 to 5). Also disclosed are technologies that switch destination ground stations based on a cloud cover map, which is weather data (see Patent Document 6), and technologies that segment messages to be transmitted and communicate messages over diverse paths using site diversity (see Patent Document 7).

[0003] Unlike computationally secure cryptographic techniques such as public key cryptography, physical layer cryptography using line-of-sight communication channels generates a cryptographic key that can only be known between the legitimate sender and receiver, based on signal processing that utilizes the physical properties and behavior of the physical layer of communication, i.e., the light propagating through the line-of-sight communication channel, the optical transmitter, receiver, and the line-of-sight communication channel.

[0004] To generate an encryption key in physical layer encryption, a random bit string, which is the source of the encryption key, is first transmitted from the sender to the receiver in the form of light. Because a highly directional laser beam is used in line-of-sight communication paths, it is practically extremely difficult for an eavesdropper to install an eavesdropping device at the center of the laser beam without being detected by the sender or receiver, and then perform some kind of processing on all received optical signals before retransmitting them. Therefore, eavesdroppers have no choice but to use light leaking from line-of-sight communication channels due to atmospheric turbulence, etc., to avoid being in the field of view of the sender and receiver. Atmospheric turbulence refers to the phenomenon in which the refractive index of the atmosphere changes randomly and is distributed due to heat. This phenomenon also gives rise to the concept of "state," such as changes in reception strength over time, in optical space communications.

[0005] In line-of-sight communication channels, atmospheric turbulence causes fluctuations in received signal strength, but at the same time, it can also be a factor in leaking information to eavesdroppers outside the laser beam's irradiation range due to photon scattering, fluctuations in the angle of arrival, and expansion of the laser beam diameter. Note that fluctuations in received signal strength in line-of-sight communication channels are not limited to atmospheric turbulence, but can also be affected by any physical phenomenon, such as changes in solar radiation, wind speed, air pressure, temperature, and humidity. Thus, it is clear that disturbances in the natural environment, including atmospheric turbulence, cannot be secretly and intentionally controlled by an eavesdropper.

[0006] For these reasons, it is considered reasonable to assume an eavesdropping model in which, in line-of-sight communication channels using laser beams, an eavesdropper can only passively obtain information from leaking optical signals. In this case, if the amount of information leaked to an eavesdropper can be properly evaluated and the value is within an acceptable range, a secure encryption key can be shared between the sender and receiver.

[0007] Therefore, in conventional physical layer cryptography, the amount of information leaked to an eavesdropper is evaluated, and the evaluated amount of information leaked is set as the upper bound. A secure cryptographic key is extracted from the random bit string that may have been partially leaked by a series of signal processing steps (key distillation process) including privacy amplification.

[0008] Here, the relationship between the sender, receiver, and eavesdropper in conventional physical layer encryption will be described with reference to Figures 10 and 11. Figure 10 is a diagram showing a typical embodiment of physical layer encryption using a moving object. Figure 10 schematically shows a state in which an optical signal emitted by a laser beam L from a transmitter S of a sender equipped on an airplane is received by a receiver R of a receiver equipped on a drone, and eavesdropped by a receiver R2 of an eavesdropper.

[0009] As shown in Figure 10, a transmitting device S transmits information by modulating a highly directional laser beam L. The authorized receiver is positioned at the center of the spread of the laser beam L using a receiving device R to receive and demodulate the optical signal. Meanwhile, an eavesdropper attempts to steal this optical signal, but to avoid being discovered by the sender and receiver, they do so by using a highly sensitive receiving device R2 from a position away from the center of the spread of the laser beam L, such as behind the receiver. Since it is difficult to directly estimate the amount of information leaked to the eavesdropper's receiving device R2, the legitimate receiver sets up a physical guard area GA around himself / herself and places a receiving device R3 simulating an eavesdropper very close to the boundary of that area in order to estimate the amount of leaked information. Conventionally, the amount of information received by the receiving device R3 is treated as the upper limit of the amount of leaked information.

[0010] FIG. 11 is a diagram showing a communication path model for evaluating the bit error rate and the amount of leaked information in the embodiment of FIG. The communication channel between the sender and the authorized receiver is modeled as the main channel M, and the communication channel between the sender and the eavesdropper is modeled as the estimated channel P. These channels are characterized by transition probabilities and a completely positive trace-preserving (CPTP) map. That is, the changes in the symbols of information passing through these channels are described by these probabilities and maps, and the performance of the physical layer encryption is revealed from these probabilities and maps. These probabilities and maps are determined by the atmospheric conditions through which the laser beam propagates, the positions of the transmitter, the authorized receiver, and the receiver simulating an eavesdropper, as well as the signal demodulation method. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] European Patent Application Publication No. 3337063 [Patent Document 2] International Publication No. 2019 / 139544 [Patent Document 3] Special Publication No. 2018-502514 [Patent Document 4] Chinese Patent Application Publication No. 113572610 [Patent Document 5] Chinese Patent Application Publication No. 113452509 [Patent Document 6] International Publication No. 2021 / 090024 [Patent Document 7] U.S. Patent Application Publication No. 2021 / 0258775 [Non-patent literature]

[0012] [Non-Patent Document 1] Z.Pan et al., “Secret-key distillation across a quantum wiretap channel under restricted eavesdropping,”Phys.Rev.Applied,vol.14,no.2,024044,2020. [Non-patent document 2] H.Endo,et al.,OSA Continuum 3 pp.2525-2543,2020. Summary of the Invention [Problem to be solved by the invention]

[0013] In conventional technologies, due to fluctuations in the atmospheric environment of a line-of-sight communication path and statistical variations in the evaluation value for that environment, it is difficult to properly evaluate the amount of information leaked to an eavesdropper, and the security of the encryption key extracted by key distillation processing is not optimized. More specifically, when the amount of leaked information is estimated to be smaller than the actual value, an encryption key that is not necessarily secure is generated at a high speed, while when the amount of leaked information is estimated to be larger than the actual value, the generated encryption key is secure but is generated only at a low speed. Furthermore, conventional technologies do not understand the correlation between the state of a line-of-sight communication channel and the amount of information leaked to an eavesdropper, which makes it difficult to predict the performance of physical layer encryption (security of encryption keys, generation efficiency, etc.) under actual conditions of a line-of-sight communication channel and to optimize the operation of the device. Furthermore, conventional techniques have the problem that they are unable to appropriately switch line-of-sight communication paths using site diversity because they do not understand the correlation between the state of line-of-sight communication paths and the amount of leaked information.

[0014] Therefore, an object of the present invention is to provide a site diversity type encryption key sharing system that can estimate the correlation between the state of a line-of-sight communication path and the amount of leaked information, generate a secure encryption key that is adapted to the actual environment of the line-of-sight communication path, and share an encryption key by switching from multiple line-of-sight communication paths to a secure line-of-sight communication path using site diversity. [Means for solving the problem]

[0015] In order to solve the above-mentioned problems, the encryption key sharing system of the present invention is an encryption key sharing system that uses optical signals propagating through line-of-sight communication paths to share an encryption key between a transmitting device and receiving devices arranged for each of a plurality of line-of-sight communication paths, and is configured to include a measurement device, a leaked information amount estimation device, a transmitting device having an optical signal transmitting unit, a first key distillation processing unit, and a line-of-sight communication path switching control unit, and a plurality of receiving devices having an optical signal receiving unit and a second key distillation processing unit.

[0016] In such a configuration, the encryption key sharing system measures the atmospheric environment (atmospheric turbulence, amount of solar radiation, etc.) of each line-of-sight communication path using at least one measurement device. The encryption key sharing system then uses a leaked information amount estimation device to estimate the amount of information leaked to an eavesdropper from the measurements output by the measurement device using a model previously trained by machine learning. This makes it possible to estimate the amount of leaked information with a high likelihood from the actual environment of a line-of-sight communication path, unlike conventional techniques. In addition, the encryption key sharing system has a line-of-sight communication path switching control unit in the transmitting device that switches the line-of-sight communication path based on the amount of leaked information, an optical signal transmitting unit in the transmitting device that encodes a random bit string that is the source of the encryption key into an optical signal and transmits it to the line-of-sight communication path, and an optical signal receiving unit in the receiving device that receives the optical signal via the line-of-sight communication path and decodes it into a random bit string.

[0017] The encryption key agreement system then generates an encryption key from a random bit string by key distillation via a public communication channel using a first key distillation processor in the transmitting device and a second key distillation processor in the receiving device. At this time, the first key distillation processor and the second key distillation processor compress the random bit string, the identity of which has been confirmed between the sender and receiver through error correction, at a compression rate according to an estimated value for the amount of leaked information. This allows the encryption key agreement system to generate an encryption key with security guaranteed according to the amount of leaked information via a secure line-of-sight communication channel. More specifically, the encryption key agreement system can efficiently generate an encryption key with a high degree of security guaranteed by using a highly secure line-of-sight communication channel and performing privacy amplification based on a highly likely estimate of the amount of leaked information.

[0018] To learn a model for estimating the amount of leaked information, the encryption key sharing system may be configured to further include a device for measuring the amount of leaked information and a learning device.

[0019] In such a configuration, the encryption key sharing system measures the amount of leaked information of the optical signal leaking from the line-of-sight communication path using the leaked information amount measurement device. The encryption key sharing system then inputs the measurement values ​​output by the measurement device to the learning device, and learns a model through supervised machine learning using the amount of leaked information measured by the leaked information amount measurement device as training data. [Effects of the Invention]

[0020] According to the present invention, it is possible to estimate the correlation between the state of a line-of-sight communication path and the amount of leaked information, switch from a plurality of line-of-sight communication paths to a secure line-of-sight communication path, and generate a secure encryption key adapted to the actual environment of the line-of-sight communication path. [Brief explanation of the drawings]

[0021] [Figure 1] 1 is an explanatory diagram for explaining an overview of a site diversity type encryption key sharing system according to a first embodiment of the present invention; [Figure 2] FIG. 2 is a diagram showing the overall configuration of the encryption key sharing system of FIG. [Figure 3] 3 is a block diagram showing the internal configuration of the encryption key sharing system of FIG. 2. FIG. [Figure 4] FIG. 4 is a block diagram showing the internal configuration of the key distillation processing unit in FIG. 3. [Figure 5] FIG. 4 is a configuration diagram of a neural network showing an example of a model stored in a model storage unit of FIG. 3. [Figure 6] FIG. 3 is a sequence diagram showing the switching operation of line-of-sight communication paths in the encryption key sharing system according to the first embodiment of the present invention. [Figure 7] FIG. 10 is an explanatory diagram illustrating an overview of an encryption key sharing system according to a second embodiment of the present invention. [Figure 8] FIG. 8 is a block diagram showing the configuration of the encryption key sharing system of FIG. 7. [Figure 9] FIG. 8 is a sequence diagram showing a model learning operation of the encryption key sharing system of FIG. 7. [Figure 10]FIG. 1 illustrates a typical prior art implementation of physical layer encryption by a mobile entity. [Figure 11] FIG. 11 is a diagram showing a communication path model for evaluating a bit error rate and an amount of leaked information in the conventional embodiment of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0022] Hereinafter, a site diversity type encryption key sharing system according to an embodiment of the present invention will be described in detail with reference to the drawings.

[0023] First Embodiment [Overall configuration of the encryption key sharing system] The overall configuration of an encryption key sharing system 1 according to a first embodiment of the present invention will be described with reference to FIGS.

[0024] The encryption key sharing system 1 shares an encryption key between a transmitting device 10 and a plurality of receiving devices 20 (201, 202) using optical signals. The encryption key sharing system 1 is a site diversity type encryption key sharing system that switches to a line-of-sight communication path 2 through which an optical signal propagates that is in good condition, i.e., one with a small amount of leaked information (amount of leaked information), and communicates between the transmitting device 10 and the receiving device 20. The line-of-sight communication path 2 is a free-space communication path for line-of-sight communication in which optical signals propagate directly. Here, line-of-sight communication refers to communication in which there are no obstructions between the sender and receiver and they can see each other. Examples of line-of-sight communication include optical communication between a low-orbit satellite and a ground station, and optical communication between a high-altitude geostationary orbit satellite and a ground station.

[0025] Here, it is assumed that the transmitting device 10 is provided on a satellite ST, and the multiple receiving devices 20 (201, 202) are provided on ground stations GS (GS1, GS2), respectively. Note that the number of ground stations GS may be three or more. In the encryption key sharing system 1, the leaked information amount estimation device 30 (301, 302) estimates the amount of leaked information based on the environmental measurement results measured by the environmental measurement device 40 (401, 402). In the encryption key sharing system 1, the transmitting device 10 acquires the estimated amount of leaked information via the public communication path 3, and switches the line-of-sight communication path 2 (21, 22) based on the amount of leaked information. The public communication channel 3 is, for example, an authenticated communication channel such as the Internet.

[0026] With this configuration, the encryption key sharing system 1 uses the leaked information amount estimation device 30 to estimate the amount of leaked information from the measured value of the atmospheric condition of the line-of-sight communication channel 2 measured by the environmental measurement device 40. Then, the encryption key sharing system 1 switches to a secure line-of-sight communication channel 2 in which the amount of leaked information notified via the public communication channel 3 is less than a predetermined standard by the transmitting device 10. Furthermore, the encryption key sharing system 1 generates a secure encryption key between the transmitting device 10 and the receiving device 20 from the random number bit string by key distillation processing via the public communication channel 3. A user who wishes to obtain the encryption key (a user who wishes to decrypt encrypted data) can connect to the ground station GS via a network (terrestrial network) and obtain the encryption key from the receiving device 20 that has decrypted the encryption key.

[0027] [Internal structure of the encryption key sharing system] The internal configuration of the encryption key sharing system 1 will be described with reference to Fig. 3 (and Fig. 1 and Fig. 2 as appropriate). Note that Fig. 3 shows only one set of a receiving device 20, a leaked information amount estimation device 30, and an environment measuring device 40. The encryption key sharing system 1 includes a transmitting device 10 provided on a satellite ST, a receiving device 20 and a leaked information amount estimation device 30 provided on a ground station GS, and an environmental measuring device 40 located on a line-of-sight communication path 2 of the ground station GS. The receiving device 20, the leaked information amount estimation device 30, and the environmental measuring device 40 are each connected by a dedicated line (whether wired or wireless).

[0028] [Transmitting device] The transmitting device 10 transmits a random bit string as an optical signal to the receiving device 20, and shares an encryption key with the receiving device 20 by performing key distillation processing. The transmitting device 10 includes an optical signal transmitting unit 100, a leaked information amount acquiring unit 110, a line-of-sight communication path switching control unit 120, and a key distillation processing unit 130.

[0029] The optical signal transmitting unit 100 encodes a random bit string, which is the source of an encryption key, into an optical signal and transmits it to the line-of-sight communication path 2. The optical signal transmitting unit 100 includes a light emitting unit 101, a light intensity adjusting unit 102, an encoding unit 103, and a light transmitting unit 104.

[0030] The light emitting unit 101 emits a train of optical pulses. Here, the light emitting unit 101 uses a laser light source that emits a highly directional light beam. The light intensity adjusting unit 102 adjusts the intensity of the optical pulse train output from the light emitting unit 101 to a level suitable for optical communications. For example, the light intensity adjusting unit 102 adjusts the intensity of the optical pulse train at a level instructed from an external source. Furthermore, for example, the light intensity adjusting unit 102 may acquire a scintillation index measured in the line-of-sight communication path 2 from the receiving device 20, and adjust the intensity of the optical pulse train so that the larger the value of the scintillation index, the stronger the intensity of the optical pulse train. The phenomenon in which the received intensity of light fluctuates over time due to atmospheric turbulence is called scintillation, and the scintillation index indicates the variance of this fluctuation.

[0031] The encoding unit 103 modulates the optical pulse train whose level has been adjusted by the optical intensity adjusting unit 102 based on a random number bit string of a predetermined bit length, which is generated by a random number generator (not shown) and serves as the basis of an encryption key, and encodes the optical pulse train as an optical signal corresponding to the random number bit string. For example, the encoding unit 103 encodes the random number bit string for each bit in an orthogonal polarization direction. In this way, the encoding unit 103 generates an optical signal (optical pulse) encoded as "0" or "1" for each photon index. Note that the encoding unit 103 may also encode the random number bit string by a method that demodulates the random number bit string to one of the bits on the receiving side, for example, by on-off modulation. In addition, the encoding unit 103 may use a demodulation method that assigns an erasure symbol to signals that fail to be detected on the receiving side, for example, a method that assigns "0" or "1" to orthogonal polarizations of light and assigns "X" if the detection of light fails in the first place. The encoding unit 103 outputs the generated optical signal to the light transmitting unit 104, and also outputs the random number bit string used for modulation to the key distillation processing unit .

[0032] The light transmitting unit 104 transmits the optical signal encoded by the encoding unit 103. The light transmitting unit 104 transmits the optical signal to the light receiving unit 201 of the receiving device 20 through the line-of-sight communication path 2 in free space. The light transmitting unit 104 switches the line-of-sight communication path 2 under the control of the line-of-sight communication path switching control unit 120, and transmits an optical signal toward the light receiving unit 201 of the receiving device 20 disposed at a predetermined position corresponding to the line-of-sight communication path 2 after the switch. For example, the light transmitting unit 104 switches the line-of-sight communication path 2 by switching the transmission direction of the optical signal using a rotation mechanism about two axes, horizontal and vertical, not shown.

[0033] The leaked information amount acquiring unit 110 acquires the leaked information amount from the receiving device 20 via the public communication path 3 . The leaked information amount acquiring unit 110 outputs to the key distillation processing unit 130 the leaked information amount acquired from the receiving device 20 corresponding to the line-of-sight communication path 2 currently transmitting the optical signal. Furthermore, the leaked information amount acquiring unit 110 outputs the leaked information amounts acquired from all the receiving devices 20 to the line-of-sight communication path switching control unit 120 .

[0034] The line-of-sight communication path switching control unit 120 controls switching of the line-of-sight communication path 2 through which the light transmitting unit 104 transmits the optical signal, based on the amount of leaked information acquired by the amount of leaked information acquiring unit 110 . The line-of-sight communication path switching control unit 120 controls the light transmitting unit 104 to switch the transmission direction of the optical signal to a line-of-sight communication path 2 that is below the standard when the amount of leaked information acquired from the receiving device 20 corresponding to the line-of-sight communication path 2 currently transmitting the optical signal exceeds a predetermined standard. Note that even if the amount of leaked information is equal to or less than a predetermined standard, the line-of-sight communication path switching control unit 120 may periodically switch between the line-of-sight communication paths 2. This allows for further prevention of eavesdropping, even if an eavesdropper is eavesdropping on a line-of-sight communication path 2, because the line-of-sight communication path 2 is periodically switched.

[0035] The key distillation processing unit (first key distillation processing unit) 130 generates an encryption key from a random number bit string by key distillation processing via the public communication channel 3. The key distillation processing unit 130 generates a bit string that is consistent between transmission and reception from the random number bit string between the key distillation processing unit 220 and the key distillation processing unit 220 via the public communication channel 3. Furthermore, the key distillation processing unit 130 generates a privacy-amplified encryption key by compressing the bit string in accordance with the amount of leaked information acquired by the leaked information amount acquisition unit 110 corresponding to the current line-of-sight communication channel 2. The encryption key generated by the key distillation processing unit 130 is used when encrypting plaintext data by encryption means (not shown) of the transmission device 10. The detailed configuration of the key distillation processing unit 130 will be described later together with the explanation of the key distillation processing unit 220.

[0036] This allows the transmitting device 10 to switch to a line-of-sight communication path 2 with high security according to the amount of leaked information, and to generate an encryption key with increased security according to the amount of leaked information, and to share it with the receiving device 20. More specifically, the transmitting device 10 can generate an encryption key with high security guaranteed based on an estimated value with a high likelihood for the amount of leaked information, and share it with the receiving device 20.

[0037] [Receiving device] The receiving device 20 receives the random number bit string as an optical signal from the transmitting device 10, and shares an encryption key with the transmitting device 10 by performing key distillation processing. The receiving device 20 includes an optical signal receiving unit 200, a leaked information amount notifying unit 210, and a key distillation processing unit 220.

[0038] The optical signal receiving unit 200 receives an optical signal via the line-of-sight communication path 2 and decodes it into a bit string. The optical signal receiving unit 200 includes a light receiving unit 201, an opto-electrical conversion unit 202, and a decoding unit 203.

[0039] The light receiving unit 201 receives the encoded optical signal (optical pulse train) transmitted from the transmitting device 10. This light receiving unit 201 receives the optical signal propagated through the line-of-sight communication path 2 in free space. The light receiving unit 201 is composed of, for example, a receiving telescope for receiving light, a coarse tracking system that changes the attitude of the receiving telescope in accordance with changes in the relative positions of the transmitting device 10 and the receiving device 20, and a fine tracking system that corrects small changes in the beam position caused by atmospheric turbulence, etc. The light receiving unit 201 outputs the received optical signal to the photoelectric conversion unit 202. Here, the light receiving unit 201 also outputs the intensity of the received optical signal to an optical signal intensity acquisition device 46 of the environment measuring device 40, which will be described later. Note that if the environment measuring device 40 is configured without the optical signal intensity acquisition device 46, the light receiving unit 201 will not output the intensity of the optical signal. The photoelectric conversion unit 202 converts the optical signal received by the light receiving unit 201 into an electrical signal. The photoelectric conversion unit 202 outputs the converted electrical signal to the decoding unit 203.

[0040] The decoding unit 203 decodes the electrical signal converted by the photoelectric conversion unit 202 into a random bit sequence. For example, if the encoding unit 103 encodes the random bit sequence by a method of encoding each bit in an orthogonal polarization direction, the decoding unit 203 determines whether the signal can be identified for each bit according to the polarization direction and decodes the bit value. In this case, the decoding unit 203 outputs, to the key distillation processing unit 220, the decoded random bit sequence and index information indicating the position in the bit sequence of the signal that was successfully identified. In addition, when the encoding unit 103 encodes the random number bit string, if a method is adopted in which the random number bit string is always demodulated to one of the bits on the receiving side, the decoding unit 203 outputs the decoded random number bit string to the key distillation processing unit 220.

[0041] The leaked information amount notification unit 210 notifies the transmission device 10 of the leaked information amount estimated by the leaked information amount estimation device 30 via the public communication path 3 . Here, the leaked information amount notifying unit 210 outputs the leaked information amount to the transmitting device 10 via the public communication path 3, and also outputs it to the key distillation processing unit 220.

[0042] The key distillation processing unit (second key distillation processing unit) 220 generates an encryption key from the random number bit string by key distillation processing via the public communication channel 3. The key distillation processing unit 220 generates a bit string that is consistent between transmission and reception from the random number bit string between the key distillation processing unit 130 and the key distillation processing unit 130 via the public communication channel 3. Furthermore, the key distillation processing unit 220 generates a privacy-amplified encryption key by compressing the bit string at a compression rate based on the value of the amount of leaked information estimated by the leaked information amount estimation device 30. Here, the key distillation processing unit 220 compresses the bit string at the same compression rate as the key distillation processing unit 130 of the transmitting device 10, and shares the encryption key. This compression rate is set to a higher rate as the amount of leaked information increases.

[0043] This allows the receiving device 20 to generate an encryption key with increased security according to the amount of leaked information and share it with the transmitting device 10. More specifically, the receiving device 20 can perform privacy amplification based on an estimated value with a high likelihood of the amount of leaked information. As a result, the transmitting device 10 and the receiving device 20 can efficiently share an encryption key whose security is guaranteed with a high degree of certainty.

[0044] Here, the configuration for performing the key distillation process of the key distillation process unit 130 and the key distillation process unit 220 will be described with reference to FIG. 4 (and also with reference to FIG. 3 as appropriate). The key distillation processing unit 130 includes a shifting unit 131, a bit error rate estimation unit 132, an information matching unit 133, and a privacy amplification unit 134. The key distillation processing unit 220 includes a shifting unit 221 , a bit error rate estimation unit 222 , an information matching unit 223 , and a privacy amplification unit 224 .

[0045] <Shifting> The shifting units 131 and 221 perform a shifting process to extract bits that have been successfully identified by the receiving side from the random number bit strings on the transmitting and receiving sides by notifying the transmitting side of index information that indicates that the receiving side has successfully identified the signal.

[0046] The sifting unit 221 on the receiving side extracts bits that have been successfully identified from the random number bit string decoded by the decoding unit 203 based on the index information generated by the decoding unit 203, and generates a sifted key (key length: N sift ) The sifting unit 221 notifies the key distillation processing unit 130 on the transmitting side of the index information via the public communication path 3. The sifting unit 221 also outputs the generated sifted key to the bit error rate estimating unit 222.

[0047] The sifting unit 131 on the transmitting side extracts bits from the random number bit string encoded by the encoding unit 103 based on the index information notified from the key distillation processing unit 220 on the receiving side via the public communication channel 3, and arranges the bits in chronological order to generate a sifted key (key length: N sift ) The sifting unit 131 outputs the generated sifted key to the bit error rate estimation unit 132 . In addition, if the encoding unit 103 encodes using a method that always demodulates the random number bit string to one of the bits on the receiving side, the key distillation processing units 130 and 220 do not perform shifting processing, and the shifting units 131 and 221 are omitted from the configuration.

[0048] <Bit error rate estimation> The bit error rate estimation units 132 and 222 estimate the bit error rate by comparing bit strings randomly extracted from the sifted key between the transmitting and receiving sides.

[0049] The bit error rate estimation unit 222 on the receiving side extracts a bit string from the sifted key generated by the sifting unit 221 by Bernoulli sampling, and generates a test bit string (key length: N test) is generated. The bit error rate estimation unit 222 extracts the test bit string from the sifted key to generate a new sifted key (key length: N ′ sift =N sift -N test ) The bit error rate estimation unit 222 notifies the key distillation processing unit 130 on the transmitting side via the public communication channel 3 of the generated test bit string and index information indicating the bit position of the test bit string in the sifted key. Furthermore, the bit error rate estimation unit 222 outputs the generated sifted key to the information matching unit 223 .

[0050] The bit error rate estimation unit 132 on the transmitting side extracts a bit string from the sifted key based on the index information notified from the key distillation processing unit 220 on the receiving side via the public communication path 3, and generates a test bit string (key length: N test ) is generated. The bit error rate estimation unit 132 extracts the test bit string from the sifted key to generate a new sifted key (key length: N ′ sift =N sift -N test ) The bit error rate estimation unit 132 estimates the bit error rate by comparing the generated test bit sequence with the test bit sequence on the receiving side notified via the public communication channel 3. Hereinafter, the estimated value of the bit error rate is referred to as p * bit Let's say. The bit error rate estimation unit 132 calculates the generated sifted key and the estimated bit error rate p * bit and output to the information matching unit 133.

[0051] <Information matching> The information matching unit 133, 223 calculates the bit error rate estimate p * bit Based on this, the error correction information (parity information) required to correct bit errors is shared, and the sifted key is matched by performing error correction processing using this information. The information matching units 133 and 223 predetermine a plurality of error correction codes with different error correction capabilities.

[0052] The information matching unit 223 on the receiving side calculates the estimated value p of the bit error rate. * bit Based on the size of the error, an error correction code is selected, and the parity information required for error correction of the sifted key is generated using the error correction code. The length of the parity information is N IR =N ′ sift (1-f(p * bit )I(X;Y)). where f(p * bit ) is a parameter that indicates the deviation of the error-correcting code used from the Shannon limit and is a value of 1 or less. In addition, I(X;Y) is the mutual information between the transmitter and receiver, and indicates the proportion of random bits that can be corrected when an ideal error correction code (= an error correction code at the Shannon limit) is used. The bit error is calculated as the estimated value p * bit When modeled as a two-way symmetric channel, I(X;Y)=1-h2(p * bit ), where h2(·) is the binary entropy function.

[0053] The information matching unit 223 notifies the key distillation processing unit 130 of the selected error correction code via the public communication channel 3, and also notifies the key distillation processing unit 130 of the parity information. The information matching unit 223 converts the shift key directly into a correction key (key length: N ′ sift ) to the privacy amplifier 224.

[0054] The information matching unit 133 on the transmitting side receives the parity information from the key distillation processing unit 220 on the receiving side via the public communication path 3 . The information matching unit 133 corrects the sifted key with the selected error correction code using the parity information, and generates a correction key (key length: N ′ siftThe correction key generated in this way will match the correction key managed by key distillation processing unit 220 on the receiving side with a very high probability. The information matching unit 133 outputs the generated correction key to the privacy amplification unit 134.

[0055] <Confidentiality Augmentation> The privacy amplifiers 134 and 224 compress the correction key based on the amount of leaked information estimated by the leaked information amount estimation device 30 to generate an encryption key with enhanced privacy.

[0056] The privacy amplification unit 134 on the transmitting side generates an encryption key from the correction key generated by the information matching unit 133 by deleting and compressing the number of bits corresponding to the amount of leaked information estimated by the leaked information amount estimation device 30 and acquired by the leaked information amount acquisition unit 110. That is, the key length of the correction key is N ′ sift , when the amount of leaked information is I(Y;Z), the privacy amplifier 134 obtains a length N PA =N ′ sift The number of bits of I(Y;Z) is deleted to generate a compressed encryption key. ′ sift From N ′ sift -N IR -N PA The function to compress the data is assumed to be shared between the sender and receiver in advance. The privacy amplifier 224 on the receiving side generates an encryption key by compressing the correction key, similar to the privacy amplifier 134, based on the estimated value of the amount of leaked information.

[0057] As described above, the key distillation processing unit 130 and the key distillation processing unit 220 obtain the final length N fin But, N fin =N ′ sift -N IR -N PA =N ′ sift (f(p * bit)I(X;Y)-I(Y;Z)) is generated. This is because the correction key has a compression ratio (f(p * bit )I(X;Y)-I(Y;Z)) to generate the final encryption key. At this time, the key distillation processing unit 130 and the key distillation processing unit 220 calculate the number N of transmitted optical pulses. tot The length of the final encryption key for fin Ratio of (N fin / N tot ) can generate encryption keys at a key generation rate of

[0058] In addition to the four basic processes (sifting, bit error rate estimation, information matching, and privacy amplification), some key distillation protocols may also disclose additional parity information to confirm the success or failure of information matching. In this case, the number of bits to be removed by privacy amplification must be increased, which changes the formulas for the compression rate and key generation rate mentioned above. Returning to FIG. 3, the configuration of the encryption key sharing system 1 will be further described.

[0059] [Device for estimating the amount of leaked information] The leaked information amount estimation device 30 estimates the amount of information leaked to an eavesdropper from the line-of-sight communication path 2 (amount of leaked information) based on the environmental measurement value in the environment measurement device 40. The leaked information amount estimation device 30 includes a model storage unit 31 and an estimation unit 32.

[0060] The model storage unit 31 stores a trained model that estimates the amount of leaked information from multiple environmental measurement quantities measured by the environmental measurement device 40. This model storage unit 31 can be configured with a general storage medium such as a semiconductor memory. The models stored in the model storage unit 31 are learned in advance using a supervised machine learning algorithm. The learning method for these models will be described later with reference to FIGS.

[0061] For example, the model storage unit 31 stores parameters of a model 300 trained by a Feed Forward Neural Network (FFNN) consisting of an input layer 301, an intermediate layer 302, and an output layer 303, as shown in FIG. 5. Model 300 is a model in which multiple environmental measurement quantities measured by environmental measuring device 40 are input as explanatory variable vectors to each node of input layer 301, and in intermediate layer 302, weights are added to the values ​​of each element of the explanatory variable vector input to input layer 301 and propagated, and the amount of leaked information (a value between 0 and 1) is output from output layer 303. The model stored in the model storage unit 31 is referenced by the estimation unit 32.

[0062] The estimation unit 32 estimates the amount of leaked information from a plurality of environmental measurement values. The estimation unit 32 uses the trained model stored in the model storage unit 31 to estimate the amount of leaked information from a plurality of measurement values ​​measured by each measurement device of the environment measurement device 40. For example, the estimation unit 32 inputs the environmental measurement values ​​measured by each measuring device of the environmental measuring device 40 as explanatory variable vectors to each node of the input layer 301 of the model 300 shown in Figure 5, and estimates the value output from the output layer 303 as the amount of leaked information. The estimation unit 32 outputs the estimated amount of leaked information to the receiving device 20 (the leaked information amount notification unit 210).

[0063] This allows the leaked information amount estimation device 30 to estimate the amount of leaked information from multiple environmental measurement values ​​using the trained model. Also, the leaked information amount estimation device 30 can estimate the amount of leaked information to an eavesdropper with a high likelihood from a combination of environmental measurement values ​​of the line-of-sight communication channel 2.

[0064] [Environmental measurement device] The environmental measurement device 40 measures the atmospheric environment of the line-of-sight communication path 2. The environmental measurement device 40 is composed of multiple measurement devices that measure the atmospheric environment of the line-of-sight communication path 2. Here, the environmental measurement device 40 includes an atmospheric fluctuation measurement device 41, a solar radiation measurement device 42, an anemometer 43, a barometer 44, a thermo-hygrometer 45, and an optical signal intensity acquisition device 46. Note that it is not necessary to include all of these multiple devices. Furthermore, the same measurement device may be placed at multiple points within the line-of-sight communication path 2.

[0065] The environmental measuring device 40 is only required to include at least the atmospheric fluctuation measuring device 41. For example, if only the atmospheric fluctuation measuring device 41 is provided, the leaked information amount estimation device 30 will estimate the amount of leaked information based only on the measured values ​​of the atmospheric fluctuation measuring device 41. Of course, by providing measuring devices that measure a wide variety of environments in addition to the atmospheric fluctuation measuring device 41, it becomes possible to more accurately estimate the amount of leaked information that accompanies environmental changes.

[0066] The atmospheric fluctuation measuring device 41 measures the quantity caused by atmospheric fluctuation in the line-of-sight communication path 2. For example, the atmospheric fluctuation measuring device 41 measures the scintillation index as the quantity caused by atmospheric fluctuation. To measure the scintillation index between the transmitting device 10 and the receiving device 20, a probe light irradiator (not shown) that irradiates probe light may be provided on the transmitting device 10 side. Then, the atmospheric fluctuation measuring device 41 provided on the receiving device 20 side may measure the scintillation index from the probe light irradiated by the probe light irradiator. The atmospheric fluctuation measuring device 41 outputs the measured scintillation index to the leaked information amount estimating device 30 .

[0067] The solar radiation measurement device 42 measures the amount of solar radiation on the line-of-sight communication path 2. For example, the solar radiation measurement device 42 measures the amount of global solar radiation. The solar radiation measurement device 42 outputs the measured amount of global solar radiation to the leaked information amount estimation device 30. The anemometer 43 measures the wind speed on the line-of-sight communication path 2. The anemometer 43 outputs the measured wind speed to the leaked information amount estimation device 30. The barometer 44 measures the air pressure in the line-of-sight communication path 2. The barometer 44 outputs the measured air pressure to the leaked information amount estimation device 30. The thermo-hygrometer 45 measures the temperature and humidity of the line-of-sight communication path 2. The thermo-hygrometer 45 outputs the measured temperature and humidity to the leaked information amount estimation device 30. Note that the thermo-hygrometer 45 may use separate measuring devices for the thermometer and the hygrometer.

[0068] The optical signal intensity acquisition device 46 acquires the intensity of the optical signal received by the receiving device 20 via the line-of-sight communication path 2. The optical signal intensity acquisition device 46 outputs the acquired optical signal intensity to the leaked information amount estimation device 30. This allows the environment measuring device 40 to notify the leaked information amount estimation device 30 of measurement values ​​obtained by measuring a wide variety of environments of the line-of-sight communication path 2.

[0069] With the above-described configuration, the site diversity encryption key sharing system 1 can estimate with high likelihood the amount of information leaked to an eavesdropper from the state of the line-of-sight communication channel 2, switch to the highly secure line-of-sight communication channel 2, and generate an encryption key with enhanced security in accordance with the amount of leaked information. More specifically, by performing privacy amplification based on the obtained estimate, it is possible to generate an encryption key whose security is guaranteed with a high degree of certainty.

[0070] [Operation of encryption key sharing system] Next, the operation of the encryption key sharing system according to the first embodiment of the present invention will be described with reference to Fig. 6 (see Fig. 3 and Fig. 4 as appropriate for the configuration). It is assumed that the model storage unit 31 of the leaked information amount estimation device 30 stores a trained model for estimating the amount of leaked information from a plurality of environmental measurement values. In step S1, each measuring device (41, 42, . . . , 46) of the environment measuring device 40 measures a plurality of environment measurement values ​​in free space including the line-of-sight communication path 2, and transmits the measured values ​​to the leaked information amount estimation device 30. The environmental measurement values ​​measured by this environmental measuring device 40 are measured in time series and become the values ​​of the explanatory variable vector that the leaked information amount estimation device 30 inputs into the model to estimate the amount of leaked information in step S3 described below. The operation of step S1 is the same for the multiple environment measuring devices 40 at each ground station.

[0071] In step S2, the leaked information amount estimation device 30 receives, by the estimation unit 32, the plurality of environmental measurement values ​​measured in step S1. In step S3, the leaked information amount estimation device 30 uses the model stored in the model storage unit 31 to estimate the amount of leaked information from the plurality of environmental measurement values ​​received in step S2, using the estimation unit 32. In step S4, the leaked information amount estimation device 30 causes the estimation unit 32 to transmit the leaked information amount estimated in step S3 to the receiving device 20. The operations of steps S2 to S4 described above are the same for the plurality of leaked information amount estimation devices 30 for each ground station.

[0072] In step S5, the receiving device 20 receives the amount of leaked information transmitted in step S4 via the leaked information amount notifying unit 210. In step S6, the receiving device 20 causes the leaked information amount notifying unit 210 to transmit the leaked information amount received in step S5 to the transmitting device 10 via the public communication path 3. The operations of steps S5 and S6 described above are the same for the multiple receiving devices 20 for each ground station. Moreover, the above steps S1 to S6 are repeated periodically.

[0073] In step S7, the transmission device 10 receives, via the leaked information amount acquisition unit 110, the leaked information amounts transmitted from the plurality of reception devices 20 in step S6. In step S8, the transmitting device 10 switches the line-of-sight communication path 2 from which the light transmitting unit 104 transmits the optical signal, based on the amount of leaked information received in step S7, using the line-of-sight communication path switching control unit 120. Here, if the amount of leaked information acquired from the receiving device 20 corresponding to the line-of-sight communication path 2 currently transmitting the optical signal exceeds a predetermined standard, the line-of-sight communication path switching control unit 120 switches the transmission direction of the optical signal to a line-of-sight communication path 2 that is below the standard. Note that the line-of-sight communication path switching control unit 120 may periodically switch among multiple line-of-sight communication paths 2 that are below the standard, even if the amount of leaked information is below the predetermined standard.

[0074] In step S9, the transmitting device 10 encodes the random number bit string as an optical signal. Here, the transmitting device 10 adjusts the intensity of a laser beam emitted by a light emitting unit 101 using a light intensity adjusting unit 102. Then, the transmitting device 10 modulates and encodes the intensity-adjusted optical signal using an encoding unit 103 based on a random number bit string. In step S10, the transmitter 10 causes the light transmitting unit 104 to transmit the optical signal encoded in step S9 to the line-of-sight communication path 2 switched in step S8.

[0075] In step S11, the receiving device 20 corresponding to the line-of-sight communication path 2 switched in step S8 receives the optical signal transmitted to the line-of-sight communication path 2 in step S11 by the light receiving unit 201. If the environmental measuring device 40 is equipped with an optical signal intensity acquiring device 46, the receiving device 20 notifies the optical signal intensity acquiring device 46 of the intensity of the received optical signal (not shown as a step).

[0076] In step S12, the receiving device 20 decodes the random number bit string from the optical signal received in step S11. Here, the receiving device 20 converts the optical signal received in step S11 into an electrical signal by the photoelectric conversion unit 202, and decodes it into a random number bit string by the decoding unit 203.

[0077] In step S13 (S13A, S13B), the key distillation processing unit 130 of the sending device 10 and the key distillation processing unit 220 of the receiving device 20 perform key distillation processing to generate an encryption key and share the key. Here, the key distillation processing units 130, 220 generate a key that matches between the sender and the receiver from the original random number bit string encoded in step S9 by performing shifting processing by the shifting units 131, 221, bit error rate estimation processing by the bit error rate estimation units 132, 222, and information matching processing by the information matching units 133, 223. Then, the key distillation processing units 130 and 220 generate an encryption key by compressing the key that has undergone information matching using the privacy amplifiers 134 and 224 at a compression rate according to the amount of leaked information received in step S5.

[0078] Through the above operations, the encryption key sharing system 1 can switch to a highly secure line-of-sight communication channel 2, estimate the amount of leaked information depending on the state of the line-of-sight communication channel 2, and generate a highly secure encryption key according to the amount of leaked information. As a result, the encryption key sharing system 1 can generate an encryption key with enhanced security according to the amount of leaked information in accordance with the state of the line-of-sight communication channel 2, and share the encryption key between the transmitting device 10 and the receiving device 20. More specifically, the encryption key sharing system 1 can generate, at an optimal speed, an encryption key whose security is guaranteed with a high degree of certainty by performing privacy amplification based on an estimate with a high likelihood of the amount of leaked information.

[0079] Second Embodiment [Overview of cryptographic key sharing system] Next, a learning method for the learned model stored in advance in the model storage unit 31 of the leaked information amount estimation device 30 will be described with reference to FIGS. The model can be learned in an encryption key sharing system 1B according to the second embodiment of the present invention shown in FIG.

[0080] First, an overview of the encryption key sharing system 1B will be described with reference to FIG. As shown in Fig. 7, the encryption key sharing system 1B, like the encryption key sharing system 1 (see Fig. 1), includes a transmitting device 10 provided on a satellite ST, a receiving device 20 provided on a ground station GS, a leaked information amount estimating device 30B, and an environment measuring device 40, and further includes a leaked information amount measuring device 50. Note that Fig. 7 shows only a device corresponding to one ground station GS, but in reality, there are as many devices as there are line-of-sight communication paths 2 to be switched. The leaked information amount measuring device 50 is installed near a predetermined guard area GA around the receiving device 20. The guard area GA is an area in which the receiver can confirm in advance that there is no eavesdropper.

[0081] Note that the model for estimating the amount of leaked information needs to be trained for each ground station GS because it differs depending on the environment of the line-of-sight communication path 2, but here we will explain training at one ground station GS. When training is performed at each ground station GS, the transmitting device 10 switches and fixes the line-of-sight communication path 2 and performs training individually.

[0082] [Internal structure of the encryption key sharing system] The internal configuration of the encryption key sharing system 1B will be described with reference to Fig. 8 (and Fig. 7 as needed). Note that the transmission device 10, the reception device 20, and the environment measuring device 40 have basically the same configuration as those of the encryption key sharing system 1, and therefore their description will be omitted. However, in the encryption key sharing system 1B, when the transmitting device 10 is operated to learn a model, the key distillation processing unit 130 of the transmitting device 10 notifies the key distillation processing unit 220 of the receiving device 20 of a random number bit string via the public communication path 3. In addition, the key distillation processing unit 220 outputs the notified random number bit string to the leaked information amount measurement device 50.

[0083] [Device for estimating the amount of leaked information] The leaked information amount estimation device 30B estimates the amount of leaked information in the line-of-sight communication path 2 based on the environmental measurement values ​​in the environment measurement device 40. Furthermore, the leaked information amount estimation device 30B also learns a model for estimating the amount of leaked information using the amount of leaked information measured by the leaked information amount measurement device 50 as training data.

[0084] The leaked information amount estimation device 30B includes a model storage unit 31, an estimation unit 32, and a learning unit 33. The configuration other than the learning unit 33 is the same as that of the encryption key sharing system 1, and therefore a description thereof will be omitted. However, the model storage unit 31 stores parameters of the model learned by the learning unit 33.

[0085] The learning unit (learning device) 33 learns a machine learning model in which a plurality of environmental measurement values ​​are used as a vector of explanatory variables and the amount of leaked information is used as a response variable. The learning unit 33 inputs multiple measurement values ​​(explanatory variable vectors) measured by each measuring device of the environmental measuring device 40, and learns a model by supervised machine learning using the amount of leaked information measured by the leaked information amount measuring device 50 as training data.

[0086] This supervised machine learning algorithm can use algorithms such as neural networks such as deep learning, nearest neighbor methods, linear models, naive Bayes classifiers, and decision trees. For example, when a neural network is used as the algorithm for supervised machine learning, the learning unit 33 learns the parameters of the model 300 using the forward propagation neural network (FFNN) described with reference to FIG.

[0087] The learning unit 33 learns the weights of each layer of the model 300 as parameters so that an explanatory variable vector is input to the input layer 301 shown in Fig. 5 and the amount of leaked information measured by the leaked information amount measuring device 50 is output from the output layer 303. For example, error back propagation can be used to learn the model 300. The learning unit 33 writes and stores the learned model, specifically the model parameters, in the model storage unit 31.

[0088] If the environment measuring device 40 is equipped with multiple measuring devices of the same type, the learning unit 33 can use the average of the measurement values ​​of the measuring devices of the same type as one element of the explanatory variable vector. Alternatively, the measurement values ​​of multiple measuring devices may be used as elements of independent explanatory variable vectors. Moreover, although the learning unit 33 is configured to be provided inside the leaked information amount estimation device 30 here, it may be configured to be provided separately as a learning device outside the leaked information amount estimation device 30.

[0089] This allows the leaked information amount estimation device 30B to learn a model for estimating the amount of leaked information from multiple environmental measurement values. Furthermore, by statistically learning using multiple environmental measurement values, the leaked information amount estimation device 30B can average out and remove factors that are difficult to observe and that cause variations in the estimated amount. Therefore, the leaked information amount estimation device 30B can learn a model that can estimate the amount of leaked information to an eavesdropper with a high likelihood from a combination of environmental measurement values ​​of the line-of-sight communication channel 2.

[0090] [Leaked information amount measuring device] The leaked information amount measuring device 50 simulates an eavesdropper and measures the amount of information leaked from the line-of-sight communication path 2 (amount of leaked information). The leaked information amount measuring device 50 includes a light receiving unit 51, a photoelectric conversion unit 52, a decoding unit 53, and a leaked information amount calculation unit .

[0091] The light receiving unit 51 receives an optical signal (leaked optical signal) leaked from the line-of-sight communication path 2. The light receiving unit 51 can have the same configuration as the light receiving unit 201. The light receiving section 51 outputs the received optical signal to the photoelectric conversion section 52 . The photoelectric conversion unit 52 converts the optical signal received by the light receiving unit 51 into an electrical signal. The photoelectric conversion unit 52 outputs the converted electrical signal to the decoding unit 53. The decoding unit 53 decodes the electrical signal converted by the photoelectric conversion unit 52 into a bit string. The decoding unit 53 performs decoding using the same method as the decoding unit 203, thereby attempting to decode the bit string of the random number sequence. The decoding unit 53 outputs the decoded bit string to the leaked information amount calculation unit 54.

[0092] The leaked information amount calculation unit 54 calculates the amount of leaked information by comparing the bit string of the raw key, i.e., the random number bit string obtained from the key distillation processing unit 220, with the bit string decrypted by the decryption unit 53. As a specific example, the leaked information amount calculation unit 54 calculates the hit rate (the rate at which bit values ​​are the same) of the decrypted bit string with respect to the bit string of the raw key as the amount of leaked information. The leaked information amount calculation unit 54 outputs the calculated leaked information amount to the leaked information amount estimation device 30 B. This leaked information amount becomes training data for the learning unit 33 . This allows the leaked information amount measuring device 50 to simulate an eavesdropper, measure the amount of leaked information corresponding to environmental changes, and generate training data for learning a model.

[0093] As described above, the encryption key sharing system 1B can learn a model that can estimate the amount of information leaked to an eavesdropper from the state of the line-of-sight communication channel 2 with a high likelihood.

[0094] [Operation of encryption key sharing system] Next, the operation of the encryption key sharing system 1B will be described with reference to FIG. 9 (and as appropriate, with reference to FIG. 8 for the configuration).

[0095] In step S20, each measuring device (41, 42, . . . , 46) of the environment measuring device 40 measures various environmental measurement values ​​in free space including the line-of-sight communication path 2, and transmits the values ​​to the leaked information amount estimation device 30B. The environmental measurement values ​​measured by the environment measuring device 40 are measured in time series, and become values ​​of an explanatory variable vector for the leaked information amount estimation device 30B to learn a model in step S30 described later.

[0096] In step S21, the transmitting device 10 encodes the random number bit string into an optical signal as a raw key bit string. Here, the transmitting device 10 adjusts the intensity of a laser beam emitted by a light emitting unit 101 using a light intensity adjusting unit 102. Then, the transmitting device 10 modulates and encodes the intensity-adjusted optical signal using an encoding unit 103 based on a random number bit string.

[0097] In step S22, the transmitting device 10 causes the light transmitting unit 104 to transmit the random number bit string encoded in step S21 to the line-of-sight communication path 2 in free space. In step S23, the transmitting device 10 transmits the random number bit string encoded in step S21 by the key distillation processing unit 130 as a raw key bit string to the key distillation processing unit 220 of the receiving device 20 via the public communication channel 3.

[0098] In step S24, the receiving device 20 receives, via the public communication path 3, the bit string of the raw key transmitted in step S23 by the key distillation processing unit 220. In step S25, the receiving device 20 causes the key distillation processing unit 220 to transmit the bit string of the raw key received in step S24 to the leaked information amount measuring device 50. In addition, if the environmental measuring device 40 is equipped with an optical signal intensity acquisition device 46, the receiving device 20 receives the optical signal sent by the light receiving unit 201 in step S22 and notifies the optical signal intensity acquisition device 46 (not shown as a step).

[0099] In step S26, the leaked information amount measuring device 50 receives, by the light receiving unit 51, the optical signal leaked from the line-of-sight communication path 2 (leaked optical signal). In step S27, the leaked information amount measuring device 50 attempts to decode the random number bit string from the optical signal received in step S26. Here, the leaked information amount measuring device 50 converts the optical signal received in step S26 into an electrical signal by the photoelectric conversion unit 52, and decodes it into a random number bit string by the decoding unit 53.

[0100] In step S28, the leaked information amount measuring device 50 receives, via the leaked information amount calculation unit 54, the bit string of the raw key transmitted in step S25. In step S29, the leaked information amount measurement device 50 calculates the amount of leaked information by comparing the random number bit string decrypted in step S27 with the bit string of the raw key received in step S28 using the leaked information amount calculation unit 54, and transmits the amount of leaked information to the leaked information amount estimation device 30B.

[0101] In step S30, the leaked information amount estimation device 30B receives the various measurement values ​​transmitted in step S20 and the amount of leaked information transmitted in step S29, and trains a model using the learning unit 33. Here, the learning unit 33 trains a machine learning model using supervised machine learning, using the various measurement values ​​as explanatory variable vectors and the amount of leaked information as training data. The trained model is stored in the model storage unit 31.

[0102] Through the above operations, the encryption key sharing system 1B can learn the correlation between the state of the line-of-sight communication path 2 and the amount of leaked information. The encryption key sharing system 1B may perform the operations of steps S20 to S30 shown in Fig. 9 as a learning mode, and then perform the operations of steps S1 to S13A and S13B shown in Fig. 6 as an actual operation mode. The encryption key sharing system 1B may also update the learning model by periodically performing the operations of the learning mode shown in Fig. 9. This allows the encryption key sharing system 1B to improve the accuracy of the learning model. [Explanation of symbols]

[0103] 1,1B Encryption key sharing system 10 Transmitting device 100 Optical signal transmitter 101 Light-emitting part 102 Light intensity adjustment unit 103 Encoding section 104 Light transmitting unit 110 Leaked information amount acquisition unit 120 Line-of-sight communication path switching control unit 130 Key distillation processing unit (first key distillation processing unit) 131 Shifting section 132 Bit Error Rate Estimation Unit 133 Information Integration Department 134 Privacy Amplification Unit 20 Receiving device 200 Optical signal receiving unit 201 Light receiving section 202 Photoelectric conversion unit 203 Decoding Unit 210 Leaked information amount notification unit 220 Key distillation processing unit (second key distillation processing unit) 221 Shifting section 222 Bit Error Rate Estimation Unit 223 Information Integration Department 224 Privacy Amplification Unit 30, 30B Leaked information amount estimation device 31 Model memory section 32 Estimation part 33 Learning unit (learning device) 40 Environmental measuring device 41 Atmospheric Fluctuation Measurement Device 42 Solar radiation measuring device 43 Anemometer 44 Barometer 45 Thermohygrometer 46 Optical signal strength acquisition device 50 Leaked information amount measuring device 51 Light receiving part 52 Photoelectric conversion unit 53 Decoding section 54 Leaked information amount calculation unit

Claims

1. An encryption key sharing system in which an encryption key is shared between a transmitting device and receiving devices arranged for each of a plurality of line-of-sight communication paths by using an optical signal propagating through a line-of-sight communication path, At least one measuring device for measuring an atmospheric environment for each of the line-of-sight communication paths; a leaked information amount estimation device that estimates the amount of information leaked to an eavesdropper from the measurement values ​​output by the measurement device using a model previously trained by machine learning; the transmitting device includes an optical signal transmitting unit that encodes a random number bit string that is a source of the encryption key into the optical signal and transmits the encoded optical signal to the line-of-sight communication path, a first key distillation processing unit that generates the encryption key from the random number bit string by key distillation processing via a public communication path, and a line-of-sight communication path switching control unit that switches the line-of-sight communication path based on the amount of leaked information; a plurality of receiving devices, each having an optical signal receiving unit that receives the optical signal via the line-of-sight communication path and decodes it into a random number bit string, and a second key distillation processing unit that generates the encryption key from the decoded random number bit string by key distillation processing via the public communication path; an encryption key sharing system, wherein the first key distillation processing unit and the second key distillation processing unit perform key distillation at a compression rate according to the amount of leaked information;

2. 2. The encryption key sharing system of claim 1, wherein, when the amount of leaked information corresponding to the line-of-sight communication path through which the optical signal is currently being transmitted exceeds a predetermined standard, the line-of-sight communication path switching control unit switches the destination of the optical signal to a line-of-sight communication path for which the amount of leaked information is equal to or less than the standard.

3. 2. The encryption key sharing system according to claim 1, wherein the line-of-sight communication path switching control unit periodically switches the line-of-sight communication path whose amount of leaked information is equal to or less than a predetermined threshold.

4. 4. The encryption key sharing system according to claim 1, wherein the first key distillation processing unit and the second key distillation processing unit generate the encryption key by increasing the compression rate as the amount of leaked information increases.

5. a leaked information amount measuring device for measuring the amount of leaked information of the optical signal leaking from the line-of-sight communication path; a learning device that receives a measurement value output by the measuring device and learns the model by supervised machine learning using the amount of leaked information measured by the leaked information amount measuring device as training data; Furthermore, 2. The encryption key sharing system according to claim 1, wherein the line-of-sight communication path switching control unit fixes the line-of-sight communication path and learns the model.

Images