Open Access
Add to BibSonomy
Abstract
To establish a time reference frame between two users in quantum key distribution, a synchronization calibration process is usually applied for the case of using gated mode single-photon detectors (SPDs). Traditionally, the synchronization calibration is independently implemented by the line length measurement for each SPD. However, this will leave a loophole that has been experimentally demonstrated by a special attack. Here, we propose an alternative synchronization scheme by fixing the relative delay of the signal time window among all SPDs and jointly performing the line length measurement with multiple SPDs under combining low-precision with high-precision synchronization. The new scheme is not only immune to the vulnerability but also improves the synchronization time from usually a few seconds to tens of milliseconds.
© 2019 Optical Society of America under the terms of the OSA Open Access Publishing Agreement
1. Introduction
Quantum key distribution (QKD) [1,2] is one of the most successful applications of quantum information science. It promises unconditionally secure key generation between two distant parties via the fundamental laws of quantum physics [3,4], rather than unproven computational complexity assumptions. The best-known QKD protocol is the Bennett-Brassard-1984 (BB84) protocol [1], combining the decoy-state method [5–7], which has been researched extensively both theoretically [8–11] and experimentally [12–16]. Currently, many practical BB84 QKD systems use optical communication fibers as quantum channels and work at the telecom wavelengths of around either 1550 nm or 1310 nm [17–19]. The detection at these wavelengths is often performed by the single-photon detector (SPD) with InGaAs avalanche photodiodes operated in Geiger mode [20], i.e., it is only activated for a narrow window when a signal pulse is expected to arrive. Therefore, Alice and Bob should synchronize the optical pulse with the center of SPD’s open window in the calibration routine.
Obviously, in this design, the synchronization between Alice’s source and Bob’s detectors is critical because the receiver will not identify the quantum signal correctly without the time gate synchronized to the photon arrival. How to choose an appropriate synchronization in the fiber network is worth considering carefully. Improper synchronization will not only affect the efficiency (long synchronization time) but also compromise the security of the QKD system. For example, the synchronization process is independently implemented by the line length measurement for each SPD [14,21], i.e., only using those detected pulse count from one detector to align the time of that detector. However, this synchronization calibration process is not efficient. More importantly, it will leave a loophole for Eve to attack the QKD system. During the synchronization calibration phase, Eve can shift the arrival time of each synchronization pulse and cause the detector efficiency mismatch for gated mode SPD. After the synchronization calibration process, Eve can use the fake-state attack [22–24] or time-shift attack [25,26] to successfully steal the secret key, which has been experimentally demonstrated in a commercial plug-and-play phase-coding QKD system [27].
In this paper, we present a secure and efficient synchronization method for QKD. Based on the assumption of the fixed relative delay of signal time window among all SPDs, it is secure against the synchronization calibration attack [27]. Furthermore, the time of the synchronization calibration will be greatly decreased by using the pulse count from different detectors jointly. This paper is organized as follows. In the second part, we first introduce a synchronization calibration attack for the traditional polarization-coding system, which independently implements the line length measurement for each SPD [14]. Then, we experimentally verify an assumption that the relative delay of signal time window among different SPDs in QKD system can be fixed even after a long time running. In the third and fourth parts, we propose and experimentally demonstrate a secure and efficient synchronization scheme. For each synchronization calibration process, the required time of the new scheme is only tens of milliseconds. In the final part, we have a conclusion.
2. Synchronization loophole and countermeasure
During the synchronization calibration process, Eve can replace the synchronization signal with his own signal and cause detector-efficiency mismatch if the line length measurement for each SPD is independently implemented [27]. Taking a polarization-coding QKD system as an example, Eve can set the horizontal pulse $\vert H \rangle$ to arrive at $t_0$, and the vertical pulse $\vert V \rangle$ at $t_1$ in the synchronization calibration process. At the receiver’s side, the time window that has the largest number of triggering is considered as a signal time window for the detector [28–30]. Consequently, the time window for $\vert H \rangle$ is $t_0$ and the time window for $\vert V \rangle$ is $t_1$. Moreover, Eve could set $t_0$ and $t_1$ carefully so that the detector efficiencies of the detectors differ greatly. After the synchronization calibration process, Eve can use fake-state attack [22–24] or time-shift attack [25,26] to acquire the key.
In order to circumvent this loophole, we assume that the relative delay of signal time window among different SPDs can be fixed since the optical lengths and electrical delays for different detectors almost unchange at the receiver. We run one QKD system for $16$ days to record the relative delay of signal time window among different SPDs. The experimental result supports our hypothesis which can be found in Fig. 1. We remark that the time-shift attack cannot be immune if one only uses our synchronization scheme, such as the case of the difference in detector efficiency characteristics.
3. New synchronization scheme
Here, we propose a secure and efficient synchronization scheme. On the one hand, we exploit the fact that the difference between the signal time window of multiple detectors remains the same. On the other hand, we implement a parallel synchronization method, where the time search range is divided evenly into $N$ portions and each portion is searched by only one detector. The time search can be simultaneously performed by using multiple detectors. Therefore, the time of the synchronization process can be considerably decreased. A schematic diagram of parallel synchronization is illustrated in Fig. 2.
The repetition rate of a QKD system is typically from tens of megahertz to gigahertz, while synchronization accuracy typically reaches tens of picoseconds. If the traversal method is utilized to finish the synchronization, the number of time windows that need to be searched can reach several hundreds to several thousands. Therefore, this synchronization method is extremely inefficient.
Here, we use a combination of low-precision and high-precision synchronization to reduce the number of searches. First, a low-precision traversal search is utilized to confirm the approximate time range of the optical pulse over the full-time range. The high-precision search is then used to obtain the signal time window in this relatively small time range. The high-precision search scheme can be applied by the dichotomy method or other high-performance search algorithms. By adopting the synchronization scheme combined with low-precision and high-precision, the search number can be significantly reduced, and the accuracy of the synchronization can be guaranteed. First, we need to calibrate the synchronization time difference among different SPDs in the lab or some other safe zone. In a BB84-QKD system, typically, Bob uses four separate SPDs, which are labeled as $\textrm {SPD}_{1}$, $\textrm {SPD}_{2}$, $\textrm {SPD}_{3}$ and $\textrm {SPD}_{4}$. Two SPDs are used for the X basis and two SPDs are used for the Z basis. Based on the signal time window $T_1$ of $\textrm {SPD}_{1}$, the differences between the signal time window of the remaining detectors $\textrm {SPD}_{i}$ and $\textrm {SPD}_{1}$ are recorded as $\Delta T_{i}$, which can be given by
where $T_{i}$ is the signal time window of detector $\textrm {SPD}_{i}$, and $i=2,~3,~4$.In the low-precision synchronization process, the receiver of the QKD system calculates the time search range of each detector according to the number of detectors ($N$), the relative delay value of each detector, and the repetition rate of the QKD system $f$. The full time search range is divided evenly into $N$ portions. For the $i$th detector, the time search range $Ra_i$ is:
The requirement for low precision is no more than the full width at half maximum of the optical pulse. A low-precision synchronous search is finished when all detectors complete the search.According to the detector count data of all the detectors in the low-precision process, we can find the time window $t_{l}$ and the detector number $n_{l}$ corresponding to the maximum detector count. The time search range of high-precision synchronization is calculated based on $t_{l}$ and $n_{l}$. The high-precision bit synchronization process and the low-precision bit synchronization process are roughly identical. The difference is that, firstly, in order to ensure the accuracy of synchronization, the accumulation time of the detector count in the high-precision synchronization process is usually greater than that in the low-precision synchronization process. Secondly, the high-precision synchronization process can further improve the efficiency by using the dichotomy algorithm.
According to the detector count data of all the detectors in the high-precision process, one need to find the time window $t_{h}$ and the detector number $n_{h}$ corresponding to the maximum detector count. For the $m$th detector, the signal time window is calculated as follows: $t_{m}=t_{h}$ if $m=n_{h}$, otherwise $t_{m}=t_{h}+(\Delta T_m-\Delta T_{n_{h}})$.
4. Experimental result
Figure 3 displays a schematic diagram of our polarization-coding decoy-state QKD system setup, including transmitter (Alice), quantum channel and receiver (Bob). At Alice’s side, we employ the phase-randomized weak-coherent pulse of 500 ps duration emitted by a 1550.12nm distributed feedback laser operating at 100 MHz as a source. The randomly changed intensity of each pulse is realized by an intensity modulator. The polarization of the signal is encoded by a fast polarization modulator. Intensity modulation and polarization modulation are controlled by a true random number generator. At Bob’s side, we use an electronic polarization controller to recover the polarization alignment before his polarization decoding optics module. Four InGaAs avalanche photodiodes operated in Geiger mode are used for single-photon detection at a clock rate of 100 MHz. The detection efficiency is $15.3\%$ while the dark count probability is approximately $8.0 \times 10^{-7}$ per gate. Between Alice and Bob, we use 50km standard single mode fiber SMF-28 with an attenuation loss of $10.3$ dB as the quantum channel. During the synchronization calibration process, the intensity of each pulse is changed to 3 to accelerate the entire process.
Fig. 3. Schematic diagram of polarization-coding QKD. PM, polarization modulator. IM, intensity modulator. FBG-50G, fiber Bragg grating. ATT, optical attenuator. CWDM, coarse wavelength division multiplexing. EPC, electronic polarization controller. PBS, polarization beam splitter. SPD, single-photon detector.
4.1 Method I
We divide the synchronization process into two round processes. The first round is low-precision synchronization, and the second round is high-precision synchronization. We fixed the detector count statistical time to 1ms in low-precision synchronization and 5ms in high-precision synchronization. The fixed high-precision is 10ps. In low-precision synchronization, we need to optimize the synchronization precision parameter $t$. The time $T_1$ taken for synchronization initialization is calculated as follows,
Fig. 4. The timing response histogram of the detected counts of implementation method I. a, low-precision synchronization. The time search range of $\textrm {SPD}_{1}$ is [0, 2.5] ns, the time search range of $\textrm {SPD}_{2}$ is [2.5, 5.0] ns, the time search range of $\textrm {SPD}_{3}$ is [5.0, 7.5] ns, and time search range of $\textrm {SPD}_{4}$ is [7.5, 10.0] ns. b, high-precision synchronization. The time search range of $\textrm {SPD}_{1}$ is [2040, 2060] ps, the time search range of $\textrm {SPD}_{2}$ is [2070, 2090] ps, the time search range of $\textrm {SPD}_{3}$ is [2100, 2120] ps, and time search range of $\textrm {SPD}_{4}$ is [2130, 2150] ps.
4.2 Method II
Although the total time spent in the synchronization calibration process of method I is reduced, this method is still not optimal. Here, we discuss how the optimal synchronization calibration process is implemented. Same as method I, we divide the synchronization process into two round processes. The difference lies in that we use the dichotomy algorithm with four detectors in the high-precision synchronization process. In the low-precision synchronization process, The time search range of $\textrm {SPD}_{1}$ is [0, 2.5] ns, the time search range of $\textrm {SPD}_{2}$ is [2.5, 5.0] ns, the time search range of $\textrm {SPD}_{3}$ is [5.0, 7.5] ns, and time search range of $\textrm {SPD}_{4}$ is [7.5, 10.0] ns. After the low-precision synchronization process, we find the time window corresponding to the maximum count is $1.92$ ns, and the corresponding detector is $\textrm {SPD}_{1}$. Therefore, the first time search range of high-precision synchronization is [1.44, 2.88] ns. Then, we divide this time search range into four equal parts, so that the time window for the first search are $1.62$ ns for $\textrm {SPD}_{1}$, $1.81$ ns for $\textrm {SPD}_{2}$, $2.00$ ns for $\textrm {SPD}_{3}$ and $2.19$ ns for $\textrm {SPD}_{4}$, respectively. The subsequent operation is similar, and the detailed processing and results are shown in the following Fig. 5. The total time $T_2$ spent in the synchronization calibration process of method II is 20 ms.
Fig. 5. The timing response histogram of the detected counts of implementation method III. a, low-precision synchronization. The time search range of $\textrm {SPD}_{1}$ is [0,2.5] ns, the time search range of $\textrm {SPD}_{2}$ is [2.5, 5.0] ns, the time search range of $\textrm {SPD}_{3}$ is [5.0, 7.5] ns, and time search range of $\textrm {SPD}_{4}$ is [7.5, 10.0] ns. b, high-precision synchronization. The time windows for the first round are $1.62$ ns for $\textrm {SPD}_{1}$, $1.81$ ns for $\textrm {SPD}_{2}$, $2.00$ ns for $\textrm {SPD}_{3}$, and $2.19$ ns for $\textrm {SPD}_{4}$. The time windows for the second round are $2.03$ ns for $\textrm {SPD}_{1}$, $2.07$ ns for $\textrm {SPD}_{2}$, $2.11$ ns for $\textrm {SPD}_{3}$, and $2.15$ ns for $\textrm {SPD}_{4}$. The time windows for the third round are $2.04$ ns for $\textrm {SPD}_{1}$, $2.05$ ns for $\textrm {SPD}_{2}$, $2.06$ ns for $\textrm {SPD}_{3}$, and $2.08$ ns for $\textrm {SPD}_{4}$.
5. Discussion and conclusion
In Ref. [31], the time required for the synchronization calibration process is about one minute. In Ref. [32], the time required for the synchronization calibration process is typically 1-10 seconds. In comparison, the parallel synchronization method in this paper can only require tens of milliseconds. We remark that the synchronization time required by our parallel rules is at most $1/N$ of the previous one [31,32] even under the same conditions, where $N$ is the number of detectors. For the QKD system based on the Large-alphabet protocol [33,34], the number of detectors used at the receiver is generally not less than 8. The time of synchronization calibration process can be reduced even more. During the synchronization process, Eve can shift the arrival time of each pulse sent from Alice by employing a variable optical delay line. This type of attack causes the signal time window of multiple detectors to shift forward or backward as a whole. Under the condition that the time efficiency curves of multiple detectors are consistent or close to each other, such an attack will only reduce the detection efficiency of the QKD system without causing the detector time-dependent efficiency mismatch in our new synchronization scheme.
In summary, an efficient synchronization method without security loophole is proposed. This synchronization method adopts the parallel search method, and divides the time search range of the synchronization process depending to the number of detectors at the receiver, and then all the time search simultaneously in their respective search ranges. Through this parallel search method, the synchronization initialization time can be greatly reduced without security loophole. As the number of detectors increases, the time of bit synchronization is significantly decreased. Most of the current QKD systems use a multi-detector scheme, the application scenario of this synchronization method is expected to be very wide.
Funding
National Natural Science Foundation of China (61801420).
References
1. C. H. Bennett and G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” Theor. Comput. Sci. 560, 7–11 (2014). [CrossRef]
2. A. K. Ekert, “Quantum cryptography based on bell’s theorem,” Phys. Rev. Lett. 67(6), 661–663 (1991). [CrossRef]
3. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74(1), 145–195 (2002). [CrossRef]
4. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. 81(3), 1301–1350 (2009). [CrossRef]
5. W.-Y. Hwang, “Quantum key distribution with high loss: toward global secure communication,” Phys. Rev. Lett. 91(5), 057901 (2003). [CrossRef]
6. X.-B. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94(23), 230503 (2005). [CrossRef]
7. H.-K. Lo, X. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94(23), 230504 (2005). [CrossRef]
8. P. W. Shor and J. Preskill, “Simple proof of security of the bb84 quantum key distribution protocol,” Phys. Rev. Lett. 85(2), 441–444 (2000). [CrossRef]
9. D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill, “Security of quantum key distribution with imperfect devices,” Quantum Inf. Comput. 4, 325–360 (2004). [CrossRef]
10. M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner, “Tight finite-key analysis for quantum cryptography,” Nat. Commun. 3(1), 634 (2012). [CrossRef]
11. C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, “Concise security bounds for practical decoy-state quantum key distribution,” Phys. Rev. A 89(2), 022307 (2014). [CrossRef]
12. D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. G. Peterson, R. J. Hughes, A. E. Lita, S. W. Nam, and J. E. Nordholt, “Long-distance decoy-state quantum key distribution in optical fiber,” Phys. Rev. Lett. 98(1), 010503 (2007). [CrossRef]
13. T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett. 98(1), 010504 (2007). [CrossRef]
14. C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, H.-P. Zeng, T. Yang, X.-B. Wang, and J.-W. Pan, “Experimental long-distance decoy-state quantum key distribution based on polarization encoding,” Phys. Rev. Lett. 98(1), 010505 (2007). [CrossRef]
15. B. Fröhlich, J. F. Dynes, M. Lucamarini, A. W. Sharpe, Z. Yuan, and A. J. Shields, “A quantum access network,” Nature 501(7465), 69–72 (2013). [CrossRef]
16. S.-K. Liao, W.-Q. Cai, W.-Y. Liu, L. Zhang, Y. Li, J.-G. Ren, J. Yin, Q. Shen, Y. Cao, Z.-P. Li, F.-Z. Li, X.-W. Chen, L.-H. Sun, J.-J. Jia, J.-C. Wu, X.-J. Jiang, J.-F. Wang, Y.-M. Huang, Q. Wang, Y.-L. Zhou, L. Deng, T. Xi, L. Ma, T. Hu, Q. Zhang, Y.-A. Chen, N.-L. Liu, X.-B. Wang, Z.-C. Zhu, C.-Y. Lu, R. Shu, C.-Z. Peng, J.-Y. Wang, and J.-W. Pan, “Satellite-to-ground quantum key distribution,” Nature 549(7670), 43–47 (2017). [CrossRef]
17. Z. Yuan, A. Dixon, J. Dynes, A. Sharpe, and A. Shields, “Practical gigahertz quantum key distribution based on avalanche photodiodes,” New J. Phys. 11(4), 045019 (2009). [CrossRef]
18. M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, Y. Yoshino, K amd Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, and A. Zeilinger, “Field test of quantum key distribution in the tokyo qkd network,” Opt. Express 19(11), 10387–10409 (2011). [CrossRef]
19. L.-J. Wang, K.-H. Zou, W. Sun, Y. Mao, Y.-X. Zhu, H.-L. Yin, Q. Chen, Y. Zhao, F. Zhang, T.-Y. Chen, and J.-W. Pan, “Long-distance copropagation of quantum key distribution and terabit classical optical data channels,” Phys. Rev. A 95(1), 012301 (2017). [CrossRef]
20. R. H. Hadfield, “Single-photon detectors for optical quantum information applications,” Nat. Photonics 3(12), 696–705 (2009). [CrossRef]
21. A. Mink, L. Ma, T. Nakassis, H. Xu, O. Slattery, B. Hershman, and X. Tang, “A quantum network manager that supports a one-time pad stream,” in Second International Conference on Quantum, Nano and Micro Technologies (ICQNM 2008), (IEEE, 2008), pp. 16–21.
22. V. Makarov and D. R. Hjelme, “Faked states attack on quantum cryptosystems,” J. Mod. Opt. 52(5), 691–705 (2005). [CrossRef]
23. V. Makarov, A. Anisimov, and J. Skaar, “Effects of detector efficiency mismatch on security of quantum cryptosystems,” Phys. Rev. A 74(2), 022313 (2006). [CrossRef]
24. V. Makarov and J. Skaar, “Faked states attack using detector efficiency mismatch on sarg04, phase-time, dpsk, and ekert protocols,” Quantum Inf. Comput. 8, 622–635 (2008).
25. B. Qi, C.-H. F. Fung, H.-K. Lo, and X. Ma, “Time-shift attack in practical quantum cryptosystems,” Quantum Inf. Comput. 7, 73–82 (2007).
26. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems,” Phys. Rev. A 78(4), 042333 (2008). [CrossRef]
27. N. Jain, C. Wittmann, L. Lydersen, C. Wiechers, D. Elser, C. Marquardt, V. Makarov, and G. Leuchs, “Device calibration impacts security of quantum key distribution,” Phys. Rev. Lett. 107(11), 110501 (2011). [CrossRef]
28. A. Pljonkin and K. Rumyantsev, “Single-photon synchronization mode of quantum key distribution system,” in 2016 International Conference on Computational Techniques in Information and Communication Technologies (ICCTICT), (IEEE, 2016), pp. 531–534.
29. K. Rumyantsev and A. Pljonkin, “Synchronization algorithm of quantum key distribution system with protection from unauthorized access,” in 2015 Workshop on Recent Advances in Photonics (WRAP), (IEEE, 2015), pp. 1–4.
30. A. Pljonkin, “Features of the photon pulse detection algorithm in the quantum key distribution system,” in Proceedings of the 2017 International Conference on Cryptography, Security and Privacy, (ACM, 2017), pp. 81–84.
31. X.-L. Liang, J.-H. Liu, Q. Wang, D.-B. Du, J. Ma, G. Jin, Z.-B. Chen, J. Zhang, and J.-W. Pan, “Fully integrated ingaas/inp single-photon detector module with gigahertz sine wave gating,” Rev. Sci. Instrum. 83(8), 083111 (2012). [CrossRef]
32. D. Rosenberg, C. G. Peterson, J. Harrington, P. R. Rice, N. Dallmann, K. Tyagi, K. McCabe, S. Nam, B. Baek, R. Hadfield, R. Hughes, and J. Nordholt, “Practical long-distance quantum key distribution system using decoy levels,” New J. Phys. 11(4), 045009 (2009). [CrossRef]
33. I. Ali-Khan, C. J. Broadbent, and J. C. Howell, “Large-alphabet quantum key distribution using energy-time entangled bipartite states,” Phys. Rev. Lett. 98(6), 060503 (2007). [CrossRef]
34. C. Lee, D. Bunandar, Z. Zhang, G. R. Steinbrecher, P. B. Dixon, F. N. Wong, J. H. Shapiro, S. A. Hamilton, and D. Englund, “High-rate large-alphabet quantum key distribution over deployed telecom fiber,” in In 2016 Conference on Lasers and Electro-Optics (CLEO), (Optical Society of America, 2016), pp. 1–2.
