QKD Key Relay With Continuous Re-Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing quantum key distribution (QKD) systems face challenges in enhancing the security of encryption keys within key management devices, particularly during the decryption and encryption processes, leading to potential information leakage due to the application keys being processed in plaintext states.
Innovation Solution
The solution involves performing decryption and encryption processes of application keys continuously, prior to or simultaneously with the transfer process, utilizing iptables/nftables on the Linux OS to minimize the time the keys are in plaintext, thereby enhancing security against intrusion attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If decryption and encryption processes are performed sequentially with plaintext storage in between, then the ease of operation is improved, but the security is worsened due to keys being exposed in plaintext state
Solution Approach 1:
The patent implements continuous decryption and encryption operations without storing plaintext keys in memory. The decryption unit decrypts incoming ciphertext keys and immediately passes them to the encryption unit for re-encryption, eliminating the plaintext exposure window. This continuous processing ensures that keys remain encrypted throughout their lifecycle in the key management device, resolving the security issue while maintaining operational efficiency.
2Ease of operation
If keys are stored in plaintext for processing, then the ease of operation is improved, but the risk of information leakage increases
Solution Approach 1:
The system maintains continuous encrypted state of keys by performing decryption and encryption in immediate succession without intermediate plaintext storage. The decryption unit processes ciphertext keys and the encryption unit immediately re-encrypts them, ensuring keys never reside in plaintext form in memory or storage, thus eliminating information leakage risks while preserving operational functionality.
Solution Approach 2:
The patent introduces an intermediary processing mechanism where decrypted keys are immediately re-encrypted through a chained encryption process. Instead of storing plaintext keys for later use, the system uses an intermediate encryption step that transforms decrypted keys back into encrypted form before they can be exposed, effectively mediating between decryption operations and preventing plaintext exposure.
3Productivity
If decryption is performed before determining transfer destination, then the productivity is improved, but the security is worsened due to extended plaintext exposure time
Solution Approach 1:
The patent performs decryption as a preliminary action before determining the transfer destination, but immediately follows it with re-encryption. The decryption unit decrypts the ciphertext key first to enable routing decisions, then the encryption unit immediately re-encrypts the decrypted key before forwarding. This preliminary decryption followed by immediate re-encryption maintains productivity while minimizing plaintext exposure time to nearly zero.
Solution Approach 2:
The system maintains continuous protected state by chaining decryption and encryption operations without interruption. Even though decryption occurs before destination determination, the immediate subsequent encryption ensures the key returns to encrypted state before being transmitted, maintaining the continuous protection paradigm while enabling necessary routing operations.
Data Source
AI summary
According to one embodiment, an information processing device relays a second encryption key encrypted with a first encryption key shared between opposing quantum key distribution (QKD) devices included in a QKD network. The information processing device includes one or more processors configured to perform a first processing module configured to control, after determining a transfer destination of a received packet, execution of decryption of the encrypted second encryption key included in the packet.