GB2457238A - Random number generator and random number generating method - Google Patents

Abstract

A random number generator comprising a source of weak light, a detector configured to detect said light as photon detection events and assign said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than 1, the generator further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin. Means to determine a bit value may assign consecutive time bins into groups of n bins and determine the bit value depending on which bin indicates that a photon detection event has occurred, where n is an integer of 2 or more. Means to determine may also assign a bit value only if just one photon detection event has occurred amongst the n bins and may comprise means to discard photon detection events in consecutive bins, to this end a comparing means may compare the output of the detector with a copy of the output of the detector which has been shifted by one time bin. The detector may comprise and avalanche photodiode with a means to isolate the avalanche signal from the output of the avalanche photodiode, for example by applying a signal which compensates for the response of the photodiode in the absence of illumination. A circuit for a random number generator is also disclosed.

Description

A Random Number Generator and Random Number Generating Method The present invention relates to the field of random number generators and random number generating methods.

Random number generators (RNGs) are important for many branches of science and technology. Their applications range from medicine to testing fundamental principles of physics. Fast and easily obtainable random numbers can be generated from a simple computer algorithm. However, such a RNG is termed a "pseudo" RNG as the random numbers are based on a deterministic pattern that will eventually repeat itself An RNG based on physical knowledge or some other classical chaotic process improves upon the pseudo RNGs in terms of unpredictability. However, the rate of a physical RNG is usually much slower than that of a pseudo RNG.

Recently, there has been work at producing RNGs based on single photon detection.

RNGs based on single photon detection are inherently quantum mechanical and therefore have the potential to be the best type of RNG technology. One example of this work is to be found in US 2006/0288062 which uses a single photon source outputting photons to a 50/50 optical coupler. The optical coupler will direct photons either randomly either down a first arm or a second arm. A single photon detector is provided at the output of each arm and a bit value is determined by measuring which of the detectors fired. Unfortunately, this system is hampered by the ability to produce perfect 50/50 optical couplers and the inability to produce photon detectors with identical efficiencies.

Stipevió et al "Quantum Random Number Generator" Rev. Sci. Instr. 78 045 04 (2007) relates to a random number generator which is based on temporal uncertainty of photons outputted by a photon source. A single detector measures time intervals between detection events. If the time between the first event and the second detection event is larger than the time between the second detection event and the third detection event one bit value is assigned and if the time between the first and second detection events is smaller than the time between the second and third detection events then a different bit value is assigned.

Ma et al "Random number generation based on the time of arrival of single photons" describes a system where a random number is generated by determining whether a photon is received in a first time window from 0 to I ps or a second time window from I s to 2iis. The source of photons is an attenuated pulsed source where the pulse length 1 OOns is considerably shorter than the time windows used by the detector to determine a number from the received signal.

In all of the above systems, post processing of the raw bits was needed in order to produce random bits of a high enough quality.

The present invention seeks to at least partially address the above problems and produces a high frequency random number generator where the randomness of the output is of a sufficient quality which does not require post processing.

Therefore, in a first aspect, the present invention provides a random number generator comprising a source of weak light, a detector configured to detect said light as photon detection events and assign said photon detection events to time bins, wherein the weak light is of an intensity where the average probability of the detector registering a photon event in a time bin is less than 1, the generator further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.

In a preferred configuration, means to determine a bit value is configured to assign consecutive time bins into groups of n bins and determine said bit value depending on which bin indicates that a photon detection event has occurred, wherein n is an integer of 2 or more.

When a measure is made by the detector the wavefunction of the photon collapses so that a photon detection event occurs in one of the time bins. Generally, the coherence time will be much longer than one time bin. Preferably, the coherence time of the source extends over two or more time bins. More preferably, the coherence time of the source extends over n bins within a group of n bins.

A filter may be used to extend the coherence time of the photons so that it is longer than at least one time bin. An incoherent source may be used with a filter in order to satisfy the coherence time requirements.

The detector may be gated and the time bins assigned to the gating signal or the detector may detect photons continuously and the output of said detector is divided into time bins.

Further, the generator is preferably configured to determine a bit value only assigns a bit value if just one photon detection event has occurred in a group of bins.

Also, the generator may comprise means to discard a result derived from photon detection events in consecutive bins, even if the bins extend over more than one group.

One particularly useful way of achieving this is to compare the output of the detector with a copy of the output of the detector which has been shifted by one time bin. For example, the shifted copy of the output of the detector may be subtracted from the detector signal.

The detector may be an avalanche photodiode (APD). More preferably, the detector comprises means to isolate the avalanche signal from the output of the avalanche photodiode. This may be achieved by applying a signal which compensates for the response of said photodiode in the absence of illumination.

In a preferred embodiment, the means to isolate the signal comprises a signal divider to divide the output signal of the photodiode into a first part and a second part, where the first part is substantially identical to the second part, delay means for delaying the second part with respect to the first part and a combiner for combining the first and delayed second parts of the signal such that the delayed second part is used to cancel periodic variations in the first part of the output signal. This arrangement can also be used to prevent generating a number from photon detection events in consecutive bins.

The above seif-differencing APD allows faster operation of an APD over those achieved with conventional APDs. However, the seif-differencing system itself provides a theoretical limit on the operational speed of the RNG. To address this issue the system may comprise a plurality of detectors each configured to detect said light and assign said photon detection events to time bins, the system further comprising a signal divider configured to direct light from said source to any one of said detectors. For example, the signal divider may be a 1/n signal divider which can direct a received signal to one of n detectors randomly.

Preferably the source is a continuous source.

In a second aspect, the present invention provides a circuit for a random number generator, the circuit comprising means to receive the output of a photon detector and assign photon detection events indicated in the output of the detector to time bins, the circuit further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred.

In a third aspect, the present invention provides a method of generating random numbers, the method comprising: emitting a light signal from a weak light source; detecting said light as photon detection events; and assigning said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than 1, the method further comprising determining a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.

The present invention will now be described with reference to the following preferred non-limiting embodiments in which: Figure 1 is a random number generating system in accordance with the prior art; Figure 2a is a random number generating system in accordance with an embodiment of the present invention and figure 2b schematically illustrates the output from the system of figure 2a and indicates how the system of figure 2a generates random numbers; Figure 3a is a random number generating system in accordance with an embodiment of the present invention and figure 3b schematically illustrates the output from the system of figure 3a and how bit values are derived from this output using a variation on the method described with reference to figure 2b; Figure 4a is a schematic of a detection system comprising an avalanche photodiode for use in the random number generator in accordance with an embodiment of the present invention, figure 4b is a plot of the input signal to the device of figure 4a, figure 4c is a plot of a first part derived from the output signal of the APD of figure 4a, figure 4d is a plot of the second part derived from the output signal of the APD of figure 4a which has been delayed and figure 4e is a plot of the seif-differenced output signal produced by the device of figure 4a; Figure 5 is a plot of a histogram of the pulses received against time for the system of figure 2; Figure 6a is a histogram showing the NIST test from the system of figure 2, figure 6b shows the confidence range of the test results of figure 6a; Figure 7 shows the results of "diehard tests" of the system of figure 2; Figure 8 is a plot of the expected random bit generation rate against a product of the photon flux and detector efficiency for a detector running at I GHz; Figure 9 is a schematic of a system in accordance with a further embodiment of the present invention where output is increased using multiplexing; Figure 10 is a variation on the detector of figure 4a; Figure II a is a schematic of a further variation on the detection system of figure 4a and figure 11 b is a plot of the input signal to the detection system of figure 11 a; Figure 12 is a schematic of a detection system which is a variation of the detection system of figure 4a for use in the random number generator in accordance with an embodiment of the present invention; Figure 13 is a detection system incorporating an avalanche photodiode and a capacitor for use in the random number generator in accordance with an embodiment of the present invention; Figure 14 is a schematic of a detection system comprising two APDs arranged to cancel one another for use in the random number generator in accordance with an embodiment of the present invention; and Figure 15 is a schematic of a free running detector with post gating.

Figure 1 is a schematic of a prior art random number generator. The prior art system comprises a photon source 101 which is typically a laser or the like.

The output is then directed into a spectral filter 103 which serves to filter out any

unwanted background radiation.

The output of the spectral filter 103 is then directed into attenuator 105. Attenuator 105 serves to convert the pulsed output from the photon source into pulses which on average have a probability containing less than one photon. As it is not possible to divide a photon, this typically means that most of non-empty pulses contains one photon.

The output of the attenuator 105 is then directed into 50/50 non-polarising beamsplitter 107. Non-polarising beamsplitter 107 randomly directs photons either to first single photon detector 109 or second single photon detector 111. Such random reflection and transmission provides a source of randomness.

Although the above system can generate random binary numbers, the degree of randomness is impacted by two factors. There will be an imbalance in the photon detection efficiency of the two detectors 109, 111 and it is difficult to ensure that the 50/50 beamsplitter 107 has exactly a 50:50 transmission reflection probability. The first problem may be circumvented by using one detector. However, the second problem is very hard to solve. In addition, there may be the effect of the bit correlation of the bit sequence due to detector dead time. A different detector is more likely to fire after one detector fires. Therefore, to resolve these issues, computation-intensive processing is required to process the raw data in order to eliminate any bias between the two detectors, resulting in a reduced random bit rate.

Figure 2a is a schematic of a random number generator in accordance with an embodiment of the present invention. The generator comprises a coherent laser I which in this case is a CW laser diode, emitting photons at a wavelength of 1.55 microns. The laser source 1 is fed into attenuator 5. Attenuator 5 is configured to attenuate the output of laser 1 so that it will not saturate the detector 7, as described below. Typically, the attenuated laser power is a few tens of pico-Watts.

The output of attenuator 5 is fed into photon detector 7. Photon detector 7 is a single photon detector. The single photon detector is gated so that it can only detect photons when the gate switches the detector to be active. The detector gates are shown in the upper trace of figure 2b. In figure 2b, the detector gating waveform is shown to be square, but it may have a different profile. The laser 1 is attenuated by attenuator 5 such that the photon detection probability for each gate is much less than unity.

The output of the generator of figure 2a is described with reference to figure 2b. The upper trace in figure 2b shows the detector gates. The detector gates are grouped into twos as shown by the dotted line. The coherence time of the laser 1 of figure 2a is much longer than a single detector gate as can be seen from the photon wave function of figure 2b. The detection probability of each gate within a bit group is identical because the wave function of each photon spreads over a number of detector gates and the emission time of each photon is totally random. The detection occurs when the photon wavefunction collapses onto one of the clock gates, which is a quantum mechanical probabilistic process.

The lower trace of figure 2b shows the results obtained from the generator of figure 2a.

In the first group I where there are two time bins, a count is registered in a first (i) of the time bins but not in the second of the time bins (ii). When a photon is received in a first time bin (i) but not in a second (ii), this, in the current embodiment, corresponds to a bit value of 0.

In the next group, the second group II shown in figure 2b, no photon is received in either of the first time bin (i) or the second time bin (ii). Therefore, no bit value is assigned to this group II. In the third group III, only a photon is received in the second time bin (ii). In this embodiment, this corresponds to a bit value of 1. In the fourth group IV, no photon is received and this again does not give rise to a bit value. In the fifth group V. two photons are received and this again is not a valid result and is ignored. In the sixth group VI, no photon is received and again a bit value cannot be assigned. In the seventh VII and eighth VIII groups, photons are received in the first bin and therefore both groups are allocated a bit value of 0.

The system which has been described with reference to figure 2 is automatically balanced because it uses the same equipment to determine whether a bit 1 or a bit 0 is registered.

There are various alternative ways grouping time bins. For example, each consecutive four time bins form one group. If one photon detection event was registered for the group, then multiple bits could be extracted for the single group since the following combinations of detection events would be possible [Pxxx] or [xPxx] or [xxPx] or [xxxPj where P indicates a photon detection event and x indicates no photon detection event.

The coherence time should be longer than the group of bins.

The coherence source 1 can also be replaced with a combination of a non-coherent source, such as a light emitting diode, and a suitably narrow bandpass filter. Such a bandpass filter should be configured to increase the coherence of the incoherent source such that the coherence time extends over more than one bin or gating period of the detector.

A narrow bandpass filter may also be used with a coherent source in order to increase the coherence time. For example, it could be used for a source which has a coherence time which is shorten than a time bin to increase the coherence time to be much longer than a time bin.

Figure 3 shows a variation on the system of figure 2. In figure 3a, the apparatus is largely identical to that described with figure 2a. Therefore, to avoid any unnecessary repetition, like reference will be used to denote like features.

Again as shown in figure 3b, the detector is gated so that the output is assigned to time bins which are grouped into twos. The photon wave function shown at the top of figure 3b is seen to extend over a number of groups of time bins. The initial detector output leads to the same trace as explained in relation to figure 2b. In figure 3, this is shown as trace figure u. Trace u is then shifted forward by one period to form trace v. Trace v is then subtracted from trace u to give an updated sequence trace w. This means that only the first detection is kept for any successive photon detections. Thus, looking at group V, it can be seen that in trace w, only the first bin is kept given a bit value of 0.

Effectively, the subtraction described above discards all photon detection events if there is photon event occurring in its previous time bin regardless of whether the previous time bin is in the same group or a preceding group. Therefore, the operation of subtraction can be replaced by discarding those photon events whose preceding time bin also registers a photon event.

For example, if photon detection in two consecutive groups gives the result [x P}{P xl where x indicates no photon detection, P indicates photon detection and [. .] indicates a group), the bit assignment is 1 for the method of figure 3. Over the method shown in Figure 2, Figure 3 method has less bit correlation. For example, for a consecutive four photon detection events, there are two possibilities: [xP][PP][Px} or [PP][PP], Figure 2 method gives a result of (1,0) for the first possibility and no bits can be extracted from second possibility. This causes a higher probability of having result (1,0). While the Figure 3 method gives only one bit (0) for the first possibility and bit (1) for the second possibility. In Figure 2, two bits are always (10) for successive detection events if two bits can be extracted from successive photon detection events. The system of figure 3 addresses this issue.

Further, the system of figure 3 can be physically realised by the self-differencing circuit which is explained with reference to figure 4.

To summarise, the procedure of figure 3 ensures that any group of time bins will consist of only one photon detection event. Second, it helps remove bit correlation caused by consecutive photon detection events. Third, there exists high-speed single photon detector with above operation functionality built-in, as described below.

In a preferred embodiment, the present invention uses an APD operating in Geiger mode. In order to achieve higher operation frequencies, the APD is used in a self differencing arrangement as shown in figure 4.

Figure 4a illustrates a circuit,for high frequency photon detection with an APD. The detector can be used in the RNG of figures 2 or 3 in accordance with an embodiment of the present invention.

A square wave input signal 4b may be applied. The input signal needs to be large enough to bias the APD above its breakdown voltage. In this particular example, the bias is set so that the avalanche peak is smaller than the charging peak.

The circuit of figure 4a shows an APD which can be operated at a higher frequency and thus one where it is possible to reverse bias the device for a very short time.

As before, the device comprises an avalanche photodiode provided in series with a resistor 53. The voltage dropped across the resistor 53 is first input to power splitter 55.

Power splitter 55 divides the output signal into a first part as shown in figure 4c and a second part which is identical to the first part shown in figure 4c. These two signals are then output via ports 57 and 59 of power splitter 55. The signal which is output via port 59 enters a delay line 56 which serves to delay the signal by a duration equal exactly one gating period. The delayed signal is shown in figure 4d. The first part of the signal and the delayed second part are then fed into hybrid junction 61. Hybrid junction 61 combines the first and the delayed second parts of the signals with 1800 phase shift to give the output shown in figure 4e, which is effectively the differential signal between figure 4c and figure 4d. A dip 75 are seen in the trace of figure 4e which indicates the presence of a photon. The provision of a positive peak followed by a negative dip (or a negative dip followed by a positive peak dependent on the configuration of the equipment) allows a clear signature indicating the detection of a photon.

The circuit in Figure 4a, performing the above described seif-differencing, allows the large capacitive response of the APD to be subtracted and the weak avalanche signal to be observed. This allows the detector to be run at very high frequencies.

The power splitter 55 may be of the type which is sold under part number ZFRSC-42+ from Mini-circuits and the hybrid junction is also available under part number ZFSCJ- 2-4 which is also available from Mini-circuits. The exact delay can be realised by using two co-axial cables with two different lengths that link the power splitter and the hybrid junction. It should be noted that the combination of the power splitter 55, the delay line 56 and the hybrid junction 61 may be integrated onto a single printed circuit board.

Typically, the gate frequency could be 1 0Hz and the gate width 0.5 ns. The lower voltage level might be 4.6V below breakdown and the higher level 2V above the breakdown voltage. The breakdown voltage might typically be 47V for an InGaAs APD.

The above can also be used with Si-APDs, which are efficient for visible light photon detection, can also be operated in high speed gated mode with the above mentioned self-differencing circuit.

To test the random number generator, a system was built using the above detector and a coherent CW laser diode with an output wavelength of 1550 nm which was attenuated to the single photon level. The detector was held at a temperature of approximately -30°. A GI-Iz square wave bias pulse train of approximately 7 volts amplitude was superimposed on a DC bias of 45.9 volts as the gating signal for the detector. In this arrangement, the dark count rate was approximately 1000 Hz. The remaining signal was amplified before being sent into time tagging single photon counting electronics which was capable of time recording single photon counting of up to 5MHz.

Figure 5 shows a histogram of the counts recorded for a detector with a clock frequency of 1.03 0Hz and a photon incident flux of approximately 20 pW. Figure 5 shows that the recorded counts are well separated from each other in time by approximately 600 picoseconds. This shows good performance for a random number generator. Any overlap between adjacent clock counts could lead to unwanted correlations in the final random bit output. The very small sharp width of approximately 60 picoseconds of the clock counter events is due to the gated detection.

Time tag counter events were recorded for a duration of approximately 2 minutes with a CW photon flux of approximately 20 pW at a clock frequency of 1.03 0Hz. The photon flux corresponded to approximately 0.3 photons per clock period. The time tagged events acquired were converted into random bits by assigning detection events in even clock cycles as a 1 and detection events occurring in odd clock cycles as a 0 as shown in figure 2.

It is important to note that no post-processing needs to be carried out in the resulting bits to improve randomness.

Next, the randomness of the generator was investigated using known techniques where a p-value was calculated. A p-value is defined as the probability of observing a test statistic which is at least as extreme as the value actually observed. For example, the NIST statistical test suite (http://csrc.n i st. gov/groups/STftoolkitimg/index.html) has a test called the frequency or monobits test. This tests the difference of l's and 0's in a particular bit stream. For a perfect random number generator, the distribution of ratio's of l's and 0's it could generate is Gaussian spread with a mean value of 0 difference. The difference of l's and 0's of the experimental data is calculated and compared with the perfect random number distribution. The p-value is then the sum of the probabilities the perfect random number generator could produce the experimental data difference of l's and 0's and all the more extreme distributions.

A significance level a is also assigned for a test. Typically, for cryptographic applications, a significance level of a = 0.01 is chosen for NIST (National Institute of Standards & Technology) tests. This means that if the p-value is greater than 0.01, the bit stream produced by the detector passes the test.

Figure 6a shows the results from the NIST tests where a p-value is calculated for 16 tests from a battery of tests. These tests are well-known to those within the art, therefore, a detailed description of each test will not be given here. However, the tests are designed to look for randomness within certain events. The tests shown here are the frequency (mono-bits) test, frequency within a block test, random binary matrix ranked tests, tests for the longest run of ones in a block, discreet Fourier transform (spectral) test, non-overlapping (a periodic) template matching test, overlapping (periodic) template matching test, Maurer' s Universal Statistical test, Lempel-Ziv complexity test, linear complexity test, serial test, approximate entropy test, cumulative sum (CUSUM) test, random excursions test and random excursions variant test.

For example, the frequency test assessed the number of ones and zeros in a sequence as these should be about the same for a truly random sequence.

The results shown in figure 6a are from testing a 500x106 bit pattern from the system of figure 2. All tests passed at the a = 0.01 significance level.

Figure 6b shows the proportion of passes for each test. The proportions are nicely distributed around the expected value of 99%. The confidence range based on the finite number of the bit streams tested (500) is also shown. All tests are within the confidence range of 97.6 to 100% for the proportion of passes.

A second battery of tests known as the Diehard tests (0. Marsaglia, A. Zaman and W. W. Tsang, Stat. And Prob. Lett. 9 35(1990) and http://www.stat.fsu.edu/pub/diehard) was also performed. The Diehard test similar to the NIST tests, the 20 diehard tests used are as follows, the birthday spacing's test, the overlapping 5-permitation test, the binary ranked test 32 x 32, the binary ranked test 31 x 31, the binary ranked test 6 x 8, the bit stream test, the OPSO test (overlapping pairs sparse occupancy), the Oqso test (overlapping quadruple sparse occupancy), the DNA test, the count the ones test on a stream of bits, the count the ones test for specific bits, the parking lot test, the minimum distance test, the 3D spheres test, the squeeze test, the overlapping sums test, the runs test and three craps test.

In the Diehard test, the significance level is range from a = 0.01 to 0.99. Tests falling within this range are deemed to have passed the test. For the block with 5 x 108 bits, 20 tests were applicable. Figure 7a shows that all 20 tests were passed.

Figure 8 is a schematic of the raw count rate of the detector up to saturation at 1 GHz as a function of the photon flux (p.) and detection efficiency (i) product p.'r.

The solid line represents the photon count rate and the dotted line represents the random bit output rate. Average bit per time bin can be expressed as p(P) p(X) = p(P) (1 -p(P)), wherep(P) is the probability of photon detection at this particular time bin while p(X) is the probability of no photon detection at the following time bin. The random bit output rate peaked at 0.25 bit per time bin when p(P)= 0.5, which is 250 MHz with 1 GHz clock rate. Further increase the photon count rate/flux will cause a drop in random bit rate. The value of 250 tvLHz is therefore the theoretical limit of the system which is over two orders of magnitude higher than any bit rates of existing quantum random number generators. Note that when using self-differencing detector, both the photon count rate and the random bit rate follow the dashed line.

Figure 9 shows a system which can improve on the bit rate of the above described system using multiplexing.

The system comprises a coherent CW laser source 201 which is attenuated by an attenuator 203 to produce an attenuated signal. The output from the attenuator 203 is split into n beams by lxn beam splitter 205. Each output of beam splitter 205 is received by a detector 207, 2072 207. Each single photon detector 207 is used as a high speed random number generator similar as previously described in Figure 2. The bit output of all n detectors is then combined to form a random generator with a speed improvement by a factor of n.

The arrangement of figure 9 overcomes the 250MHz theoretical limit of the system previously described. Also, although a beam splitter is used, it does not suffer from the problems of the prior art since the beam splitter itself is not used to determine the random number only which detector should be used to generate a random number.

Figure 10 shows a variation on the detector described with reference to figure 4a. The device of figure 10 takes the output from an APD and resistor (not shown) and directs it into hybrid junction 81. Hybrid junction 81 splits the output into a first part and a second part is described with reference to the power splitter 55 of figure 3b. However, hybrid junction 81 also introduces a 180° phase shift between the first part and the second part of the signal. The first part of the signal is output via output 83 and the second part is sent via output 85 into delay line 87.

The systems of figures 4a and figure 10 have both used combinations of power splitters/combiners and hybrid junctions. However, the hybrid junction may be replaced by a combination of phase shifters and power combiners. For example, it could be replaced by the combination of a power combiner and a 180° phase shifter.

In a further variation on the systems of figure 4a, a tuneable RF attenuator is provided which may be used in either of the inputs to hybrid junction 61 (figure 4a) or power combiner 89 (figure 10) to ensure that the two signals reach the hybrid junction or power combiner with equal amplitudes.

Typically, all the hybrid junctions and power splitter/combiners have finite response frequency range. For example, hybrid junction, Mini-circuits ZFSCJ-2-4 has a frequency range of 50MHz to 1 0Hz. It may not work well when the signal contains frequency components outside of the range, and the cancellation may not be perfect. To improve the signal to background ratio, further bandpass filters may be used to filter out those frequency components. In Figure 4a, for example, a low bandpass filter may be placed after the hybrid junction output.

The output of the power combiner 89 is fed into measuring means 90 which is configured to determine the amplitude of the output of the power combiner in order to determine the number of photons which gave rise to the avalanche.

Figure 11 shows a further variation on the system described with reference to figures 4 and 10.

The system of figure 11 a has an avalanche photodiode 51 and a resistor 53 as described with reference to figure 1 lb. Further, the signal of the voltage dropped across the resistor 53 is taken to power splitter 55 which splits the signal into a first part and a second part. The first part being outputted via output 57 and the second part via output 59 into delay line 56. The first part of the signal and the delayed second part are then fed into hybrid junction 61 which combines the two parts of the signal with 180° phase difference.

However, in the apparatus of figure 11 a, the input voltage signal is a sinusoidal voltage signal as shown in figure 1 lb and not the periodic train of rectangular pulses as shown in figure 4b. It is possible to bias the detection system of figure 1 Ia with a sinusoidal signal as long as the signal has sufficient voltage swing to bias the APD above and below the threshold for avalanche breakdown. In fact, the detector may be biased with any periodic voltage signal.

In response to the sinusoidal gating voltages, the APD output is also sinusoidal.

Superimposed on the sinusoidal output are occasional avalanche spikes due to photon detection. The amplitude of avalanche spikes is typically much smaller than that of the sinusoidal output. However, as described previously with reference to Figure 4a, by using a power splitter, delay line, and hybrid junction, the sinusoidal components can be largely cancelled and the avalanche spikes become clearly visible.

Furthermore, any small remaining components of the sinusoidal signal may be removed from the output of the hybrid junction 61 by a band rejection filter 63 which is tuned to the frequency of the sinusoidal signal. The signal is passed to amplifier 65 and then into measuring means 67 in order to determine the amplitude of photon induced spikes in the outputted signal.

Figure 12 shows a further variation in the system of figure 4, the conliguration is the same as that described with reference to figure 4. The output signal is then fed into power splitter 101. Power splitter 101 divides the signal into a first part and a second part. The first part is output via output 103 and the second part via output 105 which is further fed into delay line 107. The two parts of the signal are then fed into the differential amplifier 109. Due to the configuration of amplifier 109, only the difference of the two inputs is amplified. The differenced signal is them passed to measuring means 110 which measures the amplitude of the signal to determine the number of photons which have given rise to the avalanche.

The detector of figure 4a uses a self differencing arrangement to achieve high frequency operation from an APD. However, it is also possible to use other techniques.

For example, consider the detector of figure 13. To avoid unnecessary repetition, like reference numerals will be used to denote like features with those of figure 1. Figure 13 again has an avalanche photodiode 1 and resistor 3. A capacitor 21 and further resistor 23 are formed in series with the avalanche photodiode I and resistor 3 such that resistors 3 and 23 are connected back to back.

From this circuit, the combined DC and pulsed bias for the APD varying between V0 and V1 is applied to the APD, while just the pulse signal (varying between V1 and Vo) is applied to the capacitor. The output signal from the capacitor 21 will be similar to the output signal from APD 1 in the absence of absorption of a photon. The output from the APD 1 and capacitor 21 are then combined in hybrid junction 25. 1-lybrid junction will reverse the phase of one of its two inputs. Therefore, the hybrid junction 25 combines the output signals from both the APD 1 and the capacitor 21 with a 1800 phase difference so that they nearly cancel. This allows the charging 9 and discharging 11 peaks to be partially cancelled.

The output of the hybrid junction 25 is fed into measuring means 26 which measures the height of peaks in the output to determine the number of photons which caused the avalanche signal.

Figure 14 illustrates a further improvement to the system of figure 13 where capacitor 21 is now replaced with a second APD 23.

To avoid unnecessary repetition, like reference numerals will be used to denote like features.

A second resistor 31 and a second APD 33 are provided in the same positions as second resistor 23 and capacitor 21 of figure 10. The output of the first APD 1 and second APD 33 are then combined at hybrid junction 35 with 180° phase difference in order for the components to cancel one another. The output of the hybrid junction is then fed into measuring means 37 which in turn measures the height of peaks in the output to determine the number of photons which caused the avalanche signal.

The above description has used gated detectors. However, it is possible to realise the system using a free-running (i.e. non-gated) detector and dividing the output of the detector into bins. Such a detection system is shown in figure 15. Free running detector 301 is not gated and outputs random detection events. Its output is divided into time bin by Fast Logic XOR 303. The XOR gate 303 receives a clocked input from clock source 305 which determines the size of the time bins.

Claims (18)

1. CLAIMS: 1. A random number generator comprising a source of weak light, a detector configured to detect said light as photon detection events and assign said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than 1, the generator further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.
2. 2 A random number generator according to claim 1, wherein said means to determine a bit value is configured to assign consecutive time bins into groups of n bins and determine said bit value depending on which bin indicates that a photon detection event has occurred, wherein n is an integer of 2 or more.
3. 3. A random number generator according to claim 2, wherein said means to determine a bit value only assigns a bit value ifjust one photon detection event has occurred in a group of bins.
4. 4. A random number generator according to any preceding claim, further comprising means to discard a result derived from photon detection events in consecutive bins.
5. 5. A random number generator according to claim 4, further comprising means to compare the output of the detector with a copy of the output of the detector which has been shifted by one time bin.
6. 6. A random number generator according to any preceding claim, wherein said detector comprises an avalanche photodiode.
7. 7. A random number generator according to claim 6, further comprising means to isolate the avalanche signal from the output of the avalanche photodiode.
8. 8. A random number generator according to claim 7, wherein said means to isolate the signal comprises means to apply signal which compensates for the response of said photodiode in the absence of illumination.
9. 9. A random number generator according to either of claims 7 or 8, wherein the means to isolate the signal comprises a signal divider to divide the output signal of the photodiode into a first part and a second part, where the first part is substantially identical to the second part, delay means for delaying the second part with respect to the first part and a combiner for combining the first and delayed second parts of the signal such that the delayed second part is used to cancel periodic variations in the first part of the output signal.
10. 10. A random number generator according to any preceding claim, comprising a plurality of detectors each configured to detect said light and assign said photon detection events to time bins, the system further comprising a signal divider configured to direct light from said source to any one of said detectors.
11. I I. A random number generator according to any preceding claim, wherein time bins are selected so that the coherence time of the source extends over two or more time bins.
12. 12. A random number generator according to claim 2, wherein time bins are selected so that the coherence time of the source extends over n bins within a group of n bins.
13. 13. A random number generator according to any preceding claim, wherein said source is an incoherent source.
14. 14. A random number generator according to any preceding claim, further comprising a filter configured to extend the coherence time of the source.
15. 15. A random number generator according to claim 1, wherein said detector detects photons continuously and the output of said detector is divided into time bins.
16. 16. A circuit for a random number generator, the circuit comprising means to receive the output of a photon detector and assign photon detection events indicated in the output of the detector to time bins, the circuit further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred.
17. 17. A circuit according to claim 16, further comprising a detector.
18. 18. A method of generating random numbers, the method comprising: emitting a light signal from a weak light source; detecting said light as photon detection events; and assigning said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than 1, the method further comprising determining a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.