GB2441364A

GB2441364A - A quantum communication system which selects different protocols on the basis of security

Info

Publication number: GB2441364A
Application number: GB0617231A
Authority: GB
Inventors: Zhiliang Yuan; Andrew James Shields
Original assignee: Toshiba Research Europe Ltd
Current assignee: Toshiba Europe Ltd
Priority date: 2006-08-31
Filing date: 2006-08-31
Publication date: 2008-03-05
Anticipated expiration: 2026-08-31
Also published as: GB2441364B; GB0617231D0

Abstract

A quantum communication method comprising: Transmitting light pulses which have been prepared with one of at least four quantum states to a receiver, performing a security analysis to determine the security of the transmission and selecting from at least two pre-agreed quantum communication protocols which protocol should be used to determine information from said light pulses on the basis of said security analysis. Where said security analysis may comprise a channel transmission analysis and/or an error analysis to determine percentages of light pulses which have been correctly measured.

Description

S

I

A Ouantum Communication System and Method The present invention relates to the field of quantum communication, more specifically, the present invention relates to an improved quantum communication system and method for dealing with the presence of an eavesdropper.

In quantum communication systems, information is transmitted between a sender and a receiver by encoded single quanta, such as single photons. Each photon carries one bit of information encoded upon a property of the photon, such as its polarisation, phase or energy/time. The photon may even carry more than one bit of information, for example, by using properties such as angular momentum.

Quantum key distribution is a technique for forming a shared cryptographic key between two parties; a sender, often referred to as "Alice", and a receiver often referred to as "Bob". The attraction of this technique is that it provides a test of whether any part of the key can be known to an unauthorised eavesdropper (Eve). In many forms of quantum key distribution, Alice and Bob use two or more non-orthogonal bases in which to encode the bit values. The laws of quantum mechanics dictate that measurement of the photons by Eve without prior knowledge of the encoding basis of each causes an unavoidable change to the state of some of the photons. These changes to the states of the photons will cause errors in the bit values sent between Alice and Bob. By comparing a part of their common bit string, Alice and Bob can thus determine if Eve has gained information.

The above paragraph assumes the ideal situation where Alice always sends a single photon to Bob. However, in practical systems, a light or photon pulse will sometimes contain more than one photon. In this situation, Eve can intercept just one of the photons from the multiphoton pulse and measure this photon without Alice or Bob being able to detect her presence.

Many different protocols have been suggested for conveying information in a quantum communication system. A common protocol for distributing a secret key using single photons or weak coherent pulses is known as BB84 (Bennett et al. Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York 1984) p 175).

In BB84, the bit state 0 or 1 is encoded onto a certain physical property of a photon, such as polarisation or phase delay in an interferometer. Each bit (1 or 0) may be represented using two orthogonal states in one of two non-orthogonal bases. One of the states in each basis codes for 0, the other codes for 1. For example, for phase encoding, the first basis may be defined by applying a phase shift of 00 or 1800 to a photon passing through an interferometer, whereas the second basis may be defined by applying a phase shift of 90 or 270 to a photon passing through an interferometer. In the BB84 protocol the assignment of bit values to particular qubit states is agreed in advance and fixed. For polarisation encoding, one basis may be defined by vertically or horizontally polarising a photon and the other basis is defined by two polarisation states at 45 to the vertical and horizontal states.

If Bob chooses for a particular photon, the same basis for his measurement as Alice used to encode, he will be able to measure the received state deterministically, or in other words with a theoretical accuracy of 100%. However, if he uses a different basis from Alice there is a finite probability that he will determine the wrong bit value. If the overlap integral between states ir the two bases is 0.5 (ie if the bases are offset by 90 in the case of phase encoding), and Bob chooses a different basis to Alice, he has only a 50% chance of determining the correct result and a 50% chance of error.

After the measurement has been made, Alice and Bob communicate with one another over a classical channel. In the BB84 protocol, Alice and Bob exchange information concerning the phase shift applied by Bob and agree only to keep the results when Bob has used an appropriate phase shift, a process known as sifting. The results from any measurements performed using an incorrect phase shift by Bob are discarded. This means that, typically, the results from half of the measured photons will be discarded.

Other protocols also exist, for example, it is possible to use an encoding set consisting of two non-orthogonal states. These protocols require Bob to make a probabilistic measurement as opposed to a deterministic measurement. In a deterministic measurement Bob has a theoretical probability of 100% of determining the correct state, in a probabilistic measurement Bob will have a theoretical accuracy of less than 100% of determining the correct state. The use of a protocol which makes Bob use a probabilistic measurement is less efficient than a protocol which allows deterministic measurements to be used. However, protocols which require probabilistic measurements to be made are more resistant to eavesdroppers even in a multiphoton environment as an eavesdropper can also only make a probabilistic measurement.

In a first aspect, the present invention provides a quantum communication method comprising: transmitting light pulses which have been prepared with one of at least four quantum states to a receiver; performing a security analysis to determine the security of the transmission; and selecting from at least two pre-agreed quantum communication protocols which protocol should be used to determine information from said light pulses on the basis of said security analysis.

Thus, in the present invention the actual protocol which is used is decided after or during transmission of the key. Therefore, it is possible to determine a protocol which offers the optimum bit-rate for the transmission and security conditions.

Although, Eve does not cause an error in Bob's results if she uses a photon number splitting attack, she can still be detected as the transmission rate of pulses received by Bob will be lower if Eve is present. A channel transmission analysis can be used to see If Bob is receiving less pulses than expected. In a preferred embodiment, transmitting light pulses comprises transmitting light pulses of two or more different intensities and said channel transmission analysis comprises comparing the rate of pulses received having a first intensity with those received having a second intensity. Eve has no means for determining the intensity of the pulses so she will treat pulses of both intensities equally. However, by comparing the statistics for the received pulses of both intensities, is it possible to determine Eve's presence.

An error analysis may be performed either in addition to or instead of a channel transmission analysis as a measure of the errors in Bob's measurements may be enough to determine which protocol is desirable. Thus, the method may further comprise performing an error analysis to determine what percentage of light pulses have been correctly measured by the receiver.

In a preferred embodiment, the method further comprises: performing an error analysis to determine what percentage of light pulses have been correctly measured by the receiver; and performing a channel transmission analysis.

The protocol may be selected from a protocol which requires Bob to make deterministic measurements and a protocol which requires Bob to make probabilistic measurements e.g. a protocol which uses sifting with orthogonal basis and a protocol which uses sifting with non-orthogonal basis respectively. It is also possible to use protocols which use 6 or more quantum states.

The present invention may also comprise performing privacy amplification depending on the results of said error analysis.

The security analysis may be performed after an initial communication or during key transmission. (Obviously any parts of the key which are transmitted are a classical channel to perform error analysis are discarded).

The light pulses may be prepared using either polarisation or phase.

In a second aspect, the present invention provides a sending unit configured to transmit light pulses which have been prepared with one of at least four quantum states to a receiving unit; a receiving unit configured to collect data to allow an analysis to determine the security of the transmission to be performed; and a processor configured to analyse the security of the transmission and to select from at least two pre-agreed quantum communication protocols which protocol should be used to determine information from said light pulses on the basis of said analysis.

Any feature in one aspect of the invention may be applied to another aspect of the invention, in any appropriate combination. In particular, apparatus features may be applied to method features and vice versa.

The present invention will now be described with reference to the following non-limiting embodiments in which: Figure 1 is a schematic of a quantum communication system which can be used in the method of the present invention; Figure 2 is a plot demonstrating orthogonal and non-orthogonal sifting using 4 state protocols; Figure 3 is a table demonstrating orthogonal and non-orthogonal sifting using 4 state protocols; Figure 4 is a calculated two-dimensional plot of the optimal sifting schemes as a function of average photon flux and quantum state error rate; Figure 5 is a flow diagram illustrating a method in accordance with a preferred embodiment of the present invention; Figure 6 is a flow diagram illustrating a method in accordance with a further preferred embodiment of the present invention; Figure 7 is a flow diagram illustrating a method in accordance with a yet further preferred embodiment of the present invention; Figure 8 is a plot demonstrating orthogonal and non-orthogonal sifting using 6 state protocols; and Figure 9 is a table demonstrating orthogonal and non-orthogonal sifting using 6 state protocols.

In order to understand how the method of the present invention may be implemented, a quantum communication system will first be described.

Figure 1 shows a quantum cryptography/communication system based upon phase encoding using a polarisation sensitive fibre interferometer. The remainder of the description will consider encoding using phase. However, it will be appreciated by those skilled in the art that polarisation encoding may also be used The sender "Alice" 101 sends encoded photons to receiver "Bob" over optical fibre 105.

Alice's equipment 101 comprises a signal laser diode 107, a polarisation rotator 108 configured to rotate the polarisation of pulses from signal laser diode 107, an imba lanced fibre Mach-Zender interferometer 133 connected to the output of polarisation rotator 108, an attenuator 137 connected to the output of the interferometer 133, a bright clock laser 102, a wavelength division multiplexing (WDM) coupler 139 coupling the output from attenuator 137 and clock laser 102 and bias electronics 109 connected to said signal laser diode 107 and clock laser 102.

The interferometer 133 comprises an entrance coupler 130, one exit arm of entrance coupler 130 is joined to long arm 132, long ann 132 comprises a loop of fibre 135 designed to cause an optical delay, the other exit arm of entrance coupler 130 is joined to a short arm 131, short arm 131 comprises phase modulator 134 an exit polarising beam combiner 136 is connected to the other ends of long arm 132 and short arm 131.

All components used in Alice's interferometer 133 are polarisation maintaining.

During each clock signal, the signal diode laser 107 outputs one optical pulse. The signal diode laser 107 is connected to biasing electronics 109 which instruct the signal diode laser 107 to output the optical pulse. The biasing electronics are also connected to clock laser 102.

The linear polarisation of the signal pulses outputted by diode laser 107 is rotated by a polarisation rotator 108 so that the polarisation of the pulse is aligned to be parallel to a particular axis of the polarisation maintaining fibre (usually the slow axis) of the entrance coupler 130 of the interferometer 133. Alternatively the polarisation rotator 108 may be omitted by rotating the signal laser diode 107 with respect to the axes of the entrance polarisation maintaining fibre coupler 130.

After passing through the polarisation rotator (if present) the signal pulses are then fed into the imbalanced Mach-Zender interferometer 133 through a polarisation maintaining fibre coupler 130. Signal pulses are coupled into the same axis (usually the slow axis) of the polarisation maintaining fibre, of both output arms of the polarisation maintaining fibre coupler 130. One output arm of the fibre coupler 130 is connected to the long arm 132 of the interferometer while the other output arm of the coupler 130 is connected to the short arm 131 of the interferometer 133.

The long arm 132 of the interferometer 133 contains an optical fibre delay loop 135, while the short arm 131 contains a fibre optic phase modulator 134 which is configured to apply a phase shift of 0 (where 0 = 0 , 90 , 180 or 270 ). The fibre optic phase modulator 134 is connected through a phase modulator driver 120 to biasing electronics 109 which will be described in more detail later. The length difference of the two arms 131 and 132 corresponds to an optical propagation delay of ticlay. Typically the length of the delay loop 135 may be chosen to produce a delay tdelay 5ns. Thus, a photon travelling through the long arm 132 will lag that travelling through the short arm 131 by a time of tcjelay at the exit 136 of the interferometer 133.

The two arms 131, 132 are combined together with a polarisation beam combiner 136 into a single mode fibre 138. The fibre inputs of the polarisation beam combiner 136 are aligned in such a way that only photons propagating along particular axes of the polarisation maintaining fibre are output from the combiner 136. Typically, photons which propagate along the slow axis or the fast axis are output by combiner 136 into fibre 138.

The polarising beam combiner 136 has two input ports, an in-line input port and a 900 input port. One of the input ports is connected to the long arm 132 of the interferometer 133 and the other input port is connected to the short arm 131 of the interferometer 133.

In this example, only photons polarised along the slow axis of the in-line input fibre of the in-line input port are transmitted by the polarising beam combiner 136 and pass into the fibre 138. Photons polarised along the fast axis of the in-line input fibre of the input port are reflected and lost.

Meanwhile, at the 900 input port of the beam coupler 136, only photons polarised along the slow axis of the 90 input fibre are reflected by the beam combiner 136 and pass into the output port, while those polarised along the fast axis will be transmitted out of the beam combiner 136 and lost.

This means that the slow axis of one of the two input fibres is rotated by 90 relative to the output port. Alternatively the polarisation may be rotated using a polarisation rotator (not shown) before one of the input ports of the polarising beam combiner (136).

Thus, photon pulses which passed through the long 132 and short arms 131 will have orthogonal polarisations.

The signal pulses are then strongly attenuated by the attenuator 137 so that the average number of photons per signal pulse ji <I.

The signal pulses which are outputted by the combiner 136 into single mode fibre 138 are then multiplexed with a bright laser clock source 102 at a different wavelength using a WDM coupler 139. The multiplexed signal is then transmitted to the receiver Bob 103 along an optical fibre link 105. The biasing electronics 109 synchronises the output of the clock source 102 with the signal pulse.

Bob's equipment 103 comprises WDM coupler 141, a clock recovery unit 142 connected to an output of coupler 141, a polarisation controller 144 connected to the other output of WDM coupler 141, an imbalanced Mach-Zender interferometer 156 connected to the output of polarisation controller 144, two single photon detectors A 161, B 163 connected to the output arms of interferometer 156. Biasing electronics (not shown in Figure 1) are used to bias all active components, including the detectors 161, 163 Bob's interferometer 156 contains an entrance polarising beam splitter 151 connected to both: a long arm 153 containing a delay loop 154 and a variable delay line 157; and a short arm 152 containing a phase modulator 155. The long arm 153 and short arm 152 are connected to an exit polarisation maintaining 50/50 fibre coupler 158.

The phase modulator 155 is connected to a phase modulator driver 171. The phase modulator driver 171 is controlled by a first controller 173. All components in Bob's interferometer 156 are polarisation maintaining. The detectors 161, 163 are connected to detection processor 177 to process detection results and the main processor 179.

Bob first de-multiplexes the transmitted signal received from Alice 101 via fibre 105 using the WDM coupler 141. The bright clock laser 102 signal is routed to an optical receiver 142 to recover the clock signal for Bob 103 to synchronise with Alice 101.

The signal pulses which are separated from the clock pulses by WDM coupler 141 are fed into a polarisation controller 144 to restore the original polarisation of the signal pulses. This is done so that signal pulses which travelled the short arm 131 in Alice's interferometer 133, will pass the long arm 153 in Bob's interferometer 156. Similarly, signal pulses which travelled through the long arm 132 of Alice's interferometer 133 will travel through the short arm 152 of Bob's interferometer.

The signal then passes through Bob's interferometer 156. An entrance polarising beam splitter 151 divides the incident pulses with orthogonal linear polarisations. The two outputs of the entrance polarisation beam splitter 151 are aligned such that the two output polarisations are both coupled into a particular axis, usually the slow axis, of the polarisation maintaining fibre. This ensures that signal pulses taking either arm will have the same polarisation at the exit 50/50 polarisation maintaining coupler 158. The long arm 153 of Bob's interferometer 156 contains an optical fibre delay loop 154 and a variable fibre delay line 157, and the short arm 152 contains a phase modulator 155 which is configured to apply a phase shift of 0. The two arms 152, 153 are connected to a 50/50 polarisation maintaining fibre coupler 158 with a single photon detector A 161, B 163 attached to each output arm.

Due to the use of polarising components, there are, in ideal cases, only two routes for a signal pulse travelling from the entrance of Alice's interferometer to the exit of Bob's interferometer: i. Alice's Long Arm 132-Bob's Short Arm 152 (L-S) and ii. Alice's Short Arm 131- Bob's Long Arm 153 (S-L).

The variable delay line 157 at Bob's interferometer 156 is adjusted to make the propagation time along routes (i) and (ii) almost equal, within the signal laser coherence time which is typically a few picoseconds for a semiconductor distributed feed back (DFB) laser diode, and thereby ensure interference of the two paths. Bob achieves this by adjusting the variable fibre delay line 157 prior to key transfer.

By controlling the voltages applied to their phase modulators 134, 155, Alice and Bob determine in tandem whether paths (i) and (ii) undergo constructive or destructive interference at detectors A 161 and B 163. The phase modulators 134, 155 are connected to respective biasing means 109 and 143 to ensure synchronisation.

The variable delay line 157 can be set such that there is constructive interference at detector A 161 (and thus destructive interference at detector B 163) for zero phase difference between Alice and Bob's phase modulators. Thus for zero phase difference between Alice's and Bob's modulators and for a perfect interferometer with 100% visibility, there will be a negligible count rate at detector B 163 and a finite count rate at A 161.

If, on the other hand, the phase difference between Alice and Bob's modulators 134, is 1800, there should be destructive interference at detector A 161 (and thus negligible count rate) and constructive at detector B 163. For any other phase difference between their two modulators, there will be a finite probability that a photon may output at detector A 161 or detector B 163.

By using the above apparatus, a key can be sent from Alice 101 to Bob 103. Figure 2 shows how a photon may be prepared with one of four phase states and how these states may be assigned bit values in two different protocols (2a, 2b).

One of the protocols for sending information from Alice 101 to Bob 103 is the BB84 protocol (figure 2a). In the 3B84 protocol Alice and Bob agree that Alice will use her emitter to send photons having one of four phase states. In this particular example, these phase states are defined by Alice using her phase modulator 134 to apply one of 4 different phase shifts e, namely 0 , 90 , 1800 or 270 . These phase states define two orthogonal encoding bases I -{0 , 180 } and II -{90 , 270 ). The two states which form each orthogonal bases are assigned bit values, so in the example of figure 2a: Scheme 1: 00 - 180 - 900 - 270 -Alice sends the photons to Bob using the quantum channel randomly selecting a state by randomly applying a phase shift of 0 , 90 , 180 or 270 .

Bob measures the received photons randomly varying his measuring basis between the two bases defined by Alice. Bob achieves this by operating his phase modulator 155 under the control of first controller 173. By applying a phase shift of 0 , Bob measures can determine between states where Alice has applied a phase shift of 0 or 180 and by applying a phase shift of 90 , Bob can determine states defined by Alice applying a phase shift of 90 or 270 .

However, the BB84 protocol is not the only protocol which can be used for Alice and Bob to transmit information using the four states. The above BB84 protocol uses orthogonal states in each basis. In other words, a state represented by a phase shift of 00 is orthogonal to a state represented by a phase shift 180 .

However, it is also possible to use non-orthogonal sifting as shown in figure 2b. Here, basis Ill includes the states 0 and 90 and basis IV includes the states 1800 and 270 : When using orthogonal sifting, Bob can perform what is known as a deterministic measurement to determine which state within a certain bases is sent. Therefore, assuming that all equipment is perfectly balanced and that the channel is completely secure, Bob theoretically has a 100% chance of determining the correct state providing he has measured the state using the appropriate phase shift. (Alice and Bob need to communicate some information to see if Bob has used the appropriate phase shift).

However, when using non-orthogonal states to define the two bases, Bob can only perform what is known as a probabilistic measurement where he does not have a theoretical accuracy of 100% of distinguishing two states even if he uses an appropriate phase shift.

Looking at the table of figure 3, if Alice has applied 0 phase shift and Bob with his modulator applies a 0 phase shift, then there is a 100% probability (providing that all measurement apparatus behave perfectly) that a signal will be measured at detector A (161) and a probability of 0 that a signal will be measured at detector B (163).

Therefore, if Alice and Bob decide to use scheme 1 (above) then Bob can use a phase shift of 0 to distinguish between the two states in basis I (0, I).

However, Alice and Bob may decide to use a non-orthogonal sifting scheme, e.g. scheme 2.

Scheme 2: 0 -90 -liii lono (I by -1IAO 1 L(V -If Bob measures with a O phase shift, he cannot use this to deterministically distinguish between the states in basis III or the states in basis IV. However, by looking at the probability of registering a photon at a particular detector, it is possible to probabilistically determine which phase shift was sent by Alice for a particular phase shift applied by Bob.

For both orthogonal and non-orthogonal sifting schemes, it is necessary for Alice and Bob to communicate some information concerning which phase shift Bob used so that Alice can determine which measurements need to be throwaway. This is always done after the photons have been sent to Bob and measured.

As can be seen in figure 3, the bit rate i.e. the number of photons which Bob has to measure in order to determine a key when non-orthogonal sifting is used is twice has high as that for when orthogonal sifting is used. This is because using non-orthogonal sifting, Bob onl.y has a 50% chance of a photon registering at the correct detector even if he uses a phase shift which is approved by Alice. However, the use of sifting with non-orthogonal basis is far more resistant to attack using the so-called photon number splitting attack.

In quantum communication systems, photon pulses are often generated by attenuating pulses from a conventional pulsed laser. There exists a security risk in quantum communication systems using attenuated laser pulses as the carriers for the quantum information since multiphoton pulses (i.e. pulses which contain more than one photon) are inevitably produced even by very strongly attenuated lasers. The distribution in the number of photons per pulse for an attenuated laser with average of t photons per pulse obeys Poissonian statistics: P(n).te"/n!, where P(n) represents probability of a pulse containing n photons. There is a finite probability of a pulse containing more than one photon. Eve can launch a pulse-number splitting attack upon these multiphoton pulses. For each multiphoton pulse, she splits one photon from the pulse and stores it, and passes the remainder of the pulse to Bob.

She can measure precisely the stored photon in the case of using the orthogonal sifting scheme after Bob gives information about the phase shift he used. In this way, she gains the full information of the state encoded upon the multiphoton pulse without causing errors in Alice and Bob's shared key. Generally, the photon-number splitting attack either completely destroys the security of a quantum key distribution system or strongly reduces its maximum bit rate or range.

However, although measurement of the error rate cannot be used to show the presence of the photon number splitting attack, measurement of the channel transmission characteristics can show the presence of a photon number splitting attack. One method of achieving this is to first communicate how many pulses are being received by Bob.

However, a reduced number of pulses although indicative of a photon number splitting attack may also be due to a poor transmission environment. To distinguish between a poor transmission environment and a photon number splitting attack, the pulses are divided into at least two groups: the first group has a first average intensity, the second group has a second average intensity, further groups will have different average intensities. Average intensity of the signal pulses is measured from the average number of photons per pulse, averaged over a very large number of signal pulses in the same group. Signal pulses of different intensity groups are randomly located.

Preferably Alice and Bob estimate the fraction of Bob's measurements resulting from multi-photon pulses using two sets of pulses whose average intensities are of the same order. The average intensity (l.t') of the second group of signal pulses is comparable to, but different from, thefirst group(.t). These pulses obey Poissonian photon number distributions: P"(n) = p"e" In! for the first group with average photon number of.i per pulse, and P" (n) = au" e" / n! for the second with average photon of jf per pulse. P(n) represents the probability of a pulse containing n photons within a certain group of pulses.

When Eve applies the photon number splitting attack to the multiphoton pulses, she has to treat pulses from different intensity groups equally because she is not able to distinguish between them. By attacking the multiphoton pulses indiscriminately, she will cause a difference in transmission between the different groups because the two different groups have different average intensities and thus different proportions of pulses containing more than one photons. By analysing the transmissions carefully, the upper bound on the fraction of multiphoton pulses that contribute to Bob's measurements can be estimated. With knowledge of this bound, Alice first evaluates which sifting scheme to be used in order to achieve maximal secure bit rate, and then Alice and Bob sift keys according to Alice's evaluation. Then, privacy amplification is used to remove any information which may be obtained by Eve.

If Eve uses the photon number splitting attack and knows the measurement bases used by Bob and if she knows that Bob is using non-orthogonal sifting, she still may not have full knowledge of the key because she only has a 50% chance of obtaining the correct measurement for some of the bits. Therefore, although non-orthogonal sifting has a much lower bit rate, it is more secure.

Apart from the photon-number splitting attack, Eve could also attack a single photon pulse to gain information, for example, by intercepting a single pulse, measuring the pulse and resending the pulse. These attacks will cause a quantum state error because they inevitably perturb the quantum channel. By comparing a small fraction of quantum key, Alice and Bob can find out whether or not there exists eavesdropping activities.

However, imperfections in the apparatus also contribute to quantum state errors, for example, mis-alignment of optical apparatus and detector dark counts. It is impossible to discriminate between errors caused by imperfections in the apparatus and those from Eve, therefore, it is always assumed that all errors are caused by Eve for the sake of security.

Alice and Bob may perform error correction and perform privacy amplification to establish a secure key after a quantum key transmission. Error correction corrects all discrepancies between Alice and Bob's copies of keys, and privacy amplification allows them to share a shorter secure key by compressing the initially shared long key in order to eradicate any information which may be known to Eve.

When Alice and Bob use orthogonal sifting schemes, the formula which can be used for privacy amplification is: G!P 1-Log2 1+4e1 -41e1 2 P P-S2 L P-S2) f(e1)[e1 log2e1 +(l-e1)log2(1-e1)}} Where G is the secure bit gain per photon detected, P is the photon detection rate at Bob, S24. is the probability of multiphoton pulse (n =2) emitted by Alice, e1 is the quantum bit error rate,f(e) (f>1) is the inefficiency for error correction. This formula can be found in C. Gobby et al, Electronics Letters 40(25), 1603-1605(2004).

When Alice and Bob use a non-orthogonal sifting scheme, the formula which can be used for privacy amplification is: G=!P P 0.5S3 1-Log2 1+4e1 -4Ie1 4 P P-S3 P-S3+) + f(e1)[e1 log2 e1 + (i -e1)log2 (i -e1)]} where S3+ is the probability of the photon pulses emitted by Alice containing three or more photons.

Figure 4 is a calculated two-dimensional plot of the optimal sifting schemes as a function of average photon flux and quantum state error rate for the four-state protocol.

Security analysis, as described later in the text, gives the optimal sifting scheme which gives the highest possible secure bit gain and hence the secure bit rate. The calculation is based upon a fibre transmission loss of 6 dB, and the receiver's photon detection efficiency of 10%.

It should be noted that the quantum state error rate is not exactly the quantum bit error rate. The quantum state error rate is defined as QSER= W+R Where W is the number of measurements that disagree with what Alice has prepared, and R is the number of measurements that agree. The definition is the same as quantum bit error rate for the orthogonal sifting. However, the quantum bit error rate will be twice as high as the quantum state error rate for non-orthogonal sifting, due to the fact that only half of agreeing states contribute to the final key because of its probabilistic sifting nature.

As shown in Figure 4, there exists a boundary for both the photon flux and the quantum state error rate, beyond which no secure transmission is possible. The photon flux boundary is due to Eve's attack to multiphoton pulses, while the quantum state error rate boundary is due to Eve's attacks other than to multiphoton pulses.

Note in Figure 4 that for low quantum state error rate, orthogonal key sifting gives highest secure bit rate when the average photon flux is low. This is because multi-photon pulse probability is rare, and efficiency of orthogonal sifting is twice as high as that of non-orthogonal sifting. When the photon flux is high, it is better to use non-orthogonal sifting, as it is more immune to the pulse number splitting attack.

Regardless of whether Alice and Bob decide to use an orthogonal sifting set or a non-orthogonal set or even a combination of the two, Alice still has to send photons and apply a phase shift of 0 , 900, 180 or 270 . Similarly, regardless of the scheme, Bob has to apply a phase shift 0 (or 180 ) or 90 (or 270 ). Therefore, Alice and Bob do not need to determine the sifting scheme prior to transmission. They can determine the sifting scheme after transmission or during transmission. Without knowledge of the sifting scheme, it is more complicated for an eavesdropper to establish the key. Further, as Alice and Bob can make some analysis about the secure security of the transmission e.g. by performing a channel transmission analysis or measuring the error rate, they can determine the best and optimum protocol for the particular transmission conditions.

Figure 5 is a flow diagram illustrating a method in accordance with an embodiment of the present invention. In step SI, Alice and Bob agree which protocols they may use.

For example, Alice and Bob may decide to use two protocols, one using the bit assignment of figure 2A and the other using the bit assignment of figure 2B.

In step S3, Alice sends photons to Bob prepared with one of four quantum states. In this embodiment, these states are 00, 90 , 1800 and 270 . Alice may send all photon pulses with the same intensity or she may vary the intensity of the pulses in order to try a more sophisticated method of detecting the presence of a photon splitting attack.

Bob receives the photons in step S5 and informs Alice of the arrival times of the photons. This allows Alice to determine the channel transmission characteristics.

In step S7, Alice determines the channel transmission from the arrival time and determines which protocol to use. On the basis of the results shown in figure 4, it can be seen that if there is a more than 50% chance that the photons have been received by Bob, then it is desirable to use a non-orthogonal protocol.

Alice and Bob then sift the results S9 (as explained with reference to figure 3) on the basis of the protocol determined by the channel transmission analysis.

In the above embodiment, it has been explained that Alice determines the channel transmission characteristics. However, this could also be performed by Bob. In this situation, Alice would advise Bob when she sent photons and Bob could then determine the channel transmission characteristics. If Alice has varied the intensity of the photon pulses, then it is advisable for Alice to perform the analysis as Alice would also need to provide this information to Bob as well as advising him when the pulses were sent. In either case, Bob only ever needs to inform Alice of when he received the photon pulses as Bob has no means for determining the intensity of the pulses.

Also, if Bob does perform the channel transmission analysis, then Bob should determine which protocol can be used. It should be noted that the channel transmission characteristics can vary during the course of the transmission. Therefore, this analysis can be performed during the transmission and the protocol adapted accordingly.

The protocol may also be changed mid-way through transmission if the channel transmission characteristics change during transmission.

A further method in accordance with an embodiment of the present invention is discussed with reference to figure 6. In step Si 1, Alice and Bob agree which protocols they may use for communication. Again, in this particular embodiment, we used the protocol schematically demonstrated in figure 2A and in figure 2B. Alice then sends photons to Bob prepared with one of four quantum states. Bob measures the photons in the maimer previously described in step Si 5 and then Alice and Bob compare Bob's results with what Alice sent to determine the error rate SI 7.

Alice and Bob may agree on a test protocol to determine part of the key or Bob may simply tell Alice exactly what he measured or Alice may advise Bob exactly what she sent in order to compare part of the key. This part of the key will then be thrown away as it is purely used for determining the error rate and will not form part of secure transmission. Once the error rate is determined, whether it is advisable to use a non-orthogonal sifting scheme or an orthogonal sifting scheme can be determined. Also, if the error rate is too high, it may be decided that it is not a secure environment to transmit quantum signal and a different channel may be sought.

Alice and Bob then sift results on the basis of the protocol determined by the error rate in S19. How this sifting is performed is described with reference to figure 3.

Figure 7 shows a flow diagram of a method in accordance with an embodiment of the present invention using both error rate analysis and channel transmission analysis in order to determine the optimum protocol.

As explained with reference to Figures 5 and 6, first Alice and Bob agree which potential protocols they may use in step S3 I. Alice then sends photons to Bob prepared with one of four quantum states in step S33.

As before, Bob receives the photons and informs Alice of the arrival times of the photons in step S35. This step is performed in order for Alice to be able to establish channel transmission characteristics. These characteristics may be established simply on the basis of sending single photons on a more sophisticated method using photon pulses of different intensities. Photon pulses of different intensities are more likely to show the presence of an eavesdropper as opposed to just poor channel transmission characteristics.

Bob measures the received photons in step S37. He measures the photons as described with reference to Figures 1 and 3.

Alice and Bob then compare Bob's results with what Alice sent to determine an error rate step S39. Alice and Bob just compare a small sacrificial part of the measurement results. This part of the measurement results is not used for anything other than determining the error rate as it is communicated over a classical channel.

Alice also determines the channel transmission characteristics from the arrival time of Bob's photons in step S41. Step S41 may be performed at any time after Bob gives this information to Alice in step S35. Also, step S41 may be repeated a number of times throughout the transmission procedure in order to continually monitor channel transmission characteristics. Similarly, the error analysis of step S39 may be performed more than once.

When steps S39 and S41 are completed, Alice and Bob sift results on the basis of the protocol determined by error rate and channel transmission analysis in step S43. They can use the results shown in Figure 4 in order to determine the optimum protocol.

In step S45, Alice and Bob perform privacy amplification as described with reference to Figure 6.

The above description has concentrated on the use of four state protocols. However, it is also possible to use six or more state protocols. A six state orthogonal protocol is described in GB 2368502. Figure 8A schematically illustrates the possible states of orthogonal type six state protocol whereas Figure 8B schematically illustrates possible states of a non-orthogonal type protocol.

How these states may be sifted is described with reference to Figure 9.

It will be understood that the invention has been described above purely by way of example, and modifications of detail can be made within the scope of the invention.

Each feature disclosed in the description and (where appropriate) the claims and drawings may be provided independently or in any appropriate combination.

Claims

CLAIMS: 1. A quantum communication method comprising: transmitting

light pulses which have been prepared with one of at least four quantum states to a receiver; performing a security analysis to determine the security of the transmission; and selecting from at least two pre-agreed quantum communication protocols which protocol should be used to determine information from said light pulses on the basis of said security analysis.

2. A quantum communication method according to claim 1, wherein performing said security analysis comprises performing a channel transmission analysis.

3. A quantum communication method according to claim 1, wherein performing said security analysis comprises measuring the light pulses at the receiver; and performing an error analysis to determine what percentage of light pulses have been correctly measured by the receiver.

4. A quantum communication method according to claim 1, wherein performing said security analysis comprises measuring the light pulses at the receiver; performing an error analysis to determine what percentage of light pulses have been correctly measured by the receiver; and performing a channel transmission analysis.

5. A communication method according to either of claims 2 or 4, wherein transmitting light pulses comprises transmitting light pulses of two or more different intensities.

6. A communication method according to claim 5, wherein said channel transmission analysis comprises comparing the rate of pulses received having a first intensity with those received having a second intensity.

7. A quantum communication method according to claim 5, wherein said security analysis is used to determine that pulses with different intensities are used with different protocols.

8. A quantum communication method according to any preceding claim, wherein said quantum communication protocol is selected from a protocol which uses sifting with orthogonal basis and a protocol which uses sifting with non-orthogonal basis.

9. A quantum communication method according to either of claims 3 or 4, further comprising performing privacy amplification based on the results of said error analysis.

10. A quantum communication method according to any preceding claim, wherein said light pulses are prepared using six or more quantum states.

11. A quantum communication method according to any preceding claim, wherein said security analysis is performed during transmission of a quantum key.

12. A quantum communication method according to any preceding claim, wherein said at least four quantum states are phase states.

13. A quantum communication method according to any of claims 1 to 11, wherein said at least four quantum states are polarisation states.

14. A quantum communication system comprising: a sending unit configured to transmit light pulses which have been prepared with one of at least four quantum states to a receiving unit; a receiving unit configured to collect data to allow a security analysis to determine the security of the transmission; and a processor configured to perform the security analysis of the transmission and to select from at least two pre-agreed quantum communication protocols which protocol should be used to determine information from said light pulses on the basis of said analysis.

15. A quantum communication system according to claim 14, wherein said sending unit comprises means to transmit light pulses of two or more different intensities.

16. A quantum communication system according to claim 15, wherein the processor is configured to compare the rate of pulses received having a first intensity with those received having a second intensity.

17. A quantum communication system according to any of claims 14 to 16, wherein said processor is configured to perform said security analysis while said receiving unit is collecting data.

18. A quantum communication method or system substantially as described herein with reference to the accompanying drawings.