Quantum network and authentication method
A method for use in a quantum communication network comprising a first node, a second node and a third node, the method performed by the third node, the method comprising: receiving, from the first node, a request for authentication key data for authenticating communication with the second node; in response to the request: generating the first authentication key data; sending, to the first node, a first message comprising first authentication key data for authenticating communication between the first node and the second node, wherein the first message is authenticated using second authentication key data stored on the first node and the third node, and wherein the first message is encrypted using a first cryptographic key exchanged with the first node on the quantum communication network; and sending, to the second node, a second message comprising the first authentication key data, wherein the second message is authenticated using third authentication key data stored on the second node and the third node, and wherein the second message is encrypted using a second cryptographic key exchanged with the second node on the quantum communication network.
1. A method for use in a quantum communication network comprising a first node, a second node and a third node, the method performed by the third node, the method comprising:
receiving, from the first node, a request for authentication key data for authenticating communication with the second node;
in response to the request:
generating the first authentication key data;
sending, to the first node, a first message comprising first authentication key data for authenticating communication between the first node and the second node, wherein the first message is authenticated using second authentication key data stored on the first node and the third node, and wherein the first message is encrypted using a first cryptographic key exchanged with the first node on the quantum communication network; and
sending, to the second node, a second message comprising the first authentication key data, wherein the second message is authenticated using third authentication key data stored on the second node and the third node, and wherein the second message is encrypted using a second cryptographic key exchanged with the second node on the quantum communication network.
2. The method of claim 1 , wherein the quantum communication network further comprises one or more trusted nodes, the method further comprising:
determining that authentication key data is not available for authenticating communication with the second node;
requesting, from the one or more trusted nodes, authentication key data for authenticating communication with the second node;
receiving, from a fourth node of the one or more trusted nodes, a third message comprising the third authentication key data, wherein the third message is authenticated using fourth authentication key data stored on the third node and the fourth node, and wherein the third message is encrypted using a third cryptographic key exchanged with the fourth node on the quantum communication network; and
storing the third authentication key data.
3. The method of claim 2 , wherein the request comprises one or more quality of service criteria, and wherein the one or more trusted nodes are selected from a plurality of trusted nodes based on the one or more quality of service criteria.
4. The method of claim 2 , wherein the first message comprises an indication that the identity of the second node was authenticated using the fourth node.
5. A method, for use in a quantum communication network comprising a first node, a second node and one or more trusted nodes, the method performed by the first node, the method comprising:
requesting, from the one or more trusted nodes, authentication key data for authenticating communication with the second node;
receiving, from a third node of the one or more trusted nodes, a first message comprising first authentication key data for authenticating communication with the second node, wherein the first message is authenticated using second authentication key data stored on the first node and the third node, and wherein the first message is encrypted using a first cryptographic key exchanged between the first node and the third node on the quantum communication network.
6. The method of claim 5 , further comprising:
receiving, from a fourth node of the one or more trusted nodes, a second message comprising third authentication key data for authenticating communication with the second node, wherein the second message is authenticated using fourth authentication key data stored on the first node and the fourth node, and wherein the second message is encrypted using a second cryptographic key exchanged between the first node and the fourth node on the quantum communication network; and
deriving, based on the first authentication key data and the third authentication key data, fifth authentication key data for authenticating communication with the second node.
7. The method of claim 6 , wherein deriving the fifth authentication key data comprises performing one or more bitwise operations on the first authentication key data and the third authentication key data.
8. The method of claim 7 , wherein the one or more bitwise operations comprise an XOR operation.
9. The method of claim 5 , further comprising:
receiving an indication that the third node has been compromised; and
revoking the first authentication key data and/or authentication key data derived from the first authentication key data.
10. The method of claim 5 , wherein the first message comprises an indication that the third node of the one or more trusted nodes authenticated the identity of the second node using a fifth node other than the one or more trusted nodes.
11. The method of claim 10 , comprising:
receiving an indication that the fifth node has been compromised; and
revoking the first authentication key data and/or authentication data derived from the first authentication key data.
12. The method of claim 5 , wherein requesting, from the one or more trusted nodes, authentication key data for authenticating communication between the first node and the second node comprises:
requesting, from a first subset of the one or more trusted nodes, authentication key data for authenticating communication between the first node and the second node;
inferring that the first subset of the one or more trusted nodes is unable to provide the authentication key data; and
in response to the inference, requesting, from a second subset of the one or more trusted nodes, authentication key data for authenticating communication between the first node and the second node,
wherein the first subset of the one or more trusted nodes are nodes that satisfy a first criteria, and wherein the second subset of the one or more trusted nodes comprises the third node.
13. The method of claim 5 , wherein requesting, from the one or more trusted nodes, authentication key data for authenticating communication between the first node and the second node comprises:
querying the one or more trusted nodes to determine whether any of the one or more trusted nodes stores key authentication data for communicating with the second node;
inferring that none of the one or more trusted nodes stores key authentication data for communicating with the second node; and
querying the one or more trusted nodes to determine whether any of the one or more trusted nodes stores key authentication data for another node that stores key authentication data for communicating with the second node.
14. A first node for use in a quantum communication network comprising the first node, a second node and one or more trusted nodes, wherein the first node is configured to:
request, from the one or more trusted nodes, authentication key data for authenticating communication with the second node;
receive, from a third node of the one or more trusted nodes, a first message comprising first authentication key data for authenticating communication with the second node, wherein the first message is authenticated using second authentication key data stored on the first node and the third node, and wherein the first message is encrypted using a first cryptographic key exchanged with the third node on the quantum communication network.
15. The first node of claim 14 , wherein the first node is further configured to:
receive, from a fourth node of the one or more trusted nodes, an indication that a fifth node other than the one or more trusted nodes, wishes to initiate communication;
receive, from the fourth node, a second message comprising second authentication key data for authenticating communication with the fifth node, wherein the second message is authenticated using third authentication key data stored on the first node and the fourth node, and wherein the second message is encrypted using a second cryptographic key exchanged with the fourth node on the quantum communication network.
16. The first node of claim 15 , wherein the first node is further configured to:
receive, from a sixth node of the one or more trusted nodes, a third message comprising fourth authentication key data for authenticating communication with the fifth node, wherein the third message is authenticated using fifth authentication key data stored on the first node and the fifth node, and wherein the third message is encrypted using a third cryptographic key exchanged with the sixth node on the quantum communication network; and
derive, based on the second authentication key data and the fourth authentication key data stored, sixth authentication key data for authenticating communication with the sixth node.
17. The first node of claim 14 , wherein the first node is further configured to:
receive, from a seventh node of the one or more trusted nodes, a request for authentication key data for authenticating communication between the seventh node of the one or more trusted nodes and an eighth node;
send, to the seventh node, a fourth message comprising seventh authentication key data for authenticating communication between the seventh node and the eighth node, wherein the fourth message is authenticated using eighth authentication key data stored on the first node and the seventh node, and wherein the first message is encrypted using a fourth cryptographic key exchanged with the seventh node on the quantum communication network; and
sending, to the eighth node, a fifth message comprising the seventh authentication key data, wherein the fifth message is authenticated using ninth authentication key data stored on the first node and the eighth node, and wherein the fifth message is encrypted using a fifth cryptographic key exchanged with the eighth node on the quantum communication network.
18. The first node of claim 14 , wherein the first node is further configured to:
determining that authentication key data is not available for authenticating communication with the eighth node;
requesting, from the one or more trusted nodes, authentication key data for authenticating communication with the eighth node;
receiving, from a ninth node of the one or more trusted nodes, a sixth message comprising the ninth authentication key data, wherein the sixth message is authenticated using tenth authentication key data stored on the first node and the ninth node, and wherein the sixth message is encrypted using a sixth cryptographic key exchanged with the ninth node on the quantum communication network; and
storing the ninth authentication key data.
19. The first node of claim 18 , wherein the fifth message comprises an indication that the identity of the eighth node was authenticated using the ninth node.
20. A quantum communication network comprising the first node of claim 14 , a second node and one or more trusted nodes.