Abstract: A key management device according to an embodiment includes one or more hardware processors configured to function as a determination unit, a generation unit, and a supply unit. The determination unit determines a type of request data requested by a request message transmitted from an application that performs encrypted data communication. The generation unit generates a response message including at least one of a random number and an encryption key shared by quantum key distribution (QKD) via a communication network according to a type of the request data. The supply unit supplies the response message to the application.

Abstract: A key management device according to an embodiment is for managing an application key used for encrypting communication of a user network including cryptographic applications. The key management device includes a plan acquisition unit, a plan execution unit, a communication unit, and a provision unit. The plan acquisition unit acquires a key distribution plan formulated based on state information indicating a state of the user network. The plan execution unit determines a distribution amount of the application key for each key sharing destination corresponding to a destination cryptographic application based on the key distribution plan. The communication unit encrypts the application key using a link key generated by QKD, and transmits the encrypted application key to the key sharing destination. The provision unit provides the application key in response to a request from the cryptographic application.

Abstract: A key management device according to an embodiment is a key management device managing an application key for encrypting a communication in an application network including a plurality of applications. The key management device includes a hardware processor configured to function as a collection unit, a calculation unit, a determination unit, and a communication unit. The collection unit collects, using quantum key distribution (QKD), resource information indicating a resource of a link for which a link key is generated. The calculation unit calculates metric for a key relay route including the link on the basis of the resource information. The determination unit determines a key relay route from among a plurality of key relay routes on the basis of the metric. The communication unit uses the key relay route determined by the determination unit to send, to a destination, an application key encrypted with the link key.

Abstract: According to an embodiment, an application-key management system includes a plurality of application-key management devices and a comprehensive management device. The application-key management devices each include: a first memory configured to store an application key in one or more separated logical drives for each sharing destination of the application key shared by quantum cryptographic communication; and a first processor coupled to the first memory. The first processor is configured to: receive, from the comprehensive management device, a deletion request of specifying a logical drive storing the application key to be deleted among the logical drives; and delete the application key stored in the logical drive specified by the deletion request.

Abstract: According to an embodiment, a quantum cryptography communication system includes a quantum cryptography communication device and a key management device. The quantum cryptography communication system includes a generated information supply unit, a reception unit, a determination unit, and a global key supply unit. The generated information supply unit is configured to supply generated information generated by quantum key distribution processing, to the key management device. The reception unit is configured to receive the generated information from the quantum cryptography communication device. The determination unit is configured to determine a ratio at which the generated information is used for a global key random number for each encrypted data communication destination. The global key supply unit is configured to supply a global key generated from the global key random number to an application connected to the key management device.

Abstract: According to an embodiment, an application-key management system includes a plurality of application-key management devices and a comprehensive management device. The application-key management devices each include: a first memory configured to store an application key in one or more separated logical drives for each sharing destination of the application key shared by quantum cryptographic communication; and a first processor coupled to the first memory. The first processor is configured to: receive, from the comprehensive management device, a deletion request of specifying a logical drive storing the application key to be deleted among the logical drives; and delete the application key stored in the logical drive specified by the deletion request.

Abstract: According to an embodiment, a quantum cryptographic device includes a memory and one or more processors coupled to the memory. The one or more processors are configured to: tabulate information on an application key transmitted and received by using a quantum cryptographic key and output an application-key information tabulation result; calculate a unit price of the application key based on the application-key information tabulation result; and display information that is display information including the unit price of the application key.

Abstract: According to an embodiment, an information processor includes a memory and one or more hardware processors coupled to the memory. The one or more hardware processors are configured to function as a calculating unit, a determining unit, and a generating unit. The calculating unit is configured to calculate a key length. The determining unit is configured to determine a block size corresponding to a unit of processing in key generation and an outputtable size indicating the size of a key outputtable by the key generation. The generating unit is configured to generate a key having the key length by a hash operation using a matrix having a size determined by the block size and the outputtable size.

Abstract: According to an embodiment, an information processor includes a memory and one or more hardware processors coupled to the memory. The one or more hardware processors are configured to function as a calculating unit, a determining unit, and a generating unit. The calculating unit is configured to calculate a key length. The determining unit is configured to determine a block size corresponding to a unit of processing in key generation and an outputtable size indicating the size of a key outputtable by the key generation. The generating unit is configured to generate a key having the key length by a hash operation using a matrix having a size determined by the block size and the outputtable size.

Abstract: According to an embodiment, a communication device includes a receiver, an allocator, a first communication unit, an encryption processor, a second communication unit, and a controller. The receiver is configured to receive a shared key shared with another device. The allocator is configured to allocate the shared key to a transmission key or a reception key. The first communication unit is configured to receive data from an application. The encryption processor is configured to encrypt the data with the transmission key and decrypt the data encrypted by the other device with the reception key. The second communication unit is configured to communicate with the other device by using the encrypted data. The controller is configured to control at least one of allocation of the shared key, traffic of the first communication unit, and traffic of the second communication unit, by using state information of the device.

Abstract: According to an embodiment, a quantum key distribution device includes first and second operation units. The first operation unit is configured to perform a first operation as a key distillation operation. The first operation unit includes a hardware circuit for performing a part of the first operation. The key distillation operation includes a sifting operation for a photon bit string generated through quantum key distribution with another quantum key distribution device via a quantum communication channel. The second operation unit is configured to perform a second operation as a key distillation operation other than the first operation. The second operation unit includes a circuit for a part of the second operation. The first operation unit stores intermediate data generated by the first operation. The second operation unit generates, by the second operation, a cryptographic key being the same as for the another quantum key distribution device from the intermediate data.

Abstract: According to an embodiment, a communication device is connected with another communication device through a quantum communication channel with a shared encryption key. The device includes a communication unit, a sifter, a corrector, a calculator, and an extractor. The communication unit is configured to acquire a sequence of photons through the quantum communication channel and acquire a photon bit string corresponding to the sequence of photons. The sifter is configured to generate a shared bit string from the photon bit string by sifting processing using basis information. The corrector is configured to generate a corrected bit string by correcting an error included in the shared bit string. The calculator is configured to generate a hash-calculated bit string by performing hash calculation on the corrected bit string. The extractor is configured to extract, as the key, from the hash-calculated bit string, a bit string having the length of the key.

Abstract: According to an embodiment, a communication device is connected with external devices by quantum communication channels and a classical communication channel, and generates an encryption key with photons exchanged over the quantum communication channel. The communication device includes an acquirer, a calculator, a selector, and a communicating unit. The acquirer is configured to acquire a quantum error rate for each quantum communication channel. The calculator is configured to calculate a metric of a first path to each external device based on the quantum error rate. The selector is configured to select a second path in the classical communication channel to a specific one of the external devices based on the metric. The communicating unit is configured to transmit an application key to the specific one of the external devices over the second path.

Abstract: According to one embodiment, a key sharing device includes one or more processors function as a plurality of individual processing units. Each of the individual processing units performs any one of a plurality of individual processing operations included in processing that generates a cryptographic key by quantum key distribution. The cryptographic key is shared between the key sharing device and another key sharing device. The individual processing unit includes a control unit that controls execution of the corresponding individual processing operation according to a usage state of a storage that stores result information at least one of a result of an individual processing operation and identification information for identifying the result.

Abstract: According to an embodiment, a communication device includes an acquirer and a determiner. The acquirer is configured to acquire a first history value for each of one or more applications that use an encryption key. The first history value indicates a history value of a volume of the encryption key used by the each of one or more applications. The determiner is configured to determine a volume of the encryption key to be assigned to the corresponding application, according to the first history value.

Abstract: According to an embodiment, a communication device includes a receiver, an allocator, a first communication unit, an encryption processor, a second communication unit, and a controller. The receiver is configured to receive a shared key shared with another device. The allocator is configured to allocate the shared key to a transmission key or a reception key. The first communication unit is configured to receive data from an application. The encryption processor is configured to encrypt the data with the transmission key and decrypt the data encrypted by the other device with the reception key. The second communication unit is configured to communicate with the other device by using the encrypted data. The controller is configured to control at least one of allocation of the shared key, traffic of the first communication unit, and traffic of the second communication unit, by using state information of the device.

Abstract: According to an embodiment, a quantum key distribution device includes a quantum key distributor, a sifter, a corrector, an identifier, a classifier, a calculator, and a privacy amplifier. The quantum key distributor obtains a photon string from a photon string of two or more intensities of light pulses. The sifter obtains pulse information indicating the light pulse to which each bit of a shared bit string corresponds. The corrector corrects an error included in the shared bit string and generates a post-correction bit string. The identifier generates error position information. The classifier classifies each bit of the post-correction bit string. The calculator calculates the error rate for each light pulse and each base using the error position information. The privacy amplifier generates a cryptographic key from the post-correction bit string on the basis of the error rate.

Abstract: According to an embodiment, a communication device is connected with another communication device through a quantum communication channel with a shared encryption key. The device includes a communication unit, a sifter, a corrector, a calculator, and an extractor. The communication unit is configured to acquire a sequence of photons through the quantum communication channel and acquire a photon bit string corresponding to the sequence of photons. The sifter is configured to generate a shared bit string from the photon bit string by sifting processing using basis information. The corrector is configured to generate a corrected bit string by correcting an error included in the shared bit string. The calculator is configured to generate a hash-calculated bit string by performing hash calculation on the corrected bit string. The extractor is configured to extract, as the key, from the hash-calculated bit string, a bit string having the length of the key.

Abstract: According to an embodiment, a communication device is connected to a first network and a second network. The communication device includes a generating unit and a converting unit. The generating unit is configured to generate a first set of route information that is route information of the first network. The converting unit is configured to convert the first set of route information, and generate a second set of route information that is route information of the second network.

Abstract: According to an embodiment, a communication apparatus includes a cryptographic key storage, a transmitter, a receiver, and a sharing controller. The cryptographic key storage stores therein one or more cryptographic keys shared with an external device. The transmitter transmits specifying information that specifies at least one of the cryptographic keys to the external device. The receiver receives determination information that indicates a result of determination, which is made by the external device based on the specifying information, on whether the shared cryptographic key is consistent between the apparatus and the external device. When receiving the determination information indicating that the shared cryptographic key is inconsistent between the apparatus and the external device, the sharing controller deletes the cryptographic key specified by the specifying information from the cryptographic key storage.