Constant modulation for enhancing QKD security

The present invention is related to U.S. patent application Ser. No. 10/910,209, entitled “QKD station with EMI suppression,” filed on Aug. 3, 2004.

The present invention relates to quantum cryptography, an in particular relates to a method of operating a modulator in a quantum key exchange (QKD) system in a manner that makes eavesdropping more difficult, thus enhancing the security of the system.

Quantum key distribution involves establishing a key between a sender (“Alice”) and a receiver (“Bob”) by using weak (e.g., 0.1 photon on average) optical signals or “qubits” transmitted over a “quantum channel.” The security of the key distribution is based on the quantum mechanical principle that any measurement of a quantum system in unknown state will modify its state. As a consequence, an eavesdropper (“Eve”) that attempts to intercept or otherwise measure the qubits will introduce errors and reveal her presence.

The general principles of quantum cryptography were first set forth by Bennett and Brassard in their article “Quantum Cryptography: Public key distribution and coin tossing,” Proceedings of the International Conference on Computers, Systems and Signal Processing, Bangalore, India, 1984, pp. 175-179 (IEEE, New York, 1984). Specific QKD systems are described in U.S. Pat. No. 5,307,410 to Bennett, and in the article by C. H. Bennett entitled “Quantum Cryptography Using Any Two Non-Orthogonal States”, Phys. Rev. Lett. 68 3121 (1992).

The general process for performing QKD is described in the book by Bouwmeester et al., “The Physics of Quantum Information,” Springer-Verlag 2001, in Section 2.3, pages 27-33. During the QKD process, Alice uses a random number generator (RNG) to generate a random bit for the basis (“basis bit”) and a random bit for the key (“key bit”) to create a qubit (e.g., using polarization or phase encoding) and sends this qubit to Bob.

The above mentioned references by Bennett each describe a so-called “one-way” QKD system wherein Alice randomly encodes the polarization or phase of single photons at one end of the system, and Bob randomly measures the polarization or phase of the photons at the other end of the system. The one-way system described in the Bennett 1992 paper is based on two optical fiber Mach-Zehnder interferometers. Respective parts of the interferometric system are accessible by Alice and Bob so that each can control the phase of the interferometer. The interferometers need to be actively stabilized to within a portion of quantum signal wavelength during transmission to compensate for thermal drifts.

U.S. Pat. No. 6,438,234 to Gisin (the '234 patent), which patent is incorporated herein by reference, discloses a so-called “two-way” QKD system that is autocompensated for polarization and thermal variations. Thus, the two-way QKD system of the '234 patent is less susceptible to environmental effects than a one-way system.

In the two-way system of the '234 patent, Alice includes an optical phase modulator and a Faraday mirror. The phase modulator is provided with a modulation randomly selected from a set of modulations. The modulation is timed to coincide with the arrival of one of two optical pulses from Bob. The pulses are then sent back to Bob, with one of the pulses having been modulated. The remaining pulse is likewise modulated at Bob. The pulses are interfered, and the resulting interfered pulse is detected. This process is repeated, and the usual QKD protocols and procedures are followed to establish a secure key between Alice and Bob.

It is imperative that a potential eavesdropper (Eve) not be able to discern the activity of Alice's phase modulator. If an eavesdropper were to know the state of Alice's modulator, she would be able to deduce the value of the exchanged pulses (qubits).

Alice's modulator activity is of interest to the QKD system only when qubits are actively being modulated. At times when there are no qubits in the vicinity of Alice, the modulator's value is of no interest because there is nothing to modulate. Consequently, present-day QKD systems leave the modulator at rest when qubits are not present. However, this makes the eavesdropping task for Eve considerably easier because she can focus her concentration on changes in the state of the modulator. If Alice's modulator is active only when it is modulating qubits, then if Eve has electromagnetic interference (EMI) measurement capability or probe-beam capability, there is only a relatively small amount of information that she needs to examine to determine how the qubits were modulated.

An aspect of the invention is a method of operating a QKD system having a modulator in a manner that makes it more difficult for an eavesdropper to gain information about the modulator states of the system. The method includes activating the modulator to provide first random modulations to the modulator during corresponding gating intervals associated with expected arrival times of a qubit. The method also includes activating the modulator outside of the gating intervals to provide second random modulations to the modulator. The result is that the modulator (e.g., Alice's modulator) is essentially always active, with different modulations being applied constantly, or nearly so, as qubits are exchanged between QKD stations. Consequently, an eavesdropper attempting to gain information about the modulator states needs to figure out which modulator states are actually associated with encoding (modulating) a qubit (“qubit modulations”), and which modulations are not (“jabber modulations”).

The activation of the modulator during the expected arrival time of a qubit (i.e., during the “gating interval”) is achieved by providing the modulator with a control signal. Activation of the modulator outside of the gating interval is achieved by providing the modulator with a “jabber signal.” Both the control signal and the jabber signal may be generated by a voltage controller (modulator driver) provided with a random number from a random number generator (RNG) from either a single RNG or two different RNGs. The random number so provided is used to randomly select a modulator phase from a set of available modulator phases (e.g., φ A =+3π/4, −3π/4, π/4, and −π/4) associated with the QKD protocol.

FIG. 1 is a schematic diagram of a two-way QKD system adapted to perform the method of the present invention; and

FIG. 2 is a timing diagram of the control signals, the jabber signals and the synchronization signals, illustrating how the control signal activates the modulator during the gating intervals that surround the respective synchronization signals, and how the jabber signal activates the modulator during the time intervals outside of the gating intervals.

FIG. 1 is a schematic diagram of a two-way QKD system 10 having two QKD stations Bob and Alice linked by an optical fiber link FL. Bob includes an optical system 20 adapted to generate two coherent optical pulses P 1 and P 2 . Optical system 20 also include a phase modulator MB, a laser source LS, and a variable attenuator 22 B. Phase modulator MB is coupled to a voltage controller VB, which is coupled to a random number generator unit RNG-B. RNG-B, in turn, is coupled to a controller 30 B. Controller 30 B is also coupled to optical system 20 . Bob also includes a detector unit 40 operably coupled to optical system 20 and to controller 30 B. Detector unit 40 includes two single-photon detectors (SPDS) 41 and 42 .

Alice includes a phase modulator MA optically coupled at one end to optical fiber link FL and at the opposite end to a Faraday mirror FM. Also optionally includes a variable attenuator 22 A upstream of modulator MA. Alice also includes voltage controller VA coupled to phase modulator MA, and a random number generator RNG-A 1 coupled to the voltage controller. In an example embodiment, Alice also includes a second random number generator RNG-A 2 coupled to voltage controller VA. Alice further includes a controller 30 A coupled to random number generators RNG-A 1 and RNG-A 2 .

Bob's controller 30 B is coupled (optically or electronically) to Alice's controller 30 B via a synchronization channel SC to synchronize the operation of Alice and Bob via synchronization signals SS. In particular, the operation of the phase modulators MA and MB is coordinated by controllers 30 A and 30 B by exchanging synchronization signals SS that correspond to expected arrival times of qubits (pulses) to be modulated.

Method of Operation

In an example embodiment of the operation of QKD system 10 , Bob's controller 30 B activates optical system 20 via an activation signal S 0 to generate coherent optical pulses P 1 and P 2 having orthogonal polarizations. The pulses pass through Bob's modulator MB, which remains inactive, and optionally through variable attenuator 22 , which attenuates the pulses. The pulses then travel over to Alice via optical fiber link FL.

Pulses P 1 and P 2 then pass through Alice's phase modulator MA, which remains inactive. The pulses reflect off of Faraday mirror FM, which rotates the polarization of the pulses by 90°. As the pulses travel back through modulator MA, Alice lets the first pulse P 1 pass through unmodulated, but modulates the phase (i.e., imparts a phase shift φ A to) second pulse P 2 .

The modulation of pulse P 2 at Alice is carried out by controller 30 A providing a well-timed signal S 1 to random number generator RNG-A 1 , which provides a signal S 2 representative of a random number to voltage controller VA. In response, voltage controller VA sends a randomly selected voltage control signal SA (e.g., V[+3π/4], [V−3π/4], V[+π/4], or V[−π/4]) to modulator MA to set the phase modulation to a corresponding randomly selected phase shift φ A =+3π/4, −3π/4, π/4, or −π/4.

The two pulses P 1 and P 2 then pass through attenuator 22 A, which ensures that the pulses are single-photon level (i.e., statistically having one photon or less per pulse). The pulses travel back to Bob, where pulse P 2 passes unaltered through modulator MB, but where Bob imparts a randomly selected phase shift φ B to pulse P 1 . The modulation is carried out by controller 30 B providing a well-timed signal S 3 to RNG-B, which provide a signal S 4 representative of a random number to voltage controller VB. In response, voltage controller VB sends a randomly selected voltage control signal SB (e.g., V[+π/4] or V[−π/4]) to modulator MB to set the phase modulation to a corresponding value of +π/4 or −π/4.

Further, pulses P 1 and P 2 enter optical system 20 where they are recombined to interfere. SPDs 41 and 42 are arranged so that constructive interference (φ A −φ B =0) is detected by SPD 41 , and destructive interference (φ A −φ B =π) is detected by SPD 42 .

When Bob imparts the same basis phase as Alice, a count in SPD 41 indicates binary 0 and a count in SPD 42 indicates binary 1. However, when Bob's basis phase is different from Alice's, there is no correlation and the count winds up in either SPD 41 or 42 with equal probability (i.e., the interfered pulse has a 50:50 chance of being detected in either SPD). The resulting detected signal in detection unit 40 is transmitted to controller 30 B via a detector signal S 40 , where the detected phases are stored, along with the modulation states imparted to modulator MB.

Constant Modulation

The description of the operation of QKD system 10 thus far is essentially that of the prior art in that Alice's modulator remains inactive unless it receives a voltage signal SA that is timed to coincide with the arrival of optical pulse P 2 as reflected from Faraday mirror FM. However, under the prior art scheme, an eavesdropper that is capable of obtaining information about the modulation state of phase modulator MA need only worry about making the measurement, and not whether the measurement relates to an actual modulation of a qubit (i.e., the modulation of pulse P 1 or P 2 ).

Thus, the present invention improves upon the prior art by activating modulator MA even when there is no qubit present to modulate. In this case, eavesdropper Eve would need to sift through much more data to find the small period when the qubits are actually being modulated.

FIG. 2 is a timing diagram illustrating the activation of modulator MA relative to the expected arrival of a qubit, as indicated by synchronization signals SS. In an example embodiment, the modulation of a qubit, whose expected arrival is associated with synchronization signal SS, is carried out as described above. Typically, the duty cycle of the sync signal SS is very low, e.g., on the order of 0.5%. Such a low sync duty cycle means that there is a very short period of time over which an eavesdropper can “listen” to the qubit modulation in order to obtain the qubit data.

Thus, for a brief period of time around the expected arrival time (referred to as the “gating interval”), modulator MA is activated by control signal SA from voltage controller VA. This is illustrated in FIG. 2 as control signal SA changing from 0 to 1 (i.e., from off to on) over the gating interval surrounding the synchronization signal SS. Note that in practice, signal SA has a voltage corresponding to the phase to be set.

Outside of the gating interval, controller 30 A activates random number generator RNG-A 2 via an activation signal S 5 to send a random number to voltage controller VA via signal S 6 . Signal S 6 , in turn, causes voltage controller VA to send a “jabber signal” SJ to modulator MA. Note also that like control signal SA, the jabber signal SJ in practice has a voltage corresponding to the randomly selected phase. Note also that is preferred that the jabber signals SJ have the same signal width as the control signals SJ so that these two signal types are not discernable to an eavesdropper.

In FIG. 2 , the “0” and “1” values correspond to the particular mode—i.e., qubit modulation mode or jabber modulation mode—being enabled. The control signal (i.e., the qubit modulation signal) SA and the jabber signal SJ are also shown (not to scale) for the sake of illustration.

The combination of the control signal SA modulation and the jabber signal SJ modulation results in essentially a constant (i.e., continuous) random modulation of modulator MA, rather than (randomly) activating the modulator only during the short gating interval associated with the expected arrival of a qubit.

Jabber signal SJ drives (activates) modulator MA randomly during jabber mode just as control signal SA does during qubit modulation mode, with the exception that in jabber mode there is no expectation that a qubit will be present. Thus, an eavesdropper intent on discerning the modulation states (i.e., modulation values) of modulator MA associated with encoding the qubits no longer has the benefit of assuming each modulation was for a qubit. Now the eavesdropper has the additional burden of assessing which modulation events actually correspond to qubit modulations and which were merely jabber modulations.

In an example embodiment, the timing window surrounding the gating interval that corresponds to the “jabber mode” is determined by an FPGA or some other such timing device TD in controller 30 A. In particular, the timing device TD establishes a timing window for the jabber signal SJ that surrounds all possible worst case periods of time in which qubit modulation could occur. Thus, as mentioned above, timing device TD determines when jabber modulation is to be provided to modulator MA via RNG-A 2 . Note that in an alternative embodiment, Alice uses only one random number generator (e.g., RNG-A 1 ) to create the control modulation and the jabber modulation.

Controller 30 A records which phase modulations were applied to modulator MA during the gating intervals so that a secure key can be established between Alice and Bob using the known QKD protocols and procedures.

While the present invention has been described in connection with preferred embodiments, it will be understood that it is not so limited. On the contrary, it is intended to cover all alternatives, modifications and equivalents as may be included within the spirit and scope of the invention as defined in the appended claims.