Multi-community network with quantum key distribution
This invention relates to an optical star network in which different communities of users, such as different businesses, are provided through use of quantum key distribution (QKD). At least one QKD device is located at the central hub of the star network and communicates with QKD devices at the endpoints to establish a separate quantum key, i.e. a cryptographic key established by QKD, with each endpoint. A separate key manager is provided for each different community and each key manager is arranged to use the appropriate quantum keys for endpoints within that community to deliver the same community key to each endpoint. This community key can be used by for encrypting network traffic between members of the same community with security. Traffic passing through the network switch is encrypted, but the community keys are not delivered via the switch and hence the switch an error in the switch does not compromise security.
1. A system to implement a switched optical star network having a plurality of distinct user communities, the network comprising:
a hub and a plurality of endpoints optically connected to the hub;
wherein the hub comprises a network switch and at least one quantum key distribution (QKD) device;
each endpoint comprises a QKD device in optical communication with a QKD device at the hub, so as to, in use, derive a quantum key for that endpoint;
the hub further comprises a separate key transmitter for each respective community, and each key transmitter is connected only to those endpoints which are within its respective community;
each key transmitter is arranged to transmit only to endpoints within its respective community and is arranged to transmit to each endpoint within its respective community a community key encrypted using the quantum key for the particular endpoint;
the hub mounted and endpoint QKD devices communicate on a quantum channel and a classical channel;
the quantum and classical channels are established as different wavelengths transmitted over the same medium;
the system to implement a switched optical star network further comprises a plurality of QKD devices at the hub; and
each QKD device located at the hub is arranged to only communicate with endpoints within a single community.
2. A system to implement a switched optical star network as claimed in claim 1 , wherein each key transmitter is arranged for downstream optical transmission with appropriate endpoints in its respective community.
3. A system to implement a switched optical star network as claimed in claim 1 , wherein each key transmitter is physically secure.
4. A system to implement a switched optical star network as claimed in claim 1 , wherein each hub mounted QKD device is physically secure.
5. A system to implement a switched optical star network as claimed in claim 1 , wherein each QKD device mounted at an endpoint comprises a quantum channel receiver and each QKD device mounted at the hub comprises a quantum channel transmitter.
6. A system to implement a switched optical star network as claimed in claim 1 , wherein each QKD device mounted at an endpoint comprises a quantum channel transmitter and each QKD device mounted at the hub comprises a quantum channel receiver.
7. A system to implement a switched optical star network as claimed in claim 1 , further comprising at least one passive optical switch connecting a plurality of endpoints to the network switch.
8. A system to implement a switched optical star network as claimed in claim 1 , wherein each key transmitter is arranged to conduct the classical communication part of the quantum key distribution with the endpoints in its respective community such that each key transmitter establishes the quantum keys with the endpoints in its respective community.
9. A system to implement a switched optical star network as claimed in claim 1 , comprising a QKD device located at the hub for each optical link at the hub.
10. A system to implement a switched optical star network as claimed in claim 1 , wherein each key transmitter comprises at least one classical communication apparatus arranged for downstream communication only.
11. A system to implement a switched optical star network as claimed in claim 10 , comprising a separate classical communication apparatus for each optical link.
12. A system to implement a switched optical star network as claimed in claim 1 , in which some or all of the classical communications involved in quantum key distribution, transmission of a community key and general network traffic are arranged to operate at different wavelengths.
13. An optical star network hub apparatus configured to provide multiple communities comprising:
an optical network switch having a plurality of optical links for optical communication to endpoints;
at least one quantum key distribution (QKD) device arranged to operate on said optical links and a separate key transmitter for each respective community;
each key transmitter being connected to a different subset of the optical links such that it is only connected to those endpoints which are within its respective community; and
each key transmitter being arranged to transmit a community key over said subset of optical links only to those endpoints which are within its respective community;
wherein the community key is encrypted using a quantum key derived for that link by the QKD device;
the hub mounted and endpoint QKD devices communicate on a quantum channel and a classical channel;
the quantum and classical channels are established as different wavelengths transmitted over the same medium;
the optical star network hub apparatus further comprises a plurality of QKD devices; and
each QKD device located at the hub is arranged to only communicate with endpoints within a single community.
14. A method of operating a switched optical star network to provide different communities wherein the network comprises a plurality of endpoints, each endpoint being optically connected to a hub comprising an optical network switch, the method comprising the steps of:
using quantum key distribution (QKD) between the hub and each endpoint to establish a quantum key for each endpoint;
transmitting to each endpoint in a first community, from a first key controller at the hub, a first community key encrypted with the relevant quantum key for that endpoint; and
transmitting to each endpoint in a second community, from a second key controller at the hub, a second community key encrypted with the relevant quantum key for that endpoint; wherein
the first key controller is connected only to those endpoints which are within the first community and the second key controller is connected only to those endpoints which are within the second community;
a plurality of hub mounted QKD devices and a plurality of endpoint QKD devices communicate on a quantum channel and a classical channel;
the quantum and classical channels are established as different wavelengths transmitted over the same medium; and
each QKD device located at the hub is arranged to only communicate with endpoints within a single community.