Key management device, quantum cryptography communication system, and computer program product
A key management device according to an embodiment is a key management device managing an application key for encrypting a communication in an application network including a plurality of applications. The key management device includes a hardware processor configured to function as a collection unit, a calculation unit, a determination unit, and a communication unit. The collection unit collects, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated. The calculation unit calculates metric for a key relay route including the link on the basis of the resource information. The determination unit determines a key relay route from among a plurality of key relay routes on the basis of the metric. The communication unit uses the key relay route determined by the determination unit to send, to a destination, an application key encrypted with the link key.
1. A key management device managing an application key for encrypting a communication in an application network including a plurality of applications, the key management device comprising:
one or more hardware processors configured to:
collect, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated;
calculate metric for a key relay route including the link on a basis of the resource information;
determine a key relay route from among a plurality of key relay routes on a basis of the metric; and
use the key relay route determined to send, to a destination, an application key encrypted with the link key,
wherein
the resource information includes at least one of a generation speed for the link key in the link and an amount of the link key held in the link, and
the one or more hardware processors:
calculate first metric based on a bottleneck of resource information on a plurality of links included in the key relay route, the bottleneck being determined based on costs of the plurality of links, the costs each being one of a generation speed for the link key of corresponding one of the plurality of links, an amount of the link key held in the corresponding one of the plurality of links, and a weighted sum of the generation speed for the link key and the amount of the link key; and
determine the key relay route using the first metric as the metric.
2. The key management device according to claim 1 , wherein
the one or more hardware processors further calculate a number of hops on the key relay route, and calculates the metric further on a basis of the number of hops.
3. The key management device according to claim 2 , wherein
the one or more hardware processors calculate second metric inversely proportional to the number of hops, and
in a case where there is a plurality of the key relay routes having the first metric common to each other, the one or more hardware processors determine a key relay route further on a basis of the second metric.
4. The key management device according to claim 2 , wherein
the one or more hardware processors calculate and second metric inversely proportional to the number of hops, and
in a case where there is a plurality of the key relay routes having the second metric common to each other, the one or more hardware processors determine a key relay route further on a basis of the first metric.
5. The key management device according to claim 1 , wherein
the one or more hardware processors further collect state information indicating a state of the link,
calculate state information on the key relay route on a basis of state information on a link included in the key relay route, and
determine on a basis of the metric, a key relay route from among key relay routes having state information on the key relay route smaller than a threshold, and determines a key relay route having state information on the key relay route equal to or greater than the threshold as an anomaly route.
6. The key management device according to claim 5 , wherein
state information on the link is a quantum bit error rate (QBER) of the link.
7. The key management device according to claim 1 , wherein
the key management device belongs to any of a plurality of domains included in a QKD network,
the key management device further comprises:
an internal information memory configured to store therein internal information indicating information on a domain to which the key management device belongs, and
an external information memory configured to store therein external information indicating information on a domain to which the key management device does not belong,
the internal information includes at least the resource information on a link included in the domain to which the key management device belongs, and
the external information includes at least the resource information on a link included in the domain to which the key management device does not belong.
8. The key management device according to claim 7 , wherein
the one or more hardware processors collect the resource information stored in the internal information memory of another key management device belonging to the QKD network, and
the external information memory stores therein the resource information stored in the internal information memory of the another key management device.
9. A quantum cryptography communication system including a plurality of key management devices, wherein
the plurality of key management devices manages an application key for encrypting a communication in an application network including a plurality of applications, and
the key management device comprises:
one or more hardware processors configured to:
collect, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated,
calculate metric for a key relay route including the link on a basis of the resource information,
determine a key relay route from among a plurality of key relay routes on a basis of the metric, and
use the key relay route determined to send, to a destination, an application key encrypted with the link key,
the resource information includes at least one of a generation speed for the link key in the link and an amount of the link key held in the link, and
the one or more hardware processors:
calculate metric based on a bottleneck of resource information on a plurality of links included in the key relay route, the bottleneck being determined based on costs of the plurality of links, the costs each being one of a generation speed for the link key of corresponding one of the plurality of links, an amount of the link key held in the corresponding one of the plurality of links, and a weighted sum of the generation speed for the link key and the amount of the link key; and
determine the key relay route using the first metric as the metric.
10. The quantum cryptography communication system according to claim 9 , wherein
the key management device belongs to any of a plurality of domains included in a QKD network,
the one or more hardware processors of the key management device further configured to:
store therein internal information indicating information on a domain to which the key management device belongs, and
store therein external information indicating information on a domain to which the key management device does not belong,
the internal information includes at least the resource information on a link included in the domain to which the key management device belongs, and
the external information includes at least the resource information on a link included in the domain to which the key management device does not belong.
11. A computer program product comprising a non-transitory computer-readable medium including programmed instructions stored therein, the instructions causing a computer for managing an application key for encrypting a communication in an application network including a plurality of applications, to as:
collect, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated;
calculate metric for a key relay route including the link on a basis of the resource information;
determine a key relay route from among a plurality of key relay routes on a basis of the metric; and
use the key relay route determined to send, to a destination, an application key encrypted with the link key,
the resource information includes at least one of a generation speed for the link key in the link and an amount of the link key held in the link, and
the instructions cause the computer to:
calculate metric based on a bottleneck of resource information on a plurality of links included in the key relay route, the bottleneck being determined based on costs of the plurality of links, the costs each being one of a generation speed for the link key of corresponding one of the plurality of links, an amount of the link key held in the corresponding one of the plurality of links, and a weighted sum of the generation speed for the link key and the amount of the link key; and
determine the key relay route using the first metric as the metric.
12. A key management method for managing an application key for encrypting a communication in an application network including a plurality of applications, the method comprising:
collecting, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated;
calculating metric for a key relay route including the link on a basis of the resource information;
determining a key relay route from among a plurality of key relay routes on a basis of the metric; and
using the key relay route determined to send, to a destination, an application key encrypted with the link key,
wherein
the resource information includes at least one of a generation speed for the link key in the link and an amount of the link key held in the link, and
first metric is calculated based on a bottleneck of resource information on a plurality of links included in the key relay route, the bottleneck being determined based on costs of the plurality of links, the costs each being one of a generation speed for the link key of corresponding one of the plurality of links, an amount of the link key held in the corresponding one of the plurality of links, and a weighted sum of the generation speed for the link key and the amount of the link key; and
the key relay route is determined using the first metric as the metric.