Adva Optical Networking Se

Adtran Networks Se

Adva Network Security Gmbh

Joo Yeon Cho

Andrew Sergeev

Michael Rabinovich

Shihuan Zou

Helmut Grießer

There is provided a technique of securing clock synchronization between master clock node (MCN) and client clock node (CCN). During a cycle of exchanging PTP messages between MCN and CCN, MCN generates an associated paired message for each PTP message generated thereby and informative of tor ttimestamps provided by MCN and sends each paired message to a validation entity (VE) via a secured channel between MCN and VE. When PTP messages traverse transparent clock nodes (TCN) between MCN and CCN, each TCN generates a paired message for each version of PTP message updated thereby and sends each generated paired message to VE via a secured channel between respective TCN and VE. VE uses the received paired messages to provide a validation of the cycle, wherein synchronization-related task(s) (e.g. clock correction by the client clock node, etc.) are provided only subject to successful validation of the cycle by VE.

Secured clock synchronization in a packet-compatible network

A method and system for performing a secure key relay of an encryption key, K, provided by an initial node, KN, and used by an encoding unit (ENC) of a first data transceiver for encoding plain data, P, to provide encrypted cipher data, C, transported via a data transport link, DTL, to a decoding unit (DEC) of a second data transceiver which decodes the transported cipher data, C, using the relayed encryption key, K, provided by a terminal node, KN, as a decoding key to retrieve the plain data, P, wherein the relay of the encryption key, K, from the initial node, KN, to the terminal node, KN, is performed by means of intermediate relay nodes, KN, KN. . . KN, and comprises the steps of sharing (S) QKD-keys, K, between the nodes via secure quantum channels, QCH, of a quantum key distribution network, QKDN; performing (S) encryption of shared QKD-KEYS, K, at the initial node, KN, and at each intermediate relay node, KN, KN. . . KN, and blinding them with a blinding value, S, of the respective node to provide an encrypted cipher key, CK, by the initial node, KN, and by each intermediate relay node, KN, KN. . . KN; distributing (S) or pre-distributing the blinding values, S, of the initial node, KN, and of each intermediate relay node, KN, KN. . . KN; transmitting (S) the encrypted cipher keys, CK, of the initial node, KN, and of each of the intermediate relay nodes, KN, KN. . . KN, to the terminal node, KN; performing (S) by the terminal node, KN, logic operations on reconstructed or pre-distributed blinding values, S, on the basis of the encrypted cipher keys, CK, received by the terminal node, KN, from the initial node, KN, and received from each of the intermediate relay nodes, KN, KN. . . KN, to provide the encryption key, K, used by the decoding unit (DEC) of the second data transceiver as a decoding key to retrieve the plain data, P.

Method and system for performing a secure key relay of an encryption key

There is provided a technique of establishing encryption keys for communication between 1peer and 2peer via a data path. The technique comprises: by each peer, using input keying material to independently generate equivalent pairs of peer encryption keys (PEKs), verifying equivalence of the generated PEK pairs, and using by 1peer and 2peer the verified PEK pairs to become in possession of equivalent pairs of session encryption keys (SEKs). Verifying comprises: generating by 1peer a first handshake (HS) message encrypted by PEK Tx1 and sending the first HS message to the 2peer via the data path; decrypting by the 2peer the first HS message using the PEK Rx2, generating a second HS message encrypted by PEK Tx2, and sending the second HS message to the 1peer via the data path; and decrypting the second HS message by the 1peer using PEK Rx1.

Growing community of inventors

Wolfratshausen, Germany

Joo Yeon Cho