Secure optical communication link
This disclosure relates to secure optical communication links. In particular, this disclosure relates to data storage devices, random access memories, host interfaces, and network layers that comprise a secure optical communication link. A data storage device comprises an optical data port to connect to an optical communication link external to the data storage device and a non-volatile storage medium to store user content data received over the optical communication link. A controller controls access to the user content data stored on the non-volatile storage medium. A cryptography engine uses a cryptographic key to perform cryptographic operations on data sent and received through the optical data port. An optical key distribution device coupled to the optical data port performs quantum key distribution over the optical communication link to provide the cryptographic key to the cryptography engine.
1. A data storage device comprising:
an optical data port configured to connect to an optical communication link external to the data storage device;
a non-volatile storage medium configured to store user content data received over the optical communication link;
a cryptography engine configured to use a cryptographic key to perform cryptographic operations comprising encrypting and decrypting data sent and received through the optical data port;
an optical key distribution device coupled to the optical data port and configured to perform quantum key distribution over the optical communication link; and
a controller configured to:
perform a protocol stack for managing storage commands received as digital data through the optical communication link to a host;
execute operations for quantum key distribution using digital data messages at a top layer of the protocol stack, wherein the operations for quantum key distribution include receiving a discovery message from the host indicating key exchange capability; and
initiate, responsive to receiving the discovery message and using the optical key distribution device, quantum key distribution through a physical layer of the optical communication link to the host, wherein:
the cryptography engine is further configured to receive the cryptographic key based on the quantum key distribution; and
initiating quantum key distribution includes switching the optical key distribution device to use the physical layer of the optical communication link to transmit quantum information for determining the cryptographic key.
2. The data storage device of claim 1 , wherein the protocol stack is a remote direct memory access protocol stack for receiving commands to read the user content data from the non-volatile storage medium and write the user content data to the non-volatile storage medium.
3. The data storage device of claim 1 , wherein the operations for quantum key distribution comprise features for key negotiation by exchanging digital data messages at the top layer of the protocol stack to use quantum information exchanged at the physical layer of the optical communication link.
4. The data storage device of claim 1 , wherein the optical key distribution device is manufactured as an integrated silicon device.
5. The data storage device of claim 1 , wherein the optical key distribution device comprises a Mach-Zehnder modulator with interleaved grating couplers.
6. The data storage device of claim 1 , wherein the optical key distribution device is further configured to perform quantum key distribution based on a polarization of a photon.
7. The data storage device of claim 6 , wherein the optical key distribution device is further configured to convert the polarization of the photon in the optical communication link into a path the photon takes in an integrated circuit.
8. The data storage device of claim 1 , wherein the optical key distribution device is further configured to perform quantum key distribution based on coherent states.
9. A method for communicating data stored on a data storage device, the method comprising:
performing a protocol stack for managing storage commands received from a host as digital data through an optical communication link external to the data storage device;
receiving, by the data storage device and using digital data messages at a top layer of the protocol stack for the optical communication link, a discovery message for a quantum key exchange capability;
in response to receiving the discovery message:
switching an optical key distribution device in the data storage device to use a physical layer of the optical communication link to transmit quantum information for determining a cryptographic key; and
performing, using the optical key distribution device, quantum key distribution over the physical layer of the optical communication link to generate the cryptographic key at the data storage device; and
performing cryptographic functions comprising encrypting and decrypting data using the cryptographic key to secure digital data transmitted over the optical communication link.
10. The method of claim 9 , wherein performing the cryptographic functions comprises encrypting and decrypting user content data stored on non-volatile memory.
11. The method of claim 9 , wherein performing the cryptographic functions comprises encrypting and decrypting communications over the optical communication link.
12. The method of claim 9 , wherein performing quantum key distribution comprises:
encoding quantum information onto a photon; and
transmitting the photon over the optical communication link.
13. The method of claim 12 , wherein performing quantum key distribution comprises sending classical digital data over the optical communication link, the classical digital data being indicative in relation to the encoded quantum information.
14. A data storage device comprising:
an optical data port configured to connect to an optical communication link external to the data storage device;
a non-volatile storage medium configured to store user content data received over the optical communication link;
a cryptography engine configured to use a cryptographic key to perform cryptographic operations comprising encrypting and decrypting data sent and received through the optical data port;
an optical key distribution device coupled to the optical data port and configured to perform quantum key distribution over the optical communication link;
means for performing a protocol stack for managing storage commands received from a host as digital data through the optical communication link;
means for receiving, by the data storage device and using digital data messages at a top layer of the protocol stack for the optical communication link, a discovery message for a key exchange capability;
means for performing, in response to receiving the discovery message and using the optical key distribution device, quantum key distribution over a physical layer of the optical communication link to generate a cryptographic key at the data storage device, wherein the means for performing is configured to switch the optical key distribution device to use the physical layer of the optical communication link to transmit quantum information for determining the cryptographic key; and
means for performing cryptographic functions using the cryptographic key to secure digital data transmitted over the optical communication link.
15. A random access memory module comprising:
an optical data port configured to connect to an optical communication link external to the random access memory module;
a volatile random access memory configured to store user content data received over the optical communication link;
a cryptography engine configured to use a cryptographic key to perform cryptographic operations comprising encrypting and decrypting data sent and received through the optical data port;
an optical key distribution device coupled to the optical data port and configured to perform quantum key distribution over the optical communication link; and
a controller configured to:
perform a protocol stack for managing memory commands received as digital data through the optical communication link to a memory controller;
execute operations for quantum key distribution using digital data messages at a top layer of the protocol stack, wherein the operations for quantum key distribution include receiving a discovery message from a host indicating key exchange capability; and
initiate, responsive to receiving the discovery message and using the optical key distribution device, quantum key distribution through a physical layer of the optical communication link to the memory controller, wherein:
the cryptography engine is further configured to receive the cryptographic key based on the quantum key distribution; and
initiating quantum key distribution includes switching the optical key distribution device to use the physical layer of the optical communication link to transmit quantum information for determining the cryptographic key.
16. A host interface to provide communication between a host computer and a memory device, the host interface comprising:
an optical data port configured to connect to the memory device over an optical communication link external to the host interface;
a cryptography engine configured to use a cryptographic key to perform cryptographic operations comprising encrypting and decrypting data sent and received through the optical data port;
an optical key distribution device coupled to the optical data port and configured to perform quantum key distribution over the optical communication link; and
a controller configured to:
perform a protocol stack for managing memory commands received as digital data through the optical communication link to the memory device;
execute operations for quantum key distribution using digital data messages at a top layer of the protocol stack, wherein the operations for quantum key distribution include receiving a discovery message from the host computer indicating key exchange capability; and
initiate, responsive to receiving the discovery message and using the optical key distribution device, quantum key distribution through a physical layer of the optical communication link to the memory device, wherein:
the cryptography engine is further configured to receive the cryptographic key based on the quantum key distribution; and
initiating quantum key distribution includes switching the optical key distribution device to use the physical layer of the optical communication link to transmit quantum information for determining the cryptographic key.
17. A method for operating interconnected data storage devices, the method comprising:
performing a protocol stack for managing storage commands communicated as digital data through an optical communication link between and external to the interconnected data storage devices;
determining, using digital data messages at a top layer of the protocol stack, whether key distribution capabilities are present at one of the interconnected data storage devices;
in response to determining that the key distribution capabilities are present at one of the interconnected data storage devices:
switching an optical key distribution device in the interconnected data storage devices to use a physical layer of the optical communication link to transmit quantum information for determining a cryptographic key; and
performing, using the optical key distribution device, quantum key distribution over the physical layer of the optical communication link to generate a cryptographic key pair comprising a first key stored at one of the interconnected data storage devices and a second key stored at another of the interconnected data storage devices, wherein the optical key distribution device uses the physical layer of the optical communication link to transmit quantum information for generating the cryptographic key pair; and
performing cryptographic functions comprising encrypting and decrypting data sent over the optical communication link using the cryptographic key pair to secure digital data transmitted over the optical communication link.
18. The method of claim 17 , wherein performing quantum key distribution comprises transmitting a photon with quantum information encoded thereon over the optical communication link.
19. The method of claim 18 , wherein performing quantum key distribution comprises transmitting classical, digital data relating to the quantum information encoded on the photon.