Site-to-site tunnel authentication by quantum keys
A framework for authenticating firewall and encryption devices (FEDs) as endpoints of a secure tunnel using quantum-based secrets keys are provided. The secure tunnel is between two network sites. A quantum key distribution (QKD) subsystem is collocated, in part, with a first network site in another part, with a second network site. The QKD subsystem generates and shares at least one quantum-based secret key with respective key hosts in the first network site and second network site. Each FED obtains the same quantum-based secret key from the respective key host and authenticate each other as endpoints of the secure tunnel to be established between the first network site and the second network site through the public network. The authentication may be repeated.
1 . A system for establishing an Internet Protocol Security (IPsec) tunnel through a public network, the system comprising:
a first network site comprising a first firewall and encryption device (FED) and a first key host communicatively coupled with the first FED through a first secure subnetwork;
a second network site comprising a second FED and a second key host communicatively coupled with the second FED through a second secure subnetwork; and
a quantum key distribution (QKD) subsystem collocated, in part, with the first network site and communicatively coupled with the first key host through the first secure subnetwork and, in another part, with the second network site and communicatively coupled with the second key host through the second secure subnetwork, the QKD subsystem configured to:
produce at least one quantum-based secret key; and
share the at least one quantum-based secret key with the first key host and the second key host,
wherein the first and second FEDs are configured to:
obtain a same quantum-based secret key from their respective key hosts;
authenticate each other as endpoints of the IPsec tunnel to be established between the first network site and the second network site through the public network, the authenticating being based on the obtained same quantum-based secret key;
establish the IPsec tunnel having the first FED and the second FED as authenticated endpoints by setting up security associations;
carry out encrypted network traffic between the first network site and the second network site through the established IPsec tunnel based on the security associations; and
repeatedly reauthenticate each other as the endpoints of the IPsec tunnel based on new quantum-based secret keys obtained from their respective key hosts.
2 . The system of claim 1 , wherein
the first key host is connected to a first physical port of the first FED through a first ethernet cable,
the second key host is connected to a first physical port of the second FED through a second ethernet cable, and
the IPsec tunnel is formed between a second physical port of the first FED and a second physical port of the second FED, the first physical port being different from the second physical port.
3 . The system of claim 1 , wherein the first FED and the second FED are configured to reauthenticate each other as the endpoints of the IPsec tunnel on a periodic basis.
4 . The system of claim 1 , further comprising a means for synchronizing a timing at the first key host and the second key host or the first FED and the second FED.
5 . The system of claim 1 , wherein the first key host and the second key host are configured to communicate with the respective parts of the QKD subsystem through an application programming interface.
6 . The system of claim 1 , wherein the first FED and the first key host are connected via a secure shell (SSH) connection and the second FED and the second key host are connected via another SSH connection.
7 . The system of claim 1 , wherein the parts of the QKD subsystem collocated at the respective first and second network sites are connected to each other through a dedicated single-mode optical fiber.
8 . The system of claim 1 , wherein the QKD subsystem is configured to
repeatedly produce at least one additional quantum-based secret key, and
share the at least one additional quantum-based secret key with the first key host and the second key host.
9 . The system of claim 2 , wherein network traffic is transmitted between a first secure network and a second secure network, wherein the first secure network comprises a first router, the first router is connected to a third physical port of the first FED, and the second secure network comprises a second router, the second router is connected to a third physical port of the second FED, the third physical port being different from the first physical port and the second physical port.
10 . The system of claim 9 , wherein the first FED is configured for different security zones including a first security zone and a second security zone, the first security zone comprising devices connected to the third physical port and the second security zone comprising devices connected to the first physical port, and wherein the second FED is configured for different security zones including a first security zone and a second security zone, the first security zone comprising devices connected to the third physical port and the second security zone comprising devices connected to the first physical port.
11 . The system of claim 10 , where the different security zones further comprise a third security zone comprising the IPsec tunnel.
12 . The system of claim 1 , wherein encrypted network traffic is exchanged while the endpoints of the IPsec tunnel are reauthenticated.
13 . The system of claim 1 , wherein each quantum-based secret key has a unique identifier, wherein the same quantum-based secret key is determined using the unique identifier.
14 . The system of claim 3 , wherein a repetition time for the periodic basis is defined via a user interface.
15 . The system of claim 14 , wherein the repetition time is a multiple of a time for authenticating the endpoints.
16 . The system of claim 1 , wherein the first network site and the second network site are different locations of a same company.
17 . The system of claim 1 , wherein the first network site and the second network site are different locations of sensor networks or data centers.
18 . The system of claim 1 , wherein the first key host communicates with the first FED with an application program interface and the second key host communicates with the second FED with an application program interface.
19 . The system of claim 4 , wherein the first key host and the second key host simultaneously pushes the same quantum-based secret key to the first FED and the second FED, respectively.
20 . The system of claim 1 , wherein the first key host and the second key host are configured to mark each quantum-based secret key as being used in a memory once the quantum-based secret key is obtained and restrict the quantum-based secret key from being reused.