Patent Description:
Quantum key distribution (QKD) relates to a secure communication process which implements a cryptographic protocol involving components of quantum mechanics. Quantum key distribution enables two parties to produce a shared random secret key only known to them wherein the shared random secret key can be used to encrypt and decrypt messages. The unique property of quantum key distribution (QKD) is the ability of the two communicating parties to detect the presence of a third party trying to gain knowledge of the secret key by eavesdropping. A third party trying to eavesdrop on the secret key must in some way measure it thus introducing detectable anomalies. The security of the encryption key that uses quantum key distribution (QKD) relies on the foundations of quantum mechanics, in contrast to traditional public key cryptography which relies on the computational difficulty of certain mathematical functions. Quantum key distribution (QKD) is used to produce and distribute a secret key but not to transmit message data. The distributed secret QKD key can then be used for any chosen encryption algorithm to encrypt and decrypt a message which can be sent and transmitted over a standard communication channel. Quantum key distribution (QKD) protocols provide means to distribute symmetric (identical) random bit streams as secure keys which are secure against any eavesdropper even when the eavesdropper has unbounded computational ability. The basic element of a QKD distribution network is a pair of QKD-modules linked by a QKD-link that allows two remote parties to share secure keys. However, a secure quantum channel linking two remote parties has a limited maximum range. Accordingly, a standard QKD-network requires multiple trusted nodes to relay encryption keys. For example, the Beijing-Shanghai QKD-link in China requires <NUM> trusted nodes to create a <NUM>,<NUM> connection. However, since each trusted node has to convert the QKD-key before passing it on, an eavesdropper at the node could potentially get access to the data at the key relay node without being detected. Furthermore, every trusted node used for a key relay has to be physically protected by hardware measures which increases the technical complexity of the key relay. So far, a key relay in a QKD-network can be done either using trusted key relay nodes which comprise measures of physical protection or using so-called quantum repeaters which are able to relay a quantum key in a quantum level. However, a trusted key relay node has a potential security risk whereas a quantum repeater currently is not available in practice.

<CIT> discloses a quantum key distribution method, a device, and a storage medium, to resolve a problem of low security when a quantum key is distributed between nodes.

Document "<NPL>, provides the help for design, deployment, and operation of key management of QKDN.

<CIT> discloses that a system transports a key between a first node at one end of a path through a quantum cryptographic key distribution (QKD) network to a second node at an opposite end of the path.

<CIT> discloses a method and a system for providing authentication of mutual strangers.

Accordingly, it is an object of the present invention to provide a method and system for performing a secure relay which does not require the provision of trusted nodes requiring physical protection against access by eavesdropping third parties.

This object is achieved by the present invention which provides a method for performing a secure key relay of an encryption key and a secure key relay system, as defined in the appended set of claims.

An advantage of the computer-implemented method of the present invention relies in that the intermediate relay nodes do not have to be trusted. Only the initial node and the terminal node have to comprise trusted nodes. Accordingly, even if any of the intermediate relay nodes is hacked, the computer-implemented method according to the present invention performing a secure key relay of an encryption key is still perfectly secure. Consequently, an impact caused by a security breach of any key relay node is significantly reduced. Consequently, the computer-implemented method according to the present invention provides for a much safer key relay between remote parties.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention the blinding values of the initial node and of each intermediate relay node are pre-distributed or are distributed using a secret sharing protocol.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention the blinding values of the initial node and of each intermediate relay node are distributed as shares to the other nodes by using a secret sharing protocol.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention the distributed blinding values of the initial node and of each of the intermediate relay nodes are reconstructed by the terminal node on the basis of the shares received by the terminal node.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention, the secret sharing protocol used to distribute the blinding values of the initial node and of the intermediate relay nodes comprises a Shamir secret sharing protocol.

In a further possible embodiment of the secure key relay method according to the first aspect of the present invention, the blinding value of each node used for blinding the encrypted shared QKD-keys comprises a unique random value.

This unique random value used as a blinding value is generated in a possible embodiment of the secure key relay method according to the first aspect of the present invention by a local random number generator of the respective node.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the shared QKD-keys are encrypted by performing an XOR-operation on the QKD-keys at the respective node. The shared QKD-keys can be OTP-encrypted.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention, the encrypted QKD-keys are blinded with the blinding value of the respective node by performing an XOR-operation on the encrypted QKD-keys and the respective blinding value of the node.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention, the encryption key is generated by a random number generator of the initial node connected to the encoding unit of the first data transceiver or by a random number generator of the first data transceicer or by a QKD connected to the initial node or by an external key generator connected to the initial node.

In a further possible embodiment of the secure key relay method according to the first aspect of the present invention, the encryption key is received by the encoding unit of the first data transceiver by means of a user interface or by means of a control data interface.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the encryption key is stored in a key memory along with a key identifier of the encryption key.

In a possible embodiment of the secure key relay method according to the first aspect of the present invention, the key identifier of the encryption key relayed from the initial node via the intermediate relay nodes to the terminal node is transported from the first data transceiver via the data transmission link to the second data transceiver.

The first and second data transceiver can comprise optical transceivers. In this embodiment, the data transmission link is formed by an optical data transmission link.

In an alternative embodiment, the first data transceiver and the second data transceiver comprise electronic transceivers connected to each other via an electrical data transmission link.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the encrypted cipher data is transported as payload within data packets transmitted by the first data transceiver via the optical or electrical data transmission link to the second data transceiver.

In a further possible embodiment of the secure key relay method according to the first aspect of the present invention, the key identifier of the encryption key is transported in overhead portions of the transported data packets.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the encryption key is used by the encryption unit of the first data transceiver for performing a symmetric key encryption, for instance [JC1] AES encryption, of the plain data or as a one-time pad key for a predefined amount of received plain data.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the initial node, the intermediate relay nodes and the terminal node comprise electrical or optical transceivers connected with each other via transport links used to transport the encrypted cipher keys and the shares of the blinding values between the transceivers.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the decoding unit of the second data transceiver which decodes the encrypted cipher data received via the data transport link from the first data transceiver uses the relayed encoding key provided by the terminal node as a decoding key, wherein the encoding key used by the decoding unit as the decoding key is identified by the key identifier currently received by the second data transceiver via the data transport link.

In a still further possible embodiment of the secure key relay method according to the first aspect of the present invention, the logic operations performed by the terminal node to provide the encryption key on the basis of the reconstructed or pre-distributed blinding values and the received encrypted cipher keys comprise XOR-operations.

The invention further provides according to a second aspect a secure key relay system used for relay of an encryption key comprising the features of claim <NUM>.

The invention provides according to the second aspect a secure key relay system used for relay of an encryption key, said secure key relay system comprising.

In a possible embodiment of the secure key relay system according to the second aspect of the present invention, the initial node and the terminal node and the at least one intermediate relay node comprise optical or electrical transceivers connected with each other by means of transport links used to transport the encrypted cipher keys and to transport the shares of the blinding values between the transceivers.

In a further possible embodiment of the secure key relay system according to the second aspect of the present invention, the initial node and the terminal node comprise trusted nodes of the secure key relay system.

In a still further possible embodiment of the secure key relay system according to the second aspect of the present invention, the initial node, the intermediate relay nodes and the terminal node are connected at least pairwise via secure quantum channels of a quantum key distribution network, QKDN.

In a further possible embodiment of the secure key relay system according to the second aspect of the present invention, the data transport link used for transport of the encrypted cipher data between the first and second data transceiver comprises an optical data transport link or an electrical data transport link.

<FIG> shows schematically a possible exemplary embodiment of a secure key relay system <NUM> according to the present invention used for relay of an encryption key Kenc. The secure key relay system <NUM> as illustrated in <FIG> can be used to perform a secure key relay of at least one encryption key Kenc provided by an initial node KN<NUM> to a terminal node KNN via intermediate key relay nodes KN<NUM>,KN<NUM>. The encryption key Kenc is provided by the initial node KN<NUM> and can be used by an encoding unit ENC of a first data transceiver TR-A for encoding or encrypting plain data Pdata to provide encrypted cipher data Cdata. The encoding unit ENC of the first data transceiver TR-A (Alice) is adapted to encode plain data Pdata using the encryption key Kenc received from a data source. The encoding unit ENC of the first data transceiver TR-A provides encrypted cipher data Cdata transported via a data transport link DTL to a decoding unit DEC of a second data transceiver TR-B which decodes the transported cipher data Cdata using the relayed encryption key Kenc provided by the terminal node KNN as a decoding key to retrieve the plain data Pdata. The retrieved plain data Pdata can be further processed by a subsequent processing unit. The relay of the encryption key Kenc from the initial node KN<NUM> to the terminal node KNN is performed by the intermediate relay nodes KN<NUM>,KN<NUM>. KNN-<NUM> as illustrated in <FIG>. The initial node KN<NUM>, the terminal node KNN and the at least one intermediate key relay node can comprise in a possible embodiment electrical or optical transceivers connected with each other by means of electrical or optical transport links used to transport the encrypted cipher keys CK and shares p of the blinding values Si between the transceivers. The number of intermediate key relay nodes KN used for relay of the encryption key Kenc can vary depending on the use case, in particular depending on the length of the optical or electrical data transport link DTL between the transceivers TR-A,TR-B.

The relay of the encryption key Kenc can be performed by the computer-implemented method as illustrated in the flowchart of <FIG>. In <FIG> a possible embodiment for a key encryption relay using secret sharing protocols is illustrated. Other techniques to encrypt or blind the communication between the intermediate nodes and the terminal node can be used in alternative embodiments.

In a first step S1, QKD-keys are shared between nodes via secure quantum channels QCH of a quantum key distribution network QKDN. As illustrated in <FIG>, the initial node KN<NUM>, the intermediate relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> as well as the terminal node KNN form a chain of nodes connected with each other via electrical transport links ETL as shown in <FIG>. Further, neighboring nodes are connected pairwise by secure quantum channels QCH of a quantum key distribution network QKDN. In the quantum layer, a pair of QKD-modules can generate a pair of symmetric (identical) random bit strings based on an QKD protocol. Each QKD-module can be installed in a node of the key relay node chain illustrated in <FIG>. Accordingly, at least two neighboring nodes within the key relay node chain shown in <FIG> can share QKD-keys via a secure quantum channel QCH as shown in <FIG>.

In a further step for performing the secure key relay of the encryption key Kenc, the encryption of shared QKD-keys at the initial node KN<NUM> and at each intermediate node is performed in step S2 and then they are blinded with a blinding value Si of the respective node to provide an encrypted cipher key by the initial node KN<NUM> and by each intermediate relay node KN<NUM>, KN<NUM>. Each node KNi can hold a so-called blinding value Si. The binding value Si of a node can be pre-distributed to the respective node or can be distributed to the node using a secret sharing protocol. Blinding comprises a technique to hide a secret key by performing an XOR-operation with a random value. Blinding forms a specific encryption technique. The blinding values Si of the different nodes can be distributed to the nodes by a secret sharing protocol SSS in such a way that an aggregation or a so-called sum of all blinding values Si can be calculated only at the terminal node KNN as also illustrated in <FIG>. The blinding values Si can in a possible embodiment be distributed to the key relay nodes by a secret sharing protocol SSS before a key relay is performed. In a possible embodiment, the secret sharing protocol SSS used to distribute the blinding values Si in step S3 is formed by a Shamir secret sharing (SSS) protocol. The distribution of the blinding values in step S3 is not necessary if the blinding values have already been pre-distributed. The secret sharing protocol SSS in general comprises an input or distribution phase and a reconstruction phase as also illustrated in <FIG>, <FIG>. The blinding values Si of the initial node KN<NUM> and of each intermediate key relay node KN<NUM>,KN<NUM>. KNN-<NUM> are distributed in step S3 as shares p to the other nodes by using a secret sharing protocol, in particular the Shamir secret sharing protocol SSS as shown schematically in <FIG>. The calculation of the shares p can be achieved by using a polynomial function f as illustrated in the example of <FIG>. In an alternative embodiment the blinding values Si can be pre-distributed to the nodes.

After having distributed the shares p using the secret sharing protocol SSS, in step S3 the encrypted cipher keys CKi of the initial node KN<NUM> and of each of the intermediate relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> are transmitted in step S4 to the terminal node KNN.

In a further step S5, the blinding values Si of the initial node KN<NUM> and each of the intermediate relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> can be reconstructed on the basis of the shares p received by the terminal node KNN. The reconstruction of the blinding values Si is illustrated in <FIG>. If the blinding values Si have been pre-distributed the reconstruction in step S5 is not required.

In a final step S6, logic operations are performed by the terminal node KNN on the reconstructed or pre-distributed blinding values Si on the basis of the encrypted cipher keys CKi received by the terminal node KNN from the initial node KN<NUM> and received from each of the intermediate relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> to provide the original encryption key Kenc used by the decoding unit DEC of the second data transceiver TR-B (Bob) as a decoding key to retrieve the plain data Pdata as also illustrated in <FIG>.

The computer-implemented method for performing a secure key relay of an encryption key Kenc comprises in a possible embodiment the main steps S1,S2,S4,S6 as illustrated in the flowchart of <FIG>. In <FIG> a possible embodiment for a key encryption relay is illustrated where a secret sharing protocol is used to distribute blinding values. Other techniques to encrypt or blind the communication between the initial node KN<NUM> /intermediate relay nodes KNi and the terminal node KNN can be used in alternative embodiments. Accordingly the steps S3, S5 illustrated in the flowchart of <FIG> form optional steps.

A first step S1 of sharing the QKD-keys is performed by a quantum key distribution network QKDN connected to the nodes of the secure key relay chain as shown in <FIG>.

A step S2 of performing an encryption of the shared QKD-keys and a step of distributing S3 the blinding values Si is performed by every key relay node of the key relay node chain shown in <FIG> with the exception of the terminal node KNN.

Accordingly, the present invention provides according to a further aspect a key relay node KN adapted to perform encryption of a shared QKD-key and adapted to blind an encryption key Kenc with a blinding value Si to provide an encrypted cipher key CKi which is transmitted by the respective key relay node KN to the terminal node KNN. The respective key relay node KN is further adapted to distribute shares p of its blinding value Si to the other key relay nodes KN within the key relay node chain using a secret sharing protocol.

The terminal node KNN is adapted to perform steps S5, S6 of the embodiment of the computer-implemented method as illustrated in the flowchart of <FIG>. The terminal node KNN is adapted to reconstruct the blinding values S of the initial node and of each of the intermediate key relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> on the shares p received from the other nodes. The terminal node is further adapted to perform logic bitwise operations on the reconstructed blinding values Si on the basis of the encrypted cipher keys CKi received by the terminal node KNN from the initial node KN<NUM> and from each of the intermediate key relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> to provide the original encryption key Kenc and to supply this encryption key to the decoding unit DEC of the second data transceiver TR-B. The decoding unit DEC uses the supplied key as a decryption key in a symmetrical decryption algorithm to retrieve the original plain data Pdata.

In a possible embodiment, the blinding value Si of each node used for blinding the encrypted shared QKD-keys K comprises a unique random value. This unique random value can be generated in a possible embodiment by a local random number generator RNG implemented in the respective node. The random number generator RNG may be implemented as a pseudo random number generator PRNG.

The QKD-keys K shared between the nodes via the secure quantum channels QCH in step S1 can be OTP-encrypted in step S2 in a possible embodiment by performing a bitwise XOR-operation on the shared QKD-keys K at the respective node. The OTP-encrypted QKD-keys can be blinded in step S2 with the blinding value Si of the respective node by performing also an XOR-operation on the OTP-encrypted QKD-keys and the respective blinding value Si of the respective node.

In a possible embodiment of the secure key relay system <NUM> as illustrated in <FIG>, the encryption key Kenc can be generated by a key generator of the initial node KN<NUM> being connected to the encoding unit ENC of the first data transceiver TR-A or by a QKD connected to the initial node. In an alternative embodiment, the encryption key Kenc can also be received from an external key generator connected to the initial node or by means of a user interface or by means of a control data interface.

The generated or received encryption key Kenc can be stored in a local key memory of the first data transceiver TR-A along with an associated unique key identifier KEY-ID of the respective encryption key Kenc. The key identifier KEY-ID of the encryption key Kenc is transported from the first data transceiver TR-A (Alice) via the data transmission link DTL to the second data transceiver TR-B (Bob). Along the same data transmission link DTL, the encrypted cipher data Cdata can be transported as payload within data packets DP. Each data packet DP can comprise an overhead OH and a payload section PL. The data packets DPs are transmitted by the first data transceiver TR-A via the data transmission link DTL to the second data transceiver TR-B. The data transmission link DTL can comprise in a preferred embodiment an optical data transmission link ODTL. In an alternative embodiment, the data transmission link DTL can also comprise a wired or wireless electronic data transmission link EDTL. The key identifier KEY-ID of the encryption key Kenc which is relayed from the initial node KN<NUM> via the intermediate key relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> to the terminal node KNN can be transported in a possible embodiment within an associated field of the overheads OH of the associated transport data packets DPs. The encryption key Kenc is used by the encoding unit ENC of the first data transceiver TR-A for performing a symmetric key encryption, for instance AES, of the plain data Pdata. The employed key encryption can comprise a symmetric key encryption. The symmetric encryption and decryption has the advantage that it can be performed at a high processing speed. The encryption key Kenc can be used as a one-time pad OTP for a predefined amount of the received plain data Pdata.

The plain data P can comprise any kind of data such as image data, audio data or text data used to carry information from the same or different data sources.

The encryption of the plain data P and the decryption of the encrypted payload data PL can be performed by the transceivers TR in real time. The key relay can be performed in parallel in real time during transport of the data packets DP via the data transport link DTL. In an alternative embodiment a key relay of a sequence or group of encryption keys can be performed in advance of the transport of the encrypted data payload PL within the data packets DPs. In this case the serial transmitted data packets DPs carry a corresponding sequence of associated key identifiers Key-IDs for the already relayed encryption keys.

The transport of the encrypted data via the data transport link DTL can be performed by means of data packets. In an alternative embodiment the transport of the encrypted data can be performed in a data stream.

The initial node KN<NUM>, the intermediate relay nodes KN<NUM>, KN<NUM>. KNN-<NUM> and the terminal node KNN comprise in a possible embodiment electrical transceivers connected with each other via electrical transport links which can be used to transport the encrypted cipher keys CKi as well as the shares p of the blinding values Si of the respective nodes between the electrical transceivers. In an alternative embodiment the initial node KN<NUM>, the intermediate relay nodes KN<NUM>,KN<NUM>. KNN-<NUM> and the terminal node KNN comprise optical transceivers connected with each other via optical transport links which can be used to transport the encrypted cipher keys CKi as well as the shares p of the blinding values Si of the respective nodes between the optical transceivers.

The decryption unit DEC of the second data transceiver TR-B (Bob) is adapted to decode , i.e. to decrypt, the encrypted cipher data Cdata received via the data transport link DTL from the first data transceiver TR-A using the relayed encoding key Kenc provided by the terminal node KNN as a decoding key. The key used by the decoding unit DEC as a decoding key is identified by the key identifier KEY-ID currently received by the second data transceiver TR-B via the data transport link DTL. This key identifier KEY-ID can be transported within a field of an overhead OH of the received data packets. In a possible embodiment, the logic operations performed in step S6 by the terminal node KNN to provide the encryption key Kenc used by the decoding unit DEC for decryption comprise XOR-operations performed on the basis of the reconstructed blinding values S and the received encrypted cipher keys CKi.

As can be seen in the block diagram of <FIG>, the initial node KN<NUM> as well as each intermediate key relay node KN<NUM>, KN<NUM>. KNN-<NUM> is adapted to perform an XOR-operation on a pair of shared QKD-keys and blinding them with an associated blinding value Si of the respective node to provide an encrypted cipher key CKi. For example, the initial node KN<NUM> performs an XOR-operation of the shared QKD-keys Kenc, K1 and blinds them with a blinding value S<NUM> to calculate an encrypted cipher key CK<NUM>. In the same manner, the first intermediate relay node KN<NUM> performs an XOR-operation of the shared QKD-keys K1, K2 and blinds them with a blinding value S<NUM> also performing an XOR-operation to provide an encrypted cipher key CK<NUM>. All these calculated encrypted cipher keys CKi are supplied by the initial node KN<NUM> and by each intermediate key relay node KN<NUM>, KN<NUM>. KNN-<NUM> to the terminal node KNN.

The blinding values S of the initial node KN<NUM> and of each intermediate key relay node KN<NUM>,KN<NUM>. KNN-<NUM> can be distributed as shares p to the other nodes by using a secret sharing protocol SSS as illustrated in <FIG>. First, a polynomial f(x) of degree n is generated where S<NUM> of the polynomial function f(x) = f(<NUM>) as also illustrated in <FIG>. In a further substep n+<NUM> shares p<NUM>,. pn are created such that pi=(xi,f(xi)) for i=<NUM>,. Finally, the created share pi is distributed to the key relay nodes KNi as shown schematically in <FIG>. The distribution of the shares p of the blinding values Si is performed by means of electrical transport links ETL connecting the initial node KN<NUM>, the terminal node KNN and the at least one intermediate key relay node KN<NUM>,KN<NUM>. There is a single initial node KN<NUM>, a single terminal node KNN and a predefined number of key relay nodes KN. Each node is adapted to share its blinding value Si with the other nodes by using a secret sharing protocol, in particular Shamir's secret sharing protocol SSS. Each nodes generates in a possible embodiment a random value and can convert the generated random value into n shares p using the secret sharing protocol SSS. Each share p is distributed to the other nodes one by one. The terminal node KNN is adapted to aggregate the n shares p received from the other nodes to calculate an aggregation share S of the blinding values Si. This is also illustrated in <FIG> illustrates a reconstruction phase using a secret sharing protocol SSS. The reconstruction is performed by the terminal node KNN on the basis of the received shares pi. In a first substep, the shares pi received from the other nodes KNi (i=<NUM>,. N-<NUM>) are collected by the terminal node KNN. The received and temporarily stored shares p<NUM>,. pn of the other nodes are reconstructed by the terminal node using the polynomial function f of degree n by Lagrange interpolation. From this, the blinding value Si for each node can be reconstructed or computed Si[JC2]=f(<NUM>). The terminal node KNN can then perform logic operations, in particular XOR-operations, on the reconstructed blinding values on the basis of the encrypted cipher keys CKi received by the terminal node KNN from the initial node KN<NUM> and received from each of the intermediate relay nodes KN<NUM>,KN<NUM>-KNN-<NUM> to provide the original encryption key Kenc which then can be used by the decoding unit DEC of the second data transceiver TR-B as the decoding key in a decryption process to retrieve the plain data Pdata.

The secure key relay system <NUM> according to the present invention can in a possible embodiment make use of a method of distributing and reconstructing blinding values Si involving a secret sharing protocol. This includes an input sharing phase as illustrated in the diagram of <FIG> and a reconstruction phase as illustrated in the diagram of <FIG>. At the input sharing phase as illustrated in <FIG>, each node generates a unique blinding value Si which can be converted into n shares p by a secret sharing technique. Then, these shares p are distributed to other n relay nodes one by one as shown in <FIG>.

In a reconstruction phase, the terminal node KNN aggregates the n shares p from the other nodes and reconstructs the original blinding value Si from each node by a secret sharing technique. This process can be repeated for every relay node. By this process, each blinding value Si is kept perfectly secure unless all nodes are hacked and their shares are revealed.

Besides the process of distributing and reconstructing blinding values Si by using a secret sharing protocol, the secure key relay system <NUM> also uses a process of hiding the QKD-key by performing an XOR-operation with a random value. Each key relay node generates a unique random value which forms a so-called blinding value S. The shared QKD-keys at each node are XORed with each other (OTP-encrypted) and can then in addition also undergo an XOR-operation with the associated blinding value (CKi = (Ki ⊕ Ki+<NUM> ⊕ Si)). Then, the outcome, i.e. the cipher key CKi, is sent to the trusted terminal node KNN. In this process, a security breach of a key relay node may reveal the shared QKD-keys K and the blinding value Si but does not reveal any information on other QKD keys K of other nodes since each node comprises different blinding values S. Hence, the encryption key Kenc which is relayed over the nodes is protected under all circumstances.

<FIG> shows a possible embodiment of a secure key relay system <NUM> according to the present invention. In the illustrated example, the secure key relay system <NUM> comprises a first data transceiver TR-A connected via a data transmission link DTL to a second data transceiver TR-B. In the illustrated embodiment, both transceivers TR-A, TR-B comprise optical transceivers connected via an optical data transmission link. Plain data Pdata can be encrypted by an encryption unit ENC of the first data transceiver TR-A to provide encrypted cipher data Cdata transported via the optical data transport link ODTL to a decoding unit DEC of the second data transceiver TR-B. The decoder DEC of the second transceiver TR-B uses a relayed encryption key Kenc provided by the connected terminal node TNN as a decoding key to retrieve in a decryption process the original plain data Pdata. In the illustrated example, the first and second transceiver TR-A, TR-B comprise an FSP3000 unit. In the illustrated examples of <FIG>,<FIG> the key relay nodes KN used for relaying the encryption key Kenc can comprise optical or electrical transceivers connected with each other by means of optical or electrical transport links used to transport the encrypted cipher keys CKi and the shares p of the blinding values Si between the transceivers. In the illustrated examples of <FIG>, <FIG> the transceivers can comprise FSP150 devices. <FIG> shows an embodiment with a single key relay node KN1. <FIG> shows an embodiment with two key relay nodes KN1, KN2. The key relay nodes can be untrusted nodes and may not require additional protection mechanisms. The initial node and the terminal nodes are trusted nodes.

Claim 1:
A method for performing a secure key relay of an encryption key, Kenc, provided by an initial node, KN<NUM>, and used by an encoding unit (ENC) of a first data transceiver for encoding plain data, Pdata, to provide encrypted cipher data, Cdata, transported via a data transport link ,DTL, to a decoding unit (DEC) of a second data transceiver which decodes the transported cipher data, Cdata, using the relayed encryption key, Kenc, provided by a terminal node, KNN, as a decoding key to retrieve the plain data, Pdata, wherein the relay of the encryption key, Kenc, from the initial node, KN<NUM>, to the terminal node, KNN, is performed by means of intermediate relay nodes, KN<NUM>, KN<NUM>...KNN-<NUM>, and comprises the steps of:
- sharing QKD-keys, K, between the nodes via secure quantum channels, QCH, of a quantum key distribution network, QKDN;
- performing encryption of shared QKD-keys, K, at the initial node, KN<NUM>, and at each intermediate relay node, KN<NUM>, KN<NUM>...KNN-<NUM>, and blinding them with a blinding value, Si, of the respective node to provide an encrypted cipher key, CKi, by the initial node, KN<NUM>, and by each intermediate relay node, KN<NUM>, KN<NUM>...KNN-<NUM>, wherein the shared QKD-keys are encrypted by performing an XOR-operation on the QKD-keys at the respective intermediate relay node, wherein the encryption key, Kenc, is encrypted by performing an XOR-operation on the encryption key, Kenc, and a QKD-key, K<NUM>, at the initial node, KN<NUM>;
- transmitting the encrypted cipher keys, CKi, of the initial node, KN<NUM>, and of each of the intermediate relay nodes, KN<NUM>,KN<NUM>...KNN-<NUM>, to the terminal node, KNN; and
- performing by the terminal node, KNN, logic operations on blinding values, Si, on the basis of the encrypted cipher keys, CKi, received by the terminal node, KNN, from the initial node, KN<NUM>, and received from each of the intermediate relay nodes, KN<NUM>, KN<NUM>...KNN-<NUM>, to provide the encryption key, Kenc, used by the decoding unit (DEC) of the second data transceiver as a decoding key to retrieve the plain data, Pdata, wherein the logic operations performed by the terminal node, KNN, to provide the encryption key, Kenc, on the basis of the blinding values, Si, and the received encrypted cipher keys, CKi, comprise XOR-operations.