JP2014232989A - Quantum encryption key distribution device, transmitting device, receiving device, quantum encryption key distribution method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform efficient and safe key generation without extremely reducing a light intensity of decoy light, and to generate a safe key from an ensemble of signal light sending events of both straight and diagonal polarization bases, and make a protocol approach a quantum entanglement-based protocol to make safety certification approach a firm one.SOLUTION: A quantum encryption key distribution device 100 includes a transmitting device 10, a receiving device 15, and a transmission path 14. The transmitting device 10 has: a coherent light source part 11 generating coherent light to be transmitted to the transmission path 14; a modulator 12 modulating a polarization state of the coherent light at random; and an attenuation part 13 for attenuating an average photon number of the coherent light at random. The receiving device 15 includes: a pseudo single photon light source part 1B generating pseudo single photon light; and a partial Bell state measurement part 18 measuring a quantum-mechanical correlation between the polarization states of the coherent light as a carrier photon received from the transmission path 14 and of the pseudo single photon light.

Description

  The present invention relates to a quantum cryptography key distribution device, a transmission device, a reception device, a quantum cryptography key distribution method, and a program, and to a technique for efficiently and safely generating a key.

  With the explosive spread of the Internet and the commercialization of electronic commerce, the social needs of cryptographic technologies such as confidentiality and tampering prevention of communication and personal authentication are increasing. Quantum cryptographic key distribution technology, which is a technology for sharing a secure secret key, is attracting attention.

  FIG. 4 is a block diagram illustrating a conventional general quantum key distribution device including an eavesdropping device. In the conventional quantum cryptography key distribution apparatus, the transmission apparatus 61 includes a light source 62 that generates photons, a 2-bit random number generator 63, and an encoder 64 that codes the key data and the modulation base state into a photon state based on the light source 62. On the other hand, the receiving device 68 includes a 1-bit random number generator 69, a decoder 6A that modulates the observation ground state into photons based on the random number generator 69, and a photon detector 6B that generates a signal serving as key data. The transmission device 61 and the reception device 68 are connected by an optical transmission line 66. The eavesdropping device 67 is inserted in the middle of the optical transmission path 66 and can freely access the optical transmission path 66 and any signals propagated thereby.

  Quantum cryptographic key distribution protocol has characteristics that modern cryptography can prove its security, but in proof of its security, the transmission / reception device can be trusted and leaks key data, encoding and decoding base information, Or it is assumed a priori that there is no side channel which controls these from the outside. However, since the quantum key distribution device has a transmission path for key transmission, an input / output channel to the transmission path necessarily exists. This input / output channel to the transmission path can be a security risk. The problem is that there may be side channels that pass through this transmission path, and the side channel 65 that leaks key data, encoding and decoding base information on the transmission side, and the side that controls these from the outside on the reception side. The channel 6C is an important security issue.

  The theoretical model assumes an ideal component device, whereas a device used in reality has various characteristics different from the ideal and causes security vulnerabilities. Quantum hacking of a quantum cryptography key distribution device that exploits such vulnerability has been proposed. A transmission side channel used for quantum hacking is known to be generated by expanding the state space of a photon pulse serving as an information carrier due to non-ideality of a light source. In the standard safety proof, it is assumed that the light source produces only a single photon. However, in an actual quantum cryptography key distribution device, a weak laser light source or a pseudo single photon light source is used. These non-ideal light sources include states other than the single photon state (vacuum state and multi-photon state), and the possibility of side channel attack using this opens. Although a photon number split attack has been raised as a specific attack (Non-Patent Document 1), it is considered that these security holes were closed by using a photon or a single photon light source (Non-Patent Document 1). References 2, 3).

  On the other hand, the receiving side channel used for quantum hacking is known to be caused by inappropriate use of a decoder (Non-Patent Document 4) or non-ideality of a photon detector. Standard security proofs assume the use of an ideal photon detector, called a threshold detector. The threshold detector is a photon detector that reacts not only to a single photon state but also to a multi-photon state and generates a binary detection signal according to the presence or absence of the photon, and its safety proof does not depend on the number of photons. It is assumed that an ideal photon detector having an equal reaction probability for any number of photon states is used (Non-Patent Documents 5 and 6). However, the reaction probability of an actual photon detector depends on the photon number state. By utilizing the deviation from this assumed characteristic, the possibility of side channel attack opens. Various types of side channel attacks (time-shift attack, blinding attack, etc.) are exemplified as specific attack methods, and some have been demonstrated by experiments (Non-Patent Documents 7 to 10).

  The point of the problem of the side channel is that a third party may be able to use the quantum state of the carrier other than the signal quantum state assumed in the quantum key distribution protocol. In the use of carriers, it is necessary to eliminate such risks by eliminating the generation, observation, encoding and decoding of such unexpected quantum states, or making their presence detectable.

  In particular, the problem of the receiving side channel seems to be more serious than that of the transmitting side. This is because the characteristics of the photon detector used are extremely difficult to model quantitatively and vary from device to device, making it difficult to perform general safety certification. The fact that the security of the receiving device depends on the detector characteristics itself is a major cause of shaking the reliability of a practical quantum cryptography key distribution device.

  With regard to the problem of the receiving side channel, a new security hole has been pointed out even if countermeasures are considered. Even if a countermeasure against a known attack can be taken, a practical quantum cryptography key distribution device is not proven to be secure. It is important that security holes in the quantum cryptography key distribution device be crushed consistently by improving implementation and modeling improved devices to improve security proofs. This is the only method that can achieve provable security that a practical quantum cryptography key distribution device is superior to modern cryptography, and the development of a receiving device capable of performing consistent security proof is desired.

  In recent years, as a method for essentially solving the reception side channel attack, a method called quantum device distribution (Measurement Device Independent QKD: MDI-QKD) having independent security for a measurement device has been proposed. This method requires only authorized users to have a reliable light source, and without making any assumptions about the operation of the photon detector that has been pointed out to a security hole, unconditionally secure shared secrets between authorized users It has an excellent feature that it can generate a key.

FIG. 5 shows an example of the MDI-QKD system proposed by Lo et al. In this example, both authorized users have weak coherent light sources that can be trusted, and the decoy photon method can be used together to generate an unconditionally secure shared secret key between authorized users located remotely (≧ 5 km). A regular user has a calibrated laser light source 72, a polarization modulator 73, and an intensity modulator 74 inside the territory 71. These devices are assumed to be reliable. The photon detector 78, which is a security issue, belongs to the collaborator Charlie's territory and assumes no trust in Charlie himself and the devices in the territory. Charlie may conspire with the eavesdropper Eve to participate in the eavesdropping. An open public line is drawn between Alice, Bob, and Charlie, and arbitrary information disclosure is possible. Alice and Bob each independently modulates a light pulse emitted from a weakly coherent light source having the same emission frequency in time synchronization by a polarization modulator 73 and undergoes sufficient attenuation by an intensity modulator 74. , BB84 polarization state (horizontal (H), vertical (V), 45 ° (D), 135 ° (X) linear polarization state) output light pulse is obtained. The output light pulses of Alice and Bob are sent to Charlie via an external optical link. In the Charlie territory 77, a linear optical circuit comprising a symmetric beam splitter (BS) 75 and a polarization beam splitter (PBS) 76 that separates the linearly polarized state {H, V} is constructed and arrives from Alice and Bob. A partial bell state measurement is performed on the polarization state of the photon. Among the four photon detectors {D _1H , D _1V , D _2H , D _2V } 78, when photons are simultaneously detected by D _1H and D _1V or D _2H and D _2V arranged at the same output port Triplet two-photon state
Singlet two-photon states when photons are simultaneously detected at D _1H and D _2V , or D _1V and D _2H , located at different output ports
This is used as an event that succeeds in the measurement of projection into the subspace, and other simultaneous detection events are discarded. The following determination is possible with respect to the correlation between the polarization states of the outgoing photons of Alice and Bob.

A. If the polarization states of the outgoing photons of Alice and Bob are both selected from the linear polarization basis r = {H, V} and the Bell state measurement result | Ψ ⁺ > or | Ψ ⁻ > is obtained by Charlie, they The polarization states are orthogonal.

B. When the polarization states of the outgoing photons of Alice and Bob are both selected from the diagonal polarization basis d = {D, X} and the Bell state measurement result | Ψ ⁺ > is obtained by Charlie, their polarization states When the Bell state measurement results | Ψ ⁻ > are obtained, their polarization states are orthogonal.

  Since the Bell state measurement result shows only the quantum mechanical correlation between the polarization states of Alice and Bob, Charlie uses only the information on the polarization state basis of the Bell state measurement and the polarization states of Alice and Bob. It is impossible to estimate the polarization state of each of the above.

  If the facts of A and B are used, a secure secret key can be shared between Alice and Bob by executing the following protocol.

1. Alice and Bob independently modulate the laser light pulse into an arbitrary BB84 polarization state by the polarization modulator 73 based on the quaternary random number sequence from the true random number generator. After that, based on the ternary random number sequence from the true random number generator, the average number of photons of each output light pulse is {μ _A (<1), μ _B (<1)} (signal light), {ν _A ( <Μ _A ), ν _B (<μ _B )} (decoy light), 0 (vacuum field) (subscript A means Alice, subscript B means Bob's selected value) It is attenuated by the intensity modulator 74. Alice and Bob send each optical pulse recording the position tag, polarization state and average photon number to the collaborator Charlie via the external optical link.

2. Charlie performs a partial bell state measurement on the polarization state of optical pulses arriving from Alice and Bob. He announces to Alice and Bob the position tag of the photon and the measurement result from which the measurement result of the symmetric state | ψ ⁺ > and the antisymmetric state | ψ ⁻ > is obtained through the public line.

3. Alice and Bob merge and record the polarization state and average photon number data of the position tag optical pulse announced by Charlie and the corresponding Charlie measurement result (| Ψ ⁺ > or | Ψ ⁻ >). Discard other data. Alice and Bob collate their selected polarization basis (straight or diagonal) for the remaining data set, leave only the data set whose basis matches, and discard the rest.

4). Either Alice or Bob compares the Charlie measurement results and the judgment criteria of cases A and B above for each data, estimates the polarization state of the other party, and uses the estimation results as its own polarization state data. Replace it to get a raw key dataset.

5. Alice and Bob categorize the raw key data set with their selected polarization basis i (= r, d), selected average photon number α (= μ _A , ν _A , 0), β (= μ _B , ν _B , According to 0), it is sorted into 18 subensembles. Also,
a. From the number of elements of each sub-ensemble, the sub-ensemble raw key generation probability when the selected polarization basis is i and the selected average photon number is (α, β) = gain Q ⁱ (α, β)
b. Random sampling from each sub-ensemble and publishing the estimated polarization by 4 so that the estimation error rate of 4 in each sub-ensemble = qubit error rate (QBER) E ⁱ (α, β)
Statistical evaluation of

6). Alice and Bob are polarization state data strings (H = logic 0, V = logic 1) regarding the linear polarization base i = r of the remaining signal light sub-ensemble (sub-ensemble of α = μ _A , β = μ _B ). Is considered as a key candidate, and logical error correction is performed according to the value of E ^r (μ _A , μ _B ), and their key candidate data strings are completely correlated.

7). Alice and Bob, based on the decoy method, lower bound of the gain of the single photon emission event virtual subensemble in the signal light emission event subensemble:
And the upper limit of QBER
To evaluate. They perform logical secrecy enhancement on the key candidate data string according to these values, and erase the correlation information with the eavesdropper.

8). The remaining key candidate data string is used as a secret key.

  The points of the above protocol are summarized below.

(1) Partial Bell state measurement at the time of diagonal polarization base input in Case B depends on two-photon interference (HOM interference) of Hong-Ou-Mandel, and ideally zero arrival optical pulses or Including a single photon, its origin must be indistinguishable from its frequency, time waveform, coherence length, arrival time at the detector, and the like. For example, when a single photon of the same diagonal polarization state (D, D) or (X, X) is incident on each incident port, the measurement result of | Ψ ⁻ > (a photon is generated at a different output port of BS Output) is ideally zero due to HOM interference. When the ideal condition is not satisfied, for example, when a fake photon having a different wavelength or a multiphoton is incident, an error occurs in the determination result of B regarding the diagonal polarization base, but the determination of A regarding the linear polarization base There is no error in the result. Detection of multiphoton irradiation based on increased errors is only possible with case B.

(2) When the polarization state of a single photon component is disturbed due to wiretapping, an error occurs in both A and B determination results. Eavesdropping detection is possible due to the increased error of the single photon component.

  The unconditional security of the above protocol is discussed by Lo et al. Although the use of HOM interference enables detection of high-intensity light irradiation attacks by qubit error observation, the unconditional safety of this method can be proved against any attack that exploits the imperfection of photon detectors. It is supposed to be. The key points are as follows. The secret key data obtained after enhancing the secrecy by the decoy method may be replaced with key data generated by a single photon. In principle, if finite key data can be generated simultaneously from the data sets for linear and diagonal polarization bases, for these key data, the observation data for two non-orthogonal polarization bases is Fully correlated. The observation data completely correlates with respect to two non-orthogonal polarization bases because the measurement performed by Charlie is the bell state measurement. At this time, the entire protocol is equivalent to a protocol based on quantum entanglement (its time reversal), and there is no room for a third party including Charlie to share key information. (Non-Patent Document 11)

“Limitations on Practical Quantum Cryptography”, G.M. Brassard, N.M. Lutkenhaus, T .; Mor, B.M. C. Sanders, PHYSICAL REVIEW LETTERS, Vol. 85, no. 1330, 7 August 2000. “Quantum Key Distribution with High Loss: Tower Global Security Communication”, W.M. -Y. Hwang, PHYSICAL REVIEW LETTERS, Vol. 91, no. 5,1 August 2003. "What are single photons good for?", Nicolas Sangouard, Hugo Zbinden, arXiv: 1202.0493, 2 February 2012. “On the Security of Interferometric Quantum Key Distribution”, R.A. Gelles, T .; Mor, arXiv: 1110.6573, 30 October 2011. “Squashing Models for Optical Measurements in Quantum Communication”, N.A. J. et al. Beaudry, T .; Moroder, N .; Lutkenhaus, PHYSICAL REVIEW LETTERS, PRL101,093601,29 August 2008. “Security profile for quantum-key-distribution systems with threshold detectors”, T.A. Tsumuraru, K .; Tamaki, PHYSICAL REVIEW A, 78, 032302, 2008. "Superlinear threshold detectors in quantum cryptography", L.L. Lydersen et. al. , PHYSICAL REVIEW A, 84, 032320, 2011. "Time-shift attack in practical quantum cryptosystems", B.C. Qi, C.I. -H. F. Fung, H.C. -K. Lo, X. Ma, Quantum Information and Computation, 7, 73, 2007. "Hacking commercial quantum cryptography systems by tailored bright illumination", L. Lydersen, C.I. Wiechers, C.I. Wittmann, D.W. Elser, J. et al. Skaar, V.M. Makarov, nature Photonics, 4,686, 29 August 2010. "Full-field implementation of a perfect eavesdropper on a quantum cryptography system", I.D. Gerhardt, Q.M. Liu, A .; Lamas- Linares, J. et al. Skaar, C.I. Kurtsiefer, V.M. Makarov, Nature Communications, 2, 349, 14 June 2011. “Measurement-Device-Independent Quantum Key Distribution”, Hoi-Kong Lo, Marcos Curty, Bing Qi, PHYSICAL REVIEW LETTERS, PRL 108, 130503, 30 March.

  In the MDI-QKD setup proposed by Lo et al., A setup having asymmetry with respect to a selective polarization base is adopted as a measurement apparatus. This depends on the PBS being set so as to separate the linear polarization state d in the polarization optical system constituting the partial bell state measurement. Lo et al. Have proposed a setup that is asymmetric. This is because, in the proposal of Lo et al., Weak coherent light including multiphotons is used as a carrier. As is known, the interference degree of HOM interference of weak coherent light is at most 50%. This is because the autocorrelation signal due to the multiphoton component included in the weak coherent light is superimposed on the interference signal, and an offset occurs in the signal. When HOM interference is used for state identification, the QBER of the sub-ensemble of the diagonally polarized signal light emission event to be observed due to this noise offset is 25% or more, and the penalty due to error correction is large. For this reason, Lo et al. Proposed using a linearly polarized wave base that does not use HOM interference only for key generation and a diagonally polarized wave base that uses HOM interference only for wiretapping detection. This makes it possible to generate a key ideally without loss due to error correction from the linearly polarized wave basis (although there is a penalty of abandoning most of the data on the diagonally polarized wave basis (maximum loss of 50%)).

By using the decoy light technique, these noise offsets are canceled out, and the QBER for the diagonally polarized single photon emission event virtual sub-ensemble required for the enhancement of secrecy can be reduced. FIG. 6 shows a typical situation where Charlie is placed at the midpoint between Alice and Bob (η _A = η _B ), and Alice and Bob use decoy light with the same average photon number (ν _A = ν _B = ν). Is a result of calculating the lower limit e _L of QBER for the diagonally polarized single photon emission event virtual subensemble. As is apparent from the figure, e _L depends on the decoy light intensity, and decreases as the intensity decreases. The reason is that only a part of the noise offset is canceled out, and the degree of the cancellation depends on the decoy light intensity. In the method of Lo et al., In order to efficiently enhance confidentiality, it is necessary to cancel the noise offset component using decoy light with the lowest possible intensity in the QBER evaluation. It is not desirable because it reduces the speed of ensemble generation and leads to an increase in systematic errors in data collection time and error evaluation. In particular, in MDI-QKD, the decoy light event ensemble generation rate is determined by the product of the decoy light intensity of Alice and Bob, so the decrease in the ensemble generation rate as a side effect of reducing decoy light intensity becomes serious. there is a possibility.

  Also, with this method, it is practically difficult to generate a key from the diagonally polarized signal light emission event subensemble due to a large penalty imposed by error correction. Therefore, they proposed using an asymmetric optical setup for Charlie's partial bell state measurement where the state identification of the diagonally polarized linear basis depends on HOM interference and the state identification of the linearly polarized basis does not. In this asymmetric setup, regardless of the number of photons incident from Alice and Bob, Charlie can obtain a correct polarization correlation result if it is in a linear polarization state. For this reason, even if Alice and Bob use weak coherent light, a small QBER can be obtained for the sub-ensemble of the linearly polarized signal light emission event, and the error correction penalty can be reduced. In the QBER evaluation of the complementary diagonally polarized single-photon emission event virtual subensemble, a part of the noise offset is canceled as described above, and thus the penalty of increasing confidentiality is avoided to some extent. However, in this method, key generation is performed only from the sub-ensemble of the linearly polarized signal light emission event, so key data that is completely correlated at the same time is generated from the non-orthogonal linearly polarized signal light emission event data set at the same time. Has not been successful. Therefore, the claim that this protocol is equivalent to a protocol based on quantum entanglement remains unacceptable.

  The present invention has been made to solve such problems, and performs efficient and safe key generation without drastically reducing the light intensity of decoy light, and linear and diagonal polarization. Quantum key distribution device, transmitter, and receiver that can generate a secure key from an ensemble of signal light transmission events on both bases, can make the protocol closer to a quantum entanglement-based protocol, and can bring the security proof closer to a firm one An apparatus, a quantum cryptography key distribution method, and a program are provided.

  Other problems and novel features will become apparent from the description of the specification and the accompanying drawings.

  A quantum key distribution device according to the present invention is a quantum key distribution device including a transmission device, a reception device, and a transmission path that connects the transmission device and the reception device, and the transmission device includes: A coherent light source that generates coherent light to be transmitted to the transmission path, a modulator that randomly modulates the polarization state of the coherent light, and an attenuator that randomly attenuates the average number of photons of the coherent light. The receiver includes a pseudo single photon light source unit that generates pseudo single photon light, and the coherent light as carrier photons received from the transmission path and a quantum of polarization states of the pseudo single photon light. And a partial bell state measurement unit for measuring a mechanical correlation.

  A transmission device according to the present invention is a transmission device connected to a reception device by a transmission path, and a coherent light source unit that generates coherent light to be transmitted to the transmission path, and a polarization state of the coherent light at random A modulation unit that modulates the signal; and an attenuation unit that randomly attenuates the average number of photons of the coherent light.

  A receiving apparatus according to the present invention is a receiving apparatus connected to a transmitting apparatus by a transmission line, a pseudo single photon light source unit that generates pseudo single photon light, and coherent as carrier photons received from the transmission line And a partial bell state measuring unit for measuring a quantum mechanical correlation between the polarization state of the light and the pseudo single photon light.

  In the quantum key distribution method according to the present invention, a transmission device generates a coherent light that generates coherent light to be transmitted to a transmission line, a modulation step that randomly modulates a polarization state of the coherent light, and the coherent light An attenuation step for randomly attenuating the average number of photons of light; a pseudo-single-photon light generation step in which the receiver generates pseudo-single-photon light; the coherent light as carrier photons received from the transmission path; And a partial bell state measurement step of measuring a quantum mechanical correlation of the polarization state of the pseudo single photon light.

  A program according to the present invention is a program for causing a computer as at least one of the transmitting device and the receiving device to execute the quantum key distribution method.

  According to the present invention, it is possible to efficiently generate a safe key without extremely reducing the light intensity of the decoy light, and to generate a safety key from an ensemble of signal light transmission events of both linear and diagonal polarization bases, It is possible to provide a quantum encryption key distribution device, a transmission device, a reception device, a quantum encryption key distribution method, and a program capable of bringing a protocol closer to a protocol based on quantum entanglement and making a security proof closer to a firm one.

It is a figure which shows the structure of the quantum cryptography key distribution apparatus 100 of Embodiment 1 of this invention. It is a figure which shows the structure of the quantum cryptography key distribution apparatus 100 of Embodiment 2 of this invention. Is a diagram showing a calculation example of bait light mean photon number [nu _A lower limit e _L of QBER for diagonal polarization single photon emission events virtual sub ensemble in the first embodiment of the present invention. It is a figure which shows the structure of the conventional quantum encryption key distribution apparatus. It is a figure which shows the structure of the conventional MDI-QKD apparatus. Is a diagram showing a calculation example of bait light mean photon number [nu _A lower limit e _L of QBER to conventional diagonal polarization single photon emission events virtual sub-ensemble.

Hereinafter, specific embodiments to which the present invention is applied will be described in detail with reference to the drawings.
<Embodiment 1>
First, the configuration of the quantum key distribution apparatus 100 according to the first embodiment of the present invention will be described using the block diagram of FIG. The quantum cryptographic key distribution apparatus 100 includes a sender apparatus 10 and a receiver apparatus 15.

The optical pulse generated by the calibrated laser light source 11 of the transmitter 10 is transmitted by the polarization modulator 12 to the BB84 polarization state (horizontal (H), vertical (V), 45 ° (D), 135 ° (X ) Linear polarization state). The light pulse is attenuated by the intensity modulator 13 so that the average number of photons is μ _A (<1) (signal light), ν _A (<μ _A ) (bait light), or 0 (vacuum field). Then, it is sent to the optical transmission path 14 opened to the outside toward the receiver device 15. An optical pulse arriving in the receiver device 15 isolated from the outside from the optical transmission line 14 is separated from the symmetric beam splitter (BS) 16 and the linearly polarized state {H, V} by a polarization beam splitter (PBS) 17. And input to the input port A19 of the partial bell state measuring device 18 for measuring the quantum mechanical correlation of the polarization state of the two input photons. The partial bell state measurement device 18 measures the quantum mechanical correlation of the polarization states of the two input photons based on the simultaneous photon detection patterns of the four photon detectors 1D. The optical pulse generated by the pseudo single photon light source 1B is converted into a BB84 polarization state (horizontal (H), vertical (V), 45 ° (D), 135 ° (X) linearly polarized wave by the polarization modulator 1C. State) and is incident on the input port B1A of the partial bell state measuring device 18.

  Next, the operation of the quantum key distribution device 100 according to the first exemplary embodiment of the present invention will be described with reference to FIG. 1 and FIG. 5 related to the prior art.

The quantum key distribution apparatus 100 (FIG. 1) according to the first exemplary embodiment of the present invention has no change in the apparatus arranged in the Alice territory and its operation, compared with the proposal by Lo et al. (FIG. 5). . On the other hand, the partial bell state measuring device arranged in Charlie's territory is absorbed in Bob's territory. Bob has a quasi-single-photon light source in which the average photon number: μ _B and secondary coherence: g ⁽²⁾ (0) are calibrated instead of the weak coherent light source. The polarization state is modulated to one of the BB84 states and is input to one input port B of the partial bell state measuring apparatus. They are placed in an environment closed to the outside world, and only Bob has access to input port B, his outgoing photons and their polarization states, and Bell state measurements. Therefore, it is not necessary to monitor the transmitted light of Bob in the photon number space by the decoy light method. Other input port A is delivered from Alice, which is open to the outside world, including the eavesdropper to accept photons arriving via the transmission path of the transmission eta _A. The light source, true random number generator, polarization modulator and intensity modulator of Alice and Bob are assumed to be reliable as proposed by Lo et al., But the reliability of devices belonging to the partial bell state measurement device is not Make no assumptions. An open public line is drawn between Alice and Bob, and arbitrary information disclosure is possible. Like the Lo et al. Proposal, the triplet two-photon state | Ψ ⁺ > or the singlet two-photon state | Ψ ⁻ > depends on the simultaneous photon detection pattern of the four photon detectors {D _1H , D _1V , D _2H , D _2V }. The success event of projective measurement to the subspace is determined. Bob can estimate the polarization state of Alice's transmitted photons from his polarization state and Bell state measurement results as follows.

A. If the polarization states of the outgoing photons of Alice and Bob are both selected from the linear polarization basis r and the Bell state measurement result | Ψ ⁺ > or | Ψ ⁻ > is obtained, the state of his selected linear polarization state The orthogonal state is the polarization state selected by Alice.

B. If the polarizations of the outgoing photons of Alice and Bob are both selected from the diagonal polarization basis d and the Bell state measurement result | Ψ ⁺ > is obtained, his selected linear polarization state is the polarization selected by Alice. In the wave state, if the Bell state measurement result | Ψ ⁻ > is obtained, the orthogonal state of the linear polarization state selected by him is the polarization state selected by Alice.

  From the facts of A and B, a device in Bob's territory is considered equivalent to a receiver that implements the conventional BB84 protocol. The difference is that in the conventional receiver, the incoming photon from Alice is directly subjected to polarization modulation for base selection and directly performs the polarization projection measurement, whereas in the proposed receiver, Indirect photo-polarization modulation measurement of arrival photons from Alice by indirectly performing base-selection polarization modulation on photons prepared by Bob and obtaining polarization correlation measurement results of their photons in Bell state measurement There is to get. The single photon nature of the incident photons from input port A is ensured by observation of good HOM interference (quantum state correlation measurements) with a reliable calibrated single photon. Therefore, it is possible to distribute a secure key by executing the key distribution protocol following the BB84 protocol combined with the decoy light technique. It is a necessary condition that a secure key can be extracted that the QBER of a single-photon light incident event virtual ensemble with respect to a diagonally polarized base can be kept sufficiently small.

When this system is used, the following results are obtained from the results of the standard decoy light method. Alice is attenuated by the intensity modulator at random so that the average photon number is either μ _A (<1) (signal light), ν _A (<μ _A ) (bait light), or 0 (vacuum field). Shall be transmitted. Alice and Bob use the raw key data set obtained after basis matching according to their selected polarization basis i (= r, d) and Alice's selected average photon number α = (μ _A , ν _A , 0). The sub-ensembles are classified into six sub-ensembles, and the gains Q ⁱ (α) and QBER E ⁱ (α) of each sub-ensemble are statistically evaluated. From these, the lower limit e _L of QBER for the diagonally polarized single-photon emission event virtual subensemble can be evaluated.

As a trial calculation, η _A = 0.01 (during 100 km fiber transmission) and μ _B = 0.1 are considered. Under this situation, there is an imbalance (X = η _A ν _A / μ _B <1) in the intensity of light input from the two ports of the partial Bell state measurement apparatus. FIG. 3 is a graph in which the dependence of e _L on ν _A is plotted for the cases of g ⁽²⁾ (0) = 0.001, 0.01, 0.1, 1. Comparing FIG. 3 and FIG. 6, it can be seen that if the purity of the single photon source is high and g ⁽²⁾ (0) is small, a small e _L can be realized regardless of the size of ν _A. Considering records g ⁽²⁾ (0) to 0.002 that have been achieved with quantum dot single photon light sources to date, g ⁽²⁾ (0) <0.01 is a sufficiently achievable condition. Therefore, by using a pseudo single photon light source having a small g ⁽²⁾ (0) and the setup of FIG. 1, it becomes possible to use decoy light having a higher intensity than the method of Lo et al. Since the monitoring of Bob's photons in the photon space can be omitted, there is a possibility that the problem of the generation speed reduction of the decoy light event ensemble may be improved.

According to the present embodiment, the quantum key distribution apparatus 100 uses the pseudo-single-photon light source with a small second-order optical coherence g ⁽²⁾ (0) and the proposed optical setup, so that the method of Lo et al. Compared to the problem that the decoy light event ensemble generation speed is reduced, it is possible to use decoy light with a larger intensity than that, and the monitoring of the photons of Bob photons in the decoy light method can be omitted. Yes.

  This enables safe key generation without drastically reducing the light intensity of the decoy light, and improves the performance of the quantum cryptography key distribution device 100, such as shortening the data collection time and reducing systematic errors in error evaluation. Contribute.

<Embodiment 2>
Next, the configuration of the quantum key distribution apparatus 100 according to the second embodiment of the present invention will be described using the block diagram of FIG.

  In the quantum key distribution device 100 according to the second exemplary embodiment, the polarization modulator 12 changes the polarization state of the input photon to any of the B92 polarization state (horizontal (H) or 45 ° (D) linear polarization state). Modulate to some state. In addition, a quarter wave plate 21 is disposed between the symmetric beam splitter (BS) 16 and the polarization beam splitter (PBS) 17, so that the polarization beam splitter (PBS) 17 circularly polarizes the input photons. It functions as a polarization beam splitter that separates into wave states {R, L}. The arrangement and functions of the remaining components are the same as those in the first embodiment (FIG. 1).

  Next, the operation of the quantum key distribution apparatus 100 according to the second exemplary embodiment of the present invention will be described with reference to FIG.

In FIG. 2, the partial Bell state measurement system is modified so that the state identification of both the straight line and the diagonally polarized wave base is a symmetrical setup that is equally dependent on HOM interference. In this setup, in the partial Bell state measurement optical system of the first embodiment, the PBS set to decompose the linearly polarized wave basis r = {H, V} is inserted by inserting a quarter wavelength plate. The circular polarization basis c = {L, R} is changed to be decomposed. Of the four photon detectors {D _1L , D _1R , D _2L , D _2R }, a triplet is detected when photons are simultaneously detected by D _1L and D _1R or D _2L and D _2R arranged in the same output port. Two-photon state
Singlet two-photon states when photons are simultaneously detected at D _1L and D _2R , or D _1R and D _2L , located at different output ports
This is used as an event that succeeds in the measurement of projection into the subspace, and other simultaneous detection events are discarded. The following determination is possible regarding the correlation between the polarization states of Alice and Bob's transmitted photons.

A. When the bases of the polarization states of the outgoing photons of Alice and Bob match and the Bell state measurement result | Φ ⁺ > is obtained, their polarization states match, and the Bell state measurement result | Ψ ⁻ > is obtained. Their polarization states are orthogonal.

As a result, a symmetric HOM interference can be realized with respect to a linear and diagonal polarization base complementary to the circular polarization base. At the same time, the polarization state of Bob's photon can be reduced from the BB84 state to the B92 state consisting of only the non-orthogonal dual polarization states of H and D. However, in this case, the QBER of the sub-ensemble of the signal light emission event based on the linear and diagonal polarization states is superimposed with the noise offset due to the autocorrelation signal coming from the multi-photon component included in the weak coherent light. In order to efficiently generate a security key using this polarization symmetric setup, in order to reduce the penalty due to error correction and increased confidentiality, the QBER of the subensemble of the signal light emission event, and the decoy light emission event The QBER of the single photon emission event virtual subensemble needs to be sufficiently small, but according to the calculation, for the value of g ⁽²⁾ (0) that can be sufficiently realized with the current quantum dot single photon light source, It was found that this condition can be established. Therefore, by using the pseudo single-photon light source with small g ⁽²⁾ (0) and the polarization symmetric setup of FIG. 2, a safety key is generated from the ensemble of signal light transmission events of both linear and diagonal polarization bases. There is a possibility that the protocol can be brought closer to a protocol based on quantum entanglement, and the security proof can be brought closer to a firm one.

  In this embodiment, in order to obtain a symmetrical setup in which both the state identification of the straight line and the diagonal polarization base are equally dependent on HOM interference, in the partial Bell state measurement optical system, the linear polarization base r = {H, PBS set to decompose V} is modified to decompose the circular polarization basis c = {R, L} by inserting a quarter wave plate. As a result, a security key can be generated from an ensemble of signal light transmission events based on both linear and diagonal polarizations, and the protocol can be made closer to a protocol based on quantum entanglement and the security proof can be solidified. An encryption key distribution apparatus can be provided.

<Other embodiments>
Note that the present invention is not limited to the above-described embodiment, and can be changed as appropriate without departing from the spirit of the present invention. For example, in the above description, the operation principle of the present invention has been described by taking the BB84 protocol in which the polarization state space is the signal state space as an example. It can be applied to any signal state space similar to. For example, the polarization state space can be applied in principle to a time bin state space.

  In the above-described embodiment, the present invention has been mainly described as a hardware configuration. However, the present invention is not limited to this, and a CPU (Central Processing Unit) executes a computer program for arbitrary processing. Can also be realized. In this case, the computer program can be stored and provided to the computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

(Appendix 1)
A quantum key distribution device including a transmission device, a reception device, and a transmission path connecting the transmission device and the reception device,
The transmitter is
A coherent light source that generates coherent light to be transmitted to the transmission path;
A modulator that randomly modulates the polarization state of the coherent light;
An attenuation unit that randomly attenuates the average number of photons of the coherent light,
The receiving device is:
A pseudo single photon light source that generates pseudo single photon light; and
And a partial bell state measurement unit that measures a quantum mechanical correlation between polarization states of the coherent light and the pseudo single photon light as carrier photons received from the transmission path.
(Appendix 2)
The quantum key distribution according to claim 1, wherein the attenuation unit randomly attenuates the average number of photons to be either μA (signal light), νA (<μA) (bait light), or 0 (vacuum field). apparatus.
(Appendix 3)
The quantum cryptography key distribution device according to attachment 1 or 2, wherein the modulation unit randomly modulates the polarization state into any of the BB84 polarization states (horizontal, vertical, 45 degrees, or 135 degrees linear polarization state).
(Appendix 4)
The quantum cryptography key distribution device according to attachment 3, wherein the partial bell state measurement unit includes a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the linearly polarized state {H, V}.
(Appendix 5)
The quantum key distribution device according to claim 1 or 2, wherein the modulation unit randomly modulates the polarization state to any of the B92 polarization state (horizontal or 45 degree linear polarization state).
(Appendix 6)
The quantum cryptography key distribution device according to claim 5, wherein the partial bell state measurement unit includes a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the circular polarization state {R, L}.
(Appendix 7)
A transmission device connected to a reception device by a transmission line,
A coherent light source that generates coherent light to be transmitted to the transmission path;
A modulator that randomly modulates the polarization state of the coherent light;
An attenuation unit that randomly attenuates the average number of photons of the coherent light.
(Appendix 8)
The quantum cryptography key distribution according to claim 7, wherein the attenuation unit randomly attenuates the average photon number so as to be either μA (signal light), νA (<μA) (bait light), or 0 (vacuum field). apparatus.
(Appendix 9)
The transmission apparatus according to appendix 7 or 8, wherein the modulation unit randomly modulates the polarization state into any of the BB84 polarization states (horizontal, vertical, 45 degrees, or 135 degrees linear polarization state).
(Appendix 10)
The transmission device according to appendix 7 or 8, wherein the modulation unit randomly modulates the polarization state into any of the B92 polarization states (horizontal or 45-degree linear polarization state).
(Appendix 11)
A receiving device connected to a transmitting device by a transmission line,
A pseudo single photon light source that generates pseudo single photon light; and
And a partial bell state measurement unit that measures a quantum mechanical correlation between the coherent light as carrier photons received from the transmission path and the polarization state of the pseudo single photon light.
(Appendix 12)
The receiving apparatus according to claim 11, wherein the partial bell state measurement unit includes a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the linearly polarized state {H, V}.
(Appendix 13)
The receiving apparatus according to claim 11, wherein the partial bell state measurement unit includes a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates a circularly polarized state {R, L}.
(Appendix 14)
The transmitter is
A coherent light generation step for generating coherent light to be transmitted to the transmission line;
A modulation step for randomly modulating the polarization state of the coherent light;
An attenuation step for randomly attenuating the average number of photons of the coherent light;
The receiving device
A pseudo single photon light generation step for generating pseudo single photon light;
A partial bell state measurement step of measuring a quantum mechanical correlation between polarization states of the coherent light and the pseudo single photon light as carrier photons received from the transmission path.
(Appendix 15)
The transmission device randomly attenuates the average photon number so as to be any one of μA (signal light), νA (<μA) (bait light), and 0 (vacuum field) in the attenuation step. Quantum encryption key distribution method.
(Appendix 16)
The transmission apparatus randomly modulates the polarization state into any one of BB84 polarization states (horizontal, vertical, 45 degrees, or 135 degrees linear polarization state) by the modulation unit. Key distribution method.
(Appendix 17)
The quantum cryptography according to claim 16, wherein the receiver uses a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the linearly polarized state {H, V} in the partial bell state measurement step. Key distribution method.
(Appendix 18)
The quantum key distribution method according to supplementary note 14 or 15, wherein the transmitting device randomly modulates the polarization state into any of a B92 polarization state (horizontal or 45 degree linear polarization state) in the modulation step.
(Appendix 19)
The quantum cryptography according to claim 18, wherein the receiver uses a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the circularly polarized state {R, L} in the partial bell state measurement step. Key distribution method.
(Appendix 20)
The transmitter is
A coherent light generation step for generating coherent light to be transmitted to the transmission line;
A modulation step for randomly modulating the polarization state of the coherent light;
An attenuation step for randomly attenuating the average number of photons of the coherent light.
(Appendix 21)
The transmission device randomly attenuates the average photon number so as to be any one of μA (signal light), νA (<μA) (bait light), and 0 (vacuum field) in the attenuation step. Quantum encryption key distribution method.
(Appendix 22)
The transmission apparatus randomly modulates the polarization state into any one of BB84 polarization states (horizontal, vertical, 45 degrees, or 135 degrees linear polarization state) by the modulation unit. Key distribution method.
(Appendix 23)
The quantum key distribution method according to appendix 20 or 21, wherein, in the modulation step, the transmitter randomly modulates the polarization state into any of the B92 polarization states (horizontal or 45 degree linear polarization state).
(Appendix 24)
The receiving device
A pseudo single photon light generation step for generating pseudo single photon light;
A partial bell state measurement step of measuring a quantum mechanical correlation between polarization states of the coherent light and the pseudo single photon light as carrier photons received from a transmission path.
(Appendix 25)
25. The quantum cryptography according to claim 24, wherein the receiving device uses a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the linear polarization state {H, V} in the partial bell state measurement step. Key distribution method.
(Appendix 26)
25. The quantum cryptography according to claim 24, wherein the receiver uses a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the circularly polarized state {R, L} in the partial bell state measurement step. Key distribution method.
(Appendix 27)
A program for causing a computer as at least one of a transmission device and a reception device to execute the method according to any one of appendixes 14 to 26.

DESCRIPTION OF SYMBOLS 100 Quantum encryption key distribution apparatus 10 Sender apparatus 11 Calibrated laser light source 12 Polarization modulator 13 Intensity modulator 14 Optical transmission line 15 Receiver apparatus 16 Symmetric beam splitter (BS)
17 Polarization beam splitter (PBS)
18 Partial bell state measuring device 19 Input port A
1A Input port B
1B Pseudo Single Photon Light Source 1C Polarization Modulator 1D Photon Detector 21 1/4 Wave Plate 61 Transmitter 62 Light Source 63 Random Number Generator 64 Encoder (Modulator)
65 Transmission side channel 66 Optical transmission path 67 Eavesdropping device 68 Receiving device 69 Random number generator 6A Decoder (modulator)
6B Photon Detector 6C Receiving Side Channel 71 Territory for Authorized User 72 Calibrated Laser Light Source 72
73 Polarization modulator 74 Intensity modulator 75 Symmetric beam splitter (BS)
76 Polarized beam splitter (PBS)
77 Collier Charlie's Territory 78 Photon Detector

Claims (10)

A quantum key distribution device including a transmission device, a reception device, and a transmission path connecting the transmission device and the reception device,
The transmitter is
A coherent light source that generates coherent light to be transmitted to the transmission path;
A modulator that randomly modulates the polarization state of the coherent light;
An attenuation unit that randomly attenuates the average number of photons of the coherent light,
The receiving device is:
A pseudo single photon light source that generates pseudo single photon light; and
And a partial bell state measurement unit that measures a quantum mechanical correlation between polarization states of the coherent light and the pseudo single photon light as carrier photons received from the transmission path. The said attenuation | damping part attenuate | damps at random so that an average photon number may become either [mu] _A (signal light), [nu] _A (<[mu] _A ) (bait light), or 0 (vacuum field). Quantum cryptographic key distribution device. The quantum cryptography key distribution device according to claim 1 or 2, wherein the modulation unit randomly modulates the polarization state into any of BB84 polarization states (horizontal, vertical, 45 degrees, or 135 degrees linear polarization state). The quantum cryptography key distribution device according to claim 3, wherein the partial bell state measurement unit includes a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates the linearly polarized state {H, V}. . 3. The quantum key distribution apparatus according to claim 1, wherein the modulation unit randomly modulates a polarization state into any of a B92 polarization state (horizontal or 45 degree linear polarization state). The quantum cryptography key distribution device according to claim 5, wherein the partial bell state measurement unit includes a linear optical circuit including a symmetric beam splitter and a polarization beam splitter that separates a circularly polarized state {R, L}. . A transmission device connected to a reception device by a transmission line,
A coherent light source that generates coherent light to be transmitted to the transmission path;
A modulator that randomly modulates the polarization state of the coherent light;
An attenuation unit that randomly attenuates the average number of photons of the coherent light. A receiving device connected to a transmitting device by a transmission line,
A pseudo single photon light source that generates pseudo single photon light; and
And a partial bell state measurement unit that measures a quantum mechanical correlation between the coherent light as carrier photons received from the transmission path and the polarization state of the pseudo single photon light. The transmitter is
A coherent light generation step for generating coherent light to be transmitted to the transmission line;
A modulation step for randomly modulating the polarization state of the coherent light;
An attenuation step for randomly attenuating the average number of photons of the coherent light;
The receiving device
A pseudo single photon light generation step for generating pseudo single photon light;
A partial bell state measurement step of measuring a quantum mechanical correlation between polarization states of the coherent light and the pseudo single photon light as carrier photons received from the transmission path.   A program for causing a computer as at least one of the transmission device and the reception device to execute the method according to claim 9.