Quantum network and a quantum authentication server
A server configured to provide a pre-shared key “PSK” with a first user node, to allow a first user node and a second user node to share a PSK, the server comprising: a network interface; an authentication unit; an encryption unit; a key management system and a quantum key distribution unit, the authentication unit being configured to receive a request for authentication, via the network interface, of a first channel between a first user node and the server, the quantum key distribution unit being configured to allow a quantum key to be distributed between the first user node and the server, the quantum key being sifted using communication over the authenticated first channel to establish a first quantum key for the first user and server, the key management system being configured to provide a first PSK for the first user to allow the first user to authenticate with the second user, the encryption unit being configured to encrypt the first PSK with the quantum key to send to the first user node via the network interface.
1 . A server configured to provide a pre-shared key (PSK) with a first user node and a second user node, to allow the first user node and the second user node to share the PSK, the server comprising processing circuitry configured to:
receive a request for authentication of a first channel between the first user node and the server;
allow a quantum key to be distributed between the first user node and the server by performing quantum key distribution between the first user node and the server, the quantum key being sifted using communication over the first channel to establish a first quantum key between the first user node and the server;
provide a first PSK for the first user node to allow the first user node to authenticate with the second user node;
encrypt the first PSK with the quantum key to send to the first user node;
send a request for authentication of a second channel between the second user node and the server;
allow a quantum key to be distributed between the second user node and the server by performing quantum key distribution between the second user node and the server, the quantum key being sifted using communication over the second channel to establish a second quantum key between the second user node and the server; and
encrypt the first PSK with the second quantum key to send to the second user node, wherein said server is configured to be arranged in a hierarchy with respect to a plurality of further servers, and said server is further configured to send a query to another server above it in the hierarchy when said server receives a request from a user node for a shared PSK which it cannot satisfy.
2 . The server of claim 1 , wherein the processing circuitry is further configured to generate the first PSK for sharing between the first and second user nodes.
3 . The server of claim 1 , wherein the first quantum key has a first length and the processing circuitry is further configured to distribute a key which is longer than the first length, the remainder of the key being saved as at least one PSK for further authentication between the server and the first user node.
4 . The server of claim 3 , wherein the server is further configured to discard a PSK after a single use.
5 . The server of claim 1 , wherein the processing circuitry is further configured to store information indicating whether two user nodes are allowed to share a PSK, the server being further configured to accept or decline a request from a user node for obtaining a shared key by referring to the information stored in the access control unit.
6 . The server of claim 1 , wherein the server is further configured to contact a further server to determine whether to accept or decline a request from a user node to obtain a shared key.
7 . The server of claim 1 , wherein the processing circuitry is further configured to provide information to control at least one of the quantum key length, a PSK key length and information to be sent with the PSK.
8 . The server of claim 1 , wherein the processing circuitry is further configured to:
encode information on light, wherein the information is encoded by randomly selecting one state from a plurality of states to send to said user node, the light leaving said server in pulses which contain on average less than one photon; and
receive light pulses which contain on average less than one photon and decode information from said light pulses by measuring said light pulses, wherein the measurement basis for the measurement are randomly selected from a set of measurement bases to allow measurement of the states used to encode the information,
allow the server to compare the basis it used for encoding or decoding with that used by the user node for decoding or encoding, and discard the information from pulses where the encoding basis and the decoding measurement basis did not match.
9 . A network comprising a first server, a plurality of user nodes and at least one switch, the at least one switch being configured to allow selective connection between any two of said user nodes and any of said nodes and the server, the first server being a server in accordance with claim 1 , wherein the network further comprises the plurality of further servers, and wherein the first server and the plurality of further servers are arranged in a hierarchy and the first server is configured to send a query to another server above it in the hierarchy when the first server receives a request from a user node for a shared PSK which it cannot satisfy.
10 . The network of claim 9 , further comprising two servers and wherein the first user node, in response to a request for a PSK to authenticate with a second user node comprises receiving a PSK from the two servers, the first node forming a combined PSK from the two servers, the second user node also deriving the combined PSK to allow the first node and the second node to authenticate.
11 . The network of claim 9 , wherein the at least one switch is located within at least one of a server or a user node.
12 . The network of claim 9 , wherein the user node comprises at least one selected from a file server or a quantum computer.
13 . The network of claim 9 , wherein the network comprises a plurality of sub networks and said sub networks are linked by communication channels.
14 . A method of sharing a pre-shared key (PSK) between a first node and a second node in a network, the network further comprising a first server and a plurality of further servers, the first server and the plurality of further servers being arranged in a hierarchy, the method comprising:
receiving a request from the first user node for obtaining a PSK shared between the first user node and the second user node;
sending a query to another server above the first server in the hierarchy when the first server cannot satisfy the request;
receiving a request for authentication of a first channel between the first user node and the first server;
allowing a quantum key to be distributed between the first user node and the first server by performing quantum key distribution between the first user node and the server, the quantum key being sifted using communication over the first channel to establish a first quantum key between the first user node and the first server;
providing a first PSK for the first user node to allow the first user node to authenticate with the second user node;
encrypting the first PSK with the quantum key to send to the first user node;
sending a request for authentication of a second channel between the second user node and the first server;
allowing a quantum key to be distributed between the second user node and the first server by performing quantum key distribution between the second user node and the first server, the quantum key being sifted using communication over the second channel to establish a second quantum key between the second user node and the first server; and
encrypting the first PSK with the second quantum key to send to the second user node.
15 . The method of claim 14 , wherein, by performing quantum key distribution, a key is distributed between the first user node and the first server that is longer than a first length to establish a first quantum key having the first length, and wherein the method further comprises saving the remainder of the key as at least one PSK for further authentication between the first server and the first user node.