JP7519696B2 - Response estimation method and response estimation device - Google Patents

Description

The present invention relates to a response estimation method and a response estimation device.

In recent years, a quantum communication system called Twin-Field Quantum Key Distribution (TF-QKD) has been developed that uses standard communication optical fibers to extend the communication distance of quantum cryptography communication to more than 500 km (hereinafter, this method will be referred to as the twin-field method) (see, for example, Non-Patent Document 1).

In this twin-field method, a photon detection unit called Charlie is placed between an optical transmission unit called Alice and an optical transmission unit called Bob. Alice and Bob each randomly select a bit value (0 or 1), and then select the phase of the optical pulse accordingly and send it to Charlie.

When Charlie detects a photon from the optical pulses received from Alice and Bob, he detects whether the optical pulses received from Alice and Bob are in phase or out of phase for each detection round, and publishes the detection result to Alice and Bob. Bob inverts all bit values in rounds that are declared to be out of phase. This allows Alice and Bob to obtain a random common bit value every time a photon is detected by Charlie.

Toshiba Corporation, "Development of a new method for quantum cryptography communication that enables the world's longest communication distance of over 500 km", [online], May 23, 2018, [Retrieved July 7, 2020], Internet <URL: https://www.toshiba.co.jp/rdc/detail/1805_01.htm>

However, in the twin-field method, normal communication is carried out by carrying signals on the wave properties of light (the timing of wave vibrations) in order to utilize the properties of interference in quantum mechanics, so extremely special light known as the "Schrödinger's cat state" is required to detect eavesdropping. For this reason, when optical pulses generated by existing laser light sources are input into a photon detection unit or optical fiber, it has been difficult to efficiently estimate the response to the input, such as what type of eavesdropping has been attempted, within the quantum communication system.

Therefore, the present invention has been made in consideration of the above points, and aims to propose a response estimation method and response estimation device that can efficiently estimate the response to an input when a quantum mechanical signal is input.

A response estimation method according to the present invention is a response estimation method for estimating a response in a system that transmits a quantum mechanical signal from a transmitter to an object when the signal is input from the transmitter, the response estimation method including an ideal state definition step of defining a quantum mechanical ideal state ρ ^(ideal) of an ideal signal capable of detecting an event of the object, a specification step of expressing an approximation state in which the ideal state ρ ^{( ideal)} and a quantum mechanical state are approximated by addition and subtraction using quantum mechanical states ρ ₊ ^{(test) and} ρ ₋ ^(test) of a plurality of types of test signals, and specifying an operator inequality αρ ₊ ^{(test) -βρ} _- ^(test) ≧ ρ ^(ideal) that defines a relationship between the ideal state ρ (ideal) and the quantum mechanical states ρ ₊ (test ₎ and ρ − (test) of the plurality of types of test signals, and a detection number M of the event of the object detected by the ideal signal, and detection numbers K ₁ , K the estimation _step includes an inequality definition step of defining an inequality Prob{M ≦ f( _K1 , _K2 )} ≧ 1-ε, which defines the relationship between M≦f(K1,K2) and a parameter ε predetermined for defining an acceptable estimation error amount as a confidence level of the estimation, based on the Bernoulli sampling formula; an acquisition step of randomly switching the multiple types of test signals identified in the identification step and transmitting them to the target object to acquire detection results of the event by the test signals; and an estimation step of solving the inequality in the inequality definition step based on the detection results acquired in the acquisition step, to estimate a response of the system when the quantum mechanical signal is input.

In addition, in a response estimation method for a quantum communication system according to the present invention, a first unit and a second unit connected via a photon detection unit by a quantum communication path randomly select and sequentially transmit to the photon detection unit a communication optical pulse obtained by modulating an optical pulse with a randomly selected random bit, and a plurality of types of test optical pulses in which the phase θ and intensities μ ₁ , μ ₂ of the optical pulse are randomly selected, respectively. The response estimation method estimates a response in the quantum communication system when the communication optical pulse is input, the response estimation method includes an ideal state definition step of defining a quantum-mechanical ideal state ρ (even) of an ideal optical pulse capable of detecting the number K ₀ ^(even) of detections of pairs of communication optical pulses related to eavesdropping out of the number K ₀ of detections of pairs of communication optical pulses detected by the photon detection unit as a result of both the first unit and the second unit selecting the communication optical pulse, and defining an approximation state in which the ideal state ρ ^{( even)} and a quantum-mechanical state are approximated to each other as quantum-mechanical states ρ ₊ ^(test1) , ρ ₋ a specifying step of specifying an operator inequality αρ ₊ ^{(test1) -βρ - (test2)} ≧ ^{ρ (} even) that defines a relationship between the ideal state ρ ^(even) and the quantum mechanical states ρ ₊ ^(test1) _{and ρ - (} ^test2) of the plurality of types of test optical pulses; a specifying step of specifying the number of detections K ₀ ^{(even) of} pairs of communication optical pulses involved in eavesdropping measured by the ideal optical pulses, a number of detections K 1 of pairs of the first test optical pulses detected by the first unit and the second unit selecting, in a specified combination, first test optical pulses that are randomly selected with a certain probability, respectively, and a number of detections K ₂ of pairs of the second test optical pulses detected by the first unit and the second unit selecting, in a specified combination, second test optical pulses that are randomly selected with a certain probability, respectively, apart from the first test optical pulses, respectively, and and a parameter ε predetermined for specifying an amount ^of estimated error that can be tolerated in estimating the amount of eavesdropping on the pair of communication optical pulses, based on the Bernoulli sampling formula; an acquisition step in which the first unit _and the _{second unit} randomly transmit the communication optical pulses and the test optical pulses to the photon detection unit, respectively, and the first unit and the second unit acquire detection results obtained by _the photon detection unit detecting the pair of communication optical pulses and the pair of test optical pulses that match in the first unit and the second unit; and an estimation step of solving the inequality in the inequality definition step based on the detection results acquired in the acquisition step, to estimate a response in the quantum communication system when the communication optical pulses are input.

According to the present invention, by using an inequality defined based on the Bernoulli sampling formula, it is possible to efficiently estimate the response to an input when a quantum mechanical signal is input, without using special ideal signals or ideal optical pulses.

1 is a schematic diagram showing a configuration of a quantum cryptography key distribution system according to an embodiment of the present invention. 1 is a schematic diagram illustrating an overview of a response estimation method according to an embodiment of the present invention. FIG. 1 is a schematic diagram illustrating a random sampling test used in a response estimation method according to an embodiment of the present invention. FIG. 2 is a schematic diagram for explaining a response estimation method according to the present embodiment. FIG. 2 is a schematic diagram for explaining a response estimation method according to the present embodiment. FIG. 13 is an explanatory diagram for explaining the formula αρ ₊ ^(test) _−βρ− ^(test) ≧ρ ^(ideal) . FIG. 2 is an explanatory diagram for explaining a response estimation method according to the present embodiment. FIG. 2 is an explanatory diagram for explaining a response estimation method according to the present embodiment. FIG. 13 is an explanatory diagram for explaining the formula αρ ₊ ^(test) _−βρ− ^(test) ≧ρ ^(ideal) . 1 is a graph showing the relationship between the distance L between Alice and Bob and the key rate per pulse G/N _tot . FIG. 11 is a schematic diagram for explaining a response estimation method according to another embodiment.

The following describes in detail an embodiment of the present invention with reference to the drawings.

(1) Overview of the quantum cryptography key distribution system according to the present embodiment First, an overview of the quantum cryptography key distribution system according to the present embodiment will be described. As shown in Fig. 1, the quantum cryptography key distribution system 1 according to the present embodiment has a first unit 2 called Alice (hereinafter also simply referred to as Alice 2), a second unit 3 called Bob (hereinafter also simply referred to as Bob 3), and a photon detection unit 4 called Charlie (hereinafter also simply referred to as Charlie 4) installed between Alice 2 and Bob 3. In this case, both Alice 2 and Bob 3 are optical transmission units.

Alice 2 and Bob 3 are connected to Charlie 4 via a quantum communication path 100 such as an optical fiber, and light pulses are transmitted as transmission signals from Alice 2 and Bob 3 to Charlie 4 via the quantum communication path 100. Alice 2, Bob 3 and Charlie 4 are also connected to a public communication path (not shown) such as the Internet, and can transmit and receive various types of data to and from each other via this public communication path.

Alice 2 according to this embodiment has a transmission unit 19, an acquisition unit 10, and a response estimation device 11. The transmission unit 19 has a laser light source 5, an intensity modulator 6, a phase modulator 7, a variable optical attenuator 8, and a random number generator 9. The response estimation device 11 also has an analysis unit 12 as an ideal state definition unit, a specification unit, and an inequality definition unit, an estimation unit 13, and a key length calculation unit 14. Bob 3 has the same configuration as Alice 2 except that it does not have the response estimation device 11. Therefore, in the following, in order to avoid duplication of explanation, the following explanation will mainly focus on Alice 2.

In the quantum cryptography key distribution system 1 according to this embodiment, a case will be described in which a response estimation device 11 is provided in Alice 2; however, the present invention is not limited to this, and a response estimation device 11 may be provided only in Bob 3 without providing a response estimation device 11 in Alice 2, or a response estimation device 11 may be provided in both Alice 2 and Bob 3.

In this case, Alice 2 outputs an optical pulse from the laser light source 5 to the intensity modulator 6, and the output from the intensity modulator 6 is guided in turn to the phase modulator 7 and variable optical attenuator 8. Alice 2 modulates the intensity (average number of photons) of the optical pulse using the intensity modulator 6, and modulates the phase of the optical pulse using the phase modulator 7. The random number generator 9 generates random numbers that specify the magnitude of the intensity modulation and phase modulation, and instructs the intensity modulator 6 and phase modulator 7 on the magnitude of the intensity modulation and phase modulation based on this specification. Alice 2 attenuates the optical pulse to a single photon level using the variable optical attenuator 8, and then sends the optical pulse to Charlie 4, which is the photon detection unit 4.

Here, when Alice 2 and Bob 3 send optical pulses to Charlie 4, they randomly switch between signal mode and test mode, and randomly send communication optical pulses generated in signal mode and test optical pulses generated in test mode.

The signal mode is a mode for generating an encryption key by accumulating a common bit value between Alice 2 and Bob 3. In the signal mode, a random bit value (random bit) a is encoded into an optical pulse with a fixed intensity (average number of photons) μ to generate and transmit an optical pulse (optical pulse for communication) with an amplitude of (-1) ^a √μ.

In the test mode, the phase θ is randomly selected independently of the signal mode, and an optical pulse (test optical pulse) with three intensities 0, μ ₁ , and μ ₂ randomly selected is generated and transmitted. Specifically, when the test mode is selected, a test optical pulse of |0>, |√μ ₁ e ^iθ >, or |√μ ₂ e ^iθ > is randomly selected and transmitted.

Specifically, in Alice 2, if the label selected in signal mode is "0" and the labels selected in test mode are "10", "11" and "2", the encryption key distribution method including the response estimation method of this embodiment is executed according to the following procedure of steps 1 to 8.

[Step 1]
In step 1, Alice 2 randomly selects a label from among the labels "0", " ₁₀ ", " ₁₁ " and " ₂ " with probabilities _p0 , p10, p11 and p2, respectively. Alice 2 executes the following procedure according to the label randomly selected with each probability.
“0”: Alice 2 generates a random bit a and transmits an optical pulse with amplitude (-1) ^a √μ as the optical pulse for communication.
"10": Alice 2 transmits a pulse with zero amplitude as an optical test pulse (note that, although in reality, no optical test pulse is transmitted, it is specified here that a pulse with zero amplitude is transmitted as the optical test pulse).
“11”: Alice 2 transmits a test optical pulse with intensity μ ₁ and phase θ randomly selected.
“2”: Alice 2 transmits a test optical pulse with intensity _μ2 and randomly selected phase θ.

In this embodiment, the signal mode in which the label “0” is randomly selected with probability _p0 is referred to as “Signal,” the test modes in which the labels “ ₁₀ ” and “11” are randomly selected with probabilities p10 and _p11 , respectively, are collectively referred to as “Test 1,” and the test mode in which the label “ ₂ ” is randomly selected with probability p2 is referred to as “Test 2.”

[Step 2]
Bob 3 independently performs the same procedure as Alice 2 in step 1.

[Step 3]
Alice 2 and Bob 3 repeat steps 1 and 2 a total of N _tot times (rounds).

[Step 4]
Alice 2 and Bob 3 randomly select a label with each probability, and each time they randomly generate a communication optical pulse or a test optical pulse, they sequentially transmit this to Charlie 4 via the quantum communication channel 100 .

In this embodiment, Charlie 4 is a photon detection unit 4 that can also be a photon detection unit controlled by an unauthorized eavesdropper, also known as Eve, and has a 50:50 beam splitter 15, a pair of single photon detectors 16a, 16b, and a notification unit 20.

Charlie 4 receives successive optical pulses transmitted from Alice 2 and Bob 3 at beam splitter 15. Beam splitter 15 causes pairs of optical pulses received at the same time from Alice 2 and Bob 3 to interfere with each other, and outputs an optical pulse to the first single-photon detector 16a when the phase difference between the pair of optical pulses is 0, and outputs an optical pulse to the second single-photon detector 16b when the phase difference is π.

As a result, in Charlie 4, when the phase difference between the pair of light pulses is 0 and they are in phase, a photon can be detected by the first single-photon detector 16a, and when the phase difference between the pair of light pulses is π and they are out of phase, a photon can be detected by the second single-photon detector 16b.

For each pair of optical pulses received from Alice 2 and Bob 3 at the same time, Charlie 4 publishes the detection results, via a public communication path by a notification unit 20, to Alice 2 and Bob 3, indicating whether a photon was detected by single photon detectors 16a, 16b, and, if detected, which of single photon detectors 16a, 16b detected the photon. Alice 2 and Bob 3 acquire the detection results published by Charlie 4 using an acquisition unit 10.

[Step 5]
After that, after the quantum communication is completed, Alice 2 and Bob 3 publish the labels they have selected through the public communication channel. Using the response estimation device 11, Alice 2 determines the number of rounds (detection count) in which both Alice 2 and Bob 3 selected the label "0" and Charlie 4 notified detection, and sets this as _K0 . Alice 2 defines a sifted key by concatenating the random bits of _K0 in which both Alice 2 and Bob 3 selected the label "0".

On the other hand, Bob 3 keeps the random bits of the rounds in the same phase among the rounds of _K0 in which both Alice 2 and Bob 3 selected the label “0”, and inverts all the random bits of the rounds declared to be in the opposite phase. Then, Bob 3 defines the sifted key by concatenating the bits of all the rounds of _K0 .

In this way, Alice 2 and Bob 3 can generate a shift key that serves as the basis for the encryption key based on the communication light pulses.

[STEP 6]
At this time, Alice 2 uses the response estimation device 11 to find the number of rounds (detection count) in which both Alice 2 and Bob 3 selected the labels "10", "11", and "2" and Charlie 4 notified detection. Here, let _K10 be the number of detections when both Alice 2 and Bob 3 selected the label "10", _K11 be the number of detections when both Alice 2 and Bob 3 selected the label "11", and _K2 be the number of detections when both Alice 2 and Bob 3 selected the label "2". Here, let _K1 = _K10 + _K11 .

[STEP 7]
For error correction, Alice 2 informs Bob 3 of the H _EC bits of the syndrome of the linear code in her sifted key. In response, Bob 3 corrects his sifted key accordingly. Alice 2 and Bob 3 verify the correction by comparing the ζ′ bits via a universal hash (Reference 24). H _EC is a parameter that is determined in advance based on the expected amount of communication errors. ζ′ is a parameter that is determined in advance to specify how much imperfection in the encryption key is tolerated.

…（１）
なお、上記の式（１）の「<_ 」は「≦」とも表記し、「>_ 」は「≧」とも表記する。 Here, Alice 2 proves the security of this protocol based on the following formula (1) using the analysis unit 12 and the estimation unit 13. Note that the following formula (1) will be described in detail later.

…(1)
In addition, in the above formula (1), "<_" can also be written as "≦", and ">_" can also be written as "≧".

Note that Prob is a symbol indicating that the parameters in { } are specified in terms of probability. In other words, the above formula (1) indicates that the probability that _K0 ^(even) ≦f( _K1 , _K2 ) is equal to or greater than (1-ε).
_K0 ^(even) is a parameter that indicates the number of detections when the total number of photons in the optical pulse pairs of Alice 2 and Bob 3 is an even number, out of the number of detections _K0 when both Alice 2 and Bob 3 select the optical pulse for communication (labeled "0"). The value of this parameter changes depending on the amount of eavesdropping.
f( _K1 , _K2 ) is a function including the number of detections _K1 when both Alice 2 and Bob 3 select the labels "10" and "11", and the number of detections K2 when both Alice 2 and Bob 3 select the label " ₂ ". Details of the function f( _K1 , _K2 ) will be described later.
ε is a predetermined parameter that indicates the probability for specifying the degree of imperfection that is tolerated in the final encryption key output by the quantum encryption key distribution system 1 (i.e., for specifying the amount of estimated error that is tolerable in estimating the amount of eavesdropping on a pair of communication optical pulses).

…（２） [STEP 8]
Based on the inequality shown in the above formula (1), Alice 2 calculates the final encryption key length with high security using the following formula (2) by using the key length calculation unit 12, and notifies Bob 3. As a result, Alice 2 and Bob 3 each generate an encryption key of length G in the following formula (2) from the sifted key.

…(2)

In the above equation (2), G is the length of the encryption key.
The function h(x) is h(x)=- _xlog2x- (1-x) _log2 (1-x) when x ≦ 1/2, and h(x)=1 when x > 1/2. ζ is a parameter that is determined in advance to specify the degree of imperfection in the encryption key that is tolerated.

(2) Outline of the response estimation method of the quantum cryptography key distribution system according to the present embodiment Next, an outline of the response estimation method according to the present embodiment will be briefly described with reference to the image diagram shown in Fig. 2. As shown in Fig. 2A, when a quantum mechanical ideal state 101 of a special optical pulse capable of directly measuring the amount of eavesdropping to be estimated is difficult to generate with an existing laser light source 5, the response estimation method according to the present embodiment generates a quantum mechanical approximation state 102 that approximates the ideal state 101 by addition and subtraction using quantum mechanical states 103, 104, and 105 of optical pulses of various intensities that can be generated from a laser light source 5.

At that time, the approximate state 102 and the ideal state 101 are adjusted to satisfy an operator inequality related to the density operator representing the quantum state. The inequality related to the number of detections used in the response estimation method according to this embodiment can be obtained by simply using the Bernoulli sampling formula twice, and by using this inequality, a strict worst-case value (upper limit of the amount of eavesdropping) can be obtained under a specified confidence level.

Figure 2B is another image diagram for explaining the response estimation method according to this embodiment, which shows that traces of eavesdropping emerge when light is irradiated onto the target object 110. As described above, in a quantum communication system, in order to directly reveal traces of eavesdropping, special light that is difficult to generate with the laser light source 5 may be required. Instead of actually generating such light, in the response estimation method according to this embodiment, two types of data obtained by irradiating a light pulse (laser light) that can be generated by the laser light source 5 are created and subtracted. The inventors of the present application have been able to mathematically prove that traces appear in the result of this subtraction regardless of the type of eavesdropping attack.

(2-1) Overview of the inequality used in the response estimation method according to the present embodiment As described above, the inequality shown in the above formula (1) used in the response estimation method according to the present embodiment can be obtained by simply using the Bernoulli sampling formula twice. Here, a different example will be presented without using the above-mentioned quantum cryptography key distribution system 1, and a general overview of the inequality shown in the above formula (1) will be described while explaining a general Bernoulli sampling formula.

Figure 3 is an image diagram for explaining the Bernoulli sampling formula, and here we consider an example in which, when shipping a plurality of products (e.g., 10,000 products) 28, the number of defective products (also called defective items) contained in the actually shipped products 29 is identified. When the presence or absence of defects in each product can only be confirmed by destructive testing, one method is to randomly select a predetermined number of products (e.g., 100 items) from the products 28 to be shipped, inspect the randomly selected products for defects, and use the results to estimate the degree to which defective items are contained among the remaining 9,900 products 29 that were shipped.

Bernoulli sampling is known as a method for randomly selecting around 100 products from 10,000 products scheduled for shipment. Bernoulli sampling involves selecting a product to be sampled from each of the 10,000 products with a probability of p (for example, 1/100).

For example, when products randomly selected by Bernoulli sampling from the products to be inspected are irradiated with an ideal probe light (hereinafter, the probe light will be simply referred to as the probe) 25 and subjected to destructive inspection, the total number K of products found to be defective (denoted as "defective") is strictly guaranteed in relation to the total number of "defective" products among the remaining products 29 shipped.

…（３）

…（４） Here, the guarantee is given in the form of, for example, "the probability that more than five defects will be found in shipped products is 0.001% or less." If the sampling probability is p, the total number of defects found by inspection is K, the total number of defects found in shipped products is M, and a predetermined parameter (probability for specifying the estimated error amount) for specifying the amount of estimated error that is allowable as the confidence level of the estimation is ε, the Bernoulli sampling formula can be expressed by the following equations (3) and (4).

…(3)

…(4)

…（５）

…（６）
を満たす。ここで、χ(条件式)は、条件式が真のとき１、偽のとき０の値をとる。 In this case, ^M- indicates the lower limit of the total number of defects found in the shipped products 29, and M ⁺ indicates the upper limit of the total number of defects found in the shipped products 29. M- and M ⁺ are functions that depend on k, p, and ε, and for ^any non-negative integer n,

…(5)

…(6)
Here, χ (conditional expression) takes a value of 1 when the conditional expression is true, and takes a value of 0 when the conditional expression is false.

…（７）
をMについて解いて得られる2つの解の大きいほうをM⁺、小さいほうをM^-とすると、式（５）と式（６）が満たされる。ここで、

…（８）
である。 Specifically, one way to select the functions M ^- (k; p, ε) and M ⁺ (k; p, ε) is to use the equation (7) shown below.

…(7)
If the larger of the two solutions obtained by solving for M is called M ⁺ and the smaller is called ^M- , then equations (5) and (6) are satisfied. Here,

…(8)
It is.

Here, as shown in Figure 4, for example, when a product 28 (object) is inspected with an ideal probe 25 that can accurately inspect whether the product has a defect, if a "positive" detection result is obtained by the ideal probe 25, it can be said that the product has a defect, whereas if a "negative" detection result is obtained, it can be said that the product does not have a defect.

However, when inspecting a product 28 using an inexpensive probe (test signal) 30 that has lower inspection accuracy than an ideal probe (ideal signal capable of measuring a specified state of an object) 25, due to the low inspection accuracy, generally, even if a "positive" detection result is obtained using the inexpensive probe 30, it does not necessarily mean that the product is defective, and similarly, even if a "negative" detection result is obtained, it does not necessarily mean that the product is free of defects.

…（９） Therefore, as shown in Fig. 5 and the following formula (9), two types of "+" probes 30a and "-" probes 30b that can approximate the quantum mechanical ideal state ρ ^(ideal) of an ideal probe are found by subtracting the quantum mechanical state ρ ₊ ^{( test)} of the "+" probe 30a from the quantum mechanical state ρ _- (test) of the "-" probe 30b, and the product 28 is considered to be inspected with the two types of probes, the "+" probe 30a and the "-" probe 30b, whose quantum mechanical states satisfy the condition of the following formula (9). Note that here, the condition as in the following formula (9) is also referred to as an operator dominance condition.

…(9)

In the above formula (9), ρ ₊ ^(test) , ρ ₋ ^(test) , and ρ ^(ideal) are called density operators or density matrices, and represent the quantum mechanical state of matter or light in quantum mechanics.

ρ ₊ ^(test) is the density operator of the inexpensive “+” probe 30a, ρ _- ^(test) is the density operator of another inexpensive “−” probe 30b that is in a different quantum mechanical state from the “+” probe 30a, and ρ ^(ideal) is the density operator of the ideal probe 25.
α and β are positive real numbers (parameters).
An inequality between operators A >= B means that the difference operator AB is positive semidefinite.

Here, let _K1 be the total number of events (also called the number of detections) that result in a positive result when a product 28 is inspected with a "+" probe 30a with a probability _P1 . Let _K2 be the total number of events (also called the number of detections) that result in a positive result when a product 28 is inspected with a "-" probe _30b with a probability P2. Let the product 29 be shipped with a probability _P3 . Note that if all uninspected products are shipped, _P3 = 1- _{P1 -P2} holds, but below we will also include the case where none of the products are shipped, and the probability of shipment is an arbitrary value that satisfies 0< _P3 ≦ 1- _{P1 -P2} . Let M be the total number of positive results when the shipped products 29 are inspected with an ideal probe 25.

…（１０） In this case, the following equation (10) can be derived using the above equation (9) and the binomial distribution equations (3) and (4) based on the Bernoulli sampling formula.

…(10)

Here, we will explain the function f( _K1 , _K2 , _P1 , _P2 , _P3 , α, β, ε) in the above equation (10), which is a function including _K1 , _K2 , _P1 , _P2 , _P3 , α, β, ε.

…（１１） First, as shown in Fig. 6, the difference between the left and right sides of the inequality in the above formula (9) is a semi-positive definite value, so it can be expressed as (α-β-1)ρ ^(junk) using a certain quantum mechanical state ρ ^(junk) . Then, ρ ₊ ^(test) can be expressed as the following formula (11) using this ρ ^(junk) . Note that α-β ≧ 1.

…(11)

…（１２）

…（１３） Here, if _Q1 , _Q2 , and _Q3 are defined by the following formula (12), the above formula (11) can be expressed by the following formula (13), where _Q1 , _Q2 , and _Q3 ≧0, and _Q1 + _Q2 + _Q3 ＝ _P1 .

…(12)

…(13)

Here, the following can be said from the above formula (13).
Let _K1 be the total number of positive results when inspecting products 28 with a "+" probe 30a with a probability of _P1 , and this is quantum mechanically equivalent to carrying out all three of the following steps (i), (ii), and (iii), as shown in Figure 6. Additionally, _K1 = _L1 + _L2 + _L3 .

(i) Let L ₁ be the total number of positive results when the products 28 are inspected with the "-" probe 30b with a probability of Q ₁ .
(ii) Let L ₂ be the total number of positive results when products 28 are inspected with an ideal probe 25 with a probability of Q ₂ .
(iii) Let L ₃ be the total number of positive results when the products 28 are inspected with the "junk" probe 32 with a probability of Q ₃ .

Here, consider the case where a product 28 is inspected using two types of probes, a "+" probe 30a and a "-" probe 30b, as shown in Fig. 7. That is, consider the case where "when a product 28 is inspected with a "+" probe 30a with a probability of _P1 , the total number of positive results is _K1 ," and "when a product 28 is inspected with a "-" probe 30b with a probability of _P2 , the total number of positive results is _K2 ." Furthermore, a product ₂₉ is shipped with a probability of P3, and the number of defects in the shipped product 29 is M.

As explained in Figure 6, "when inspecting products 28 with a "+" probe 30a with a probability of _P1 , the total number of positive results is _K1 " is quantum mechanically equivalent to performing all three of the above (i), (ii), and (iii), so inspecting products 28 using two types of probes, a "+" probe 30a and a "-" probe 30b, can be said to be quantum mechanically equivalent to performing all five of the following (i), (ii), (iii), (iV), and (V), as shown in Figure 7. Also, _K1 = _L1 + _L2 + _L3 .

(i) Let _L1 be the total number of positive results when products 28 are inspected with the "-" probe 30b with probability _Q1 . (ii) Let L2 be the total number of positive results when products ₂₈ are inspected with an ideal probe 25 with probability _Q2 . (iii) Let _L3 be the total number of positive results when products 28 are inspected with the "junk" probe ₃₂ with probability Q3. (iV) Let _K2 be the total number of positive results when products 28 are inspected with the "-" probe 30b with probability _P2 .
(V) Let M be the total number of positive results when inspecting products 28 with an ideal probe 25 with probability _P3 .

In this way, inspecting product 28 using two types of probes, "+" probe 30a and "-" probe 30b, can be said to accomplish all five of the above tasks from a different perspective.

Here, looking at (ii) and (V) above, the probability of being selected is different for _Q2 and _P3 , but in both cases, the ideal probe 25 is used to inspect the products 28, and the total number of positives is counted. Therefore, under the condition that "(ii) or (V) is selected," the total number of positives obtained for samples selected with probability _Q2 /( _P3 + _Q2 ) is _L2 , and the total number of positives in products not selected is M, which is the same as Bernoulli sampling. Therefore, the total number of defects, M, can be estimated by _L2 .

…（１４） Based on this idea, the following equation (14) can be obtained based on the Bernoulli sampling formula shown in the above equation (4).

…(14)

…（１５） Similarly, when we look at (i) and (iV) above, the probability of selection is different between _Q1 and _P2 , but in both cases, the "-" probe 30b is used to inspect the products 28 and the total number of positives is counted. Therefore, with the same idea as above, the total number of defects _L1 can be estimated by _K2 . Therefore, in this case as well, the following formula (15) can be obtained based on the Bernoulli sampling formula shown in the above formula (3).

…(15)

Moreover, by changing the above _K1 = _L1 + _L2 + _L3 to _L2 + _L3 = _K1 - _L1 , removing _L3 and expressing _L2 as an inequality, the following equation (16) can be obtained.
L ₂ ≦ K ₁ - L ₁ … (16)

From the above, it is possible to determine _L1 from _K2 based on the above formula (15), and it is possible to determine _L1 and _L2 from _K1 based on the above formula (16), and it is further possible to determine the total number M that is ultimately desired from _L2 based on the above formula (14). Of these, _K1 and _K2 are parameters that can be found by inspecting the products 28 using two types of probes, the "+" probe 30a and the "-" probe 30b.

…（１７） Then, from the above formulas (14), (15), and (16), the above formula (10) and the following formula (17) can finally be obtained (FIG. 8).

…(17)

In this way, by simply using the Bernoulli sampling formula (equations (14) and (15)) twice, the total number M of positive products 29 finally shipped can be estimated based on the inspection results of products 28 using two types of probes, a "+" probe 30a and a "-" probe 30b.

From the above, in the above example, for example, in a system in which a quantum mechanical probe (signal) is transmitted from a transmitter to a product 28, which is an object, a response in the system at the time when the probe is input from the transmitter can be estimated. In this case, a quantum mechanical ideal state ρ ^(ideal) of a probe (ideal signal) 25 capable of detecting a certain event in the product 28 is specified (ideal state specification step). Then, an approximation state in which this ideal state ρ ^(ideal) and a quantum mechanical state are approximated is expressed by addition and subtraction using the quantum mechanical states ρ ₊ ^(test) and ρ _- ^(test) of two types of inexpensive probes (test signals) 30a and 30b, and an operator inequality (αρ ₊ ^(test) -βρ _- (test) ≧ ρ ^(ideal) ) that defines the relationship between the ideal state ρ ^(ideal) and the quantum mechanical states ρ ₊ ^{(test) and} ρ _- ^(test) of the two types of inexpensive probes 30a and 30b is specified (specification step).

In addition, in this example, an inequality (Prob{M ≦ f(K1, K2; P1, P2, P3, α, β, ε)} ≧ 1-ε) that defines the relationship between the number M of events indicating that a product 29 is defective detected by an ideal probe 25, the number _K1 , _K2 of events indicating that a product 28 is defective obtained for each type of inexpensive probe 30a, 30b when two types of inexpensive probes _30a , _30b are randomly selected to detect events indicating that a product 28 _is defective, and a probability ε for determining the _amount of estimation error that is acceptable as the confidence level of the estimation is defined based _on the Bernoulli sampling formula (inequality definition step).

As a result, in this example, the two types of inexpensive probes 30a, 30b identified in the identification step are randomly switched to irradiate the product 28, and detection results ( _K1 , _K2 ) of defective events using the inexpensive probes 30a, 30b are obtained (acquisition step).Based on the detection results obtained in the acquisition step, the inequality in equation (10) is solved to estimate the response to the input when the probes are input, i.e., the response as to the extent to which the product 29 contains defective items (estimation step).

Note that, although the present invention is not limited to this example in that two types of inexpensive probes 30a and 30b are used, the quantum mechanical ideal state of an ideal probe (ideal signal) 25 may be approximated by using three or more types of inexpensive probes and adding and subtracting the quantum mechanical states of the three or more types of inexpensive probes.

As shown in Figure 9, even when three or more types of inexpensive probes are used, the probes can be grouped as follows: _α := _Σiαi , β:= _{Σjβj ,} ρ ₊ ^(test) := _Σi ( _αi /α) _ρi , _ρ- ^(test) := _Σj ( _βj /β) _ρ'j , and the above equation (9) can be considered.

(2-2) Inequality in response estimation method in quantum communication system In the above, it has been explained that the inequality shown in the above formula (1) can be obtained by using the Bernoulli sampling formula only twice, using the number of defective products among shipped products as an example. Here, the response estimation method in the twin-field quantum cryptography key distribution system 1 shown in Fig. 1 will be explained again.

…（１８） In the signal mode, Alice 2 generates an optical pulse C _A with an amplitude √μ with a probability of 1/2, and an amplitude -√μ with a probability of 1/2. In either case, the probability that the optical pulse C _A contains an even number of photons is e ^-μ cosh μ, and the probability that it contains an odd number of photons is e ^-μ sinh μ. Bob 3 generates an optical pulse C _B in exactly the same way. In this case, the density operator that expresses the quantum state of the two pulses is expressed as the sum form using the state ρ ^(even) where the total number of photons is an even number and the state ρ ^(odd) where the total number of photons is an odd number, as shown in the following equation (18).

…(18)

This means that two pulses are prepared in state ρ ^{(even) with} probability p _even :=e ^-2μ cosh 2μ, which is equivalent to being prepared in state ρ ^(even) with probability p _odd :=1-p _even .

Under this interpretation, the total number of detections _K0 reported by Charlie 4 in signal mode can be considered as the sum of the number of detections _K0 ( ^{even) when two pulses are ready in state ρ (even )} and the number of detections _K0 ( ^odd) when two pulses are ready in state ρ ⁽ odd) ( _K0 = _K0 ^(even) + _K0 ^(odd) ).

K ₀ ^(even) /K ₀ is called the phase error rate, and corresponds to the contribution rate to the number of detections of the state ρ ^(even) where the total number of photons is even. A low phase error rate means that the amount of eavesdropping on the sifted key is low. K ₀ ^(even) is a quantity that cannot actually be known, but if its upper limit e _ph can be determined by some method, a privacy amplification procedure can be used to shorten the length of the final encryption key to approximately 1- h (e _ph ) times the length of the sifted key, resulting in a secure encryption key that is almost free of eavesdropping (References 22, 23). Here, as mentioned above, the function h(x) is h(x)=-xlog ₂ x-(1-x)log ₂ (1-x) when x ≦ 1/2, and h(x)=1 when x > 1/2.

…（１９）
が成り立つ時、最終的な暗号鍵の長さを、下記の式（２０）

…（２０）
にすれば、暗号鍵の不完全性が、次式（２１）で与えられるε_secに抑えられることが知られている。

…（２１） More precisely, in this embodiment, the following formula (19)

…(19)
When this is true, the length of the final encryption key is calculated using the following formula (20).

…(20)
It is known that, if the encryption key is set to ε sec, the incompleteness of the encryption key can be suppressed to ε _sec given by the following equation (21).

…(21)

Therefore, if we can find a function f(K ₁ , K ₂ ) that satisfies equation (1), then by taking the length of the final encryption key as G in equation (2), we can prove that its incompleteness is at most ε _sec in the above equation.

The main problem is how to design the test mode to estimate K ₀ ^(even) in the signal mode. Here, in the quantum key distribution system 1, it is very difficult to actually generate an optical pulse of ρ ^(even) in an ideal state using the laser light source 5. Therefore, based on the idea of "(2-1) Outline of the inequality used in the response estimation method according to the present embodiment" described above, the upper limit of K ₀ ^(even) is derived only from the number of detections of states that can be generated using the laser light source 5.

…（２２）
（ii）確率p₁₁ ²で光パルス対が下記の式（２３）の状態に準備される。その際の検出数はK₁₁

…（２３）
（iii）確率p₂ ²で光パルス対が下記の式（２４）のに準備される。その際の検出数はK₂

…（２４）
（iV） 確率p₀ ²p_evenで光パルス対が状態ρ^(even) に準備される。その際の検出数はK₀ ^（even）
となる。 The density operator of the state of an optical pulse with intensity μ and phase θ randomly selected is denoted as τ(μ). The number of detections that appear in this embodiment can be summarized as follows:
(i) With a probability p ₁₀ ² , a pair of optical pulses is prepared in the state of the following equation (22). The number of detections at that time is K ₁₀

…(22)
(ii) With probability p ₁₁ ² , the optical pulse pair is prepared in the state of the following equation (23). The number of detections at that time is K ₁₁

…(23)
(iii) With probability p ₂ ² , a pair of optical pulses is prepared as shown in the following equation (24). The number of detections is K ₂

…(24)
(iV) With probability p ₀ ² p _even , an optical pulse pair is prepared in state ρ ^(even) . The number of detections is K ₀ ^(even).
It becomes.

…（２５） The method of proof here is based on the operator dominance condition shown in the following equation (25).

…(25)

Here, Γ and Λ are positive constants. In this embodiment, the parameter set ( _p10 , _p11 , μ, _μ1 , _μ2 , Γ, Λ) satisfies the above formula (25). Note that Γ and Λ can be calculated from _p10 , _p11 , μ, _μ1 , _μ2 ), and the explanation thereof will be given later (formulas (38), (39), and (40)).

…（２６） Here, the density operator of the optical pulse pair is defined as the following equation (26).

…(26)

…（２７） The positive parameters α and β are defined as shown in the following equation (27).

…(27)

In this case, equation (25) becomes identical to equation (9) in "(2-1) Overview of inequalities used in the response estimation method of this embodiment" above.

Moreover, the number of detections that appears in this embodiment can be rewritten as follows.
(i) A pair of optical pulses is prepared in state ρ ₊ ^(test) with probability p ₁₀ ² + p ₁₁ ^2. The number of detections is then K ₁
(ii) With probability p ₂ ² , a pair of optical pulses is prepared in state ρ _- ^(test) . The number of detections is then K ₂
(iii) With probability p ₀ ² p _even , an optical pulse pair is prepared in state ρ ^(even) . The number of detections at that time is K ₀ ^(even).

…（２８） Here, ^if _P1 = _p102 + ^p112 , _P2 ⁼ _{p22 , P3} = _p02peven , ^and M = _K0 ^(even) , the settings are the same as those in "(2-1) Outline of inequalities used in the response estimation method _according to this embodiment." Therefore, _if the following equation (28) is defined using the function f( _K1 , _K2 , _P1 , _P2 , _P3 , α, β, ε) defined in equation (17), the above equation (1) can be derived by utilizing the fact that equation (10) holds.

…(28)

…（２９）

…（３０） The function f(K ₁ , K ₂ ) given by the above equation (28) becomes the following equations (29) and (30).

…(29)

…(30)

…（３１） Note that M ^± obtained by solving equation (7) for M can be approximated as in equation (31) below when (1 - p)K >> -logε.

…(31)

…（３２）

…（３３）
As a result, the function f(K1, K2) in the above formula (29) can be expressed by the following formula (32). Note that f(K1, K2) in the following formula (32) can be expressed by the following formula (33).

…(32)

…(33)

(2-3) Numerical Simulation Next, the relationship between the distance L between Alice 2 and Bob 3 and the key rate per pulse G/N _tot was investigated by numerical simulation, and the results shown in Fig. 11 were obtained. In this numerical simulation, the loss in the optical fiber when transmitting optical pulses from Alice 2 and Bob 3 to Charlie 4 was set to 0.2 dB/km, the mode mismatch rate independent of loss was set to e _m = 0.03, and the detection efficiency of Charlie 4 was set to η _d = 0.3. In addition, the parameters (μ, μ ₁ , μ ₂ , p ₀ , p ₁₀ , p ₁₁ , p ₂ ) were optimized for each distance L.

In this numerical simulation, the following model was applied to determine _K0 , _K1 , and _K2 . The overall permeability from Alice 2 to Charlie 4 and the overall permeability from Bob 3 to Charlie 4 were set to η= _ηd10-0.2L ^/20 , respectively.

…（３４）

…（３５）

…（３６） We assumed that Charlie 4 would declare success when one or both of the single photon detectors 16a and 16b detect a photon. If both single photon detectors 16a and 16b detect a photon, Charlie 4 would randomly declare in-phase or out-of-phase. We set the false positive rate (dark count probability) of Charlie 4's single photon detectors 16a and 16b to p _d = 10 ^-8 . In this case, the effective false positive rate of the single photon detectors 16a and 16b combined is d: = 2p _d -p _d ^2. The expected detection frequency can be modeled as the following equations (34), (35), and (36).

…(34)

…(35)

…(36)

…（３７） For the bit error rate, a model shown in the following equation (37) with a mode mismatch rate e _m =0.03 was used.

…(37)

The cost of error correction, H _EC, was assumed to be 1.1 × K ₀ h(e _bit ).

In calculating the key rate for finite values of N _tot , the security parameters are ε = 2 ^-66 , ζ = 66 and ζ ´ = 32, and the protocol is found to be secure for ε _sec = 2 ^-31 < 10 ^-10 .

The final quantum key length G shown in equation (2) above was optimized using the Nelder-Mead method with six parameters: μ,a = _μ1 /μ,b = _μ2 /μ, _p2 , _p1 = _p10 + _p11 ,s = _p10 /( _p10 + _p11 ).

Fig. 10 shows the asymptotic limit key generation rate (Asymptotic), which is the limit when the number of pulse pair transmissions N _tot is infinite, and the key generation rate when the number of transmissions is finite and N _tot = 10 ¹¹ and 10 ^12. For comparison, Fig. 10 also shows the asymptotic limit rate of the ideal decoy BB84 protocol (References 2, 4) for a direct link from Alice 2 to Bob 3 with a transmission rate of η _d 10 ^{-0.2L / 10} , and the PLOB limit rate (Reference 4), which is the theoretical limit for a direct link.

The key rate of N _tot = 10 ¹¹ using the protocol according to this embodiment slightly exceeds the PLOB limit when the distance L between Alice 2 and Bob 3 is 300 km or more. It was also confirmed that N _tot = 10 ¹² using the protocol according to this embodiment clearly exceeds the PLOB limit at 250 km or more. It was also confirmed that the protocol according to this embodiment exceeds the performance of the decoy BB84 protocol at N _tot = 10 ¹¹ and exceeds 150 km.

From the results of the numerical simulation shown in Fig. 10, it was confirmed that the PLOB limit is exceeded when the total number of pulse pairs transmitted from Alice 2 and Bob 3 is 10 ¹¹ -10 ¹² , which corresponds to several minutes to 20 minutes in a system repeating pulses at 1 GHz.

…（３８） (2-4) Construction of operator dominance condition
Here, a procedure for calculating a parameter set that satisfies the operator dominance condition shown in the above formula (25) will be described. It is assumed that the values of μ ₁ , μ ₂ , p ₁₀ , and p ₁₁ > 0 satisfy the following formula (38).

…(38)

…（３９）

…（４０） In this case, if Γ and Λ are defined in accordance with the following expressions (39) and (40), the above expression (25) is satisfied.

…(39)

…(40)

…（４１） The proof is as follows: Using τ(μ)=e ^-μ Σ _k (μ ^k /k!)|k><k|, the left side of the above equation (25) has the diagonal form Σ _k , _k′ (q _k+k′ / k! k′!)|k,k′><k,k′| in the Fock basis, where q _m is expressed by the following equation (41).

…(41)

…（４２） By substituting the above equation (39) into the above equation (41), the following equation (42) is obtained under the condition of the above equation (38).

…(42)

…（４３） Using _qm , the above equation (40) can be rewritten as the following equation (43).

…(43)

…（４４） Let π _e =Σ ^∞ _k=0 |2k><2k| and π _e =Σ ^∞ _k=0 |2k><2k| be projection operators onto the subspaces with even and odd photon numbers, respectively. In addition, π _st is expressed by the following equation (44).

…(44)

…（４５） Since the state ρ ^(even) is the state obtained when the total number of photons is an even number, the following equation (45) is obtained.

…(45)

…（４６）

…（４７）

…（４８） Therefore, it can be said that the above equation (25) is equivalent to the set of equations (46), (47) and (48) below.

…(46)

…(47)

…(48)

…（４９）
ただし、

…（５０）
である。 The condition of the above formula (48) is clearly true from the above formula (42). When k+k' is an even number, qk _+k' > 0 holds, so if the following formula (49) is true, then the above formula (46) is true.

…(49)
however,

…(50)
It is.

…（５１）
同様に、下記の式（５２）のもとで下記の式（５３）が成り立ち、このことは上記の式（４７）も真であることを意味する。

…（５２）

…（５３） From equation (43), the following equation (51) is obtained, and it can be seen that the above equation (49) and the above equation (46) are true.

…(51)
Similarly, under the following equation (52), the following equation (53) holds, which means that the above equation (47) is also true.

…(52)

…(53)

(3) Actions and Effects In the above configuration, the response estimation device 11 according to this embodiment is provided in a quantum key distribution system ₁ in which Alice 2 and Bob 3, connected via a quantum communication path 100, randomly select and sequentially transmit to the other party an optical communication pulse obtained by modulating an optical pulse with a randomly selected random bit, and multiple types of test optical pulses, the phase θ and intensities μ1, _μ2 of which are randomly selected.

In this case, the response estimation device 11 defines a quantum mechanical ideal state ρ (ideal) of an ideal optical pulse capable of detecting the number K ₀ ^(even) of detections of pairs of communication optical pulses involved in eavesdropping out of the number K ₀ of detections of pairs of communication optical pulses detected because both Alice 2 and Bob 3 selected the communication optical pulses ⁽ ideal state definition step).

In addition, the response estimation device 11 expresses an approximation state in which the ideal state ρ ^(ideal) and the quantum mechanical state are close to each other by addition and subtraction using the quantum mechanical states ρ ₊ ^(test) and ρ ₋ ^(test) of the test optical pulses generated by random modulation, and identifies an operator inequality that defines the relationship between the ideal state ρ ^(ideal) and the quantum mechanical states ρ ₊ ^(test) and ρ ₋ ^(test) of the two types of test optical pulses (identification step).

Then, in the response estimation device 11, the inequality of the above formula ₍₁ ) that defines the relationship among the detection number _K0 ^(even) of pairs of communication optical pulses involved in eavesdropping measured using ideal optical pulses, the detection number _K1 of the first pair of test optical pulses detected as a result of Alice 2 and Bob 3 selecting first test optical pulses randomly selected with probabilities p10 and p11, respectively, in a specified combination (test 1), the detection number _K2 of the second pair of test optical pulses detected as a result of both Alice 2 and Bob 3 selecting second test optical pulses randomly selected with probability _P2 (test ₂ ), and the probability ε for defining the tolerable amount of estimation error in estimating the amount of eavesdropping on pairs of communication optical pulses is defined from a binomial distribution based on the Bernoulli sampling formula (inequality defining step).

As a result, when the response estimation device 11 randomly transmits communication optical pulses and test optical pulses to Charlie 4 from Alice 2 and Bob 3, and obtains detection results from Charlie 4 detecting matching communication optical pulses and test optical pulses between Alice 2 and Bob (acquisition step), it can solve the inequality in equation (1) above based on the detection results and estimate the amount of eavesdropping in the quantum cryptography key distribution system 1 when the communication optical pulses are input (estimation step).

In this way, in this embodiment, eavesdropping on communication optical pulses can be monitored using an inequality defined based on the Bernoulli sampling formula, so that eavesdropping can be monitored efficiently using an existing laser light source 5 without using a special ideal optical pulse that is said to be necessary to detect eavesdropping.

According to the above configuration, the amount of eavesdropping on optical pulses for communication can be estimated using an inequality defined by a binomial distribution based on the Bernoulli sampling formula, so that the amount of eavesdropping on optical pulses for communication can be efficiently estimated without using special ideal optical pulses that have traditionally been necessary to estimate the amount of eavesdropping on optical pulses for communication.

(4) Other embodiments (4-1) Application of the response estimation method to a measurement system Next, a case will be described in which the response estimation method according to this embodiment is applied to a measurement system 41 configured with a transmitter 42 and a measuring device 43 as shown in Fig. 11. In this case, the transmitter 42 has a transmitting unit 44 having a laser light source, a phase modulator, etc. (not shown), and a response estimation device 11. The transmitting unit 44 randomly selects, for example, either a horizontally polarized laser light pulse or a vertically polarized laser light pulse, and transmits the selected light pulse to the measuring device 43 via the quantum communication channel 100.

The measuring device 43 has a polarizing beam splitter 46, a pair of photon detectors 47a, 47b, and a notification unit 49. The measuring device 43 receives a laser light pulse from the transmitter 42 with the polarizing beam splitter 46, and outputs a laser light pulse to either of the photon detectors 47a, 47b via the polarizing beam splitter 46. The measuring device 43 detects photons polarized at an oblique angle of +45 degrees with a certain detection efficiency η using the photon detector 47a, and detects photons polarized at an oblique angle of -45 degrees with the same detection efficiency η using the other photon detector 47b.

When the measuring device 43 detects a photon only with the photon detector 47a, it transmits the detection result of "bit value 0" to the transmitter 42 via the communication path (not shown) through the notification unit 49. On the other hand, when the measuring device 43 detects a photon only with the photon detector 47b, it transmits the detection result of "bit value 1" to the transmitter 42 via the communication path (not shown) through the notification unit 49. In all other cases, the measuring device 43 transmits the detection result of "measurement failed" to the transmitter 42 via the communication path (not shown). If the measuring device 43 faithfully performs the above operations, the bit value when the measurement is successful will be an ideal true random number.

Here, the following inspection method can be considered as a method for inspecting the above-mentioned operation of measuring device 43. In this case, a testing light source separate from transmitter 42 is used. The testing light source generates an ideal pulse by quantum-mechanically superimposing a horizontally polarized laser light pulse and a vertically polarized laser light pulse. Then, this ideal first pulse is repeatedly sent to measuring device 43, and the frequency with which measuring device 43 detects a "bit value 0" is recorded.

Separately, an ideal pulse is generated by using a test light source to superimpose a horizontally polarized laser light pulse and a vertically polarized laser light pulse with a different quantum mechanical phase from the above. This ideal second pulse is then repeatedly sent to measuring device 43, and the frequency with which measuring device 43 detects "bit value 1" is recorded. Ideally, the frequency with which measuring device 43 detects "bit value 0" and "bit value 1" should be close to the number of tests multiplied by η.

Therefore, if the frequency with which "bit value 0" and "bit value 1" are detected by measuring device 43 is known, then according to quantum mechanics, it is possible to quantitatively determine the extent to which the output of measuring device 43 differs from an ideal true random number, making it possible to generate random numbers with guaranteed performance.

However, in reality, there is a problem in that it is technically difficult to generate an ideal pulse that superimposes a horizontally polarized laser light pulse and a vertically polarized laser light pulse.

In addition, an ideal pulse in which a horizontally polarized laser light pulse and a vertically polarized laser light pulse are superimposed is generally different from the diagonally polarized +45 degree laser light pulse generated by the existing transmitting unit 44 provided in the transmitter 42, so it is difficult to use the existing transmitting unit 44 as is.

Therefore, instead of testing using pulses in an ideal state as described above, the response estimation method of this embodiment can be used to test the operation of the measuring instrument 43 as follows.

In this case, in the transmitter 42, a transmission unit 44 generates test laser light pulses (test signals) with multiple types of complex amplitudes randomly selected to inspect the operation of the measuring device 43. The transmission unit 44 repeatedly sends each type of test laser light pulse with the randomly selected complex amplitude to the measuring device 43, and receives and records the frequency with which the measuring device 43 detects a "bit value of 0" from a notification unit 49 of the measuring device 43.

The response estimation device 11 of the transmitter 42 can determine, from the detection frequency of the "bit value 0" for each complex amplitude, a lower limit on the frequency at which the measuring instrument 43 detects the "bit value 0" when an ideal first pulse in which a horizontally polarized laser light pulse and a vertically polarized laser light pulse are superimposed is repeatedly sent to the measuring instrument 43.

Similarly, the transmitter 44 generates test laser light pulses (test signals) with multiple types of complex amplitudes randomly selected, repeatedly sends each type of test laser light pulse with a randomly selected complex amplitude to the measuring device 43, and receives and records the frequency with which the measuring device 43 detects a "bit value of 1" from the notification unit 49 of the measuring device 43. This allows the response estimation device 11 of the transmitter 42 to determine, from the detection frequency of the "bit value of 1" for each complex amplitude, the lower limit of the frequency with which the measuring device 43 detects a "bit value of 1" when repeatedly sending to the measuring device 43 a second pulse in an ideal state in which a horizontally polarized laser light pulse and a vertically polarized laser light pulse are superimposed in a state different from the first pulse.

If we know the lower limits of the detection frequency of "bit value 0" and "bit value 1" in measuring device 43 when a test laser light pulse with a randomly selected complex amplitude is sent from transmitter 42 to measuring device 43, then, according to quantum mechanics, it becomes possible to quantitatively determine how much the output of measuring device 43 differs from an ideal true random number.

As described above, the measurement system 41 can use only a laser light source that is inexpensive to prepare to test the measuring instrument 43 without any guarantee assumptions, and generate random numbers with guaranteed performance.

Here, we will explain in more detail by focusing on the point that "when an ideal pulse in which a horizontally polarized laser light pulse and a vertically polarized laser light pulse are superimposed is repeatedly sent to the measuring instrument 43, a lower limit on the frequency with which the measuring instrument 43 detects a "bit value 0" is found."

If the complementary event of the event that the measuring device 43 detects a "bit value of 0" is event E, then this event E corresponds to the event that the measuring device 43 detects a "bit value of 1" or a "measurement failure." Therefore, it can be said that finding the lower limit of the frequency at which the measuring device 43 detects a "bit value of 0" is equivalent to finding the upper limit of the frequency of the measuring device 43 detecting event E.

Here, the density operator (density matrix) relating to an ideal pulse in which a horizontally polarized laser light pulse and a vertically polarized laser light pulse are superimposed is denoted by ρ ^(ideal) .
Also, a density operator (density matrix) for one or more types of test laser light pulses of complex amplitude generated with an appropriate probability is denoted by ρ ₊ ^(test) .
Furthermore, a density operator (density matrix) for one or more types of complex amplitude test laser light pulses that are generated with an appropriate probability different from ρ ₊ ^(test) and have a quantum mechanical state different from ρ ₊ ^(test) is denoted as ρ _- ^(test) .

The analysis unit 12 analyzes ρ ^(ideal) , ρ ₊ ^(test) , and ρ ₋ ^(test) for which the following formula (54), which is the same as the above formula (9), holds.
αρ ₊ ^(test) -βρ _- ^(test) ≧ ρ ^(ideal) …(54)

Here, for example, a test laser light pulse (first test signal) in state ρ ₊ ^(test) is generated with a certain probability _P1 , and the frequency (detection number) of event E at measuring instrument 43 when the test laser light pulse is sent to measuring instrument 43 is set to _K1 .
In addition, a test laser light pulse (second test signal) in state _ρ- ^(test) is generated with a certain probability _P2 , and the frequency (detection number) of event E at measuring instrument 43 when the test laser light pulse is sent to measuring instrument 43 is denoted as _K2 .
Further, it is assumed here that measuring device 43 is used for random number generation with probability _P3 .

As in the above-described embodiment, the following equation (55) is obtained based on the Bernoulli sampling formula.
Prob{M ≦ f(K ₁ ,K ₂ ;P ₁ ,P ₂ ,P ₃ ,α,β)} ≧ 1-ε…(55)

M indicates the frequency with which the event E is detected by the measuring device 43 when a pulse in an ideal state ρ ^(ideal) is sent to the measuring device 43 with a probability of _P3 . Also, ε is a parameter determined in advance to specify the allowable magnitude of the probability of erroneously estimating the upper limit of M (i.e., the amount of estimation error that is allowable as the confidence level of the estimation). Note that the parameters in these formulas (54) and (55) are the same as those in the above-mentioned embodiment, and therefore details will be omitted here to avoid duplication of explanation.

In the above configuration, the response estimation device 11 provided in the measurement system 41 defines a quantum-mechanical ideal state ρ ^(ideal) of a laser light pulse (ideal signal) 25 capable of detecting an event E of the measuring device 43 (ideal state defining step). Then, an approximation state in which this ideal state ρ ^(ideal) and a quantum-mechanical state are approximated is expressed by addition and subtraction using the quantum-mechanical states ρ ₊ ^(test) and ρ ₋ ^(test) of multiple types of test laser light pulses (test signals) selected at random, and an operator inequality (αρ ₊ ^(test) -βρ _- ^(test) ≧ ρ ^(ideal)) that defines the relationship between the ideal state ρ ^{(ideal )} and the quantum-mechanical states ρ ₊ ( ^test ) and ρ ₋ (test) of the multiple types of test laser light pulses is specified (specifying step).

In addition, in the response estimation device 11, the inequality of the above equation (55), which defines the relationship between the number M of detections of the event E by the measuring device 43 detected by an ideal laser light pulse, the numbers _K1 , _K2 of detections of the event E obtained for each type of test laser light pulse when multiple types of test laser light pulses are randomly selected and the event E is detected by the measuring device 43, and the probability ε for defining the tolerable amount of estimation error, is defined from a binomial distribution based on the Bernoulli sampling formula (inequality definition step).

As a result, the response estimation device 11 randomly switches between the multiple types of test laser light pulses identified in the identification step and transmits them to the measuring instrument 43, acquires the detection results ( _K1 , _K2 ) of event E of the measuring instrument 43 using the test laser light pulses (acquisition step), and solves the inequality in equation (55) based on the detection results acquired in the acquisition step, thereby estimating the degree of detection error that will occur in the measuring instrument 43 (estimation step).

In the response estimation device 11, as in the above-described embodiment, the estimation unit 13 can use an inequality (equation (55)) defined based on the Bernoulli sampling formula to efficiently estimate the response of the measurement system 1 to an input when a quantum mechanical signal is input to the measuring instrument 43, without using a special ideal laser light pulse that has conventionally been required to detect the state of the measuring instrument 43.

(4-2) Others In the above-mentioned embodiment, the quantum cryptography key distribution system 1 in which Alice 2 and Bob 3 are connected via Charlie 4 is applied, but the present invention is not limited to this, and may be applied to a quantum communication system in which an optical pulse is transmitted from Alice 2 to Bob 3 without the intervention of Charlie 4. For example, the response estimation device 11 according to this embodiment can also be applied to a quantum communication system in which the transmitter 42 is used as the first unit (Alice) and the measuring device 43 is used as the second unit (Bob), and Alice randomly selects as a signal an optical communication pulse modulated by a randomly selected random bit, and as a test signal, a plurality of types of test optical pulses in which the phase and intensity of the optical pulse are randomly selected, and transmits the optical communication pulse and the test optical pulse sequentially from Alice to Bob.

In addition, in this embodiment, the application of communication optical pulses and test optical pulses has been described, but the present invention is not limited to this, and various other quantum mechanical communication signals and test signals, such as electromagnetic waves, may also be applied.

(5) References The following list is a list of references to supplement the technical matters of this embodiment. The contents of each reference may serve as supplementary information to deepen understanding of the technical contents of this embodiment.
1.Bennett, CH & Brassard, G. Quantum cryptography: public key distribution and coin tossing. Proc. IEEE Int. Conf. Comput. Syst. Signal Process. 175-179 (1984)
2.Scarani, V. et al. The security of practical quantum key distribution. Rev. Mod. Phys. 81, 1301-1350 (2009).
3.Takeoka, M., Guha, S. & Wilde, MM Fundamental rate-loss tradeoff for optical quantum key distribution. Nat. Commun. 5, 5235 (2014).
4.Pirandola, S., Laurenza, R., Ottaviani, C. & Banchi, L. Fundamental limits of repeaterless quantum communications. Nat. Commun. 8, 15043 (2017).
5.Briegel, H., Dur, W., Cirac, JI & Zoller, P. Quantum repeaters: the role of imperfect local operations in quantum communication. Phys. Rev. Lett. 81, 5932-5935 (1998).
6.Panayi, C., Razavi, M., Ma, X. & Lutkenhaus, N. Memory-assisted measurement-device-independent quantum key distribution. New J. Phys. 16, 043005 (2014).
7.Azuma, K., Tamaki, K. & Munro, WJ All-photonic intercity quantum key distribution. Nat. Commun. 6, 10171 (2015).
8.Lucamarini, M., Yuan, ZL, Dynes, JF & Shields, AJ Overcoming the rate-distance limit of quantum key distribution without quantum repeaters. Nature 557, 400-403 (2018).
9.Lo, H.-K., Curty, M. & Qi, B. Measurement-device-independent quantum key distribution. Phys. Rev. Lett. 108, 130503 (2012).
10.Tamaki, K., Lo, H.-K., Fung, C.-HF & Qi, B. Phase encoding schemes for measurement-device-independent quantum key distribution with basis-dependent flaw. Phys. Rev. A 85, 042307 (2012).
11.Wang, X.-B. Beating the photon-number-splitting attack in practical quantum cryptography. Phys. Rev. Lett. 94, 230503 (2005).
12.Hwang, WY Quantum key distribution with high loss: toward global secure communication. Phys. Rev. Lett. 91, 057901 (2003).
13.Lo, H.-K., Ma, X. & Chen, K. Decoy state quantum key distribution. Phys. Rev. Lett. 94, 230504 (2005).
14.Ma, X., Zeng, P. & Zhou, H. Phase-matching quantum key distribution. Phys. Rev. X 8, 31043 (2018).
15. Tamaki, K., Lo, H.-K., Wang, W. & Lucamarini, M. Information theoretic security of quantum key distribution overcoming the repeaterless secret key capacity bound. Preprint at http://arxiv.org/abs/1805.05511 (2018).
16.Wang, X.-B., Yu, Z.-W. & Hu, X.-L. Twin-field quantum key distribution with large misalignment error. Phys. Rev. A 98, 062323 (2018).
17.Yin, H.-L. & Fu, Y. Measurement-device-independent twin-field quantum key distribution. Sci. Rep. 9, 3045 (2019).
18.Cui, C. et al. Twin-field quantum key distribution without phase post-selection. Phys. Rev. Applied 11, 034053 (2019).
19.Curty, M., Azuma, K. & Lo, H.-K. Simple security proof of twin-field type quantum key distribution protocol. Preprint at http://arxiv.org/abs/1807.07667 (2018).
20.Lin, J. & Lutkenhaus, N. Simple security analysis of phase-matching measurement-device-independent quantum key distribution. Phys. Rev. A 98, 42332 (2018).
21. Yin, H.-L. & Chen, Z.-B. Twin-field quantum key distribution over 1000 km Fiber. Preprint at http://arxiv.org/abs/1901.05009 (2019).
22.Shor, PW & Preskill, J. Simple proof of security of the BB84 quantum key distribution protocol. Phys. Rev. Lett. 85, 441-444 (2000).
23.Koashi, M. Simple security proof of quantum key distribution based on complementarity. New J. Phys. 11, 045018 (2009).
24. Carter, JL & Wegman, MN Classes of hash functions. J. Comput. Syst. Sci. 18, 143-154 (1979).
25.Hoffding, W. Probability inequalities for sums of bounded random variables. J. Am. Stat. Assoc. 58, 13-30 (1963).
26. Hayashi, M. & Tsurumaru, T. Concise and tight security analysis of the Bennett-Brassard 1984 protocol with finite key lengths. New J. Phys. 14, 093014 (2012).
27.Muller-Quade, J. & Renner, R. Composability in quantum cryptography. New J. Phys. 11, 085006 (2009).

1. Quantum cryptography key distribution system (quantum communication system)
2. Alice (1st unit)
3. Bob (2nd unit)
4. Charlie/Eve (photon detection unit)
10 Acquisition unit 11 Response estimation device 12 Analysis unit (ideal state definition unit, identification unit, inequality definition unit)
13 Estimation Unit

Claims (10)

1. A response estimation method for estimating a response in a system that transmits a quantum mechanical signal from a transmitter to an object when the signal is input from the transmitter, comprising:
An ideal state definition step of defining a quantum mechanical ideal state of an ideal signal capable of detecting an event of the object;
a specifying step of expressing an approximation state in which the ideal state and a quantum mechanical state are approximated by addition and subtraction using the quantum mechanical states of a plurality of types of test signals, and specifying an inequality of an operator that defines a relationship between the ideal state and the quantum mechanical states of the plurality of types of test signals;
an inequality defining step of defining an inequality that defines a relationship between the number of events of the object detected by the ideal signal, the number of events detected for each type of test signal when the plurality of types of test signals are randomly selected and the events are detected in the object, and a parameter ε that is predetermined to define an allowable amount of estimation error as a confidence level of estimation, based on a Bernoulli sampling formula;
an acquisition step of randomly switching the plurality of types of test signals identified in the identification step and transmitting them to the target, and acquiring a detection result of the event by the test signals;
an estimation step of estimating a response of the system when the quantum mechanical signal is input by solving the inequality in the inequality definition step based on the detection result acquired in the acquisition step;
A response estimation method, comprising: The system includes: the transmitter being a first unit; and the object being a second unit;
a quantum communication system in which the first unit randomly selects, as the signal, a communication optical pulse obtained by modulating an optical pulse with a randomly selected random bit, and, as the test signal, a plurality of types of test optical pulses, the phase and intensity of which are randomly selected, and sequentially transmits the communication optical pulse and the test optical pulse from the first unit to the second unit;
The response estimation method according to claim 1 . The inequality in the inequality definition step is expressed by the following formula (1):
The response estimation method according to claim 1 or 2.

…(1)
Prob in the above formula (1) is a symbol indicating that the parameters in { } are defined in terms of probability.
M is the number of detections of the event at the object when the ideal signal is transmitted.
f( _K1 , _K2 , _P1 , _P2 , _P3 , α, β, ε) is a function that includes the number _K1 of detections of the event in the object by a first test signal selected randomly with probability _P1 , the number _K2 of detections of the event in the object by a second test signal selected randomly with probability _P2 , _P3 which is an arbitrary value satisfying 0< _P3 ≦1- _P1 - _P2 , positive parameters α and β, and a predetermined parameter ε for specifying the tolerable amount of estimation error as the confidence level of the estimation. The f( _K1 , _K2 , _P1 , _P2 , _P3 , α, β, ε) is expressed by the following formula (2):
The response estimation method according to claim 3 .

…(2)
The functions M ^- (k; p, ε) and M ⁺ (k; p, ε) are given by

…(3)

…(4)
Here, χ (conditional expression) takes a value of 1 when the conditional expression is true, and takes a value of 0 when the conditional expression is false.
_Q1 is ( _P1β )/α and _Q2 is _P1 /α. In a quantum communication system in which a first unit and a second unit connected via a photon detection unit by a quantum communication path randomly select and sequentially transmit to the photon detection unit a communication optical pulse obtained by modulating an optical pulse with a randomly selected random bit and a plurality of types of test optical pulses, the phases and intensities of which are randomly selected, the first unit and the second unit randomly select and transmit to the photon detection unit a communication optical pulse, the phases and intensities of which are randomly selected, the second unit and the test optical pulses randomly select and transmit to the photon detection unit a communication optical pulse, the response estimation method comprising the steps of:
an ideal state defining step of defining a quantum mechanical ideal state of ideal optical pulses capable of detecting the number of pairs of communication optical pulses related to eavesdropping among the number of pairs of communication optical pulses detected by the photon detection unit as a result of both the first unit and the second unit selecting the communication optical pulses;
a specifying step of expressing an approximation state in which the ideal state and a quantum mechanical state are approximated by addition and subtraction using the quantum mechanical state of the test optical pulse generated by random modulation, and specifying an inequality of an operator that defines a relationship between the ideal state and the quantum mechanical states of the multiple types of test optical pulses;
an inequality defining step of defining an inequality that defines a relationship between the number of detections of the pair of communication optical pulses related to eavesdropping measured by the ideal optical pulse, the number of detections of the pair of first test optical pulses detected as a result of the first unit and the second unit selecting the first test optical pulse selected at random with a certain probability, the number of detections of the pair of second test optical pulses detected as a result of the first unit and the second unit both selecting the second test optical pulse selected at random with a certain probability separately from the first test optical pulse, and a parameter ε that is predetermined to define an amount of estimation error that is tolerable in estimating the amount of eavesdropping on the pair of communication optical pulses, based on a Bernoulli sampling formula;
an acquisition step in which the first unit and the second unit randomly transmit the communication optical pulse and the test optical pulse to the photon detection unit, respectively, and the first unit and the second unit acquire detection results of the communication optical pulse and the test optical pulse of the pair that match in the first unit and the second unit detected by the photon detection unit;
an estimation step of solving the inequality in the inequality definition step based on the detection result acquired in the acquisition step, and estimating a response in the quantum communication system when the communication optical pulse is input;
A method for estimating a response of a quantum communication system, comprising: The inequality in the inequality definition step is expressed by the following formula (5):
A method for estimating a response of a quantum communication system according to claim 5.

…(5)
In the above formula (5), Prob is a symbol indicating that the parameters in { } are defined in terms of probability.
_K0 ^(even) is a parameter indicating the number of detections of a pair of communication optical pulses involved in eavesdropping among the number of detections _K0 of the round in which the photon detection unit notifies that both the first unit and the second unit have selected the communication optical pulse.
f( _K1 , _K2 ) is a function that includes the number of detections K1 of the round in which the photon detection unit detects and notifies that both the first unit and the second unit have selected the first test light pulse, which is selected randomly with a certain probability, and the number of detections _K2 of the round in which the photon detection unit detects and notifies that both the first unit and the second unit have selected the _second test light pulse, which is selected randomly with a certain probability.
ε is a parameter that is determined in advance to define the amount of estimation error that is tolerable in estimating the amount of eavesdropping on the pair of communication optical pulses. The f(K ₁ , K ₂ ) is expressed by the following formula (6):
A method for estimating a response of a quantum communication system according to claim 6.

…(6)
The function M ⁺ (k;p,ε) in the above formula (6) is, for any non-negative integer n,

…(7)
Here, χ (conditional expression) takes a value of 1 when the conditional expression is true, and takes a value of 0 when the conditional expression is false.
p ₀ is the probability that the communication optical pulse is randomly selected in the first unit and the second unit, and is a predetermined parameter.
p _even is the probability that the total number of photons in the pair of communication optical pulses is an even number when both the first unit and the second unit select the communication optical pulse, and is a predetermined parameter.
Λ is a predetermined parameter.
K ₁ ^(even)+ is expressed by the following formula (8).

…(8)
The function M ^- (k;p,ε) is given by:

…(9)
Meet the following.
_p2 is the probability that the second test light pulse is randomly selected in the first unit and the second unit, and is a predetermined parameter.
Γ is a predetermined parameter. The f(K ₁ , K ₂ ) is expressed by the following formula (10):
A method for estimating a response of a quantum communication system according to claim 6.

…(10)
p ₀ is the probability that the communication optical pulse is randomly selected in the first unit and the second unit, and is a predetermined parameter.
p _even is the probability that the total number of photons in the pair of communication optical pulses is an even number when both the first unit and the second unit select the communication optical pulse, and is a predetermined parameter.
Γ and Λ are predetermined parameters.
_p2 is the probability that the second test light pulse is randomly selected in the first unit and the second unit, and is a predetermined parameter.
ν(K ₁ , K ₂ ) is given by the following formula (11).

…(11) A response estimation device for estimating a response in a system in which a quantum mechanical signal is transmitted from a transmitter to an object when the signal is input from the transmitter, comprising:
an ideal state definition unit that defines a quantum mechanical ideal state of an ideal signal capable of detecting an event of the object;
an identification unit that represents an approximation state in which the ideal state and a quantum mechanical state are approximated by addition and subtraction using the quantum mechanical states of a plurality of types of test signals, and identifies an inequality of an operator that defines a relationship between the ideal state and the quantum mechanical states of the plurality of types of test signals;
an inequality definition unit that defines an inequality that defines a relationship between the number of events of the object detected by the ideal signal, the number of events detected for each type of test signal when the plurality of types of test signals are randomly selected to detect the events in the object, and a parameter ε that is predetermined to define an amount of estimation error that is acceptable as a confidence level of estimation, based on a Bernoulli sampling formula;
an estimation unit that randomly switches between the multiple types of test signals identified by the identification unit and transmits them to the target, obtains a detection result of the event caused by the test signals, and solves the inequality obtained by the inequality definition unit based on the detection result to estimate a response of the system when the quantum mechanical signal is input;
A response estimation device comprising: In a quantum communication system in which a communication optical pulse obtained by modulating an optical pulse with a randomly selected random bit and a plurality of types of test optical pulses, the phases and intensities of which are randomly selected, are randomly transmitted to the photon detection unit between a first unit and a second unit connected via a quantum communication path via a photon detection unit, the response estimation device estimating a response in the quantum communication system when the communication optical pulse is input, comprising:
an ideal state defining unit that defines a quantum mechanical ideal state of ideal optical pulses that can detect the number of pairs of communication optical pulses related to eavesdropping among the number of pairs of communication optical pulses detected by the photon detection unit as a result of both the first unit and the second unit selecting the communication optical pulses;
a determination unit that represents an approximation state in which the ideal state and a quantum mechanical state are approximated by addition and subtraction using the quantum mechanical state of the test optical pulse generated by random modulation, and determines an inequality of an operator that defines a relationship between the ideal state and the quantum mechanical states of the plurality of types of test optical pulses;
an inequality definition unit that defines, based on a Bernoulli sampling formula, an inequality that defines a relationship between the number of detections of the pair of communication optical pulses involved in eavesdropping measured by the ideal optical pulse, the number of detections of the pair of first test optical pulses detected as a result of both the first unit and the second unit selecting the first test optical pulse that is selected randomly with a certain probability, the number of detections of the pair of second test optical pulses detected as a result of both the first unit and the second unit selecting the second test optical pulse that is selected randomly with a certain probability separately from the first test optical pulse, and a parameter ε that is predetermined to define an amount of estimation error that is tolerable in estimating the amount of eavesdropping on the pair of communication optical pulses;
an estimation unit that randomly transmits the communication optical pulse and the test optical pulse in the first unit and the second unit, respectively, to the photon detection unit, and obtains detection results of the communication optical pulse and the test optical pulse of a matched pair in the first unit and the second unit by the photon detection unit, and solves the inequality in the inequality defining step based on the detection results to estimate a response in the quantum communication system when the communication optical pulse is input;
A response estimator for a quantum communication system comprising:

Images