Asymmetric delay attack on an entanglement-based bidirectional clock synchronization protocol

TL;DR

This paper presents an attack on a quantum-based bidirectional clock synchronization protocol that exploits asymmetric delays introduced by optical circulators, causing errors in synchronization without detection.

Contribution

It reveals a vulnerability in entanglement-based clock synchronization protocols by demonstrating how asymmetric delays can be exploited to induce errors.

Findings

The attack successfully causes synchronization errors.

The attack evades detection mechanisms.

Optical circulators can be manipulated to break reciprocity.

Abstract

We demonstrate an attack on a clock synchronization protocol that attempts to detect tampering of the synchronization channel using polarization-entangled photon pairs. The protocol relies on a symmetrical channel, where propagation delays do not depend on propagation direction, for correctly deducing the offset between clocks -- a condition that could be manipulated with optical circulators, which rely on static magnetic fields to break the reciprocity of propagating electromagnetic fields. Despite the polarization transformation induced within a set of circulators, our attack creates an error in time synchronization while successfully evading detection.

Equations

$${\tau }_{AB}=\delta +\Delta t_{AB}\mathrm{and}{\tau }_{BA}=\delta -\Delta t_{BA}$$

$$\Delta T=\Delta t_{AB}+\Delta t_{BA}={\tau }_{AB}-{\tau }_{BA},$$

$$\delta =\frac{1}{2}[({\tau }_{AB}+{\tau }_{BA})-(\Delta t_{AB}-\Delta t_{BA})]$$

$$\delta =\frac{1}{2}\left({\tau }_{AB}+{\tau }_{BA}\right)$$

$$|{\Psi }^{-}⟩\to \pm \frac{1}{\sqrt{2}}\left(|HV⟩-|VH⟩\right)=\pm |{\Psi }^{-}⟩.$$

$$|\tilde{\psi }(t)⟩=e^{-if(t)}|\psi (t)⟩\text{and}|\tilde{\psi }(\tau )⟩=|\tilde{\psi }(0)⟩,$$

$$\Delta f=\beta +\gamma ,$$

$$\beta =\int {\text{displaylimits}}_0^{\tau }⟨\tilde{\psi }(t)|i\frac{\mathrm{d}}{\mathrm{d}t}|\tilde{\psi }(t)⟩$$

$$\gamma =-\int {\text{displaylimits}}_0^{\tau }⟨\psi (t)|i\frac{\mathrm{d}}{\mathrm{d}t}|\psi (t)⟩\mathrm{d}t$$

$$\beta =-\frac{1}{2}\Omega .$$

$$|\psi (t=0)⟩=e^{-i\varphi }\cos (\theta /2)|R⟩+\sin (\theta /2)|L⟩$$

$$\gamma$$

$$\hat{N}=k\left(\begin{array}{cc}{n}_R& 0\\ 0& n_L\end{array}\right)\text{and}|\psi (z)⟩=\left(\begin{array}{c}{e}^{ik{n}_{R}z}{e}^{-i\varphi }\cos (\theta /2)\\ e^{ik{n}_{L}z}sin(\theta /2)\end{array}\right)$$

$$n_{R,L}=n_0\left(1\pm \frac{VB}{k{n}_0}\right),$$

$$\gamma =k{n}_{0}d+VBd\cos \theta ,$$

$$|\psi ⟩=\cos (\theta /2)|R⟩+\sin (\theta /2)|L⟩,$$

$$|{\psi }_{\perp }⟩=-\sin (\theta /2)|R⟩+\cos (\theta /2)|L⟩,$$

$$|{\Psi }^{-}⟩$$

$$\displaystyle=\frac{i}{\sqrt{2}}\Big{(}|{\psi_{\perp}}\rangle_{A}|{\psi}\rangle_{B}-|{\psi}\rangle_{A}|{\psi_{\perp}}\rangle_{B}\Big{)}.$$

$$|{\Psi }^{-}⟩$$

$$\displaystyle=\frac{i}{\sqrt{2}}\Big{(}e^{i\phi}|{\psi_{\perp}}\rangle_{A}|{\psi}\rangle_{B}-e^{i\phi^{\prime}}|{\psi}\rangle_{A}|{\psi_{\perp}}\rangle_{B}\Big{)}$$

$$\displaystyle=\frac{ie^{i\phi}}{\sqrt{2}}\Big{(}|{\psi_{\perp}}\rangle_{A}|{\psi}\rangle_{B}-e^{i2\pi}|{\psi}\rangle_{A}|{\psi_{\perp}}\rangle_{B}\Big{)}$$

$$=e^{i\varphi }|{\Psi }^{-}⟩=-e^{ik{n}_{0}d}|{\Psi }^{-}⟩$$

$$\equiv -|{\Psi }^{-}⟩.$$

$$|{\Psi }^{-}⟩$$

$$\displaystyle=\frac{i}{\sqrt{2}}\Big{(}e^{i\beta}|{\psi_{\perp}}\rangle_{A}|{\psi}\rangle_{B}-e^{-i\beta}|{\psi}\rangle_{A}|{\psi_{\perp}}\rangle_{B}\Big{)}.$$

Full text

I Introduction

Clock synchronization protocols that bidirectionally exchange signals, e.g., the Network Time Protocol (NTP) or the two-way satellite time transfer (TWSTFT), are widely used to estimate the absolute time offset between remote clocks without first characterizing network propagation times Mills (1991); PTP (2009); Piester et al. (2008); Jiang et al. (2017). By assuming that propagation delays are symmetric in the two directions of travel in a synchronization channel, parties estimate one-way propagation times as half of the round-trip time. Although convenient, this assumption exposes the protocol to attacks that introduce unknown asymmetric channel delays which cannot be detected by better encryption or authentication Narula and Humphreys (2018). Existing countermeasures Mizrahi (2012); Ullmann and Vögeler (2009); Tsang and Beznosov (2006) e.g. based on monitoring round-trip times have been evaded by sophisticated intercept, spoofing and delay techniques Rabadi et al. (2017).

Recently, protocol implementations using entangled photons suggest measuring non-local properties to ensure that synchronization networks have not been tampered with – a technique associated with entanglement-based quantum key distribution Lee et al. (2019); Hou et al. (2018); Lamas-Linares and Troupe (2018). Tight time correlations between entangled photons prepared by spontaneous parametric down conversion (SPDC) allow synchronizing independent atomic clocks at photon rates of order 100 pairs/s Lee et al. (2019) and with potential accuracies $<1\,$ps Hou et al. (2018). Monogamy of entanglement ensures that a counterfeit photon entangled with the legitimate signal cannot be generated, allowing signal authentication Yang (2006). The no-cloning theorem prevents intercept, copy and resend of an identical quantum state with an arbitrary delay Wootters and Zurek (1982).

Despite these security enhancements, the vulnerability to an asymmetric delay attack remains since photons traveling in opposite directions can be passively rerouted with a circulator (Figure 1) by using the Faraday effect to break the reciprocity of the channel. A recent proposal suggests that even polarization-insensitive circulators, which rotate input polarizations back to the same state, impose a measurable change in the phase of the joint state Troupe and Lamas-Linares (2018). The proposal was based on the fact that the phase change after a cyclic quantum evolution is measurable under certain conditions Berry (1987). Previous experiments with entangled photons Kwiat and Chiao (1991); Strekalov and Shih (1997); Brendel et al. (1995); Jha et al. (2009) seemed to support this proposed protection.

In this work, we examine the circulator-based asymmetric delay attack Troupe and Lamas-Linares (2018). We experimentally show that the attack cannot be detected by the proposed mechanism and demonstrate an induced error in synchronization of over $25$ ns between two rubidium clocks.

II Attacking an Entanglement-Based Clock Synchronization Protocol

We briefly review the clock synchronization protocol considered Troupe and Lamas-Linares (2018).

The protocol involves two parties, Alice and Bob, connected by a single mode optical channel. Each party has a source of polarization-entangled photons pairs generated by SPDC. One photon of the pair is detected locally, while the other is sent and detected on the remote side (Figure 1). Every photodetection event is time-tagged with respect to a local clock which assigns time stamps $t$ and $t^{\prime}$.

Photon pairs emerging from SPDC are tightly time-correlated. Thus, for an offset $\delta$ between the clocks, a propagation time $\Delta t_{AB}$ from Alice to Bob, and $\Delta t_{BA}$ in the other direction, the second-order correlation function $G^{(2)}(\tau=t^{\prime}-t)$ of the time difference has two peaks at

[TABLE]

due to pairs created by Alice and Bob Glauber (1963). A round-trip time $\Delta T$ for photons can be calculated using the inter-peak separation,

[TABLE]

while the offset

[TABLE]

is given by the midpoint of the peaks and a propagation delay asymmetry, respectively. Assuming a symmetrical propagation delay, $\Delta t_{AB}=\Delta t_{BA}$, the clock offset

[TABLE]

is obtained directly from the midpoint.

Eve may now may exploit this assumption by separating the two propagation directions with a pair of circulators (Figure 1 gray region), introducing a direction dependent delay $\Delta t_{AB}-\Delta t_{BA}=(L-L^{\prime})/v$, where $L$ is the additional propagation length from Alice to Bob, and $L^{\prime}$ in the other direction, and $v$ is the speed of light in the fiber. If Alice and Bob continue to rely on the midpoint between the peaks to estimate $\delta$, they will obtain instead $\delta+(L-L^{\prime})/2v$.

In an attempt to detect the circulators, Ref. Troupe and Lamas-Linares, 2018 suggests that Alice and Bob monitor polarization correlations using avalanche photodiode preceded by a polarization measurement in the appropriate bases (D${}_{\text{A,B}}$). The detection scheme is based on the fact that circulators use Faraday Rotation to separate photons propagating in opposite directions - Faraday Rotation is a time-reversal symmetry breaking mechanism that rotates polarization, potentially changing the input state.

For each individual polarization state to be preserved, the circulators must rotate the state by an integer multiple of 180${{}^{\text{o}}}$ so that for a Bell state $|{\Psi^{-}}\rangle=\frac{1}{\sqrt{2}}\left(|{HV}\rangle-|{VH}\rangle\right)$ distributed by Alice, the rotation of Bob’s state ($|{\psi}\rangle_{B}\rightarrow\pm|{\psi}\rangle_{B}$) does not result in any measurable change

[TABLE]

However, as the evolution of Bob’s state follows a closed trajectory on the Poincaré sphere, Ref. Troupe and Lamas-Linares, 2018 predicted that a geometric phase – the phase determined by the geometry of the trajectory on the sphere Berry (1987) – is imposed on the Bell state, and can be detected in a non-local measurement. We show in the supplementary material that when other phase contributions are taken into account, the net effect of the circulators nonetheless produce no measurable change to the Bell state (Eq. 5). We use this result and experimentally demonstrate a successful asymmetric delay attack using the circulators in subsequent sections.

III Experiment

We first implement the clock synchronization protocol. For two independent rubidium clocks, the following setup was previously characterized to achieve a synchronization precision of 51 ps in 100 s, comparable to the relative intrinsic frequency instability of each clock Lee et al. (2019).

Two identical SPDC sources generate polarization-entangled photon pairs (Figure 1). The output of a laser diode (power $\approx$10 mW, central wavelength 405 nm) is coupled into a single mode optical fiber (SMF) for spatial mode filtering and focused to a beam waist of 80 $\mu$m into a 2 mm thick $\beta$-Barium Borate crystal cut for non-collinear type-II phase matching Kwiat et al. (1995). Down-converted photons at 810 nm are coupled into two single mode fibers with an overall detected pair rate of about $200$ s*-1*. Fiber beam splitters separate the photon pairs so that one photon is detected locally with an avalanche photodetector (D${}_{\text{A,B}}$), while the other photon is transmitted to the remote party.

Time-stamping units assign detection times $t$ and $t^{\prime}$ to the events detected at Alice and Bob, respectively. We compute the histogram $G^{(2)}(\tau=t^{\prime}-t)$ of the time differences and resolve two coincidence peaks (FWHM $\approx$ 500 ps) with a resolution of 16 ps, one from each source Ho et al. (2009). The offset and round-trip-times are determined from the mean and separation of the peaks, respectively. For the purposes of this demonstration, we lock the clocks with unknown offset to a common rubidium frequency reference, thus avoiding frequency drifts that can detract from the main point of the experiment, i.e. demonstrating an induced error in offset estimation.

III.1 Asymmetric Delay Attack

To implement the asymmetric delay attack, we use two 3-port polarization-insensitive optical circulators of design-wavelength 810 nm and two single mode fibers of lengths $L$ and $L^{\prime}$.

We first estimate the initial offset ${\delta_{\text{o}}}$ between the two clocks with a symmetric channel delay $L=L^{\prime}=L_{\text{o}}$. Figure 2(a) shows $g^{(2)}(\tau)$, the second-order correlation function $G^{(2)}(\tau)$ normalized to background coincidences, acquired from the time stamps recorded for about 5 min. In Figure 3 we plot the offset and round-trip times estimated every 40 s.

To illustrate the difference in the cross-correlation measured between a symmetric and an asymmetric delay attack, we use two 5 m fibers to impose an additional round-trip of 10 m, but distribute them differently during each attack. For the symmetric delay attack, we extend $L$ and $L^{\prime}$ equally by 5 m. We observe in Figure 2(b) that although the peak separation increases, the midpoint of the peaks used for estimating the offset remains unchanged. For the asymmetric delay attack, both fibers are used to extend $L$ by 10 m, while $L^{\prime}$ remains unchanged. We observe in Figure 2(c) that the peak separation remains the same as in Figure 2(b), but the midpoint of the peaks has shifted by $25.24(2)$ ns corresponding to half the additional round-trip time incurred. This indicates a successful attack.

III.2 Asymmetric Delay Attack Detection

As a proof-of-principle demonstration of how the circulators influence the distributed entanglement, we measure polarization correlations of Alice’s pair source before and after the circulators are inserted in one of its output modes with the setup shown in Figure 4. For each output mode, a quarter-wave plate (QWP), half-wave plate (HWP) and polarizing beamsplitter (PBS) projects the polarization mode into either $|{H}\rangle,|{V}\rangle,|{D}\rangle,|{A}\rangle,|{L}\rangle\text{ or }|{R}\rangle$. Fiber polarization controllers (FPCs) correct for the polarization errors introduced by the fibers. We note that since FPCs do not break time-reversal symmetry, they cannot invert the polarization transformation induced by the circulators. We detect photon pairs with APDs for 36 wave plate settings and numerically search for the density matrix most likely to have returned the observed pair rates Altepeter et al. (2005).

Figure 5 shows the reconstructed density matrices of Alice’s state before ($\rho_{\text{o}}$) and after ($\rho$) the introduction of the circulators into the path of Bob’s photons.

We compare $\rho_{\text{o}}$ and $\rho$ by computing the fidelity $F(\rho,\rho_{\text{o}})=\left(\textrm{Tr}\sqrt{\sqrt{\rho}\rho_{\text{o}}\sqrt{\rho}}\right)^{2}$. The uncertainty in $F$ due to errors in counting statistics was obtained by Monte Carlo simulation, where 36 new measurement results are numerically generated, each drawn randomly from a Poissonian distribution with a mean equal to the original number of counts Altepeter et al. (2005). From these numerically generated results, a new density matrix can be calculated and consequently, a new value of $F$. Repeating this process 100 times, we obtain the fidelity distribution shown in Figure 6 from which we compute a 95% confidence interval $98.7\%<F<98.9\%$. The distribution of $F$ does not include 100%, which we attribute to imperfect control of the polarization state in the optical fiber. From the near-unity value of $F$, we conclude that the circulators do not affect the distributed Bell state.

IV Conclusion

We have successfully demonstrated an attack of a clock synchronization protocol that tries to achieve security by detecting changes in polarization-entanglement distributed across a synchronization channel. The attack was implemented by rerouting photons with polarization-insensitive circulators, and imposing a direction-dependent propagation delay. The observed shift in the estimated clock offset is equal to half the propagation delay asymmetry, as expected for a protocol which assumes a symmetric channel Narula and Humphreys (2018). Although circulators reroute photons using a polarization-rotation mechanism, we experimentally verify that they produce no measurable change in the distributed entangled state, indicating that they cannot be detected with the protocol.

In this work, we focused on detecting its underlying mechanism – Faraday Rotation (FR), which must be performed in any circulator. Methods based on characterizing light intensities, e.g. identifying additional reflections, may still allow the detection of circulators, but they rely on the specific characteristics of the device (e.g. reflectivity). We also note that when Alice and Bob exchange photons that are identical in every other degree-of-freedom apart from propagation direction, there are few technologies besides a FR-based circulator capable of discreetly separating their photons. Alternatives such as advanced photonic structures Jalas et al. (2014); Dmitriev et al. (2013a, b); Bi et al. (2011); Yu and Fan (2009) and quantum non-demolition measurements Lamas-Linares and Troupe (2018) still pose a significant technological barrier for any adversary, so entanglement-based clock synchronization still may provide a significant security advantage compared to traditional methods.

In the supplementary material, we also examine the geometric phase associated with polarization state rotation in the circulators, previously thought to be observable Troupe and Lamas-Linares (2018), as an additional phase associated with photon dynamics in the Faraday Rotator neutralizes this geometric phase. We note that when geometric phases were observed in other entangled systems, an interferometric arrangement was necessary to eliminate the influence of this “dynamic” phase Kwiat and Chiao (1991); Strekalov and Shih (1997); Brendel et al. (1995); Jha et al. (2009). Whether or not a similar technique can be used to secure the present synchronization protocol remains an open question.

We acknowledge support by the National Research Foundation & Ministry of Education in Singapore. JT acknowledges support from the ARL:UT Independent Research and Development Program.

Appendix A Supplementary material

In this section, we show that when circulators rotate the polarization state of one of the photons in an entangled pair by 180${}^{\text{o}}$, the geometric phase imposed on the rotated photon does not produce a measurable change in polarization entanglement.

We first introduce the formalism to deal with the fact that points on the Poincaré sphere carry no phase information; the beginning and end points of a cyclic evolution correspond on the same point on the sphere.

To reflect this property, we define a “basis vector field” $|{\tilde{\psi}(t)}\rangle$, such that

[TABLE]

where $f(t)$ is the phase of $|{\psi(t)}\rangle$ expressed in terms of its basis state $|{\tilde{\psi}(t)}\rangle$ on the Poincaré sphere Anandan (1992).

The change in $f$ comprises of two terms

[TABLE]

where the geometric phase

[TABLE]

is due to the evolution of the basis state along a curved geometry, and the dynamic phase

[TABLE]

is due to the photon’s dynamics through the rotation medium Troupe and Lamas-Linares (2018).

A.1 Geometric Phase

Berry showed that the geometric phase is proportional only to the solid angle $\Omega$ subtended by the cyclic trajectory on the Poincaré sphere Berry (1987),

[TABLE]

Thus, a qubit in the initial state

[TABLE]

that underwent a 180${}^{\text{o}}$ rotation in the plane of polarization ($\phi\rightarrow\phi+2\pi$) will accumulate a geometric phase $\beta=-\pi(1-\cos\theta)$.

A.2 Dynamic Phase

To evaluate the dynamic phase $\gamma$ accumulated by the photon at end of a Faraday Rotator of length $d$, we parameterize its expression in Eq. 8 in terms of the penetration depth $z$

[TABLE]

where

[TABLE]

are expressed in the $\{|{R}\rangle,|{L}\rangle\}$ basis, and $k=\frac{2\pi}{\lambda}$ is the wave number of the photon mode in free space.

The Faraday Rotator is a birefringent medium whose refractive indices $n_{R,L}$ depend on the magnitude of an applied magnetic field $B$ in the direction of light propagation,

[TABLE]

where $V$ is the Verdet constant and $n_{0}$ is the index of refraction in the absence of a magnetic field.

Substituting 12 into 11, we obtain

[TABLE]

where the product $VBd$ can be shown Zak (1991) to be the anti-clockwise rotation angle for a linearly polarized input.

Consider an initial input state $|{\psi(\phi=0,\theta=0)}\rangle=|{H}\rangle$. For the evolution cycle ($\phi=0\rightarrow 2\pi$) considered earlier, $|{H}\rangle\rightarrow|{-45}\rangle\rightarrow{|{V}\rangle}\rightarrow|{+45}\rangle\rightarrow|{H}\rangle$ corresponds to a clockwise 180${}^{\text{o}}$ in the plane-of-polarization. Thus, the the rotation must be realized by a medium whose product $VBd=-\pi$. Consequently, the dynamic phase $\gamma=kn_{0}d-\pi\cos\theta$ for the state considered in Eq. 10.

A.3 Overall Phase & the Circulator Attack

We have already shown that an initial state

[TABLE]

will accumulate a geometric phase $\beta=-\pi(1-\cos\theta)$ and a dynamic phase $\gamma=kn_{0}d-\pi\cos\theta$, resulting in an overall phase $\phi=kn_{0}d-\pi$. Repeating this procedure for the orthogonal state

[TABLE]

we obtain a geometric phase of $\beta^{\prime}=-\beta=+\pi(1-\cos\theta)$ and a dynamic phase $\gamma^{\prime}=kn_{0}d+\pi\cos\theta$, resulting in an overall phase $\phi^{\prime}=kn_{0}d+\pi=\phi+2\pi$.

Let the entangled pair initially be in the Bell state $|{\Psi^{-}}\rangle=\frac{1}{\sqrt{2}}\left(|{HV}\rangle-|{VH}\rangle\right)$. With the first qubit Alice’s photon and the second one Bob’s photon. We can re-write the Bell state in the basis defined by Equations 15 and 16,

[TABLE]

The state of the Bell pair after Bob’s photon goes through Eve’s circulator based attack, $\hat{U}_{Attack}$, is given by

[TABLE]

We can see from this expression, that the initial Bell state remains unchanged from the introduction of the circulators, and is equivalent to the result obtained by direct calculation in Eq. 5.

Recent work assumed that the contribution from the dynamic phase was “zero, or is known and compensated for” and predicted instead that the circulators imparted a non-local geometric phase to produce a dramatic change Troupe and Lamas-Linares (2018)

[TABLE]

However, we note that the dynamic phase (Eq. 14) is likewise non-local (due to its dependence on $\theta$) and combines with the geometric phase to produce no measurable net change in the state.