Method and system for multi-user quantum key distribution and management

Abstract

A method for distributing quantum-based cryptographic keys to multiple network nodes. Multi-user quantum key distribution from one node to two further nodes can be extended to a binary tree structure where any further node can participate in quantum key distribution with its two child nodes. Keys generated in a 3-node subgroup can be stitched with keys from a parent 3-node subgroup or a child 3-node group, and key confirmation can be provided through an authenticated classical channel. The classical channel can also be used to communicate and relay membership updates, allowing the key operator at the root node of the binary tree to update the key accordingly.

Description

Technical Field

[0001] [ Technical Field The present invention generally relates to the field of quantum cryptography, and more particularly to methods and systems for quantum key distribution when the number of parties involved is changed.

Background Art

[0002] Key distribution to multiple parties, such as the Group Diffie-Hellman protocol (GDH) and the Group Key Management Protocol (GKMP), can provide the ability to create and distribute keys within groups of any size without the intervention of a globally centralized key operator. However, in some situations, for example, when subgroups are not allowed to monitor each other except through a centralized key operator, a centralized key operator may be desirable to enable subgroup monitoring. The prior art lacks a model in which the key operator can monitor subgroups while preventing subgroups from monitoring each other, i.e., subgroups do not have a direct trust relationship. Furthermore, the calculation of group keys using the GDH protocol is exponential, suggesting room for simplification or increased efficiency.

[0003] Quantum-based keys can be regarded as a sequence of bits (i.e., 0 and 1), and each bit is determined by quantum-level randomness. A protocol called multi-user quantum key distribution (MU QKD) demonstrates such symmetric communication of keys from one party to two other parties, along with associated verification. However, the MU QKD protocol has so far been limited to three-party distribution.

[0004] Therefore, there is a need for methods and systems to eliminate or mitigate one or more limitations of the prior art by simplifying the calculation of group keys, and by increasing and then decreasing the number of parties in the MU QKD scheme, while there is no direct trust relationship between subgroups.

[0005] This background information is provided to clarify information that the applicant considers to be potentially relevant to the present invention. It is not necessarily intended, nor should it be interpreted, that any of the above information constitutes prior art to the present invention. [Overview of the Initiative]

[0006] The embodiment includes a method for extending a three-party quantum key distribution scheme to more than three parties using a trust model in which a central key operator can monitor subgroups and have trust relationships with them, while subgroups are prevented from monitoring each other and do not have trust relationships with each other. The trust model according to the embodiment can be based on a binary tree structure with a central key operator at the root, which is compatible with three-party quantum key distribution and can be extended to further parties by having any of the tree nodes act as secondary operators for their child nodes and as intermediaries with their own parent nodes. The computation of group keys according to the embodiment can be linear, which provides computational simplification and efficiency that is enhanced compared to the prior art. Furthermore, the embodiment includes a system and method for updating group-based multi-user (MU) keys when a node leaves the network in order to respect forward secrecy requirements.

[0007] The embodiment allows multiple parties in a network to communicate with each other using quantum-based keys, and the keys can be updated by a central operator when a party joins or leaves the network.

[0008] Using a network configured as a binary tree network, a quantum base key can be derived between an operator node and at least one of its two child nodes. Another quantum base key can be derived between one of the child nodes and at least one of its own child nodes. The two keys can then be transmitted to the operator node and combined into a quantum base key common to at least three discontinuous nodes. Thus, the embodiment enables communication between discontinuous nodes and benefits from the quantum base key and its high level of security.

[0009] Furthermore, in this embodiment, the quantum-based key can be updated when a node joins the network and when a node leaves the network, and the key update is a linear process, which is simpler than the update techniques of the prior art.

[0010] In this embodiment of the key distribution network, a central operator can maintain trust relationships with other nodes, while the other nodes do not have trust relationships with each other unless they go through the operator. This is because key updates can be performed by the operator.

[0011] The embodiment includes a method for generating a key, comprising the steps of: deriving a first key using a first node and a second node; deriving a second key using a second node and a third node; encrypting the first key using the second key; encrypting the second key using the first key; transmitting the encrypted first key to a third node; transmitting the encrypted second key to the first node; and deriving a stitched key from the first key and the second key, wherein the key is an encryption key made from a sequence of bits, the first node has a direct connection to the second node, and the second node has a direct connection to the third node. In the embodiment, the step of deriving the stitched key can be performed using a key derivation function (KDF). In the embodiment, the key derivation function may be a hash-based message authentication code (HMAC) key derivation function (HKDF). In the embodiment, the step of deriving a stitched key from a first key and a second key may be performed by concatenating the first key and the second key. In the embodiment, each node may be a node in a binary tree, the first node may be the parent node of the second node, the second node may be the child of the first node and the parent of the third node, and the third node may be the child of the second node. In the embodiment, the steps of deriving the first key and the steps of deriving the second key may include the step of at least one node sending a sequence of qubits to at least one receiving node, where each qubit is in a 2-qubit entanglement state.In the embodiment, there may be a confirmation that a stitch key is common to a first node and a third node, and the confirmation includes the second node receiving a message from the first node containing a request for confirmation and the first node's signature, sending a message to the third node containing a request for confirmation, the first node's signature and the second node's signature, receiving a message from the third node containing an acknowledgment and the third node's signature, and sending a message to the first node containing an acknowledgment, the third node's signature and the second node's signature. In the embodiment, the node's signature may include an integrity key derived using a key derivation function, the input of which may include at least a stitch key, an identifier of the sending node and an identifier of the receiving node. In the embodiment, the key derivation function may be a hash-based message authentication code (HMAC) key derivation function (HKDF). In the embodiment, the input of the key derivation function may include an identifier of an intermediary node.

[0012] Embodiments include a method for updating cryptographic keys for nodes in a binary tree network, comprising the steps of: a first node receiving a group update request from a second node for the removal of a third node; sending a group update response and the first node's signature to the second node; sending a group key update and the first node's signature to the second node; and sending a group key update and the first node's signature to a fourth node, where the first node is the parent node of the second and fourth nodes, and the second node is the parent node of the third node. Embodiments may further include the step of the first node sending a group key update and the first node's signature to at least one other node.

[0013] Embodiments include a system for performing quantum key distribution to a plurality of nodes, each having at least three nodes of a binary tree, wherein the first node is the parent node to the second node, the second node is the child node to the first node and the parent node to the third node, and the third node is the child node to the second node, and each node operates to participate in quantum key distribution based on a qubit in a 2-qubit entangled state. Embodiments may include a second node and a third node that operate to derive a key between the second node and the third node, and a first node and a second node that operate to derive a key between the first node and the second node, wherein the second node operates to encrypt the key using the other key and send the encrypted key to the other node, and the first node operates to derive a group key for the first node, the second node and the third node using the key between the second node and the third node and the key between the first node and the second node. In the embodiment, the system may further include one or more classical channels for communicating key confirmation requests and key confirmation responses from one node to another.

[0014] The embodiment includes a machine-readable medium for storing machine-readable instructions, which, when executed by the processor of the first node, can be configured to receive a group update request from the second node for the deletion of the third node, send a group update response and the first node's signature to the second node, send a group key update and the first node's signature to the second node, send a group key update and the first node's signature to the fourth node, where the first node is the parent node of the second and fourth nodes, and the second node is the parent node of the third node. In the embodiment, the machine-readable medium may further be configured to allow the first node to send a group key update and the first node's signature to at least one other node.

[0015] The embodiment includes a machine-readable medium for storing machine-readable instructions, which, when executed by the processor of a second node, is configured to generate a key, the second node derives a first key using the first and second nodes, derives a second key using the second and third nodes, encrypts the first key using the second key, encrypts the second key using the first key, transmits the encrypted first key to the third node, transmits the encrypted second key to the first node, and receives a stitch key from the first node, the stitch key being derived by the first node from the first and second keys, the key being an encryption key made from a sequence of bits, the first node having a direct connection to the second node, and the second node having a direct connection to the third node. In the embodiment, the stitch key may be a hash-based message authentication code (HMAC) key. In one embodiment, deriving the first key may involve the first node sending a sequence of qubits to the second node, where each qubit is in a 2-qubit entanglement state.

[0016] In some embodiments, a node such as the second node can be a user equipment device (UE). [Brief explanation of the drawing]

[0017] [Figure 1] This document presents a multi-user quantum key distribution (MU QKD) network with a binary tree structure, based on an embodiment that implements photonic qubits. [Figure 2] This embodiment demonstrates a multi-user quantum key distribution (MU QKD) network with a binary tree structure, with emphasis on subgroups and associated group keys. [Figure 3]Shows a group of three network nodes and the trust relationships between the nodes according to an embodiment. [Figure 4] It is a call flow diagram showing steps to enable group key stitching according to an embodiment. [Figure 5a] Shows a part of a message requesting confirmation of a stitch group key from operator node O to node C according to an embodiment. [Figure 5b] Shows a part of a message requesting confirmation of a stitch group key from node A to node C according to an embodiment. [Figure 5c] Shows a part of a message requesting confirmation of a stitch group key from node C to operator node O according to an embodiment. [Figure 5d] Shows a part of a message requesting confirmation of a stitch group key from node A to operator node O according to an embodiment. [Figure 6a] Shows a method by which, according to an embodiment, a completeness key can be reconstructed from a node identifier and a group key and used to create a signature for the sending node. [Figure 6b] Shows a method by which, according to an embodiment where the node is the node defined in FIGS. 1 - 5, a completeness key can be reconstructed from a node identifier and a group key and used to create a signature for the sending node. [Figure 7] It is a call flow diagram showing steps to enable confirmation of a stitch group key according to an embodiment. [Figure 8] Shows the removal of a node when leaving a binary tree network according to an embodiment. [Figure 9] It is a call flow diagram showing a process for removing one or more nodes leaving a binary tree network according to an embodiment. [Figure 10] It is a block diagram of an electronic device (ED, electronic device) shown in a computing and communication environment that can be used to implement the devices and methods disclosed herein.

Best Mode for Carrying Out the Invention

[0018] A centralized trust model in which a key operator can monitor a subgroup of nodes (i.e., parties), where the subgroup cannot monitor each other and depends on the key operator without having a direct trust relationship with each other, can be realized with a binary tree network structure according to an embodiment. The binary tree structure is also compatible with a three-party quantum key distribution scheme in which any node (i.e., vertex) can be a party. In an embodiment that realizes the binary tree structure, any node of the binary tree can symmetrically send a key to two subsequent nodes (child nodes), thereby enabling a multi-level or hierarchical structure that includes more than three nodes. When functioning as a transmission side, a node of the binary tree is a parent node with respect to two other nodes and can be called a leader node. The binary tree structure has one root node that can be called an operator node. In an embodiment, any group of three parties that includes one parent node functioning as a leader and two child nodes functioning as a reception side can be called a subgroup. Subgroups associated with the root node (i.e., operator node) by the same number of intermediate nodes can be said to be in the same layer. The layer including the root node can be called "Layer 1".

[0019] A method for an operator node to manage subgroups of multiple layers according to an embodiment can be called a key stitching (KS) trust model. In an embodiment, key stitching is a process in which a node that receives a first key or Layer 1 key from an operator node can generate a second key or Layer 2 key for transmission to a further node, and then the first key and the second key can be collected through the operator node to create a common key for Layer 1 and Layer 2. In an embodiment, the receiving node that also generates a key can be called a subgroup "leader". Further, compared with the prior art in which group key calculation is exponential, the group key calculation of the embodiment can be linear.

[0020] Linear overhead is due to the group dynamics of nodes joining or leaving the network. The QKD protocol requires communication overhead for four message round trips with only operator O. If N represents the number of nodes in the network, this can be expressed as O(4N). Using a protocol such as the Group Diffie-Hellman (GDH) protocol, group key calculation is exponentially O(N). m ) is better represented by this.

[0021] The embodiment is applicable to a three-party quantum key distribution scheme, where a quantum-based key can be generated, processed, and distributed as a sequence of bits from an operator node to two other separate parties (i.e., the first two child nodes of a binary tree structure), and key security, or the secrecy of the bit value, is verified through quantum mechanisms and quantum-based principles. A three-party quantum key distribution scheme called multi-user quantum key distribution or MU QKD is described in PCT / CA2021 / 050738.

[0022] The embodiment may include at least one authenticated classical channel, which can be used to communicate and compare key versions received by different parties, i.e., to obtain key agreement involved in the distribution scheme.

[0023] In embodiments applied to multi-user quantum key distribution (MU QKD) protocols (i.e., where the number of users is N≧2), key security and / or confidentiality can be based on a two-qubit entanglement state where Bell's inequality is broken. This scheme improves or ensures incompatibility and protection against eavesdropping.

[0024] The embodiment combines MU QKD with a key stitching trust model to provide a simplified mechanism for symmetrically distributing and sharing keys to subgroups of further layers beyond the first two receivers (i.e., beyond Layer 1), thereby extending key distribution to multiple layers and multiple members. A key for one layer can be stitched to a key for another layer. For example, a Layer 1 key distributed from an operator node to its two child nodes can be stitched to a Layer 2 key distributed from the Layer 1 child nodes to the Layer 2 child nodes. Furthermore, the key stitching trust model can be complemented by systems and methods for updating group-based multi-user keys when a party leaves the network, in order to respect forward secrecy requirements.

[0025] In embodiments, the key can be a sequence of bits, each determined by quantum-scale randomness. Before determination, the bits can be quantum bits or "qubits," which can be seen as bits of information in a superposition of two resulting states, typically described as |0> and |1> (as opposed to classical bits 0 and 1) using the notation of the art. In embodiments, the qubits may have two possible resulting states |0> and |1> when measured, and the initial (pre-measurement) state ψ of the superposition can be expressed as follows: ψ=a|0>+b|1> (1) Here, a and b correspond indirectly to the probabilities of each resulting state of the superposition through further computation, which in some embodiments can be 50%. State |0> is one possible resulting state of the qubit, and state |1> is another possible resulting state, each possibility having a 50% probability of occurring, and the results of each qubit are essentially random. A process called "measurement," which depends on how the qubit was realized and generated, once the results are known, can be used as classical bits, i.e., 0s or 1s, to form a sequence that can be used as a key. Thus, such a key is called a quantum-based key or simply a quantum key. A quantum key can be a sequence of bits, each bit being randomly determined according to quantum-level randomness.

[0026] In the embodiment, when a qubit is first generated and transmitted, its state can be undetermined, and when received by a network node, the state of the qubit can be measured and thus determined to be either 0 or 1, with a random value. At the quantum scale of a qubit, which can be realized as a single particle, a single atom, or other entity with measurable quantum properties, the measurement itself can cause the qubit to enter a determined state, and the measurement can be performed such that only one of two possible outcomes is possible. The two possible outcomes can be labeled as state |0> and state |1>, and after the measurement, the qubit becomes a classical bit, simply as 0 or 1. For example, if the qubit is a photon in a random (quantum) state of polarization, typically the photon enters a determined (classical) state of polarization by measuring the polarization using a polarizer.

[0027] A quantum-based key (i.e., a quantum key) can be a sequence of bits (i.e., 0s and 1s), where each bit is randomly determined based on physical quantum-scale phenomena. When first transmitted, a qubit can be undetermined, but at the time of reception, the state of the qubit can be measured, and as a qubit, the state can be determined as either 0 or 1. If the receiving point is an undesirable interceptor (e.g., an eavesdropper), the qubit becomes a determined bit, and its randomness is lost. In a hypothetical scenario, the interceptor can measure the bit and obtain, for example, 1. To conceal its presence, the interceptor transmits a conventional bit 1 to the intended receiving node. However, with a well-designed system and method, a receiving node measuring the bit as 0 or 1 can statistically determine whether the bit was transmitted as a random qubit or as a classical bit by an interceptor who initially received and measured the original qubit.

[0028] A 2-qubit entangled state is a state containing two qubits that interact in such a way that each qubit cannot be described independently. Instead, the two qubits must be described as a single entity. For example, if the two qubits are not entangled, there are four possible outcome states for a pair: |00>, |01>, |01>, and |11>, where in |xy>, x is the bit value of one bit in the pair and y is the bit value of the other bit in the pair. However, if the two qubits are entangled, the measurement result is limited to two possibilities: |00> or |11>. The creation of multiple qubits, each qubit entangled with one other qubit, can result in the creation of two columns of entangled qubits representing two copies of the key. In subsequent processing, the two columns can be compared. If, during comparison, it is shown that many bits in the sequence are in an unentangled state, i.e., many |01> or |10> states are present, then it can be concluded that the qubit transmission is compromised and the key is insecure. However, if the states of most bits follow those of the original entangled qubit, i.e., a significant number of |00> and |11> states are present and very few |01> or |10> states are present, then the key can be considered uncompromised, secure, and usable. Interception of a sequence of qubits can cause entangled qubits to become conventional bits, so interception can cause an increased proportion of |01> and |10> states and cause the key to be rejected. However, excessive noise can also cause |01> and |10> states, so environmental noise should be taken into account when evaluating the security of a key.

[0029] When two qubits are entangled, only two result states are possible. The quantum state of two entangled qubits can be represented as follows: ψ=1 / √2|00>+1 / √2|11> ψ = 1 / √2 (|00> + |11>) (1) Here, |00> represents one possible outcome state of the entangled qubits (both being 0), |11> represents other possible outcome states of the entangled qubit (both being 1), The 1 / √2 power corresponds to a 50% probability for each measured outcome state.

[0030] In group communications, when group members need to securely exchange messages, the generation of a group key may be required, and this group key is common to all members of the group. For example, in mobile multicast communications, the key distribution method is the Authentication and Key Agreement (AKA) protocol. Such protocols may rely on the secrecy of the root key (K), and unauthorized modification or compromise of the root key K could lead to information leakage. By using a multi-user quantum key distribution (MU QKD) method based on a two-qubit entanglement state according to the embodiment, the risk of unauthorized modification or compromise of the key can be significantly reduced, and in some cases to an arbitrarily low level, depending on the implementation. Compared to a completely classical computing environment, in the embodiment, the measurement of many unentangled states (i.e., states |01> and |10>) can indicate the interception of the initial transmission of a sequence of entangled qubits, so the multi-user quantum key distribution (MU QKD) method according to the embodiment can provide improved security against interceptor (i.e., eavesdropper, man-in-the-middle (MITM)) attacks.

[0031] The embodiment may include a three-party multi-party quantum key distribution (MU QKD) scheme in which a key operator (a parent node acting as a leader node) can generate two sequences of entangled qubits as two copies of the key to be distributed from the key operator to two other separate parties (child nodes acting as receiving nodes). The two copies of the sequence of qubits can be processed, compared, and verified to become a classical bit key that can be shared among all three parties, and for this purpose, the embodiment may also include one or more authenticated classical channels to communicate the agreement with the different copies of the key to be distributed.

[0032] For security, key distribution to multiple users using the MU QKD scheme can depend on the physical proximity between the sending and receiving nodes. When a quantum-based key is distributed to a user device (i.e., a UE such as a mobile handset) according to the MU QKD scheme based on two-qubit entanglement, the UE must be close enough to the source of the generated qubits to securely receive them. As the distance increases, the likelihood of the qubits being intercepted or disrupted by noise also increases. Therefore, the security of quantum-based keys can increase as the distance between the source and receiving nodes decreases.

[0033] Due to an entanglement feature called "quantum non-locality" in this technology, key distribution to multiple users using the MU QKD scheme can be extremely secure. Quantum non-locality can be experimentally observed to mean that when two qubits are entangled and their states are undetermined, a measurement of one qubit instantaneously determines the state of the other qubit, regardless of their location. Therefore, the state of a qubit is not necessarily determined by "local" conditions, but can be determined by a measurement at the location of the other qubit. A formula called Bell's inequality can be used to indicate whether qubits are entangled or not. Typically, if two qubits are not entangled, Bell's inequality is satisfied. However, the state of two qubits being entangled does not satisfy Bell's inequality, and therefore, if Bell's inequality is not satisfied, this indicates the presence of entangled qubits. From Bell's inequality, the probability of two qubits being entangled, when an interceptor (i.e., eavesdropper) is involved, can be expressed as follows: E(AC)+E(CB)< <E(AB) (2) Here, E(AC) represents the expected value (i.e., probability) that a bit at receiving node A will be entangled with a bit at interceptor (C). E(CB) represents the expected value (i.e., probability) that a bit at receiving node B will be entangled with a bit at interceptor (C). E(AB) represents the expected value (i.e., probability) that a bit at receiving node A is entangled with a bit at receiving node B.

[0034] Equation (2) states that the probability E(AB) of entanglement between a qubit received by receiving node A and a qubit received by receiving node B is much greater than the probability that a qubit received by eavesdropper C is entangled with one at either A or B. In other words, if a qubit is received by an eavesdropper, the probability that it is entangled with a bit at receiving node A or B is negligibly low. Therefore, the security level of a quantum-based key can be assessed by counting how many of its qubits are received in a state of two-qubit entanglement.

[0035] Embodiments may include a multi-user quantum key distribution (MU QKD) method such as a 2-qubit MU QKD, and key stitching such that the same key is further shared with multiple network nodes, thereby extending the MU QKD to multiple members of multiple layers. The first node may be a centralized operator node O responsible for the initial MU QKD, key stitching, and realizing trust relationships with further nodes (i.e., a key stitching trust model). In embodiments that implement a 2-qubit MU QKD protocol in a binary tree structure, operator node O can symmetrically distribute keys to its child nodes, i.e., receiving node A and receiving node B, and operator O, node A and node B together can be said to form the core layer of the network or layer 1 of the MU QKD network. Layer 1 may contain one trust group whose members are operator node O, node A and node B. Nodes A and B may be called "Alice" and "Bob," respectively.

[0036] In the embodiment, each of receiving node A and receiving node B can also function as an additional sender by generating a pair of entangled qubits that can be sent to further child nodes. If MU QKDs exist from node A to receiving child nodes C and D, nodes A, C and D can be called another trust group, and if MU QKDs exist from node B to receiving nodes E and F, nodes B, E and F can be called yet another trust group. In the embodiment, either MU QKD from node A to nodes C and D and / or from node B to node E can be called a Layer 2 QKD or a Layer 2 MU QKD.

[0037] Figure 1 shows a MU QKD network having a binary tree structure according to one embodiment. In an embodiment in which a sequence of qubits is realized as a sequence of photons, the key source 105 can generate a sequence of photons 110, which are received by a polarizing beam splitter 115 and can generate pairs of entangled qubits 120. Each pair of entangled qubits can be said to be in a bell state, which can be expressed as equation (1)125. The first polarizing beam splitter 115 that generates the entangled qubits can be called the key operator node or operator O. By generating many pairs of qubits in sequence, each qubit is in a 2-qubit entangled state, and two copies of the sequence of qubits can be generated, each qubit in one copy entangles with a qubit in the other copy, and each copy can be transmitted to a different receiving node. The first sequence of qubits is transmitted to node A130, and the second sequence of qubits, each entangled with the first sequence of qubits, can be transmitted to node B135.

[0038] When a qubit is received at node A130, its polarization state can be measured by a polarization beam splitter. The measurement result, which can be one of two states, can be recorded in the memory associated with node A as a conventional bit of 0 or 1, depending on the measurement result. Similarly, node B135 can perform the same operation with the other entangled qubit of the pair. Later, the sequence recorded at node A can be compared with the sequence recorded at node B, and if the level of entanglement is sufficient, i.e., the sequence received at node A is sufficiently similar to the sequence received at node B, as determined by the user, they can be made similar or identical by removing dissimilar bits, and the final sequence can be used as a key.

[0039] In this embodiment, each of node A and node B can generate pairs of entangled qubits 140, 145 that can be sent to further receiving nodes such as node C150 (user 1), node D155 (user 2), node E160 (user 3), and node F165 (user 4), so that receiving nodes A130 and B135 can also function as if they were further operators. Distributions from operator O115 to nodes A and B can be called "layer 1" 170 distributions, and distributions from nodes A and / or B to nodes C and D, and / or nodes E and F can be called "layer 2" 175 transmissions.

[0040] If nodes A130 and B135 also function as further operators by generating further pairs of entangled qubits 140, 145, then they can function as operator nodes for their respective child nodes, and each three-party group can be called a subgroup, with nodes A and B each being called subgroup leaders. Each subgroup can also be a trust group, and each subgroup or trust group can generate a group key unique to that subgroup or trust group.

[0041] Figure 2 shows a structure for multi-user quantum key distribution and stitching according to an embodiment, with emphasis on subgroups and associated group keys. This figure represents key distribution from a central operator O115 to its child nodes in a binary tree, into a multi-layer group of nodes. First, a symmetric key distribution 205 can be performed from the operator at node O115 to node A130 and then to node B135, together forming group G(O,AB)210. The keys distributed and derived by nodes O, A and B are K O-A-B It can be called 215.

[0042] key K O-A-B After 215 is derived, further symmetric key distributions 220 can be made from node A130 to nodes C150 and D155, the three of which can be called subgroup G(A,CD)225. The resulting key initially consists of two copies of the entangled qubit, K A-C-D It can be called 230. Similarly, a further MU KD235 can be performed from node B135 to nodes E160 and F165, and that group can be called subgroup G(B,EF)240, and the resulting key is K B-E-F It can be called 245.

[0043] As shown in Figure 2, in an embodiment where MU QKD is performed in multiple groups, group key stitching represents a group key verification protocol according to the embodiment, which can collect two or more keys into a combined group key through at least one intermediate entity for the multiple groups involved. For example, in Figure 2, the intermediate entity can be node A130 between two separate groups, namely group G(O,AB)210 and group G(A,CD)225. In such a case, a combined group key can be generated for the two groups, and the combined group key is key K O-A-B 215 and K A-C-D Based on 225.

[0044] In this embodiment, the group key stitch trust model can be constructed based on security assumptions including the following: • A powerful centralized key operator exists, and trust is directed towards that centralized operator. To ensure the security characteristics of the group key stitching trust model, a secure key exchange mechanism such as MU QKD exists.

[0045] Figure 3 shows a trust model to which group key stitching according to this embodiment can conform. This model includes a group of three network nodes and trust relationships between the nodes. In this embodiment, operator node O115 may have a direct mutual trust relationship 310 with receiving node A130 and a separate mutual trust relationship 320 with receiving node B135. However, a trust relationship 330 does not necessarily exist between node A and node B, and thus mutual trust between them can only be achieved through node O115.

[0046] In symbolic notation, trust relationships can be represented as follows: The trust relationship between node O and A can be represented as follows:

number

number

number

number

[0047] To achieve group key stitching through operator O115 and to establish a trust model with subgroups such as group G(A,CD)225, once key K(OAB) is derived via MU QKD, the following steps can be performed by node A130. See Figure 2. Node A performs key distribution using a sequence of 2-qubit entanglements from Node A to Nodes C and D (i.e., MU QKD in each subgroup) to derive the group key K(ACD)230. Node A relays key K(OAB)215 to group G(A,CD)225 and key K(ACD)230 to group G(O,AB)210 via an authenticated classical channel (i.e., group key exchange). Node A encrypts key K(ACD)230 using key K(OAB)215. Node A sends the encrypted key K(ACD)230 to Node O via the classical channel. Node A encrypts key K(OAB)215 using key K(ACD)230. Node A transmits the encrypted key K(OAB)215 to nodes C and D via the classical channel. By combining keys K(OAB)215 and K(ACD)230, etc., a group key for groups G(OAB)215 and G(ACD)225 can be derived (i.e., "group key stitching"), which can be expressed as follows: K(OACD) = K(OAB) || K(ACD) Node A relays the transmission of the stitch group key verification request message Msg1 from operator O, signed by O, to C and D (i.e., stitch group key verification). Optionally, to prevent a MITM attack from intercepting node A' (i.e., the eavesdropper), operator O may encode the identifier (ID) of node A into O's signing key. • Simultaneously, the same process can be executed between nodes B, E, and F.

[0048] Figure 4 is a call flow diagram illustrating the steps that enable group key stitching according to the embodiment. Node A130 can receive a sequence of entangled qubits from operator node O115 and participate in the MU QKD using group G(O,AB) to derive the group key K(OAB). Node A can also send a sequence of entangled qubits to nodes C150 and D155. Node A can participate in the MU QKD as part of group G(A,CD) to derive the group key K(ACD). The result of both instances of the MU QKD is that node A130 has two quantum-based keys, namely K(OAB) and K(ACD). Therefore, to send either of the two keys, node A130 can encrypt one using the other, and vice versa.

[0049] In this embodiment, node A130 can encrypt K(ACD) using K(OAB) and send the result E[K(ACD)] to operator node O115. Node A can also encrypt K(OAB) using K(ACD) and send the result E[K(OAB)] to nodes C150 and D155.

[0050] When keys K(OAB) and K(ACD) are received by Layer 1 and Layer 2 nodes, they can be "stitched" (i.e., combined by themselves or by linking them together, etc.) to form a group key K(OACD) 425.

[0051] In this embodiment, a confirmation process may follow the stitching of a group key such as K(OACD). As an initial group key confirmation step, a confirmation request message can be sent from operator node O115 to nodes C and D via relay by node A.

[0052] Figure 5a shows the characteristics of a message requesting confirmation of a stitch group key from operator node O to node C, according to an embodiment. The stitch group key confirmation request message "Msg1" 505 can be sent from operator O115 to node C150 via node A130. The content and parameters of the request message may include variables related to security 510 and can be signed with a signature from O515.

[0053] In a further group key verification step, a stitched group key verification request message "Msg2" can exist from node A to node C.

[0054] Figure 5b shows the characteristics of a request message from node A to node C for verifying a stitch group key according to an embodiment. The request message "Msg2" 520, along with its content and parameters including Msg1 505, can be sent directly from node A130 to node C150 and signed with A525's signature.

[0055] In a further group key verification step, a response message "Msg3" may exist from node C to operator O to verify the stitched group key.

[0056] Figure 5c shows the characteristics of a response message from node C to operator O that verifies the stitch group key according to an embodiment. The response message "Msg3" 530 can be sent from node C150 to operator O115 via node A130, and its content and parameters may include variables related to security 535 and can be signed using the signature of node C540.

[0057] In a further group key verification step, a response message "Msg4" can be sent from node A to operator O to verify the stitched group key.

[0058] Figure 5d shows the characteristics of a response message from node A to operator O that verifies the stitch group key, according to an embodiment. The response message Msg4 545 can be sent directly from node A525 to operator O115 using the signature of A525 and the content and parameters including Msg3 530.

[0059] The sender can use a secure hash function to sign the message. In particular, the message can be signed by the sending node (i.e., the source node) using signatures such as Sig(O)515, Sig(A)525, and Sig(B)540, which can be created using an integrity key "IK(source)". The integrity key can be derived from a key derivation function (i.e., KDF) such as a hash-based message authentication code (HMAC) KDF, also known as HKDF. The identifiers of the sender (i.e., source), receiver (i.e., destination), and relay can be known by the nodes, as can the group key, so the receiver can reconstruct the integrity key sent to it. Identifiers can be called ID(source), ID(destination), and ID(relay), and the identification keys for Sig(O)515, Sig(A)525, and Sig(C)540 can be represented as "IK(O)", "IK(A)", and "IK(C)", respectively.

[0060] Figure 6a shows an embodiment in which an integrity key is reconstructed from node identifiers and group keys and can be used to construct a signature for the sending node. The identifiers of source S, destination D, and relay R, ID(S)605, ID(D)610, and ID(R)615, respectively, can be used by the signing node along with the group key K620. A key derivation function (KDF)625, such as an HKDF, can be used to extend the strength or entropy of a key, taking ID(S), ID(D), ID(R) and the group key K as inputs, and generating an integrity key IK(S)630 as an output. IK(S)630 can be used along with the message Msg635 to create a signed message Sig[IK(S),Msg]640 for the sending node (i.e., the message source).

[0061] Figure 6b shows how, according to an embodiment in which the nodes are the nodes identified in Figures 1 to 5, the integrity key can be reconstructed from the node identifier and the group key, and the signature can be created for the sending node. The KDF625 in operator node O can use the identifiers of operator O, node C, and relay A, ID(O)655, ID(C)660, and ID(A)665, respectively, along with the group key K(OACD)670, as input to create the integrity key IK(O)680 as output. The integrity key IK(O)680 can be used along with the message Msg685 to create the signature 690 for operator node O.

[0062] Figure 7 is a call flow diagram illustrating the steps that enable verification of a stitched group key according to an embodiment. As the first step, operator node O115 can send a key verification request to node A130 with O's signature as message Msg1 505 705. Node A130 can add A's signature and relay the key verification request to nodes C150 and D155 as message Msg2 710. Nodes C and D, operating simultaneously or sequentially, can add their own signatures and send key verification replies to node A as message Msg3 715 each 715. After node A adds node A's signature and relays the key verification replies to operator node O 720, the key verification can be considered complete. When operator node O receives the key verification replies, the key stitching process as shown in Figure 4 for creating key K(OACD) can be considered successful 725, and these keys can be used.

[0063] In this embodiment, the calculation for stitching group keys can be linear, in contrast to other non-linear group key management protocols. The baseline assumption in this embodiment is that the trust model can be established through intermediate anchor points, such as node A130 in this example, which already have a pre-established secure connection with a central anchor point, such as node O115.

[0064] In embodiments, group dynamics, also known as membership dynamics, can describe events that occur when a party or group member joins a group (i.e., a node joins the network), leaves a group (i.e., a node leaves the network), or when a group undergoes other similar changes or updates. In such cases, whether the group key is derived directly from the 3-party MU QKD or derived using stitching as in embodiments, the confidentiality of the updated group should be maintained, especially when a member leaves the group.

[0065] In embodiments, "forward secrecy" refers to the property that when a node (i.e., a member) leaves a group, the node should be unable to decrypt information circulating within the updated group. In embodiments where keys are stitched and nodes or subgroups leave the binary tree network, key management is simpler than alternative methods. In particular, the process of removing a leaving node or subgroup, which may include removing the key portion of a particular subgroup, involves linear computation, which makes the cost of managing key changes simpler, more efficient, and easier to implement than with conventional group key algorithms such as GDH and similar methods.

[0066] In embodiments, once group keys for multiple nodes are stitched together, the detachment process may include trimming nodes by referencing the tree structure. Two limitations may exist on such trimming. One limitation is that trimming a node may also affect peer members under the same root node, where peer members can be other child nodes that share the same parent node. For example, in group G(A,CD)225, trimming node C150 also causes the removal of peer member node D155. The other limitation is that trimming a node may affect subgroups under that node. For example, in group G(A,CD)225, trimming node C150 may also cause further nodes such as node G and node H to be trimmed as well, and since node D is removed, nodes I and J are also removed.

[0067] Figure 8 shows the removal of a node when leaving a binary tree network according to the embodiment. Each node in the illustrated binary tree is a node participating in the MU QKD scheme according to the embodiment. When node C150 is removed from the network, node D155 is also removed, and all branches 815 or subgroups 820 of nodes C and D are also removed.

[0068] Embodiments using multi-party quantum key distribution (MU QKD) can establish secure multi-party communication based on a central anchor point, indicated as operator node O115.

[0069] Figure 9 is a call flow diagram illustrating the process for removing one or more nodes that are leaving a binary tree network according to an embodiment. Node A130, which has a branch with nodes C and D (not shown) that are leaving the network, can send a message MsgUpd1 to its root node, operator O115, which contains a group update request "Group Update Request (Delete)" for deletion and the signature of node A "Sig(A)". Node A can then receive a response from the root node operator O115 as MsgUpd2 "Group Update Response (Delete)" along with the signature of node O "Sig(O)". After the root node operator O115 updates the stitch group key, node A can then receive the updated stitch group key from node O as a message MsgUpd3 containing the updated stitch group key and the signature of O Sig(O). Operator node O115 can also send a MsgRem3 to node B. The result of the process shown in Figure 9 is a new group with nodes C and D removed and updated, and the corresponding updated group key 925.

[0070] Figure 10 is a block diagram of an electronic device (ED) 952 shown within a computing and communication environment 950 that may be used to implement the devices and methods disclosed herein. Such an electronic device may be a UE or a network element. The electronic device 952 typically includes a processor 954 such as a central processing unit (CPU), a dedicated processor such as a field programmable gate array (FPGA) or other such processor, memory 956, a network interface 958, and a bus 960 for connecting the components of the ED 952. The ED 952 may optionally also include components such as a mass storage device 962, a video adapter 964, and an I / O interface 968 (shown by a dashed line). The ED 952 in an embodiment may also include a cache.

[0071] Memory 956 may include any type of non-temporary system memory readable by processor 954, such as static random-access memory (SRAM), dynamic random-access memory (DRAM), synchronous DRAM (SDRAM), read-only memory (ROM), or a combination thereof. In embodiments, memory 956 may include one or more types of memory, such as ROM for use during boot-up, and DRAM for program and data storage for use while a program is running. Bus 960 may be one or more of several bus architectures of any type, including a memory bus or memory controller, a peripheral bus, or a video bus.

[0072] The electronic device 952 may also include one or more network interfaces 958, which may include at least one of a wired network interface and a wireless network interface. The network interface 958 may include a wired network interface for connecting to network 974, and may also include a wireless access network interface 972 for connecting to other devices on a wireless link. The network interface 958 enables the electronic device 952 to communicate with remote entities, such as those connected to network 974.

[0073] The mass storage 962 may include any type of non-transient storage device configured to store data, programs, and other information and to make the data, programs, and other information accessible via the bus 960. The mass storage 962 may include, for example, one or more of a solid-state drive, a hard disk drive, a magnetic disk drive, or an optical disk drive. In some embodiments, the mass storage 962 may be separate from the electronic device 952 and may be accessible through the use of a network interface such as interface 958. In the illustrated embodiment, the mass storage 962 is separate from the memory 956 that contains it and may generally perform storage tasks that are suitable for higher latency, but may generally provide lower volatility or not provide volatility at all. In some embodiments, the mass storage 962 may be integrated with heterogeneous memory 956.

[0074] In some embodiments, the electronic device 952 may be a standalone device, while in other embodiments, the electronic device 952 may reside within a data center. A data center is, as understood in the art, a collection of computing resources (typically a server formula) that can be used as a collective computing and storage resource. Within a data center, multiple servers can be connected together to provide a computing resource pool from which virtualized entities can be instantiated. Data centers can be interconnected to form a network of pooled computing and storage resources connected to each other by connectivity resources. Connectivity resources may take the form of physical connections such as Ethernet or optical links, and in some cases may also include wireless communication channels. When two different data centers are connected by multiple different communication channels, the links can be combined using one of several techniques, including the formation of a link aggregation group (LAG). It should be understood that any or all of the computing, storage, and connectivity resources (along with other resources in the network) can be divided between different subnetworks, in some cases in the form of resource slices. When resources are sliced ​​across multiple connected data centers or a collection of other nodes, different network slices can be created.

[0075] In the embodiment, the electronic device 952 can be used at any node to receive, process, store and / or receive a sequence of bits as a key. It can also be used, according to the embodiment, to stitch two group keys into one group key for a larger group, and to encrypt the key with other keys before transmitting it to other nodes. It can also be used, according to the embodiment, to update the key when a node leaves the network. The electronic device can also be used to update the group key when one or more nodes leave the network. The memory 956 can be used to store sequences of bits and any of the nodes. The network interface 958 can be used at any node to establish an authenticated classical channel between nodes, and any of these can be used, according to the embodiment, to communicate keys from one node to another, or to communicate acknowledgment and acknowledgment messages.

[0076] The embodiment includes a method for generating a key, comprising the steps of: deriving a first key using a first node and a second node; deriving a second key using a second node and a third node; encrypting the first key using the second key; encrypting the second key using the first key; transmitting the encrypted first key to a third node; transmitting the encrypted second key to the first node; and deriving a stitched key from the first key and the second key, wherein the key is an encryption key made from a sequence of bits, the first node has a direct connection to the second node, and the second node has a direct connection to the third node. In the embodiment, the step of deriving the stitched key can be performed using a key derivation function (KDF). In the embodiment, the key derivation function may be a hash-based message authentication code (HMAC) key derivation function (HKDF). In the embodiment, the step of deriving a stitched key from a first key and a second key may be performed by concatenating the first key and the second key. In the embodiment, each node may be a node in a binary tree, the first node may be the parent node of the second node, the second node may be the child of the first node and the parent of the third node, and the third node may be the child of the second node. In the embodiment, the steps of deriving the first key and the steps of deriving the second key may include the step of at least one node sending a sequence of qubits to at least one receiving node, where each qubit is in a 2-qubit entanglement state.In the embodiment, there may be a confirmation that a stitch key is common to a first node and a third node, and the confirmation includes the second node receiving a message from the first node containing a request for confirmation and the first node's signature, sending a message to the third node containing a request for confirmation, the first node's signature and the second node's signature, receiving a message from the third node containing an acknowledgment and the third node's signature, and sending a message to the first node containing an acknowledgment, the third node's signature and the second node's signature. In the embodiment, the node's signature may include an integrity key derived using a key derivation function, the input of which may include at least a stitch key, an identifier of the sending node and an identifier of the receiving node. In the embodiment, the key derivation function may be a hash-based message authentication code (HMAC) key derivation function (HKDF). In the embodiment, the input of the key derivation function may include an identifier of an intermediary node.

[0077] Embodiments include a method for updating cryptographic keys for nodes in a binary tree network, comprising the steps of: a first node receiving a group update request from a second node for the removal of a third node; sending a group update response and the first node's signature to the second node; sending a group key update and the first node's signature to the second node; and sending a group key update and the first node's signature to a fourth node, where the first node is the parent node of the second and fourth nodes, and the second node is the parent node of the third node. Embodiments may further include the step of the first node sending a group key update and the first node's signature to at least one other node.

[0078] Embodiments include a system for performing quantum key distribution to a plurality of nodes, each having at least three nodes of a binary tree, wherein the first node is the parent node to the second node, the second node is the child node to the first node and the parent node to the third node, and the third node is the child node to the second node, and each node operates to participate in quantum key distribution based on a qubit in a 2-qubit entangled state. Embodiments may include a second node and a third node that operate to derive a key between the second node and the third node, and a first node and a second node that operate to derive a key between the first node and the second node, wherein the second node operates to encrypt the key using the other key and send the encrypted key to the other node, and the first node operates to derive a group key for the first node, the second node and the third node using the key between the second node and the third node and the key between the first node and the second node. In the embodiment, the system may further include one or more classical channels for communicating key confirmation requests and key confirmation responses from one node to another.

[0079] The embodiment includes a machine-readable medium for storing machine-readable instructions, which, when executed by the processor of the first node, can be configured to receive a group update request from the second node for the deletion of the third node, send a group update response and the first node's signature to the second node, send a group key update and the first node's signature to the second node, send a group key update and the first node's signature to the fourth node, where the first node is the parent node of the second and fourth nodes, and the second node is the parent node of the third node. In the embodiment, the machine-readable medium may further be configured to allow the first node to send a group key update and the first node's signature to at least one other node.

[0080] The embodiment includes a machine-readable medium for storing machine-readable instructions, which, when executed by the processor of a second node, is configured to generate a key, the second node derives a first key using the first and second nodes, derives a second key using the second and third nodes, encrypts the first key using the second key, encrypts the second key using the first key, transmits the encrypted first key to the third node, transmits the encrypted second key to the first node, and receives a stitch key from the first node, the stitch key being derived by the first node from the first and second keys, the key being an encryption key made from a sequence of bits, the first node having a direct connection to the second node, and the second node having a direct connection to the third node. In the embodiment, the stitch key may be a hash-based message authentication code (HMAC) key. In one embodiment, deriving the first key may involve the first node sending a sequence of qubits to the second node, where each qubit is in a 2-qubit entanglement state.

[0081] Other embodiments include devices that function as nodes as described herein, including UEs and network elements.

[0082] Embodiments are described above in conjunction with embodiments of the present invention in which they can be realized. Those skilled in the art will understand that embodiments may be realized in conjunction with the embodiments described, but may also be realized in conjunction with other embodiments of that embodiment. Where embodiments are mutually exclusive or otherwise incompatible with one another, this will be obvious to those skilled in the art. Some embodiments may be described in relation to one embodiment, but as will be obvious to those skilled in the art, they may also be applicable to other embodiments.

[0083] While the present invention has been described with reference to its specific features and embodiments, it is evident that various modifications and combinations can be made thereto without departing from the invention. Therefore, the specification and drawings should be considered merely illustrative examples of the invention as defined by the appended claims, and are intended to cover all modifications, variations, combinations, or equivalents that fall within the scope of the invention.

Claims

1. A method for generating a key for performing quantization key distribution to multiple nodes, A step of deriving a first key using the first and second nodes of a binary tree, wherein the first node is the parent node of the second node, and the second node is one of the two child nodes of the first node, The step of deriving a second key using the second and third nodes, wherein the third node is one of the two child nodes of the second node, The steps include: encrypting the first key using the second key; The steps include: encrypting the second key using the first key; The steps include sending the encrypted first key to the third node, The first node sends an encrypted second key to the first node in order to derive a stitch key from the first key and the second key, A step of deriving a stitch key from the first key and the second key, Includes, A key is a cryptographic key made from a sequence of bits, The first node has a direct connection to the second node, A method wherein the second node has a direct connection to the third node.

2. The method according to claim 1, wherein the step of deriving the stitch key is performed using a key derivation function (KDF).

3. The method according to claim 2, wherein the key derivation function is a hash-based message authentication code (HMAC) key derivation function (HKDF).

4. The method according to claim 1, wherein the step of deriving a stitch key from the first key and the second key is performed by linking the first key and the second key.

5. The method according to any one of claims 1 to 4, wherein the steps of deriving a first key and deriving a second key include the step of at least one node transmitting a sequence of qubits to at least one receiving node, each qubit being in a two-qubit entanglement state.

6. The verification further includes confirming that the stitch key is common to the first node and the third node, wherein the second node is Receiving a message from the aforementioned first node containing an acknowledgment request and the signature of the aforementioned first node, Sending a message to the third node that includes the acknowledgment request, the signature of the first node, and the signature of the second node, Receiving a message from the third node including an acknowledgment and the signature of the third node, The method according to any one of claims 1 to 5, comprising sending a message to the first node containing the acknowledgment, the signature of the third node, and the signature of the second node.

7. The node's signature includes an integrity key derived using a key derivation function, and its input is at least, The aforementioned stitching key, The identifier of the sending node, Identifier of the receiving node and The method according to claim 6, including the method described in claim 6.

8. The method according to claim 7, wherein the key derivation function is a hash-based message authentication code (HMAC) key derivation function (HKDF).

9. The method according to claim 7 or 8, wherein the input further includes an identifier for a relay node.

10. A machine-readable medium for storing machine-readable instructions, A machine-readable medium wherein, when the machine-readable instruction is executed by the processor of the second node, the second node is configured to implement the method according to any one of claims 1 to 9.

Images