Quantum-safe data center interconnects
1 like492 views
The document discusses the vulnerabilities of data center interconnections (DCI) to interception and the risks posed by quantum computers to encrypted data communication. It highlights the importance of quantum-key distribution (QKD) and post-quantum cryptography (PQC) as solutions for achieving quantum-safe key exchanges. Various deployment scenarios and examples of implementing quantum-safe solutions in regional networks are presented.
Quantum-safe data center interconnects
- 1. Quantum-safe data center interconnects OIDA Executive Forum 2019 – Panel 4: Commercial QKD & Encryption Jörg-Peter Elbers A practitioner’s guide
- 2. © 2019 ADVA Optical Networking. All rights reserved.22 Intercepting data center traffic is easy and can reveal a vast amount of critical data Why do we care? Data center interconnect (DCI) DWDM interception devices 10 to 100Gbit/s, direct detect and coherent Data center A Data center B Fiber tapping devices
- 3. © 2019 ADVA Optical Networking. All rights reserved.33 On-the-fly encryption secures data communication over insecure channels What can we do? AES-256 Public channel Secret key K Message M Message M Alice Bob Secret key K Cyphertext C Diffie- Hellman Diffie- Hellman Key exchange Encrypted data transmission AES-256
- 4. © 2019 ADVA Optical Networking. All rights reserved.44 Quantum computers put secrecy of encrypted data communication at risk What changes with quantum computers? Data center A Data center B
- 5. © 2019 ADVA Optical Networking. All rights reserved.55 • Provides computational security • Is based on difficulty of math problems • Works on any communication channel • Requires endpoint protocol access only • Is independent of optical layer • Provides information-theoretic security • Is based on laws of quantum physics • Needs optical fiber or free-space channel • Requires access to physical infrastructure • Depends on optical link performance Quantum-key distribution (QKD)Post-quantum cryptography (PQC) Note: Security is only as strong as the weakest link in the chain How can we make the key exchange quantum-safe?
- 6. © 2019 ADVA Optical Networking. All rights reserved.66 Long-haul DCI link DCI via Layer 1 VPNMetro DCI link What are practical DCI deployment scenarios? Dark fiber(s) Amplified optical link (Multi-) operator network Simplest case Can use separate fiber for QKD Typically <100km QKD needs trusted nodes and careful link engineering Can only use PQC (no optical layer access) #1 #2
- 7. © 2019 ADVA Optical Networking. All rights reserved.77 UK regional network EU research networkFinancial institution Some quantum-safe deployment examples Cambridge Adastral Park, Ipswich QKD with trusted nodes Encyrpted DWDM & quantum signal on same fiber Multi-vendor QKD support Open key exchange interface Quantum channel Encrypted data channels <40km point-to-point link
- 8. © 2019 ADVA Optical Networking. All rights reserved.88 Key exchange schemes can be combined to provide robust quantum-safe solutions Do I need to decide on one key exchange scheme? AES-256-GCM AES-256-GCM Secret key K Message M Message M Alice Bob Ciphertext C Diffie- Hellman Diffie- Hellman Post quantum Post quantum Key combiner Key exchange Key exchange QKD QKD Key exchange Secret key K Key combiner
- 9. Thank you IMPORTANT NOTICE The content of this presentation is strictly confidential. ADVA Optical Networking is the exclusive owner or licensee of the content, material, and information in this presentation. Any reproduction, publication or reprint, in whole or in part, is strictly prohibited. The information in this presentation may not be accurate, complete or up to date, and is provided without warranties or representations of any kind, either express or implied. ADVA Optical Networking shall not be responsible for and disclaims any liability for any loss or damages, including without limitation, direct, indirect, incidental, consequential and special damages, alleged to have been caused by or in connection with using and/or relying on the information contained in this presentation. Copyright © for the entire content of this presentation: ADVA Optical Networking. jelbers@advaoptical.com