Patent Description:
An application programming interface (API) is used in acquiring encryption keys/decryption keys generated from key management server devices by using quantum key distribution (QKD). When receiving a one-time encrypted packet, a forwarding device (or a host) such as a router acquires a decryption key from a key management server device by using the API and decrypts the packet.

However, in the conventional techniques described above, it is difficult to perform QKD encryption and decryption without degrading the communication performance of a mobile phone network.

<CIT> discloses a system and method for distributing quantum keys between first and second applications running on first and second client devices, respectively. During operation, a first application running on the first client device can transmit a first key request to a first quantum-key-management (QKM) module managing a first set of quantum keys, and transmit a notification to the second application running on the second client device, the notification prompting the second application to transmit a second key request to a second QKM module managing a second set of quantum keys. The first application can receive, from the first QKM module, a first quantum key based on the first key request, in response to the first QKM module determining that the second application receives a second quantum key based on the second key request. <CIT> discloses a method which includes receiving at a node of a transitive IP network a data packet including a Network Services Header ("NSH"); accessing by the transitive IP network node context contained in the NSH, wherein the context may be used by the transitive IP network node to perform an enhanced network service in connection with the received data packet; performing by the transitive IP network node the enhanced network service in connection with the received data packet using the accessed context; and, subsequent to the performing, forwarding the received packet to a next node.

According to an arrangement, there is provided a forwarding device according to claim <NUM>.

According to another arrangement, there is provided a forwarding device according to claim <NUM>.

According to another arrangement, there is provided a key management server device according to claim <NUM>.

According to another arrangement, there is provided a communication system according to claim <NUM>.

According to another arrangement, there is provided a computer program product according to claim <NUM>.

Hereinafter, arrangements of a forwarding device, a key management server device, a communication system, a forwarding method, and a computer program product will be described in detail with reference to the accompanying drawings.

Note that a packet indicates a transmission unit of information transmitted and received via a network, and frames at L2, and segments and datagrams at L4 are also referred to as packets for the sake of convenience in the description of the following arrangements. Those referred to as packets include information such as headers and footers at L2.

First, a system configuration example of a communication system of a first arrangement will be described.

<FIG> is a diagram illustrating a system configuration example of a communication system <NUM> according to the first arrangement. The communication system <NUM> of the first arrangement includes routers 10a and 10b, key management server devices 20a and 20b, a mobile phone network management server device <NUM>, and networks <NUM> to <NUM>.

Hereinafter, the routers 10a and 10b will be simply referred to as a router <NUM> when not distinguished from each other. Similarly, the key management server devices 20a and 20b will be simply referred to as a key management server device <NUM> when not distinguished from each other.

The routers 10a and 10b are connected together via the network <NUM>. The network <NUM> is, for example, a network in a mobile phone network.

The router 10a is also connected to the network <NUM> so as to forward a packet received through the network <NUM> to the router 10b. The router 10b is also connected to the network <NUM> so as to forward the packet forwarded from the router 10a to an external device connected to the network <NUM>.

In the first arrangement, a case in which the communication system <NUM> controls communication through the networks <NUM> to <NUM> included in the mobile phone network will be described below.

For example, the routers 10a and 10b may be installed in a section of mobile backhaul between a core network device and a base station device. In this case, the networks <NUM>, <NUM>, and <NUM> correspond to the mobile backhaul. The core network device is, for instance, an Evolved Packet Core (EPC) or a <NUM> Core network (5GC). The base station device is, for instance, a Base Band Unit (BBU) or a Central Unit (CU).

For example, the routers 10a and 10b may be also installed in a section of mobile fronthaul between a base band device and a wireless device. In this case, the networks <NUM>, <NUM>, and <NUM> correspond to the mobile fronthaul. The base band device is, for instance, a Base Band Unit (BBU) or a Distributed Unit (DU). The wireless device is, for instance, a Remote Radio Head (RRH) or a Radio Unit (RU). For example, for a network configuration using the Distributed Unit (DU), the routers 10a and 10b may be installed in a section of mobile midhaul between the CU and the DU. In this case, the networks <NUM>, <NUM>, and <NUM> correspond to the mobile midhaul.

For instance, in the backhaul and the midhaul, user data is transmitted and received via a GTP-U (GTP user data tunneling; GPRS Tunneling Protocol; GPRS: General Packet Radio Service) protocol. In the fronthaul, user data is transmitted and received via an eCPRI protocol.

The router 10a is connected to the key management server device 20a. The router 10b is connected to the key management server device 20b. The router 10a acquires an encryption key for encrypting the packet to be forwarded to the router 10b from the key management server device 20a. Meanwhile, the router 10b acquires a decryption key for decrypting the packet received from the router 10a from the key management server device 20b.

Although the arrangements describe packet encryption and decryption processes for the sake of convenience, the packet encryption and decryption processes do not necessarily have to be performed. In some applications, the router 10a may attach authentication data to the packet without encrypting the packet, and the router 10b may verify the authentication data. In any case, the router 10a acquires a key from the key management server device 20a along with the packet forwarding process, and the router 10b acquires a key corresponding to the key used in the router 10a from the key management server device 20b.

Note that the router <NUM> and the key management server device <NUM> may be mounted in the same housing as one device, or may be mounted as separate devices.

The key management server devices 20a and 20b are connected together via the network <NUM>. The networks <NUM> and <NUM> may be an identical network or different networks. Typically, the key management server devices 20a and 20b are connected to each other via an optical fiber network. Thus, the key management server devices 20a and 20b can safely share a bit string with each other by quantum cryptography. In addition to sharing the bit string, the key management server devices 20a and 20b transmit and receive a control message for generating/sharing the decryption key corresponding to the encryption key. For example, a key identifier for identifying each key, and a length of key (key length) are adjusted by the control message. Information included in the control message is referred to as key information. Meanwhile, a bit string indicating the encryption key and the decryption key itself is referred to as a key value.

The mobile phone network management server device <NUM> is connected to the router 10a via the network <NUM>. The mobile phone network management server device <NUM> transmits information specifying a packet to be encrypted to the router 10a. The mobile phone network management server device <NUM> is also connected to the router 10b via the network <NUM>. The mobile phone network management server device <NUM> transmits information specifying a packet to be decrypted to the router 10b.

Note that the networks <NUM>, <NUM>, and <NUM> may be an identical network or different networks from one another. Alternatively, some of the networks <NUM>, <NUM>, and <NUM> may be an identical network, and the remaining network may be a different network therefrom.

The packets to be encrypted and decrypted are specified based on, for instance, a TEID (an identifier for a tunnel endpoint) field included in a GTP-U header, a QFI (an identifier indicating the quality-of-service of a flow) field, and a PC_ID (an identifier for continuous IQ data; e.g., a physical channel, layer, and antenna port) included in an eCPRI protocol. When the core network device is the EPC, the mobile phone network management server device <NUM> may specify a bearer identifier (Evolved Packet System (EPS) Bearer ID; EBI) instead of directly specifying the TEID. An extended Antenna-Carrier (eAxC) identifier (composed of a combination of a DU port identifier, a band sector identifier, a component carrier, and a RU port identifier) defined in O-RAN fronthaul specifications may be used for the PC_ID.

The mobile phone network management server device <NUM> is, for example, the core network device included in the backhaul in the mobile phone network. More specifically, in the case of the <NUM> core, at least one of an Access and Mobility Management Function (AMF) for configuring setting over an N2 interface, a Session Management Function (SMF) for configuring setting over an N4 interface, a Policy Control Function (PCF) for providing policy control, and an Application Function (AF) for receiving a request from the outside serves as the mobile phone network management server device <NUM>. Note that a user or an operator may set that data needs to be encrypted from the outside via the AF. In this case, an external server that configures such setting can also be considered as the mobile phone network management server device <NUM>. Additionally, in the case of the EPC, a Policy and Charging Rules Function (PCRF), described in 3GPP TS23. <NUM>, for providing policy management, or a Policy and Charging Enforcement Function (PCEF) for providing communication control serves as the mobile phone network management server device <NUM>.

When the fronthaul is encrypted, an instruction may be given from the mobile phone network management server device <NUM> having information of a physical position of an antenna, a distance (may be a value estimated from delay) to the antenna, and confidentiality of an application installed under the antenna, separately from the above configuration, as a server to specify the PC_ID.

The mobile phone network management server device <NUM> uniquely specifies a series of packets transmitted and received between specific nodes or specific applications, instructs the router 10a to encrypt the specified packets (flows, bearers, and slices), and instructs the router 10b to decrypt the specified packets (flows, bearers, and slices). Note that the target of encryption or decryption specified by the mobile phone network management server device <NUM> may be one packet as well as a plurality of packets (flows).

The mobile phone network management server device <NUM> can further specify a flow not to be encrypted for the router 10a, and a flow not to be decrypted for the router 10b.

The router 10a may obtain information such as a Secure Application Entity (SAE) ID of the router 10b together with the instruction from the mobile phone network management server device <NUM>, or may identify the SAE ID of the router 10b based on the instruction.

To instruct the router 10a from the mobile phone network management server device <NUM>, for example, an N2 interface or an N4 interface described in GPP TS23. <NUM>, Diameter, GTP-control (GTP-C), REST, eCPRI, and NETCONF are used. In the case of the N2 interface and the N4 interface, a protocol used for setting is, for instance, a Packet Forwarding Control Protocol (PFCP) for the N4 interface, and a Next Generation Application Protocol (NGAP) for the N2 interface. Note that whether to perform encryption (decryption), its method or the like may be specified as some of Quality of Service (QoS) parameters in the case of the backhaul or the midhaul. Additionally, for example, the mobile phone network management server device <NUM> and the router 10a may share a file and a memory, through which the mobile phone network management server device <NUM> may give the instruction to the router 10a. The same applies to the instruction to the router 10b from the mobile phone network management server device <NUM>.

<FIG> is a diagram illustrating a function configuration example of the router 10a that encrypts a packet according to the first arrangement. The router 10a of the first arrangement includes a receiving module <NUM>, a packet reception processing module <NUM>, an encryption processing module <NUM>, an encryption key reception processing module <NUM>, a storage control module <NUM>, a storage <NUM>, and a forward processing module <NUM>.

The receiving module <NUM> receives, for example, information specifying a packet to be encrypted (encryption target packet) from the mobile phone network management server device <NUM>. The receiving module <NUM> also receives, for example, information specifying a packet not to be encrypted from the mobile phone network management server device <NUM>. More specifically, for instance, the receiving module <NUM> may receive the information specifying (instructing) the encryption target packet (or the encryption non-target packet) as some of the QoS parameters of packet communication from the mobile phone network management server device <NUM>. When receiving the instruction from the mobile phone network management server device <NUM>, the receiving module <NUM> informs the encryption processing module <NUM> whether to encrypt the instructed packet.

When receiving a packet from the network <NUM>, the packet reception processing module <NUM> inputs the packet to the encryption processing module <NUM>.

When the received packet is instructed to be encrypted by the mobile phone network management server device <NUM>, the encryption processing module <NUM> inputs a request to read an encryption key having a specified key length to the storage control module <NUM>, and acquires the encryption key from the storage control module <NUM>. The encryption processing module <NUM> then encrypts the packet, and inputs the encrypted packet to the forward processing module <NUM>. Meanwhile, when the received packet is instructed not to be encrypted by the mobile phone network management server device <NUM>, the encryption processing module <NUM> inputs the packet to the forward processing module <NUM> without giving the encryption process.

When receiving an encryption key from the key management server device 20a, the encryption key reception processing module <NUM> inputs the encryption key to the storage control module <NUM>.

When receiving the encryption key from the encryption key reception processing module <NUM>, the storage control module <NUM> stores the encryption key in the storage <NUM>. Additionally, when receiving a request to read the encryption key having a specified key length from the encryption processing module <NUM>, the storage control module <NUM> reads the encryption key having the specified key length from the storage <NUM>, and inputs the encryption key and the key identifier identifying the encryption key to the encryption processing module <NUM>.

Note that the storage control module <NUM> may keep acquiring the encryption key from the key management server device 20a via the encryption key reception processing module <NUM> independently of the operation of the encryption processing module <NUM>. Alternatively, the storage control module <NUM> may acquire the encryption key from the key management server device 20a via the encryption key reception processing module <NUM> when instructed by the encryption processing module <NUM>.

The encryption key is acquired, for example, by using a communication protocol such as ETSI GS QKD <NUM>. The encryption key may be also acquired, for example, via a key file generated by the key management server device 20a. Additionally, the encryption key may be acquired, for example, on a shared memory when the router 10a and the key management server device 20a are mounted in the same housing as one device.

When receiving the encrypted packet or the unencrypted packet from the encryption processing module <NUM>, the forward processing module <NUM> forwards the packet to the router 10b through the network <NUM>.

<FIG> is a diagram illustrating a function configuration example of the router 10b that decrypts a packet according to the first arrangement. The router 10b basically performs a similar operation to that of the router 10a. The routers 10a and 10b differ in processing performed on the packet. While the router 10a performs encryption, the router 10b performs decryption. The router 10b of the first arrangement includes the receiving module <NUM>, the packet reception processing module <NUM>, the storage control module <NUM>, the storage <NUM>, the forward processing module <NUM>, a decryption key reception processing module <NUM>, and a decryption processing module <NUM>.

A packet header includes the presence/absence of encryption. In the presence of encryption, the packet header includes a key identifier and an encryption algorithm of a key used for encryption. When a payload is only partially encrypted, the packet header includes information identifying the encrypted region.

The receiving module <NUM> receives, for example, information specifying a packet to be decrypted (decryption target packet) from the mobile phone network management server device <NUM>. The receiving module <NUM> also receives, for example, information specifying a packet not to be decrypted from the mobile phone network management server device <NUM>. More specifically, for instance, the receiving module <NUM> may receive the information specifying (instructing) the decryption target packet (or the decryption non-target packet) as some of the QoS parameters of packet communication from the mobile phone network management server device <NUM>. When receiving the instruction from the mobile phone network management server device <NUM>, the receiving module <NUM> informs the decryption processing module <NUM> whether to decrypt the instructed packet.

When receiving the packet from the network <NUM>, the packet reception processing module <NUM> inputs the packet to the decryption processing module <NUM>.

Meanwhile, the decryption key reception processing module <NUM> acquires a decryption key from the key management server device 20b independently of the packet reception process. When receiving the decryption key from the key management server device 20b, the decryption key reception processing module <NUM> inputs the decryption key to the storage control module <NUM>.

The decryption key is acquired, for example, by using a communication protocol such as ETSI GS QKD <NUM>. The decryption key may be also acquired, for example, via a key file generated by the key management server device 20b. Additionally, the decryption key may be acquired, for example, through a shared memory when the router 10b and the key management server device 20b are mounted in the same housing as one device.

When receiving the decryption key from the decryption key reception processing module <NUM>, the storage control module <NUM> stores the decryption key in the storage <NUM>. The storage <NUM> accumulates decryption keys independently of the packet reception process. When receiving a request to read the decryption key from the decryption processing module <NUM>, the storage control module <NUM> reads the decryption key from the storage <NUM>, and inputs the decryption key to the decryption processing module <NUM>.

Note that the storage control module <NUM> keeps acquiring the decryption key from the key management server device 20b via the decryption key reception processing module <NUM> independently of the operation of the decryption processing module <NUM>. This enables the decryption processing module <NUM> to decrypt the packet by using the decryption key supplied from the key management server device 20b without requesting the key management server device 20b to generate the decryption key.

The decryption processing module <NUM> decrypts the packet instructed from the receiving module <NUM>. In decrypting the packet, the decryption processing module <NUM> extracts identification information (typically, the key identifier) of the decryption key corresponding to the encryption key used for encrypting the packet from header information or the like of the packet, and acquires the decryption key corresponding to the identification information from the storage <NUM> via the storage control module <NUM>.

When the storage <NUM> does not have the decryption key corresponding to the encryption key (when the decryption key has not been supplied from the key management server device 20b), the storage control module <NUM> requests the decryption key from the key management server device 20b via the decryption key reception processing module <NUM>. When the decryption key is inputted from the decryption key reception processing module <NUM>, the storage control module <NUM> directly inputs the decryption key to the decryption processing module <NUM> without storing the decryption key in the storage <NUM>. This allows the decryption key to be given to the decryption processing module <NUM> as quickly as possible, thereby quickly performing the decryption process.

When the decryption key for decrypting the packet has not been supplied from the key management server device 20b at the time of packet decryption, the decryption processing module <NUM> may wait for a predetermined time and request the storage control module <NUM> to read the decryption key.

When the decryption key cannot be acquired even after a predetermined number of requests for the storage control module <NUM> to read the decryption key, the decryption processing module <NUM> discards the packet without decrypting the packet. Additionally, when the decryption key for decrypting the packet has not been supplied from the key management server device 20b at the time of packet decryption, the decryption processing module <NUM> may wait for a notification from the storage control module <NUM> for a predetermined time. When receiving no notification after passage of the predetermined time, the decryption processing module <NUM> may discard the packet without decrypting the packet.

When acquiring the decryption key from the storage control module <NUM>, the decryption processing module <NUM> decrypts the packet and inputs the decrypted packet to the forward processing module <NUM>.

When receiving the decrypted packet from the decryption processing module <NUM>, the forward processing module <NUM> forwards the packet to the external device connected to the network <NUM>.

<FIG> is a diagram illustrating a function configuration example of the key management server device 20a that supplies an encryption key according to the first arrangement. The key management server device 20a of the first arrangement includes a key distribution processing module <NUM>, a storage <NUM>, a control signal processing module <NUM>, an encryption key generation module <NUM>, and a supply module <NUM>.

The key distribution processing module <NUM> shares a bit string with the key management server device 20b via the network <NUM> by using quantum key distribution (quantum cryptography). Note that the key distribution processing module <NUM> may be mounted separately from the key management server device 20a as a quantum key distribution processing device.

The storage <NUM> accumulates bit strings shared by the key distribution processing module <NUM>.

The control signal processing module <NUM> transmits the control signal including the key information such as the identification information (typically, the key identifier), the key length, and offset information of the encryption key (the decryption key in the key management server device 20b) to the key management server device 20b that generates the decryption key, in addition to control regarding the sharing of the bit string. The offset information is information indicating where to extract the encryption key (the decryption key) from the shared bit string.

The encryption key generation module <NUM> generates the encryption key according to a request for the encryption key from the router 10a or autonomously. For example, the key length of the encryption key is specified by the request for the encryption key from the router 10a. Alternatively, for instance, the encryption key generation module <NUM> autonomously generates the encryption key having a predetermined key length. The encryption key generation module <NUM> extracts the encryption key having the key length from the bit string to generate the encryption key, and generates the key identifier identifying the encryption key.

The supply module <NUM> supplies the router 10a with the encryption key generated by the encryption key generation module <NUM> according to the request for the encryption key from the router 10a or autonomously. The encryption key is supplied to the router 10a using the bit string (key value) indicating the encryption key itself and the key identifier identifying the encryption key.

<FIG> is a diagram illustrating a function configuration example of the key management server device 20b that supplies a decryption key according to the first arrangement. The key management server device 20b of the first arrangement includes a key distribution processing module <NUM>, a storage <NUM>, a control signal processing module <NUM>, a supply module <NUM>, and a decryption key generation module <NUM>.

The key distribution processing module <NUM> shares the bit string with the key management server device 20a via the network <NUM> by using quantum key distribution (quantum cryptography). Note that the key distribution processing module <NUM> may be mounted separately from the key management server device 20b as a quantum key distribution processing device.

The storage <NUM> accumulates the bit strings shared by the key distribution processing module <NUM>.

The control signal processing module <NUM> receives the control signal including the key information such as the identification information (typically, the key identifier), the key length, and the offset information of the decryption key (the encryption key in the key management server device 20a) from the key management server device 20a, in addition to control regarding the sharing of the bit string.

Upon receiving the control signal, the decryption key generation module <NUM> generates the decryption key corresponding to the encryption key from the bit string on the basis of the key identification information and the key length without waiting for a request to generate the decryption key from the router 10b. This allows the decryption key to be acquired more quickly when the router 10b decrypts the packet received from the router 10a. Consequently, the forward throughput/forward speed of the router 10b can be improved. Note that the bit position to extract the decryption key from the shared bit string is specified, for example, by the offset information included in the control signal.

The supply module <NUM> supplies the decryption key generated by the decryption key generation module <NUM> to the router 10b.

<FIG> is a diagram for explaining an example of a communication method according to the first arrangement. First, the receiving module <NUM> of the router 10a receives information specifying a packet to be encrypted from the mobile phone network management server device <NUM> (step S1-<NUM>). Meanwhile, the receiving module <NUM> of the router 10b receives information specifying a packet to be decrypted from the mobile phone network management server device <NUM> (step S1-<NUM>).

Subsequently, the packet reception processing module <NUM> of the router 10a receives a packet from the external device connected to the network <NUM> (step S2). The encryption processing module <NUM> of the router 10a then transmits a request to generate an encryption key having the same length as the packet received by the process at the step S2 to the key management server device 20a (step S3).

Subsequently, in the key management server device 20a, the encryption key generation module <NUM> generates the encryption key, and the control signal processing module <NUM> notifies the key management server device 20b of the key information (the key identification information and the key length) of the generated encryption key (step S4).

The supply module <NUM> of the key management server device 20a then supplies the encryption key to the router 10a (step S5-<NUM>). Meanwhile, in the key management server device 20b, the decryption key generation module <NUM> generates a decryption key corresponding to the encryption key supplied by the process at the step S5-<NUM> from the bit string shared with the key management server device 20a on the basis of the key identification information and the key length notified at the step S4 without waiting for a request to generate the decryption key from the router 10b. The supply module <NUM> supplies (pushes) the decryption key to the router 10b (step S5-<NUM>). Note that the request to generate the decryption key is, for example, calling of Get key or Get key with key IDs of a Key Delivery API described in ETSI GS QKD <NUM>. Alternatively, the router 10b may issue the request to generate the decryption key to the key management server device on TCP, UDP, or other transport protocols. When the router 10b and the key management server device share a file system and a memory, the request to generate the decryption key may be issued through interprocess communication.

Subsequently, when the packet received by the process at the step S2 is the packet specified by the process at the step S1-<NUM>, the encryption processing module <NUM> of the router 10a encrypts the packet by using the encryption key supplied by the process at the step S5-<NUM>, and forwards the encrypted packet to the router 10b through the network <NUM> (step S6). Note that a packet not specified by the process at the step S1-<NUM> is forwarded without being encrypted at the step S6.

Subsequently, the packet reception processing module <NUM> of the router 10b receives the packet forwarded by the process at the step S6. When the packet forwarded by the process at the step S6 is the packet specified by the process at the step S1-<NUM>, the decryption processing module <NUM> decrypts the packet by using the decryption key supplied by the process at the step S5-<NUM>, and the forward processing module <NUM> forwards the packet to the external device connected to the network <NUM> (step S7). Note that a packet not specified by the process at the step S1-<NUM> is forwarded without being decrypted at the step S7.

As described above, the communication system <NUM> of the first arrangement includes the mobile phone network management server device <NUM>, the key management server device 20a (first key management server device), the key management server device 20b (second key management server device), the router 10a (first forwarding device), and the router 10b (second forwarding device).

In the router 10a (first forwarding device), the receiving module <NUM> receives the information specifying the encryption target packet from the mobile phone network management server device <NUM>. The packet reception processing module <NUM> receives a first reception packet through the network <NUM> (first network). When the first reception packet is the encryption target packet, the encryption processing module <NUM> transmits the request to generate the encryption key to the first key management server device, and encrypts the first reception packet by using the encryption key supplied from the first key management server device. The forward processing module <NUM> (first forward processing module) forwards the encrypted first reception packet or the unencrypted first reception packet to the second forwarding device through the network <NUM> (second network).

In the key management server device 20a (first key management server device), the key distribution processing module <NUM> shares the bit string by quantum key distribution. When the mobile phone network management server device <NUM> specifies the encryption target packet for the first forwarding device, the encryption key generation module <NUM> generates the encryption key for encrypting the encryption target packet from the bit string in response to the request to generate the encryption key transmitted from the first forwarding device. The control signal processing module <NUM> transmits the control signal including the key identification information for identifying the encryption key and the key length indicating the length of the encryption key to the second key management server device.

In the router 10b (second forwarding device), the packet reception processing module <NUM> receives a second reception packet through the second network. When the second reception packet is the decryption target packet, the decryption processing module <NUM> decrypts the second reception packet by using the decryption key supplied from the second key management server device without transmitting the request to generate the decryption key to the second key management server device. The forward processing module <NUM> (second forward processing module) forwards the decrypted second reception packet or the undecrypted second reception packet.

In the key management server device 20b (second key management server device), the key distribution processing module <NUM> shares the bit string by quantum key distribution. The control signal processing module <NUM> receives the control signal. Upon receiving the control signal, the decryption key generation module <NUM> generates the decryption key corresponding to the encryption key from the bit string based on the key identification information and the key length without waiting for the request to generate the decryption key from the second forwarding device. The supply module <NUM> supplies the decryption key to the second forwarding device.

Consequently, the communication system <NUM> of the first arrangement can perform the QKD encryption and decryption without degrading the communication performance of a mobile phone network. More specifically, the above configuration enables the router 10a (QKD compatible router) to receive control information (the information specifying the encryption target packet (flow)) from the mobile phone network. The router 10a can thereby identify traffic to be protected by the QKD encryption key within traffic passing through the router 10a. The control information from the mobile phone network is also transmitted to the QKD key management server devices 20a and 20b. Thus, the key management server devices 20a and 20b are adjusted such that both endpoints of communication to be protected can share a required encryption key. That is, communication over the mobile phone network can be selectively protected by QKD. As a result, the communication to be protected can be appropriately encrypted without degrading the communication performance of the wide-area IP network even when an encryption router (VPN router) using QKD is installed at a main point in the network.

In the conventional technique, a key distribution processing speed using QKD is slower than a communication speed of the mobile phone network. Thus, the communication performance of the mobile phone network is degraded if the encryption router (VPN router) using QKD is installed at a main point in the network.

While the case in which the single router 10b is connected to the key management server device 20b is described in the example of <FIG>, a plurality of the routers 10b may be connected to the key management server device 20b. When the routers 10b are connected to the key management server device 20b, the control signal further includes router identification information identifying the router 10b to be supplied with the decryption key. The router identification information includes, for example, an IP address, a port number, and a host name of each router <NUM>. The supply module <NUM> supplies the decryption key to the router identified by the router identification information.

Next, a modification of the first arrangement will be described. In the modification, a description similar to that of the first arrangement will be omitted, and only different points from those of the first arrangement will be described.

In the modification, a case in which a SAE ID is generated and given for each flow will be described.

When a flow to be encrypted is specified from the mobile phone network management server device <NUM>, the receiving module <NUM> of the router 10a of the modification generates a SAE ID corresponding to the flow, and additionally sets the SAE ID to itself. The receiving module <NUM> generates a SAE ID corresponding to the flow by, for example, combining a SAE ID set to the router 10a itself and information identifying the flow.

For example, the receiving module <NUM> connects the SAE ID set to the router 10a itself and the information identifying the flow to generate a new SAE ID. Additionally, for instance, the receiving module <NUM> connects the SAE ID set to the router 10a itself and a hash value of the information identifying the flow to generate a new SAE ID. Moreover, for example, the receiving module <NUM> generates a hash value obtained from the SAE ID set to the router 10a itself and the information identifying the flow as a new SAE ID.

The new SAE ID corresponding to the flow may be global unique, or may be unique (local unique) only between the routers 10a and 10b. In any case, the receiving module <NUM> of the router 10a receiving the instruction from the mobile phone network management server device <NUM> generates the SAE ID corresponding to the flow to be encrypted according to a certain rule. The receiving module <NUM> of the router 10b also generates a SAE ID corresponding to a flow to be decrypted in a similar method.

The SAE IDs generated by the respective receiving modules <NUM> may be transmitted and received, for instance, between the routers 10a and 10b, or on a control signal communication channel via the key management server devices <NUM>. Additionally, for example, the router 10a may estimate the SAE ID to be newly generated by the router 10b from the SAE ID of the router 10b itself and the information identifying the flow to be decrypted by the router 10b. The same applies to the router 10b.

Next, a second arrangement will be described. In the second arrangement, a description similar to that of the first arrangement will be omitted, and only different points from those of the first arrangement will be described.

In the second arrangement, a case in which a router that receives a route change instruction is added will be described.

<FIG> is a diagram illustrating a system configuration example of a communication system <NUM>-<NUM> according to the second arrangement. The communication system <NUM>-<NUM> of the second arrangement includes the routers 10a to 10d, the key management server devices 20a and 20b, the mobile phone network management server device <NUM>, and the networks <NUM> to <NUM>. In the second arrangement, routers 10c and 10d and a network <NUM> are added to the configuration of the first arrangement. Since the routers 10c and 10d have an identical configuration, a case of the router 10c will be described later as an example using <FIG>.

In the example in <FIG>, the routers 10a and 10b are connected together via the network <NUM>. The packet encrypted by the router 10a is forwarded to the router 10b through the network <NUM>. The networks <NUM> and <NUM> may be an identical network or different networks. The packet encrypted by the router 10a may be also forwarded to the router 10b through the router 10c, the network <NUM>, and the router 10d without connecting the routers 10a and 10b to the network <NUM>.

Note that a Software Defined Networking (SDN) compatible router and a Network Service Header (NSH) defined by RFC8300 may be used as a method for achieving a route change of the second arrangement. In this case, to cause a specific packet instructed from the mobile phone network management server device <NUM> to pass through the routers 10a and 10b, the receiving module <NUM> gives a NSH header describing a function type and an order of a service to the specific packet. The forward processing module <NUM> then forwards the packet specified by the NSH header to the router 10a. The forward processing module <NUM> forwards other packets (packets not instructed from the mobile phone network management server device <NUM>) and a packet received from the router 10a to the network <NUM>.

<FIG> is a diagram illustrating a function configuration example of the router 10c that receives a route change instruction according to the second arrangement. The router 10c of the second arrangement includes the receiving module <NUM>, the packet reception processing module <NUM>, and the forward processing module <NUM>.

The receiving module <NUM> receives an instruction (specification) to forward a specific packet to the router 10a from the mobile phone network management server device <NUM>.

The forward processing module <NUM> forwards the specified packet to the router 10a. The forward processing module <NUM> forwards other packets (packets not instructed from the mobile phone network management server device <NUM>) and a packet received from the router 10a to the network <NUM>.

The routers 10a and 10b may be connected to the mobile phone network management server device <NUM>, or do not have to be connected to the mobile phone network management server device <NUM>. <FIG> illustrates a configuration in which the routers 10a and 10b have connection with the mobile phone network management server device <NUM>. When the routers 10a and 10b have connection with the mobile phone network management server device <NUM>, the routers 10a and 10b encrypt and decrypt the packet instructed from the mobile phone network management server device <NUM> in a similar manner to the first arrangement.

When the routers 10a and 10b have no connection with the mobile phone network management server device <NUM>, the router 10a performs encryption according to a predetermined rule, for example, by always encrypting the received packet or encrypting only a specific packet. The same applies to the router 10b that performs decryption.

Next, a third arrangement will be described. In the third arrangement, a description similar to that of the first arrangement will be omitted, and only different points from those of the first arrangement will be described.

In the third arrangement, a case in which one or more key management server devices <NUM> exist between the key management server devices 20a and 20b will be described.

<FIG> is a diagram for explaining an example of a system configuration of a communication system <NUM>-<NUM> and a communication method according to the third arrangement. In the example of <FIG>, two key management server devices 20e and 20f are added between the key management server devices 20a and 20b.

In the third arrangement, the key management server device 20a shares the bit string with the key management server device 20e via a quantum cryptographic communication channel. Additionally, the key management server device 20b shares the bit string with the key management server device 20f via a quantum cryptographic communication channel. Thus, the key management server devices 20a and 20b cannot directly share the bit string in the third arrangement.

In the third arrangement, the control signal processing module <NUM> of the key management server device 20a protects (encrypts) the key information used for decrypting the packet in the router 10b by using the bit string shared with the adjacent key management server device 20e, and transmits the key information to the key management server device 20e. Note that the key information of the third arrangement includes not only the key identification information and the key length but also the key value used for the decryption key. The control signal processing module <NUM> of the key management server device 20e transmits the key information used for decrypting the packet in the router 10b to the adjacent key management server device 20f in a similar manner. As described above, the key information used for decrypting the packet forwarded by the router 10a is delivered to the key management server device 20b in a bucket brigade manner through the key management server devices <NUM> (step S4-<NUM> to step S4-<NUM>).

The supply module <NUM> of the key management server device 20a supplies the encryption key to the router 10a (step S5-<NUM>). Meanwhile, in the key management server device 20b, the decryption key generation module <NUM> generates the decryption key by using the key value included in the key information notified by the process at the step S4-<NUM> without waiting for a request to generate the decryption key from the router 10b. The supply module <NUM> supplies (pushes) the decryption key to the router 10b (step S5-<NUM>).

Note that a description on the steps S1-<NUM>, S1-<NUM>, S2, S3, S6 and S7, which is similar to that of the first arrangement (see <FIG>), is omitted.

The key management server devices 20a and 20e share the bit string in advance by the key distribution processing modules <NUM>. Thus, a portion of the bit string may be extracted and used as the key value of the decryption key used in the router 10b. That is, the key management server device 20a may newly generate the decryption key to be used in the router 10b, protect the decryption key by using the bit string shared with the key management server device 20e, and transmit the decryption key to the key management server device 20e. Alternatively, the key management server device 20a may instruct the key management server device 20e to use a portion of the bit string shared with the key management server device 20e as the key value of the decryption key used in the router 10b.

Moreover, the control signal processing module <NUM> of the key management server device 20a may directly transmit the key identification information and the key length shared between the key management server devices 20a and 20b to the key management server device 20b, without being relayed in a bucket brigade manner by the key management server devices 20e and 20f. Note that the key identification information and the key length may be encrypted or transmitted in clear text.

When no additional key management server device <NUM> exists between the key management server devices 20a and 20b, that is, even in a configuration similar to that of the first arrangement in <FIG>, the key management server device 20a may protect (encrypt) the decryption key to be used in the router 10b by using the bit string shared with the key management server device 20b and transmit the decryption key to the key management server device 20b.

As described above, in the communication system <NUM>-<NUM> of the third arrangement, the key distribution processing module <NUM> of the key management server device 20a shares the bit string with the facing key management server device 20e by quantum key distribution. The control signal processing module <NUM> of the key management server device 20a encrypts the decryption key by using the shared bit string, and transmits the control signal including the encrypted decryption key and the key identification information identifying the decryption key to the facing key management server device 20e.

Similarly, the key distribution processing module <NUM> of the key management server device 20e shares the bit string with the facing key management server device 20f by quantum key distribution. The control signal processing module <NUM> of the key management server device 20e encrypts the decryption key (the decryption key received from the key management server device 20a) by using the shared bit string, and transmits the control signal including the encrypted decryption key and the key identification information identifying the decryption key to the facing key management server device 20f.

Similarly, the key distribution processing module <NUM> of the key management server device 20f shares the bit string with the facing key management server device 20b by quantum key distribution. The control signal processing module <NUM> of the key management server device 20f encrypts the decryption key (the decryption key received from the key management server device 20e) by using the shared bit string, and transmits the control signal including the encrypted decryption key and the key identification information identifying the decryption key to the facing key management server device 20b.

Upon receiving the control signal from the key management server device 20f, the supply module <NUM> of the key management server device 20b supplies the decryption key to the router 10b without waiting for the request to generate the decryption key from the router 10b.

Meanwhile, in the router 10b, the packet reception processing module <NUM> receives the packet encrypted with the encryption key corresponding to the decryption key identified by the key identification information. The decryption processing module <NUM> decrypts the packet by using the decryption key supplied from the key management server device 20b without requesting the key management server device 20b to generate the decryption key.

Consequently, the communication system <NUM>-<NUM> of the third arrangement can provide similar effects to those of the first arrangement even when the bit string cannot be directly shared between the key management server devices 20a and 20b. Additionally, the communication system <NUM>-<NUM> of the third arrangement enables the decryption key for decrypting the encrypted packet to be acquired from the key management server device 20b without receiving the encrypted packet.

Next, a fourth arrangement will be described. In the fourth arrangement, a description similar to that of the first arrangement will be omitted, and only different points from those of the first arrangement will be described.

In the fourth arrangement, a case in which the mobile phone network management server device <NUM> is connected to the router 10a and is not connected to the router 10b will be described.

<FIG> is a diagram illustrating a system configuration example of a communication system <NUM>-<NUM> according to the fourth arrangement. The communication system <NUM>-<NUM> of the fourth arrangement includes the routers 10a and 10b, the key management server devices 20a and 20b, the mobile phone network management server device <NUM>, and the networks <NUM> to <NUM>. In the fourth arrangement, the network <NUM> between the mobile phone network management server device <NUM> and the router 10b is deleted from the configuration of the first arrangement.

<FIG> is a diagram illustrating a function configuration example of the router 10b that decrypts a packet according to the fourth arrangement. The router 10b of the fourth arrangement includes the packet reception processing module <NUM>, the storage control module <NUM>, the storage <NUM>, the forward processing module <NUM>, the decryption key reception processing module <NUM>, and the decryption processing module <NUM>. In the fourth arrangement, the router 10b does not include the receiving module <NUM>. Unlike in the first arrangement, the decryption processing module <NUM> determines whether the received packet is encrypted from a header or the like of the packet. When the packet is encrypted, the decryption processing module <NUM> acquires the decryption key and performs the decryption process in a similar manner to the first arrangement. Other operations of the router 10b are similar to those of the first arrangement.

Lastly, hardware configuration examples of the router <NUM> and the key management server device <NUM> of the first to fourth arrangements will be described.

<FIG> is a diagram illustrating a hardware configuration example of the router <NUM> according to the first to fourth arrangements. The router <NUM> includes a control device <NUM>, a primary storage device <NUM>, an auxiliary storage device <NUM>, a display device <NUM>, an input device <NUM>, and a communication interface (IF) <NUM>.

The control device <NUM>, the primary storage device <NUM>, the auxiliary storage device <NUM>, the display device <NUM>, the input device <NUM>, and the communication IF <NUM> are connected together via a bus <NUM>.

The control device <NUM> executes a computer program read into the primary storage device <NUM> from the auxiliary storage device <NUM>. The primary storage device <NUM> is a memory such as a read only memory (ROM) and a random access memory (RAM). The auxiliary storage device <NUM> is, for example, a hard disk drive (HDD) or a memory card.

The display device <NUM> displays a state or the like of the router <NUM>. The input device <NUM> receives an input from a user. The communication IF <NUM> is an interface to be connected to the networks <NUM> to <NUM> and <NUM> to <NUM> and the key management server device <NUM>. Note that the router <NUM> does not have to include the display device <NUM> and the input device <NUM>. When the router <NUM> does not include the display device <NUM> and the input device <NUM>, for example, a display function and an input function of an external terminal connected via the communication IF <NUM> may be used.

<FIG> is a diagram illustrating a hardware configuration example of the key management server device <NUM> according to the first to fourth arrangements. The key management server device <NUM> of the first to fourth arrangements includes a control device <NUM>, a primary storage device <NUM>, an auxiliary storage device <NUM>, a display device <NUM>, an input device <NUM>, a quantum communication IF <NUM>, and a classical communication IF <NUM>.

The control device <NUM>, the primary storage device <NUM>, the auxiliary storage device <NUM>, the display device <NUM>, the input device <NUM>, the quantum communication IF <NUM>, and the classical communication IF <NUM> are connected together via a bus <NUM>.

The control device <NUM> executes a computer program read into the primary storage device <NUM> from the auxiliary storage device <NUM>. The primary storage device <NUM> is a memory such as a ROM and a RAM. The auxiliary storage device <NUM> is, for example, an HDD or a memory card.

The display device <NUM> displays a state or the like of the key management server device <NUM>. The input device <NUM> receives an input from a user. Note that the key management server device <NUM> does not have to include the display device <NUM> and the input device <NUM>.

The quantum communication IF <NUM> is an interface to be connected to a quantum cryptographic communication channel (the network <NUM>). The classical communication IF <NUM> is an interface to be connected to a control signal communication channel and the router <NUM>.

The computer program executed by the router <NUM> and the key management server device <NUM> of the first to fourth arrangements is provided as a computer program product by being recorded in a computer-readable storage medium such as a CD-ROM, a memory card, a CD-R, and a digital versatile disc (DVD) in the form of an installable or executable file.

The computer program executed by the router <NUM> and the key management server device <NUM> of the first to fourth arrangements may also be stored in a computer connected to a network such as the Internet and may be provided by being downloaded via the network.

The computer program executed by the router <NUM> and the key management server device <NUM> of the first to fourth arrangements may also be provided via a network such as the Internet without being downloaded.

The computer program executed by the router <NUM> and the key management server device <NUM> of the first to fourth arrangements may also be provided by being previously incorporated in a ROM or the like.

The computer program executed by the router <NUM> of the first to fourth arrangements is configured by a module including a function achievable by the computer program within the function configuration of the router <NUM> of the first to fourth arrangements. The control device <NUM> reads and executes the computer program from a storage medium such as the auxiliary storage device <NUM> such that the function achieved by the computer program is loaded in the primary storage device <NUM>. That is, the function achieved by the computer program is generated on the primary storage device <NUM>.

Additionally, the computer program executed by the key management server device <NUM> of the first to fourth arrangements is configured by a module including a function achievable by the computer program within the function configuration of the key management server device <NUM> of the first and second arrangements. The control device <NUM> reads and executes the computer program from a storage medium such as the auxiliary storage device <NUM> such that the function achieved by the computer program is loaded in the primary storage device <NUM>. That is, the function achieved by the computer program is generated on the primary storage device <NUM>.

Note that the functions of the router <NUM> and the key management server device <NUM> of the first to fourth arrangements may be partially or wholly achieved by hardware such as an integrated circuit (IC). The IC is, for example, a processing module that executes dedicated processing.

Moreover, when a plurality of processors are used to achieve the functions, each processor may achieve one of the functions or two or more of the functions.

For example, the above router <NUM> may be a switch that forwards frames (packets) at L2 layer. That is, the above arrangements can be applied to a forwarding device such as a router, a switch, and a gateway.

Additionally, for instance, packets may be encrypted and decrypted partially, not entirely. Preferably, the uppermost layer protocol is encrypted partially other than a specified condition or entirely, out of protocols instructed to be encrypted or decrypted. For example, a data portion (payload portion) of the uppermost layer protocol may be encrypted or decrypted. For instance, when encryption and decryption are performed on a flow forwarded over IPv4 and having UDP destination port No. <NUM>, a UDP data portion (payload portion) excluding a UDP header may be encrypted and decrypted. If the entire packet is encrypted, a problem occurs in forwarding the packet, or it becomes difficult to specify a decryption target under the same conditions on the decryption side. These problems can be solved by encrypting only the data portion.

Moreover, for example, the mobile phone network management server device <NUM> may specify a portion to be encrypted or decrypted. For instance, the mobile phone network management server device <NUM> may notify the router <NUM> of an encryption target portion (decryption target portion) including a start position and an end position to perform encryption or decryption in a packet, together with encryption/decryption conditions for each flow. The start position and the end position may be notified, for example, using the number of bytes (the number of octets) of the offset from the start of the packet. The router <NUM> encrypts or decrypts the specified portion of the packet based on such an instruction. Additionally, the encryption target portion (decryption target portion) may be transmitted by being embedded in a frame header or data. Moreover, conversely, a portion not to be encrypted (portion not to be decrypted), not the encryption target portion (decryption target portion), may be transmitted.

Additionally, for instance, the encryption processing module <NUM> of the router 10a (the decryption processing module <NUM> of the router 10b) recalculates an Ethernet checksum since data is changed by encryption (decryption). If the checksums of IPv4, UDP, TCP, and other protocols are changed, the checksums may be recalculated and provided.

Claim 1:
A forwarding device (10b) connected to a key management server device (20b) configured to generate a decryption key by using quantum key distribution, QKD, the forwarding device comprising:
a receiving module (<NUM>) configured to receive information specifying a decryption target packet from a mobile phone network management server device (<NUM>) before receiving a reception packet for selectively protecting communications in case the key distribution processing speed using QKD is slower than a communication speed of a mobile phone network;
a packet reception processing module (<NUM>) configured to receive the reception packet;
a decryption processing module (<NUM>) configured to determine, based on the previously received information specifying the decryption target packet, whether the reception packet is the decryption target packet specified from the mobile phone network management server device (<NUM>), and decrypt the reception packet when the reception packet is the decryption target packet; and
a forward processing module (<NUM>) configured to forward the decrypted reception packet or the undecrypted reception packet.