JP2012044310A - Quantum cryptographic device and cryptographic key evaluation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a quantum cryptographic device which can evaluate the reliability of a cryptographic secret key, independent of measurement of the absolute value of light intensity.SOLUTION: There is provided a quantum cryptographic device which transmits photons including secret key information to a receiving device, comprising a light source which satisfies that the secondary intensity correlation measurement g(0), that is the index of ratio of multi-photons, is less than one: g(0)<1, a splitter which splits the photon pulse emitted from the light source into a key generating photon pulse for generating a secret key candidate and an evaluating photon pulse for evaluating g(0), a statistic evaluating unit which measures the g(0) of the evaluating photon pulse split by the splitter and removes the measurement noise from the measured g(0) to determine the statistic evaluation data of the g(0), and a data analyzing unit which notifies the receiving device of the statistic evaluation data of the g(0) determined by the statistic evaluating unit, in order to check the security on a plurality of secret key candidates after transmitting the plural secret key candidates to the receiving unit.

Description

  The present invention relates to a quantum cryptography device that performs quantum cryptography key distribution that transmits a cryptographic secret key using photons, and an encryption key evaluation method.

  With the explosive spread of the Internet and the commercialization of electronic commerce, there is an increasing social need for cryptographic technologies such as maintaining confidentiality of communications, preventing tampering, and personal authentication. Currently, a common key method such as DES encryption and a public key method such as RSA encryption are widely used. However, these are based on “computational safety”. In other words, current cryptosystems are constantly threatened by advances in computer hardware and decryption algorithms. In particular, in fields where extremely high security is required, such as transactions between banks and information related to military and diplomacy, the impact will be great if practically secure encryption methods are put into practical use.

  There is a one-time pad method as an encryption method whose unconditional security is proved by information theory. The one-time pad method is characterized in that an encryption key having the same length as the communication text is used, and the encryption key is discarded once. In Non-Patent Document 1, Bennett et al. Proposed for the first time a specific quantum cryptographic key distribution protocol that is widely known as the BB84 protocol and that securely distributes a cryptographic private key used in the one-time pad method. It was. As a result, research on quantum cryptography has become active. In quantum cryptography, the laws of physics guarantee the security of cryptography, which makes it possible to guarantee the ultimate security independent of computer capabilities. Currently, quantum cryptography devices that are being studied a lot encode 1-bit information into a single photon state and transmit it. This is due to the fact that the state of a single photon can be manipulated with high accuracy and the information encoded in the photon is resistant to environmental disturbances.

  In a quantum cryptography device whose security has been theoretically proved, as described in Non-Patent Document 1, two distinct states of a quantum mechanical two-degree-of-freedom system and a complementary state thereof (there are The secret key is transmitted securely using the superposition state. An eavesdropping act disturbs the quantum mechanical state, and the protocol is designed so that the amount of leaked information can be estimated from errors in the data of authorized senders and receivers. Such quantum states used for information communication are often referred to as quantum information. A quantum mechanical two-degree-of-freedom system carrying quantum information is called a qubit and is mathematically equivalent to a spin 1/2 system. Quantum information carried on a qubit is specified only by specifying 1-bit data (0 or 1) and its base.

  In cipher key distribution using photons as quantum bit carriers, implementation of a quantum cryptography device (Non-Patent Document 1) called “polarization coding” that encodes information into two polarization states that a photon propagating in space can have, Implementation of a quantum cryptography key distribution system (Non-Patent Documents 2 to 4) called “phase coding” that encodes information into a relative phase shift value between two single photon pulses is known. Polarization coding is known as a system suitable for a quantum cryptography system for spatial transmission, and phase coding is known as a system suitable for an existing quantum cryptography system for an optical fiber communication network.

  FIG. 5 is a block diagram illustrating a configuration example of a quantum cryptography key distribution system based on phase coding disclosed in Non-Patent Documents 2-4.

  As shown in FIG. 5, the transmission apparatus 20 includes a pulse light source 21 that periodically generates photon pulses, an asymmetric Mach-Cehnder interference system 22, and a random number generator 23. The receiving device 40 includes an asymmetric Mach-Cehnder interference system 42, a random number generator 43, photon detectors 48 and 49, and a time recording unit 41. The asymmetric Mach-Cender interfering system 22 and the asymmetric Mach-Cender interfering system 42 are connected by a transmission line 26. The asymmetric Mach-Cehnder interference system 22 is internally branched into two optical paths, and a phase modulator 25 is provided on one of the two optical paths. The asymmetric Mach-Cender interferometer 42 is internally branched into two optical paths, and a phase modulator 45 is provided on one of the two optical paths.

  The operation of the quantum key distribution system shown in FIG. 5 will be briefly described.

  A photon pulse generated by the pulse light source 21 is incident on an asymmetric Mach-Zehnder interference system 22 in which a phase modulator 25 is included in one arm. Due to the action of the asymmetric Mach-Zehnder interference system 22, the photon pulse is emitted to the transmission line 26 as a pair photon pulse. The relative phase shift of the pair photon pulse is subjected to 4-level random modulation by the phase modulator 25 based on the 2-bit random number generated by the random number generator 23. Then, the pair photon pulse is emitted from the transmission device 20 to the reception device 40 via the transmission path 26.

  The pair photon pulses are incident on an asymmetric Mach-Zehnder interference system 42 in which a phase modulator 45 is included in one arm. The pair photon pulse is subjected to binary random modulation by the phase modulator 45 based on the 1-bit random number generated by the random number generator 43 and then emitted to two output ports. One of the two output ports is connected to the photon detector 49, and the other is connected to the photon detector 48. A photon pulse emitted through each of the two output ports is composed of three time components corresponding to combinations of photon pulse passing paths in the asymmetric Mach-Zehnder interference system 22 and the asymmetric Mach-Zehnder interference system 44. Among these, the interference component depending on the phase modulation in the phase modulators 25 and 45 is the second temporal component pulse in terms of time and is called a center pulse. Other photon pulse components are called satellite pulses.

  In the quantum cryptography key distribution system shown in FIG. 5, the photon detector 49 operates in accordance with a gate signal from a gate signal generator (not shown), so that only the arriving photon in the center pulse is selectively detected. The photon arrival time is recorded in the time recording unit 41. Based on the photon detection record including the photon arrival time information recorded by the time recording unit 41, the authorized user of the receiving device 40 performs analysis while communicating with the authorized user of the transmitting device 20 to obtain the key. The shift key that is a candidate for is extracted. The error in the shift key is deleted by communicating between authorized users of both the transmitting device 20 and the receiving device 40 and performing error correction processing. By communicating between authorized users and executing a confidentiality enhancement process based on the error rate in the shift key to shorten the key, the possibility of information leakage to the eavesdropper is eliminated, and a secure private key Is obtained.

  Next, features and problems common to the receiving apparatus used in the above-described quantum cryptography key distribution system will be described.

  In the implementation using a single photon as a carrier, the security of the encryption secret key shared by the quantum encryption key distribution protocol can be proved strictly theoretically. In this case, the security of the key depends only on the error contained in the shift key extracted from the photons arriving at the receiving device. However, the light source used in the implementation of an actual quantum key distribution system is not a strict single photon light source. For example, in the simplest implementation, a weak laser light pulse that is sufficiently attenuated so that the average number of photons in the pulse is 1 or less is used. The photon distribution statistic of this light source is a Poisson photon statistic, which has a large number of pulses containing zero or one photon (denoted as vacuum or single photon), but two or more photons (hereinafter, many A pulse (denoted as a photon) is generated with a finite probability. Also, in more future single-photon light source implementations, such as on-demand and heralded single-photon light sources, the multi-photon pulse generation probability can be significantly smaller than Poisson photon statistics, but it is zero It is not easy to guarantee that.

  Under such conditions, the risk of an eavesdropping attack by an eavesdropper cannot be excluded, so it is necessary to increase the secrecy more cautiously. Well known to. In quantum cryptography key distribution, an eavesdropper evaluates the security of a key under the rule that no condition is imposed on the eavesdropping strategy unless it violates the laws of physics. With a photon extraction attack, under the BB84 protocol, an eavesdropper can obtain complete information from one photon in a multiphoton pulse and deliver the remaining photons to the receiver. As a result, for multiphoton pulses, complete key information can be obtained without leaving evidence in the arriving photons, thus increasing the risk of error-free attack. In addition to this, an eavesdropper must be able to control the optical loss and photon detection efficiency of the line and receiver.

  An eavesdropper makes the best use of this advantage and gives each pulse an optical loss that depends on the number of photons in the pulse. The rate of arrival to can be increased. That is, the eavesdropper increases the optical loss of the single photon pulse component and decreases the optical loss of the multiphoton pulse component. As a result, as long as a legitimate user increases confidentiality based on a single photon transmission model, an eavesdropper can acquire a larger amount of key information. Therefore, a legitimate user needs to enhance confidentiality based on stricter standards, such as taking measures based on a photon extraction attack scenario in order to guarantee the security of the key.

  The points of the above photon extraction strategy are summarized as follows. Under the standard BB84 protocol, legitimate users encode the same 1-bit orthogonal information for multiphotons, giving the eavesdropper the advantage of error-free attack, The advantage is that the optical loss and the photon detection efficiency of the line and the receiving device can be controlled without being known by a regular user.

  As a countermeasure against the above-mentioned photon extraction attack, Hoon Wong Yang invented the decoy photon method in 2003 (see Non-Patent Document 5), and this method has been widely used in practical quantum cryptography systems. . In this method, in addition to the real signal light pulse for transmitting the key data, light pulses having different intensities as decoys are randomly mixed to extract data that can be effectively used as a key by the receiving side. A regular user can evaluate the proportion of components caused by dangerous multiphoton pulses in the arriving light pulse by comparing the detection probability of the signal light pulse and the decoy light pulse after quantum communication. With regard to these dangerous pulses, it is assumed that the eavesdropper has complete information regardless of bit errors, and it is possible to leak information to the eavesdropper by executing a confidentiality enhancement process and shortening the key. The property is erased and a secure private key is obtained. The points of this method are as follows.

  In the original BB84 protocol, the quantum channel in the corresponding space is evaluated by performing a statistical error test on the arrival photon in the physical space that encodes key information such as polarization and phase. Wiretapping changes the characteristics of the quantum channel from the identity channel to the depolarized channel. Therefore, by evaluating the characteristics of the quantum channel, it is possible to detect the presence of an eavesdropping action and theoretically suppress the upper limit of information leakage to the eavesdropper.

  On the other hand, photon extraction attacks change the characteristics of quantum channels in the photon number space. In order to detect this, it is necessary to make probe light having several different photon statistics enter the quantum channel and statistically evaluate the characteristics of the output light. The decoy light pulse is used to evaluate the characteristics of the quantum channel in the photon number space. The evaluation accuracy of the upper limit of the amount of information leaked to an eavesdropper depends on the accuracy of measurement of the photon statistics of the incident light pulse as well as the accuracy of the measuring device, in other words, the accuracy of control of the intensity. A general light source has a fluctuation in intensity, and the determination accuracy of the value depends on the accuracy of an external test apparatus such as a power meter.

International Conference on IEEE Computers, Systems, and Signal Processing by Bennett and Brassard (IEEE Int. Conf. On Computers, Systems, and Signal Processing, Bangalore, India, p. 175 (1984)) Zbinden et al., “Experimental Quantum Cryptography”, “INTRODUCTION TO QUANTUM COMPUTATION AND INORMATION” (World Scientific, 1998), pages 120-126 Ekert et al., “Quantum Cryptography”, “The Physics of Quantum Information (edited by Bouwmeester et al.)” (Springer, 2000), 15 pages Gisin et al., “Quantum Cryptography” Review of Modern Physics, Rev. Mod. Phys., 74 (2002), pages 145-195 Yang Phys. Rev. Lett. 91, 057901 (2003). Gottesman et al., Quantum Inf. Comput. 4, 325-360 (2004).

  The light intensity measurement is an absolute value measurement. Although this type of measurement is performed using a photoelectric conversion device such as a photodetector, it is necessary to calibrate the detection efficiency, which is a proportionality factor, together with the linearity between the light intensity and the output electric signal. The detection efficiency of the test device needs to be recalibrated frequently due to changes over time. Even if the detection efficiency is known, it is difficult to grasp the effective detection efficiency including external factors such as loss during optical coupling, and there is often a risk of evaluating the light intensity at a low level. At this time, since the actual operational light intensity is increased, there is a risk that the upper limit of the amount of information leaked to an eavesdropper is evaluated lower. In this way, the reliability of security may be questioned for the current system that requires evaluation of the absolute value of light intensity, and the quantum cryptography key distribution system that does not depend on measurement of the absolute value of light intensity Development of was desired.

  The present invention has been made to solve the above-described problems of the technology, and makes it possible to evaluate the reliability of the encryption secret key without depending on the absolute value measurement of the light intensity. An object of the present invention is to provide a quantum cryptography device and a cryptographic key evaluation method.

In order to achieve the above object, a quantum cryptography apparatus of the present invention is a quantum cryptography apparatus that transmits a photon including secret key information to a receiving apparatus,
For the second-order intensity correlation coefficient g ⁽²⁾ (0), which is an indicator of the ratio of multiphotons, a light source that satisfies g ⁽²⁾ (0) <1,
The photon pulse emitted from the light source is converted into a key generation photon pulse for generating a secret key candidate that is the secret key candidate and an evaluation photon pulse for evaluating g ⁽²⁾ (0). A splitter to separate,
Measured g ⁽²⁾ (0) of the evaluation photon pulses separated by the splitter, the statistical evaluation of the measured g ⁽²⁾ wherein to remove measurement noise from (0) g ⁽²⁾ (0) A statistical evaluation unit for data,
After transmitting a plurality of secret key candidates to the receiving device, the g ⁽²⁾ (0) statistical evaluation data obtained by the statistical evaluation unit is used for security evaluation of the plurality of secret key candidates. A data analysis unit for notifying the receiving device;
It is the structure which has.

Further, the encryption key evaluation method of the present invention is an encryption key evaluation method by a transmitting device that transmits photons including secret key information to a receiving device,
For the second-order intensity correlation coefficient g ⁽²⁾ (0), which is an index of the ratio of multiphotons, a photon pulse emitted from a light source satisfying g ⁽²⁾ (0) <1 is a candidate for the secret key The key generation photon pulse for generating the secret key candidate and the evaluation photon pulse for evaluating g ⁽²⁾ (0) are separated,
The measured g ⁽²⁾ (0) with respect to the separated the evaluation photon pulses, statistical evaluation of the measured g ⁽²⁾ wherein to remove measurement noise from (0) g ⁽²⁾ (0) Seeking data,
After the plurality of secret key candidates are transmitted to the receiving device, the g ⁽²⁾ (0) statistical evaluation data is notified to the receiving device for security evaluation of the plurality of secret key candidates. is there.

  According to the present invention, it is possible to evaluate the reliability of the encryption secret key using a realistic photon light source without depending on the absolute value measurement of the light intensity, thereby improving the security reliability of the encryption secret key. be able to.

It is a block diagram which shows the example of 1 structure of the quantum encryption key distribution system of this embodiment. FIG. ² is a block diagram illustrating a configuration example of a g ⁽²⁾ (0) statistical evaluation unit illustrated in FIG. 1. It is a flowchart which shows the procedure from the statistical measurement of g ⁽²⁾ (0) by the transmitting apparatus of this embodiment to notifying the result to a receiving apparatus. It is an example of the histogram measured by g ⁽²⁾ (0) statistical evaluation part shown in FIG. It is a block diagram which shows one structural example of the related quantum encryption key distribution system.

  The configuration of the quantum key distribution system of this embodiment will be described. FIG. 1 is a block diagram showing a configuration example of a quantum key distribution system according to this embodiment.

The quantum cryptography key distribution system has two quantum cryptography devices including a transmission device 10 and a reception device 30. As illustrated in FIG. 1, the transmission device 10 includes a photon source 11, a beam splitter 19, a random number generator 13, a g ⁽²⁾ (0) statistical evaluation unit 17, and a data analysis unit 14. The receiving device 30 includes a decoder 32, a photon detector 39, a random number generator 33, and a data analysis unit 34.

  The encoder 12 of the transmitting device 10 and the encoder 32 of the receiving device 30 are connected by a quantum channel 16 for transmitting photon pulses. The data analysis unit 14 and the data analysis unit 34 serve as signal lines for communicating the analysis results, and each of the transmission device 10 and the reception device 30 is a classical channel whose communication partner has been authenticated (hereinafter simply referred to as a classical channel). 36 is connected.

The photon source 11 is a sub-Poisson light source (non-ideal single-photon light source) that satisfies the second-order intensity correlation coefficient g ⁽²⁾ (0) g ⁽²⁾ (0) <1 that is an index of the ratio of multiphotons. It is. In the case of a light source in which most of the emitted photon pulses are multiphotons, g ⁽²⁾ (0)> 1, and in the case of a light source that emits an ideal single photon, g ⁽²⁾ (0) = 0. In this embodiment, a photon pulse by a sub-Poisson light source is used instead of a photon pulse by a weak laser beam.

The g ⁽²⁾ (0) statistical evaluation unit 17 measures g ⁽²⁾ (0) on-site during the key generation operation with respect to the photon pulse separated by the beam splitter 19. g ⁽²⁾ (0) Statistical evaluation unit 17, the measured g ⁽²⁾ (0) from the removal of the measurement noise g ⁽²⁾ is a statistical measure of the (0) g ⁽²⁾ (0) Statistics Obtain evaluation data. g ⁽²⁾ (0) The configuration of the statistical evaluation unit 17 will be described in detail later.

  The random number generator 13 supplies the encoder 12 with time-tagged 2-bit random number data for the encoder 12 to encode the photons and generate raw key random number data that is a secret key candidate. The random number generator 33 supplies the decoder 32 with time-tagged 1-bit random number data for decrypting the secret key candidate.

  The data analysis unit 14 includes a storage unit 141 and a control unit 142. The control unit 142 is provided with a CPU (Central Processing Unit) (not shown) that executes predetermined processing according to a program, and a memory (not shown) for storing the program. The data analysis unit 34 includes a storage unit 341 and a control unit 342. The control unit 342 is provided with a CPU (not shown) that executes predetermined processing according to a program and a memory (not shown) for storing the program.

The control unit 142 and the control unit 342 are configured such that, after the transmitting device 10 and the receiving device 30 share a plurality of raw key random number data, the data stored in the own device and the counterpart device with respect to some raw key random number data randomly sampled The error statistical evaluation data during transmission of the secret key candidate is obtained by comparing with the data stored in. In addition, the control unit 142 notifies the control unit 342 of the reception device 30 of the g ⁽²⁾ (0) statistical evaluation data obtained by the g ⁽²⁾ (0) statistical evaluation unit 17. The control unit 142 and the control unit 342 use the error statistical evaluation data and the g ⁽²⁾ (0) statistical evaluation data to perform safety evaluation on a plurality of raw key random number data, and secure the plurality of raw key random number data. Extract the private key.

  In the present embodiment, as a function of the photon detector 39, measurement of the absolute value of the light intensity is not essential. Even the photon detector 39 with unknown detection efficiency can be used for the receiving device 30 without any problem.

FIG. 2 is a diagram illustrating a configuration example of the g ⁽²⁾ (0) statistical evaluation unit illustrated in FIG. The configuration example shown in FIG. 2 shows an example in which g ⁽²⁾ (0) is measured by applying a standard Hanbury Brown and Twis intensity interference system.

As shown in FIG. 2, the g ⁽²⁾ (0) statistical evaluation unit 17 includes an optical coupler 53, photon detectors 55 and 56, a gate signal generator 57, and a time analysis unit 58. The photon pulse reflected by the beam splitter 19 is input to the input port of the optical coupler 53. FIG. 2 shows photon pulses 51 and 52 as examples of photon pulses.

Of the two output ports of the optical coupler 53, the transmission path of one output port is connected to the photon detector 55, and the transmission path of the other output port is connected to the photon detector 56. The output ports of the photodetectors 55 and 56 are connected to the time analysis unit 58. Here, it is assumed that a photon pulse is sampled by the g ⁽²⁾ (0) statistical evaluation unit 17 from the beam splitter 19 with a period T1.

  The gate signal generator 57 transmits a gate signal for operating the photon detectors 55 and 56 to the photon detectors 55 and 56 at a period T2 (= (1/2) T1). When receiving a photon detection signal, which is a signal when the photon detectors 55 and 56 detect photon pulses, from the photon detectors 55 and 56, the time analysis unit 58 records the time as the photon arrival time.

The time analysis unit 58 records the frequency and the photon arrival time when the photon detectors 55 and 56 simultaneously detect the photons and records the noise caused by the photon detectors 55 and 56 between the photon detections. Record and calculate a statistical measurement value after removing noise by the photon detectors 55 and 56 for g ⁽²⁾ (0). Details of the calculation method will be described later.

In the g ⁽²⁾ (0) statistical evaluation unit of the present embodiment, a gate mode operation type photon detector that operates when a gate signal is input is described. A photon detector of a non-gate mode operation type that operates without it may be used. In this case, the measurement noise of the photon detector may be measured in advance.

Next, the operation of the quantum cryptography key distribution system of this embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing a procedure from the statistical measurement of g ⁽²⁾ (0) to notification of the result to the reception device 30 by the transmission device 10.

In FIG. 1, a part of the photon pulse generated by the photon source 11 is separated by the beam splitter 19 (step 101) and is incident on the g ⁽²⁾ (0) statistical evaluation unit 17. g ⁽²⁾ (0) photon pulse incident on the statistical evaluation section 17, g ⁽²⁾ (0) by statistical evaluation unit 17, in the key generation operation on site g ⁽²⁾ (0) Statistical evaluation data Is obtained (step 102), and the result is stored in the storage unit 141 of the data analysis unit 14. The remaining photon pulses separated by the beam splitter 19 are four-value modulated by the encoder 12 based on the time-tagged 2-bit random number data generated by the random number generator 13 and then sent to the quantum channel 16. The time-tagged 2-bit random number data used for the modulation is stored in the storage unit 141 of the data analysis unit 14.

Note that the photon pulse incident on the encoder 12 corresponds to a key generation photon pulse for generating a secret key candidate, and g ⁽²⁾ (0) The photon pulse incident on the statistical evaluation unit 17 is g ^{(2 This} corresponds to an evaluation photon pulse for evaluating (0).

  The photon pulse transmitted to the receiving device 30 through the quantum channel 16 is decoded by the decoder 32 based on the 1-bit random number data generated by the random number generator 33 and detected by the photon detector 39. In addition, the random number generator 33 stores the used 1-bit random number data information in the storage unit 341 of the data analysis unit 34. The data analysis unit 34 stores the 1-bit random number data with the time tag obtained for the arrival photon in the storage unit 341.

Here, an example of how the g ⁽²⁾ (0) statistical evaluation unit 17 obtains g ⁽²⁾ (0) statistical evaluation data will be described with reference to FIG. If the repetition period at which the photon pulse from the beam splitter 19 enters the g ⁽²⁾ (0) statistical evaluation unit 17 is 100 ns, the gate signal transmitter 57 is gated at 20 MHz (corresponding to twice the frequency of the repetition period). The signal is transmitted to photon detectors 55 and 56.

  Photon pulses 51 and 52 incident at a period of 100 ns enter the input port of the optical coupler 53. FIG. 2 shows a state in which two photon pulses 51 and 52 are incident with a time of 100 ns. Photon pulses that have reached the optical coupler 53 are separated by the optical coupler 53. Of the two separated photon pulses, one photon pulse is guided to the photon detector 55 and the other photon pulse is guided to the photon detector 56. A gate signal is input to the photon detectors 55 and 56 from the gate signal generator 57 at a frequency of 20 MHz. Thereby, the photon detectors 55 and 56 operate in synchronization with the arrival of the photons. These photon detectors do not require absolute measurement of light intensity. The photon detection signal is guided to the time analysis unit 58, and the photon arrival times in the two photon detectors 55 and 56 are recorded.

  With respect to the photon detection time difference ΔT between the two photon detectors 55 and 56, a histogram in which the event frequency P (ΔT) corresponding to each half period (50 ns in this example) is plotted is obtained. FIG. 4 is an example of a histogram. The horizontal axis of the graph shown in FIG. 4 is time, and the vertical axis indicates event frequency. The simultaneous detection of photon pulses by the photon detectors 55 and 56 corresponds to an event. The event frequency record shows the result in the case of 1 hour in FIG. 4, but is not limited to this time, and actually, from the transmission start time of a plurality of secret key candidates from the transmission device 10 to the reception device 30. This is the time until the transmission end time.

  As shown in FIG. 4, the histogram is data that repeatedly increases and decreases every 50 ns. In the graph shown in FIG. 4, the histogram of the decrease component is extremely small compared to the histogram of the increase component, and is indicated by a value close to the bottom of the graph. This is because the photon detectors 55 and 56 did not actually detect the photon pulse, but the photon detectors 55 and 56 erroneously detected due to noise. Noise that causes this erroneous detection corresponds to measurement noise.

Of the increasing and decreasing data, g ⁽²⁾ (0) can be evaluated by analyzing the data corresponding to the increasing component (cycle = 100 ns), and detected by analyzing the data corresponding to the decreasing component (cycle = 100 ns) Can evaluate the instrument noise. Therefore, the true value of g ⁽²⁾ (0) can be evaluated by taking the difference between these evaluation values. The time analysis unit 58 obtains g ⁽²⁾ (0) statistical evaluation data based on a value obtained by subtracting the event frequency corresponding to the decrease component from the event frequency corresponding to the increase component.

  Returning to the description of the operation of the quantum key distribution system of this embodiment. The control unit 142 of the data analysis unit 14 and the control unit 342 of the data analysis unit 34 use the classical channel 36 to perform time tagging on the time-tagged random number data stored in the storage unit 141 and the storage unit 341, respectively. Are extracted in correspondence with each other and made public, and the raw key random number data is extracted from the storage unit of each device. And the control part 142 and the control part 342 are preserve | saved in each of the memory | storage part 141 and the memory | storage part 341 so that some raw key random number data random-sampled in this way and other raw key random number data can be distinguished. .

The control unit 142 and the control unit 342 compare the data stored in the own device with the data stored in the partner device for a part of the randomly sampled raw key random number data, so that the secret key candidate is being transmitted. Get error statistics evaluation data. Further, in the present embodiment, the control unit 142 of the transmission device 10 notifies the control unit 342 of the reception device 30 of g ⁽²⁾ (0) statistical evaluation data stored in the storage unit 141 (step 103).

Measurements of loss η from the photon source 11 to the entrance of the quantum channel 16 can be performed without depending on the absolute value measurement of the light intensity, g ^{(2) (0)} as <0.01 is satisfied g ⁽²⁾ ( When 0) is small, the probability p _{multi of} multiphoton pulses at the entrance of the quantum channel can be suppressed to p _multi <(1/2) g ⁽²⁾ (0) η ² .

According to the safety standards of the quantum key distribution using incomplete devices (Non-patent Document 6), the evaluation formula p _multi upper limit of the probability p _multi multiphoton pulses in quantum channels inlet <(1/2) g ^{( 2) The} key shortening rate necessary to obtain a secure secret key can be obtained from (0) η ² and error statistical evaluation data. Based on this, the control unit 142 and the control unit 342 can extract a secure secret key from the remaining raw key random number data by executing the confidentiality enhancement protocol.

According to the quantum cryptography apparatus of the present embodiment, in the quantum cryptography key distribution system using a realistic photon light source, the security evaluation of the cryptographic secret key is performed using g ⁽²⁾ (0) statistical evaluation data. Therefore, it is not necessary to use a photon detector that requires absolute value measurement of light intensity. Therefore, the reliability of the encryption secret key can be evaluated without depending on the measurement of the absolute value of the light intensity, and the security reliability of the encryption secret key can be improved.

g ⁽²⁾ (0) As a function of the photon detector included in the statistical evaluation unit 17, it is not necessary to measure the absolute value of the light intensity. However, when there is noise in the photon detector, only one photon detector is used. ^{(2) When} (0) is measured, g ⁽²⁾ (0) is overestimated. In this embodiment, the g ⁽²⁾ (0) statistical evaluation unit 17 separates the noise component of the photon detectors 55 and 56 from the g ⁽²⁾ (0) measurement value, and the noise component is g ⁽²⁾ ( 0) Since it is removed from the measured value, g ⁽²⁾ (0) can be prevented from being overestimated.

Further, g ^{(2) (0)} According to the statistics evaluation unit ^{17, g (2) (0} ) rating because performed locally at the transmitting device within 10, without giving chink that attached to an eavesdropper, the measured g ^{(2 )} It is possible to remove the contribution due to noise from (0).

DESCRIPTION OF SYMBOLS 10 Transmission apparatus 30 Reception apparatus 11 Photon source 12, 32 Encoder 13, 33 Random number generator 14, 34 Data analysis part 17 g ⁽²⁾ (0) Statistical evaluation part 39, 55, 56 Photon detector 53 Optical coupler 54 Optical delay Road 58 Time Analysis Department

Claims (3)

A quantum cryptography device that transmits a photon including secret key information to a receiving device,
For the second-order intensity correlation coefficient g ⁽²⁾ (0), which is an indicator of the ratio of multiphotons, a light source that satisfies g ⁽²⁾ (0) <1,
The photon pulse emitted from the light source is converted into a key generation photon pulse for generating a secret key candidate that is the secret key candidate and an evaluation photon pulse for evaluating g ⁽²⁾ (0). A splitter to separate,
Measured g ⁽²⁾ (0) of the evaluation photon pulses separated by the splitter, the statistical evaluation of the measured g ⁽²⁾ wherein to remove measurement noise from (0) g ⁽²⁾ (0) A statistical evaluation unit for data,
After transmitting a plurality of secret key candidates to the receiving device, the g ⁽²⁾ (0) statistical evaluation data obtained by the statistical evaluation unit is used for security evaluation of the plurality of secret key candidates. A data analysis unit for notifying the receiving device;
A quantum cryptography device. The quantum cryptography device according to claim 1,
The statistical evaluation unit
An optical coupler that separates the evaluation photon pulse incident from the splitter at a predetermined period into two photon pulses;
A first photon detector that detects one of the two photon pulses separated by the optical coupler via a first transmission path;
A second photon detector for detecting the other photon pulse of the two photon pulses separated by the optical coupler via a second transmission path;
The first frequency, which is the frequency at which the first and second photon detectors simultaneously detect photon pulses, and the frequency at which the first and second photon detectors misdetect by noise within a predetermined time. The second frequency is recorded, the difference between the first frequency and the second frequency is calculated, and the statistical evaluation data of g ⁽²⁾ (0) is calculated based on the value of the difference. The time analysis section
A quantum cryptography device. An encryption key evaluation method by a transmitting device that transmits a photon including secret key information to a receiving device,
For the second-order intensity correlation coefficient g ⁽²⁾ (0), which is an index of the ratio of multiphotons, a photon pulse emitted from a light source satisfying g ⁽²⁾ (0) <1 is a candidate for the secret key The key generation photon pulse for generating the secret key candidate and the evaluation photon pulse for evaluating g ⁽²⁾ (0) are separated,
The measured g ⁽²⁾ (0) with respect to the separated the evaluation photon pulses, statistical evaluation of the measured g ⁽²⁾ wherein to remove measurement noise from (0) g ⁽²⁾ (0) Seeking data,
After transmitting a plurality of secret key candidates to the receiving device, the g ⁽²⁾ (0) statistical evaluation data is notified to the receiving device for security evaluation of the plurality of secret key candidates. Key evaluation method.

Images