The Network Impact of Hijacking a Quantum Repeater

TL;DR

This paper analyzes the security impact of hijacking quantum repeaters in quantum networks, quantifies the workload and costs involved, and proposes a randomized testing method to prevent network disruption.

Contribution

It introduces a quantitative framework for assessing the impact of quantum repeater hijacking and proposes a simple randomized testing approach to enhance security.

Findings

Hijacking can cause significant work loss and rerouting penalties.

Distributed quantum state tomography can detect hijacking costs.

Randomized testing effectively prevents hijacking attacks.

Abstract

In quantum networking, repeater hijacking menaces the security and utility of quantum applications. To deal with this problem, it is important to take a measure of the impact of quantum repeater hijacking. First, we quantify the workload of each quantum repeater with regards to each quantum communication. Based on this, we show the costs for repeater hijacking detection using distributed quantum state tomography and the amount of work loss and rerouting penalties caused by hijacking. This quantitive evaluation covers both purification-entanglement swapping and quantum error correction repeater networks. Naive implementation of the checks necessary for correct network operation can be subverted by a single hijacker to bring down an entire network. Fortunately, the simple fix of randomly assigned testing can prevent such an attack.

Figures

Tables

Table 1. Table 1: The correspondence table of variables.

$W$	Work of the entire network. Work denotes total number of attempts to share Bell pairs for teleportation per second  [38].
$W_k$, $W^{\prime }\left(W^{\prime \prime }\right)$	Work of repeater k, work including rerouting penalty.
$H$	Amount of work to create end-to-end Bell pair.
$D$	Data (packet) rate of communication, in Bell pairs per second.
$h$	# hops between two nodes in a communication session.
$L$	Amount of work loss.
$F,F^{\prime },F^{\prime \prime }$	Initial, purified, twice purified fidelity.
$E\left(F\right)$	Expected number of fidelity $F$ base Bell pairs consumed to build one final Bell pair.
$P_{1\left(2\right)}$	Success probability of round 1 (2) of purification.
$M$	Maintenance state analysis cost, in Bell pairs.
$C$	Total network capacity, in Bell pairs per second.
$R$	Maintenance rate, in Bell pairs per second.
$S,S^{\prime },S^{\prime \prime }$	The slack of network at each time point.

Table 2. Table 2: The procedure for checking for the presence of a hijacked repeater.

# Steps	Master repeater (Node 1)	Slave repeater (Node 2)
Prep 1.	Sharing initial Bell pairs with fidelity $F$.
Prep 2.	Performing two round purification to create final Bell pairs.
1.	Select Bell pairs for tomography using synchronized, secure pseudo random number generators at each end.   .
2.	Choose measurement basis using local pure random selector, receive pulse and measure qubit.
3.	M: Receive basis and result from Node 2.	S: Send basis and result to Node 1.
Branch:	Pulse received on both sides?	(S:wait)
Yes:	$\to$Recalculate d.m. and Fidelity.
No:	$\to$Back to Step 1.
Branch:	Is fidelity over the threshold?
Yes:	$\to$Send d.m. to Node 2.	S: Receive d.m. from Node 1.
No:	$\to$Back to Step 1.
Finish.	Terminate tomography, move link to production use.

Source \Target	${\Phi }^{+}$	${\Psi }^{+}$	${\Psi }^{-}$	${\Phi }^{-}$
${\Phi }^{+}$	${\Phi }^{+}$	$\times$	$\times$	${\Phi }^{-}$
${\Psi }^{+}$	$\times$	${\Psi }^{+}$	${\Psi }^{-}$	$\times$
${\Psi }^{-}$	$\times$	${\Psi }^{-}$	${\Psi }^{+}$	$\times$
${\Phi }^{-}$	${\Phi }^{-}$	$\times$	$\times$	${\Phi }^{+}$

Source \Target	${\Phi }^{+}$	${\Psi }^{+}$	${\Psi }^{-}$	${\Phi }^{-}$
${\Phi }^{+}$	${\Phi }^{+}$	${\Psi }^{+}$	$\times$	$\times$
${\Psi }^{+}$	${\Psi }^{+}$	${\Phi }^{+}$	$\times$	$\times$
${\Psi }^{-}$	$\times$	$\times$	${\Phi }^{-}$	${\Psi }^{-}$
${\Phi }^{-}$	$\times$	$\times$	${\Psi }^{-}$	${\Phi }^{-}$

Equations

$$\rho =F|{\Phi }^{+}⟩⟨{\Phi }^{+}|+\frac{1-F}{3}\left(|{\Phi }^{-}⟩⟨{\Phi }^{-}|+|{\Psi }^{+}⟩⟨{\Psi }^{+}|+|{\Psi }^{-}⟩⟨{\Phi }^{-}|\right),$$

$$H_{k,i}^{ES}$$

$$H_{k,i}^{QEC}$$

$$W_k=\sum _{i\in connections}{H}_{k,i}^{type}{D}_{k,i}.$$

$$W=\sum _{k\in nodes}{W}_k=\sum _k\sum _{i\in connections}{H}_{k,i}^{type}{D}_{k,i}.$$

$$L_{k}t=\sum _{i\in connections}(h_{k,i}+1)H_{k,i}^{type}{D}_{k,i}t.$$

$${\rho }^{ABC}$$

$${\rho }^{AB}$$

$$=$$

$$M_j^{link}=B(F)E(F),$$

$$M_{k,i}^{con(ES)}=\underset{log(h_{k,i})}{\underbrace{B(F)E(F)B(F^{\prime \prime })E(F^{\prime \prime })B(F^{\prime \prime \prime \prime })E(F^{\prime \prime \prime \prime })\cdots B(F^{{}^{\prime }{\cdots }^{\prime }})E(F^{{}^{\prime }{\cdots }^{\prime }})}}.$$

$$M_{k,i}^{con(QEC)}$$

$$T=wm.$$

$$R=\sum _{j\in links}\frac{M_j^{link}}{wm}+\sum _{k\in nodes}\frac{M_k^{con}}{w^{\prime }{m}^{\prime }},$$

$$W^{\prime }=W-L_{sus}+\sum _{i\in rerouted-connections}(h_{sus,i}+1+{\Delta }_{sus,i})H_{sus,i}^{\prime type}{D}_{sus,i}^{\prime },$$

$$S=C-W-R.$$

$$R\ll L_{sus}.$$

$$S^{\prime }=(C-C_{sus})-W^{\prime }-(R-R_{sus}),$$

$$S^{\prime \prime }$$

$$W^{\prime \prime }$$

$$\rho =F|{\Phi }^{+}⟩⟨{\Phi }^{+}|+\frac{1-F}{3}\left(|{\Psi }^{+}⟩⟨{\Psi }^{+}|+|{\Psi }^{-}⟩⟨{\Psi }^{-}|+|{\Phi }^{-}⟩⟨{\Phi }^{-}|\right).$$

$$P_1$$

$$F^{\prime }$$

$$P_2$$

$$F^{\prime \prime }$$

$$E(F)$$

$$|S|\le 2,$$

$$S=E(\theta ,\varphi )+E(\theta ,{\varphi }^{\prime })+E({\theta }^{\prime },\varphi )+E({\theta }^{\prime },{\varphi }^{\prime }).$$

Full text

Keywords: Route hijacking, Quantum repeater, Quantum network

1 Introduction

Large scale quantum repeater networks will be required for world-wide quantum communication between arbitrary nodes [1, 2]. The main functionality of the quantum network is to create Bell pairs between two chosen nodes  [3, 4]. Such Bell pairs enable, for example, provably secure shared keys for classical encrypted communication [5], distributed quantum computation [6, 7, 8, 9, 10, 11, 12], and various kinds of physical experiments [13, 14, 15, 16].

Implementations of quantum repeaters are classified into three generations by Muralidharan et al.  [17]. (1) The first generation employs entanglement purification  [3, 18, 19, 20]. To make forward progress, these schemes depend on receiving messages indicating the success or failure of entangled state creation, and are known as acknowledged entanglement control (AEC) [21, 22] or heralded entanglement generation (HEG) [17, 23].

This generation achieves high fidelity by entanglement purification, which requires bidirectional classical communication (a two-way entanglement purification protocol, or 2-EPP) and achieves Bell pairs between non-neighboring nodes by entanglement swapping between neighboring links [24]. To tolerate decoherence, this generation requires entanglement purification between remote nodes, therefore the cost increases as a polynomial multiple of the number of hops. (2) The second generation creates encoded Bell pairs between each pair of neighboring nodes and executes entanglement swapping between encoded Bell pairs to create encoded Bell pairs between two arbitrary nodes  [25, 26, 27]. Encoded Bell pairs over each link are created by using transversal teleportation-CNOT gates, which consume physical Bell pairs and require only unidirectional classical communication (a one-way entanglement purification protocol, 1-EPP). At the link level this generation is employed only when the photonic qubit’s error rate is low, because the benefit of 1-EPP is ruined if physical level bidirectional entanglement purification (2-EPP) is required. Fowler et al.’s Bell pair creation for the surface code is also in this generation  [28]. Their method creates a surface code lattice which spans all the repeater nodes in a path between the two end nodes by measuring stabilizers separated in neighboring nodes by consuming Bell pairs. Next, the portions of the lattice held by repeater nodes are measured out and a Bell pair encoded on the surface code is left between the two end nodes. (3) The third generation directly sends pulses on which a quantum state is encoded by quantum error correction, which requires unidirectional classical communication (1-EPP)  [29, 30]. This generation requires very high reception probability to allow direct transmission of states. We call (1) the entanglement swapping (ES) model and call (2) and (3) quantum error correction (QEC) models.

Any generation and model assumes that every node functions properly, but in the real world, malfunctions and hijacking of nodes are problematic. A world-wide internetwork will have too many nodes to avoid such problems. Malfunctions can be detected by self-check of every node, however, hijackings generally accompany concealment, hence it is difficult to find them by self-checks alone.

Repeater hijacking is one of the highest priority problems in network operation, due to its possible impact on the stability of the network itself. In contrast, use of vulnerable applications is a lesser concern from the point of view of network operations, because it affects the integrity of the nodes using the quantum applications rather than the operational integrity of the network.

In classical networks, there exist many types of attacks and taxonomies of those have been created. As an example from the perspective of the attack target, in a denial of service (DoS) attack, the attacker infringes on the availability of information services. An attacker can also listen in on a communications session. If the listening is passive, the attacker is referred to as an eavesdropper. An attacker that modifies messages between the sender and receiver is known as a man in the middle. In this way, the eavesdropper intercepts messages exchanged between the two victims and replaces them with other messages, while letting the victims think that they are directly talking to each other through a private connection. A model that has been used in Internet of Things research led to our model based on the issues of confidentiality (whether data has been disclosed), integrity (whether data has bee modified), and availability [31]. Classically, the impact of failures of nodes or attacks on nodes, especially distributed denial of service attacks, has been analyzed [32, 33, 34, 35]. Because attacks that prevent proper use of some nodes can be tolerated by dynamic routing, the robustness of the network against failures and attacks depends on the structure of the network. In earlier work, we proposed a taxonomy of the physical attacks on individual repeater nodes [31]. For the first step of quantification of those attacks, in this paper we focus on the impact of attacks on quantum repeaters.

In this paper, we propose an algorithm to detect hijacked nodes, similar to quantum key distribution (QKD), utilizing a state analysis method such as quantum state tomography [36]. By consuming a portion of the created Bell pairs for state analysis and adding some classical communication, we can find abnormal Bell pairs, whether caused by changes to the noise level, hardware or software failures, or attacks. By doing this we can detect man in the middle attacks on the quantum repeater network, as described in Sec. 4.1. Next we analyze the impact of hijacking on the performance of the overall network.

To discuss the margin of network capacity and the cost for hijacking detection, we take notice of the frequency of state analysis for network maintenance. The state analysis interval is closely allied to the stability and integrity of the quantum repeater network. As the total work approaches the network capacity, queueing delays grow quickly [37]. Therefore, a network is always designed with a certain amount of “slack” capacity, to reduce queueing delays and the probability of connection failure due to insufficient capacity as the work varies over time. Fig. 1 qualitatively shows the different uses of network bandwidth, and how they vary over time. These uses will be detailed in Sec. 2.4

To quantify this discussion, we evaluate the number of entanglement attempts (quantum optical pulses, e.g. single photons) required for tomography between nonlocal nearest neighbor repeaters. We expand this element to include the costs for hijacking detection on ES model and QEC model repeater networks.

Sec. 2 shows the components of a quantum repeater network and tomography. In Sec. 3, we quantify the effects of repeater hijacking. In Sec. 4, we quantify the work of tomography for hijacking detection and discuss the occurrence of work shedding. Sec. 5 shows how a single hijacker can leverage its position in the network to dramatically expand an attack and bring down an entire network by framing other repeaters, leading network administrators to conclude that an entire set of repeaters has been hijacked and causing them to isolate enough nodes to partition the network. It then proposes a solution. Sec. 6 describes the process of network operation and recovery from hijack detection. Sec. 7 summarizes our results and discusses remaining problems.

2 Quantum repeater networks

Before discussing the effect of repeater hijacking, we show the basic organization of a quantum repeater network with several active connections and the isolation of a hijacking repeater in Fig. 2.

Each node corresponds to a quantum repeater and each link corresponds to a channel such as optical fiber. When the network detects repeater hijacking, the corresponding repeater is isolated from the network and connections adopt newly recalculated shortest paths [38].

We show the definition of variables for this paper in Table 1.

2.1 Quantum repeater

A quantum repeater is a device for quantum communication capable of local quantum operations and conservation of quantum information. Quantum repeaters perform quantum communications using shared Bell pairs between target repeaters. The implementation model of a repeater is classified according to the Bell pair sharing method, as discussed in Sec. 1. A repeater’s four main responsibilities are: 1. link-level entanglement creation; 2. connection of quantum states for multi-hop communication; 3. management of errors; and 4. participating in the management of the network.

In this paper, we distinguish the types of quantum repeaters based on their connectivity. A Router is connected to three or more links. A Repeater has exactly two external links, so that it is useful in a line only. An End node has one link and is connected to a network constructed of Routers and Repeaters. Our investigation focuses on Repeater and Router hijacking, because hijacking of an End node allows the hijacker to report any results to the application, up to and including completely forging the existence of the quantum network itself. (See Sec. 3.1). End nodes also cannot spread malicious effects to surrounding networks.

In a quantum repeater network, connections are multiplexed [39]. Each repeater may be used as the start, end and relay point of multiple quantum communication sessions simultaneously.

2.2 Quantum state analysis

Quantum tomography is a conventional method for estimating the actual quantum states $\rho_{reality}$ generated by a physical apparatus. For the purposes of this paper, any state analysis technique will do, but for concreteness we present our analysis in terms of tomography. As shown in Fig. 3, the density matrix $\rho_{ideal}$ cannot exist in reality, since errors occur in any physical apparatus. Utilizing quantum tomography, a large number of measurements of $\rho_{reality}$ give us the fidelity between $\rho_{ideal}$ and $\rho_{reconstructed}$.

This scheme can be applied to confirming the operational fidelity of an optical fiber and repeater setup, end-to-end, as well as to the detection of repeater hijacking.

2.2.1 Quantum key distribution

QKD has the ability to detect eavesdroppers [41]. For a noisy channel, information reconciliation to detect errors and privacy amplification to reduce the amount of information divulged by information reconciliation are proposed, at the cost of reducing the generated secret key size [42, 43]. Acting as a simplified form of state analysis, QKD can find evidence of eavesdroppers operating on the quantum states. However, the simplest form assumes that the hijacker is measuring or completely entangling with every quantum state. If the hijacker is more sophisticated and attacks fewer states or entangles only weakly, the effects are more subtle and require more careful checks to detect.

If our only goal is to prove a Bell inequality violation, the CHSH game is good enough and requires fewer quantum resources than tomography [44, 45, 46]. Of course, quantum tomography can more thoroughy evaluate the quantum channel state while proving a Bell inequality violation. From the point of view of network management, evaluation of the state created by the channel is an important, fundamental task, to which quantum tomography is well suited. Rather than add a second protocol for the narrow purpose of looking for hijacked repeaters, it makes sense to combine the two tasks, so we propose the adoption of quantum tomography for hijack analysis as well.

2.2.2 Distributed style tomography

To use tomography on a repeater network, we have suggested a distributed quantum state tomography protocol using TCP/IP networks to exchange the classical information about measurement bases and results, and the output of the tomographic calculations [40]. In that protocol, we analyze tomography between remotely located repeaters using Bell pairs that have been purified twice. Against Werner states $\rho$ with fidelity $F$,

[TABLE]

as input states, the second round of purification [47, 48] gives us a greater boost in fidelity than the first round [2]. The use of many rounds of purification increases the number of Bell pairs consumed, raising the required number of entanglement attempts exponentially. To keep the analysis straightforward, we assume without loss of generality the use of two rounds. We give a brief summary of our protocol in Table 2.

Like QKD, not only must the choice of Bell basis for measurement be random, but which Bell pairs in the sequence of generated states are allocated to tomography must appear random; if e.g. every tenth Bell pair is used for hijacker detection, she will simply avoid hijacking those states. Doing the selection purely randomly and independently at each node will be very inefficient; the two nodes will choose the same pairs with only probability $P^{2}$. Instead, operation of this detection process will proceed using pseudorandom selection of states, which requires properly synchronized, cryptographically secure pseudorandom number generators between each pair of repeaters performing hijack monitoring. The setup of this generation process is beyond the scope of this paper.

The ability of tomography to distinguish the presence of malicious activity from noise depends on the state of the Bell pairs can that be generated. Operational networks are expected to make extensive use of purification. We expect that purification will be conducted in pairs of rounds, first suppressing $X$ errors, then $Z$ errors. Fig. 4 shows the fidelity after one round ($F^{\prime}$) and two rounds ($F^{\prime\prime}$) of purification. Beginning with Werner states, the first round of purification shuffles $X$ errors into $Z$ error terms, with minimal improvement to fidelity. The second round of purification then produces a large improvement in fidelity.

Detection of malicious activity depends on our ability to demonstrate violation of the CHSH inequality. Fig. 5 shows the expected CHSH measure with the initial Werner states ($S$), after one round of purification ($S^{\prime}$), and after two rounds ($S^{\prime\prime}$).

Interestingly, although the fidelity increase after one round of purification is small, the asymmetric error terms produce a much larger gap in the $S$ value. Therefore, two rounds of purification are desirable for Bell pairs destined for application use, but one round is preferred for Bell inequality violation. For further details on the behavior of purification and CHSH, see A.

2.3 Network administrator

To discuss the identification of hijacking repeater, we assume the existence of a central network administrator who has his own trustworthy nodes and collects all end to end tomography results. When hijacked node is specified, the administrator promptly isolates the involved node and delivers updated network routing tables that do not use the isolated node.

2.4 Phases of network operation

In this research, we classify the phases of network operation as follows.

Phase 1. Network bootstrapping.

At the start of network operations, we need to initialize network components. To check the condition of quantum repeaters and links, some types of tomography (which are explained in Sec. 4.2) are utilized. Almost the entire capacity of the network is spent to execute these operations, so that quantum communications for users are not yet provided. Based on the information acquired via this tomography, the network nodes create routing tables for selecting paths through the network.

Phase 2. Normal operation.

In normal operations, the network performs quantum communications for end node applications and various tomography operations for the maintenance of the network. The network slack prevents instability of connections and requires us to minimize possible maintenance costs. This phase is the main portion of network operations and continues until the detection of repeater hijacking. Dynamic changes to traffic and topology occur, but for our purposes here are treated as static.

Phase 3. After repeater hijacking detection.

The amount of useful work lost depends on our lag in detecting the start of hijacking, which in turn depends on the frequency of tomography. The network performs rerouting operations and isolates all suspected repeaters.

Reduced network performance and increased communication costs shrink the slack.

Phase 4. Return of innocent repeaters

By careful verification, if the administrator identifies the actual hijacked repeater, he returns all isolated innocent repeaters to the network. After these operations, the network is reset to a new steady-state equilibrium, giving us a new Phase 2.

3 The impact of repeater hijacking

3.1 The Hijacker’s Capabilities

For our model of a hijacker, we assume that the hijacker has taken complete classical control of a quantum repeater, but is not capable of new physical actions such as blinding detectors [49]. We are focusing on the hijacker’s selective use of the repeater’s quantum capabilities, such as modifying the circuits used for purification, quantum error correction or entanglement swapping. The hijacker may alter destinations of operations, rerouting connections or entangling additional qubits to quantum states that are being developed. Those qubits may be local within the hijacked repeater, or may involve a fourth party elsewhere in the network. Accordingly, the hijacker is able to foil quantum communications and potentially to steal quantum information.

Hijacking of an End node would give the hijacker the ability to convince an application of any behavior by the network, just as taking control of a personal computer’s operating system allows a hacker to emulate any behavior by the system. This means the hijacker can conceal hijacking all the way to the end of the application’s work. Such an all-powerful hijacker is beyond the scope of this work.

In this paper, we focus on the detectable hijacking of Routers and Repeaters. The hijacker’s goal is to maximize the hijacking time and the range of influence while remaining undetected.

In following parts of this section, we define the work of a network, classify two types of effects of repeater hijacking, and quantify the work loss problem.

3.2 Defining connection cost

To quantify the network impact of the hijacking of a quantum router, we need to understand the amount of work (see the work entry in Table 1) done by the network. We can either count connections and sum the work done per connection across the entire network, or we can count nodes and sum the work done per node across the entire network. As our goal is to study the hijacking of a single router, the latter may seem more desirable, but the behavior of ES connections makes the former easier in some ways.

First, let us establish a definition of work. The primary element of work in a quantum network is the quantum optical pulses used to create entanglement across a link. The work done for a connection, then, is the total number of pulses used on behalf of that connection across the set of nodes involved [38].

For one connection achieving an end-to-end Bell pair generation rate (data rate) of $D$ Bell pairs/second consumed by the application such as QKD or quantum distributed computation, how much work is done? The work done at each node is $D$ multiplied by an overhead factor $H$ that depends on the type of repeater network:

[TABLE]

where $h_{k,i}$ denotes the path length for connection $i$ passing through the repeater $k$, and $c$ is a small constant dependent on the details of the purification scheme. $d$ denotes the code distance or the block size for error correction. (For comparison, because the error correction overhead is essentially constant, the amount of work done at a node in a classical network is simply linear in the number of bits being transmitted, $H^{C}_{k,i}=O(1)$.)

To calculate the work at repeater $k$, we simply sum over the $HD$ product for each connection passing through the repeater,

[TABLE]

Note that this sum is only the work contributing directly to end-to-end states to be consumed by application, and does not include the cost of tomography. Then, we can quantify the work of network $W$ as follows:

[TABLE]

3.3 Quantifying work loss

When we detect the hijacking of repeater $k$ with duration $t$, we can consider all connections using $k$ to be lost. The amount of work loss $L_{k}$ is more than $W_{k}$, with other repeaters work corresponds to lost connections as follows:

[TABLE]

4 Preventing repeater hijacking

4.1 Distributed style tomography for hijacking detection

Tomography is a conventional scheme for characterizing a quantum state [36], and can be repurposed to detect quantum state falsification. This scheme can be applied to verifying the link state and the repeater state, including the detection of repeater hijacking. For example, the hijacker entangles a third qubit $C$ with the Bell pair $|\Phi^{+}\rangle_{AB}$ Alice and Bob are sharing. The system $\rho^{ABC}$ without $C$ becomes a completely mixed state as follows:

[TABLE]

Then, an ensemble of $\rho^{AB}$ cannot prove a Bell inequality violation and hijacking can be detected statistically over a set of trials. Of course, this works only if both sides share measurement results securely. If the eavesdropper can modify or control both the quantum and classical connections between the two parties, she can send false measurement results and fake a Bell inquality violation [5, 50, 51]. To avoid such a man in the middle attack, we assume all classical communications are authenticated and unmodified. Then, each node can send classical messages to other nodes securely.

4.2 Work for tomography

Next, we discuss the work for a node and any type of link tomography.

Node tomography (self check)

State tomography and process tomography in each node are requisite for verification of gate operation and internal self functions. This tomography cannot detect repeater hijacking. In this research, we assume this operation is done periodically.

$1$ hop link tomography

Periodic but frequent tomography between nearest neighbor repeaters is requisite for verification of the state of each link. In prior work [40], we have shown that we need around $2000\sim 3000$ Bell pairs for tomography to reconstruct the state with $99$% fidelity for initial Bell pair fidelity of $F\simeq 0.65$. We can define the tomography work for link $j$ as follows:

[TABLE]

where $B(F)$ denotes required number of Bell pair for tomography based on initial Bell pair fidelity $F$ and $E(F)$ is as in Eq. (26).

Multilevel recursive tomography for ES model

In ES model repeater networks, multilevel recursive tomography is requisite for checking the condition of purification, entanglement swapping operations and the connection state. The tomography work at ES model repeater $k$ for connection $i$ becomes as follows:

[TABLE]

We can calculate $F^{{}^{\prime}\cdots^{\prime}}$ using Eq. (25) recursively.

End to End tomography for QEC model

During quantum communications on QEC model repeaters, both end nodes need to execute tomography periodically to check the connection state. If done with appropriate attention to security, this operation can detect the repeater hijacking, but cannot identify which repeater has been hijacked if the connection length is larger than $2$ hops. The tomography work at QEC model repeater for connection $i$ becomes as follows:

[TABLE]

We will discuss the frequency and the total work of those tomography in following section.

4.3 Identification of hijacking repeater

When the hijacked repeater always acts maliciously on every connection, the administrator can identify that repeater by using the combination of reported tomography results. In contrast, when the hijacked repeater targets only the connection between two specific repeaters, whether administrator can identify or not depends on the repeater models.

For example, in Fig. 2, if it is known that the $a-a^{\prime}$ and $b-b^{\prime}$ connections both pass through a hijacked repeater, we can infer that the malicious node is $k$. Naturally, this identification process requires substantial support from the classical network protocols.

4.3.1 ES model

In the ES model, repeaters perform entanglement swapping in a nested tree to share final Bell pairs for communication. As shown in Fig. 6, if we perform cryptographically secure tomography along with every entanglement swapping operation, we can finger the culprit repeater.

After the identification, the network should isolate the hijacked repeater as soon as possible and reroute connections passing through that repeater. These changes reduce total network performance and increase communication costs so that the slack of network is suppressed. In exchange for this burden, the effects of the hijacking are rooted out.

4.3.2 QEC model

In the QEC model, we can detect the repeater hijacking using end to end tomography but our ability to correctly identify the hijacked repeater is weak. When the hijacked repeater targets specific one connection through multiple repeaters, we cannot identify the hijacked repeater. Then we must reroute the connection and should temporarily increase the frequency of tomography to determine if we have successfully rerouted around the hijacked repeater. As shown in Fig. 7, if the attack continues, identification of hijacked repeater may be possible. However, in the example in Case 2. with no ability to route around the hijacked node, the connection may have to be abandoned.

The aftermath of the identification and effects associated with it are similar to the ES model.

4.4 The appropriate frequency of tomography.

To maintain the integrity of a repeater network, we need periodic tomography on each link and node. Here, we discuss the appropriate frequency of tomography.

To provide load balancing, sliding window is a suitable scheme for link tomography. Each link performs burst size tomography operations with average interval $m$. Here, each interval must vary randomly to foil attempts by the hijacker to remain undetected by laying low and not intercepting states to be used for tomography. The network can verify the link states using the tomography results of the prescribed window, as shown in Fig. 8.

There is the following relation between the time for verification $T$ and the window size for tomography $w$:

[TABLE]

The total tomography cost for network maintenance per second $R$ can be described as follows:

[TABLE]

where $w~{}(w^{\prime})$ and $m~{}(m^{\prime})$ denote the window size and interval of link (connection) tomography. For example, if each burst is $10$ Bell pairs with the interval $m=1$ sec and $2000$ Bell pairs are required for tomography, we need $200$ seconds for link verification.

5 Framing innocent repeaters

5.1 Framing an innocent repeater

If the hijacker continues attacking in the most straightforward fashion, we can identify the hijacked repeater or prevent attacking as just described. However, if the hijacker can identify Bell pairs that will be used for hijack detection in any layer above his position in the swapping hierarchy or any connection he terminates, he can substantially damage operation of large swaths of the network by framing innocent repeaters, convincing network administrators that other repeaters besides itself have been hijacked.

The hijacker can frame another, innocent repeater in one of two ways: first, when it is the endpoint of a Bell pair, it can directly falsify measurement results, causing the failure of the entanglement checks that test for the presence of a hijacker, in which case the last node to perform entanglement swapping will be blamed. Second, if it knows the sequence of tests performed by the other nodes after entanglement swapping, it can selectively choose which Bell pairs to corrupt.

For example, in the left side of Fig. 9, the hijacked router’s neighbors $a$ and $b$ will check the Bell pairs created after the hijacker’s entanglement swap. If they detect corruption, they will naturally blame the hijacker and report him to the network adminstrator.

If, however, the hijacker allows the $a-b$ Bell pairs to be created uncorrupted but corrupts the Bell pairs used for the $a-c$ check (marked 1 in the figure), the $a-b$ check will pass but the $a-c$ check will fail, and nodes $a$ and $c$ will instead conclude that $b$ has been hijacked. The hijacker has successfully framed $b$, who will now be reported to the network administrator and removed from the network, pending further investigation.

This level of subterfuge is possible if the hijacker can predict which Bell pairs will be used for which operations. For example, if the first ten Bell pairs created with $a$ are used to check the link, the next ten to check the $a-b$ connection, and the next ten used to check the $a-c$ connection, the hijacker knows to leave the first twenty Bell pairs alone, then corrupt the next ten.

In a QEC network, checks are not done in the same nested fashion, so a hijacker cannot use this technique to frame other repeaters. However, because end-to-end checks are done, he can still disrupt any individual connection. which then forces rerouting of that connection, as described in Sec. 4.3.2. QEC network administrators will use these end-to-end reports to attempt to identify and isolate the hijacker, as described in Sec. 2.3. In the right half of Fig. 9, the hijacker is carrying two connections. If he chooses to corrupt the $e-e^{\prime}$ connection but not the $d-d^{\prime}$ connection, an administrator examining the network will logically conclude that the bad guy is router $f$, and the hijacker has successfully framed someone other than himself.

5.2 Possibility of bringing down the network

When the attack is detected, the network administrator will isolate suspect repeaters from the network. Depending on the structure of the network, framing several carefully chosen repeaters can bring down the network. We show examples of bringing down the network in Fig. 10.

To prevent such a serious situation, the network topology should be designed robustly.

5.3 Preventing framing

Use of a simple or easily predicted sequence of Bell pairs for hijack detection allows a hijacker to hide his presence and to frame other nodes. This can result in something of a cat and mouse game if the hijacker lays low during the investigation. To prevent this, administrators need to conceal information about the sequence of hijack detection. For a given connection the choice of which Bell pairs will be used for hijack detection can be decided by the end nodes using some form of secret agreement, or the sequence can be chosen by an administrator and communicated securely to the set of nodes in the path. The interval between Bell pairs chosen for hijack detection, at each level of the check (number of hops spanned by the Bell pairs), must appear random to any outside observer. For example, in the left hand side of Fig. 7, node $b$ naturally must know which Bell pairs shared with $a$ will be used to check for hijacking between them, but it must not be able to predict which Bell pairs will be used to check for hijacking between $a$ and $c$. (both those directly reported by an end node and those that can otherwise be reasoned to be suspects)

As one of the draft, administrator every give the sequence information to repeaters which practice just before execution. The execute period should be to appear in randomly.

Administrator also consider the framing and perform isolation to all suspect repeaters (reported and all reportable repeaters). At the same time as isolation, the administrator should check isolated repeaters directly to close in on and confirm the identity of the hijacked repeater. After this quarantine, repeaters shown to be innocent will be gradually returned to the network. We will discuss the transition of network performance during these operation in next section.

6 Post process of hijacking detection

6.1 An increase of the work from rerouting penalty

When the network detects the hijacking of repeater $k$, $k$ and other suspected repeaters are isolated from other repeaters and all connections via suspect repeaters are forced to reroute. If all connections selected the shortest path, rerouting increases each path length by $\Delta_{sus,i}$, where $i$ denotes connection $i$ passing through suspected repeaters.

The increased work $W^{\prime}$ in contrast with $W$ in Eq. (5) can be described as follows:

[TABLE]

where $L_{sus}$, $H^{\prime type}_{sus,i}$ and $D^{\prime}_{sus,i}$ are work loss from isolation of suspected repeaters, the updated work and datarate for each rerouted connection not passing through suspected repeaters.

6.2 The occurrence of Work shedding

We next investigate the phase of network operations from the point view of the change of change in the network slack.

Phase 1. Network bootstrapping

During this phase, all network performance is spent on node and link tomography. Normal quantum communication has not started yet. The slack of the network will be narrow in this phase.

Phase 2. Normal operation

In the normal operation phase, the network requires node and link tomography within the interval $m$. Quantum communications subject to additional multilevel recursive tomography cost $M^{con}$ (in ES repeater cases; QEC network requires end to end tomography) corresponding to communication work. Then, the network slack $S$ becomes as follows:

[TABLE]

Here we assume $W=0.7C$, $R=0.1C$ and $S=0.2C$. Using the quantitative assumption after Eq. (14), this network is still provides 20 Bell pairs per second as surplus capacity.

We assume the repeater hijacking event occurs at a certain point in time in this phase. For efficient operation, the maintenance cost should be sufficiently smaller than the worst assumption of the work loss $L^{worst}_{sus}$ as follows:

[TABLE]

Here, “the maximum time from the start to detection of repeater hijacking” is equal to the time for verification $T$. Using Eq. (13), we can consider both the maintenance state analysis cost $M$ and $L_{sus}$ to be functions of $m$. To satisfy this requirement, we should not adopt an excessively small $m$. A larger $m$ suppresses the maintenance cost but increases the impact of repeater hijacking.

Phase 3. After repeater hijacking detection

After repeater hijacking detection, the troubled repeater is purged from the network and connections through that repeater are rerouted. As the rerouting progresses, the amount of work lost at a given moment is gradually reduced and the costs of rerouted connections increase, as above. Then, the slack of the network becomes as follows:

[TABLE]

where the subscript $sus$ denotes all suspected repeaters including the hijacked repeater $k$ and $R_{sus}$ denotes the maintenance costs for $sus$ and links to $sus$. As $S$ declines, queueing delays go up. If $S$ becomes zero or negative, we have insufficient capacity to support our current work, and must shed some work. The available network bandwidth goes down and we cannot avoid communication delay.

As an example, assume the extreme case in which $10$% repeaters of network are suspected of having been. Then, we can set $C_{sus}=0.1C$ and $R_{sus}=0.1R$. Using the assumption after Eq. (16), in order to keep the slack value positive, we need to keep $W^{\prime}<0.81C$. In other words, the increase in communication cost $W^{\prime}-W$ accompanying the route change has to stay less than $0.11C=$ 11 Bell pairs per sec. As in the above discussion, the slack of the network depends on interval parameters of tomography and the rerouting penalty.

Phase 4. Return of innocent repeaters

By careful verification, if the administrator believes she has reliably identified the really hijacked repeater $k$, isolated innocent repeaters are returned to the network. Then, the recoverd slack $S^{\prime\prime}$ and reconfigured work of the network $W^{\prime\prime}$ becomes as follows:

[TABLE]

Since $W^{\prime\prime}$ is obviously smaller than $W^{\prime}$, in some cases, we can expect that the workload shedding will be solved by returning the slack to a positive value.

7 Discussion

In this paper, we show the effects of repeater hijacking and appropriate network operations from the viewpoint of the slack on ES and QEC model quantum repeater networks. To make quantitative discussions, we quantify works of repeater network based on the required number of pulses for distributed quantum tomography. We present actual phases of quantum repeater network operation and expected maximum duration of repeater hijacking. To suppress work losses, we need larger maintenance costs and network slack is tight. For this reason, we recommend that the interval may be adjusted carefully to prevent the possibility of work shedding and the bringing of huge work losses for the actual network design. We also show the difference between ES and QEC model in identification of hijacking repeater. In the QEC model, we can detect hijacking but cannot always identify the hijacking repeater.

A single hijacked node can, in theory, bring down an entire network by leveraging two factors to frame other repeaters: the necessity of many distributed checks in the network to support effective operation, and the delayed dependence of the results of those checks on prior operations. Classical networks of course are vulnerable to various attacks on their routing algorithms that can make portions of the network unreachable, but no checks equivalent to post-entanglement swapping tomography are conducted, so no similar subversion mechanism is possible. Fortunately, the relatively simple fix of choosing Bell pairs for hijack checks in a random, secure manner can alleviate this vulnerability.

Acknowledgements

We would like to thank Shigeya Suzuki and Yohei Kuga for useful discussion. This material is based upon work supported by the Air Force Office of Scientific Research under award number FA2386-16-1-4096.