JP2008070636A - Correlating random number generating method and correlating random number generating device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a correlating random number generating source necessary for a secret key shared cryptosystem as a correlating random number generating method and a correlating random number generating device that can be physically obtained. <P>SOLUTION: The correlating random number generating device 100 that generates correlating random numbers used for the secret key shared cryptosystem comprises: an irregular signal for driving generating section 101 outputting, as an irregular signal for driving, signals depending on difficult-to-measure physical quantity; a parameter value generating section 106 generating uniformly random parameter values; an irregular signal for random number generating section 105 generating irregular signals for random number by developing, on the basis of the parameter values generated by the parameter value generating section 106, the irregular signals for driving generated by the irregular signal for driving generating section 101 to be more irregular; and a quantizing section 107 generating correlating random numbers by quantizing the irregular signals for random number generated by the irregular signal for random number generation section 105. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a correlation random number generation method and a correlation random number generation apparatus for generating a correlation random number used in a secret key sharing cryptographic system.

Let A be an alphabet, and consider random numbers X∈A and Y∈A that take values in A. Here, it is assumed that the random numbers X and Y have a correlation, that is, the mutual information amount between X and Y is positive, and the sender and the regular receiver (hereinafter referred to as a sender and receiver) , Y can be considered. At this time, it is known that the sender / receiver can share secret information with a third party other than the sender / receiver (hereinafter referred to as an eavesdropper) by exchanging appropriate information through the public communication path. ing. Such an operation is called secret key sharing. The concept of secret key sharing is described in Non-Patent Document 1, for example.
UM Maurer and S. Wolf, “Unconditionally Secure Key Agreement and the Intrinsic Conditional Information,” IEEE Transactions on Information Theory, vol. 45, No. 2, p. 499-514, March 1999

In order to realize secret key sharing, a technique for generating a correlated random number sequence on the sender side and the receiver side is necessary. Therefore, the random numbers of the sender and the regular receiver are X and Y, respectively. In general, it is assumed that an eavesdropper also obtains a large number of random numbers correlated with X and Y. The random numbers obtained by these eavesdroppers are set as (Z ₁ , Z ₂ ,..., Z _M ). Hereinafter, it is expressed as Z ^M = (Z ₁ , Z ₂ ,..., Z _M ).

The maximum amount of secret information that can be shared by the sender and receiver is called secret key capacity. In the following, the secret key capacity is represented by S (X; YＭZ ^M ). The sample number M of the eavesdropper's random number is an index for measuring the eavesdropper's ability to attack the secret key, and the secret key capacity S (X; Y‖Z ^M ) decreases monotonously as the M increases. It has the property to do. In application, it is desired to obtain a specific calculation value of the secret key capacity for an arbitrarily given random number source, but at present, calculation for an arbitrary random number source is impossible.

As a correlation random number source for secret key sharing, a source satisfying the following conditions is desired.
(Condition 1) The secret key capacity is positive, that is, S (X; Y‖Z ^M )> 0.
(Condition 2) The secret key capacity S (X; Y‖Z ^M ) can be specifically calculated.
(Condition 3) For an arbitrarily fixed number of random sample of eavesdropper M,
The secret key capacity S (X; Y‖Z ^M ) should be as large as possible.

  Here, since the secret key capacity of 0 means that secret key sharing is not possible in principle, (condition 1) is an indispensable condition for realizing secret key sharing. Further, in secret key sharing, if information is shared between senders and receivers exceeding the secret key capacity, the secrecy of information to an eavesdropper cannot be guaranteed. Therefore, it is important to know the maximum amount of information that can be shared while maintaining confidentiality. For this reason, (Condition 2) is required. Furthermore, (Condition 3) requires that as much secret information as possible can be shared between the sender and the receiver.

  FIG. 1 is a diagram showing an example of a set of random numbers in a mathematical model of a correlated random number source. Hereinafter, a mathematical model of a correlated random number source suitable for secret key sharing that satisfies the above (condition 1) to (condition 3) will be described with reference to FIG.

First, consider a finite set A as shown in FIG. Here, it is assumed that the set A is divided into subsets A _i (i = 1, 2,..., N) each including k elements and not sharing the same elements. That is, the set A satisfies the following formula (1).

In FIG. 1, the entire rectangle drawn with a solid line represents the set A, and e _ij (i = 1, 2,..., N, j = 1, 2,..., K) represents the elements of the set A. . In addition, each small rectangular portion partitioned by a dotted line represents a subset A _i . Here, a set of labels i representing the subset A _i is I = {i = 1, 2,..., N}. Then, the function f: A → I is defined as a function that associates an arbitrary element aεA _{i with} a label i of a subset to which a belongs, that is, a function of f (a) = i.

On the other hand, the selection function s: I → A is defined as a function that associates one representative element of A _i with an arbitrary element iεI. Representative original choice from each subset A _i is k but since the number of subsets is n, the number of all possible selection function becomes k ⁿ pieces. Therefore, a set S of all possible selection functions is defined by the following equation (2).

Then, X∈A, Y∈A, Z _i ∈A (i = 1, 2,..., M) take a value in the set A and are random variables according to the joint probability distribution given by the following expression (3). And However, M ≦ n.

Here, z = (z ₁ , z ₂ ,..., Z _M ), and the summation on the right side is taken for all possible selection functions s. Each probability density function on the right side is defined by the following equations (4) to (7).

  FIG. 2 is a diagram showing the correspondence between a set of random numbers and a random number source in a mathematical model of a correlated random number source. Hereinafter, the correlation random number source model defined by the probability distribution function of Expression (3) will be intuitively described with reference to FIG. That is, random number generation in the correlated random number source model represented by Expression (3) is equivalent to the situation described below.

First, as shown in FIG. 2, when there are _n independent random number sources R ₁ , R ₂ ,. . In the trial, each random number source R _i prepares one random number real value r _i independently. As for the realization value r _i , one element is selected with an equal probability of 1 / k from the elements included in the subset A _i in the model. That is, r _i ε {e _i1 ,..., E _ik } = A _i .

The sender selects one random number source from the n random number sources with an equal probability of 1 / n, observes r _i, and sets the observed value r _i as an actual value of the random number X. Similarly, the receiver also selects one random number source with an equal probability of 1 / n, and sets the observed value as an actual value of the random number Y. On the other hand, an eavesdropper selects M different random number sources from n random number sources without duplication, and observes their realization values r _{i {m}} (m = 1,..., M). These observation values are assumed to be real values of random numbers Z _i (m = 1,..., M).

Here, notation i {m} in the subscript portion of r i _{m}, it is i _m, i.e., m represents that a subscript of i.

  Next, the derivation of the secret key capacity of the correlated random number source will be described based on these intuitive explanations. First, in order to share information between a sender and a receiver, the sender and the receiver must select the same random number source. When the random number sources are different from each other, the value of the random number X and the value of the random number Y are uncorrelated, and information cannot be shared.

First, the probability that a sender selects a particular random number source is p _a = 1 / n. The probability that the receiver selects the same random number source is p _b = 1 / n. At this time, considering that the random number source selected by the sender may be any of the n random number sources, the probability Pr that the sender and the receiver select the same virtual random number source is expressed by the following equation (8). It is represented by

  If the random number source selected by the sender / receiver is included in the set of M random number sources selected by the eavesdropper, the eavesdropper knows the values of the random numbers X and Y possessed by the sender / receiver. Therefore, the random number value shared between the sender and the receiver cannot maintain confidentiality with respect to the eavesdropper. Conversely, if the random number source selected by the sender / receiver is not included in the set of M random number sources selected by the eavesdropper, the eavesdropper may estimate the values of the random numbers X and Y at all. Since this is not possible, the sender / receiver can have confidential information for the eavesdropper.

That is, the probability Pr that the transmission / reception party random number source selection matches and is not included in the set of M random number sources selected by the eavesdropper is expressed by the following equation (9).

Since the entropy of information that can be shared between the sender and receiver when this event occurs is log ₂ k, the secret key capacity of the correlated random number source is given by the following equation (10).

Further, when the upper bound of the secret key capacity normalized by the number of elements | A | included in the set A is evaluated with respect to a fixed value with the attack power M of the eavesdropper, the following expression (11) is obtained. .

  Expression (10) indicates that the secret key capacity can be accurately evaluated with respect to the correlated random number source model, and when the condition M <n is satisfied, the secret key capacity is positive. It is shown that. Therefore, it can be seen that (Condition 1) and (Condition 2) required for the above-described correlated random number source for secret key sharing are satisfied.

Further, according to Non-Patent Document 2, it is proved that the upper bound of the standardized secret key is 1 / M for a wide class of correlated random number sources. As shown in Expression (11), the standardized secret key capacity ¼M of the correlated random number source model is a value close to the upper bound 1 / M. That is, it can be said that the correlated random number source model also satisfies (Condition 3).
J. Muramatsu, K. Yoshimura, K. Arai and P. Davis, “Secret key agreement under sampling attack”, Proceedings of International Symposium on Information Theory and its Applications, p.75-78, December 2004

  However, conventionally, there has been no correlated random number generator that physically implements the above-described correlated random number source model. The present invention has been made in view of the problem, and provides a correlated random number generation source necessary for a secret key sharing encryption system as a correlated random number generation method and a correlated random number generation apparatus that can be physically realized. With the goal.

  The invention according to claim 1 is a correlation random number generation method for generating a correlation random number used in a secret key sharing encryption system, and outputs a signal dependent on a physical quantity whose value is difficult to measure. A parameter for generating a uniformly random parameter value by using a device to generate an irregular signal for driving and a second device for outputting a uniformly random signal. The driving irregular signal generated by the driving irregular signal generating means using the value generating step and a third device that performs a complicated operation in which it is difficult to predict the output signal from the input signal, Based on the parameter value generated by the parameter value generating means, the random signal random signal generating step for generating the random signal for random number by further irregularly developing, and for the random number Irregular signal random number generated in the rule signal generating step by quantizing, generating a discrete correlation random number, characterized by comprising a.

  According to a fifth aspect of the present invention, there is provided a correlation random number generator for generating a correlation random number used in a secret key sharing encryption system, which outputs a signal depending on a physical quantity whose value is difficult to measure. Uniformly random parameter values are generated using the random device for driving that generates the irregular signal for driving using the device 1 and the second device that outputs the random signal uniformly. The driving irregular signal generated by the driving irregular signal generating means using the parameter value generating means that performs the complicated operation in which it is difficult to predict the output signal from the input signal. A random signal random number generating means for generating a random random signal based on the parameter value generated by the parameter value generating means, and the random number random signal generating means. No. quantized irregular signal generated random number by the generation means, quantizing means for generating a discrete correlation random number, characterized by comprising a.

  According to the first or fifth aspect of the invention, in the driving irregular signal generating step or the driving irregular signal generating means, the device that outputs a signal depending on a physical quantity whose value is difficult to measure is provided. Since the driving irregular signal is used to generate the irregular signal for driving, the irregular signal for driving depends on a physical quantity whose value is difficult to measure. In addition, in the random signal random signal generation step or the random signal generation unit, the driving irregularity is generated using a third device that performs a complicated operation in which it is difficult to predict an output signal from an input signal. The irregular driving signal generated by the signal generating means is further irregularly developed based on the parameter value generated by the parameter value generating means. This is based on the parameter value, and selects a random random signal having a certain value from the random random signal that can be generated in the random signal random signal generating step or the random signal generating means. Corresponds to the process. Therefore, the present invention corresponds to a model of a correlated random number source suitable for secret key sharing described with reference to FIG.

The invention according to claim 2 is the random number generation method according to claim 1, wherein the first device is a random phase optical pulse generator, and the third device is parallel to each other. A plurality of nonlinear optical waveguides disposed adjacent to each other, and a plurality of phase modulators that respectively modulate signals input to the plurality of nonlinear optical waveguides. And
The invention described in claim 6 is the random number generator according to claim 5, wherein the first device is a random phase optical pulse generator, and the third device is a mutual generator. A plurality of nonlinear optical waveguides arranged adjacent to each other in parallel, and a plurality of phase modulators that respectively modulate signals input to the plurality of nonlinear optical waveguides. It is characterized by.

  According to the invention of claim 2 or claim 6, the random signal light pulse generator that has been physically realized is used to generate the irregular signal for driving, and the phase modulation that is physically realized. A random signal for random numbers is generated using a device and a nonlinear optical waveguide array (a plurality of nonlinear optical waveguides arranged so as to be adjacent to each other in parallel). Therefore, the random signal for random numbers is generated so as to be physically realizable.

A third aspect of the present invention is the random number generation method according to the first or second aspect of the present invention, wherein the second device is a thermal noise random number generator.
The invention described in claim 7 is the random number generator of the invention described in claim 5 or 6, wherein the second device is a thermal noise random number generator.

  According to the invention of claim 3 or claim 7, uniformly random parameter values are generated using a thermal noise random number generator that has already been physically realized. Accordingly, the parameter value is generated so as to be physically realizable.

The invention according to claim 4 is the random number generation method according to any one of claims 1 to 3, wherein in the quantization step, an adder and a comparator are used. The random number random signal generated in the random number random signal generation step is quantized.
The invention according to claim 8 is the random number generation device according to any one of claims 5 to 7, wherein the quantization means includes an adder and a comparator. The random number random signal generated by the random number random signal generating means is quantized.

  According to the invention of claim 4 or claim 8, using the adder and the comparator that have already been physically realized, the generated random signal for random number is quantized, and the discretized random number is obtained. obtain. Therefore, the random number is generated physically feasible.

  As described above, according to the present invention, a correlation random number generation source necessary for a secret key sharing encryption system is provided as a correlation random number generation method and a correlation random number generation apparatus that can be physically realized.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 3 is a diagram showing an example of the configuration of the correlated random number generation device according to the embodiment of the present invention. As shown in FIG. 3, the correlated random number generation device 100 includes a driving irregular signal generation unit 101, a driving irregular signal transmission unit 102, a first random number generation unit 103, and a second random number generation unit 104. Composed.

  In FIG. 3, a driving irregular signal generation unit 101 generates a driving irregular signal that depends on a physical quantity that is difficult to measure, and the generated driving irregular signal passes through the driving irregular signal transmission unit 102. Via the first random number generator 103 and the second random number generator 104. The first random number generation unit 103 and the second random number generation unit 104 generate random numbers of the sender and the regular receiver, respectively.

  Here, the first random number generation unit 103 includes a random number random signal generation unit 105, a parameter value generation unit 106, and a quantization unit 107. Similarly, the second random number generation unit 104 includes a random number random signal generation unit 108, a parameter value generation unit 109, and a quantization unit 110.

  Random number random signal generators 105 and 108 receive the driving random signal as an input, develop the random signal further randomly, generate a random random signal, and generate the random random signal thus generated. Is input to the quantization units 107 and 110. The parameter value generators 106 and 109 randomly set parameter values that change the input / output relationship in the random signal random signal generator 105. Further, the quantization units 107 and 110 quantize the random number random signal and output a randomized random number. Here, a random variable representing a random number generated from the first random number generator 103 is assumed to be X, and a random variable representing a random number generated from the second random number generator 104 is assumed to be Y.

  FIG. 4 is a diagram illustrating an example of the configuration of the correlated random number generation device when an eavesdropper is present in the present embodiment. As shown in FIG. 4, the eavesdropper has M same devices as the first random number generation unit 103, and inputs the same driving irregular signal to them to generate M random realization values. Will be assumed.

The first random number generator 103 generates a random number according to the following procedure.
(Procedure 1) The parameter value generation unit 106 randomly determines and sets a parameter value that changes the input / output relationship of the random signal generation unit 105 for random numbers.
(Procedure 2) Random number random signal generator 105 receives a driving irregular signal, and generates a random random signal based on the driving irregular signal and the parameter value set by parameter value generator 106. Generation.
(Procedure 3) The quantization unit 107 quantizes the random number random signal and outputs the quantized value as an actual value of X.

Similarly, the second random number generation unit 104 generates random numbers according to the following procedure.
(Procedure 1 ′) The parameter value generation unit 109 randomly determines a parameter value for changing the input / output relationship of the random signal generation unit 108 for random numbers independently of the parameter value generation unit 106 of the first random number generation unit 103. And set to that value.
(Procedure 2 ′) The random random signal generation unit 108 receives the driving irregular signal, and uses the driving irregular signal and the parameter value set by the parameter value generation unit 109 to generate a random random signal. Generate a.
(Procedure 3 ′) The quantization unit 110 quantizes the random number random signal and outputs the quantized value as an actual value of the random number Y.

  The first random number generation unit 103 and the second random number generation unit 104 realize the random numbers X and Y according to (Procedure 1)-(Procedure 3) and (Procedure 1 ')-(Procedure 3') described above, respectively. One value can be generated at a time. Therefore, in order to generate a large number of random numbers (random number series) by the first random number generation unit 103 and the second random number generation unit 104, a new input irregular signal for driving is used (procedure 1)-( Procedure 3) and (procedure 1 ′)-(procedure 3 ′) may be repeated.

  FIG. 5 is a diagram showing an example of a mathematical model representing the function of the random number generation unit in the correlated random number generation device according to the present embodiment. Here, the random number generation unit refers to the first random number generation unit 103 or the second random number generation unit 104. Hereinafter, the first random number generation unit 103 is simply referred to as the random number generation unit 103, and the first random number generation unit 103 is referred to as the first random number generation unit 103. Will be described. The second random number generation unit 104 is the same as the first random number generation unit 103.

In FIG. 5, a driving irregular signal that depends on a physical quantity that is difficult to measure is represented by w = (w _o , w _u ) εW. Here, a measurable physical quantity part is represented as w _o , a difficult to measure physical quantity part is represented as w _u, and W is a set of possible values of the driving irregular signal w. Also, a set of possible values of the parameter c that changes the input / output relationship of the random signal generator for random number 105 is C = {c ₁ , c ₂ ,..., C _n }. At this time, the random number random signal generation unit 105 and the quantization unit 107 function as shown in the following expression (12): the driving random signal w = (w _o , w _u ) and the parameter c. It is described by a function f having a value as an argument.

Here, D is a set including the output value x from the random number generation unit 103. That is, the output value x from the random number generation unit 103 is uniquely determined if w = (w _o , w _u ) and c are given, and becomes x = f (w _o , w _u , c). The function f is assumed to be a non-constant function whose output value varies depending on w _o , w _u , and c. With this assumption, the output value of the function f depends on w _u , but it is difficult for the observer to measure w _u and the value is unknown, so the output value x of the function f cannot be predicted uniquely. . Therefore, the output from the random number generation unit 103 can be regarded as a random variable even under conditions where w _o and c are known. Therefore, this random variable is represented as X∈D.

The following assumptions are made in the mathematical model of the random number generator 103 described above.
(Assumption 1) The value of w _u is unknown in any case. Even if the output value x of the function f, the observable part w _o of the input, and the value of the parameter value c are given, the function f is a complex function, and the relational expression x = f (w _o , w _u , C) it is impossible to estimate w _u .
(Assumption 2) As the value of the parameter c, one value is selected at random with equal probability from all possible values and set.
(Assumption 3) For a certain input (w _o , w _u ), a vector (f (w _o , w _u , c ₁ ),..., F (w _o , w) whose components are outputs when the parameter values are changed Consider _u , c _n )) ∈ D ⁿ . When w _o is arbitrarily fixed and w _u is varied over all possible values, the vector is uniformly distributed over the set D ⁿ .

  When these assumptions are realized, the correlation random number generation device 100 using the first random number generation unit 103 and the second random number generation unit 104 having the mathematical model described above is used as a correlation random number source for secret key sharing. The condition will be met.

  FIG. 6 is a diagram showing the correspondence between the model of correlated random number generation shown in FIGS. 1 and 2 and the mathematical model of the random number generator shown in FIG. Hereinafter, it is assumed that the above (Assumption 1) to (Assumption 3) are realized, and that the random number generation unit 103 corresponds to the correlation random number source suitable for secret key sharing shown in FIG. 1 and FIG. To do.

First, since a random signal for driving that depends on an unknown physical quantity w _u is input to the random number generation unit 103, an output value from the random number generation unit 103 even if w _o and c are known. x cannot be uniquely predicted. Therefore, the variable X having x as an actual value can be regarded as a random variable. Further, for the parameter c for changing the input / output relationship in FIG. 5, the values c _i (i = 1,..., N) that the parameter c can take are respectively converted into virtual independent random number sources R _i (FIG. 2). This can correspond to the subscript number i of i = 1,..., n). That is, c _i ⇔i.

At this time, in FIG. 3, the quantization unit 107 discretizes the output signal of the random number random signal generation unit 105 into k stages, and D = {1,..., K}. On the other hand, it is assumed that A ₁ = A ₂ =... = A _n = D in the subset A _i in the correlated random number source of FIG. Further, the output value _f for each parameter value _{c i (w o, w u} , c i) and to correspond with actual values _{r i} of the random number in a virtual random number source _{R i.} In such a case, since the random number random signal generation unit 105 and the quantization unit 107 have the above (assuming 3) property, the output vector (f (w _o , w _u , c) of the random number generation unit 103 is used. ₁ ),..., F (w _o , w _u , c _n )) are uniformly distributed on D ⁿ . This is equivalent to the situation in FIG. 2 where the virtual random number source R _i independently selects the realized value r _i from the subset A _i (= D) with an equal probability of 1 / k.

The operation of selecting the parameter value c in the random number generation unit 103 from the set C with an equal probability of 1 / n is performed by the sender selecting a single virtual random number source R _i with an equal probability of 1 / k. Equivalent to operation.

  Therefore, for the sender, the random number generation process performed by the correlated random number generator 100 according to the present embodiment shown in FIGS. 3 to 6 is equivalent to that of the correlated random number source suitable for secret key sharing in FIG. The same applies to the random number generation process of the receiver and the eavesdropper.

  For the above reasons, the correlated random number generation device 100 of the present embodiment can generate a random number equivalent to the correlated random number source suitable for secret key sharing in FIG.

FIG. 7 is a diagram illustrating an example of a specific mounting configuration of the random number generation unit of the correlated random number generation device according to the present embodiment. As shown in FIG. 7, the random number for random signal generation unit 105, a number adjacent the nonlinear optical waveguide G _i having a non-linearity by known Kerr effect (in this case, N-1 present, i.e., i = 1 ,..., N-1) A non-linear optical waveguide array configured side by side. At this time, the phase modulator M _i is arranged on the input side of each nonlinear optical waveguide G _i , and the photodiode P _i is arranged on the output side.

The phase modulator M _i includes an optical signal E _i (a driving irregular signal) output from a driving irregular signal generator 101 (see FIG. 3) configured by a known random phase optical pulse generator or the like. The phase modulator M _i modulates the input optical signal M _i according to the parameter value c separately input from the parameter value generation unit 106. Then, the modulated optical signal is input to the nonlinear optical waveguide G _i, is to develop a more irregular signal by a non-linear optical waveguide G _i. Further, photodiode P _i of each of the nonlinear optical waveguide G _i converts the optical signal output from the nonlinear optical waveguide G _i into an electrical signal.

On the other hand, the quantization unit 107, for example, is configured to include a comparator and two adders, each adder, the output of the same number of photodiode P _i is input. Each adder adds the input signal values, and outputs addition values Q ₁ and Q ₂ , respectively. The comparator compares the magnitudes of these two added values Q ₁ and Q ₂ and converts them into binary discrete values based on the magnitude.

Further, the parameter value generation unit 106 is configured by, for example, a thermal noise random number generation device or the like, appropriately generates a uniform random number, and uses the generated random number as a parameter value c _i to generate a random number random signal generation unit 105. To supply.

  Hereinafter, a detailed description of the operation of the random number generation unit 103 configured as described above will be given based on a mathematical model.

In FIG. 7, (N−1) driving irregular signals E ₁ , E ₂ ,..., E _N-1 are random phase light pulses generated by the random phase light pulse generator. 13) and formula (14).

Here, E _j is the electric field of light, k ₀ is the wave number of light, ω ₀ is the frequency of light, t is time, x is a coordinate along the light traveling direction (the incident surface of the optical waveguide is x = 0) ), Ξ is a variable defined by ξ = k ₀ x−ω ₀ t, and φ _j is a constant representing the initial phase. Note that the value of φ _j varies depending on j. A (ξ) is the amplitude of the optical pulse, A ₀ is a constant, and δ is a small positive real constant.

The j-th optical pulse E _j represented by Expression (13) is incident on the j-th optical waveguide after passing through the phase modulator M _j . In each phase modulator M _j , the phase of light is changed by θ _j as shown in the following equation (15).

The set of phase variation theta _j in each phase modulator _{M j} in FIG. _{7 (θ 1, θ 2,} ..., θ N-1) , the change input-output relationship of the random number for random signal generation unit 105 of FIG. 3 It corresponds to the parameter c to be made. As a simple case, consider the case of θ _j = 0 or π. A new parameter b _i ε {0, 1} (i = 0, 1,..., H−1) expressing the phase change amount is introduced, and the value of b _{i and} the value of θ _j are expressed by the following equation (16): It corresponds as follows.

In this example, it is assumed that b ₀ = 0, that is, θ _j = 0 (j mod h = 0). Therefore, the parameter c for changing the input / output relationship of the random signal generator for random number 105 is c = b ₁ b ₂ ... B when a set of b _i (i = 0, 1,. _h−1 ∈ {0, 1} can be expressed as ^h−1 .

The value of parameter c is randomly selected with equal probability from the set {0, 1} ^h−1 every time a random number is generated. Here, the random setting of the value of the parameter c can be realized by using, for example, a thermal noise random number generator that generates uniform random numbers from thermal noise. That is, a uniform random number generated by a thermal noise random number generator or the like is discretized into a binary value of (h−1) bits and set as a set value of c = b ₁ b ₂ ... B _h−1. .

In FIG. 7, the intensity of the light output from the nonlinear optical waveguide G _j (j = 0, 1,..., N−1) is increased by the photodiode P _j (j = 0, 1,..., N−1). It is converted into an electrical signal. Here, the intensity of the light output from the _jth nonlinear optical waveguide _Gj is represented by Ij. At this time, the number of optical waveguides (N-1) is assumed to be an odd number. In the comparator, two quantities Q ₁ and Q ₂ defined by the following equation (17) are compared.

Here, the output of the comparator is a binary random number X∈ {0,1}, and the actual value x∈ {0,1} is based on the result of comparing the _two quantities Q ₁ and Q _2. Is defined by the following equation (18).

  In order to generate a large number of binary random numbers (random number sequences) in the random number generator 103 described above, the driving irregular signal having a set of random initial phases that is different each time by the driving irregular signal generator 101. An optical pulse is generated, and the optical pulse is supplied to the random number generation unit 103. Then, the random number generation unit 103 is caused to repeatedly execute the operation described above.

  Next, in the correlated random number generation device 100 using the random number generation unit 103 having the configuration of FIG. 7, (Assumption 1) to (Assumption 3) provided when the mathematical model of the random number generation unit 103 is described is realized. This is explained using numerical calculation results for a mathematical model of a nonlinear optical waveguide array.

First, (Assumption 1) will be described. In the present embodiment, the physical quantity corresponding to the driving irregular signal w = (w _o , w _u ) is the amplitude and phase of the random phase light pulse. The amplitude A _{0 of the} optical pulse corresponds to an observable physical quantity, and the set of initial phases (φ ₁ , φ ₂ ,..., Φ _N−1 ) corresponds to a physical quantity that is difficult to observe. That is, w _o = A ₀ , w _u = (φ ₁ , φ ₂ ,..., Φ _N−1 ).

Therefore, the relative difference in the initial phase of the optical pulse is defined as, for example, Δφ _j = φ _j −φ ₁ (j = 2,..., N−1) with φ ₁ as a reference. At this time, the physical quantity that is difficult to observe is expressed as w _u = (φ ₁ , φ ₁ + Δφ ₂ ,..., Φ ₁ + Δφ _N−1 ), and the intensity I _j (j = 1) of the light output from the optical waveguide array. ,..., N-1) directly affect these initial phase differences.

Therefore, consider the measurement of a set of initial phase differences (Δφ ₂ ,..., Δφ _N-1 ). Since the phase of light cannot be measured directly, the initial phase difference Δφ _j can be measured by passing two lights branched from the first and jth optical pulses through an interferometer, and the input light intensity and output. The phase difference must be determined from the light intensity. Therefore, if the number N of optical waveguide arrays is sufficiently large, a large number of interferometers must be prepared, and the input / output light intensity must be measured after adjusting the incident timing of the two branched lights to the interferometer. Don't be. Since this measurement operation requiring a large number of interferometers is actually difficult, (Δφ ₂ ,..., Δφ _N-1 ) can be regarded as a physical quantity that is difficult to measure. As a result, the initial phase set (φ ₁ , φ ₂ ,..., Φ _N−1 ) itself can be regarded as a physical quantity that is difficult to measure.

Incidentally, in this embodiment, for the sake of simplification, coherent light such as Equation (13) is considered as an input optical pulse, and the initial phase φ _j is assumed to be a constant. However, incoherent light is used as an input optical pulse. It is also possible. When the coherent length is shorter than the optical pulse length, the phase φ _j is a function of ξ inside the optical pulse, and φ _j (ξ) changes on a very short scale depending on ξ. For this reason, in the case of incoherent optical pulse input, it is more difficult to measure the phase difference (Δφ ₂ ,..., Δφ _N−1 ).

Therefore, the electric field of the optical pulse in the _jth nonlinear optical waveguide Gj is expressed as the following equation (19).

Here, k is the wave number of light in the nonlinear optical waveguide G _j, xi] 'it is xi]' is a variable that is defined by = kx-ω _{0 t.} Since Expression (14) representing an optical pulse is assumed, Ψ _j (ξ ′, t) ≠ 0 is established only for a certain small section ξ′∈ [−δ ′, 0]. Therefore, a wavefront of ξ ′ = 0 is considered and defined as ψ _j (t) = ψ _j (0, t). At this time, the time evolution of ψ _j (t) in the nonlinear optical waveguide G _j is approximately described by the discrete nonlinear Schrödinger equation shown in the following equation (20) in the dimensionless form.

At the incident surface (x = 0) of the optical waveguide array, ψ _j (0) = A ₀ exp [i (φ _j + θ _j )], and the boundary condition is given by ψ ₀ (t) = ψ _N (t) = 0 It is done. The same applies to the time evolution of wavefronts corresponding to other values of ξ ′ included in the interval [−δ ′, 0]. The discrete nonlinear Schrödinger equation (Equation (20)) is a chaotic system and is known to exhibit random time evolution.

FIG. 8 is a diagram showing an example in which the state of time evolution of the solution ψ _j of the discrete nonlinear Schrödinger equation is numerically calculated. Here, in the numerical calculation of the discrete nonlinear Schrödinger equation (Equation (20)), the optical pulse array with N = 128 is an optical pulse having a uniform amplitude and a different initial phase φ _j for each nonlinear optical waveguide G _j. And the phase modulation amount θ _j at that time is set to θ _j = 0.

The graph shown in FIG. 8 shows the value of | ψ _j (t) | as a function of the optical waveguide number j and time t. From this graph, it can be seen that the amplitude of the light that is uniform at the time of incidence (| ψ _j (t) | = constant) changes very randomly with time. Therefore, since the intensity distribution of the output light of the optical waveguide array becomes very complicated, it can be determined that the assumption regarding the complexity of the function f in (Assumption 1) is realized.

Next, (Assumption 2) will be described. In the present embodiment, a set of phase variation theta _j in each phase modulator M _j, to correspond to a parameter c to vary the input-output relationship of the random number for random signal generation unit 105. The parameter c (c = b ₁ b ₂ ... B _h−1 ε {0, 1} ^h−1 ) is generated by, for example, a thermal noise generator every time a random number is generated. Therefore, since the operation corresponds to an operation of selecting one value with equal probability from the set {0, 1} ^h−1 , it can be determined that Assumption 2 is realized.

Finally, a numerical verification result indicating that (Assumption 3) is realized will be described. Here, consider the case where N = 16 and h = 4. Since h = 4, the parameter c is a 3-bit number c = b ₁ b ₂ b ₃ ε {0, 1} ³ . Since c is 3 bits, the number n of elements included in the set C of values that c can take is n = 2 ³ = 8. On the other hand, the set D including the random number X is D = {0, 1}. Therefore, the set D ⁿ including the output vector in (Assumption 3) is D ⁿ = {0, 1} ⁸ . Numbers from 0 to 255 can be numbered by converting the elements of D ⁿ from binary to decimal.

FIG. 9 is a diagram showing a histogram representing the frequency of appearance of an output vector with respect to a set of initial phases of various values based on numerical calculation of the discrete nonlinear Schrödinger equation. Here, an output vector for a set of initial phases of various values (φ ₁ , φ ₂ ,..., Φ _N−1 ) is discretely nonlinear under a condition where the incident light pulse amplitude is fixed to A ₀ = 0.5. It was obtained by numerical calculation of the Schrodinger equation (formula (20)). The vertical axis in FIG. 9 represents the appearance frequency (appearance probability) of the output vector on the set D ⁿ obtained by the numerical calculation, and the horizontal axis represents the element number k (k = 0, 1,...) Of the set D ⁿ . , 255). That is, FIG. 9 shows that the output vector is uniformly distributed on D ⁿ , so that it can be determined that Assumption 3 is realized.

  Based on the above verification, it was shown that the correlated random number generation device 100 using the random number generation unit 103 shown in FIG. 7 is a correlated random number generation source applicable to the secret key sharing application.

It is the figure which showed the example of the set of the random numbers in the mathematical model of a correlation random number source. It is the figure which showed the correspondence of the set of random numbers and the random number source in the mathematical model of the correlated random number source. It is the figure which showed the example of the structure of the correlation random number generator which concerns on embodiment of this invention. It is the figure which showed the example of the structure of the correlation random number generator when an eavesdropper exists in this embodiment. It is the figure which showed the example of the mathematical model showing the function of the random number generation part in the correlation random number generation device which concerns on this embodiment. FIG. 6 is a diagram showing a correspondence relationship between the correlation random number generation model shown in FIGS. 1 and 2 and the mathematical model of the random number generation unit shown in FIG. 5. It is the figure which showed the example of the concrete mounting structure of the random number generation part of the correlation random number generation device which concerns on this embodiment. It is the figure which showed the example which numerically calculated the mode of the time evolution of the solution (psi) _j of a discrete nonlinear Schrodinger equation. It is the figure which showed the histogram showing the appearance frequency of the output vector with respect to the set of the initial phase of various values based on the numerical calculation of a discrete nonlinear Schrodinger equation.

Explanation of symbols

100 Correlated Random Number Generator 101 Driving Irregular Signal Generation Unit (Driving Irregular Signal Generation Unit)
102 driving irregular signal transmission unit 103 first random number generation unit (random number generation unit)
104 Second random number generator 105, 108 Random number random signal generator (Random number random signal generator)
106, 109 Parameter value generation unit (parameter value generation means)
107,110 Quantization unit (quantization means)

Claims (8)

A correlation random number generation method for generating a correlation random number used in a secret key sharing cryptographic system,
A driving irregular signal generating step for generating a driving irregular signal using the first device that outputs a signal depending on a physical quantity whose value is difficult to measure;
A parameter value generating step of generating a uniformly random parameter value using a second device that outputs a uniformly random signal;
By using the third device that performs a complicated operation in which it is difficult to predict the output signal from the input signal, the driving irregular signal generated by the driving irregular signal generating unit is converted by the parameter value generating unit. Based on the generated parameter value, random number random signal generation step for further irregularly developing and generating random number random signal;
Quantizing the random signal for random number generated in the random signal generating step for random number to generate a discretized correlated random number;
A correlated random number generation method comprising: The first device is a random phase optical pulse generator;
The third device includes a plurality of nonlinear optical waveguides arranged so as to be adjacent to each other in parallel, and a plurality of phase modulators that respectively modulate signals input to the plurality of nonlinear optical waveguides. The correlation random number generation method according to claim 1, wherein the correlation random number generation method is a device constituted by: The correlation random number generation method according to claim 1, wherein the second device is a thermal noise random number generator. The random signal generated in the random signal random signal generation step is quantized using an adder and a comparator in the quantization step. 2. A correlated random number generation method according to claim 1. A correlation random number generator for generating a correlation random number used in a secret key sharing cryptographic system,
A driving irregular signal generating means for generating a driving irregular signal using the first device that outputs a signal that depends on a physical quantity whose value is difficult to measure;
Parameter value generating means for generating a uniformly random parameter value using a second device that outputs a uniformly random signal;
By using the third device that performs a complicated operation in which it is difficult to predict the output signal from the input signal, the driving irregular signal generated by the driving irregular signal generating unit is converted by the parameter value generating unit. Based on the generated parameter value, random number random signal generating means for further irregularly developing and generating a random number random signal;
Quantizing means for quantizing the random signal for random number generated by the random signal generating means for random number and generating discretized correlated random numbers;
A correlation random number generator characterized by comprising: The first device is a random phase optical pulse generator;
The third device includes a plurality of nonlinear optical waveguides arranged so as to be adjacent to each other in parallel, and a plurality of phase modulators that respectively modulate signals input to the plurality of nonlinear optical waveguides. 6. The correlation random number generation device according to claim 5, wherein the correlation random number generation device is configured as follows. The correlated random number generator according to claim 5 or 6, wherein the second device is a thermal noise random number generator. The said quantization means is comprised including an adder and a comparator, and quantizes the random number random signal produced | generated by the said random number random signal production | generation means. 8. The correlation random number generator according to any one of items 7 to 9.

Images