Abstract: A data content checker arrangement for protecting communication between a sensitive computer system (102) and an external computer system (104). The arrangement includes a store (108) connected to input and output sub-systems (106) and (114) and to content checkers (110) and (112) arranged in parallel. The input and output sub-systems (106) and (114) are connected to the external computer system (104) and the sensitive computer system (102) respectively. Data received from the external computer system (104) is encrypted by the input sub-system (106) using an encryption key to which the content checkers (110) and (112) have access. The content checkers (110) and (112) can therefore decrypt, read and check the data. If the data passes a content checker's checks, the checker digitally signs and stores it, decrypted, in the store (108); if the checks are not passed, the checker discards the data.

Abstract: Methods and apparatus for use in quantum key distribution (QKD) are described. A quantum QKD signal is generated at a source and transmitted through a fibre optic network to an endpoint, a key being agreed with communication over a classical QKD channel. The classical QKD channel contains additional information relevant to a network over which keys are distributed, and may be processed at nodes intermediate between the source and the endpoint.

Abstract: A firewall system employs signature validation hardware communicating via low level communication protocols and with inner and outer host computers, which have network protocol stacks and for implementing complex communication protocols with remote source and destination computers. The source computer has data checker and signature functionalities, which respectively check data and generate digital signatures for data to be transmitted. The inner host computer receives transmitted data and converts it to a lower protocol level at which the hardware operates. The hardware uses digital circuitry for protocols and checking. It validates signatures in data at a software application level, but only requires protocols that are simple and low level. The firewall system communicates with the source and destination computers via high performance connection media.

Abstract: Methods, apparatus, programs and signals for providing communications network security. The approach is based on using established “standard” protocols, but packets (or cells or frames) are deliberately malformed by the sender, optionally according to a predetermined rule (for example by inverting a packet check digit). A filter forwards only packets identified as being invalid, optionally in accordance with the rule; packets which are valid with respect to the “standard” protocol are dropped. The filter is preferably implemented in hardware to mitigate the risk of its being compromised by a malicious attack.

Abstract: A method of establishing a quantum key for use between a first network node (QNode1) and a second network node (QNode3) in a network for carrying out quantum cryptography includes a key agreement step carried out by a third node (QNode2) and the second node (QNode3) and a subsequent authentication step carried out by the first and second nodes directly. As the key agreement step does not involve QNode1, another key agreement step may be simultaneously performed by another pair of network nodes QNode4, QNode5 to agree a quantum key for use by network nodes QNode1 and QNode5. The invention allows respective quantum keys to be established between a network node and each of a set of other nodes more rapidly than is the case if each quantum key is established serially by key agreement and authentication steps.

Abstract: A method of authentication between first (QNodeX) and second (QNodeY) network nodes within a network suitable for implementing quantum cryptography comprises steps in which the first and second nodes each generate a cryptographic hash ([MXY]AI, [MYX]AJ) of a message ([MXY], [MYX]) using respective authentication keys (AI, AJ) shared with a third network node (QNodeW). The messages may be those exchanged between the first and second nodes during agreement of a quantum key to be used between the nodes. An authentication key to be shared by the first and second nodes may be established using the quantum key. The invention therefore allows an authentication key to be established and shared between the first and second network nodes without direct physical intervention. Networks having large numbers of network nodes may be re-keyed following replacement or maintenance of a network node much more quickly and easily than is the case where re-keying is achieved by physically supplying shared authentication keys.

Abstract: The invention relates to methods and apparatus for Quantum key distribution. Such methods including authenticating a first node in a communications network with a remote node in the communications network. The authentication may include connecting an authentication device to the first node, agreeing a quantum key between the first node and the remote node based on a quantum signal transmitted or received by the first node and performing an authentication step between the authentication device and the remote node on an encrypted channel. Authentication between the authentication device and remote node may be taken as authentication of the first node.

Abstract: The present invention relates to an improved quantum signal transmitter, which has a plurality of quantum output channels having at least one optical source and at least one optical splitter acting on the output of said at least one source.

Abstract: A method of key distribution from a first entity to a second entity including the first entity communicating with a moveable key device so as to share a secret data with said moveable key device, relocating said moveable key device to a location having a quantum link with said second entity, transmitting a quantum signal from said moveable key device to said second entity on said quantum link, the quantum signal being based on said secret data; and said first entity and said second entity undertaking key agreement based on the quantum signal received by the second entity. Such a method allows the principles of quantum key distribution to be applied even in the absence of a suitable quantum communications link between the first and second entities.

Abstract: This invention relates to an optical star network in which different communities of users, such as different businesses, are provided through use of quantum key distribution (QKD). At least one QKD device is located at the central hub of the star network and communicates with QKD devices at the endpoints to establish a separate quantum key, i.e. a cryptographic key established by QKD, with each endpoint. A separate key manager is provided for each different community and each key manager is arranged to use the appropriate quantum keys for endpoints within that community to deliver the same community key to each endpoint. This community key can be used by for encrypting network traffic between members of the same community with security. Traffic passing through the network switch is encrypted, but the community keys are not delivered via the switch and hence the switch an error in the switch does not compromise security.

Abstract: A method of performing quantum key distribution across a network. The method involves a first node first agreeing a quantum key with a first intermediate node in the path. Next the intermediate node exchanges a quantum signal with the next node in the path—which is a targeted node. The intermediate node communicates with the first node using the previous established quantum key details of the quantum signal sent or received by the intermediate node. The first node then performs a key agreement step to agree a quantum key directly with the targeted node. Having established a quantum key with the current targeted node the method can be repeated but with the next node in the network path as the targeted node until a destination node is reached. The final quantum key agreed with the destination node can then be used for encrypting communication between those nodes across the network.

Abstract: The method involves exchange of a quantum signal between a first quantum node and a second quantum node as is usual in known quantum key distribution (QKD) scheme. The first quantum node communicates details of the quantum signal it sent or received with a first remote node. The first remote node thus has all the information to required to take the place of the first quantum node in the key agreement step with the second quantum node. The first quantum node may be arranged to transmit the quantum signal to the second quantum node, in which ease the invention provides a distributed quantum transmitter with the control logic in the first remote node being distributed remotely from the actual quantum transmitter in the first quantum node. Communications between the first remote node and first quantum node may comprise or be protected by a quantum key derived by conventional QKD.

Abstract: Method and apparatus for mitigating the effects of security threat involving malicious code concealed in computer files (for example computer viruses, etc.). The method operates by inserting additional strings of arbitrary length within computer files of known type which may contain such security threats. The strings are chosen to have no substantial effect on the files in normal operation, but potentially disrupt attack code located in the file. Inserted sequences may incorporate a character sequence which, if interpreted as code, halts execution of that program. Alternatively, or in addition, character sequences may be deleted or reordered provided that they have no effect on normal interpretation of the file. As a result, the effect of malicious code operating successfully as intended by an attacker may be mitigated. The methods do not require prior knowledge of the nature of a specific threat and so provide threat mitigation for previously unidentified threats.

Abstract: Methods, apparatus, programs and signals for providing communications network security. The approach is based on using established “standard” protocols, but packets (or cells or frames) are deliberately malformed by the sender, optionally according to a predetermined rule (for example by inverting a packet check digit). A filter forwards only packets identified as being invalid, optionally in accordance with the rule; packets which are valid with respect to the “standard” protocol are dropped. The filter is preferably implemented in hardware to mitigate the risk of its being compromised by a malicious attack.

Abstract: Computer system protection to protect against harmful data from an external computer network (60) (e.g. the Internet) involves supplying incoming data (62) to a software checker (64) as the data enters a computer system (not shown). The checker (64) routes any suspect data (66) to an encryptor (68) which encrypts it to render it unusable and harmless. Encrypted data passes to a computer (72) in an internal network (74) and having a desktop quarantine area or sandbox (76) for suspect data. The computer (72) runs main desktop applications (78) receiving encrypted data (70) for storage and transfer, but not for use in any meaningful way because it is encrypted. Equally well applications (78) cannot be interfered with by encrypted data (70) because encryption makes this impossible. On entry into the sandbox (76), the encrypted data (70) is decrypted to usable form it then becomes accessible by software (204) suitable for use in the sandbox (76) subject to sandbox constraints.

Abstract: Computer system protection to protect against harmful data from an external computer network (60) (e.g. the Internet) involves supplying incoming data (62) to a software checker (64) as the data enters a computer system (not shown). The checker (64) routes any suspect data (66) to an encryptor (68) which encrypts it to render it unusable and harmless. Encrypted data passes to a computer (72) in an internal network (74) and having a desktop quarantine area or sandbox (76) for suspect data. The computer (72) runs main desktop applications (78) receiving encrypted data (70) for storage and transfer, but not for use in any meaningful way because it is encrypted. Equally well applications (78) cannot be interfered with by encrypted data (70) because encryption makes this impossible. On entry into the sandbox (76), the encrypted data (70) is decrypted to usable form; it then becomes accessible by software (204) suitable for use in the sandbox (76) subject to sandbox constraints.