QKD switching system and protocols

A quantum key distributed, QKD, linking apparatus for use with at least two endpoint devices for linking said endpoint devices in a QKD network, the QKD linking apparatus comprising:

• a plurality of QKD links, each QKD link having a communication medium comprising a quantum channel and a classical channel, wherein each endpoint is assigned a QKD link connecting said each endpoint to the QKD linking apparatus;
• a quantum communication component comprising a plurality of quantum receivers, each quantum receiver configured for receiving quantum transmissions over a quantum channel of a different one of the QKD links;
• a classical transceiver component comprising a plurality of classical transceivers, each classical transceiver configured for transmitting classical data over a classical channel of one of the QKD links and configured for receiving classical data over the classical channel of said one of the QKD links;
• and
• a controller connected to the quantum communication component and the classical transceiver component, the controller configured to:
• route or switch data received in a quantum transmission from an endpoint via a quantum receiver assigned to the endpoint over a quantum channel of the QKD link of the endpoint;
• route or switch classical data for classical transmission to an endpoint via a classical transceiver assigned to the endpoint over a classical channel of the QKD link of the endpoint;
• and
• route or switch classical data received by a classical transceiver over the classical channel of the QKD link of an endpoint as required;
• wherein the QKD linking apparatus further comprises a random number generator, wherein the controller performs a QKD protocol between a first endpoint device and a second endpoint device, the controller further configured to:
• route or switch a first set of random bits or keys received by a quantum receiver assigned to the first endpoint device from quantum transmissions from the first endpoint device over a quantum channel of the QKD link of the first endpoint device, wherein the quantum receiver uses a first quantum receiving basis for receiving the quantum transmission of the first set of random bits or keys and the first endpoint device uses a first quantum transmission basis for transmitting the quantum transmission of the first set of random bits or keys;
• route or switch an indication of the first set of random bits or keys validly received by the quantum receiver to the first endpoint device over the classical channel of the QKD link of the first endpoint device by a classical transceiver assigned to the first endpoint device;
• route or switch data representative of the first quantum receiving basis used for receiving the first set of random bits or keys to the first endpoint device over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device;
• determine a first intermediate set of symbols associated with the QKD linking apparatus based on discarding those first set of random bits or keys that were not validly received by the quantum receiver assigned to the first endpoint device;
• route or switch a second set of random bits or keys received by a quantum receiver assigned to the second endpoint device from quantum transmissions from the second endpoint device over a quantum channel of the QKD link of the second endpoint device, wherein the quantum receiver uses a second quantum receiving basis for receiving the quantum transmission of the second set of random bits or keys and the second endpoint device uses a second quantum transmission basis for transmitting the quantum transmission of the second set of random bits or keys;
• route or switch an indication of the second set of random bits or keys validly received by the quantum receiver to the second endpoint device over the classical channel of the QKD link of the second endpoint device by a classical transceiver assigned to the second endpoint device;
• route or switch data representative of the second quantum receiving basis used for receiving the second set of random bits or keys to the second endpoint device over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• determine a second intermediate set of symbols associated with the QKD linking apparatus based on discarding those second set of random bits or keys that were not validly received by the quantum receiver assigned to the second endpoint device;
• generate an encrypted first intermediate set of symbols using the second intermediate set of symbols;
• route or switch the encrypted first intermediate set of symbols over the classical channel of the QKD link of the second endpoint via the classical transceiver assigned to the second endpoint device, wherein the second endpoint device decrypts the encrypted first intermediate set of symbols based on deriving the second intermediate set of symbols associated with the QKD linking apparatus from the received second quantum transmission basis and the second quantum receiving basis;
• route or switch data representative of the first quantum transmission basis and the first quantum receiving basis received from the first endpoint device for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• route or switch data representative of the second quantum transmission basis and the second quantum receiving basis received from the second endpoint device for classical transmission over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device, wherein the first endpoint device determines a first shared key based on discarding all bits from the received first set of random bits except those bits where the first transmission basis equals the first receiving basis and the second transmission basis equals the second receiving basis, and the second endpoint device determines a second shared key based on discarding all bits from the decrypted first intermediate set of symbols except those bits where the first transmission basis equals the first receiving basis and the second transmission basis equals the second receiving basis;
• route or switch data representative of error correction and/or privacy amplification in relation to the first and second shared keys over the classical channels of the QKD links of the first and second endpoint devices, wherein the first and second devices determine a final shared key based on the first and second shared keys.

A quantum key distributed, QKD, linking apparatus for use with at least two endpoint devices for linking said endpoint devices in a QKD network, the QKD linking apparatus comprising:

• a plurality of QKD links, each QKD link having a communication medium comprising a quantum channel and a classical channel, wherein each endpoint is assigned a QKD link connecting said each endpoint to the QKD linking apparatus;
• a quantum communication component comprising a plurality of quantum receivers, each quantum receiver configured for receiving quantum transmissions over a quantum channel of a different one of the QKD links;
• a classical transceiver component comprising a plurality of classical transceivers, each classical transceiver configured for transmitting classical data over a classical channel of one of the QKD links and configured for receiving classical data over the classical channel of said one of the QKD links;
• and
• a controller connected to the quantum communication component and the classical transceiver component, the controller configured to:
• route or switch data received in a quantum transmission from an endpoint via a quantum receiver assigned to the endpoint over a quantum channel of the QKD link of the endpoint;
• route or switch classical data for classical transmission to an endpoint via a classical transceiver assigned to the endpoint over a classical channel of the QKD link of the endpoint;
• and
• route or switch classical data received by a classical transceiver over the classical channel of the QKD link of an endpoint as required;
• wherein the QKD linking apparatus further comprises a random number generator, wherein the controller performs a QKD protocol between a first endpoint device and a second endpoint device, the controller further configured to:
• route or switch a first set of random bits or keys received by a quantum receiver assigned to the first endpoint device from quantum transmissions from the first endpoint device over a quantum channel of the QKD link of the first endpoint device, wherein the quantum receiver uses a first quantum receiving basis for receiving the quantum transmission of the first set of random bits or keys and the first endpoint device uses a first quantum transmission basis for transmitting the quantum transmission of the first set of random bits or keys;
• route or switch an indication of the first set of random bits or keys validly received by the quantum receiver to the first endpoint device over the classical channel of the QKD link of the first endpoint device by a classical transceiver assigned to the first endpoint device;
• route or switch data representative of the first quantum receiving basis used for receiving the first set of random bits or keys to the first endpoint device over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device;
• determine a first intermediate set of symbols associated with the QKD linking apparatus based on discarding those first set of random bits or keys that were not validly received by the quantum receiver assigned to the first endpoint device;
• route or switch a second set of random bits or keys output from a random number generator for quantum transmission to the second endpoint device over a quantum channel of the QKD link of the second endpoint device via a quantum transmitter assigned to the second endpoint device, wherein the second endpoint device uses a second quantum receiving basis for receiving the quantum transmission of the second set of random bits or keys;
• route or switch an indication of the second set of random bits or keys validly received by the second endpoint device received from the second endpoint device over the classical channel of the QKD link of the second endpoint via a classical transceiver assigned to the second endpoint device;
• route or switch data representative of the second quantum transmission basis used for transmitting the second set of random bits or keys for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• determine a second intermediate set of symbols associated with the QKD linking apparatus based on discarding those second set of random bits or keys that do not correspond to the received indication of the second set of random bits or keys validly received by the second endpoint device;
• generate an encrypted first intermediate set of symbols using the second intermediate set of symbols;
• route or switch the encrypted first intermediate set of symbols over the classical channel of the QKD link of the second endpoint via the classical transceiver assigned to the second endpoint device, wherein the second endpoint device decrypts the encrypted first intermediate set of symbols based on deriving the second intermediate set of symbols associated with the QKD linking apparatus from the received second quantum transmission basis and the second quantum receiving basis;
• route or switch data representative of the first quantum transmission basis and the first quantum receiving basis received from the first endpoint device for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• route or switch data representative of the second quantum transmission basis and the second quantum receiving basis received from the second endpoint device for classical transmission over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device, wherein the first endpoint device determines a first shared key based on discarding all bits from the received first set of random bits except those bits where the first transmission basis equals the first receiving basis and the second quantum transmission basis equals the second receiving basis, and the second endpoint device determines a second shared key based on discarding all bits from the decrypted first intermediate set of symbols except those bits where the first transmission basis equals the first receiving basis and the second quantum transmission basis equals the second receiving basis;
• route or switch data representative of error correction and/or privacy amplification in relation to the first and second shared keys over the classical channels of the QKD links of the first and second endpoint devices, wherein the first and second devices determine a final shared key based on the first and second shared keys.

A computer-implemented method for controlling a quantum key distributed, QKD, linking apparatus for use in linking at least two endpoint devices in a QKD network, the QKD linking apparatus comprising:

• a plurality of QKD links, each QKD link having a communication medium comprising a quantum channel and a classical channel, wherein each endpoint is assigned a QKD link connecting said each endpoint to the QKD linking apparatus;
• a quantum communication component comprising a plurality of quantum receivers, each quantum receiver configured for receiving quantum transmissions over a quantum channel of a different one of the QKD links;
• and
• a classical transceiver component comprising a plurality of classical transceivers, each classical transceiver configured for transmitting classical data over a classical channel of one of the QKD links and configured for receiving classical data over the classical channel of said one of the QKD links;
• and
• wherein the method comprises:
• routing or switching data generated for quantum transmission from an endpoint via a quantum receiver assigned to the endpoint over a quantum channel of the QKD link of the endpoint;
• routing or switching classical data for classical transmission to an endpoint via a classical transceiver assigned to the endpoint over a classical channel of the QKD link of the endpoint;
• routing or switching classical data received by a classical transceiver over the classical channel of the QKD link of an endpoint as required;
• and
• performing a QKD protocol between a first endpoint device and a second endpoint device, the method further comprising:
• routing or switching a first set of random bits or keys output from a random number generator for quantum transmission to the first endpoint device over a quantum channel of the QKD link of the first endpoint device via a quantum receiver assigned to the first endpoint device, wherein the first endpoint device uses a first quantum receiving basis for receiving the quantum transmission of the first set of random bits or keys;
• routing or switching an indication of the first set of random bits or keys validly received by the first endpoint device received over the classical channel of the QKD link of the first endpoint device by a classical transceiver assigned to the first endpoint device;
• routing or switching data representative of the first quantum transmission basis used for transmitting the first set of random bits or keys over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device;
• determining a first intermediate set of symbols associated with the QKD linking apparatus based on discarding those first set of random bits or keys that do not correspond to the received indication of the first set of random bits or keys validly received by the first endpoint device;
• routing or switching a second set of random bits or keys output from the random number generator for quantum transmission to the second endpoint device over a quantum channel of the QKD link of the second endpoint device via a quantum receiver assigned to the second endpoint device, wherein the second endpoint device uses a second quantum receiving basis for receiving the quantum transmission of the second set of random bits or keys;
• routing or switching an indication of the second set of random bits or keys validly received by the second endpoint device received from the second endpoint device over the classical channel of the QKD link of the second endpoint via a classical transceiver assigned to the second endpoint device;
• routing or switching data representative of the second quantum transmission basis used for transmitting the second set of random bits or keys for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• determining a second intermediate set of symbols associated with the QKD linking apparatus based on discarding those second set of random bits or keys that do not correspond to the received indication of the second set of random bits or keys validly received by the second endpoint device;
• generating an encrypted first intermediate set of symbols using the second intermediate set of symbols;
• routing or switching the encrypted first intermediate set of symbols over the classical channel of the QKD link of the second endpoint via the classical transceiver assigned to the second endpoint device, wherein the second endpoint device decrypts the encrypted first intermediate set of symbols based on deriving the second intermediate set of symbols associated with the QKD linking apparatus from the received second quantum transmission basis and the second quantum receiving basis;
• routing or switching data representative of the first quantum transmission basis and the first quantum receiving basis received from the first endpoint device for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• routing or switching data representative of the second quantum transmission basis and the second quantum receiving basis received from the second endpoint device for classical transmission over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device, wherein the first endpoint device determines a first shared key based on discarding all bits from the received first set of random bits except those bits where the first quantum transmission basis equals the first receiving basis and the second quantum transmission basis equals the second receiving basis, and the second endpoint device determines a second shared key based on discarding all bits from the decrypted first intermediate set of symbols except those bits where the first quantum transmission basis equals the first receiving basis and the second quantum transmission basis equals the second receiving basis;
• routing or switching data representative of error correction and/or privacy amplification in relation to the first and second shared keys over the classical channels of the QKD links of the first and second endpoint devices, wherein the first and second devices determine a final shared key based on the first and second shared keys.

A computer-implemented method for controlling a quantum key distributed, QKD, linking apparatus for use in linking at least two endpoint devices in a QKD network, the QKD linking apparatus comprising:

• a plurality of QKD links, each QKD link having a communication medium comprising a quantum channel and a classical channel, wherein each endpoint is assigned a QKD link connecting said each endpoint to the QKD linking apparatus;
• a quantum communication component comprising a plurality of quantum receivers, each quantum receiver configured for receiving quantum transmissions over a quantum channel of a different one of the QKD links;
• and
• a classical transceiver component comprising a plurality of classical transceivers, each classical transceiver configured for transmitting classical data over a classical channel of one of the QKD links and configured for receiving classical data over the classical channel of said one of the QKD links;
• and
• wherein the method comprises:
• routing or switching data generated for quantum transmission from an endpoint via a quantum receiver assigned to the endpoint over a quantum channel of the QKD link of the endpoint;
• routing or switching classical data for classical transmission to an endpoint via a classical transceiver assigned to the endpoint over a classical channel of the QKD link of the endpoint;
• routing or switching classical data received by a classical transceiver over the classical channel of the QKD link of an endpoint as required;
• and
• performing a QKD protocol between a first endpoint device and a second endpoint device, the method further comprising:
• routing or switching a first set of random bits or keys received by a quantum receiver assigned to the first endpoint device from quantum transmissions from the first endpoint device over a quantum channel of the QKD link of the first endpoint device, wherein the quantum receiver uses a first quantum receiving basis for receiving the quantum transmission of the first set of random bits or keys and the first endpoint device uses a first quantum transmission basis for transmitting the quantum transmission of the first set of random bits or keys;
• routing or switching an indication of the first set of random bits or keys validly received by the quantum receiver to the first endpoint device over the classical channel of the QKD link of the first endpoint device by a classical transceiver assigned to the first endpoint device;
• routing or switching data representative of the first quantum receiving basis used for receiving the first set of random bits or keys to the first endpoint device over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device;
• determining a first intermediate set of symbols associated with the QKD linking apparatus based on discarding those first set of random bits or keys that were not validly received by the quantum receiver assigned to the first endpoint device;
• routing or switching a second set of random bits or keys received by a quantum receiver assigned to the second endpoint device from quantum transmissions from the second endpoint device over a quantum channel of the QKD link of the second endpoint device, wherein the quantum receiver uses a second quantum receiving basis for receiving the quantum transmission of the second set of random bits or keys and the second endpoint device uses a second quantum transmission basis for transmitting the quantum transmission of the second set of random bits or keys;
• routing or switching an indication of the second set of random bits or keys validly received by the quantum receiver to the second endpoint device over the classical channel of the QKD link of the second endpoint device by a classical transceiver assigned to the second endpoint device;
• routing or switching data representative of the second quantum receiving basis used for receiving the second set of random bits or keys to the second endpoint device over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• determining a second intermediate set of symbols associated with the QKD linking apparatus based on discarding those second set of random bits or keys that were not validly received by the quantum receiver assigned to the second endpoint device;
• generating an encrypted first intermediate set of symbols using the second intermediate set of symbols;
• routing or switching the encrypted first intermediate set of symbols over the classical channel of the QKD link of the second endpoint via the classical transceiver assigned to the second endpoint device, wherein the second endpoint device decrypts the encrypted first intermediate set of symbols based on deriving the second intermediate set of symbols associated with the QKD linking apparatus from the received second quantum transmission basis and the second quantum receiving basis;
• routing or switching data representative of the first quantum transmission basis and the first quantum receiving basis received from the first endpoint device for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• routing or switching data representative of the second quantum transmission basis and the second quantum receiving basis received from the second endpoint device for classical transmission over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device, wherein the first endpoint device determines a first shared key based on discarding all bits from the received first set of random bits except those bits where the first transmission basis equals the first receiving basis and the second transmission basis equals the second receiving basis, and the second endpoint device determines a second shared key based on discarding all bits from the decrypted first intermediate set of symbols except those bits where the first transmission basis equals the first receiving basis and the second transmission basis equals the second receiving basis;
• routing or switching representative of error correction and/or privacy amplification in relation to the first and second shared keys over the classical channels of the QKD links of the first and second endpoint devices, wherein the first and second devices determine a final shared key based on the first and second shared keys.

A computer-implemented method for controlling a quantum key distributed, QKD, linking apparatus for use in linking at least two endpoint devices in a QKD network, the QKD linking apparatus comprising:

• a plurality of QKD links, each QKD link having a communication medium comprising a quantum channel and a classical channel, wherein each endpoint is assigned a QKD link connecting said each endpoint to the QKD linking apparatus;
• a quantum communication component comprising a plurality of quantum receivers, each quantum receiver configured for receiving quantum transmissions over a quantum channel of a different one of the QKD links;
• and
• a classical transceiver component comprising a plurality of classical transceivers, each classical transceiver configured for transmitting classical data over a classical channel of one of the QKD links and configured for receiving classical data over the classical channel of said one of the QKD links;
• and
• wherein the method comprises:
• routing or switching data generated for quantum transmission from an endpoint via a quantum receiver assigned to the endpoint over a quantum channel of the QKD link of the endpoint;
• routing or switching classical data for classical transmission to an endpoint via a classical transceiver assigned to the endpoint over a classical channel of the QKD link of the endpoint;
• routing or switching classical data received by a classical transceiver over the classical channel of the QKD link of an endpoint as required;
• and
• performing a QKD protocol between a first endpoint device and a second endpoint device, the method further comprising:
• routing or switching a first set of random bits or keys received by a quantum receiver assigned to the first endpoint device from quantum transmissions from the first endpoint device over a quantum channel of the QKD link of the first endpoint device, wherein the quantum receiver uses a first quantum receiving basis for receiving the quantum transmission of the first set of random bits or keys and the first endpoint device uses a first quantum transmission basis for transmitting the quantum transmission of the first set of random bits or keys;
• routing or switching an indication of the first set of random bits or keys validly received by the quantum receiver to the first endpoint device over the classical channel of the QKD link of the first endpoint device by a classical transceiver assigned to the first endpoint device;
• routing or switching data representative of the first quantum receiving basis used for receiving the first set of random bits or keys to the first endpoint device over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device;
• determining a first intermediate set of symbols associated with the QKD linking apparatus based on discarding those first set of random bits or keys that were not validly received by the quantum receiver assigned to the first endpoint device;
• routing or switching a second set of random bits or keys output from a random number generator for quantum transmission to the second endpoint device over a quantum channel of the QKD link of the second endpoint device via a quantum receiver assigned to the second endpoint device, wherein the second endpoint device uses a second quantum receiving basis for receiving the quantum transmission of the second set of random bits or keys;
• routing or switching an indication of the second set of random bits or keys validly received by the second endpoint device received from the second endpoint device over the classical channel of the QKD link of the second endpoint via a classical transceiver assigned to the second endpoint device;
• routing or switching data representative of the second quantum transmission basis used for transmitting the second set of random bits or keys for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• determining a second intermediate set of symbols associated with the QKD linking apparatus based on discarding those second set of random bits or keys that do not correspond to the received indication of the second set of random bits or keys validly received by the second endpoint device;
• generating an encrypted first intermediate set of symbols using the second intermediate set of symbols;
• routing or switching the encrypted first intermediate set of symbols over the classical channel of the QKD link of the second endpoint via the classical transceiver assigned to the second endpoint device, wherein the second endpoint device decrypts the encrypted first intermediate set of symbols based on deriving the second intermediate set of symbols associated with the QKD linking apparatus from the received second quantum transmission basis and the second quantum receiving basis;
• routing or switching data representative of the first quantum transmission basis and the first quantum receiving basis received from the first endpoint device for classical transmission over a classical channel of the QKD link of the second endpoint device via the classical transceiver assigned to the second endpoint device;
• routing or switching data representative of the second quantum transmission basis and the second quantum receiving basis received from the second endpoint device for classical transmission over a classical channel of the QKD link of the first endpoint device via the classical transceiver assigned to the first endpoint device, wherein the first endpoint device determines a first shared key based on discarding all bits from the received first set of random bits except those bits where the first quantum transmission basis equals the first receiving basis and the second quantum transmission basis equals the second receiving basis, and the second endpoint device determines a second shared key based on discarding all bits from the decrypted first intermediate set of symbols except those bits where the first quantum transmission basis equals the first receiving basis and the second quantum transmission basis equals the second receiving basis;
• routing or switching data representative of error correction and/or privacy amplification in relation to the first and second shared keys over the classical channels of the QKD links of the first and second endpoint devices, wherein the first and second devices determine a final shared key based on the first and second shared keys.