Key exchange system, base station equipment, QKD equipment, method, and program

Abstract

A key exchange system according to an aspect of the present disclosure includes a plurality of QKD devices that execute a quantum key delivery protocol involving at least error correction and a plurality of hub devices that perform encrypted communication with each other, wherein the hub devices each include a key generation unit configured to generate an encryption key for performing encrypted communication with another hub device on the basis of information received from the QKD devices, and the QKD devices each include a QKD processing unit configured to execute the quantum key delivery protocol with another QKD device and to generate a correction key from a ciphertext of random number information, and a first transmission unit configured to transmit, to the hub devices, information expressing the result of base matching in the quantum key delivery protocol.

Description

Technical Field

[0001] The present disclosure relates to a key exchange system, a base station device, a QKD device, a method, and a program.

Background Art

[0002] It is known that with the practical application of quantum computers, mathematical problems (prime factorization problem, discrete logarithm problem) that form the security basis of existing cryptography can be solved in a realistic time. Therefore, there is a risk that existing cryptographies such as RSA cryptography and elliptic curve cryptography will be endangered, and it is necessary to shift to cryptographic technologies that cannot be decoded even by quantum computers.

[0003] As cryptographic technologies that cannot be decoded even by quantum computers, there are post-quantum cryptography (PQC) and quantum key distribution (QKD). The BB84 method is known as a typical protocol of QKD (for example, Non-Patent Document 1). The BB84 method is a method of expressing and transmitting / share one-bit key information with the polarization or phase of one photon.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, the conventional BB84 method has a problem in that security cannot be guaranteed if the QKD device, which transmits and receives photons, is unreliable, because the QKD device holds the key information.

[0006] This disclosure is made in view of the above points and aims to provide a technology that enables secure key exchange using the QKD protocol. [Means for solving the problem]

[0007] A key exchange system according to one aspect of the present disclosure is a key exchange system comprising a plurality of QKD devices that execute a quantum key distribution protocol that includes at least error correction, and a plurality of base devices that communicate with each other in an encrypted manner, wherein each base device has a key generation unit configured to generate an encryption key for encrypted communication with other base devices based on information received from the QKD device, and each QKD device has a QKD processing unit configured to execute the quantum key distribution protocol with other QKD devices and generate a correction key from a ciphertext of random number information, and a first transmission unit configured to transmit information representing the result of a base match in the quantum key distribution protocol to the base devices. [Effects of the Invention]

[0008] The QKD protocol provides a technology that enables secure key exchange. [Brief explanation of the drawing]

[0009] [Figure 1] This figure shows an example of a QKD protocol. [Figure 2] This figure shows an example of key extraction. [Figure 3] This figure shows an example of the overall configuration of the key exchange system according to this embodiment. [Figure 4] This sequence diagram shows an example of the processing performed by the key exchange system according to this embodiment. [Figure 5]This is a diagram showing an application example of the overall configuration of the key exchange system according to this embodiment. [Figure 6] This is a sequence diagram showing an application example of the processing executed by the key exchange system according to this embodiment. [Figure 7] This is a diagram showing an example of the hardware configuration of a computer.

Mode for Carrying Out the Invention

[0010] Hereinafter, an embodiment of the present invention will be described.

[0011] <Key Exchange by QKD Protocol> Hereinafter, assuming the BB84 method of encoding bits (0 or 1) into polarization as an example of the QKD protocol, the case of performing key exchange by the QKD protocol will be described with reference to FIG. 1. For details of the BB84 method, refer to, for example, Non-Patent Document 1 above.

[0012] In FIG. 1, it is assumed that encrypted communication is performed between a base station device (transmission node) existing at the base on the data transmission side and a base station device (reception node) existing at the base on the data reception side. At this time, it is assumed that a QKD device (transmission node) exists at the base on the data transmission side and a QKD device (reception node) exists at the base on the data reception side. The key (encryption key) used for encrypted communication between the base station device (transmission node) and the base station device (reception node) is generated and shared by executing the QKD protocol between the QKD device (transmission node) and the QKD device (reception node).

[0013] In the BB84 method, a key is generated and shared by the following procedures 1 to 7. In the following description of the BB84 method, the QKD device (transmission node) is referred to as the "sender" and the QKD device (reception node) is referred to as the "receiver".

[0014] Procedure 1: The sender generates random information (a random bit string of a predetermined length).

[0015] Step 2: The sender randomly selects a basis (+ basis or × basis) from the two bases, and encodes (encodes) the bit sequence into the polarization of photons according to the basis. At this time, the sender encodes the polarization of photons according to Table 1 below.

[0016]

Table 1

[0017] Step 3: The sender transmits the photon sequence to the receiver through the optical transmission line.

[0018] Step 4: The receiver randomly selects a basis from the two bases (+ basis or × basis), and measures the photons (that is, decodes the photons with the selected basis and determines the bit value according to whether the photons are detected by the photon detector).

[0019] Step 5: The receiver notifies the sender through the public communication channel which basis was used to measure the photons.

[0020] Step 6: The sender notifies the receiver through the public communication channel the part where the basis it selected matches the basis notified by the receiver (for example, the positions of the bit sequences where those bases match). The above Steps 5 to Step 6 are also called basis verification.

[0021] Step 7: The sender and receiver extract the bit sequences where their chosen bases match, and generate an encryption key (key information) based on the extracted bit sequences. For example, as shown in Figure 2, if the sender and receiver have chosen the same base in bits 1, 5, 7, 10, and 11 (with the first bit being index 0), the bit sequence "1100010" is extracted, and an encryption key (key information) is generated based on this bit sequence. This bit sequence is also called a sieve key. Generally, after obtaining a sieve key, a portion of this sieve key is extracted as test bits, and the presence or absence of eavesdropping is evaluated based on the bit error rate. If it is determined that there is no eavesdropping, error correction and confidentiality enhancement processing are performed to generate an encryption key (key information).

[0022] As a result, the encryption key used for encrypted communication is shared between the QKD device (transmitting node) and the QKD device (receiving node), and the branch devices (transmitting node) and branch devices (receiving node) can perform encrypted communication using this encryption key.

[0023] As explained above, in conventional QKD protocols such as the BB84 method, the QKD device holds the key information. Therefore, if the QKD device is unreliable, security cannot be guaranteed. Accordingly, the following proposes a key exchange method that can conceal key information from the QKD device. An unreliable QKD device is, for example, one that poses a risk of key information leakage.

[0024] <Proposed method> In this proposed method, to conceal key information from the QKD device, a secret key sk is generated at the base station, and random number information encrypted with this secret key sk is used when generating key information at the QKD device. On the other hand, the base station, upon receiving key information from the QKD device, decrypts it using the secret key sk to obtain the encryption key used for encrypted communication. This allows key information to be concealed from the QKD device.

[0025] The following describes a key exchange system for sharing QKD key information using the proposed method described above.

[0026] <Overall configuration of the key exchange system> An example of the overall configuration of the key exchange system according to this embodiment will be explained with reference to Figure 3.

[0027] As shown in Figure 3, the key exchange system according to this embodiment includes a plurality of base station devices 10 and a plurality of QKD devices 20. Hereinafter, a base station device 10 located at a data transmission site will be referred to as "base station device 10A," and a base station device 10 located at a data reception site will be referred to as "base station device 10B." Similarly, a QKD device 20 located at a data transmission site will be referred to as "QKD device 20A," and a QKD device 20 located at a data reception site will be referred to as "QKD device 20B." Each base station device 10 and each QKD device 20 are connected to each other via an open communication channel, and the QKD devices 20 are connected to each other via an optical transmission channel.

[0028] The base station device 10 is an information processing device (computer) that performs encrypted communication with other base station devices 10 located at other locations. The base station device 10 includes a base station communication processing unit 101, a secret key sharing processing unit 102, a random number generation processing unit 103, an encryption processing unit 104, and a key generation processing unit 105. Each of these parts is realized, for example, by processing that one or more programs installed on the base station device 10 cause a processor such as a CPU (Central Processing Unit) to execute.

[0029] The inter-site communication processing unit 101 performs encrypted communication with the site device 10 located at another site and various processes necessary for such encrypted communication. The secret key sharing processing unit 102 performs processes for generating and sharing the secret key sk (secret key for stream cipher scheme) with the site device 10 located at another site. The random number generation processing unit 103 generates random number information r, which is a random bit sequence of a predetermined length. The encryption processing unit 104 generates ciphertext C by encrypting the random number information r with the secret key sk. The key generation processing unit 105 uses information received from the QKD device 20 (bit number of the old key, or the bit number and the correction key C' described later) to generate an encryption key D to be used for encrypted communication with the site device 10 located at another site. Hereinafter, data x encrypted with the secret key sk will also be represented as Enc(x;sk), and data x' decrypted with the secret key sk will also be represented as Dec(x';sk). Furthermore, the inter-site communication processing unit 101, secret key sharing processing unit 102, random number generation processing unit 103, encryption processing unit 104, and key generation processing unit 105 of the base station device 10A will be referred to as "inter-site communication processing unit 101A," "secret key sharing processing unit 102A," "random number generation processing unit 103A," "encryption processing unit 104A," and "key generation processing unit 105A," respectively. Similarly, the inter-site communication processing unit 101, secret key sharing processing unit 102, random number generation processing unit 103, encryption processing unit 104, and key generation processing unit 105 of the base station device 10B will be referred to as "inter-site communication processing unit 101B," "secret key sharing processing unit 102B," "random number generation processing unit 103B," "encryption processing unit 104B," and "key generation processing unit 105B," respectively. Note that the base station device 10B does not need to have at least one of the random number generation processing unit 103B and the encryption processing unit 104B.

[0030] QKD device 20 is an information processing device (computer) that executes the QKD protocol (e.g., BB84 method, etc.) via an optical transmission path with QKD devices 20 located at other locations. QKD device 20 has a QKD processing unit 201. The QKD processing unit 201 is realized, for example, by one or more programs installed in QKD device 20 that are executed by a processor such as a CPU. The QKD processing unit 201 executes the QKD protocol (including error correction, etc.) via an optical transmission path with QKD devices 20 located at other locations, and generates and shares a correction key C', which is the key after error correction. Hereinafter, the QKD processing unit 201 of QKD device 20A will be referred to as "QKD processing unit 201A", and the QKD processing unit 201 of QKD device 20A will be referred to as "QKD processing unit 201B".

[0031] <Processes performed by the key exchange system> An example of the processes performed by the key exchange system according to this embodiment will be explained with reference to Figure 4. The processes performed by the key exchange system according to this embodiment can be broadly divided into pre-key sharing (step S101), QKD key exchange (steps S102 to S109), and inter-site communication (steps S110 to S115).

[0032] The secret key sharing processing unit 102A of base station device 10A and the secret key sharing processing unit 102B of base station device 10B generate and share the secret key sk for the stream encryption scheme (step S101).

[0033] The random number generation processing unit 103A of the base station device 10A generates random number information r, which is a random bit sequence of a predetermined length (step S102).

[0034] The encryption processing unit 104A of the base station device 10A generates a ciphertext C, i.e., C=Enc(r;sk), by encrypting random number information r with the secret key sk (step S103). Since sk is the secret key of the stream cipher scheme, the ciphertext C=Enc(r;sk) is specifically the exclusive OR of r and sk.

[0035] The inter-site communication processing unit 101A of the base station device 10A transmits the ciphertext C to the QKD device 20A (step S104).

[0036] The QKD processing unit 201A of the QKD device 20A encodes the ciphertext C (for example, by setting the encoding rate according to the previous error rate (bit error rate) and then encoding it) (step S105), and then executes the QKD protocol (including error correction, etc.) with the QKD processing unit 201B of the QKD device 20B to generate and share the corrected key C' (step S106). The encoding can be done by encoding the bit sequence representing the ciphertext C into the polarization (or phase) of a photon, similar to the existing BB84 method. Furthermore, the QKD processing unit 201A of the QKD device 20A and the QKD processing unit 201B of the QKD device 20B can obtain a sieve key by base matching, calculate the bit error rate and evaluate whether or not eavesdropping has occurred, and if it is evaluated that there is no eavesdropping, perform error correction to generate and share the corrected key C'. However, error correction should be performed using a method that allows setting the coding rate (for example, Low Density Parity Check (LDPC)).

[0037] The QKD processing unit 201A of the QKD device 20A transmits the bit number of the sieve key obtained by the base matching in step S106 (in other words, the bit number of the portion where the base selected between the QKD device 20A and the QKD device 20B matches) to the base device 10A (step S107).

[0038] Meanwhile, the QKD processing unit 201B of the QKD device 20B transmits the bit number of the sieve key obtained by the base match in step S106 and the correction key C' obtained in step S106 to the base device 10B (steps S108 to S109).

[0039] The key generation processing unit 105A of the base station device 10A obtains key r' using the random number information r generated in step S102 and the bit number received from the QKD device 20A (step S110). That is, the key generation processing unit 105A extracts the bit sequence corresponding to the bit number from the bit sequence representing the random number information r, and uses this extracted bit sequence as key r'.

[0040] The key generation processing unit 105B of the base station device 10B obtains key r' using the correction key C' and bit number received from the QKD device 20B and the secret key sk (step S111). That is, the key generation processing unit 105B decrypts the correction key C' with the secret key sk (i.e., Dec(C';sk)), extracts the bit sequence corresponding to the bit number from the decrypted bit sequence (i.e., the bit sequence representing Dec(C';sk)), and uses this extracted bit sequence as key r'. Note that since sk is the secret key of the stream cipher scheme, Dec(C';sk) is specifically the exclusive OR of C' and sk.

[0041] The key generation processing unit 105A of base station device 10A and the key generation processing unit 105B of base station device 10B share the information necessary for the security enhancement process (step S112). The security enhancement process is a process to improve security by sacrificing one bit, and is also called key distillation along with error correction, etc. Since the security enhancement process is an existing technology, a detailed explanation will be omitted.

[0042] The key generation processing unit 105A of the base station device 10A performs confidentiality enhancement processing on key r' to generate encryption key D (step S113). As a result, the base station device 10A can obtain encryption key D to be used for encrypted communication.

[0043] Similarly, the key generation processing unit 105B of the base station device 10B performs confidentiality enhancement processing on key r' to generate encryption key D (step S114). As a result, the base station device 10B can obtain encryption key D to be used for encrypted communication.

[0044] As a result, the inter-site communication processing unit 101A of the base station device 10A and the inter-site communication processing unit 101B of the base station device 10B can perform encrypted communication using encryption key D (step S115).

[0045] <Application Examples> The following describes one application example of this embodiment: the case in which a relay device 30 is present between QKD devices 20. In the following, the same parts as in the above embodiment will be omitted from the explanation, and only the differences from the above embodiment will be described.

[0046] • Overall configuration of a key exchange system in an application example The overall configuration of the key exchange system in the application example will be explained with reference to Figure 5.

[0047] As shown in Figure 5, in the application example key exchange system, a relay device 30 is present between base station 10A and base station 10B. The relay device 30 is connected to base station 10A by an optical transmission path, and is also connected to base station 10B by an optical transmission path.

[0048] • Processes performed by a key exchange system in application examples. The processes performed by the key exchange system in the application example will be explained with reference to Figure 6. In this application example, only the processes from steps S205 to S206 in Figure 6 differ from the sequence diagram explained in Figure 4. Therefore, only the processes from steps S205 to S206 will be explained below.

[0049] The QKD processing unit 201A of the QKD device 20A encodes the ciphertext C (for example, by encoding after setting the encoding rate according to the previous error rate (bit error rate)) (step S205), and generates and shares the corrected key C' by executing the QKD protocol (including error correction, etc.) with the QKD processing unit 201B of the QKD device 20B via the relay device 30 (step S206). The encoding can be done by encoding the bit sequence representing the ciphertext C into the polarization (or phase) of a photon, similar to the existing BB84 method. Furthermore, the QKD processing unit 201A of the QKD device 20A and the QKD processing unit 201B of the QKD device 20B can obtain a sieve key by base matching, calculate the bit error rate and evaluate whether or not there is eavesdropping, and if it is evaluated that there is no eavesdropping, perform error correction to generate and share the corrected key C'. However, error correction should be performed using a method that allows setting the coding rate (for example, a low-density parity check code (LDPC), etc.).

[0050] <Hardware configuration of each device> The base station device 10, the QKD device 20, and the relay device 30 can be realized, for example, by the hardware configuration of the computer 500 shown in Figure 7.

[0051] The computer 500 shown in Figure 7 includes an input device 501, a display device 502, an external interface 503, a communication interface 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these hardware components is connected to the others via a bus 509 for communication.

[0052] The input device 501 is, for example, a keyboard, mouse, touch panel, physical buttons, etc. The display device 502 is, for example, a display, display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502.

[0053] External I / F 503 is an interface to external devices such as recording media 503a. Computer 500 can read from and write to the recording media 503a via external I / F 503. Examples of recording media 503a include flexible disks, CDs (Compact Discs), DVDs (Digital Versatile Disks), SD memory cards (Secure Digital memory cards), and USB (Universal Serial Bus) memory cards.

[0054] The communication interface 504 is an interface for connecting the computer 500 to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 507 is, for example, a storage device (storage device) such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or flash memory. The processor 508 is, for example, an arithmetic unit such as a CPU.

[0055] The base station device 10, QKD device 20, and relay device 30 according to this embodiment can realize the various processes described above by having, for example, the hardware configuration of the computer 500 shown in Figure 7. Note that the hardware configuration of the computer 500 shown in Figure 7 is just one example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 and multiple processors 508, it may not have some of the hardware shown, or it may have various hardware other than the hardware shown.

[0056] <Summary> As described above, in the key exchange system according to this embodiment, a secret key sk is shared among the base devices 10, and random number information is encrypted using the secret key sk. Then, the QKD protocol (including error correction, etc.) is executed among the QKD devices 20 using this encrypted random number information. As a result, each base device 10 can obtain an encryption key D (QKD key) from the correction key C' obtained through error correction. At this time, since the correction key C' is generated from the encrypted random number information in the QKD device 20, the random number information (key information) can be kept secret from the QKD device 20. For this reason, even if, for example, the QKD device 20 is not trustworthy, the security of the entire system can be enhanced.

[0057] <Sharing of private key sk> In the above embodiment, there are no particular limitations on the method for sharing the secret key sk between the base station device 10A and the base station device 10B. Existing key encapsulation mechanisms (KEM: Key Encapsulation Mechanism) may be used. For example, by using a post-quantum cryptographic KEM such as NTRU, which is a type of lattice cryptography, key sharing can also be performed with quantum computers.

[0058] The present invention is not limited to the embodiments specifically disclosed above, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of Symbols]

[0059] 10-site equipment 20 QKD equipment 30 Relay device 101 Inter-site communication processing unit 102 Secret key sharing processing unit 103 Random Number Generation Processing Unit 104 Encryption Processing Unit 105 Key generation processing unit 201 QKD Processing Unit 500 Computers 501 Input device 502 Display device 503 External I / F 503a Recording medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 Processors Bus 509

Claims

1. A key exchange system comprising multiple QKD devices that execute a quantum key distribution protocol that includes at least error correction, and multiple site devices that communicate with each other in an encrypted manner, The aforementioned base equipment It has a key generation unit configured to generate an encryption key for encrypted communication with other base station devices based on information received from the QKD device, The aforementioned QKD device is A QKD processing unit is configured to execute the quantum key distribution protocol with other QKD devices and generate a correction key from the ciphertext of random number information. It has a first transmitting unit configured to transmit information representing the result of a base match in the quantum key distribution protocol to the base device, A key exchange system in which the information received from the QKD device includes information representing the result of a base match in the quantum key distribution protocol.

2. Of the aforementioned multiple base stations, the base station located at the data transmission base is: A secret key sharing unit is configured to share a secret key with a base station device located at the data receiving site, A random number generator is configured to generate random number information, which is a random bit sequence of a predetermined length. An encryption unit configured to generate a ciphertext by encrypting the random number information using the aforementioned secret key, The system further includes a second transmitting unit configured to transmit the aforementioned ciphertext to a QKD device located at the data transmission site, The key generation unit in the base station equipment located at the data transmission base station is: The key exchange system according to claim 1, configured to generate the encryption key based on the result of the base match and the random number information.

3. The first transmitting unit of the QKD device located at the data receiving site among the plurality of QKD devices is: The system is configured to transmit the information representing the result of the base match and the correction key to a base station device located at the data receiving site. The key generation unit in the base station device located at the data receiving base station is: The key exchange system according to claim 2, configured to generate the encryption key based on the result of the base match, the correction key, and the secret key.

4. The aforementioned secret key is the key for a stream cipher scheme, The aforementioned private key sharing unit is: The key exchange system according to claim 2 or 3, configured to share the secret key with a base station device located at the data receiving site using a key encapsulation mechanism based on quantum cryptography.

5. A key exchange system comprising a plurality of QKD devices that execute a quantum key distribution protocol that includes at least error correction, and a plurality of base devices that communicate with each other in an encrypted manner, wherein the base device is A secret key sharing unit is configured to share a secret key with a site device located at the data receiving site when it is located at the data sending site, A random number generation unit is configured to generate random number information, which is a random bit sequence of a predetermined length, when it is located at the data transmission site. An encryption unit is configured to encrypt the random number information using the secret key and generate ciphertext for generating a correction key using the quantum key distribution protocol, when it is located at the data transmission site. A first transmitting unit, which is configured to transmit the ciphertext to a QKD device located at the data transmitting site when it is located at the data transmitting site, A key generation unit is configured to generate an encryption key for encrypted communication with other base station devices based on information received from the QKD device, It has, A base station device, the information received from the QKD device includes information representing the result of a base match in the quantum key distribution protocol.

6. A key exchange system comprising a plurality of QKD devices that execute a quantum key distribution protocol that includes at least error correction, and a plurality of site devices that perform encrypted communication with other site devices based on information received from the QKD devices, A QKD processing unit is configured to execute the quantum key distribution protocol with other QKD devices and generate a correction key from the ciphertext of random number information. A first transmission unit configured to transmit information representing the result of a base match in the quantum key distribution protocol to the base device, It has, A QKD device, wherein the information received from the QKD device includes information representing the result of a basis match in the quantum key distribution protocol.

7. A method used in a key exchange system that includes multiple QKD devices that execute a quantum key distribution protocol that includes at least error correction, and multiple site devices that communicate with each other in an encrypted manner, The aforementioned base equipment A key generation procedure is performed to generate an encryption key for encrypted communication with other site devices based on the information received from the QKD device. The aforementioned QKD device, A QKD processing procedure that executes the quantum key distribution protocol with other QKD devices and generates a corrected key from the ciphertext of random number information, A first transmission procedure is performed, which involves transmitting information representing the result of a base match in the quantum key distribution protocol to the base device. A method wherein the information received from the QKD device includes information representing the result of a base match in the quantum key distribution protocol.

8. A program that causes a computer to function as a base station device or QKD device included in the key exchange system described in claim 1.

Images