Security analysis of practical continuous-variable quantum key   distribution systems under laser seeding attack

Yi Zheng; Peng Huang; Anqi Huang; Jinye Peng; Guihua Zeng

arXiv:1907.01553·quant-ph·September 17, 2019

Security analysis of practical continuous-variable quantum key distribution systems under laser seeding attack

Yi Zheng, Peng Huang, Anqi Huang, Jinye Peng, Guihua Zeng

PDF

TL;DR

This paper analyzes the security vulnerabilities of practical continuous-variable quantum key distribution systems under laser seeding attack and proposes a real-time monitoring scheme to enhance their security.

Contribution

It identifies a security loophole caused by laser seeding attack and introduces a monitoring method to accurately evaluate and secure CVQKD systems.

Findings

01

Laser seeding attack can overestimate secret key rates.

02

Proposed monitoring scheme effectively detects and resists the attack.

03

Security loophole in practical CVQKD systems is mitigated.

Abstract

Here, we investigate the security of the practical one-way CVQKD and CV-MDI-QKD systems under laser seeding attack. In particular, Eve can inject a suitable light into the laser diodes of the light source modules in the two kinds of practical CVQKD systems, which results in the increased intensity of the generated optical signal. The parameter estimation under the attack shows that the secret key rates of these two schemes may be overestimated, which opens a security loophole for Eve to successfully perform an intercept-resend attack on these systems. To close this loophole, we propose a real-time monitoring scheme to precisely evaluate the secret key rates of these schemes. The analysis results indicate the implementation of the proposed monitoring scheme can effectively resist this potential attack.

Figures7

Click any figure to enlarge with its caption.

Equations42

I = μ \int_{0}^{T} P (t) d t,

I = μ \int_{0}^{T} P (t) d t,

∣ α_{A_{0}} ⟩ = ∣ α_{A_{0}} ∣ e^{i θ} = x_{A_{0}} + i p_{A_{0}}, x_{A_{0}} = ∣ α_{A_{0}} ∣ cos θ, p_{A_{0}} = ∣ α_{A_{0}} ∣ sin θ,

∣ α_{A_{0}} ⟩ = ∣ α_{A_{0}} ∣ e^{i θ} = x_{A_{0}} + i p_{A_{0}}, x_{A_{0}} = ∣ α_{A_{0}} ∣ cos θ, p_{A_{0}} = ∣ α_{A_{0}} ∣ sin θ,

x_{A_{0}}^{'} = g x_{A_{0}}, p_{A_{0}}^{'} = g p_{A_{0}}, V_{A_{0}}^{'} = g V_{A_{0}},

x_{A_{0}}^{'} = g x_{A_{0}}, p_{A_{0}}^{'} = g p_{A_{0}}, V_{A_{0}}^{'} = g V_{A_{0}},

x_{A_{0}^{'}} p_{A_{0}^{'}} x_{B_{0}^{'}} p_{B_{0}^{'}} = t_{A C} x_{A_{0}} + z_{A C}, = t_{A C} p_{A_{0}} + z_{A C}, = t_{B C} x_{B_{0}} + z_{B C}, = t_{B C} p_{B_{0}} + z_{B C},

x_{A_{0}^{'}} p_{A_{0}^{'}} x_{B_{0}^{'}} p_{B_{0}^{'}} = t_{A C} x_{A_{0}} + z_{A C}, = t_{A C} p_{A_{0}} + z_{A C}, = t_{B C} x_{B_{0}} + z_{B C}, = t_{B C} p_{B_{0}} + z_{B C},

⟨ x_{A_{0}}^{2} ⟩ = ⟨ x_{B_{0}}^{2} ⟩ = ⟨ x_{C}^{2} ⟩ = ⟨ x_{A_{0}} x_{C} ⟩ = ⟨ x_{C} x_{D} ⟩ = ⟨ p_{A_{0}}^{2} ⟩ = V_{x_{A_{0}}} = V_{p_{A_{0}}}, ⟨ p_{B_{0}}^{2} ⟩ = V_{x_{B_{0}}} = V_{p_{B_{0}}}, ⟨ p_{D}^{2} ⟩ = \frac{1}{2} η (T_{A C} V_{x_{A_{0}}} + T_{B C} V_{x_{B_{0}}}) + N_{0} + V_{e l} + \frac{1}{2} η (T_{A C} ξ_{A C} + T_{B C} ξ_{B C}), \frac{η T _{A C}}{2} V_{x_{A_{0}}}, ⟨ p_{B_{0}} p_{D} ⟩ = \frac{η T _{B C}}{2} V_{p_{B_{0}}}, ⟨ p_{C} p_{D} ⟩ = \frac{1}{2} η (T_{A C} V_{x_{A_{0}}} - T_{B C} V_{x_{B_{0}}}) + \frac{1}{2} η (T_{A C} ξ_{A C} - T_{B C} ξ_{B C}) .

⟨ x_{A_{0}}^{2} ⟩ = ⟨ x_{B_{0}}^{2} ⟩ = ⟨ x_{C}^{2} ⟩ = ⟨ x_{A_{0}} x_{C} ⟩ = ⟨ x_{C} x_{D} ⟩ = ⟨ p_{A_{0}}^{2} ⟩ = V_{x_{A_{0}}} = V_{p_{A_{0}}}, ⟨ p_{B_{0}}^{2} ⟩ = V_{x_{B_{0}}} = V_{p_{B_{0}}}, ⟨ p_{D}^{2} ⟩ = \frac{1}{2} η (T_{A C} V_{x_{A_{0}}} + T_{B C} V_{x_{B_{0}}}) + N_{0} + V_{e l} + \frac{1}{2} η (T_{A C} ξ_{A C} + T_{B C} ξ_{B C}), \frac{η T _{A C}}{2} V_{x_{A_{0}}}, ⟨ p_{B_{0}} p_{D} ⟩ = \frac{η T _{B C}}{2} V_{p_{B_{0}}}, ⟨ p_{C} p_{D} ⟩ = \frac{1}{2} η (T_{A C} V_{x_{A_{0}}} - T_{B C} V_{x_{B_{0}}}) + \frac{1}{2} η (T_{A C} ξ_{A C} - T_{B C} ξ_{B C}) .

⟨ x_{C}^{2} ⟩ + ⟨ x_{C} x_{D} ⟩ = ⟨ p_{D}^{2} ⟩ - ⟨ p_{C} p_{D} ⟩ = η T_{A C} V_{x_{A_{0}}} + η T_{A C} ξ_{A C} + N_{0} + V_{e l}, η T_{B C} V_{x_{B_{0}}} + η T_{B C} ξ_{B C} + N_{0} + V_{e l} .

⟨ x_{C}^{2} ⟩ + ⟨ x_{C} x_{D} ⟩ = ⟨ p_{D}^{2} ⟩ - ⟨ p_{C} p_{D} ⟩ = η T_{A C} V_{x_{A_{0}}} + η T_{A C} ξ_{A C} + N_{0} + V_{e l}, η T_{B C} V_{x_{B_{0}}} + η T_{B C} ξ_{B C} + N_{0} + V_{e l} .

T_{A C} = T_{B C} = ε_{A C} = ε_{B C} = \frac{2 ⟨ x _{A_{0}} x _{C} ⟩ ^{2}}{η ⟨ x _{A_{0}}^{2} ⟩ ^{2}}, \frac{2 ⟨ p _{B_{0}} p _{D} ⟩ ^{2}}{η ⟨ p _{B_{0}}^{2} ⟩ ^{2}}, \frac{⟨ x _{C}^{2} ⟩ + ⟨ x _{C} x _{D} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ x _{A_{0}} x _{C} ⟩ / ⟨ x _{A_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ x _{A_{0}}^{2} ⟩}{N _{0}}, \frac{⟨ p _{D}^{2} ⟩ - ⟨ p _{C} p _{D} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ p _{B_{0}} p _{D} ⟩ / ⟨ p _{B_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ p _{B_{0}}^{2} ⟩}{N _{0}} .

T_{A C} = T_{B C} = ε_{A C} = ε_{B C} = \frac{2 ⟨ x _{A_{0}} x _{C} ⟩ ^{2}}{η ⟨ x _{A_{0}}^{2} ⟩ ^{2}}, \frac{2 ⟨ p _{B_{0}} p _{D} ⟩ ^{2}}{η ⟨ p _{B_{0}}^{2} ⟩ ^{2}}, \frac{⟨ x _{C}^{2} ⟩ + ⟨ x _{C} x _{D} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ x _{A_{0}} x _{C} ⟩ / ⟨ x _{A_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ x _{A_{0}}^{2} ⟩}{N _{0}}, \frac{⟨ p _{D}^{2} ⟩ - ⟨ p _{C} p _{D} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ p _{B_{0}} p _{D} ⟩ / ⟨ p _{B_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ p _{B_{0}}^{2} ⟩}{N _{0}} .

x_{A_{0}}^{'} = x_{B_{0}}^{'} = x_{C}^{'} = x_{D}^{'} = g x_{A_{0}}, p_{A_{0}}^{'} = g p_{A_{0}}, g x_{B_{0}}, p_{B_{0}}^{'} = g p_{B_{0}}, g x_{C}, p_{C}^{'} = g p_{C}, g x_{D}, p_{D}^{'} = g p_{D} .

x_{A_{0}}^{'} = x_{B_{0}}^{'} = x_{C}^{'} = x_{D}^{'} = g x_{A_{0}}, p_{A_{0}}^{'} = g p_{A_{0}}, g x_{B_{0}}, p_{B_{0}}^{'} = g p_{B_{0}}, g x_{C}, p_{C}^{'} = g p_{C}, g x_{D}, p_{D}^{'} = g p_{D} .

T_{A C}^{'} = T_{B C}^{'} = ε_{A C}^{'} = ε_{B C}^{'} = \frac{2 ⟨ x _{A_{0}} x _{C}^{'} ⟩ ^{2}}{η ⟨ x _{A_{0}}^{2} ⟩ ^{2}} = g T_{A C}, \frac{2 ⟨ p _{B_{0}} p _{D}^{'} ⟩ ^{2}}{η ⟨ p _{B_{0}}^{2} ⟩ ^{2}} = g T_{B C}, \frac{⟨( x _{C}^{'} ) ^{2} ⟩ + ⟨ x _{C}^{'} x _{D}^{'} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ x _{A_{0}} x _{C}^{'} ⟩ / ⟨ x _{A_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ x _{A_{0}}^{2} ⟩}{N _{0}} = \frac{ε _{A C}}{g}, \frac{⟨( p _{D}^{'} ) ^{2} ⟩ - ⟨ p _{C}^{'} p _{D}^{'} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ p _{B_{0}} p _{D}^{'} ⟩ / ⟨ p _{B_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ p _{B_{0}}^{2} ⟩}{N _{0}} = \frac{ε _{B C}}{g} .

T_{A C}^{'} = T_{B C}^{'} = ε_{A C}^{'} = ε_{B C}^{'} = \frac{2 ⟨ x _{A_{0}} x _{C}^{'} ⟩ ^{2}}{η ⟨ x _{A_{0}}^{2} ⟩ ^{2}} = g T_{A C}, \frac{2 ⟨ p _{B_{0}} p _{D}^{'} ⟩ ^{2}}{η ⟨ p _{B_{0}}^{2} ⟩ ^{2}} = g T_{B C}, \frac{⟨( x _{C}^{'} ) ^{2} ⟩ + ⟨ x _{C}^{'} x _{D}^{'} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ x _{A_{0}} x _{C}^{'} ⟩ / ⟨ x _{A_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ x _{A_{0}}^{2} ⟩}{N _{0}} = \frac{ε _{A C}}{g}, \frac{⟨( p _{D}^{'} ) ^{2} ⟩ - ⟨ p _{C}^{'} p _{D}^{'} ⟩ - N _{0} - ν _{e l} N _{0}}{2 (⟨ p _{B_{0}} p _{D}^{'} ⟩ / ⟨ p _{B_{0}}^{2} ⟩ ) ^{2} N _{0}} - \frac{⟨ p _{B_{0}}^{2} ⟩}{N _{0}} = \frac{ε _{B C}}{g} .

ξ_{P I R, A C} = ξ_{t, A C} + 2 u N_{0},

ξ_{P I R, A C} = ξ_{t, A C} + 2 u N_{0},

ε_{P I R, A C} = ε_{t, A C} + 2 u .

ε_{P I R, A C} = ε_{t, A C} + 2 u .

ε_{P I R, A C}^{'} = \frac{ε _{t, A C} + 0.2}{g} .

ε_{P I R, A C}^{'} = \frac{ε _{t, A C} + 0.2}{g} .

I_{A B}^{h e t} = 2 \times \frac{1}{2} lo g_{2} \frac{V _{B}^{h e t}}{V _{B ∣ A}^{h e t}} = lo g_{2} \frac{V _{A} + 1 + χ _{line, m}}{1 + χ _{line, m}},

I_{A B}^{h e t} = 2 \times \frac{1}{2} lo g_{2} \frac{V _{B}^{h e t}}{V _{B ∣ A}^{h e t}} = lo g_{2} \frac{V _{A} + 1 + χ _{line, m}}{1 + χ _{line, m}},

\begin{split}&{\Gamma^{m}_{AB}}=\\ &\left[{\begin{array}[]{*{20}{c}}{\left({{V_{A}}+1}\right){\mathbb{I}}}&{\sqrt{T_{m}\left[{{{\left({{V_{A}}+1}\right)}^{2}}-1}\right]}{\sigma_{Z}}}\\ {\sqrt{T_{m}\left[{{{\left({{V_{A}}+1}\right)}^{2}}-1}\right]}{\sigma_{Z}}}&(T_{m}{V_{A}}+1+T_{m}\varepsilon_{m})\mathbb{I}\end{array}}\right],\end{split}

\begin{split}&{\Gamma^{m}_{AB}}=\\ &\left[{\begin{array}[]{*{20}{c}}{\left({{V_{A}}+1}\right){\mathbb{I}}}&{\sqrt{T_{m}\left[{{{\left({{V_{A}}+1}\right)}^{2}}-1}\right]}{\sigma_{Z}}}\\ {\sqrt{T_{m}\left[{{{\left({{V_{A}}+1}\right)}^{2}}-1}\right]}{\sigma_{Z}}}&(T_{m}{V_{A}}+1+T_{m}\varepsilon_{m})\mathbb{I}\end{array}}\right],\end{split}

T_{m} = ε_{m} = \frac{T _{A C}}{2} k^{2}, 1 + \frac{1}{T _{A C}} [2 + T_{B C} (ε_{B C} - 2) + T_{A C} (ε_{B C} - 1)] + \frac{1}{T _{A C}} (\frac{2}{k} V_{B} - T_{B C} V_{B} + 2)^{2} .

T_{m} = ε_{m} = \frac{T _{A C}}{2} k^{2}, 1 + \frac{1}{T _{A C}} [2 + T_{B C} (ε_{B C} - 2) + T_{A C} (ε_{B C} - 1)] + \frac{1}{T _{A C}} (\frac{2}{k} V_{B} - T_{B C} V_{B} + 2)^{2} .

ε_{m} = \frac{T _{B C}}{T _{A C}} (ε_{B C} - 2) + ε_{A C} + \frac{2}{T _{A C}} .

ε_{m} = \frac{T _{B C}}{T _{A C}} (ε_{B C} - 2) + ε_{A C} + \frac{2}{T _{A C}} .

χ_{B E} = G (\frac{λ _{m, 1} - 1}{2}) + G (\frac{λ _{m, 2} - 1}{2}) - G (\frac{λ _{m, 3} - 1}{2}) .

χ_{B E} = G (\frac{λ _{m, 1} - 1}{2}) + G (\frac{λ _{m, 2} - 1}{2}) - G (\frac{λ _{m, 3} - 1}{2}) .

λ_{m, 1, 2}^{2} λ_{m, 3} = \frac{1}{2} (A_{m} \pm A_{m}^{2} - 4 B_{m}), = \frac{( T _{m} ε _{m} + 2 ) ( V _{A} + 1 ) - T _{m} V _{A}}{T _{m} ( ε _{m} + V _{A} ) + 2},

λ_{m, 1, 2}^{2} λ_{m, 3} = \frac{1}{2} (A_{m} \pm A_{m}^{2} - 4 B_{m}), = \frac{( T _{m} ε _{m} + 2 ) ( V _{A} + 1 ) - T _{m} V _{A}}{T _{m} ( ε _{m} + V _{A} ) + 2},

A_{m} = B_{m} = (V_{A} + 1)^{2} - 2 T_{m} (V_{A}^{2} + 2 V_{A}) + (T_{m} V_{A} + T_{m} ε_{m} + 1)^{2}, [(T_{m} ε_{m} + 1) (V_{A} + 1) - T_{m} V_{A}]^{2} .

A_{m} = B_{m} = (V_{A} + 1)^{2} - 2 T_{m} (V_{A}^{2} + 2 V_{A}) + (T_{m} V_{A} + T_{m} ε_{m} + 1)^{2}, [(T_{m} ε_{m} + 1) (V_{A} + 1) - T_{m} V_{A}]^{2} .

K_{m} = β I_{A B}^{h e t} - χ_{B E} .

K_{m} = β I_{A B}^{h e t} - χ_{B E} .

V_{A}^{'} T_{m}^{'} ε_{m}^{'} = g V_{A}, V_{B}^{'} = g V_{B}, = \frac{g T _{A C} V _{B}}{T _{B C} ( g V _{B} + 2 )}, = \frac{T _{B C}}{T _{A C}} (\frac{ε _{B C}}{g} - 2) + \frac{ε _{A C}}{g} + \frac{2}{g T _{A C}} .

V_{A}^{'} T_{m}^{'} ε_{m}^{'} = g V_{A}, V_{B}^{'} = g V_{B}, = \frac{g T _{A C} V _{B}}{T _{B C} ( g V _{B} + 2 )}, = \frac{T _{B C}}{T _{A C}} (\frac{ε _{B C}}{g} - 2) + \frac{ε _{A C}}{g} + \frac{2}{g T _{A C}} .

Peer Reviews

No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.

Videos

No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.

Full text

††thanks: Corresponding author: [email protected]††thanks: Corresponding author: [email protected]

Security analysis of practical continuous-variable quantum key distribution systems under laser seeding attack

Yi Zheng

College of Information Science and Technology, Northwest University, Xi’an 710127, Shaanxi, China

Peng Huang

State Key Laboratory of Advanced Optical Communication Systems and Networks, and Center of Quantum Information Sensing and Processing, Shanghai Jiao Tong University, Shanghai 200240, China

Anqi Huang

Institute for Quantum Information $\&$ State Key Laboratory of High Performance Computing, College of Computer, National University of Defense Technology, Changsha 410073, China

Greatwall Quantum Laboratory, China Greatwall Technology, Changsha 410205, China

Jinye Peng

College of Information Science and Technology, Northwest University, Xi’an 710127, Shaanxi, China

Guihua Zeng

State Key Laboratory of Advanced Optical Communication Systems and Networks, and Center of Quantum Information Sensing and Processing, Shanghai Jiao Tong University, Shanghai 200240, China

Abstract

Here, we investigate the security of the practical one-way CVQKD and CV-MDI-QKD systems under laser seeding attack. In particular, Eve can inject a suitable light into the laser diodes of the light source modules in the two kinds of practical CVQKD systems, which results in the increased intensity of the generated optical signal. The parameter estimation under the attack shows that the secret key rates of these two schemes may be overestimated, which opens a security loophole for Eve to successfully perform an intercept-resend attack on these systems. To close this loophole, we propose a real-time monitoring scheme to precisely evaluate the secret key rates of these schemes. The analysis results indicate the implementation of the proposed monitoring scheme can effectively resist this potential attack.

pacs:

03.67.Hk, 03.67.-a, 03.67.Dd

I INTRODUCTION

Quantum key distribution (QKD) is a promising technology, which enables two authorized communication parties Alice and Bob to share a string of secret keys through an insecure quantum channel in the presence of a potential eavesdropper Eve Ekert1991Quantum ; gisin2002quantum ; weedbrook2012gaussian ; grosshans2003quantum . In theory, the basic laws of quantum physics guarantee the unconditional security of this technology Shor2000Simple ; Lo1999Unconditional ; leverrier2013security . At present, QKD technology can be implemented by two kinds of different means, i.e., discrete-variable quantum key distribution (DVQKD) and continuous-variable quantum key distribution (CVQKD). Different from DVQKD systems, CVQKD systems rely on continuous modulation of the light field quadratures, which can be measured by utilizing the mature coherent detection technique instead of single-photon detection weedbrook2012gaussian ; grosshans2003quantum . Therefore, CVQKD systems can be well compatible with the classical optical communication systems. In particular, CVQKD with the Gaussian-modulated coherent states (GMCS) is one well-known protocol, which has been proven to be secure against the collective and coherent attacks leverrier2013security . Over the past years, the GMCS CVQKD scheme has been experimentally implemented by many research groups in laboratories and in field environment qi2007experimental ; fossier2009field ; Jouguet2012Experimental ; huang2016field . In this work, we also focus on the investigation of the GMCS CVQKD schemes.

As we all known that the implemented devices (e.g., laser, modulators, detetors) of the GMCS CVQKD schemes is assumed to be secure and perfect in the security proofs leverrier2013security . In fact, however, there are some direct or indirect imperfections in practical GMCS CVQKD systems Jouguet2012Analysis . These imperfections can be divided into two categories. First, some imperfections may open several security loopholes. In particular, Eve can exploit these loopholes to steal key information without being detected, which seriously threatens the practical security of the systems. This is an effective quantum hacking strategy, such as the local oscillator (LO) fluctuation attack Ma2014Local , the LO calibration attack Jouguet2013Preventing , the wavelength attack Huang2013Quantum ; Ma2014Wavelength ; huang2014quantum , the saturation attack Qin2016Quantum , finite sampling bandwidth effects Wang2016Practical , homodyne detector blinding attack qin2018homodyne , jitter in clock synchronization xie2018practical , and the polarization attack zhao2018polarization . Second, the other imperfections can simply deteriorate the performance of the systems, such as imperfect phase compensation huang2015security , finite-size effects leverrier2010finite , and the noisy coherent states liu2017imperfect ; filip2008continuous ; usenko2010feasibility ; shen2011continuous ; yang2012source . These imperfections hinder the commercial application of CVQKD.

Subsequently, several strategies have been designed to remove these imperfections. For the first imperfections that can open security loopholes, countermeasures are proposed to improve existing systems. For example, a real-time shot-noise measurement (RTSNM) scheme is used to resist the attacks originating from the local oscillator (LO) signal Jouguet2013Preventing ; Liu2017 . Then, a local LO (LLO) CVQKD scheme is designed and implemented experimentally, which can fundamentally close the security loophole originates from LO soh2015self ; Qi2015Generating ; huang2015high-speed ; wang2018pilot ; Tao2018High . Another attractive approach is to improve GMCS CVQKD protocol directly, i.e., continuous-variable measurement-device-independent quantum key distribution with the Gaussian-modulated coherent states (GMCS CV-MDI-QKD) protocol, which is immune to all detector side-channel attacks pirandola2015high-rate ; ma2014gaussian ; li2014continuous-variable ; Zhang2017Finite ; papanastasiou2017finite ; ma2018continuous . To remove the second imperfections, the reasonable noise models are needed to precisely evaluate the performance of the system. It is important to note that the above countermeasures do not close all potential loopholes, and new proposed attacks may defeat the CVQKD system. Therefore, the discoveries and preventions of the concealed security loopholes are vital to the commercial application of CVQKD.

Light source is one of key devices for the implementation of QKD systems, which is assumed to be trusted in previous research. For instance, in CVQKD, the noisy Gaussian source is well studied and modeled shen2011continuous ; yang2012source . However, the parameters of the light source may be actively tampered by Eve huang2019laser ; sun2015effect ; pang2019hacking . In particular, based on the framework of GMCS CV-MDI-QKD, the sources become the final battlefield between the authorized communication parties and Eve. Therefore, the effects of the tampered source should be considered for the security analysis of practical CVQKD systems, which has not been well studied.

More recently, Huang $\it{et}$ $\it{al}$ . proposed an efficient quantum hacking strategy related with light source to attack the DVQKD systems, which is called as laser seeding attack huang2019laser . In this quantum hacking scheme, Eve can inject bright light into the laser diode of the systems to actively open a loophole. In this paper, inspired by this quantum hacking attack in DVQKD, we study the security of practical CVQKD systems under the laser seeding attack. Here, we focus on several well-known CVQKD protocols, i.e., the standard one-way GMCS CVQKD and GMCS CV-MDI-QKD schemes. More specifically, we first reveal that Eve can exploit the laser seeding attack to make the intensity of the transmitted Gaussian-modulated coherent states increased. Then, we find that the laser seeding attack makes the quantum channel excess noises of these two systems underestimated. Subsequently, we show that the secret key rates of these two systems are overestimated by Alice and Bob under the attack. These imperfect evaluative results are coincident with the security analysis results of CVQKD under the effects of the reduced optical attenuation caused by the laser damage attack zheng2019practical ; huang2019damage ; bugge2014laser , which indicates that the laser seeding attack can also open a security loophole for Eve to perform an intercept-resend attack on these two kinds of CVQKD systems without being detected. In particular, although the CV-MDI-QKD protocols can remove all side channels originate from measurement unit, we observe that it is more vulnerable than the one-way CVQKD schemes to the laser seeding attack. Finally, we design a countermeasure to resist the laser seeding attack, where the intensity of optical signal generated by light source is monitored by the authorized communication parties in real time. The analysis result indicates that the legitimate communication parties can precisely evaluate the channel parameters to accurately calculate the secret key rate of these two systems through this scheme.

This paper is organized as follows. In Sec. II, the laser seeding attack is described and modeled. Then, the security of various CVQKD systems under the laser seeding attack is studied in Sec. III. In Sec. IV, we investigate the countermeasure to resist the laser seeding attack. Finally, conclusions are presented in Sec. V.

II PRINCIPLE OF THE LASER SEEDING ATTACK

II.1 Scheme of laser seeding attack

In Ref. huang2019laser , Huang $\it{et}$ $\it{al}$ . proposed the laser seeding attack and demonstrated that Eve may perform the attack in the light source of a practical DVQKD system to steal key information without being detected, which seriously destroys the practical security of the system. Fig. 1 shows the scheme of the laser seeding attack clearly according to the experimental results in Ref. huang2019laser . Specifically, Eve can utilize a tunable continuous-wave laser to inject a bright light with a proper wavelength into the semiconductor laser diode of a DVQKD system via quantum channel, where the semiconductor laser diode generates the optical signals driven by the electrical signals. In particular, a polarization controller is used for adjusting the polarization of the injected light signal to maximize the injection efficiency. According to the analyses in Ref. huang2019laser , we describe the two curves of power of the optical signal generated by the laser diode varying with time in the laser seeding attack case and ideal case, respectively. The laser seeding attack will cause two main effects on the ideal curve, which are shown in Fig. 1. The first impact is that the curve becomes wider with a much higher and longer tail. The other influence is that the peak of the curve shifts to earlier compared with the ideal situation. Here, we use $P(t)$ and $P^{\prime}(t)$ to represent the power of the output optical signal in ideal situation and with the attack, respectively. Then, the intensity of the optical signal prepared by light source without the laser seeding attack can be calculated as

[TABLE]

where $T$ is the period of the optical pulse emitted by laser diode, $\mu$ is a certain coefficient related with detection. Here, we assume that the parameters $T$ and $\mu$ are fixed and unaffected by the laser seeding attack. Correspondingly, the intensity $I^{\prime}$ of the optical signal generated by the attacked light source can also be acquired by Eq. (1). It is obvious that the intensity of the optical signal prepared by the light source gets larger under the effects of the laser seeding attack. For simplicity, we assume that $I^{\prime}=gI(g>1)$ in the following analysis. Here, $g$ reflects the power of the laser seeding attack.

Similarly, in practical CVQKD systems, light source is also a key device, which can be used for generating information carrier signal and LO signal in the transmitter Alice. In particular, light source is also used in Bob’s side for a CV-MDI-QKD system. In implementations of CVQKD, the semiconductor laser diode is also widely used to generate the optical signals driven by the electrical signals. For example, 100 ns coherent light pulses can be prepared for CVQKD by using a 1550 nm laser diode at a repetition rate of 1 Mhz Jouguet2012Experimental . Therefore, Eve may perform the laser seeding attack in a CVQKD system. In the following sections, we will focus on the theoretical security research of various CVQKD systems under the laser seeding attack.

II.2 The effects of the laser seeding attack in a CVQKD system

In the practical implementation of a standard one-way GMCS CVQKD system, Alice modulates the random key information to the pulse signal $A$ , which can result in a series of Gaussian-modulated coherent states $|\alpha\rangle$ weedbrook2012gaussian . After optical attenuation, we use $|\alpha_{A_{0}}\rangle$ to indicate the transmitted coherent states. Based on the phase space, $|\alpha_{A_{0}}\rangle$ can be written as

[TABLE]

where $|\alpha_{A_{0}}|$ and $\theta$ indicate the amplitude and phase of the transmitted Gaussian-modulated optical signal $A_{0}$ , respectively. In particular, $x_{A_{0}}$ and $p_{A_{0}}$ are two independent quadratures variables with identical variance $V_{A_{0}}$ and zero mean grosshans2003quantum ; weedbrook2012gaussian .

However, the generated optical signal $A$ can change under the laser seeding attack. Therefore, $x_{A_{0}}$ , $p_{A_{0}}$ , and $V_{A_{0}}$ may deviate from their ideal values due to the influences of the attack, which is revealed in Fig. 2 based on the phase space. Since $I\propto|\alpha_{A_{0}}|$ , the changes of $x_{A_{0}}$ , $p_{A_{0}}$ , and $V_{A_{0}}$ are as follows:

[TABLE]

where $x^{\prime}_{A_{0}}$ and $p^{\prime}_{A_{0}}$ are two independent quadratures variables of the transmitted quantum signal $A^{\prime}_{0}$ with the attack, $V^{\prime}_{A_{0}}$ are the variance of $x^{\prime}_{A_{0}}$ or $p^{\prime}_{A_{0}}$ . Similarly, the effects also exist in a CV-MDI-QKD system.

In addition, it is important to note that the intensity of LO signal can also become large with the increase of the intensity of the generated optical signal $A$ . In a practical CVQKD system, there are many reasons for the increase of the intensity of LO signal, such as the decrease of optical attenuation zheng2019practical . Although the origin of the change is ambiguous for Alice and Bob, the real-time shot-noise measurement technique can eliminate the impact. Therefore, we do not have to consider the influences of the increased intensity of the LO signal in the following analysis.

III SECURITY ANALYSIS

III.1 Security of a one-way GMCS CVQKD system under the laser seeding attack

The analyses in Sec. II indicate that the laser seeding attack will lead to the increased intensity of the transmitted Gaussian-modulated coherent states, which is the same as the influences of the reduced optical attenuation caused by the laser damage attack bugge2014laser ; makarov2016creation ; zheng2019practical ; huang2018quantum ; huang2019damage . Therefore, based on the analyses in Ref. zheng2019practical , it is feasible that Eve can unconsciously steal key information shared by Alice and Bob in a one-way GMCS CVQKD system by using the laser seeding attack. The analysis result indicates that the enhancement of the transmitted Gaussian-modulated coherent states can open a security loophole for Eve to attack a one-way GMCS CVQKD system without trace.

Further, whatever the reason for the increased intensity of the transmitted Gaussian-modulated coherent states, we can use the analysis method presented in zheng2019practical to investigate the practical security of the system under this loophole. Thus, we no longer describe the calculation process of the secret key rate for the system under the laser seeding attack. Fig. 3 depicts the relationship between the secret key rate and the transmission distance for the one-way GMCS CVQKD system under the laser seeding attack when $\varepsilon=0.01,0.05$ . The fixed parameters for the simulation are set as: $V_{A_{0}}=4,\eta=0.5,\nu_{\text{el}}=0.01,\beta=95\%,\epsilon=10^{-10},m=0.5\times N$ , respectively.

It is clear that the evaluative secret key rate $K_{e}$ under the laser seeding attack are overestimated compared with the practical secret key rate $K_{p}$ in the same situation. These results also demonstrate that the laser seeding attack can open a security loophole for Eve to perform an intercept-resend attack in a practical one-way CVQKD system. In particular, the gap between the estimated secret key rate and the corresponding practical secret key rate represents the key information that can be acquired by Eve through the intercept-resend attack. We find that the leaking of the secret key information ascends with the power of the laser seeding attack. In addition, Eve can acquire more secret key information in the case of a larger excess noise $\varepsilon$ under the same attack power of laser seeding attack.

III.2 Security of GMCS CV-MDI-QKD systems under the laser seeding attack

In GMCS CV-MDI-QKD systems, the two sources become the only region that can be exploited by Eve. Here, these sources are the same as the source of one-way GMCS CVQKD systems. Therefore, it is possible that Eve attacks these sources actively. In the following analysis, we will investigate the practical security of CV-MDI-QKD systems under the laser seeding attack in detail.

III.2.1 The estimated channel parameters under the laser seeding attack

Although CV-MDI-QKD can remove all known or unknown side-channel attacks on detectors, Eve may perform the laser seeding attack on the light source module in a practical CV-MDI-QKD system. Therefore, it is essential that the practical security of a CV-MDI-QKD system under the laser seeding attack is investigated. In Fig. 4, we describe the equivalent entanglement-based (EB) model of the CV-MDI-QKD schemes. Specifically, Alice and Bob first generate one two-mode squeezed state with variance ${V_{A}}+1$ and ${V_{B}}+1$ , respectively. Here, the mode ${A_{1}}$ ( ${B_{1}}$ ) is retained by Alice (Bob), the other mode ${A_{\rm{2}}}$ ( ${B_{\rm{2}}}$ ) is sent to an untrusted third party Charlie through the quantum channel with length $L_{AC}$ ( $L_{BC}$ ). The total transmission distance $L_{AB}$ is equal to ${L_{AC}}+{L_{BC}}$ . Subsequently, Charlie interferes two modes $A^{\prime}$ and $B^{\prime}$ at a beam splitter (BS) with two output modes $C$ and $D$ . Then, both the quadrature variable $x_{C}$ of mode $C$ and quadrature variable $p_{D}$ of mode $D$ are measured by Charlie through homodyne detection, and he announces the measurement results $\left\{{{x_{C}},{p_{D}}}\right\}$ through a public channel pirandola2015high-rate ; ma2014gaussian . Finally, Bob modifies mode ${B_{1}}$ to ${B^{\prime}_{\rm{1}}}$ by displacement operation $D\left(\beta\right)$ , where $\beta=g_{m}\left({{x_{C}}+i{p_{D}}}\right)$ , and $g_{m}$ represents the gain of the displacement operation. After through these procedures, mode ${A_{1}}$ and ${B^{\prime}_{\rm{1}}}$ become entangled. Accordingly, Alice and Bob will share a group correlated vectors $X=\left\{{\left({{{x_{A_{0}}}_{i}},{{x_{B_{0}}}_{i}}}\right)\left|{i=1,2,\ldots,N}\right.}\right\}$ or $P=\left\{{\left({{{p_{A_{0}}}_{i}},{{p_{B_{0}}}_{i}}}\right)\left|{i=1,2,\ldots,N}\right.}\right\}$ after the quadratures of mode ${B^{\prime}_{\rm{1}}}$ and mod ${A_{1}}$ are measured by employing heterodyne detection. It is notable that Alice and Bob implement information reconciliation and privacy amplification to obtain a string of secret key.

It is obvious that there are two quantum channels which satisfy with linear model in a CV-MDI-QKD system. Here, the excess noise and transmittance of the quantum channel between Alice (Bob) and Charlie are expressed by ${\varepsilon_{AC}}$ ( ${\varepsilon_{BC}}$ ) and ${T_{AC}}$ ( ${T_{BC}}$ ). Since the transmission of the Gaussian-modulated quantum coherent states before the interference in Charlie’s apparatus is the same with the one-way GMCS CVQKD systems, the involved two quantum channels can also be modeled as a normal linear model with the following relations:

[TABLE]

where $x_{A_{0}}$ ( $p_{A_{0}}$ ), $x_{A^{\prime}_{0}}$ ( $p_{A^{\prime}_{0}}$ ), $x_{B_{0}}$ ( $p_{B_{0}}$ ) and $x_{B^{\prime}_{0}}$ ( $p_{B^{\prime}_{0}}$ ) are the values of the quadrature variables of mode $A_{2}$ , $A^{\prime}$ , $B_{2}$ and $B^{\prime}$ , respectively. Here, $t_{AC}=\sqrt{T_{AC}}$ , $t_{BC}=\sqrt{T_{BC}}$ , $z_{AC}$ and $z_{BC}$ are the total noises in the two quantum channels that obeys two centered normal distribution with variance $\sigma^{2}_{AC}=T_{AC}\xi_{AC}+N_{0}$ and $\sigma^{2}_{BC}=T_{BC}\xi_{BC}+N_{0}$ , respectively. These variances include shot noise $N_{0}$ , channel excess noises $\xi_{AC}$ and $\xi_{BC}$ .

Based on the above analyses, we can obtain the following relations ma2014gaussian ; Zhang2017Finite ; li2014continuous-variable ; papanastasiou2017finite :

[TABLE]

According to Eq. (5), we can further get

[TABLE]

In particular, we here assume that these detectors located in Charlie’s side have identical detection efficiency $\eta$ and electronic noise $V_{el}$ . Moreover, in the evaluation of the secret key rate, the above parameters $V_{x_{A_{0}}}$ , $V_{x_{B_{0}}}$ , $\xi_{AC}$ , $\xi_{BC}$ and $V_{el}$ must be calculated in shot-noise unit, i.e., $V_{A}N_{0}$ , $V_{B}N_{0}$ , $\varepsilon_{AC}N_{0}$ , $\varepsilon_{BC}N_{0}$ and $\nu_{el}N_{0}$ , respectively.

By using Eqs. (5) and (6), the channel parameters $T_{AC}$ , $T_{BC}$ , $\varepsilon_{AC}$ and $\varepsilon_{BC}$ can be estimated by

[TABLE]

It is important to note that the quadrature variable $p_{C}$ of mode C or quadrature variable $x_{D}$ of mode D needs also to be measured for estimating these channel parameters. Therefore, we should use a heterodyne detector to replace one of the two homodyne detectors. More importantly, the above investigations are based on the fact that the CV-MDI-QKD can remove all side-channel attacks on detectors. Therefore, we consider that the precision of the estimated parameters are not limited by the detectors in Charlie’s side.

However, the analyses of Sec. II indicate that the estimated values may be affected by the laser seeding attack. In order to clearly show this influence, we here consider the worst case, which is that the two light source modules of the system is simultaneously attacked. For simplicity, we assume that the attack power is the same (i.e., ${g_{1}}={g_{2}}=g$ ) and do not consider the other attack situations. Therefore, these quadrature variable $x_{A_{0}}$ ( $p_{A_{0}}$ ), $x_{B_{0}}$ ( $p_{B_{0}}$ ), $x_{C}$ ( $p_{C}$ ) and $x_{D}$ ( $p_{D}$ ) will become

[TABLE]

In a practical CV-MDI-QKD system, if Alice and Bob are not aware of the laser seeding attack, they still use $x_{A_{0}}$ and $p_{B_{0}}$ to estimate the channel parameters. Therefore, these relations in Eq. (7) kept by Alice, Bob and Charlie become

[TABLE]

There are some obvious deviations caused by the laser seeding attack between Eq. (7) and Eq. (9). It is obvious that these channel excess noises are underestimated under the laser seeding attack. Therefore, Eve may perform a classical intercept-resend attack to collect key information without trace under the shield of the laser seeding attack, which illustrates that a loophole will occurs in a practical CV-MDI-QKD system. In order to clearly show the loophole, we cite a specific partial intercept-resend (PIR) attack to analyze the security of a practical CV-MDI-QKD system in presence of the laser seeding attack in the next section.

III.2.2 A quantitative example

The intercept-resend attack plays an important role as one part of most quantum hacking strategies. In the quantum hacking scheme based on the laser seeding attack, Eve may also exploit the classical intercept-resend attack to collect key information. Therefore, we first investigate the PIR attack between Alice and Charlie under the laser seeding attack. In the PIR attack, the probability distribution of quadrature variable of mode $A^{\prime}$ in Charlie’s apparatus is weighted sum of two Gaussian distributions, i.e., the distribution of the intercepted resend data with a weight of $u$ and the distribution of the transmitted data with a weight of $1-u$ Jouguet2013Preventing ; lodewyck2007experimental . Further, the extra excess noise caused by Eve in the implementation of the PIR attack can be expressed by $2uN_{0}$ . In principle, the total excess noise estimated by Alice and Charlie under the PIR attack can be represented as

[TABLE]

where $\xi_{t,AC}=\varepsilon_{t,AC}N_{0}$ is the technical excess noise. Expressed in shot-noise, the estimated excess noise $\xi_{PIR,AC}$ can be computed as

[TABLE]

With loss of generality, we assign 0.1 to $u$ . Correspondingly, the excess noise $\varepsilon_{PIR,AC}$ estimated by Alice and Charlie can become $\varepsilon_{t,AC}+0.2$ . In this case, the estimated excess noise under the laser seeding attack should be rewritten as

[TABLE]

In the practical implementation of a CV-MDI-QKD system, we assume that the technical excess noise $\varepsilon_{t,AC}=0.1$ . Therefore, when Eve performs the PIR attack, the estimated total excess noise under the laser seeding attack can be calculated as $\varepsilon^{\prime}_{PIR,AC}=\frac{0.3}{g}$ . Before the execution of the laser seeding attack, the noise value is $0.3$ , which obviously exceeds the ideal value. Accordingly, the process of key distribution is interrupted to guarantee the security of the system. However, we find that the estimated total excess noise can be reduced by Eve with the help of the laser seeding attack. When $g=3$ , the estimated total excess noise $\varepsilon^{\prime}_{PIR,AC}=0.1$ , i.e., the ideal noise value without attack. It has been experimentally demonstrated that $g$ can equal 3 under the control of Eve huang2019laser . The result indicates that Eve can perform the laser seeding attack to make the PIR attack hidden. In particular, Eve can perform a full intercept-resend (FIR) attack in the case of $u=1$ . Although the FIR attack is the most powerful, it can also be hidden when Eve makes $g$ exceeds 21. These analysis results fully demonstrate that the extra excess noise induced by the intercept-resend attack can be completely concealed by Eve through the laser seeding attack. Similarly, the excess noise induced by the intercept-resend attack between Bob and Charlie can also be concealed by Eve with the help of the laser seeding attack. Therefore, the laser seeding attack will open a loophole for Eve to successfully hide her attacks, which seriously destroys the security of the practical CV-MDI-QKD system.

III.2.3 Secret key rate under the laser seeding attack

In this section, we mainly focus on the secret key rate of a CV-MDI-QKD scheme under one-mode collective Gaussian attack, where Bob performs reverse reconciliation. We here point out that this one-mode attack is not the optimal strategy. In particular, the two-mode attack is demonstrated to be the optimal attack pirandola2015high-rate . More concretely, Eve performs correlated two-mode coherent Gaussian attack on two quantum channels by employing their interactions. However, in a practical CV-MDI-QKD system, the correlation of the two quantum channels can become very weak when they come from different directions. Therefore, the quantum channel of CV-MDI-QKD can be reduced to one-mode channel in this context. Here, Eve can efficiently perform the one-mode attack.

It has been demonstrated that the CV-MDI-QKD schemes is equivalent to the one-way CVQKD protocols using coherent states and heterodyne detection when the preparation of Bob’s EPR states and the displacement operation of Bob are assumed to be untrusted li2014continuous-variable . Therefore, the calculation process of secret key rate of CV-MDI-QKD protocols is the same with the one-way GMCS CVQKD. In the following analysis, we assume that the heterodyne detection is perfect and do not consider the finite-size effect, which does not affect our analysis results. Here, the shannon mutual information between Alice and Bob becomes fossier2009improvement

[TABLE]

where $V^{het}_{B}=\eta T_{m}(V_{A}+1+\chi_{\text{line},m})/2$ , $V^{het}_{B|A}=\eta T_{m}(1+\chi_{\text{line},m})/2$ and $\chi_{\text{line},m}=1/T_{m}-1+\varepsilon_{m}$ . Furthermore, the vital covariance matrix ${\Gamma^{m}_{AB}}$ between Alice and Bob can be expressed as

[TABLE]

where

[TABLE]

In order to minimize $\varepsilon_{m}$ , we adopt $k=\sqrt{\frac{{2{V_{B}}}}{{{T_{BC}}\left({{V_{B}}+2}\right)}}}$ ; then

[TABLE]

According to Refs. fossier2009improvement ; leverrier2010finite , the Holevo bound can be obtained as

[TABLE]

Here,

[TABLE]

where

[TABLE]

Eventually, the secret key rate against collective attacks for the CV-MDI-QKD schemes is calculated as

[TABLE]

The analysis indicates that the secret key rate of the system can be expressed as $K_{m}=K(V_{A},V_{B},T_{m},\varepsilon_{m})$ . When Alice and Bob are not aware of the laser seeding attack, the evaluative secret key rate is expressed as $K_{m,e}=K(V_{A},V_{B},T_{m},\varepsilon^{\prime}_{m})$ . However, the practical secret key rate of the system should be computed as $K_{m,p}=K(V^{\prime}_{A},V^{\prime}_{B},T^{\prime}_{m},\varepsilon_{m})$ . Here,

[TABLE]

Next, we simulate the secret key rate versus transmission distance in the symmetric and extreme asymmetric case when Eve performs the laser seeding attack in the two light source modules of a practical CV-MDI-QKD system. Fig. 5 shows the secret key rate versus transmission distance in the symmetric case under different excess noise environment when the attack power $g=1.02$ . In the simulation analysis, the involved parameters are fixed as follows. ${V_{A}}={V_{B}}=40$ , $\eta=0.6$ , $\varepsilon_{AC}=\varepsilon_{BC}=0.01,0.05$ , $\beta=95\%$ , respectively. We observe that there is an obvious gap between the secret key rate estimated by Alice and Bob and the practical secret key rate. The results indicate that Eve can perform the intercept-resend attack without trace to steal key information in a practical CV-MDI-QKD system.

Fig. 6 reveals the secret key rate of the system as a function of the transmission distance from Alice to Bob in the extreme asymmetric case when the excess noise $\varepsilon_{AC}$ and $\varepsilon_{BC}$ are assumed to be 0.01 or 0.05. Here, the attack power $g=1.02$ , and the other parameters for the simulation are fixed values that has been confirmed in the analysis of the symmetric case. It is obvious that the secret key rate calculated by Alice and Bob is overestimated compared with the practical secret key rate. In particular, we find that the CV-MDI-QKD systems are more sensitive to the laser seeding attack than the one-way GMCS CVQKD system. A slight attack power can have a major impact on the evaluative value of secret key rate of the CV-MDI-QKD systems, especially in the extreme asymmetric case.

The above investigations demonstrate that the laser seeding attack opens a security loophole for Eve to obtain information about secret key without trace in a practical CV-MDI-QKD system, which seriously destroys the practical security of the system.

IV Countermeasure against the laser seeding attack

The above investigations show that the laser seeding attack affects the parameter estimation and the evaluative secret key rate. To resist this attack, we can exploit an appropriate isolator to prevent the injected light. However, it is important to note that Eve might reduce the performance of the isolator by laser damage attack. Therefore, we here propose a real-time monitoring scheme for the intensity of output optical signal in light source module to prevent the incorrect estimation of channel parameters. According to the analysis of Section. II, we find that the intensity of the LO signal can simultaneously change under the effects of the laser seeding attack. Therefore, the attack can be directly found by monitoring the intensity of the LO signal in real time before attenuation.

Fig. 7 shows the countermeasure against the laser seeding attack for the one-way CVQKD systems in Alice’s apparatus. Specifically, Alice first splits a fraction of the undiminished LO signal to measure its intensity by using a photodiode. Here, the practical value of the intensity of the undiminished LO signal is $I_{p}$ , which can also be automatically predicted by using machine learning liu2018 . Then, Alice can calculate the value of $g$ by comparing the difference between the measured value and the preset value $I_{0}$ of the separated LO signal, i.e., $g=\frac{I_{p}}{I_{o}}=\frac{V^{\prime}_{A_{0}}}{V_{A_{0}}}$ . Eventually, according to Ref. zheng2019practical , Alice and Bob can precisely evaluate the secret key rate of the system, i.e., $K_{m}=K(gV_{A_{0}},\frac{T^{\prime}}{g},g\varepsilon^{\prime},\nu_{el})=K_{p}$ . These analyses demonstrate that the real-time monitoring scheme can help Alice and Bob to precisely estimate the channel parameters of the system. Finally, the secret key rate of the CVQKD systems under the laser seeding attack can be precisely evaluated with the help of this scheme. The accurate evaluation of secret key rate can effectively close this security loophole. In particular, in a LLO CVQKD system, Alice can split a fraction of undiminished reference signal to monitor its intensity in real-time to close this loophole. In addition, the loss of the LO signal in the above scheme can be completely compensated by properly adjusting the preset value of the attenuation level of the VOA in the light path of LO.

It is important to note that this real-time monitoring scheme can equally remove the loophole induced by the laser seeding attack in a practical CV-MDI-QKD system. Here, the two light sources of the system should be simultaneously monitored by adding the monitoring module which is shown in Fig. 7. More concretely, the monitoring scheme also makes the secret key rate evaluated precisely to resist the laser seeding attack. For example, in the case of the same attack power, the parameter $g$ can be acquired by $g={g_{1}}={g_{2}}=\frac{I_{p_{1}}}{I_{0}}=\frac{I_{p_{2}}}{I_{0}}$ . Next, the secret key rate of the system can be evaluated as $K_{m,e}=K(gV_{A},gV_{B},T^{\prime}_{m},\varepsilon_{m})=K_{m,p}$ . The analysis result indicates that the proposed real-time monitoring scheme can effectively resist the laser seeding attack to close this security loophole.

V CONCLUSION

In this work we have studied the security of several practical CVQKD systems under the laser seeding attack. More specifically, we have studied the standard one-way GMCS CVQKD protocols in reverse reconciliation, and GMCS CV-MDI-QKD schemes in the symmetric case and extreme asymmetric case. Here, we consider that Eve can carry out the laser seeding attack in the laser sources of the two kinds of CVQKD systems. We show that the intensity of the transmitted Gaussian-modulated quantum optical signals can become large with the increase of the intensity of optical signals prepared by the light source module under the attack.

For the practical one-way CVQKD systems, we observe that the effects of the laser seeding attack are similar with the influences of the reduced optical attenuation caused by laser damage attack. Therefore, the laser seeding attack opens a loophole for Eve in the system. We further show that the laser seeding attack makes the secret key rate of the system overestimated, which also demonstrates the attack can help Eve to hide herself. In particular, Eve can obtain more key information for the case of a larger channel excess noise in the same attack power. In order to close this loophole, we propose a real-time monitoring scheme for the intensity of the optical signal generated by the light source module by measuring the intensity of the LO signal before attenuation. This scheme can make Alice and Bob precisely evaluate the channel parameters to accurately analyse the performance of the system.

Apart from this, we mainly investigate the laser seeding attack for the effects of the security of a practical CV-MDI-QKD system. We find that these channel excess noises of the system are underestimated under the laser seeding attack, which indicates that the attack can open a security loophole for Eve to successfully perform an intercept-resend attack. Although the CV-MDI-QKD system can remove all side channels from the measurement unit, Eve can also successfully perform the laser seeding attack in the two light source modules of the system to steal key information without being detected. We also find that the CV-MDI-QKD schemes are more sensitive to the laser seeding attack compared with the one-way CVQKD protocols. It is notable that the proposed real-time monitoring scheme can also close this loophole in a practical CV-MDI-QKD system.

ACKNOWLEDGMENTS

This work was supported by the National key research and development program (Grant No. 2016YFA0302600), the National Natural Science Foundation of China (Grants No. 61671287, 61631014, 61332019, 61632021), and the Natural Science Basic Research Plan in Shaanxi Province of China (Grant No. 2019JM-591).

Bibliography52

The reference list from the paper itself. Each links out to its DOI / PubMed record.

1(1) A. K. Ekert, Phys. Rev. Lett. 67 , 661 (1991).
2(2) N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74 , 145 (2002).
3(3) C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev. Mod. Phys. 84 , 621 (2012).
4(4) F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, Nature (London) 421 , 238 (2003).
5(5) P. W. Shor and J. Preskill, Phys. Rev. Lett. 85 , 441 (2000).
6(6) H.-K. Lo and H. F. Chau, Science 283 , 2050 (1999).
7(7) A. Leverrier, R. García-Patrón, R. Renner, and N. J. Cerf, Phys. Rev. Lett. 110 , 030502 (2013).
8(8) B. Qi, L.-L. Huang, L. Qian, and H.-K. Lo, Phys. Rev. A 76 , 052323 (2007).