Yang Fang-Li, Guo Ying, Shi Jin-Jing, Wang Huan-Li, Pan Jin-Jin. Improving continuous-variable quantum key distribution under local oscillator intensity attack using entanglement in the middle. Chinese Physics B, 2017, 26(10): 100303
Permissions
Improving continuous-variable quantum key distribution under local oscillator intensity attack using entanglement in the middle
Yang Fang-Li1, Guo Ying2, †, Shi Jin-Jing2, Wang Huan-Li3, Pan Jin-Jin1
College of Electronic Information and Automation, Guilin University of Aerospace Technology, Guilin 541000, China
School of Information Science and Engineering, Central South University, Changsha 410083, China
Guilin Public Works Section of High Speed Railway, Nanning Railway Bureau, Guilin 541000, China
Project supported by the National Natural Science Foundation of China (Grant Nos. 61379153, 61401519, and 61572529), the Natural Science Foundation of Hunan Province, China (Grant No. 2017JJ3415), the Science and Technology Project of Guangxi Zhuang Autonomous Region, China (Grant Nos. AC16380094 and 1598008-29), and the Natural Science Fund of Guangxi Zhuang Autonomous Region, China (Grant No. 2015GXNSFAA139298).
Abstract
A modified continuous-variable quantum key distribution (CVQKD) protocol is proposed by originating the entangled source from a malicious third party Eve in the middle instead of generating it from the trustworthy Alice or Bob. This method is able to enhance the efficiency of the CVQKD scheme attacked by local oscillator (LO) intensity attack in terms of the generated secret key rate in quantum communication. The other indication of the improvement is that the maximum transmission distance and the maximum loss tolerance can be increased significantly, especially for CVQKD schemes based on homodyne detection.
Quantum key distribution (QKD) firstly transmits quantum signals in the insecure quantum channel and then shares the secret keys through a classical authenticated channel.[1,2] Since the first demonstration of continuous-variable quantum field was presented in 1998,[3] the continuous-variable quantum key distribution (CVQKD)[4–12] has achieved a great development. Compared with the original discrete-variable protocols, the CVQKD schemes exhibit several advantages, including easier generation of the used Gaussian states[13] and a far quicker repetition rate. As is well known, the traditional Gaussian CVQKD protocols can be classified by three parts, that is the sender’s state,[14,15] the receiver’s detection,[16] and the reconciliation algorithm.[17,18] Over the years, the CVQKD has become a well-established technology in theory and experiment. Its security has been improved greatly in comparison with the optimal collective attacks.[19–21] Moreover, the CVQKD protocols based on the entanglement properties of two-mode squeezed states[22,23] can distribute the deterministic key.[22] Nowadays, a measurement-device-independent quantum key distribution (MDI-QKD)[24–27] has been demonstrated to be technically practical, which can guarantee the information security, and has received considerable attention.
However, in an ideal CVQKD protocol,[28–31] only the signal is considered and the local oscillator (LO) is ignored. Practically, the LO signal and the Alice’s signal, which have the same initial polarization and phase with each other, are derived from Alice in a quantum channel simultaneously[12,32] to control the LO phase drift[33] as small as possible. In this case, not only could the Alice’s signal be intercepted but also the LO signal could be eavesdropped and manipulated by Eve. Eve can attack the channel via reducing the LO intensity without being discovering, and this is referred to as LO intensity attack (LOIA) which leads to some security concerns[34,35] in the CVQKD protocol. Consequently, monitoring the LO intensity is a necessary operation to guarantee security. However, the true secret key rate or equivalently monitored key rate was demonstrated to be compromised severely which was described in Ref. [34]. Therefore, what we need to do urgently is to find an approach to enhance the effected performance of the CVQKD protocol under LOIA, we call it as the LOIA–CVQKD protocol.
During the past decade, in regard to both security proofs[36–38] and practical demonstrations,[39,40] the entangled source generated from Eve in the middle has become a focus of discrete-variable QKD. Analogously, in the CVQKD field, Christian proposed protocols[30] where the entanglements were derived from the distrusted Eve, rather than from the legitimate Alice or Bob. The result in Ref. [30] showed that this method can effectively compensate the effect of loss and hence improve secret key rates between Alice and Bob. Based on this background, we conquer the above-mentioned problems in LOIA–CVQKD by changing the structure of the trusted participator originating entanglement to that of Eve preparing the source in the middle. We define the modified LOIA–CVQKD as the middle-based LOIA–CVQKD and analyze protocols on the secret key rates, working distances, and channel losses.
The rest of this paper is organized as follows. We will review the original LOIA–CVQKD protocol in Section 2. In order to improve the performance of the LOIA–CVQKD protocol, in Section 3, we describe the proposed CVQKD scheme in detail. In Section 4, we discuss the efficiency of the middle-based LOIA–CVQKD protocols and perform some simulations. Section 5 gives a brief conclusion.
2. The original LOIA–CVQKD protocol
We introduce a practical coherent state LOIA–CVQKD protocol with homodyne measurement as shown in Fig. 1. For simplicity, we do not consider other three protocols in this section. In the EB system, Alice first generates an EPR state and the LO signal is divided at a beam splitter (BS) as a classical LO and a low intensity signal. In Alice side, heterodyne detection on mode A0 (one half mode of the EPR modes) is implemented by mixing A0 with the auxiliary vacuum C0 into the BS1 and homodyning the outputs A and C to obtain PA and XA respectively. Then Alice projects the other half of the EPR mode B0 on a quantum state. In a practical protocol, the quantum signal and the local oscillator travel through the same insecure channel monitored by Eve. As for the PA and XA, although the satisfactory Gaussian distributions are different from each other, they have the same variance and VA is the modulation variance of the source. A realistic homodyne detection with efficiency can be described by placing a beamsplitter of transmittance before an ideal homodyne detector with input . We assume this measurement is perfect, so the efficiency and then . Before Bob performing homodyne detection, he achieves the mode given by
where the channel transmission is ∂ and denotes Eve’s mode introduced with the quadrature variance M. If the original intensity of LO is not monitored and the fluctuation is not quantified, Bob will perform the measurement
with the proportional LO intensity coefficient κ limited in the range of , where is (or identically ). In the following, we assume that the parameter κ of each pulse is equivalent for simplicity. In practical implementation, the fluctuation of the LO intensity opens a loophole which can be catched by Eve. She attacks not only the signal with conventional Gaussian collective attack, but also the LO with a peculiar intensity attenuation. There appears a serious problem, that is, the so-called LOIA can be partially hidden, since Eve uses the non-changing phase attenuator to reduce the intensity of LO.
Fig. 1. The original structure of LOIA–CVQKD protocol based on Alice, generating EPR state and LO signal by laser. Eve performs LO intensity attenuation attack, which consists of attacking the signal beam with a traditional Gaussian collective attack with unitary operation and attacking LO with intensity attenuation by a non-changing phase attenuator .
The covariance matrixes[34] between Alice’s mode A and Bob’s mode B read,
WHERE σz represents the Pauli matrix and is an identity matrix. From Eq. (3), we obtain a = V, , and . In addition, the total added noise is defined as with excess noise . Another covariance matrix between the two modes reads,
Note that the superscript n indicates the intensity of the LO. In this case, the total added noise is with .[30] As a consequence, when Bob monitors the channel at destination, the channel transmission is ∂ and the excess noise is . Without monitoring, the two variances become and , respectively. If Eve wants to steal the largest amount of information while cannot be discovered, she must reduce εn to zero and introduce a noise M
3. The middle-based LOIA–CVQKD protocol
Inspired by the method in Ref. [30], the middle-based LOIA–CVQKD protocol is proposed. The goal of our exploration is to improve the performance of the CVQKD under Eve’s LOIA; see Fig. 2. In other words, the structure of the LOIA–CVQKD is modified by generating the entanglements from a distrusted eavesdropper Eve in the middle instead of preparing from the legal party Alice or Bob.
Fig. 2. The proposed structure of middle-based LOIA–CVQKD protocol where the EPR source and the LO signal are placed in the middle between Alice and Bob. Eve’s attack consists of two LOIAs on either side of the entangled source. Alice and Bob can implement either homodyne or heterodyne detection with direct or reverse reconciliation.
In our new scheme, the entangled source, a Gaussian state of variance V, is derived from the middle of the transmission based on a laser beam that generates the EPR state while producing two local oscillators LO and LO . The modes A0 and B0 are emitted by the entangled source as the two-mode squeezed vacuum state. Alice and Bob independently implement measurement for one of two quadratures between the measured mode and the corresponding LO (LOA and LOB). The rotated quadratures are and , where α is referred to as the relative phase of the signal A and LOA. Similarly, ψ is the relative phase between the signal B and LOB. Figure 2 shows that Eve’s attack consists of two LOIAs on each side of the source. The loss of the quantum channel of the protocol is described by the channel transmittances ∂1 and ∂2 with . It can be seen that Alice is the sender to create the initial entangled state where . In the middle-based protocol, the channels are symmetric, i.e., . The Gaussian variances of the two entangled modes A0 and B0 are symmetric too, i.e., .
When the system is monitored, the middle-based covariance matrix of Alice’s mode A and Bob’s mode B is shown as
where , , , , and . The superscript m represents the entanglement placed in the middle. When the channel is free of monitoring, the channel excess noise between Alice and Eve is
Considering the LOIA in the improved scheme, we obtain the equation for noise M1
Similarly, we can calculate the noise
related to the transmission ∂2, which is symmetric to ∂1. Obviously, the result is concluded by .
When the entangled source is originated in the middle, the usual eight protocols[31] in entanglement-based CVQKD schemes can be summarized as four, which lies on the type of measurement used by Alice and Bob. As shown in Fig. 2, Alice applies a beam splitter (BS1) of transmittance TA over mode A, if we fix () the homodyne (heterodyne) detection is done by Alice, resulting in preparing squeezed (coherent) states. Similarly, Bob can realize homodyne (heterodyne) detection by selecting the transmittance () of the beam splitter (BS2) used by him. If Alice and Bob employ a same type of measurement, which means , there is no difference between direct and reverse reconciliation protocols.[31] Therefore, the explicit equivalences between the middle-based protocols can be summarized as follows: (i) For squeezed states with (coherent states with ) and homodyne detection with (heterodyne detection with ), direct and reverse reconciliation protocols can be seen to be the same. (ii) Direct (reverse) reconciliation protocols based on coherent states and homodyne detection are equivalent for reverse (direct) reconciliation schemes on basis of squeezed states and heterodyne detection.
4. Secret key rates
To demonstrate the effectiveness of the middle-based method on performances, the secret key rates of coherent states protocols are analyzed and for simplicity the squeezed states protocols are not be considered, as they are analogous to the coherent states protocols. A detailed investigation of the secret key rate of a monitored CVQKD based on direct reconciliation is described as
where IAB is cited as the Shannon mutual information of Alice and Bob, while χAE is the Holevo bound of Alice and Eve. The modulation variance VA and Bob’s measurements on Alice’s encodings VB can be given, separately, by
The conditional variance reads
Accordingly, the conditional variances in the middle-based system are obtained as
and
A monitoring is used to guarantee the instantaneous changed LO intensity in the practical protocol. The practical or unconditional secure secret key rate RR and the monitoring secret key rate R are equal when the CVQKD system is attacked by LOIA, which is proved in Ref. [34].
Alice and Bob’s mutual information of coherent states CVQKD with homodyne or heterodyne detection are calculated, respectively, by
where . Eve and Alice’s mutual information was mentioned by many publications[30,31] and can be displayed as
To derive χAE, we should figure out the computing methods of and . Fortunately, can be obtained by using the fact that system E can apply a purification of the system AB. What is more, is relevant to the eigenvalues λ1 and λ2 of γAB, so the equation is
where
with , , and . Two separate calculations performed as Alice’s measurement are different according to homodyne or heterodyne detection applied by Bob in the coherent states CVQKD. Firstly, the homodyne detection is introduced. The system BCE is pure with the purification arguments, so . The modes A and C can be mixed in a beam splitter (BS), then the covariance matrix is gained by an operation of homodyne over mode A, as is correlated with the symplectic eigenvalues of . This process is described as
System BS acts on mode A and mode C then we can gain the symplectic transformation . After Alice uses homodyne measurement, the correlation matrix reads,
Thus the conditional Von Neumann entropy based on homodyne detection is
where with and .
Then, the conditional von Neumann entropy is calculated when Bob heterodynes the incoming mode B. That is
with .
The efficiencies of the middle-based LOIA–CVQKD protocol in terms of the secret key rates and the maximal channel losses will be illustrated in this section. There are several parameters affected the performances of the respective systems, such as the variance of entangled source V, the transmission κ of LO, and channel losses.
So far we have assumed the parameter V = 20 to study the effects of κ on the coherent states protocols with the homodyne detection as shown in Fig. 3 and the heterodyne detection as shown in Fig. 4. The practical secret key rates of the middle-based LOIA–CVQKD are denoted by solid lines, and the practical secret key rates of the initial LOIA–CVQKD without the entangled source in the middle are represented by the dashed lines. The secret rates and maximum channel losses can be increased with the increase of κ, both for the middle-based and the original LOIA–CVQKD protocols. Noting that the dashed and solid lines meet at point A(0.66, 0.85) corresponding to κ = 0.97 and B(0.68,0.95) corresponding to κ = 0.99 as shown in Fig. 3. The point A(0.66, 0.85) is taken as an example from which we can see that if the channel loss is greater than 0.66 dB, the key rate of the middle-based protocol is far higher than that of the original one under the LOIA. While if the value is lower than 0.66 dB, the secret key rate of the former is slightly lower than the latter. In view of the above characteristic, the abscissa value of intersection is defined as the threshold value. Therefore, as the heterodyne case shown in Fig. 4, the threshold value is 1.03 dB and 0.91 dB when κ = 0.97 and κ = 0.99. By comparison, we find the homodyne threshold value is smaller than the heterodyne one when the κ value of the two types of protocols is the same. Thus the middle-based method with the homodyne detection may play a positive role in performance earlier than that in performing heterodyne detection. In Fig. 3, when κ = 0.99 (red lines), the maximum gap of the channel losses between the solid lines and dashed ones in the same color appears, and a similar result can be seen in Fig. 4. What the phenomenon indicates that the performance of the middle-based LOIA–CVQKD is improved as the value of κ increases. By studying the data of Figs. 3 and 4, the maximum gap of the homodyne case is 21.04 dB. Obviously, it is much bigger than that of the heterodyne detection protocol, which is about 0.09 dB.
Fig. 3. (color online) The balances between the secret key rates and the maximal channel losses of the middle-based and the original LOIA–CVQKD protocols with coherent states and homodyne detection for the given parameters V = 20, .
Fig. 4. (color online) The balances between the secret key rates and the maximal channel losses of the middle-based and the original LOIA–CVQKD protocols with coherent states and heterodyne detection for the given parameters V = 20, .
The effect of V on the performance of the schemes is also taken into account with parameter κ = 0.99. From the Figs. 5 and 6, we can find that the efficiency of all protocols can be enhanced with the increase of the value of V. As displayed in Fig. 5 or Fig. 6, with the different values of the parameter V the threshold values are different. For example, when Bob employs the heterodyne detection, the threshold values of protocols with V = 10 and V = 20 are 0.77 dB and 0.68 dB, respectively. By comparisons, it is found that in protocols based on the heterodyne detection the bigger value of parameter V, which is controlled in an appropriate range, may cause a faster key rate of the growth. Moreover, by observing the simulation results of Figs. 3, 4, 5, and 6, we conclude that the middle-based schemes based on coherent states and the homodyne detection can circumvent the 3-dB loss limit while the heterodyne detection cases cannot. Note that when the quantum channel is attacked under the LOIA, the secret key rates can be compromised severely. Fortunately, this problem can be solved via the entanglement in the middle when channel loss reaches the threshold value.
Fig. 5. (color online) The balances between the secret key rates and the maximal channel losses of the middle-based and the original LOIA–CVQKD protocols with coherent states and homodyne detection for the given parameters κ = 0.99, .
Fig. 6. (color online) The balances between the secret key rates and the maximal channel losses of the middle-based and the original LOIA–CVQKD protocols with coherent states and heterodyne detection for the given parameters κ = 0.99, .
As is well known, the channel loss = aL dB is certificated and L represents the transmission distance between Alice and Bob with channel loss coefficient of optical fiber a = 0.2 dB/km, thus we can conclude from our study that the maximum transmission distance can increase almost 105.2 km for the homodyne detection, while that for the heterodyne detection is about 0.45 km when V = 20 and κ = 0.99. Compared with the striking effect of the middle-based LOIA–CVQKD on the homodyne detection, the effect on the heterodyne detection is much less. All the results show that it is much beneficial to originate the entanglement in the middle with appropriate parameters V and κ to balance the high secret key rate and the transmission distance for the LOIA–CVQKD based on cohere states.
5. Conclusion
In this paper, we proposed the LOIA–CVQKD protocols with the entanglement in the middle. The most obvious superiority of the modified protocols is that the larger tolerance to loss can be received over the lossy channel in comparison with the original protocols under LOIA. Alternative advantage is found in increasing the secret key rates of the schemes when channel loss reaches the threshold value. In addition, by choosing appropriately the system parameters κ and V, the performance of the protocols can be enhanced to some extent. By studying the threshold values of the simulation data, we find the middle-based method in the homodyne detection can play a positive role in performance earlier than that in the heterodyne detection. Furthermore, especially the simulation results indicate that if Bob homodynes the incoming mode B, the improved protocol can conquer the 3-dB loss limit while the heterodyne protocol cannot realize this goal, even though other conditions are identical. By comparing the above two cases, we conclude that the entanglement in the middle is more suitable for LOIA–CVQKD protocols with the homodyne detection than that with the heterodyne detection.
