This paper presents a key management approach for quantum generated keys and its integration into the IPsec/IKE protocol. The solution is used in a security gateway that integrates quantum key distribution (QKD) and IPsec as a system-on-chip solution. The QKD acquisition module and the IPsec part of this prototype are implemented in hardware to provide a high level of integration as well as high encryption throughput. To make use of these fast encryption capabilities, a flexible key management approach is necessary to provide keys just in time. Thus, the presented key management approach focuses on an efficient key update mechanism and minimizes the communication overhead. Furthermore, the presented approach is a first step to integrate QKD solutions into
real-world commercial applications using standardized interfaces.
This paper presents a key management approach for quantum generated keys and its integration into the IPsec/IKE protocol. The solution is used in a security gateway that integrates quantum key distribution (QKD) and IPsec as a system-on-chip solution. The QKD acquisition module and the IPsec part of this prototype are implemented in hardware to provide a high level of integration as well as high encryption throughput. To make use of these fast encryption capabilities, a flexible key management approach is necessary to provide keys just in time. Thus, the presented key management approach focuses on an efficient key update mechanism and minimizes the communication overhead. Furthermore, the presented approach is a first step to integrate QKD solutions into
real-world commercial applications using standardized interfaces.
IPSec is a widely used network security protocol that plays a crucial role in providing secure transmission channels in the current Internet. However, the advent of quantum computing poses unprecedented challenges to the security of traditional cryptographic methods, including those used in IPSec. Fortunately, quantum key distribution (QKD) offers a theoretically unbreakable method for exchanging keys between two communicating parties. To address the security threats posed by quantum computing, we propose IPSeQ, a security-enhanced IPSec protocol that integrates QKD into its design. Specifically, IPSeQ leverages quantum keys to strengthen key negotiation, authentication, and data encryption processes. To achieve rapid key updates while ensuring transmission efficiency and key synchronization, IPSeQ introduces a sliding window-based dynamic key updating mechanism. Experiments conducted with real QKD devices demonstrate that our proposed mechanism can improve throughput by more than 50 percent compared to traditional schemes, particularly at higher quantum key generation rates. Additionally, IPSeQ effectively maintains robust data transmission in scenarios where quantum keys are scarce (e.g., when the key generation rate is less than 10 kb/s).
This paper presents a practical solution to the problem of limited bandwidth in Quantum Key Distribution (QKD)- secured communication through using rapidly rekeyed Internet Protocol security (IPsec) links. QKD is a cutting-edge security technology that provides mathematically proven security by using quantum physical effects and information theoretical axioms to generate a guaranteed non-disclosed stream of encryption keys. Although it has been a field of theoretical research for some time, it has only been producing market-ready solutions for a short period of time. The downside of this technology is that its key generation rate is only around 52,000 key bits per second over a distance of 50 km. As this rate limits the data throughput to the same rate, it is substandard for normal modern communications, especially for securely interconnecting networks. IPsec, on the other hand, is a well-known security protocol that uses classical encryption and is capable of exactly creating site-to-site virtual private networks. This paper presents a solution that combines the performance advantages of IPsec with QKD. The combination sacrifices only a small portion of QKD security by using the generated keys a limited number of times instead of just once. As a part of this, the solution answers the question of how many data bits per key bit make sensible upper and lower boundaries to yield high performance while maintaining high security. While previous approaches complement the Internet Key Exchange protocol (IKE), this approach simplifies the implementation with a new key synchronization concept, proposing a lightweight protocol that uses relatively few, slim control messages and sparse acknowledgement. Furthermore, it provides a Linux-based module for the AIT QKD software using the Netlink XFRM Application Programmers Interface to feed the quantum key to the IP***ABSTRACT TRUNCATED TO 1920 CHARS***
Quantum Key Distribution (QKD) is a technique for sharing encryption keys between two adjacent nodes. It provides unconditional secure communication based on the laws of physics. From the viewpoint of network research, QKD is considered to be a component for providing secure communication in network systems. A QKD network enables each node to exchange encryption keys with arbitrary nodes. However previous research did not focus on the processing speed of the key management method essential for a QKD network. This paper focuses on the key management method assuming a high-speed QKD system for which we clarify the design, propose a high-speed method, and evaluate the throughput. The proposed method consists of four modules: (1) local key manager handling the keys generated by QKD, (2) one-time pad tunnel manager establishing the transparent encryption link, (3) global key manager generating the keys for application communication, and (4) web API providing keys to the application. The proposed method was implemented in software and evaluated by emulating QKD key generation and application key consumption. The evaluation result reveals that it is capable of handling the encryption keys at a speed of 414 Mb/s, 185 Mb/s, 85 Mb/s and 971 Mb/s, for local key manager, one-time pad tunnel manager, global key manager and web API, respectively. These are sufficient for integration with a high-speed QKD system. Furthermore, the method allows the high-speed QKD system consisting of two nodes to expand corresponding to the size of the QKD network without losing the speed advantage.
Quantum Key Distribution (QKD) is a mechanism for creating shared,
secret, random bits. This document describes extensions to the IKEv2
protocol to use random bits created via QKD as keys for IPsec. The
Diffie-Hellman key agreement mechanism is replaced with QKD. The use
of QKD-generated keys with standard IPsec will extend the lifetime of
privacy guarantees for IPsec-protected data: future technological
advances that break Diffie-Hellman key exchange will not disclose data
until such time as the encryption algorithm used for the IPsec tunnel
is broken.
Standardization bodies are releasing specifications that will help the adoption of Quantum Key Distribution (QKD) technology. The protocols standardized by the European Telecommunications Standards Institute (ETSI) make it possible to distribute keys to network elements operating at any layer of the protocol stack. On the other hand, the IETF released a standard mechanism to integrate post-quantum keys into IPSec. In this work, we introduce a new mechanism to provide QKD keys to IPSec endpoints. This solution was implemented in the PoliQI network at Politecnico di Milano. We also compare this solution to providing keys to applications with the same security level. We model the system using a Continuous-Time Markov Chain and conclude that the two approaches can secure a similar number of applications. Integration with the applications allows a finer control on whether to block new applications or drop rekeying requests. Integration with IPSec makes it easier to introduce QKD in an existing infrastructure.
We present a fully operable security gateway prototype, integrating quantum key distribution and realised as a system-on-chip. It is implemented on a field-programmable gate array and provides a virtual private network with low latency and gigabit throughput. The seamless hard- and software integration of a quantum key distribution layer enables high key-update rates for the encryption modules. Hence, the amount of data encrypted with one session key can be significantly decreased. We realise a highly modular architecture and make extensive use of software/hardware partitioning. This work is the first approach towards application of a new key distribution technology in dedicated security processors. In particular, it elaborates requirements for the integration of quantum key distribution on a chip level.