Key establishment and secure communications based on satellite-connected entropy sources
Systems and techniques for secure communications and distribution of random values, provided via satellite communications, are described. These random values are generated from one or more ground-based entropy sources (e.g., quantum random number generators (QRNGs) at terrestrial locations), and optionally combined with values from satellite-based entropy sources (e.g., QRNGs at non-terrestrial locations). An example method includes: receiving a first random value generated by a first QRNG at a terrestrial location; receiving a second random value and a third random value via at least one satellite communication, each additional random value generated by other QRNGs; and generating a cryptographic key based on the first random value, the second random value, and the third random value. The cryptographic key may be produced by a key derivation function that combines the random values, and the cryptographic key may be used to establish a secure communication session.
1 . A method performed by a computing system operating at a terrestrial location for generating a cryptographic key based on satellite-provided entropy values, the method comprising:
receiving a first random value, the first random value locally generated by a first quantum random number generator at the terrestrial location;
receiving a second random value communicated by satellite via at least one satellite communication, the second random value remotely generated by a second quantum random number generator located at a first satellite;
receiving a third random value communicated by satellite via the at least one satellite communication, the third random value remotely generated by a third quantum random number generator located at a second terrestrial location, wherein the third random value is communicated from the second terrestrial location to the computing system at the terrestrial location via a satellite communication network, wherein the third quantum random number generator and the second quantum random number generator operate at different locations and the third random value is different from the second random value;
generating a cryptographic key based on the first random value that is locally generated, the second random value that is communicated by satellite, and the third random value that is communicated by satellite; and
establishing an encrypted communication session between the terrestrial location and the second terrestrial location based on use of the cryptographic key, wherein the cryptographic key is a symmetric key that is derived at the terrestrial location and the second terrestrial location based on the first random value, the second random value, and the third random value.
2 . The method of claim 1 , further comprising:
receiving at least one additional random value via the at least one satellite communication;
wherein generating the cryptographic key is further based on the at least one additional random value.
3 . The method of claim 1 , wherein generating the cryptographic key includes:
performing a key derivation function based on the first random value, the second random value, and the third random value.
4 . The method of claim 3 , wherein the key derivation function is performed on a result of a Boolean function that provides a combination of the first random value, the second random value, and the third random value.
5 . The method of claim 1 , wherein the encrypted communication session provides data associated with at least one financial transaction.
6 . The method of claim 1 , wherein the at least one satellite communication is conducted with at least one low earth orbit (LEO) satellite, and wherein the terrestrial location comprises a ground station used for communication with the at least one LEO satellite or a computer system associated with the ground station.
7 . The method of claim 6 , wherein generating the cryptographic key is based on key generation parameters provided from the at least one LEO satellite, and wherein the key generation parameters are determined by the at least one LEO satellite or another terrestrial location.
8 . A non-transitory machine-readable medium comprising instructions, which when executed by a machine operating at a terrestrial location, cause the machine to:
identify a first random value, the first random value locally generated by a first quantum random number generator at the terrestrial location;
identify a second random value received by satellite via at least one satellite communication, the second random value remotely generated by a second quantum random number generator located at a first satellite;
receiving a third random value by satellite via the at least one satellite communication, the third random value remotely generated by a third quantum random number generator located at a second terrestrial location, wherein the third random value is communicated from the second terrestrial location to the machine at the terrestrial location via a satellite communication network, wherein the third quantum random number generator and the second quantum random number generator operate at different locations and the third random value is different from the second random value;
generate a cryptographic key based on the first random value that is locally generated, the second random value that is communicated by satellite, and the third random value that is communicated by satellite; and
establish an encrypted communication session between the terrestrial location and the second terrestrial location based on use of the cryptographic key, wherein the cryptographic key is a symmetric key that is derived at the terrestrial location and the second terrestrial location based on the first random value, the second random value, and the third random value.
9 . The machine-readable medium of claim 8 , wherein the instructions, which when executed by the machine, cause the machine to:
identify at least one additional random value received via the at least one satellite communication;
wherein to generate the cryptographic key is further based on the at least one additional random value.
10 . The machine-readable medium of claim 8 , wherein to generate the cryptographic key includes to:
perform a key derivation function based on the first random value, the second random value, and the third random value.
11 . The machine-readable medium of claim 10 , wherein the key derivation function is performed on a result of a Boolean function that provides a combination of the first random value, the second random value, and the third random value.
12 . The machine-readable medium of claim 8 , wherein the encrypted communication session provides data associated with at least one financial transaction.
13 . The machine-readable medium of claim 8 , wherein the at least one satellite communication is conducted with at least one low earth orbit (LEO) satellite, and wherein the terrestrial location comprises a ground station used for communication with the at least one LEO satellite or a computer system associated with the ground station.
14 . The machine-readable medium of claim 13 , wherein to generate the cryptographic key is based on key generation parameters provided from the at least one LEO satellite, and wherein the key generation parameters are determined by the at least one LEO satellite or another terrestrial location.