QKD Key Relay Processing With Continuous Decryption and Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing quantum key distribution (QKD) systems face challenges in enhancing the security of encryption keys, particularly during the relay process, where the application keys are temporarily in plaintext form, making them vulnerable to intrusion attacks.

Innovation Solution

The solution involves performing decryption and encryption processes continuously, prior to or simultaneously with the transfer process, using iptables/nftables functions to minimize the time the application keys are in plaintext form, thereby reducing the risk of information leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If decryption and encryption processes are performed separately with intermediate plaintext storage, then the processing is simpler and easier to implement, but the security of encryption keys deteriorates because keys are exposed in plaintext form during transfer

Engineering Contradiction:

Improvesecurity of encryption keyVSAvoidcomplexity of decryption and encryption process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the decryption and encryption processes into a single continuous operation using iptables/nftables hook functions. The decryption of the incoming encrypted application key and the encryption of the application key for outgoing transmission are performed back-to-back without intermediate plaintext storage, combining two security-critical operations into one integrated process flow.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent implements continuous decryption and encryption operations through network packet filtering hooks. The decryption process immediately feeds into the encryption process in an unbroken sequence, ensuring the application key never resides in plaintext state between operations. This continuous action eliminates the security vulnerability of intermediate plaintext storage.

Inventive Principle:

Principle #20Continuity of useful action

2Ease of operation

If application keys are stored in plaintext form for processing, then the ease of operation improves, but the risk of information leakage increases

Engineering Contradiction:

Improveease of key processingVSAvoidrisk of key leakage

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces iptables/nftables hook functions as intermediaries that mediate between the decryption and encryption processes. These hook functions act as a secure bridge that transfers the application key from decrypted to encrypted state without allowing it to be stored or exposed in plaintext form, maintaining ease of operation while eliminating leakage risk.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent rushes through the plaintext state of the application key by performing decryption and encryption in immediate succession without any intermediate storage or processing steps. The system skips over the dangerous plaintext state as quickly as possible, minimizing exposure time to near zero and effectively eliminating the risk of key leakage during transfer.

Inventive Principle:

Principle #21Skipping (Rushing through)

Data Source

PatentEP4618471A1Information processing device, quantum cryptographic communication system, information processing method, and computer-readable medium

Publication Date: 2025.09.17 KK TOSHIBA

Figure 1
Figure 2
Figure 3

AI summary

According to one arrangement, an information processing device (2) relays a second encryption key encrypted with a first encryption key shared between opposing quantum key distribution (QKD) devices (1) included in a QKD network (100). The information processing device (2) includes a first processing module (27) configured to control, after determining a transfer destination of a received packet, execution of decryption of the encrypted second encryption key included in the packet.