Key management device, quantum cryptography communication system, and computer program product
A key management device according to an embodiment includes one or more hardware processors configured to function as a determination unit, a generation unit, and a supply unit. The determination unit determines a type of request data requested by a request message transmitted from an application that performs encrypted data communication. The generation unit generates a response message including at least one of a random number and an encryption key shared by quantum key distribution (QKD) via a communication network according to a type of the request data. The supply unit supplies the response message to the application.
1. A key management device comprising:
one or more hardware processors configured to function as:
a determination unit configured to determine a type of request data requested by a request message transmitted from an application that performs encrypted data communication;
a generation unit configured to generate a response message including at least one of a random number and an encryption key shared by quantum key distribution (QKD) via a communication network according to the type of the request data; and
a supply unit configured to supply the response message to the application, wherein
the request message includes a parameter designating at least one of the encryption key and the random number as the type of the request data.
2. The key management device according to claim 1 , wherein
the communication network includes at least one of a QKD network that shares a first encryption key and a QKD link that shares a second encryption key, and
the generation unit generates a response message including at least one of the first encryption key shared via the QKD network, the second encryption key shared via the QKD link, and a random number according to a type of the request data.
3. The key management device according to claim 1 , wherein
the key management device is connected to a QKD module that is one of devices included in the communication network and
a random number generation module that generates the random number.
4. The key management device according to claim 1 , wherein the request message further includes a parameter designating a number of pieces of request data and a parameter designating a size of the request data, and the generation unit generates a response message including the request data having a size and the number designated by the request message.
5. The key management device according to claim 1 , wherein
the request message includes at least one of a method parameter designating an encryption method used by the application, a communication destination parameter designating a communication destination of the application, and a size parameter designating a data size, and
the generation unit generates a response message including at least one of an encryption key and a random number according to the method parameter in a case where the method parameter is included in the request message, generates a response message including at least one of an encryption key and a random number according to the communication destination parameter in a case where the communication destination parameter is included in the request message, and generates a response message including at least one of an encryption key used for an encryption process of data having a size designated by the size parameter and a random number used for an encryption process of data having a size designated by the size parameter in a case where the size parameter is included in the request message.
6. The key management device according to claim 1 , wherein
the generation unit generates the response message by describing the response message using a message format of a same format in a case where a type of data supplied in response to a request is an encryption key, in a case where a type of data supplied in response to a request is a random number, and in a case where types of data supplied in response to a request are both the encryption key and the random number.
7. The key management device according to claim 1 , wherein
when the request data is an encryption key, the determination unit determines whether an accumulation amount of encryption keys in the key management device is smaller than a first threshold value,
the one or more hardware processors of the key management device further function as:
a conversion unit configured to convert a random number into an encryption key when the accumulation amount of the encryption keys is smaller than the first threshold value, and
a communication unit configured to encrypt a converted encryption key indicating an encryption key converted from the random number using an encryption key shared by the QKD and transmit the encrypted converted encryption key to a device connected to an application on a reception side of the encrypted data communication, and
the generation unit generates a response message including the converted encryption key.
8. The key management device according to claim 7 , wherein
when the request data is the random number, the determination unit determines whether an accumulation amount of random numbers in the key management device is smaller than a second threshold value,
the conversion unit converts an encryption key into a random number in a case where the accumulation amount of the random numbers is smaller than the second threshold value,
the communication unit transmits communication for making a notification of non-use or deletion of the encryption key, that is converted into the random number, to a device sharing the encryption key converted into the random number, and
the generation unit generates a response message including a converted random number indicating a random number converted from an encryption key.
9. A quantum cryptography communication system comprising:
an encrypted data communication network in which a plurality of applications performs encrypted data communication;
a communication network in which a plurality of quantum key distribution (QKD) modules shares an encryption key by QKD; and
a plurality of key management devices connected to the plurality of QKD modules, wherein
the key management device comprises:
one or more hardware processors configured to function as:
a determination unit configured to determine a type of request data requested by a request message transmitted from an application,
a generation unit configured to generate a response message including at least one of the encryption key and a random number according to the type of the request data, and
a supply unit configured to supply the response message to the application, wherein
the request message includes a parameter designating at least one of the encryption key and the random number as the type of the request data.
10. A computer program product having a non-transitory computer readable medium including programmed instructions stored therein, wherein the instructions, when executed by a computer, cause the computer to function as:
a determination unit configured to determine a type of request data requested by a request message transmitted from an application that performs encrypted data communication;
a generation unit configured to generate a response message including at least one of a random number and an encryption key shared by quantum key distribution (QKD) via a communication network according to the type of the request data; and
a supply unit configured to supply the response message to the application, wherein
the request message includes a parameter designating at least one of the encryption key and the random number as the type of the request data.