Controlling single-photon detector ID210 with bright light

TL;DR

This paper demonstrates that the ID210 single-photon detector can be fully controlled by bright light, exposing a vulnerability that can be exploited in quantum key distribution to compromise security.

Contribution

It provides the first experimental evidence of bright-light control of the ID210 detector and discusses potential countermeasures.

Findings

ID210 detector is vulnerable to bright-light blinding

Vulnerability can be exploited for faked-state attacks in QKD

Countermeasures can mitigate this security risk

Abstract

We experimentally demonstrate that a single-photon detector ID210 commercially available from ID Quantique is vulnerable to blinding and can be fully controlled by bright illumination. In quantum key distribution, this vulnerability can be exploited by an eavesdropper to perform a faked-state attack giving her full knowledge of the key without being noticed. We consider the attack on standard BB84 protocol and a subcarrier-wave scheme, and outline a possible countermeasure.

Tables

Table 1. Table 1: Calculated parameters for successful control of ID210 detector in SCW QKD scheme.

Eve’s faked-state power in…	Blinding power ($\mathrm{nW}$)	$E_{\text{always}}$ ($\mathrm{fJ}$)	$E_{\text{never}}$ ($\mathrm{fJ}$)
subcarriers after filtering	35	25.8	15.4
spectrum before modulation	700	516	308
spectrum entering Bob’s module	3056	2252	1345

Equations

$$E_{\text{always}}\le E_{\text{trigger}}\le 2E_{\text{never}}.$$

Full text

I Introduction

Quantum key distribution (QKD) technology allows to securely distribute symmetric keys between two parties by utilizing fundamental aspects of quantum physics Bennett and Brassard (1984). In theory, legitimate users (Alice and Bob) are able to detect any eavesdropping in the quantum channel performed by Eve. Today security of several QKD protocols has been unconditionally proven Renner (2008). However, in practice Eve is still able to obtain information about quantum keys without alarming Alice and Bob by exploiting loopholes in QKD hardware, which are not taken into consideration during the security analysis. This technique is referred to as “quantum hacking” and has been experimentally demonstrated with a variety of QKD components Lamas-Linares and Kurtsiefer (2007); Nauerth et al. (2009); Xu et al. (2010); Lydersen et al. (2010a); Sun et al. (2011); Jain et al. (2011); Tang et al. (2013); Bugge et al. (2014); Sajeed et al. (2015a); Huang et al. (2016); Makarov et al. (2016); Huang et al. (2018). These results have helped to further solidify QKD security by patching the loopholes or extending security analysis. It is therefore important to continue testing other QKD devices in order to develop efficient hacking countermeasures.

A particular QKD component found to be vulnerable to quantum hacking is a single-photon detector Makarov et al. (2006); Lydersen et al. (2010a, b); Wiechers et al. (2011); Weier et al. (2011); Lydersen et al. (2011a, b); Sauge et al. (2011); Gerhardt et al. (2011); Sajeed et al. (2015b); Huang et al. (2016). For field applications in urban infrastructure, where the QKD nodes are located at medium distances (up to $100~{}\mathrm{k}\mathrm{m}$), it is most practical to use single-photon registration systems based on avalanche photodiodes (APDs) Hadfield (2009) because they provide sufficient efficiency without use of complex cooling systems required for superconducting detectors Natarajan et al. (2012). Several experiments demonstrated that Eve can take full control over the detector by blinding it by an intense continuous wave (c.w.) laser and then sending additional trigger pulses in order to achieve controllable clicks at desired times. Combining this method with measuring photon states send by Alice allows Eve to secretly obtain full knowledge about the quantum key Gerhardt et al. (2011). This quantum hacking technique is known as a faked-state attack Makarov and Hjelme (2005); Lydersen et al. (2010a); Gerhardt et al. (2011). It has been implemented on several commercially available APDs Lydersen et al. (2010a, b); Sauge et al. (2011); Jogenfors et al. (2015); Huang et al. (2016).

The purpose of this work is to investigate the vulnerability to the faked-state attack of another single-photon detector, ID Quantique ID210, which is currently commercially available idq and has recently been used in several QKD setups Cañas et al. (2017); Bannik et al. (2017); Miroshnichenko et al. (2018). Notably some of these experimental schemes are based on subcarrier-wave (SCW) QKD architecture where quantum states are formed at spectral sidebands of an intense light through phase modulation Gleim et al. (2017). In SCW QKD systems a major fraction of the signal is filtered out before detection. Therefore another important task is to calculate realistic blinding parameters for SCW systems with ID Quantique ID210 detector. We have found that these setups are potentially susceptible to the faked-state attack.

II Experimental setup

In our tests we have used ID210 single-photon detector by ID Quantique based on InGaAs/InP APD (unit serial number 1119019J010) idq . To simulate realistic conditions for Eve’s attack, we have treated the detector as a black box in the course of all experiments. We have not opened its housing nor manually interfered in operation of any internal circuits. All APD settings have been at the values normally used in SCW QKD operation Bannik et al. (2017): quantum efficiency 10%, gating frequency $100~{}\mathrm{M}\mathrm{Hz}$, gate width $3~{}\mathrm{n}\mathrm{s}$, deadtime $100~{}\mathrm{n}\mathrm{s}$. For these settings, the dark count rate fluctuates around $200~{}\mathrm{Hz}$. All the parameters have been set using standard ID210 user interface from the front panel of the device.

Experimental setup for testing the detector for control by bright light is shown in Fig. 1. The APD is externally gated by an arbitrary waveform generator (AWG 1; Agilent 81110A) at frequency of $100~{}\mathrm{M}\mathrm{Hz}$. This value is typical for SCW QKD schemes Bannik et al. (2017); Gleim et al. (2017). Another generator (AWG 2; Highland Technology P400) is synchronized from AWG 1 and performs two functions. Firstly, it provides constant current to a continuous laser source (L1; Alcatel 1905 LMI) used for APD blinding. Secondly, it is driving the trigger pulse laser (L2; Gooch & Housego AA1401) at $10~{}\mathrm{M}\mathrm{Hz}$ rate. This value is lower than the gating frequency, because in realistic conditions only a small fraction of pulses emitted by Alice (no more than 10%) reach Bob’s single photon detector. L1 and L2 outputs are connected to variable optical attenuators (VOA 1; OZ Optics DA-100-3S-1550 and VOA 2; FOD 5418) that regulated output optical power. VOA outputs lead to fiber-optic beam splitter with a $50\!:\!50$ ratio. One beamsplitter output arm is connected to an optical power meter (OPM; Joinwit JW3208), while the other leads to the ID210 detector (APD). The power meter monitors optical power applied to the APD from L1 and L2. We have taken into account a non-ideal beamsplitting ratio when calibrating this power. At the second stage of experiment, we have substituted OPM with an optical-to-electrical converter limited to roughly $2~{}\mathrm{G}\mathrm{Hz}$ bandwidth (OEC; LeCroy OE555), in order to accurately determine an optical pulse shape of L2. The electrical signals from OEC and APD are measured by an oscilloscope (OSC; LeCroy 820Zi). Trigger pulse energy is calculated from average optical power registered by OPM divided by the pulse repetition rate.

III Results

Our first task has been to find out if ID210 is susceptible to blinding. To do this, we have used L1 to generate c.w. laser radiation directed to APD optical input (with L2 switched off). L1 optical power has been regulated by VOA 1. When optical power at APD input has exceeded 24 nW, we have registered a complete absence of dark counts that indicates successful blinding of ID210 detector by c.w. radiation. The blinding does not harm the detector in any way, as its parameters return to normal each time L1 is turned off.

Blinding the APD implies switching it from Geiger to linear mode by bright illumination. After that Eve can take full control over detector clicks by exceeding a current threshold at a comparator in the linear mode by sending trigger pulses of sufficient energy along with c.w. blinding radiation Lydersen et al. (2010a). Therefore our second step has been to determine the necessary trigger pulse parameters and synchronize these pulses with APD gates.

We have initiated trigger pulses by turning on L2 with $5~{}\mathrm{n}\mathrm{s}$ wide pulses at 10 MHz frequency. The latter value has been chosen as a maximum expected detector click frequency given $100~{}\mathrm{n}\mathrm{s}$ deadtime. The shape of the optical trigger pulse is important for accurately adjusting the delay between the “faked state” and the detector gate (Fig. 2). Its measured duration is less than $500~{}\mathrm{p}\mathrm{s}$ full-width at half-magnitude (FWHM). Meanwhile, FWHM of the gate pulse matches the preset gate width of $3~{}\mathrm{n}\mathrm{s}$. We have then adjusted the timing of our optical trigger pulse to minimize its energy required to produce a click in the blinded regime, which presumably aligns it with the middle of the gate.

Our next step has been to determine a maximum trigger pulse energy $E_{\text{never}}$ at which the blinded detector still clicks with zero probability, and minimum energy $E_{\text{always}}$ at which it clicks with unity probability. When the trigger pulse energy $E_{\text{trigger}}$ is increased, the click probability undergoes a transition, shown in Fig. 3 for several blinding powers. For example, under $35~{}\mathrm{n}\mathrm{W}$ c.w. blinding, the detector never clicks when $E_{\text{trigger}}\leq E_{\text{never}}=15.4~{}\mathrm{f}\mathrm{J}$ and always clicks when $E_{\text{trigger}}\geq E_{\text{always}}=25.8~{}\mathrm{f}\mathrm{J}$. At higher blinding powers, a click probability transition from 0 to 1 becomes more abrupt, which is apparent by comparing the plots for c.w. blinding of $35$ and $2512~{}\mathrm{n}\mathrm{W}$ that have been measured with a higher resolution to illustrate this effect.

The last step of characterizing the APD is defining the boundary values for trigger pulse energies that Eve can use to carry out the most efficient faked-state attack. Reference Huang et al., 2016 describes in detail the methodology we use here for estimating these values. Let us consider BB84 protocol with four states in two orthogonal bases Bennett and Brassard (1984). When Eve performs the faked-state attack, there are two possible detection outcomes: either Eve and Bob choose the same bases, or not. Eve wants Bob’s detector to always click in the first case, and never in the second. She can achieve it by imposing a limitation on her $E_{\text{trigger}}$, making it sufficient to induce a click only when Bob’s basis choice is the same as hers Lydersen et al. (2010a):

[TABLE]

Figure 4 illustrates these boundaries for the analyzed ID210 detector: any trigger pulse energy between $E_{\text{always}}$ and $2E_{\text{never}}$, indicated by a shaded area, can be utilized for a successful attack. When Eve uses $E_{\text{trigger}}$ values from this interval, and Bob chooses the same basis, the eavesdropper will fully control the APD response and possess information on every key bit. When their bases do not coincide, a click will never happen, and these instances will be discarded by Alice and Bob during sifting stage. Thanks to this approach, Eve imposes on Bob only the states that she knows, and acquires full information about the quantum key. Hence, we have shown that an eavesdropper can perform a successful faked-state attack on ID210 single-photon detector in a realistic scenario of BB84 protocol.

IV Attack on subcarrier-wave QKD

The investigated detector has recently been employed in several QKD experiments Bannik et al. (2017); Miroshnichenko et al. (2018) based on SCW principle Mérolla et al. (1999). This QKD scheme is promising as a backbone for large-scale quantum network thanks to its high capability for multiplexing Mora et al. (2012); Chistyakov et al. (2014) and robustness against environmental influence on the optical fiber Gleim et al. (2017, 2016); Kynev et al. (2017). In this type of systems the encoding photons are not directly generated by an attenuated laser source but rather appear on spectral sidebands during a phase modulation of light. As can be seen from a general scheme of SCW QKD setup (Fig. 5), the signal spectrum passes through a narrow filter (SF) before detection in order to remove the optical carrier that contains most of the optical power. It is therefore important to investigate if this filtering is an obstacle for Eve’s detector control and faked-state attack on SCW QKD setups. In realistic conditions we should also consider insertion losses in Bob.

For our analysis we have used SCW QKD experimental parameters from Ref. Gleim et al., 2017: loss in Bob module $6.4~{}\mathrm{d}\mathrm{B}$, SF extinction ratio $30~{}\mathrm{d}\mathrm{B}$, and modulation index (the ratio between optical power in the carrier and the two sidebands) of 20. Let Eve prepare the signal states in a way similar to Alice: a spectrum with a strong carrier and two subcarriers. This spectrum will pass through the receiving unit undergoing the same modulation and filtering as the normal Alice’s signal. Knowing the subcarrier power levels sufficient to blind the detector, we can estimate the total power that Eve should send into Bob module for successful blinding. For instance, let us consider the lowest blinding power of $35~{}\mathrm{n}\mathrm{W}$ confirmed experimentally in this work. In the SCW QKD scheme, before the pulse reaches the APD, it must undergo phase modulation at PSM2, where only $1/20$ of the initial optical carrier power is directed into the sidebands that will subsequently pass the SF. Therefore initial power at PSM2 input should be at least $700~{}\mathrm{n}\mathrm{W}$. Likewise, we should consider insertion loss in Bob’s module ($6.4~{}\mathrm{d}\mathrm{B}$), therefore the minimum power used by Eve for a successful attack should be at least $3056~{}\mathrm{n}\mathrm{W}$. A similar logic works for the trigger pulse energy, as summarized in Table 1. As can be seen, although Eve must operate with higher blinding powers and trigger pulse energies in order to control the detector in SCW QKD scheme, the power levels needed are still sufficiently low not to damage any optical components Makarov et al. (2016). These results suggest that SCW QKD setups do not have enough intrinsic loss to prevent detector control using the described method.

V Countermeasures

The faked-state attack is very general and has been successfully used for hacking different APDs. The most efficient countermeasure against it is implementing measurement-device-independent (MDI) QKD architecture Lo et al. (2012), where the detection unit is moved from Alice and Bob to an untrusted party Charlie. MDI QKD protocol is based on Bell state measurements and ensures that Charlie (or Eve) is limited to openly announcing the measurement outcomes and is incapable of acquiring secure key information. Unfortunately, in practice MDI QKD architecture remains difficult to implement and yields much lower key rates.

In traditional two-party QKD, attempts to produce a countermeasure of a similar quality integrated with a security proof have led to stringent requirements on components Lydersen et al. (2011c); Marøy et al. (2017), which have not yet been implemented. Simpler countermeasures that utilize photon counting statistics have been proposed but none yet battle-tested Honjo et al. (2013); Koehler-Sidki et al. (2018a); Fedorov et al. (2019). A more practical countermeasure may imply redesigning an avalanche quenching circuit of the APD and introducing precise photocurrent sensors into it Yuan et al. (2010); Lydersen et al. (2010c); Yuan et al. (2011a); Lydersen et al. (2011d); Yuan et al. (2011b); Koehler-Sidki et al. (2018b).

Here we propose a simple solution for the SCW QKD scheme analyzed in Sec. IV. As explained above, in SCW QKD intense optical radiation acts as a carrier for the phase-modulated quantum signal on its sidebands. Even though the carrier contains no information about the key, in practical QKD it is necessary to detect it as a countermeasure against a photon-number-splitting attack Guerreau et al. (2005). We propose to reveal APD blinding by monitoring this signal. Our system contains a circulator used to measure the carrier and sideband signals individually (Fig. 5). Since the faked-state attack requires significantly elevated carrier optical power (see Table 1), a watchdog detector D can be installed for monitoring its abnormally high values. We presume that one cannot put an unprotected detector into a third port of the circulator, as it could be potentially blinded by Eve there. We therefore suggest to place it in a fourth port and protect it by an attenuator and a mirror in the third port, as shown in Fig. 5. The attenuation value should be carefully chosen to be high enough to prevent blinding of D but sufficiently low to allow carrier detection by a regular photodiode. Testing this idea can be future work.

VI Conclusion

We have demonstrated experimentally that ID Quantique ID210 single-photon detector based on avalanche photodiode is vulnerable to blinding and can be controlled by bright light. We have shown that the faked-state attack will work in SCW QKD systems where a major signal fraction is filtered out before detection. We have also suggested a simple optical scheme that could act as a potential countermeasure in SCW QKD. Overall, even though the faked-state attack was introduced a decade ago, no universal industrial-scale solution for two-party QKD has been found yet. Today MDI QKD remains the only strictly proven countermeasure against detector hacking. All alternative solutions are still to be meticulously tested and incorporated into existing security proofs. Our results emphasise that known vulnerabilities should be addressed at the system design stage, and any countermeasures thoroughly tested experimentally.

Acknowledgements.

This Letter has been reviewed by ID Quantique prior to its publication. This work was funded by the Ministry of Education and Science of Russia (programs 5-in-100 and NTI center for quantum communications), NSERC of Canada (programs Discovery and CryptoWorks21), CFI, and MRIS of Ontario. A.H. was supported by China Scholarship Council. This work was funded by Government of Russian Federation (grant 08-08). Author contributions: V.C. conducted the experiment, analyzed data, proposed the countermeasure, and wrote the Letter with input from all authors. A.H. guided the experiment. V.M. and V.E. supervised the study.