Quantum key distribution
Methods and apparatus for quantum key distribution are described, in particular including methods and networks 300 arranged to improve and/or ensure the security of data transmitted thereby by (i) ensuring a certain level of loss within at least part of the network, (ii) placing a penultimate and an endpoint nodes in situated in a secure second enclave, (iii) analyzing a transmitted bit stream to ensure that it does not provide an unacceptable amount of information about the key that may be generated therefrom, and/or (iv) varying the order in which bits are used to generate a key.
1. A method of quantum key distribution comprising a quantum exchange step and a subsequent key agreement step, wherein, in the quantum exchange step, a first quantum node and a second quantum node exchange a quantum signal over a first quantum link and wherein the first quantum node communicates with a control node such that the control node has information regarding the quantum signal exchanged in the quantum exchange step, and the control node takes the place of the first quantum node in the key agreement step, the method further comprising determining a bit loss factor corresponding to the ratio between bits exchanged in the quantum signal and the number of bits used, or to be used, in the key agreement step, maintaining a certain level of loss in communications involving any of the first quantum node, the second quantum node and the control node, determining if the bit loss factor meets predetermined security requirements and, if the predetermined security requirements are not met, enhancing the security of the network by at least one of the following: increasing the bit loss factor, hashing the bits used in establishing a key, using an alternative or additional hashing function to increase the bit reduction in hashing, increasing the rate at which keys are replaced, sending portions of random strings for determining keys along different paths, in which the bit loss factor meets predetermined security requirements if the number of possible bit combinations used in key generation exceeds the number of possible keys which may be established in use of the network.
2. A method according to claim 1 which further comprises determining if the bit loss factor meets predetermined security requirements and, if the predetermined requirements are not met, enhancing the security of the network by further providing a plurality of paths through the network.
3. A method according to claim 1 in which the bit loss factor is increased by increasing losses between nodes and/or selecting the efficiency of a node or a component of the network.
4. A quantum key distribution network comprising a control QKD device linked in series via at least two one intermediate QKD devices with an endpoint QKD device, wherein each QKD device has at least one quantum transmitter and/or receiver arranged to exchange a quantum signal with an adjacent QKD device in a quantum exchange step, each intermediate QKD device comprising a communication unit for communicating information regarding the quantum signal exchanged with the adjacent QKD device with a communication unit at the control QKD device and the control QKD device is arranged to agree, in a key agreement step, a quantum key with each QKD device in the series in sequence, wherein the network further comprises a security monitor arranged to determine a bit loss factor corresponding to the ratio between bits exchanged in the quantum signal in at least one quantum exchange step and the number of bits used or to be used in an associated key agreement step, and to determine if the bit loss factor meets predetermined security requirements and, if the predetermined security requirements are not met, to enhance the security of the network by at least one of the following: increasing the bit loss factor, hashing the bits used in establishing a key, increasing the rate at which keys are replaced, sending portions of random strings for determining keys along different paths, and wherein the network is adapted such that a certain level of loss is maintained in communications involving any of the quantum key distribution device, in which the bit loss factor meets predetermined security requirements if the number of possible bit combinations used in key generation exceeds the number of possible keys which may be established in use of the network.
5. A network according to claim 4 in which the security monitor is arranged to determine if the bit loss factor meets predetermined security requirements and, if the predetermined requirements are not met, enhance the security of the network by further providing a plurality of paths through the network.