RANDOMIZED ANCILLARY QUBIT OVERCOMES DETECTOR -CONTROL AND INTERCEPT -RESEND HACKING OF QUANTUM KEY DISTRIBUTION

2025-04-29 0 0 4.53MB 17 页 10玖币

侵权投诉

RANDOMIZED ANCILLARY QUBIT OVERCOMES

DETECTOR-CONTROL AND INTERCEPT-RESEND HACKING

OF QUANTUM KEY DISTRIBUTION

Salem F. Hegazy

National Institute of Laser Enhanced Sciences,

Cairo University,

Giza 12613, Egypt

salem@niles.cu.edu.eg

Salah S. A. Obayya

Center for Photonics and Smart Materials,

Zewail City of Science and Technology,

Giza 12578, Egypt

sobayya@zewailcity.edu.eg

Bahaa E. A. Saleh

CREOL, The College of Optics & Photonics,

University of Central Florida,

Orlando, FL, 32816, USA

besaleh@creol.ucf.edu

October 5, 2022

ABSTRACT

Practical implementations of quantum key distribution (QKD) have been shown to be subject to

various detector side-channel attacks that compromise the promised unconditional security. Most

notable is a general class of attacks adopting the use of faked-state photons as in the detector-control

and, more broadly, the intercept-resend attacks. In this paper, we present a simple scheme to overcome

such class of attacks: A legitimate user, Bob, uses a polarization randomizer at his gateway to distort

an ancillary polarization of a phase-encoded photon in a bidirectional QKD conﬁguration. Passing

through the randomizer once on the way to his partner, Alice, and again in the opposite direction,

the polarization qubit of the genuine photon is immune to randomization. However, the polarization

state of a photon from an intruder, Eve, to Bob is randomized and hence directed to a detector in a

different path, whereupon it triggers an alert. We demonstrate theoretically and experimentally that,

using commercial off-the-shelf detectors, it can be made impossible for Eve to avoid triggering the

alert, no matter what faked-state of light she uses.

1 Introduction

The unconditional security offered by quantum key distribution (QKD) relies on laws of quantum physics [

], which

dictate that any attempt by an adversary to know about the secret key, would inevitably introduce disturbance that alerts

the legitimate parties [

]. This ultimate information-theoretic security has been proved for idealized devices [

]

and also under semi-realistic conditions [

]. In practice, however, real-life components of QKD systems may

deviate from these idealized theoretical models, or encounter new scenarios, offering effective vulnerabilities to the

adversary.

For instance, the imperfect preparation of the single-photon state may lead to leaking information about the key.

This gap between theory and real-life practice allows for a plethora of source-side attacks ranging from the photon-

number-splitting (PNS) attack [

], the phase-remapping attack [

], the wavelength-selected photon-number-

splitting attack [

], and the pattern-effect attack [

], to the nonrandom-phase attacks based on unambiguous-state-

discrimination [16], and laser seed control [17,18,19].

arXiv:2210.01204v1 [quant-ph] 3 Oct 2022

APREPRINT - OCTOBER 5, 2022

Compared to the source-side attacks, imperfections on the detection side are known to show much higher vulnerability

to quantum hacking [

]. For example, detector imperfections such as breakdown ﬂuorescence [

], ﬁnite (

∼µ

dead time [

], nonzero dark counts, less-than-unity efﬁciency, and nonﬁxed efﬁciency within the gate time [

], all

of which can be exploited by Eve to compromise QKD security. This leads in practice to a signiﬁcant number of

potential attacks such as detector ﬂuorescence [

], faked-state [

], time-shift [

], time-side-channel [

channel calibration [

], laser damage [

], spatial mismatch [

], detector saturation [

], and polarization

shift [

] attacks. More interestingly, the single-photon detectors (SPDs) of the receiver (Bob), normally operating in the

Geiger mode [

], can be turned by Eve into linear mode, which allows for various blinding and remote-control attacks

[

]. Among the detection-side attacks, the latter is widely known to be the most powerful

[

], with successful demonstrations on various types of SPDs, including passively and actively quenched avalanche

photodetectors (APDs) [

], gated/non-gated APDs [

], and superconducting nanowire single-photon detectors

(SNSPDs) [47].

Since the inception of quantum encryption [

], the intercept-resend strategies have been developed through many

quantum hacking paradigms. Its original version based on resending single photons was easily neutralized by QKD [

Employing detector imperfections, more crafty intercept-resend versions have evolved via resending faked multiphoton

states either solitarily (e.g., the after-gate attack [

], the faint-after-gate attack [

], and the detector-control attack

under speciﬁc laser damage [

]) or teamed with a blinding light (e.g., continuous-wave blinding attack [

sinkhole blinding attack [48], thermal blinding attack [48,45], and pulsed illumination attack [44]).

Currently, there exist two main approaches against the intercept-resend and detector-control hacking strategies. The ﬁrst

is based on monitoring some detector measures, such as its photocurrent, for anomalously excessive values [

This includes also observing the detector’s count rates versus random variations of either the detection efﬁciency

[

], or the attenuation in front of the detector [

]. These security patches could defeat the original attacks they

were designed for, but unfortunately they fail against subsequent ad-hoc modiﬁed attacks [46,55].

The second is the measurement-device-independent QKD (MDI-QKD) approach [

], which enables elimination of all

detector side-channels [

], offering security regardless of the nature of the detection apparatus. However, MDI QKD

builds on performing a remote Bell-state measurement, which requires high-visibility two-photon interference between

independent photons from Alice’s and Bob’s laser sources, a practically challenging procedure.

In this paper, we present a scheme to protect practical QKD systems against various attacks based on faked-state

light, including the detector-control attacks and more generally the class of intercept–resend attacks. The scheme

uses phase encoding and a two-way conﬁguration, similar to the plug-and-play conﬁguration [

], which uses

polarization-assisted routing through Bob’s transceiver, and a Faraday mirror at Alice’s site. In our scheme, however,

the polarization qubit serves a different function. A photon generated at Bob’s transceiver is transmitted through a

polarization randomizer, which assigns it a random state of polarization, and upon reﬂection from the Faraday mirror it

passes once more through the same randomizer, in a state orthogonal to its original state, and is directed to a speciﬁc

path, whereupon the photon is detected in accordance with the phase-encoded BB84 protocol. Light pulses generated

by an intruder must pass through the randomizer at the gateway to Bob’s transceiver, and since they pass only once, they

acquire a random state and end up in a different path, whereupon their detection triggers an alert. The randomizer is

ﬁxed during the course of the photon roundtrip and is refreshed after every cycle of photon transmission and detection.

Thus, the polarization qubit serves as a carrier of a password that allows genuine photons to be directed to the secured

detectors, while an intruder’s fake photons are randomized and possibly end up at the alert detectors.

We further consider the case that Eve launches a generalized detector-control attack. To render her attack unnoticeable,

she tailors the parameters of triggering pulses and blinding light in order to meet two requirements: (i) to avoid

triggering alert detectors, and (ii) to be able to sometimes trigger the secured detectors in the right way. These two

requirements lead us to a necessary and sufﬁcient condition that Bob’s secured and alert detectors have to satisfy. We

note that commercially available detectors can violate this necessary and sufﬁcient condition and thereby guarantee

that these two requirements are impossible to meet simultaneously. We experimentally demonstrate how various faked

states by Eve fail to simultaneously meet these two requirements of unnoticeable attack. Security analysis of the system

shows that for various types of attacks Eve cannot diminish the alert rate, even if she has complete control over Bob’s

secured detectors.

2 QKD scheme

As shown in Fig. 1(a), Bob employs a single photon with two encoded qubits: a time-bin qubit communicating the

key, and an ancillary polarization qubit serving as a security pass [

]. As in typical interferometric QKD systems,

the photon undergoes a roundtrip from Bob to Alice, where the time-bin qubit is modulated, and sent back to Bob

whereupon it is directed to two sets of detectors depending on its state of polarization. Entry into Bob’s receiver is

APREPRINT - OCTOBER 5, 2022

Figure 1:

(a)

Optical layout of the QKD system. Bob creates single photons with time-bin (key) and polarization

(ancillary) qubits. The polarization qubit is randomized by an operator

, only known to Bob. Alice’s phase modulator

(PM) encodes the time-bin state by a phase

φA∈ {0, π}

{π/2,3π/2}

. A Faraday mirror (FM) compensates Bob’s

back-tracing photon for all encountered polarization variations, including the randomization

. The polarization-based

Mach-Zehnder interferometer (PMZI) swaps the time-bin/polarization qubits for polarization/path qubits. Therefore,

the key qubit is measured in path

in either diagonal-antidiagonal (

D/A

) or right-left (

R/L

) circular polarization

bases. The polarization randomizer

– which may be implemented by means of high-speed electro-optic polarization

controller – is active against Eve’s fake photons and may direct them, without Eve’s notice, to the alert detectors in path

. A click of the alert detectors in path

is a sign for Eve’s intrusion. The polarization switch

alternates between

measurements bases:

D/A

and

R/L

. BS: beam splitter; PBS: polarization beam splitter; PC: polarization controller;

Cir: optical circulator; VA: variable attenuator; BF: narrow band-pass ﬁlter.

(b)

The timeline for the operations on

qubits of the three photonic degrees of freedom, path, time bin, and polarization, during the course of a roundtrip from

Bob to Alice and back along a channel

. The operator

describes the polarization transformation, when light enters

Bob’s system. In the opposite direction, it encounters a transformation

(c)

Optical setup demonstrating Eve’s

system. The half-wave plate HWP1 and the following polarization-based two-path system control the purity of the

polarization state via mixing orthogonal polarization components of two subsequent laser pulses. The subsequent half-

and quarter-wave plates, HWP2 and QWP, alter the polarization state unitarily. The two-path system in the last stage

performs the time-bin phase encoding.

secured by a polarization randomizer applying a random transformation

(based on Haar measure) that changes every

photon-roundtrip duration. Alice uses a Faraday mirror (FM) that switches the polarization qubit into an orthogonal

state so that as the photon crosses the polarization randomizer in the opposite direction, the randomization is cleared.

Since its state is only known to Bob, the randomizer is a secure polarization-based gateway that directs the photon to

speciﬁc detectors in the receiver.

The process begins as shown in Fig. 1(a) with Bob sending single-photon pulses along path

in a polarization-path

state:

|ψ1i= 1/√2(|Hi+|Vi)|ai.(1)

This is subsequently swapped for a time-polarization state

|ψ2i= 1/√2(|tli+|tsi)|Hi(2)

by use of an unbalanced polarization-based Mach-Zehnder interferometer (PMZI) with a polarization controller (PC)

placed in its short arm, converting the V (H) polarization into H (V) polarization.

On Alice’s side, the leading time bin

|tsi

is encoded with a phase shift

φA

, and

π/2

3π/2

. Upon reﬂection

from the FM, the photon polarization is ﬂipped to its orthogonal state. This compensates for the undesired polarization

changes accompanying the phase modulation [

], and also for the birefringence-based polarization ﬂuctuations along

the optical ﬁber [

]. Upon re-entry into Bob’s transceiver, since

is ﬁxed during the photon roundtrip, its effect is

also cancelled out by transmission in the opposite direction. The state is now:

|ψ3i=1

√2(|tli+eiφA|tsi)|Vi.(3)

APREPRINT - OCTOBER 5, 2022

Bob’s receiver is gated to select roundtrip passage via the short-long and the long-short arms of the PMZI arms. It is

also conﬁgured such that with single-photon interference in the PMZI, the time-polarization state

|ψ3i

is swapped back

to a polarization-path state

|ψ4i= 1/√2(|Hi+eiφA|Vi)|bi.(4)

The photon is therefore directed to path

, which we call the secure path. As will be shown later, detection of a photon

in path ais an indication that the system has been tampered with, and path ais therefore called the alert path.

After swapping the key qubit back to polarization, the BB84 measurement is performed passively in one of the conjugate

bases: diagonal-antidiagonal (

D/A

) or right-left (

R/L

) circular polarization. The system’s action on the different

degrees of freedom (path, time, and polarization) of the photon during its roundtrip course is illustrated in Fig. 1(b).

In yet another measure of added security, Bob randomly directs the received photon – in a managed way – to path

instead of path

for measurement. This is accomplished by appropriate control of the polarization randomizer. This

random-switching tactic unveils types of attacks that can bias triggering actions to path

such as pulsed-blinding

[44,55,22] and wavelength-dependent attacks [69].

Alice’s phase coding and Bob’s gated detection require precise time synchronization between the two sides which is

done via a wavelength-multiplexed classical channel carrying bright pulses. A portion of the power received by Alice is

monitored to detect Trojan horse attacks [63].

Here, an ideal single-photon source is assumed for convenience. To defend against the PNS attack, Bob applies a

decoy-state technique [65,66,67]; verifying that his produced decoy pulses encounter the same single-photon loss.

3 Randomized routing of faked-state light

Eve’s goal is to signal the detectors in the secure path

without registering a click on the detectors of the alert path

In a typical intercept–resend strategy, Eve would measure Alice’s encoded state and then send faked-state light in a

phase modulated state

(|tli+eiφE|tsi)/√2

, mimicking the measured key qubit, together with a polarization qubit in

a state

ρp

. Upon transmission through the PMZI, and within the detection window (centered at:

ts+tl

), the state of

Eve’s photon(s) becomes

2|HihH|(|biX+eiφE|ai)UρpU+

×(Xhb|+e−iφEha|)|HihH|

2|VihV|(|aiX+eiφE|bi)UρpU+

×(Xha|+e−iφEhb|)|VihV|.

(5)

The NOT operator

is due to action of the PC in the PMZI. To obtain the which-path statistics, we trace over

polarization and obtain the reduced density operator of the path states

+ cos φEhV|UρpU+|Hi|biha|+pb|bihb|.(6)

The probabilities that Eve’s photon(s) ends up in the alert path

pa=hH|UρpU+|Hi

, while that of reaching path

pb= 1 −pa=hV|UρpU+|Vi

. If Eve were to know the operator

, she would be able to make

pa= 0

by use of a

pure state

ρp= U+|VihV|U

. Not knowing

, if she runs the conventional intercept-resend attack [

] by measuring

the Alice-encoded photon and re-sending a new photon prepared in accordance with the measurement outcome to

Bob, then the average probability that it passes to path

is 25% (obtained by averaging over the continuum of random

realizations of

based on Haar measure, assuming ideal single-photon sources, measurements, and detection). This

alert rate is on top of the normal 25% quantum bit error rate (QBER) of the BB84 key qubit.

4 Necessary criteria for Bob’s detectors

4.1 Criteria formulation

A more stealth intercept–resend strategy that we now investigate in more details is Eve’s use of blinding light together

with triggering multi-photon pulses [

]. Upon blinding, the SPD in the linear mode never clicks when

the triggering pulse energy is below a threshold

Enever

, and always clicks when the energy is greater than a threshold

Ealways

[

]. When the energy falls between these two levels, the detector clicks with a probability between 0 and

文档加载中……请稍候！
如果长时间未打开，您也可以点击刷新试试。

下载文档到电脑，查找使用更方便

10 玖币 0人已下载

立即下载

摘要：

RANDOMIZEDANCILLARYQUBITOVERCOMESDETECTOR-CONTROLANDINTERCEPT-RESENDHACKINGOFQUANTUMKEYDISTRIBUTIONSalemF.HegazyNationalInstituteofLaserEnhancedSciences,CairoUniversity,Giza12613,Egyptsalem@niles.cu.edu.egSalahS.A.ObayyaCenterforPhotonicsandSmartMaterials,ZewailCityofScienceandTechnology,Giza12578,E...

展开>> 收起<<

RANDOMIZED ANCILLARY QUBIT OVERCOMES DETECTOR -CONTROL AND INTERCEPT -RESEND HACKING OF QUANTUM KEY DISTRIBUTION.pdf

共17页,预览4页

还剩页未读，继续阅读

声明：本站为文档C2C交易模式，即用户上传的文档直接被用户下载，本站只是中间服务平台，本站所有文档下载所得的收益归上传人(含作者)所有。玖贝云文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。若文档所含内容侵犯了您的版权或隐私，请立即通知玖贝云文库，我们立即给予删除！

RANDOMIZED ANCILLARY QUBIT OVERCOMES DETECTOR -CONTROL AND INTERCEPT -RESEND HACKING OF QUANTUM KEY DISTRIBUTION

相关推荐

开通VIP享超值会员特权

作者详情

相关内容

热门标签

举报选择: