GB2457328A

GB2457328A - Random number generation using photon detection events

Info

Publication number: GB2457328A
Application number: GB0821007A
Authority: GB
Inventors: Zhiliang Yuan; James Dynes; Mark Richard Stevenson; Andrew James Shields
Original assignee: Toshiba Research Europe Ltd
Current assignee: Toshiba Europe Ltd
Priority date: 2008-02-05
Filing date: 2008-11-17
Publication date: 2009-08-12
Anticipated expiration: 2028-11-17
Also published as: GB0821007D0; GB2457328B

Abstract

A quantum random number generator comprises a source of weak light (e.g. laser diode 1, attenuator 5), and detector 7 (e.g. a gated, single photon detector) and detects said light as photon detection events and assigns said photon detection events to time bins. The generator further determines at least a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred. The probability of the detector registering a photon event in a time bin is less than 1. The weak light is continuous or has a pulse length longer than a time bin. Detector 7 may be a self-differencing avalanche photodiode (APD), in Geiger mode, having splitter (55), delay line (56) and combiner (61), that prevents random number generation for photon detections in consecutive bins by comparing the detector output with the output shifted by one time bin. Random numbers may be generated by converting time stamps assigned to a photon arrivals into binary numbers.

Description

1 2457328 A Random Number Generator and Random Number Generating Method The present invention relates to the field of random number generators and random number generating methods.

Random number generators (RNGs) are important for many branches of science and technology. 1'heir applications range from medicine to testing fundamental principles of physics. Fast and easily obtainable random numbers can be generated from a simple computer algorithm. However, such a RNG is termed a "pseudo" RNG as the random numbers are based on a deterministic pattern that will eventually repeat itself.

An RNG based on physical knowledge or some other classical chaotic process improves upon the pseudo RNGs in terms of unpredictability. However, the rate of a physical RNG is usually much slower than that of a pseudo RNG.

Recently, there has been work at producing RNGs based on single photon detection.

RNGs based on single photon detection are inherently quantum mechanical and therefore have the potential to be the best type of RNG technology. One example of this work is to be found in US 2006/0288062 which uses a single photon source outputting photons to a 50/50 optical coupler. The optical coupler will direct photons either randomly either down a first arm or a second arm. A single photon detector is provided at the output of each arm and a bit value is determined by measuring which of the detectors fired. Unfortunately, this system is hampered by the ability to produce perfect 50/50 optical couplers and the inability to produce photon detectors with identical efficiencies.

Stipeviá et al "Quantum Random Number Generator" Rev. Sci. Instr. 78 045104 (2007) relates to a random number generator which is based on temporal uncertainty of photons outputted by a photon source. A single detector measures time intervals between detection events. If the time between the first event and the second detection event is larger than the time between the second detection event and the third detection event one bit value is assigned and if the time between the first and second detection events is smaller than the time between the second arid third detection events then a different bit value is assigned.

Ma et a! "Random number generation based on the time of arrival of single photons" describes a system where a random number is generated by determining whether a photon is received in a first time window from 0 to lizs or a second time window from 1ps to 2s. The source of photons is an attenuated pulsed source where the pulse length lOOns is considerably shorter than the time windows used by the detector to determine a number from the received signal.

In all of the above systems, post processing of the raw bits was needed in order to produce random bits of a high enough quality.

The present invention seeks to at least partially address the above problems and produces a high frequency random number generator where the randomness of the output is of a sufficient quality which does not require post processing.

Therefore, in a first aspect, the present invention provides a random number generator comprising a source of weak light, a detector configured to detect said light as photon detection events and assign said photon detection events to time bins, wherein the weak light is of an intensity where the average probability of the detector registering a photon event in a time bin is less than 1, the generator further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.

In a preferred configuration, means to determine a bit value is configured to assign consecutive time bins into groups of n bins and determine said bit value depending on which bin indicates that a photon detection event has occurred, wherein n is an integer of 2 or more.

When a measure is made by the detector the wavefunction of the photon collapses so that a photon detection event occurs in one of the time bins. Generally, the coherence time will be much longer than one time bin. Preferably, the coherence time of the source extends over two or more time bins. More preferably, the coherence time of the source extends over n bins within a group of n bins.

A filter may be used to extend the coherence time of the photons so that it is longer than at least one time bin. An incoherent source may be used with a filter in order to satisfy the coherence time requirements.

The detector may be gated and the time bins assigned to the gating signal or the detector may detect photons continuously and the output of said detector is divided into time bins.

Even if the detector is gated, multiple time bins may be incorporated into each gating period. Thus the time bins do not have to be synchronised with the detector.

Further, the generator is preferably configured to determine a bit value only assigns a bit value ifjust one photon detection event has occurred in a group of bins.

Also, the generator may comprise means to discard a result derived from photon detection events in consecutive bins, even if the bins extend over more than one group.

One particularly useful way of achieving this is to compare the output of the detector with a copy of the output of the detector which has been shifted by one time bin. For example, the shifted copy of the output of the detector may be subtracted from the detector signal.

The detector may be an avalanche photodiode (APD). More preferably, the detector compnses means to isolate the avalanche signal from the output of the avalanche photodiode. This may be achieved by applying a signal which compensates for the response of said photodiode in the absence of illumination.

In a preferred embodiment, the means to isolate the signal comprises a signal divider to divide the output signal of the photodiode into a first part and a second part, where the first part is substantially identical to the second part, delay means for delaying the second part with respect to the first part and a combiner for combining the first and delayed second parts of the signal such that the delayed second part is used to cancel periodic variations in the first part of the output signal. This arrangement can also be used to prevent generating a number from photon detection events in consecutive bins.

The above self-differencing APD allows faster operation of an APD over those achieved with conventional APDs. However, the self-differencing system itself provides a theoretical limit on the operational speed of the RNG. To address this issue the system may comprise a plurality of detectors each configured to detect said light and assign said photon detection events to time bins, the system further comprising a signal divider configured to direct light from said source to any one of said detectors. For example, the signal divider may be a 1/n signal divider which can direct a received signal to one of n detectors randomly.

Preferably the source is a continuous source.

Even if the source is pulsed, there is no need for the source to be synchronous with the detector. Obviously, if the source is a continuous source, then necessarily the source is not synchronised with the detector.

As the source is asynchronous with the detector then the photon arrival times at the detector are asynchronous with respect to the source. There is no need for any reset line, clock synchronization or any other phase relationship mechanism that relates the source to the detector.

As described above, the time bins may be synchronous or asynchronous with the detector gates. In asynchronous operation, there are multiple time bins per gate or the detector is free running as described above.

In one embodiment, the apparatus comprises a time stamping card configured to allocate a time stamp indicating an arrival time of a photon wherein said time stamping card is asynchronous with respect to the detector.

The time stamp allocated by said time stamping card may be directly converted to said bit value to allow extraction of said bit value from said time stamp. In general, a time stamp card will allocate a plurality of bits to each event which is time stamped. Thus, by using the actual bit value of the time stamp, it is possible to maximse the number of bits extracted from each photon arrival event and hence allow a greater range of random numbers to be extracted more efficiently.

In a second aspect, the present invention provides a circuit for a random number generator, the circuit comprising means to receive the output of a photon detector and assign photon detection events indicated in the output of the detector to time bins, the circuit further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred.

In a third aspect, the present invention provides a method of generating random numbers, the method comprising: emitting a light signal from a weak light source; detecting said light as photon detection events; and assigning said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than 1, the method further comprising determining a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.

The present invention will now be described with reference to the following preferred non-limiting embodiments in which: Figure 1 is a random number generating system in accordance with the prior art; Figure 2a is a random number generating system in accordance with an embodiment of the present invention and figure 2b schematically illustrates the output from the system of figure 2a and indicates how the system of figure 2a generates random numbers; Figure 3a is a random number generating system in accordance with an embodiment of the present invention and figure 3b schematically illustrates the output from the system of figure 3a and how bit values are derived from this output using a variation on the method described with reference to figure 2b, figure 3c is a variant on the system of figure 3a and figures 3d and e schematically illustrate outputs from the system of figure 3c; Figure 4a is a schematic of a detection system comprising an avalanche photodiode for use in the random number generator in accordance with an embodiment of the present invention, figure 4b is a plot of the input signal to the device of figure 4a, figure 4c is a plot of a first part derived from the output signal of the APD of figure 4a, figure 4d is a plot of the second part derived from the output signal of the APD of figure 4a which has been delayed and figure 4e is a plot of the seif-differenced output signal produced by the device of figure 4a; Figure 5 is a plot of a histogram of the pulses received against time for the system of figure 2; Figure 6a is a histogram showing the NIST test from the system of figure 2, figure 6b shows the confidence range of the test results of figure 6a; Figure 7 shows the results of "diehard tests" of the system of figure 2; Figure 8 is a plot of the expected random bit generation rate against a product of the photon flux and detector efficiency for a detector running at 1 GHz; Figure 9 is a schematic of a system in accordance with a further embodiment of the present invention where output is increased using multiplexing; Figure 10 is a variation on the detector of figure 4a; Figure 1 la is a schematic of a further variation on the detection system of figure 4a and figure 1 lb is a plot of the input signal to the detection system of figure ha; Figure 12 is a schematic of a detection system which is a variation of the detection system of figure 4a for use in the random number generator in accordance with an embodiment of the present invention; Figure 13 is a detection system incorporating an avalanche photodiode and a capacitor for use in the random number generator in accordance with an embodiment of the present invention; Figure 14 is a schematic of a detection system comprising two APDs arranged to cancel one another for use in the random number generator in accordance with an embodiment of the present invention; and Figure 15 is a schematic of a free running detector with post gating.

Figure 1 is a schematic of a prior art random number generator. The prior art system comprises a photon source 101 which is typically a laser or the like.

The output is then directed into a spectral filter 103 which serves to filter out any

unwanted background radiation.

The output of the spectral filter 103 is then directed into attenuator 105. Attenuator 105 serves to convert the pulsed output from the photon source into pulses which on average have a probability containing less than one photon. As it is not possible to divide a photon, this typically means that most of non-empty pulses contains one photon.

The output of the attenuator 105 is then directed into 50/50 non-polarising bearnsplitter 107. Non-polarising beamsplitter 107 randomly directs photons either to first single photon detector 109 or second single photon detector 111. Such random reflection and transmission provides a source of randomness.

Although the above system can generate random binary numbers, the degree of randomness is impacted by two factors. There will be an imbalance in the photon detection efficiency of the two detectors 109, 111 and it is difficult to ensure that the 50/50 beamsplitter 107 has exactly a 50:50 transmission reflection probability. The first problem may be circumvented by using one detector. However, the second problem is very hard to solve, in addition, there may be the effect of the bit correlation of the bit sequence due to detector dead time. A different detector is more likely to fire after one detector fires. Therefore, to resolve these issues, computation-intensive processing is required to process the raw data in order to eliminate any bias between the two detectors, resulting in a reduced random bit rate.

Figure 2a is a schematic of a random number generator in accordance with an embodiment of the present invention. The generator comprises a coherent laser 1 which in this case is a CW laser diode, emitting photons at a wavelength of 1.55 microns. The laser source I is fed into attenuator 5. Attenuator 5 is configured to attenuate the output of laser 1 so that it will not saturate the detector 7, as described below. Typically, the attenuated laser power is a few tens of pico-Watts.

The output of attenuator 5 is fed into photon detector 7. Photon detector 7 is a single photon detector. The single photon detector is gated so that it can only detect photons when the gate switches the detector to be active. The detector gates are shown in the upper trace of figure 2b. In figure 2b, the detector gating waveform is shown to be square, but it may have a different profile. The laser 1 is attenuated by attenuator 5 such that the photon detection probability for each gate is much less than unity.

The output of the generator of figure 2a is described with reference to figure 2b. The upper trace in figure 2b shows the detector gates. The detector gates are grouped into twos as shown by the dotted line. The coherence time of the laser 1 of figure 2a is much longer than a single detector gate as can be seen from the photon wave function of figure 2b. The detection probability of each gate within a bit group is identical because the wave function of each photon spreads over a number of detector gates and the emission time of each photon is totally random. The detection occurs when the photon wavefunction collapses onto one of the clock gates, which is a quantum mechanical probabilistic process.

The lower trace of figure 2b shows the results obtained from the generator of figure 2a.

In the first group I where there are two time bins, a count is registered in a first (i) of the time bins but not in the second of the time bins (ii). When a photon is received in a first time bin (i) but not in a second (ii), this, in the current embodiment, corresponds to a bit value of 0.

in the next group, the second group II shown in figure 2b, no photon is received in either of the first time bin (i) or the second time bin (ii). Therefore, no bit value is assigned to this group II. In the third group III, only a photon is received in the second time bin (ii). In this embodiment, this corresponds to a bit value of 1. In the fourth group IV, no photon is received and this again does not give rise to a bit value. In the fifth group V, two photons are received and this again is not a valid result and is ignored. In the sixth group VI, no photon is received and again a bit value cannot be assigned. in the seventh VII and eigJith VIII groups, photons are received in the first bin and therefore both groups are allocated a bit value of 0.

The system which has been described with reference to figure 2 is automatically balanced because it uses the same equipment to determine whether a bit 1 or a bit 0 is registered.

The coherence time should be preferably longer than the group of bins.

The coherence source 1 can also be replaced with a combination of a non-coherent source, such as a light emitting diode, and a suitably narrow bandpass filter. Such a baiidpass filter should be configured to increase the coherence of the incoherent source such that the coherence time extends over more than one bin or gating period of the detector.

A narrow bandpass filter may also be used with a coherent source in order to increase the coherence time. For example, it could be used for a source which has a coherence time which is shorten than a time bin to increase the coherence time to be much longer than a time bin.

Figure 3 shows a variation on the system of figure 2. In figure 3a, the apparatus is largely identical to that described with figure 2a. Therefore, to avoid any unnecessary repetition, like reference will be used to denote like features.

Again as shown in figure 3b, the detector is gated so that the output is assigned to time bins which are grouped into twos. The photon wave function shown at the top of figure 3b is seen to extend over a number of groups of time bins. The initial detector output leads to the same trace as explained in relation to figure 2b. In figure 3, this is shown as trace figure u. Trace u is then shifted forward by one period to form trace v. Trace v is then subtracted from trace u to give an updated sequence trace w. This means that only the first detection is kept for any successive photon detections. Thus, looking at group V, it can be seen that in trace w, only the first bin is kept given a bit value of 0.

Effectively, the subtraction described above discards all photon detection events if there is photon event occurring in its previous time bin regardless of whether the previous time bin is in the same group or a preceding group. Therefore, the operation of subtraction can be replaced by discarding those photon events whose preceding time bin also registers a photon event.

For example, if photon detection in two consecutive groups gives the result [x P]{P x] where x indicates no photon detection, P indicates photon detection and [. . I indicates a group), the bit assignment is 1 for the method of figure 3. Over the method shown in Figure 2, Figure 3 method has less bit correlation. For example, for a consecutive four photon detection events, there are two possibilities: [xP][PP][Px} or [PP][PP], Figure 2 method gives a result of(1,0) for the first possibility and no bits can be extracted from ii second possibility. This causes a higher probability of having result (1,0). While the Figure 3 method gives only one bit (0) for the first possibility and bit (1) for the second possibility. In Figure 2, two bits are always (10) for successive detection events if two bits can be extracted from successive photon detection events. The system of figure 3 addresses this issue.

Further, the system of figure 3 can be physically realised by the self-differencing circuit which is explained with reference to figure 4.

To summarise, the procedure of figure 3b ensures that any group of time bins will consist of only one photon detection event. Second, it helps remove bit correlation caused by consecutive photon detection events. Third, there exists high-speed single photon detector with above operation functionality built-in, as described below.

There are various alternative ways to group time bins. For example, a set of consecutive four time bins form one group. If one photon detection event was registered for the group, then multiple bits could be extracted for the single group since the following combinations of detection events would be possible [Pxxx] or [xPxx] or [xxPx] or [xxxP] where P indicates a photon detection event and x indicates no photon detection event.

Figure 3c shows a variation on the system of figure 3a. In figure 3c, the apparatus is largely identical to that described with figure 3a. Therefore, to avoid any unnecessary repetition, like reference will be used to denote like features. In the apparatus of figure figure 3c a time acquisition card 8 is shown, which is connected to detector 7. The time acquisition card is capable of generating time stamps.

Again as shown in figure 3b, the detector is gated so that the output is assigned to time bins which are grouped into twos. The photon wave function shown at the top of figure 3d is seen to extend over a number of groups of time bins. In figure 3d, this is shown as trace figure u. This grouping of bins gives an identical output to the method described in Figure 2. In figure 3d, trace v shows a different grouping, this time that of four time bins. It is now possible to realise one extra bit of information per photon detection event over the method of trace u as there are now four positions for the photon count to be detected. In figure 3d, trace w shows a grouping of 8 time bins. Now two extra bits of information can be realised over the method of trace v as there are now 8 positions for the photon count to be detected.

it is not necessary for the time bins be synchronised to the detector gate frequency for correct operation.

One of the drawbacks of the above scheme is that it is possible for the detector to register more than one photon within a given group. It is possible to assign a bit sequence for each photon detection in the group, however, such a treatment most likely will cause bit correlation. Another possibility is to discard these events when two or more photons are registered within a single group, leading a slight loss in the bit rate.

One way to get around the above drawback is to use time bins smaller than a detector gate period. For example, to divide each gate into 4 or 8 mini time bins. In such way, it is guaranteed that no more than one photon can be registered within a group of time bins and hence a bit sequence can be extracted from each photon detection. Such an operation is shown in figure 3(e). In figure 3e, each detector gating period is split up into time bins. In trace (u), each gating period is divided up into 4 time bins permitting 2 bits of random bit extraction per gate period.

Preferably, a large number of mini-time bins can be grouped together, in such a way that a group extends over many clock periods. One example of this is shown schematically in trace (v) of figure 3(e). Here each gating period is divided up into 8 time bins allowing 3 bits of random bit extraction per gate period.

In trace (w) of figure 3w there is complete asynchronous operation between the detector gates and the time bins. The random arrivals of photon detections can be harnessed for bit extraction purely through the converting the time stamp of arrival x to a binary value.

Figure 3(w) shows random bit extraction when the time stamp has a size of 28bits.

In summary, in figure 2, random photon arrivals are recorded at the detector and a binary random bit stream is derived purely from the fact if the photon arrived in an odd detector gate a binary "0" is ascribed; conversely if it arrives in an even detector gate a "1" is ascribed. This was performed experimentally by using a photon counting card.

Each photon arrival was given a unique time-stamp (accuracy 4picoseconds) and this written to a file. After the experiment, the file was analyzed using a computer program.

The program worked out, assuming the detector was gated at 1 GHz, which detector gate a photon arrival fell into, and hence built up the random bit stream in that manner.

The systems of figures 3d and e utilize the full timing capability of the photon counter card 8. Here, more than just 1 bit is extracted from each photon arrival. The timing accuracy of the photon counter card used in this particular example is 4 picoseconds and it needs 28 bits to store this timing information. These extra bits can be used to expand the single photon arrival event.

In the experiments, the photon counting card is not tied synchronously to the detector gating frequency. In the trace of figure 3e(w) the photon counting card just waits for random photon arrivals.

In a preferred embodiment, the present invention uses an APD operating in Geiger mode. In order to achieve higher operation frequencies, the APD is used in a self differencing arrangement as shown in figure 4.

Figure 4a illustrates a circuit for high frequency photon detection with an APD. The detector can be used in the RNG of figures 2 or 3 in accordance with an embodiment of the present invention.

A square wave input signal 4b may be applied. The input signal needs to be large enough to bias the APD above its breakdown voltage. In this particular example, the bias is set so that the avalanche peak is smaller than the charging peak.

The circuit of figure 4a shows an APD which can be operated at a higher frequency and thus one where it is possible to reverse bias the device for a very short time.

As before, the device comprises an avalanche photodiode provided in series with a resistor 53. The voltage dropped across the resistor 53 is first input to power splitter 55.

Power splitter 55 divides the output signal into a first part as shown in figure 4c and a second part which is identical to the first part shown in figure 4c. These two signals are then output via ports 57 and 59 of power splitter 55. The signal which is output via port 59 enters a delay line 56 which serves to delay the signal by a duration equal exactly one gating period. The delayed signal is shown in figure 4d. The first part of the signal and the delayed second part are then fed into hybrid junction 61. Hybrid junction 61 combines the first and the delayed second parts of the signals with 1800 phase shift to give the output shown in figure 4e, which is effectively the differential signal between figure 4c and figure 4d. A dip 75 are seen in the trace of figure 4e which indicates the presence of a photon. The provision of a positive peak followed by a negative dip (or a negative dip followed by a positive peak dependent on the configuration of the equipment) allows a clear signature indicating the detection of a photon.

The circuit in Figure 4a, performing the above described seif-differencing, allows the large capacitive response of the APD to be subtracted and the weak avalanche signal to be observed. This allows the detector to be run at very high frequencies.

The power splitter 55 may be of the type which is sold under part number ZFRSC-42+ from Mini-circuits and the hybrid junction is also available under part number ZFSCJ- 2-4 which is also available from Mini-circuits. The exact delay can be realised by using two co-axial cables with two different lengths that link the power splitter and the hybrid junction. It should be noted that the combination of the power splitter 55, the delay line 56 and the hybrid junction 61 may be integrated onto a single printed circuit board.

Typically, the gate frequency could be I GHz and the gate width 0.5 ns. The lower voltage level might be 4.6V below breakdown and the higher level 2V above the breakdown voltage. The breakdown voltage might typically be 47V for an InGaAs APD.

The above can also be used with Si-APDs, which are efficient for visible light photon detection, can also be operated in high speed gated mode with the above mentioned self-differencing circuit.

To test the random number generator, a system was built using the above detector and a coherent CW laser diode with an output wavelength of 1550 nni which was attenuated to the single photon level. The detector was held at a temperature of approximately -30°. A GHz square wave bias pulse train of approximately 7 volts amplitude was superimposed on a DC bias of 45.9 volts as the gating signal for the detector. In this arrangement, the dark count rate was approximately 1000 Hz. The remaining signal was amplified before being sent into time tagging single photon counting electronics which was capable of time recording single photon counting of up to 5MHz.

Figure 5 shows a histogram of the counts recorded for a detector with a clock frequency of 1.03 GHz and a photon incident flux of approximately 20 pW. Figure 5 shows that the recorded counts are well separated from each other in time by approximately 600 picoseconds. This shows good performance for a random number generator. Aiiy overlap between adjacent clock counts could lead to unwanted correlations in the final random bit output. The very small sharp width of approximately 60 picoseconds of the clock counter events is due to the gated detection.

Time tag counter events were recorded for a duration of approximately 2 minutes with a CW photon flux of approximately 20 pW at a clock frequency of 1.03 GHz. The photon flux corresponded to approximately 0.3 photons per clock period. The time tagged events acquired were converted into random bits by assigning detection events in even clock cycles as a 1 and detection events occurring in odd clock cycles as a 0 as shown in figure 2.

It is important to note that no post-processing needs to be carried out in the resulting bits to improve randomness.

Next, the randomness of the generator was investigated using known techniques where a p-value was calculated. A p-value is defined as the probability of observing a test statistic which is at least as extreme as the value actually observed. For example, the NIST statistical test suite (http://csrc.nist.gov/groups/ST/toolkitirnglindex.html) has a test called the frequency or monobits test. This tests the difference of l's and 0's in a particular bit stream. For a perfect random number generator, the distribution of ratio's of I s and 0's it could generate is Gaussian spread with a mean value of 0 difference. The difference of 1 s and 0's of the experimental data is calculated and compared with the perfect random number distribution. The p-value is then the sum of the probabilities the perfect random number generator could produce the experimental data difference of I s and 0's and all the more extreme distributions.

A significance level a is also assigned for a test. Typically, for cryptographic applications, a significance level of a 0.01 is chosen for NIST (National Institute of Standards & Technology) tests. This means that if the p-value is greater than 0.01, the bit stream produced by the detector passes the test.

Figure 6a shows the results from the NIST tests where a p-value is calculated for 16 tests from a battery of tests. These tests are well-known to those within the art, therefore, a detailed description of each test will not be given here. However, the tests are designed to look for randomness within certain events. The tests shown here are the frequency (mono-bits) test, frequency within a block test, random binary matrix ranked tests, tests for the longest run of ones in a block, discreet Fourier transform (spectral) test, non-overlapping (a periodic) template matching test, overlapping (periodic) template matching test, Maurer's Universal Statistical test, Lempel-Ziv complexity test, linear complexity test, serial test, approximate entropy test, cumulative sum (CUSUM) test, random excursions test and random excursions variant test.

For example, the frequency test assessed the number of ones and zeros in a sequence as these should be about the same for a truly random sequence.

The results shown in figure 6a are from testing a 500x 106 bit pattern from the system of figure 2. All tests passed at the a= 0.01 significance level.

Figure 6b shows the proportion of passes for each test. The proportions are nicely distributed around the expected value of 99%. The confidence range based on the finite number of the bit streams tested (500) is also shown. All tests are within the confidence range of 97.6 to 100% for the proportion of passes.

A second battery of tests known as the Diehard tests (G. Marsaglia, A. Zaman and W. W. Tsang, Stat. And Prob. Lett. 9 35 (1990) and http://www.stat.fsu.edu/publdiehard) was also performed. The Diehard test similar to the NIST tests, the 20 diehard tests used are as follows, the birthday spacing's test, the overlapping 5-perrnitation test, the binary ranked test 32 x 32, the binary ranked test 31 x 31, the binary ranked test 6 x 8, the bit stream test, the OPSO test (overlapping pairs sparse occupancy), the Oqso test (overlapping quadruple sparse occupancy), the DNA test, the count the ones test on a stream of bits, the count the ones test for specific bits, the parking lot test, the minimum distance test, the 3D spheres test, the squeeze test, the overlapping sums test, the runs test and three craps test.

In the Diehard test, the significance level is range from a= 0.01 to 0.99. Tests falling within this range are deemed to have passed the test. For the block with 5 x 108 bits, 20 tests were applicable. Figure 7 shows that all 20 tests were passed.

Figure 8 is a schematic of the raw count rate of the detector up to saturation at I GHz as a function of the photon flux (j) and detection efficiency () product jt.

The solid line represents the photon count rate and the dotted line represents the random bit output rate. Average bit per time bin can be expressed as p(P) . p(X) = p(P) .(i -p(P)), wherep(P) is the probability of photon detection at this particular time bin while p) is the probability of no photon detection at the following tinie bin. The random bit output rate peaked at 0.25 bit per time bin when p(P)= 0.5, which is 250 MHz with I GHz clock rate. Further increase the photon count rate/flux will cause a drop in random bit rate. The value of 250 MHz is therefore the theoretical limit of the system which is over two orders of magnitude higher than any bit rates of existing quantum random number generators. Note that when using self-differencing detector, both the photon count rate and the random bit rate follow the dashed line.

Figure 9 shows a system which can improve on the bit rate of the above described system using multiplexing.

The system comprises a coherent CW laser source 201 which is attenuated by an attenuator 203 to produce an attenuated signal. The output from the attenuator 203 is split into n beams by I xn beam splitter 205. Each output of beam splitter 205 is received by a detector 207, 2072 207. Each single photon detector 207 is used as a high speed random number generator similar as previously described in Figure 2. The bit output of all n detectors is then combined to form a random generator with a speed improvement by a factor of n.

The arrangement of figure 9 overcomes the 250MHz theoretical limit of the system previously descnbed. Also, although a beam splitter is used, it does not suffer from the problems of the prior art since the beam splitter itself is not used to determine the random number only which detector should be used to generate a random number.

Figure 10 shows a variation on the detector described with reference to figure 4a. The device of figure 10 takes the output from an APD and resistor (not shown) and directs it into hybrid junction 81. Hybrid junction 81 splits the output into a first part and a second part is described with reference to the power splitter 55 of figure 3b. However, hybrid junction 81 also introduces a 180° phase shift between the first part and the second part of the signal. The first part of the signal is output via output 83 and the second part is sent via output 85 into delay line 87.

The systems of figures 4a and figure 10 have both used combinations of power splitters/combiners and hybrid junctions. However, the hybrid junction may be replaced by a combination of phase shifters and power combiners. For example, it could be replaced by the combination of a power combiner and a 180° phase shifter.

In a further variation on the systems of figure 4a, a tuneable RF attenuator is provided which may be used in either of the inputs to hybrid junction 61 (figure 4a) or power combiner 89 (figure 10) to ensure that the two signals reach the hybrid junction or power combiner with equal amplitudes.

Typically, all the hybrid junctions and power splitter/combiners have finite response frequency range. For example, hybrid junction, Mini-circuits ZFSCJ-2-4 has a frequency range of 50MHz to 1 GHz. It may not work well when the signal contains frequency components outside of the range, and the cancellation may not be perfect. To iniprove the signal to background ratio, further bandpass filters may be used to filter out those frequency components. In Figure 4a, for example, a low bandpass filter may be placed after the hybrid junction output.

The output of the power combiner 89 is fed into measuring means 90 which is configured to determine the amplitude of the output of the power combiner in order to determine the number of photons which gave rise to the avalanche.

Figure 11 shows a further variation on the system described with reference to figures 4 and 10.

The system of figure ha has an avalanche photodiode 51 and a resistor 53 as described with reference to figure 1 lb. Further, the signal of the voltage dropped across the resistor 53 is taken to power splitter 55 which splits the signal into a first part and a second part. The first part being outputted via output 57 and the second part via output 59 into delay line 56. The first part of the signal and the delayed second part are then fed into hybnd junction 61 which combines the two parts of the signal with 180° phase difference.

However, in the apparatus of figure 11 a, the input voltage signal is a sinusoidal voltage signal as shown in figure 1 lb and not the periodic train of rectangular pulses as shown in figure 4b It is possible to bias the detection system of figure ha with a sinusoidal signal as long as the signal has sufficient voltage swing to bias the APD above and below the threshold for avalanche breakdown. In fact, the detector may be biased with any periodic voltage signal.

In response to the sinusoidal gating voltages, the APD output is also sinusoidal.

Superimposed on the sinusoidal output are occasional avalanche spikes due to photon detection. The amplitude of avalanche spikes is typically much smaller than that of the sinusoidal output. However, as described previously with reference to Figure 4a, by using a power splitter, delay line, and hybrid junction, the sinusoidal components can be largely cancelled and the avalanche spikes become clearly visible.

Furthermore, any small remaining components of the sinusoidal signal may be removed from the output of the hybrid junction 61 by a band rejection filter 63 which is tuned to the frequency of the sinusoidal signal. The signal is passed to amplifier 65 and then into measuring means 67 in order to determine the amplitude of photon induced spikes in the outputted signal.

Figure 12 shows a further variation in the system of figure 4, the configuration is the same as that described with reference to figure 4. The output signal is then fed into power splitter 101. Power splitter 101 divides the signal into a first part and a second part. The first part is output via output 103 and the second part via output 105 which is further fed into delay line 107. The two parts of the signal are then fed into the differential amplifier 109. Due to the configuration of amplifier 109, only the difference of the two inputs is amplified. The differenced signal is them passed to measuring means 110 which measures the amplitude of the signal to determine the number of photons which have given rise to the avalanche.

The detector of figure 4a uses a self differencing arrangement to achieve high frequency operation from an APD. However, it is also possible to use other techniques.

For example, consider the detector of figure 13. To avoid unnecessary repetition, like reference numerals will be used to denote like features with those of figure 1. Figure 13 again has an avalanche photodiode 1 and resistor 3. A capacitor 21 and further resistor 23 are formed in series with the avalanche photodiode 1 and resistor 3 such that resistors 3 and 23 are connected back to back.

From this circuit, the combined DC and pulsed bias for the APD varying between V0 and V1 is applied to the APD, while just the pulse signal (varying between V1 and Vo) is applied to the capacitor. The output signal from the capacitor 21 will be similar to the output signal from APD I in the absence of absorption of a photon. The output from the APD I and capacitor 21 are then combined in hybrid junction 25. Hybrid junction will reverse the phase of one of its two inputs. Therefore, the hybrid junction 25 combines the output signals from both the APD I and the capacitor 21 with a 1800 phase difference so that they nearly cancel. This allows the charging 9 and discharging 11 peaks to be partially cancelled.

The output of the hybrid junction 25 is fed into measuring means 26 which measures the height of peaks in the output to determine the number of photons which caused the avalanche signal.

Figure 14 illustrates a further improvement to the system of figure 13 where capacitor 21 is now replaced with a second APD 23.

To avoid unnecessary repetition, like reference numerals will be used to denote like features.

A second resistor 31 and a second APD 33 are provided in the same positions as second resistor 23 and capacitor 21 of figure 10. The output of the first APD 1 and second APD 33 are then combined at hybrid junction 35 with 180° phase difference in order for the components to cancel one another. The output of the hybrid junction is then fed into measuring means 37 which in turn measures the height of peaks in the output to determine the number of photons which caused the avalanche signal.

The above description has used gated detectors. However, it is possible to realise the system using a free-running (i.e. non-gated) detector and dividing the output of the detector into bins. Such a detection system is shown in figure 15. Free running detector 301 is not gated and outputs random detection events. Its output is divided into time bin by Fast Logic XOR 303. The XOR gate 303 receives a clocked input from clock source 305 which determines the size of the time bins.

Claims

CLAIMS: I. A random number generator comprising a source of weak light, a detector configured to detect said light as photon detection events and assign said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than I, the generator further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.
2 A random number generator according to claim I, wherein said means to determine a bit value is configured to assign consecutive time bins into groups of n bins and determine said bit value depending on which bin indicates that a photon detection event has occurred, wherein n is an integer of 2 or more.
3. A random number generator according to claim 2, wherein said means to determine a bit value only assigns a bit value ifjust one photon detection event has occurred in a group of bins.
4. A random number generator according to any preceding claim, further comprising means to discard a result derived from photon detection events in consecutive bins.
5. A random number generator according to claim 4, further comprising means to compare the output of the detector with a copy of the output of the detector which has been shifted by one time bin.
6. A random number generator according to any preceding claim, wherein said detector comprises an avalanche photodiode.
7. A random number generator according to claim 6, further comprising means to isolate the avalanche signal from the output of the avalanche photodiode.
8. A random number generator according to claim 7, wherein said means to isolate the signal comprises means to apply signal which compensates for the response of said photodiode in the absence of illumination.
9. A random number generator according to either of claims 7 or 8, wherein the means to isolate the signal comprises a signal divider to divide the output signal of the photodiode into a first part and a second part, where the first part is substantially identical to the second part, delay means for delaying the second part with respect to the first part and a combiner for combining the first and delayed second parts of the signal such that the delayed second part is used to cancel periodic variations in the first part of the output signal.
10. A random number generator according to any preceding claim, comprising a plurality of detectors each configured to detect said light and assign said photon detection events to time bins, the system further comprising a signal divider configured to direct light from said source to any one of said detectors.
11. A random number generator according to any preceding claim, wherein time bins are selected so that the coherence time of the source extends over two or more time bins.
12. A random number generator according to claim 2, wherein time bins are selected so that the coherence time of the source extends over n bins within a group of n bins.
13. A random number generator according to any preceding claim, wherein said source is an incoherent source.
14. A random number generator according to any preceding claim, further comprising a filter configured to extend the coherence time of the source.
15. A random number generator according to claim 1, wherein said detector detects photons continuously and the output of said detector is divided into time bins.
16. A random number generator according to claim 1, wherein the source is not synchronised with the detector gating.
17. A random number generator according to claim 1, wherein the detector is gated and the time bins and detector gating are not synchronised.
1 8. A circuit for a random number generator, the circuit comprising means to receive the output of a photon detector and assign photon detection events indicated in the output of the detector to time bins, the circuit further comprising means to determine a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred.
19. A circuit according to claim 18, further comprising a detector.
20. A method of generating random numbers, the method comprising: emitting a light signal from a weak light source; detecting said light as photon detection events; and assigning said photon detection events to time bins, wherein the weak light is of an intensity where the probability of the detector registering a photon event in a time bin is less than 1, the method further comprising determining a bit value from the pattern of time bins where a photon detection event has occurred and where a photon detection event has not occurred, wherein the source of weak light is continuous or has a pulse length longer than a time bin.