Quantum key distribution node apparatus and method for quantum key distribution thereof

Patent metadata

Field	Value
Publication number	US-11316677-B2
Application number	US-202017069073-A
Country	US
Kind code	B2
Filing date	Oct 13, 2020
Priority date	Jul 3, 2020
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

A quantum key distribution (QKD) node apparatus and a QKD method therein. The QKD node apparatus may include a QKD module for generating quantum keys and quantum key IDs, a quantum key synchronization management module for storing the quantum keys and the quantum key IDs as outbound and inbound quantum keys in a distributed manner and sharing the outbound and inbound quantum keys with a second QKD node apparatus, and a quantum key orchestration module for delivering a master key and a master key ID to a secure application connected therewith in response to a request for the master key with the ID of a second secure application and delivering a packet including the master key encrypted with the outbound quantum key shared with the second QKD node apparatus, the master key ID, and a quantum key ID, to the second QKD node apparatus.

First claim

What is claimed is:

1. A quantum key distribution (QKD) node apparatus, comprising:
at least one processor, and a memory having instructions stored thereon, which, when executed by the at least one processor, cause the at least one processor to perform:
a QKD module for generating quantum keys and quantum key IDs;
a quantum key synchronization management module for storing the quantum keys and the quantum key IDs generated by the QKD module as an outbound quantum key and an inbound quantum key in a distributed manner and for sharing the outbound quantum key and the inbound quantum key with a second QKD node apparatus; and
a quantum key orchestration module for delivering a master key, generated using a random number, and a master key ID to a secure application connected therewith when the master key is requested by the secure application using an ID of a second secure application, and for transmitting a packet including the master key encrypted with the outbound quantum key shared with the second QKD node apparatus connected with the second secure application, the master key ID, and the quantum key ID to the second QKD node apparatus,
wherein the QKD modules equal in number to a number of quantum key synchronization management modules are connected therewith in a one-to-one manner, and each of the QKD module and the quantum key synchronization management module is one or more in number,
wherein the quantum key orchestration module is configured to:
retrieve a path corresponding to the ID of the second secure application based on an internal routing table, and
transmit a packet, including the master key encrypted with an outbound quantum key shared with a relay QKD node apparatus, the master key ID, information about the path, and a quantum key ID, to the relay QKD node apparatus when the relay QKD node apparatus for relaying is present on the path.

2. The QKD node apparatus of claim 1 , wherein, when the second secure application is connected with the QKD node apparatus, the quantum key orchestration module delivers the master key corresponding to the master key ID when a key request is made by the second secure application using the master key ID.

3. The QKD node apparatus of claim 1 , wherein, when a group key is requested by the secure application connected with the QKD node apparatus using IDs of multiple secure applications as parameters, the quantum key orchestration module delivers the group key generated using a random number and a group key ID to the secure application, retrieves a path along which the group key is transmitted using an internal routing table and the IDs of the multiple secure applications, and transmits a packet including the group key encrypted with an outbound quantum key shared with a next QKD node apparatus on the path, the group key ID, information about the path, the IDs of the multiple secure applications, and a quantum key ID to the next QKD node apparatus on the path.

4. The QKD node apparatus of claim 1 , wherein, when a large number of master keys is requested by the secure application connected with the QKD node apparatus, the quantum key orchestration module encrypts the large number of master keys with the outbound quantum key based on a block cipher.

5. A quantum key distribution (QKD) node apparatus, comprising:
at least one processor, and a memory having instructions stored thereon, which, when executed by the at least one processor, cause the at least one processor to perform:
a QKD module for generating quantum keys and quantum key IDs;
a quantum key synchronization management module for storing the quantum keys and the quantum key IDs generated by the QKD module as an outbound quantum key and an inbound quantum key in a distributed manner and sharing the outbound quantum key and the inbound quantum key with a second QKD node apparatus; and
a quantum key orchestration module for decrypting a master key included in a packet with the inbound quantum key shared with the second QKD node apparatus upon receiving the packet, including the encrypted master key, a master key ID, and the quantum key ID, from the second QKD node apparatus, and for delivering the master key corresponding to the master key ID to a secure application connected with the QKD node apparatus upon receiving the master key ID from the secure application,
wherein the QKD modules equal in number to a number of quantum key synchronization management modules are connected therewith in a one-to-one manner, and each of the QKD module and the quantum key synchronization management module is one or more in number,
wherein the quantum key orchestration module is configured to:
decrypt the encrypted master key with the inbound quantum key pertaining to the second QKD node apparatus when it is confirmed that the QKD node apparatus is required to relay the master key based on information about a path included in a packet upon receiving the packet from the second QKD node apparatus,
encrypt the decrypted master key with an outbound quantum key shared with a third QKD node apparatus, which is a next QKD apparatus on the path,
generate a packet including the encrypted master key, the information about the path, the master key ID, and a quantum key ID, and
transmit the packet to the third QKD node apparatus.

6. The QKD node apparatus of claim 5 , wherein:
when the packet includes a group key and IDs of multiple secure applications and when an ID of the secure application connected with the QKD node apparatus is included in the IDs of the multiple secure applications, the quantum key orchestration module stores the group key and a group key ID and deletes path information pertaining to the QKD node apparatus and the ID of the secure application connected with the QKD node apparatus from the packet.

7. The QKD node apparatus of claim 5 , wherein, when the master key is present in a large number thereof, the quantum key orchestration module decrypts the master key based on a block cipher.

8. A quantum key distribution method, comprising:
delivering, by a quantum key distribution (QKD) node apparatus, a master key, generated using a random number, and a master key ID to a secure application connected with the QKD node apparatus in response to a request from the secure application for the master key, which is required for quantum cryptographic communication with a second secure application;
when the second secure application is a secure application connected with the QKD node apparatus, delivering, by the QKD node apparatus, the master key corresponding to the master key ID when the master key is requested by the second secure application with the master key ID; and
when the second secure application is not a secure application connected with the QKD node apparatus, encrypting, by the QKD node apparatus, the master key with an outbound quantum key shared with a second QKD node apparatus connected with the second secure application, and delivering, by the QKD node apparatus, a packet including the encrypted master key, the master key ID, and a quantum key ID, to the second QKD node apparatus,
wherein the delivering the packet to the second QKD node apparatus comprises:
when the second secure application is not a secure application connected with the QKD node apparatus, retrieving a routing path using an internal routing table and an ID of the second secure application; and
when a relay QKD node apparatus is present on the routing path, encrypting the master key with an outbound quantum key shared with the relay QKD node apparatus and transmitting a packet including the master key, the master key ID, information about the routing path, and a quantum key ID to the relay QKD node apparatus,
wherein when the relay QKD node apparatus receives the packet fro

Assignees

• Electronics & Telecommunications Res Inst

Inventors

• Ko Haeng-Seok
• Ji Se Wan
• Jeong Younchang
• Kwon Osung
• Kim Seok
• Kim Eun Ji
• Hong Changho
• Jang Jingak
• Kwon Daesung

Classifications

• H04L9/0855 Primary

  involving additional nodes, e.g. quantum relays, repeaters, intermediate nodes or remote nodes · CPC title

• H04L9/0852

  Quantum cryptography (transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03) · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L9/12

  Transmitting and receiving encryption devices synchronised or initially set up in a particular manner · CPC title