Practical security of continuous-variable quantum key distribution with   reduced optical attenuation

Yi Zheng; Peng Huang; Anqi Huang; Jinye Peng; Guihua Zeng

arXiv:1904.08777·quant-ph·July 17, 2019

Practical security of continuous-variable quantum key distribution with reduced optical attenuation

Yi Zheng, Peng Huang, Anqi Huang, Jinye Peng, Guihua Zeng

PDF

TL;DR

This paper examines the security vulnerabilities in practical continuous-variable quantum key distribution systems caused by reduced optical attenuation, proposing countermeasures to prevent potential intercept-resend attacks.

Contribution

It identifies a security loophole caused by reduced optical attenuation and introduces a real-time monitoring scheme with an optical fuse to enhance system security.

Findings

01

Reduced optical attenuation can lead to overestimated secret key rates.

02

A practical countermeasure with an optical fuse effectively resists intercept-resend attacks.

03

The proposed scheme enables precise evaluation of the secret key rate in CVQKD systems.

Abstract

In a practical CVQKD system, the optical attenuator can adjust the Gaussian-modulated coherent states and the local oscillator signal to an optimal value for guaranteeing the security of the system and optimizing the performance of the system. However, the performance of the optical attenuator may deteriorate due to the intentional and unintentional damage of the device. In this paper, we investigate the practical security of a CVQKD system with reduced optical attenuation. We find that the secret key rate of the system may be overestimated based on the investigation of parameter estimation under the effects of reduced optical attenuation. This opens a security loophole for Eve to successfully perform an intercept-resend attack in a practical CVQKD system. To close this loophole, we add an optical fuse at Alice's output port and design a scheme to monitor the level of optical…

Equations64

L = - 10 l g \frac{I _{out}}{I _{in}},

L = - 10 l g \frac{I _{out}}{I _{in}},

∣ α_{A} ⟩ = ∣ α_{A} ∣ e^{i θ} = x_{A} + i p_{A}, x_{A} = ∣ α_{A} ∣ cos θ, p_{A} = ∣ α_{A} ∣ sin θ,

∣ α_{A} ⟩ = ∣ α_{A} ∣ e^{i θ} = x_{A} + i p_{A}, x_{A} = ∣ α_{A} ∣ cos θ, p_{A} = ∣ α_{A} ∣ sin θ,

I_{A} \propto ∣ α_{A} ∣^{2}

I_{A} \propto ∣ α_{A} ∣^{2}

V_{A} = 2 ⟨ n ⟩ .

V_{A} = 2 ⟨ n ⟩ .

I_{out}^{'} = k I_{out} (k > 1) .

I_{out}^{'} = k I_{out} (k > 1) .

x_{A_{0}}^{'} = k x_{A_{0}}, p_{A_{0}}^{'} = k p_{A_{0}}, V_{A_{0}}^{'} = k V_{A_{0}},

x_{A_{0}}^{'} = k x_{A_{0}}, p_{A_{0}}^{'} = k p_{A_{0}}, V_{A_{0}}^{'} = k V_{A_{0}},

x_{B} = t x_{A_{0}} + z,

x_{B} = t x_{A_{0}} + z,

⟨ x_{A_{0}}^{2} ⟩ = V_{X_{A_{0}}}, ⟨ x_{A_{0}} x_{B} ⟩ = η T V_{X_{A_{0}}}, ⟨ x_{B}^{2} ⟩ = η T V_{X_{A_{0}}} + η T ξ + N_{0} + V_{el} .

⟨ x_{A_{0}}^{2} ⟩ = V_{X_{A_{0}}}, ⟨ x_{A_{0}} x_{B} ⟩ = η T V_{X_{A_{0}}}, ⟨ x_{B}^{2} ⟩ = η T V_{X_{A_{0}}} + η T ξ + N_{0} + V_{el} .

\hat{t} = \frac{\sum _{i = 1}^{m} x _{A_{0}_{i}} x _{B} _{i}}{\sum _{i = 1}^{m} x _{A_{0}_{i}}^{2}}, \overset{σ}{^}^{2} = \frac{1}{m} i = 1 \sum m (x_{B}_{i} - \hat{t} x_{A_{0}}^{2}_{i}) .

\hat{t} = \frac{\sum _{i = 1}^{m} x _{A_{0}_{i}} x _{B} _{i}}{\sum _{i = 1}^{m} x _{A_{0}_{i}}^{2}}, \overset{σ}{^}^{2} = \frac{1}{m} i = 1 \sum m (x_{B}_{i} - \hat{t} x_{A_{0}}^{2}_{i}) .

\hat{t}\sim\mathcal{N}\Bigg{(}t,\frac{\sigma^{2}}{\sum_{i=1}^{m}{{x^{2}_{A_{0}}}_{i}}}\Bigg{)},\frac{m{\hat{\sigma}}^{2}}{\sigma^{2}}\sim\chi^{2}(m-1),

\hat{t}\sim\mathcal{N}\Bigg{(}t,\frac{\sigma^{2}}{\sum_{i=1}^{m}{{x^{2}_{A_{0}}}_{i}}}\Bigg{)},\frac{m{\hat{\sigma}}^{2}}{\sigma^{2}}\sim\chi^{2}(m-1),

t \in [\hat{t} - Δ t, \hat{t} + Δ t], σ^{2} \in [\overset{σ}{^}^{2} - Δ σ^{2}, \overset{σ}{^}^{2} + Δ σ^{2}] .

t \in [\hat{t} - Δ t, \hat{t} + Δ t], σ^{2} \in [\overset{σ}{^}^{2} - Δ σ^{2}, \overset{σ}{^}^{2} + Δ σ^{2}] .

Δ t = z_{ϵ_{PE} / 2} \frac{σ ^ ^{2}}{m V _{X_{A_{0}}}}, Δ σ^{2} = z_{ϵ_{PE} / 2} \frac{σ ^ ^{2} 2}{m},

Δ t = z_{ϵ_{PE} / 2} \frac{σ ^ ^{2}}{m V _{X_{A_{0}}}}, Δ σ^{2} = z_{ϵ_{PE} / 2} \frac{σ ^ ^{2} 2}{m},

T = \frac{t ^ ^{2}}{η}, ε = \frac{σ ^ ^{2} - N _{0} - ν _{el} N _{0}}{N _{0} t ^ ^{2}} .

T = \frac{t ^ ^{2}}{η}, ε = \frac{σ ^ ^{2} - N _{0} - ν _{el} N _{0}}{N _{0} t ^ ^{2}} .

⟨ x_{A_{0}}^{2} ⟩ = V_{X_{A_{0}}}, ⟨ x_{A_{0}} x_{B}^{'} ⟩ = k η T V_{X_{A_{0}}}, ⟨(x_{B}^{'})^{2} ⟩ = k η T V_{X_{A_{0}}} + η T ξ + N_{0} + V_{el} .

⟨ x_{A_{0}}^{2} ⟩ = V_{X_{A_{0}}}, ⟨ x_{A_{0}} x_{B}^{'} ⟩ = k η T V_{X_{A_{0}}}, ⟨(x_{B}^{'})^{2} ⟩ = k η T V_{X_{A_{0}}} + η T ξ + N_{0} + V_{el} .

η T^{'} V_{X_{A_{0}}} = k η T V_{X_{A_{0}}}, η T^{'} V_{X_{A_{0}}} + η T^{'} ξ^{'} + N_{0} + V_{el} = k η T V_{X_{A_{0}}} + η T ξ + N_{0} + V_{el} .

η T^{'} V_{X_{A_{0}}} = k η T V_{X_{A_{0}}}, η T^{'} V_{X_{A_{0}}} + η T^{'} ξ^{'} + N_{0} + V_{el} = k η T V_{X_{A_{0}}} + η T ξ + N_{0} + V_{el} .

T^{'} = k T, ξ^{'} = \frac{ξ}{k} .

T^{'} = k T, ξ^{'} = \frac{ξ}{k} .

ε^{'} = \frac{ε}{k} (k > 1) .

ε^{'} = \frac{ε}{k} (k > 1) .

ξ_{PIR} = ξ_{t} + 2 u N_{0},

ξ_{PIR} = ξ_{t} + 2 u N_{0},

ε_{PIR} = ε_{t} + 2 u .

ε_{PIR} = ε_{t} + 2 u .

ε_{PIR}^{'} = \frac{ε _{t} + 0.4}{k} .

ε_{PIR}^{'} = \frac{ε _{t} + 0.4}{k} .

K = \frac{n}{N} [β I_{A B} - S_{BE}^{ϵ_{PE}} - Δ (n)],

K = \frac{n}{N} [β I_{A B} - S_{BE}^{ϵ_{PE}} - Δ (n)],

I_{A B} = \frac{1}{2} lo g_{2} \frac{V _{B}}{V _{B ∣ A_{0}}} = \frac{1}{2} lo g_{2} \frac{V _{A_{0}} + 1 + χ _{tot}}{1 + χ _{tot}} .

I_{A B} = \frac{1}{2} lo g_{2} \frac{V _{B}}{V _{B ∣ A_{0}}} = \frac{1}{2} lo g_{2} \frac{V _{A_{0}} + 1 + χ _{tot}}{1 + χ _{tot}} .

\begin{split}&{\Gamma_{AB}}=\\ &\left[{\begin{array}[]{*{20}{c}}{\left({V_{A_{0}}}+1\right)\mathbb{I}}&{\sqrt{{T_{\min}}\left({{V^{2}_{A_{0}}}+2{V_{A_{0}}}}\right)}{\sigma_{z}}}\\ {\sqrt{{T_{\min}}\left({{V^{2}_{A_{0}}}+2{V_{A_{0}}}}\right)}{\sigma_{z}}}&{\left[{{T_{\min}}\left({{V_{A_{0}}}+{\varepsilon_{\max}}}\right)+1}\right]\mathbb{I}}\end{array}}\right],\end{split}

\begin{split}&{\Gamma_{AB}}=\\ &\left[{\begin{array}[]{*{20}{c}}{\left({V_{A_{0}}}+1\right)\mathbb{I}}&{\sqrt{{T_{\min}}\left({{V^{2}_{A_{0}}}+2{V_{A_{0}}}}\right)}{\sigma_{z}}}\\ {\sqrt{{T_{\min}}\left({{V^{2}_{A_{0}}}+2{V_{A_{0}}}}\right)}{\sigma_{z}}}&{\left[{{T_{\min}}\left({{V_{A_{0}}}+{\varepsilon_{\max}}}\right)+1}\right]\mathbb{I}}\end{array}}\right],\end{split}

T_{m i n} = \frac{( t ^ - Δ t ) ^{2}}{η}, ε_{m a x} = \frac{σ ^ ^{2} + Δ σ ^{2} - N _{0} - ν _{el} N _{0}}{t ^ ^{2} N _{0}},

T_{m i n} = \frac{( t ^ - Δ t ) ^{2}}{η}, ε_{m a x} = \frac{σ ^ ^{2} + Δ σ ^{2} - N _{0} - ν _{el} N _{0}}{t ^ ^{2} N _{0}},

S_{BE}^{ϵ_{PE}} = i = 1 \sum 2 G (\frac{λ _{i} - 1}{2}) - i = 3 \sum 5 G (\frac{λ _{i} - 1}{2}),

S_{BE}^{ϵ_{PE}} = i = 1 \sum 2 G (\frac{λ _{i} - 1}{2}) - i = 3 \sum 5 G (\frac{λ _{i} - 1}{2}),

λ_{1, 2}^{2} = λ_{3, 4}^{2} = λ_{5} = \frac{1}{2} (A \pm A^{2} - 4 B), \frac{1}{2} (C \pm C^{2} - 4 D), 1,

λ_{1, 2}^{2} = λ_{3, 4}^{2} = λ_{5} = \frac{1}{2} (A \pm A^{2} - 4 B), \frac{1}{2} (C \pm C^{2} - 4 D), 1,

A B C D = (V_{A_{0}} + 1)^{2} - 2 T_{min} (V_{A_{0}}^{2} + 2 V_{A_{0}}) + [T_{min} (V_{A_{0}} + ε_{m a x}) + 1]^{2}, = [(T_{min} ε_{m a x} + 1) (V_{A_{0}} + 1) - T_{min} V_{A_{0}}]^{2}, = \frac{A χ _{hom} + ( V _{A_{0}} + 1 ) B + T _{min} ( V _{A_{0}} + ε _{m a x} ) + 1}{η T _{min} ( V _{A_{0}} + ε _{m a x} ) + 1 + ν _{el}}, = \frac{B ( V _{A_{0}} + 1 ) + B χ _{hom}}{η T _{min} ( V _{A_{0}} + ε _{m a x} ) + 1 + ν _{el}} .

A B C D = (V_{A_{0}} + 1)^{2} - 2 T_{min} (V_{A_{0}}^{2} + 2 V_{A_{0}}) + [T_{min} (V_{A_{0}} + ε_{m a x}) + 1]^{2}, = [(T_{min} ε_{m a x} + 1) (V_{A_{0}} + 1) - T_{min} V_{A_{0}}]^{2}, = \frac{A χ _{hom} + ( V _{A_{0}} + 1 ) B + T _{min} ( V _{A_{0}} + ε _{m a x} ) + 1}{η T _{min} ( V _{A_{0}} + ε _{m a x} ) + 1 + ν _{el}}, = \frac{B ( V _{A_{0}} + 1 ) + B χ _{hom}}{η T _{min} ( V _{A_{0}} + ε _{m a x} ) + 1 + ν _{el}} .

Δ (n) = 7 \frac{lo g _{2} ( 1 / 1 ϵ ϵ )}{n} + \frac{2}{n} lo g_{2} \frac{1}{ϵ _{PA}},

Δ (n) = 7 \frac{lo g _{2} ( 1 / 1 ϵ ϵ )}{n} + \frac{2}{n} lo g_{2} \frac{1}{ϵ _{PA}},

var (U) = ⟨ U^{2} ⟩ - ⟨ U ⟩^{2} = \frac{1}{N _{u}} i = 1 \sum N_{u} U_{i}^{2} - (\frac{1}{N _{u}} i = 1 \sum N_{u} U_{i})^{2},

var (U) = ⟨ U^{2} ⟩ - ⟨ U ⟩^{2} = \frac{1}{N _{u}} i = 1 \sum N_{u} U_{i}^{2} - (\frac{1}{N _{u}} i = 1 \sum N_{u} U_{i})^{2},

var^{'} (U) = var (U) + z_{ϵ_{PE} / 2} \frac{var ( U ) 2}{N _{u}} .

var^{'} (U) = var (U) + z_{ϵ_{PE} / 2} \frac{var ( U ) 2}{N _{u}} .

Peer Reviews

No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.

Videos

No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.

Full text

††thanks: Corresponding author: [email protected]††thanks: Corresponding author: [email protected]

Practical security of continuous-variable quantum key distribution with reduced optical attenuation

Yi Zheng

College of Information Science and Technology, Northwest University, Xi’an 710127, Shaanxi, China

Peng Huang

State Key Laboratory of Advanced Optical Communication Systems and Networks, and Center of Quantum Information Sensing and Processing, Shanghai Jiao Tong University, Shanghai 200240, China

Anqi Huang

Institute for Quantum Information $\&$ State Key Laboratory of High Performance Computing, College of Computer, National University of Defense Technology, Changsha 410073, China

Greatwall Quantum Laboratory, China Greatwall Technology, Changsha 410205, China

Jinye Peng

College of Information Science and Technology, Northwest University, Xi’an 710127, Shaanxi, China

Guihua Zeng

State Key Laboratory of Advanced Optical Communication Systems and Networks, and Center of Quantum Information Sensing and Processing, Shanghai Jiao Tong University, Shanghai 200240, China

Abstract

In a practical CVQKD system, the optical attenuator can adjust the Gaussian-modulated coherent states and the local oscillator signal to an optimal value for guaranteeing the security of the system and optimizing the performance of the system. However, the performance of the optical attenuator may deteriorate due to the intentional and unintentional damage of the device. In this paper, we investigate the practical security of a CVQKD system with reduced optical attenuation. We find that the secret key rate of the system may be overestimated based on the investigation of parameter estimation under the effects of reduced optical attenuation. This opens a security loophole for Eve to successfully perform an intercept-resend attack in a practical CVQKD system. To close this loophole, we add an optical fuse at Alice’s output port and design a scheme to monitor the level of optical attenuation in real time, which can make the secret key rate of the system evaluated precisely. The analysis shows that these countermeasures can effectively resist this potential attack.

pacs:

03.67.Hk, 03.67.-a, 03.67.Dd

I INTRODUCTION

In the field of quantum cryptography, quantum key distribution (QKD) technology has attracted widely attention due to its unconditional security based on the guarantee of the basic laws of quantum physics Ekert1991Quantum ; Lo1999Unconditional . It is a relatively mature technology to share symmetric keys between the authorized communication parties Alice and Bob through an insecure quantum channel that can be freely controlled and manipulated by a potential eavesdroppers Eve Ekert1991Quantum ; Lo1999Unconditional ; gisin2002quantum ; weedbrook2012gaussian . At present, QKD systems can be divided into the two broad classes: discrete-variable quantum key distribution (DVQKD) and continuous-variable quantum key distribution (CVQKD). In comparison with DVQKD systems, CVQKD systems using weak coherent states and a homodyne detector can be well compatible with the existing optical communication systems weedbrook2012gaussian ; Takesue2007Quantum ; grosshans2003quantum ; qi2007experimental ; fossier2009improvement . Therefore, research of CVQKD has far-reaching significance.

In particular, CVQKD with the Gaussian-modulated coherent states (GMCS) is the most favorable scheme, which has been experimentally implemented by many research groups in laboratories and in field environment qi2007experimental ; fossier2009field ; Jouguet2012Experimental ; huang2016field ; wang201525 . Here, we also focus on the exploration of GMCS CVQKD schemes. Although GMCS CVQKD schemes have been theoretically proven to be secure against the collective and coherent attacks Jouguet2012Analysis ; leverrier2013security , there are some security loopholes that can be used for hiding their attacks by Eve in practical experimentations of such schemes, such as the local oscillator (LO) fluctuation attack Ma2014Local , the LO calibration attack Jouguet2013Preventing , the wavelength attack Huang2013Quantum ; Ma2014Wavelength , the saturation attack Qin2016Quantum , finite sampling bandwidth effects Wang2016Practical , homodyne detector blinding attack qin2018homodyne , jitter in clock synchronization xie2018practical , and the polarization attack zhao2018polarization . Subsequently, many corresponding countermeasures have been proposed by researchers. To be specific, in order to resist the attacks related to LO, a real-time shot-noise measurement (RTSNM) scheme is proposed by researchers Kunzjacques2015Robust ; Wang2018Practical . Recently, a local LO (LLO) CVQKD scheme is designed and implemented experimentally, which can fundamentally close the security loophole originates from LO huang2015high-speed ; soh2015self ; qi2015generating ; tao2018high ; wang2018pilot . In addition, the proposed continuous-variable measurement-device-independent quantum key distribution (CV-MDI-QKD) schemes can completely eradicate all fatal loopholes related to the detector pirandola2015high-rate ; li2014continuous-variable . This history shows that the discovery of security loopholes promotes study of corresponding countermeasures, enhancing the practical security of CVQKD. Therefore, the explorations of the concealed security loopholes are vital to the practical application of CVQKD.

Optical attenuation is one of the key steps in the implementation of CVQKD schemes. However, the performance of optical attenuators may deteriorate due to environmental perturbations. For example, Eve can reduce its attenuation level through laser damage attack huang2018quantum ; bugge2014laser . In particular, the influences, which originate from the decrease of optical attenuation, are ambiguous for the performance of a practical CVQKD system. In this paper, we mainly investigate how the decrease of optical attenuation affects the performance of the system. More specifically, we first reveal the deviation between the ideal states and the transmitted Gaussian-modulated states affected by the reduced optical attenuation. Then, we explore the quantum channel parameter estimation under these effects based on the above analysis. Our results show that the channel excess noise may be underestimated by Alice and Bob under the effects of decreased optical attenuation. Subsequently, the secret key rate is overestimated by Alice and Bob, which is coincident with the security analysis result of DVQKD under the effects of reduced optical attenuation huang2019laser . Thus, the decrease of optical attenuation may open a security loophole for Eve to successfully hide her attacks, such as the classical non-Gaussian attack, i.e., the intercept-resend attack. To eliminate this loophole, we add an optical fuse at Alice’s output port and design a real-time monitoring scheme of the level of optical attenuation for a practical CVQKD system. The analysis indicates that Alice and Bob can precisely evaluate the channel parameters to accurately calculate the secret key rate for a practical CVQKD system through this scheme.

This paper is organized as follows. In Sec. II, the effects of decreased optical attenuation are described and modeled. Then, we analyse the parameter estimation of GMCS CVQKD systems with reduced optical attenuation in Sec. III. By considering the effects of reduced optical attenuation, in Sec. IV, we evaluate the secret key rate against collective attacks through theoretical calculation and simulation. To resist the loophole induced by decreased optical attenuation, we add an optical fuse at Alice’s output port and design a real-time monitoring method for optical attenuation in Sec. V. Finally, conclusions are presented in Sec. VI.

II THE EFFECTS OF REDUCED OPTICAL ATTENUATION

Optical attenuators can reduce the intensity of their input optical signals to satisfy with the request of QKD systems. In particular, variable optical attenuator (VOA) is one well-known attenuator that can adjust the level of attenuation. The level of attenuation is represented as

[TABLE]

where $I_{\text{in}}$ and $I_{\text{out}}$ are the intensity of the input and output optical signals in VOA, respectively. However, in practical experimentation, the level of attenuation may not achieve the excepted goal due to the effects of environmental perturbations. For example, Eve may perform the laser damage attack on VOA to reduce its attenuation level in a running DVQKD system. Specifically, Eve can inject suitable light to the VOA via quantum channel to deteriorate the performance of the attenuator (see Fig. 1) huang2018quantum ; bugge2014laser . In particular, the VOA can suffer catastrophic damage when the attack reaches a certain power, which has been shown experimentally huang2018quantum . Fig. 1 also reflects the relationship between the intensity of the output and input optical signal in VOA under the effects of the laser damage attack based on the Eq.(1). Obviously, the intensity of the output optical signal for the attacked VOA is greater than its ideal value.

Optical attenuator is also a key device for the implementation of a CVQKD system. Similarly, VOA has been widely used in the CVQKD systems. In particular, VOA is used in the transmitter of a practical CVQKD system (see Fig. 2), which can attenuate the intensity of the Gaussian-modulated optical signal $A$ to quantum level for guaranteeing the unconditional security of the system based on the basic laws of quantum physics grosshans2003quantum ; fossier2009improvement ; leverrier2013security ; weedbrook2012gaussian . It is notable that the attenuation level of VOA in the CVQKD systems can be also decreased by Eve through laser damage attack. Here, after attenuation, we use $A_{0}$ and $A^{\prime}_{0}$ to represent the ideal quantum signal and imperfect quantum signal, respectively.

More specifically, in a Gaussian-modulated scenario, Alice generates a series of Gaussian-modulated coherent states $|\alpha_{A}\rangle$ based on the key information weedbrook2012gaussian . In the phase space, $|\alpha_{A}\rangle$ can be expressed as

[TABLE]

where $|\alpha_{A}|$ and $\theta$ respectively indicate the amplitude and phase of the Gaussian-modulated optical signal $A$ , $x_{A}$ and $p_{A}$ are two independent quadratures variables with identical variance $V_{A}$ and zero mean grosshans2003quantum ; weedbrook2012gaussian . Moreover, the intensity $I_{A}$ and amplitude $|\alpha_{A}|$ of the optical signal $A$ obey the following relation:

[TABLE]

Therefore, Alice can adjust the values of $x_{A}$ and $p_{A}$ to the appropriate values $x_{A_{0}}$ and $p_{A_{0}}$ by VOA. Here, $x_{A_{0}}$ and $p_{A_{0}}$ are two quadratures variables of the ideal quantum optical signal $A_{0}$ . Correspondingly, $|\alpha_{A_{0}}\rangle=x_{A_{0}}+ip_{A_{0}}$ is the transmitted Gaussian-modulated coherent states. In addition, the variance $V_{A}$ of the quadratures variables $x_{A}$ or $p_{A}$ in terms of the mean photon number of optical signal $A$ reads laudenbach2018continuous

[TABLE]

Equally, the variance $V_{A}$ can also be attenuated to the preset value $V_{A_{0}}$ by Alice through VOA in a practical CVQKD system.

However, $x_{A_{0}}$ , $p_{A_{0}}$ and $V_{A_{0}}$ may deviate from the ideal values due to the effects of reduced optical attenuation, which is revealed in Fig. 3 based on the phase space. In the following analysis, we assume that $I^{\prime}_{\text{out}}$ and $I_{\text{out}}$ satisfy with the following relation:

[TABLE]

Correspondingly, according to the above analysis, the changes of $x_{A_{0}}$ , $p_{A_{0}}$ and $V_{A_{0}}$ are as follows:

[TABLE]

where $x^{\prime}_{A_{0}}$ and $p^{\prime}_{A_{0}}$ are two independent quadratures variables of imperfect quantum signal $A^{\prime}_{0}$ , $V^{\prime}_{A_{0}}$ are the variance of $x^{\prime}_{A_{0}}$ or $p^{\prime}_{A_{0}}$ .

Apart from these, the intensity of LO signal needs to be adjusted to an optimal value by VOA to optimize the performance of a practical CVQKD system. There is no doubt that the intensity of LO signal can deviate from the optimal value under the effects of reduced optical attenuation. In practice, however, the effects of decreased optical attenuation on the LO signal can be completely eliminated through the real-time shot-noise measurement technique. The basic principle of the technique is illustrated in the Fig. 4. Specifically, Bob first splits a fraction of LO signal to a balanced homodyne detector. Further, the variance of shot-noise can be evaluated through the interference between the separated LO signal and the vacuum mode. In addition, according to the calibrated linear relation between the variance of shot-noise and the intensity of LO signal, the variance can be also evaluated by monitoring the intensity of the LO signal in real time. Accordingly, we will focus on the investigation of the effects of reduced optical attenuation on signal states, i.e., the Gaussian-modulated coherent states, in the following analysis.

III PARAMETER ESTIMATION UNDER THE EFFECTS OF REDUCED OPTICAL ATTENUATION

The key distribution process of the one-way GMCS CVQKD systems can be described by the standard prepare-and-measure (PM) model. However, in practical implementation of CVQKD schemes, the evaluation of the secret key rate is accomplished based on the equivalent entanglement-based (EB) scheme. The sender Alice first prepares one two-mode squeezed (EPR) state with variance $V=V_{A_{0}}+1$ . Subsequently, the mode $A$ is measured by a heterodyne detector, and the mod $A_{0}$ is sent to the the receiver Bob through a quantum channel with transmissivity $T$ and excess noise $\varepsilon$ . Then, Bob exploits a homodyne detector with efficiency $\eta$ and noise $\nu_{\text{el}}$ to measure the quadratures $x_{B}$ or $p_{B}$ of his received mode $B_{2}$ (see Fig. 5) fossier2009improvement . In addition, the homodyne detector inefficiency is modelled by a beam splitter. Finally, it is essential to perform classical post-processing which includes sifting, parameter estimation, key reconciliation and privacy amplification fossier2009improvement ; grosshans2003quantum ; Wang2018High ; li2018memory . In particular, parameter estimation is a key step which determines the secret key rate and the maximal transmission distance for a practical CVQKD system.

After transmission and detection of the quantum coherent states, Alice and Bob share a group correlated vectors $X=\{(x_{{A_{0}}_{i}},{x_{B}}_{i})|i=1,2,\ldots,N\}$ or $P=\{(p_{{A_{0}}_{i}},{p_{B}}_{i})|i=1,2,\ldots,N\}$ . Here, $N$ is the total number of the received pulses. The involved quantum channel for GMCS CVQKD systems is assumed to be a normal linear model which satisfies the following relation between Alice and Bob:

[TABLE]

where $t=\sqrt{\eta t}$ , vector $z$ is the total noises term following a centered normal distribution with variance $\sigma^{2}=\eta T\xi+N_{0}+V_{\text{el}}$ . Here, the related parameter $\eta$ is detection efficiency of the homodyne detector, $V_{\text{el}}$ is electronic noise of the homodyne detector, $N_{0}$ is the variance of shot-noise. Accordingly, $x_{A_{0}}$ and $x_{B}$ meet the following relations:

[TABLE]

There is no doubt that $p_{A_{0}}$ and $p_{B}$ also satisfy Eqs. (7) and (8). Moreover, in the evaluation of the secret key rate, the above parameters $V_{X_{A_{0}}}$ , $\xi$ and $V_{\text{el}}$ must be described by $V_{A_{0}}N_{0}$ , $\varepsilon N_{0}$ and $\nu_{\text{el}}N_{0}$ , respectively.

In practical experimentation, Alice and Bob randomly extract $m(m<N)$ pairs data from $X$ or $P$ vectors to estimate the parameters $T$ and $\xi$ . The maximum-likelihood estimators $\hat{t}$ and ${\hat{\sigma}}^{2}$ are known with the normal linear model leverrier2010finite ; Jouguet2012Analysis , which are

[TABLE]

Here, parameters $\hat{t}$ and ${\hat{\sigma}}^{2}$ are independent estimators which obey the distributions

[TABLE]

where $t$ and ${\sigma}^{2}$ are the true values of these parameters. The $\chi^{2}$ distribution converges to a normal distribution under the condition that $m$ is large enough (e.g., $m>10^{6}$ ). Therefore, the confidence intervals for the estimators $\hat{t}$ and $\hat{\sigma}^{2}$ are

[TABLE]

Here,

[TABLE]

where $\epsilon_{\text{PE}}$ is a probability that the estimated parameter does not belong to the confidence region, $z_{\epsilon_{\text{PE}}/{2}}$ is a coefficient following $1-\frac{1}{2}\text{erf}(z_{\epsilon_{\text{PE}}/{2}}/\sqrt{2})=\frac{1}{2}\epsilon_{\text{PE}}$ , and $\text{erf}(\cdot)$ is the error function defined as $\text{erf}(x)=\frac{2}{\sqrt{\pi}}\int_{0}^{x}e^{-t^{2}}dt$ . Making use of the previous estimators, the quantum channel parameters, i.e., the transmission $T$ and excess noise $\varepsilon$ , can be estimated by

[TABLE]

According to the analysis in Sec. II, the transmitted Gaussian-modulated coherent states under the effects of reduced optical attenuation are different from the ideal states with perfect optical attenuation for a practical CVQKD system. It should be noted that $x^{\prime}_{A_{0}}$ and $x^{\prime}_{B}$ also satisfy with Eqs. (7) and (8), i.e., $x^{\prime}_{B}=tx^{\prime}_{A_{0}}+z$ , $\langle({x^{\prime}_{A_{0}}})^{2}\rangle=V^{\prime}_{X_{A_{0}}},\langle{x^{\prime}_{A_{0}}}{x^{\prime}_{B}}\rangle=\sqrt{\eta T}V^{\prime}_{X_{A_{0}}}$ , $\langle({x^{\prime}_{B}})^{2}\rangle=\eta TV^{\prime}_{X_{A_{0}}}+\eta T\xi+N_{0}+V_{\text{el}}$ . Here, $V^{\prime}_{X_{A_{0}}}=V^{\prime}_{A_{0}}{N_{0}}$ , $x^{\prime}_{B}$ is the practical value detected by Bob under the effects of imperfect optical attenuation.

However, Alice and Bob still use $x_{A_{0}}$ to estimate parameters for a CVQKD system with reduced attenuation under the condition that they do not aware the shifting of the attenuation level of VOA. Therefore, the relations between vectors kept by Alice and Bob become

[TABLE]

Finally, based on Eqs. (8) and (14), we get

[TABLE]

Solving these equations yields

[TABLE]

Expressed in shot-noise unit, the estimated excess noise become

[TABLE]

Fig. 6 shows the estimated excess noise as a function of $k$ under $\varepsilon=0.01,0.03,0.05$ , respectively. It is clearly that the channel excess noises are underestimated under the effects of reduced optical attenuation. We find that with the increment of the value of $k$ , the estimated values of various channel excess noises will decrease. When the attenuation level deteriorates to a certain extent, the excess noise estimated by Alice and Bob may be close to zero. These analysis results indicate that the reduced optical attenuation may create a condition for Eve to conceal her attacks in a practical CVQKD system. Next, we use the classical partial intercept-resend (PIR) attack as an example to analyse the security of a practical CVQKD system under the effects of reduced optical attenuation.

In the PIR attack, the probability distribution of Bob’s measurements is weighted sum of two Gaussian distributions Jouguet2013Preventing ; lodewyck2007experimental . The first one is the distribution of the intercepted resend data with a weight of $u$ , and the other one is the distribution of the transmitted data with a weight of $1-u$ . Further, the extra excess noise induced by the PIR attack is expressed by $2uN_{0}$ . In theory, the excess noise estimated by Alice and Bob under the effects of the PIR attack should be written as

[TABLE]

where $\xi_{t}=\varepsilon_{t}N_{0}$ is the technical excess noise of the system. Expressed in shot-noise, the estimated excess noise $\xi_{\text{PIR}}$ can be computed as

[TABLE]

Here, we use $u=0.2$ as an example to analyse the PIR attack in general situation. Correspondingly, the estimated excess noise become $\varepsilon_{t}+0.4$ . In this case, the estimated excess noise under the effects of reduced optical attenuation should be calculated as

[TABLE]

In a practical CVQKD system, we assume that the technical excess noise is a typical value, i.e., $\varepsilon_{t}=0.1$ . Therefore, when Eve executes the PIR attack, the estimated excess noise under the effects of reduced optical attenuation can be calculated as $\varepsilon^{\prime}_{\text{PIR}}=\frac{0.5}{k}$ . In the case of perfect optical attenuation, the noise value is $0.5$ . The obvious increase of the excess noise makes the potential attack exposed. Hence, denial-of-service can occur to guarantee the security of the system. However, we find that Eve can exploit the effects of decreased optical attenuation to reduce the estimated excess noise. For example, when $k=5$ , the estimated excess noise $\varepsilon^{\prime}_{\text{PIR}}=0.1$ , i.e., the ideal noise value without attack. Here, based on Eqs. (1) and (5), Eve can reduce the attenuation level of the VOA by $10\lg 5\approx 7\text{dB}$ to satisfy with $k=5$ . These analysis results fully demonstrate that the excess noise induced by the PIR attack can be completely hidden with the help of reduced optical attenuation. In particular, a full intercept-resend (FIR) attack can be implemented when $u=1$ . Correspondingly, the excess noise estimated by Alice and Bob under the effects of reduced optical attenuation should be expressed as $\varepsilon_{\text{FIR}}=\frac{2.1}{k}$ . In this case, when $k$ exceeds 21, the strongest FIR attack can be completely hidden by Eve. Therefore, the decreased optical attenuation will open a loophole for Eve to hide her attacks, which seriously destroys the security of the practical system.

IV SECRET KEY RATE AGAINST COLLECTIVE ATTACKS UNDER THE EFFECTS OF REDUCED OPTICAL ATTENUATION

The secret key rate and the maximal transmission distance are the key standards for the performance evaluation of a practical CVQKD system. Based on the parameters ${V_{A_{0}}}$ , $T$ , $\varepsilon$ , $\eta$ and ${\nu_{\text{el}}}$ , Alice and Bob can calculate the information shared by them, as well as the maximal bound on the information available to eavesdropper. In the case of reverse reconciliation, the secret key rate $K$ with $n$ received pulses used for key establishment against collective attacks is expressed as fossier2009improvement ; leverrier2010finite

[TABLE]

where $n=N-m$ , and $\beta\in({0,1})$ is the reconciliation efficiency. $S_{\text{BE}}^{\epsilon_{\text{PE}}}$ represents the maximal value of the Holevo information compatible with the statistics except with probability ${\epsilon_{\text{PE}}}$ , and ${I_{AB}}$ represents the shannon mutual information between Alice and Bob, which can be derived from Bob’s measured variance ${V_{B}}$ and the conditional variance ${V_{B|A_{0}}}$ as

[TABLE]

Here, $\chi_{\text{tot}}=\chi_{\text{line}}+\chi_{\text{hom}}/T$ represents the total noise referred to the channel input, where $\chi_{\text{line}}=1/T-1+\varepsilon$ , and $\chi_{\text{hom}}=[({1-\eta})+\nu_{\text{el}}]/\eta$ . In particular, $S_{\text{BE}}^{\epsilon_{\text{PE}}}$ is determined by the following covariance matrix between Alice and Bob with finite-size effect:

[TABLE]

where matrices ${\mathbb{I}}=\left[{\begin{array}[]{*{20}{c}}1&0\\ 0&1\end{array}}\right]$ and ${\sigma_{z}}=\left[{\begin{array}[]{*{20}{c}}1&0\\ 0&{-1}\end{array}}\right]$ , ${T_{\min}}$ and ${\varepsilon_{\max}}$ correspond the lower bound of $T$ and the upper bound of $\varepsilon$ , respectively. According to Ref. leverrier2010finite , when $m$ is large enough (e.g., $m>10^{6}$ ), $T_{\min}$ and $\varepsilon_{\max}$ can be calculated by using

[TABLE]

where $\Delta t$ and $\Delta\sigma^{2}$ are defined in Eq. (12). Then, $S_{\text{BE}}^{\epsilon_{\text{PE}}}$ can be acquired by

[TABLE]

where $G\left(x\right)=\left({x+1}\right){\log_{2}}\left({x+1}\right)-x{\log_{2}}x$ , ${\lambda_{i}}\geq 1$ are sympletic eigenvalues derived from covariance matrices, which can be written as

[TABLE]

where

[TABLE]

Moreover, $\Delta\left(n\right)$ is a linear function of $n$ in Eq. (21), which is related to the security of the privacy amplification. In a practical CVQKD system, it can be given by leverrier2010finite

[TABLE]

where $\overline{\epsilon}$ and ${\epsilon_{\text{PA}}}$ , which are virtual parameters and can be optimized in the computation, denote the smoothing parameter and the failure probability of the privacy amplification, respectively. In addition, $\overline{\epsilon}$ and ${\epsilon_{\text{PA}}}$ are usually set to be equal to ${\epsilon_{\text{PE}}}$ due to the value of $\Delta(n)$ mainly depends on $n$ .

Based on the above equations, Alice and Bob can calculate the secret key rate with finite-size effect against collective attacks for the system. Therefore, the secret key rate can be regarded as a function of the above parameters, i.e., $K=K(V_{A_{0}},T,\varepsilon,\nu_{\text{el}})$ . According to the analysis in Sec. III, the estimated quantum channel parameters under reduced optical attenuation are different from their true values. In addition, the variation of $V_{A_{0}}$ can also not be detected by Alice and Bob when the modulation variance is not be monitored in a practical CVQKD system. Accordingly, the evaluated secret key rate for a CVQKD system with decreased optical attenuation is expressed as $K_{e}=K(V_{A_{0}},T^{\prime},\varepsilon^{\prime},\nu_{\text{el}})$ . However, the practical secret key rate should be calculated as $K_{p}=K(V^{\prime}_{A_{0}},T,\varepsilon,\nu_{\text{el}})$ . In order to clearly reveal the difference between the evaluated secret key rate and the practical secret key rate for a practical CVQKD system with reduced optical attenuation, we simulate the secret key rate versus transmission distance under different excess noise $\varepsilon$ .

Fig. 7 depicts the relationship between the secret key rate and the transmission distance for a practical CVQKD system under the effects of different deterioration situations when $\varepsilon=0.01,0.05$ . The fixed parameters for the simulation are set as: $V_{A_{0}}=4,\eta=0.5,\nu_{\text{el}}=0.01,\beta=95\%,\epsilon=10^{-10},m=0.5\times N$ , respectively. It is obvious that the secret key rate $K_{e}$ evaluated by Alice and Bob under the effects of reduced optical attenuation is overestimated compared with their practical value $K_{p}$ . The simulation results also demonstrate that the decreased optical attenuation can open a security loophole for Eve to perform an intercept-resend attack in a practical CVQKD system.

In particular, the difference between the estimated secret key rate under reduced optical attenuation and the practical secret key rate in the same situation reflects the key information that can be acquired by Eve through the intercept-resend attack. We find that the leaking of the secret key information increases with the decrease of optical attenuation. In addition, the simulation results also indicate that Eve can acquire more secret key information in the case of a larger excess noise $\varepsilon$ under the effects of the same amount of decrease of optical attenuation.

More importantly, the defense of the attack is a key task. We observe that the changes of the modulation variance of the system and the attenuation level of VOA are synchronous in a practical CVQKD system. Therefore, the real-time monitoring of the modulation variance of the system might close this loophole, which is investigated in detail in next section.

V COUNTERMEASURES

The above investigations show that the influences of reduced optical attenuation effect on the estimated parameters procedures and the evaluated secret key rate. To remove the loophole induced by reduced optical attenuation, we here add an isolator at Alice’s output port to resist the potential laser damage attack. More specifically, we first bound the power of Eve’s injected light to a reasonable based on the method in Ref. lucamarini2015practical , and then choose an appropriate isolator for the system. However, it might be possible that Eve is able to decrease the performance of the isolator by using the laser damage attack. Therefore, the isolation value should be monitored in real time. In order to reduce costs and improve efficiency, we can replace the isolator with an optical fuse. The optical fuse can only tolerate a certain amount of laser power but disconnects itself once the power crosses a threshold. In this way, the optical fuse physically blocks the injected high power, which effectively protects the system from the laser damage attack.

Apart from the laser damage attack, the attenuation value may decrease due to the effects of the rising of environment temperature. Accordingly, we propose a real-time monitoring scheme for the level of optical attenuation to prevent the incorrect estimation of channel parameters. According to the analysis of Section. II, we find that the performance of the optical attenuator can be evaluated by monitoring the real-time variation of the modulation variance before the transmission of quantum signal.

Fig. 8 shows the procedure of the real-time monitoring scheme of the level of optical attenuation for a practical CVQKD system in Alice’s apparatus. Specifically, Alice first splits a fraction of the attenuated quantum signal and the undamped LO signal. Then, Alice can get a sample $U$ after the interference between the separated quantum signal and LO signal in a homodyne detector. The detection module has been described in Fig. 4. In the sample, all data are the sampled voltage values. Then, the variance of these data can be counted as

[TABLE]

where $N_{u}$ is the size of the sample, $U_{i}$ is the ith data in the sample. Since the sample is finite, the value of $\text{var}(U)$ should be modified as

[TABLE]

Subsequently, the measured variance of the quadrature variables $x_{A_{0}}$ or $p_{A_{0}}$ of the separated quantum signal can be calculated as laudenbach2018continuous

[TABLE]

where $P_{\text{LO}}$ is the power of the separated local oscillator, $\rho$ is the PIN diode’s responsivity, $g$ is the total amplification of the homodyne detector, $B$ is electronic bandwidth, $h$ is Planck’s constant, $f$ is optical frequency. Because these parameters are some constant values, Alice can analyse the variation of the modulation variance through the sample $U$ . Further, the practical variance of the quadrature variables $X_{A_{0}}$ or $P_{A_{0}}$ can be calculated as

[TABLE]

Therefore, $k$ can be acquired in real time by analysing the difference between $V_{p}$ and the preset modulation variance $V_{A_{0}}$ , i.e., $k=\frac{V^{\prime}_{A_{0}}}{V_{A_{0}}}=\frac{V_{p}}{V_{A_{0}}}$ . Finally, Alice and Bob can utilize the acquired $V_{p}$ and $k$ to precisely evaluate the secret key rate of the system, i.e., $K_{m}=K(V_{p},\frac{T^{\prime}}{k},k\varepsilon^{\prime},\nu_{\text{el}})=K_{p}$ . These analysis results fully indicate that the real-time monitoring scheme can effectively resist the loophole induced by reduced optical attenuation.

Importantly, in the proposed scheme, the homodyne detector and the separated LO signal may be controlled by Eve. Fortunately, the countermeasures against the attacks related to LO and homodyne detector has been designed well in Refs .Wang2016Practical ; Jouguet2013Preventing ; Qin2016Quantum ; qin2018homodyne . Based on these corresponding countermeasures, the proposed monitoring scheme is immune to Eve. In addition, the monitoring module may reduce the performance of the system, and add the complexity of the implementation of the system. However, it is notable that the influences of the losses of the Gaussian-modulated signal and LO signal can be completely eliminated by properly adjusting the preset value of the attenuation level of VOA in a practical CVQKD system.

Through the combination of the above countermeasures, the modulation variance of the system can be precisely evaluated in real time. Eventually, the secret key rate of the CVQKD systems with reduced optical attenuation can be precisely evaluated to effectively remove this security loophole with the help of these schemes.

VI CONCLUSION

We have investigated the impacts of reduced optical attenuation for a practical CVQKD system. We reveal that the transmitted Gaussian-modulated coherent states will deviate from the preset values under the effects of decreased optical attenuation. Further, we find that the estimated channel excess noise is smaller than the practical value under the influences of reduced optical attenuation. This effect makes the secret key rate of the system overestimated, which can open a security loophole for Eve to successfully perform the intercept-resend attack in a practical CVQKD system. We show that Eve can obtain more key information for the case of a larger channel excess noise in the same amount of decrease of optical attenuation. Eve also can obtain more key information by reducing the attenuation value further. In order to close the loophole induced by reduced optical attenuation, we first add an optical fuse at Alice’s output port and then propose a real-time monitoring scheme for the attenuation level of VOA in a practical CVQKD system by analysing the variation of the variance of the quadrature variables $X_{A_{0}}$ or $P_{A_{0}}$ of the attenuated quantum signal before send to Bob. These countermeasures can make Alice and Bob precisely evaluate the channel parameters to accurately analyse the performance of the CVQKD systems with reduced optical attenuation.

ACKNOWLEDGMENTS

This work was supported by the National key research and development program (Grant No. 2016YFA0302600), the National Natural Science Foundation of China (Grants No. 61671287, 61631014, 61332019, 61632021), and the Nature Fund of Science in Shaanxi in 2018(Grant No. 2018JM6123).

Bibliography41

The reference list from the paper itself. Each links out to its DOI / PubMed record.

1(1) A. K. Ekert. Quantum cryptography based on bell’s theorem. Physical Review Letters, 67(6):661, 1991.
2(2) H. K. Lo and H. F. Chau. Unconditional security of quantum key distribution over arbitrarily long distances. Science, 283(5410):2050-2056, 1999.
3(3) Nicolas Gisin, Grégoire Ribordy, Wolfgang Tittel, and Hugo Zbinden. Quantum cryptography. Reviews of modern physics, 74(1):145, 2002.
4(4) Christian Weedbrook, Stefano Pirandola, Raúl García-Patrón, Nicolas J Cerf, Timothy C Ralph, Jeffrey H Shapiro, and Seth Lloyd. Gaussian quantum information. Reviews of Modern Physics, 84(2):621, 2012.
5(5) Hiroki Takesue, Sae Woo Nam, Qiang Zhang, Robert H. Hadfield, Toshimori Honjo, Kiyoshi Tamaki, and Yoshihisa Yamamoto. Quantum key distribution over a 40-d B channel loss using superconducting single-photon detectors. Nature Photonics, 1(17):5078-5081, 2007.
6(6) Frédéric Grosshans, Gilles Van Assche, Jérôme Wenger, Rosa Brouri, Nicolas J Cerf, and Philippe Grangier. Quantum key distribution using gaussian-modulated coherent states. Nature, 421(6920):238, 2003.
7(7) Bing Qi, Lei-Lei Huang, Li Qian, and Hoi-Kwong Lo. Experimental study on the Gaussian-modulated coherent-state quantum key distribution over standard telecommunication fibers. Physical Review A, 76(5):052323, 2007.
8(8) Simon Fossier, Eleni Diamanti, Thierry Debuisschert, Rosa Tuallebrouri, and Philippe Grangier. Improvement of continuous-variable quantum key distribution systems by using optical preamplifiers. J. Phys. B, 42(11):114014, 2009.