Key management and user authentication for quantum cryptography networks
View Patent ↗Key management and user authentication systems and methods for quantum cryptography networks that allow for users securely communicate over a traditional communication link (TC-link). The method includes securely linking a centralized quantum key certificate authority (QKCA) to each network user via respective secure quantum links or “Q-links” that encrypt and decrypt data based on quantum keys (“Q-keys”). When two users (Alice and Bob) wish to communicate, the QKCA sends a set of true random bits (R) to each user over the respective Q-links. They then use R as a key to encode and decode data they send to each other over the TC-link.
1. A method of establishing a secure communication link between first and second users A and B in a quantum network (“Q-network”), where A and B are in direct communication with each other over only via a traditional communication link (TC-link) and in direct communication with respective first and second quantum key certification authorities (QKCAs) via respective first and second Q-links, comprising:
sending a set R of truly random bits from the second QKCA to B over the first Q-link;
sending the set R from the second QKCA to the first QKCA over a third Q-link connecting the first and second QKCAs;
sending the set R from the first QKCA to A over the second Q-link; and
A and B using the set R as a key to encrypt and send information over the TC-link.
2. A method of establishing a secure communication link between first and second users A and B in a quantum network (“Q-network”), comprising:
establishing a direct communication between A and B initially over only via a traditional communication link (TC-link);
establishing A and B to be in direct communication with respective first and second quantum key certification authorities (QKCAs) via respective first and second Q-links:
sending a set R of truly random bits from the second QKCA to B over the first Q-link;
sending the set R from the second QKCA to the first QKCA over a third Q-link connecting the first and second QKCAs;
sending the set R from the first QKCA to A over the second Q-link; and
A and B using the set R as a key to encrypt and send information over the TC-link.
3. The method of claim 2 , wherein A and the first and second QKCAs are separate.
4. The method of claim 3 , wherein B and the first and second QKCAs are separate.
5. The method of claim 2 , including:
at A, encrypting data D using set R as an encryption key to form encrypted data D* and transmitting D* over the TC-link directly to Bob; and
at B, receiving and decrypting encrypted data D* using set R as a decryption key to recover data D.
6. The method of claim 2 , wherein the second QKCA includes a session manager and a true random number generator that operates to generate the set R.
7. The method of claim 2 , further comprising A and B using set R as an authentication key to securely communicate over the TC-link.
8. The method of claim 2 , further comprising:
establishing a Q-link directly between A and B; and
authenticating the Q-link using the set R.