Quantum safe enclaves
AssigneeAmazon Technologies, Inc.
InventorsAntia Lamas Linares, Pavel Lougovski, Eric Jason Brandwine
Life of this patent
Estimating the term…
Abstract
A system and method for establishing and using quantum safe enclaves is described. In some embodiments, secure shared randomness is distributed between nodes, for example using quantum key distribution. The secured shared randomness is used to generate quantum safe network keys that enable quantum safe network links to be established between any of the nodes included in the quantum safe enclave. A network manager enforces policies that restrict communications between nodes of the quantum safe enclave to transmission via quantum safe network links. Such an arrangement protects communicated data from quantum enabled attacks that may compromise other forms of encryption.
Claims20
A system, comprising:
- a plurality of computing devices of a service provider network configured to allocate a quantum safe enclave to a customer of the service provider network, wherein the quantum safe enclave comprises one or more computing resources provisioned as a virtualized computing instance or a bare metal computing instance for use by the customer;
- a plurality of quantum safe network links within the quantum safe enclave, wherein respective ones of the computing devices connected to the quantum safe network links store securely distributed secure shared randomness used to encrypt communications transmitted via the quantum safe network links;
- and
- one or more different computing resources external to the quantum safe enclave configured to implement a network manager configured to:
- enforce one or more policies that limit communications between the computing resources allocated for use by the customer and operated on behalf of the customer within the quantum safe enclave to transmission via respective ones of the quantum safe network links.
A method, comprising:
- provisioning, as a virtualized computing instance or a bare metal computing instance, computing resources of a service provider network to be allocated as a quantum safe enclave for use by a customer of the service provider network;
- receiving a request to move data, between the computing resources allocated for use by the customer, within the quantum safe enclave;
- and
- enforcing, using one or more different computing resources, one or more policies that limit transmission of data within the quantum safe enclave between the computing resources allocated for use by the customer to transmission via one or more quantum safe network (QSN) links whose endpoints share securely distributed shared randomness used to encrypt communications transmitted via the one or more quantum safe network links.
One or more non-transitory, computer-readable media, storing program instructions, that when executed on or across one or more processors, cause the one or more processors to:
- provision, as a virtualized computing instance or a bare metal computing instance, computing resources of a service provider network to be allocated as a quantum safe enclave for use by a customer of the service provider network, wherein the computing resources are separate from the one or more processors;
- receive a request to move data, between the computing resources allocated for use by the customer, within the quantum safe enclave;
- and
- enforce one or more policies that limit transmission of data between the computing resources allocated for use by the customer within the quantum safe enclave to transmission via one or more quantum safe network links whose endpoints share securely distributed shared randomness used to encrypt communications transmitted via the one or more quantum safe network links.
Dependencies are inferred from the claim text.