QKD Key Forwarding Path Verification Using Node Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing quantum key distribution networks lack a comprehensive method for verifying the path taken by cryptographic keys, especially in larger networks, which is crucial for identifying compromised nodes and ensuring secure routing across geographic boundaries.
Innovation Solution
A method and system for verifying the key forwarding path in a quantum key distribution network using digital signatures generated by selected QKD nodes, where each node signs the cryptographic key with information about the routing, enabling secure verification against eavesdropping and malicious attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signatures are generated by each selected QKD node containing path information, then path verification security is improved, but computational complexity and processing time increase
Solution Approach 1:
The path verification process is segmented by having each QKD node generate its own digital signature containing its segment of the path information, rather than one node generating a signature for the entire path. This distributes the computational workload across multiple nodes while maintaining verification security.
Solution Approach 2:
Digital signatures are generated in advance during the key distribution process before final verification is needed. Each node signs the path information as it forwards the cryptographic key, so verification can be performed efficiently by simply checking the existing signatures rather than regenerating them.
2Reliability
If comprehensive path verification is implemented across all QKD nodes, then network security monitoring is improved, but system complexity and overhead increase
Solution Approach 1:
The digital signature mechanism serves multiple functions simultaneously: it provides authentication of the cryptographic key, verifies the complete path taken by the key, and enables security monitoring. This multi-functionality reduces overall system complexity by using a single mechanism for multiple security purposes.
Solution Approach 2:
The digital signatures act as intermediaries that carry path verification information through the network without requiring direct communication between all nodes. Each node adds its signature to the key forwarding path, and the receiving node can verify the entire path by checking these intermediary signatures.
3Reliability
If digital signatures with path information are transmitted by each QKD node, then path authenticity is improved, but data transmission volume increases
Solution Approach 1:
The path information is merged into the digital signature itself rather than being transmitted separately. Each node's signature contains encoded path information that is verified cryptographically, eliminating the need for separate path data transmission while maintaining authenticity.
Data Source
Figure 1~2
Figure 3~4
Figure 5~7
AI summary
The invention provides a method for verifying a key forwarding path of at least one cryptographic key in a quantum key distribution, QKD, network, and a system for the verification of the key forwarding path of at least one cryptographic key, the method comprising at least steps of: selecting (using either a centralized or a decentralized method) a number of QKD nodes of the QKD network, which define a key forwarding path of the at least one cryptographic key; transmitting to each of the selected QKD nodes data indicating at least partial information about the key forwarding path of the at least one cryptographic key; generating, by each selected QKD node, a digital signature, wherein the digital signature contains at least the data indicating at least partial information about the key forwarding path of the at least one cryptographic key; transmitting, by each selected QKD node (N1-N9), the digital signature generated at that selected QKD node (N1-N9); and verifying the key forwarding path of the at least one cryptographic key through a verification of the transmitted digital signatures.