WO2020177848A1

WO2020177848A1 - Calibrating trusted noise in quantum key distribution

Info

Publication number: WO2020177848A1
Application number: PCT/EP2019/055267
Authority: WO
Inventors: Fred Chi Hang FUNG; Spiros MIKROULIS
Original assignee: Huawei Technologies Duesseldorf Gmbh
Priority date: 2019-03-04
Filing date: 2019-03-04
Publication date: 2020-09-10
Also published as: CN113302875A

Abstract

A receiver configured to operate in a quantum key distribution system is provided. The receiver comprises a detector to generate an electrical signal from a received optical signal, an electric circuitry operable to process the electrical signal, a controller operable to either couple the electric circuitry and the detector or to decouple the electric circuitry from the detector, and a noise estimator for estimating, when the electric circuitry is decoupled from the detector, the noise of the electric circuitry.

Description

CALIBRATING TRUSTED NOISE IN QUANTUM KEY

DISTRIBUTION

TECHNICAL FIELD

Embodiments of the present invention relate to the field of quantum key distribution (QKD).

BACKGROUND

QKD is a technique that enables two distant, legitimate parties to establish a common (or shared) secret key in a way that is, considering the laws of quantum mechanics, secure against eavesdropping on the used communication channel(s).

To be specific, a shared secret key is a piece of information that is known to both the legitimate parties and unknown to anyone else. Since the shared secret (key) is known only to the legitimate parties, it plays a key role in cryptography where it has many application, such as secure communication, e.g., encryption, decryption of messages and message authentication.

In optical data communications, an eavesdropper, conventionally called Eve, can acquire information about a signal (e.g., a key) transmitted from a sender to a receiver, conventionally called Alice and Bob, respectively, e.g., by splitting of and detecting a fraction of the information carrying light.

In non-QKD systems, the security of the key exchange between two distant parties is typically based on asymmetric cryptography, which relies on the computational complexity of certain mathematical problems, e.g., Diffie-Hellman key exchange or Ri vest- Shamir- Adleman public-key cryptosystems. However, as soon as a sufficiently powerful (quantum) computer is available or mathematical progress (e.g., more efficient algorithms) has been made, such key distribution methods may become insecure. Even worse, all data that has been encrypted using keys distributed with these methods can retroactively be broken if the key exchange has been recorded by an eavesdropper.

In QKD, on the other hand, the security of the key distribution is guaranteed by the laws of quantum mechanics and their consequences, most notably, Heisenberg’s uncertainty principle and the no-cloning theorem. The uncertainty principle, which states that certain variables cannot be known simultaneously with arbitrary precision, implies that measuring one variable destroys information about some other variable. Thus, when Eve performs measurements on the transmitted signal, she inevitably leaves a trace by introducing transmission errors. The no-cloning theorem states that it is impossible to make a perfect copy of an unknown quantum state, e.g., of a signal (or a fraction thereof) encoded in the polarization degree of freedom of light where the potential encoded states are non-orthogonal. Consequently, it is also impossible to circumvent the uncertainty principle by performing measurements on perfect copies.

Thus, in short, the presence of an eavesdropper spying on communication between the sender and the recipient inevitably leaves a trace that can be detected by way of observing the amount of transmission errors (or, equivalently, noise) and loss in the transmission channel. In QKD, this is exploited by calculating, based on the observed noise, an upper bound for the information accessible to any eavesdropper. If this upper bound is sufficiently small, a shared secret key can be extracted from the information shared between the sender and the recipient. Under certain conditions, this shared secret key extraction can be proven to be information theoretic secure.

QKD systems can be divided into discrete variable QKD (DV QKD) systems and continuous variable QKD (CV QKD) systems. In DV QKD systems, the information from which the shared secret key is extracted is encoded in a discrete variable, which usually is the polarization/spin degree of freedom of, ideally, single photons, as, e.g., in the BB84 protocol. However, single photon sources and detectors are expensive and difficult to miniaturize. In CV QKD systems, on the other hand, the information from which the shared secret key is extracted is encoded in a continuous variable.

Correspondingly, CV QKD protocols are usually based on the transmission of coherent or squeezed states of light, where said information is encoded in the quadratures (phase and amplitude) of the transmitted light/electromagnetic field. At the receiver, the received signal can thus be measured by means of coherent detection (e.g., homodyne, intradyne, or heterodyne detection) using a strong local oscillator (LO). For these reasons, CV QKD is more compatible with standard components and equipment used in current telecommunications systems, and it is even possible to simultaneously use the same optical fiber for QKD and classical signal transmission. SUMMARY

Embodiments of the present application provide apparatuses and methods for receiving a signal according to the independent claims.

The foregoing and other objects are achieved by the subject matter of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.

In particular, according to a first aspect, an apparatus for receiving an optical signal is provided. The apparatus is configured to operate in a quantum key distribution system and comprises a detector operable to generate an electrical signal from the optical signal; an electric circuitry operable to process the electrical signal; a controller operable to either couple the electric circuitry and the detector or to decouple the electric circuitry from the detector; and a first noise estimator for estimating, when the electric circuitry is decoupled from the detector, a first noise of the electric circuitry.

In this way, it may be ascertained that the estimated noise of the electric circuitry is a classical noise which may allow to not attribute the estimated noise to an eavesdropper without risking an insecure shared secret key. This may have the benefit of obtaining a larger shared secret key (or shared secret key rate) than in a strict security model that attributes the total/entire noise to Eve. At the same time, the level of security of such a strict model may be maintained.

In a further implementation of the first aspect, the apparatus may further comprise a raw key generator for generating a raw key from the electrical signal processed by the electric circuitry; and a quantum noise estimator for estimating a second noise of the optical signal by subtracting the first noise from a noise of the raw key, wherein the estimate of the second noise includes quantum excess noise.

In any of the above exemplary implementations, the controller may further be configured to decouple, for one or more time periods, during a reception period of the optical signal, the detector from the electric circuitry; and the first noise estimator may further be configured to estimate, during the reception period of the optical signal and when the detector is decoupled from the electric circuitry, the first noise. Estimating the noise of the electric circuitry during the reception of the optical signal may increase the representativeness of the estimated noise of the electric circuitry for the noise of the electric circuitry experienced during the reception of the optical signal.

In any of the exemplary implementations above, in particular in those in which the controller is configured to decouple the detector from the electric circuitry during the reception period of the optical signal, the one or more time periods may have a predetermined, predefined, or random length.

This measure may further increase the representativeness of the estimated noise of the electric circuitry for the noise of the electric circuitry experienced during the reception of the optical signal.

In any of the exemplary implementations above, in particular in those in which the controller is configured to decouple the detector from the electric circuitry during the reception period of the optical signal, the one or more time periods may be distributed in a predetermined, predefined, or random manner over the reception period of the optical signal.

In any of the above exemplary implementations, the apparatus may further be configured to operate in a continuous variable quantum key distribution system.

In any of the above exemplary implementations, the detector may further be operable to perform, using a local oscillator for coherent detection, a measurement on the optical signal thereby generating the electrical signal from the optical signal.

In any of the above exemplary implementations, in particular in those using a local oscillator for coherent detection, the apparatus may further comprise a modulator operable to randomly modulate a phase and/or an amplitude of the local oscillator.

By randomly modulating the phase and/or amplitude of the local oscillator, it may be justified to treat the quantum excess noise and the estimated noise of the electric circuitry as if they were decorrelated (even if they are correlated). This may allow to accurately estimate the quantum excess noise by subtracting the estimated noise of the electric circuitry from the noise of the raw key even if the quantum excess noise and the noise of electric circuitry are correlated (neglecting here other noises, such as the shot noise, that may be subtracted from the noise of the raw key as well).

In any of the above exemplary implementations, the controller may include an electrical switch.

In any of the above exemplary implementations, the electric circuitry may include an amplifier.

According to second aspect, a method for receiving an optical signal is provided. The method is for quantum key distribution and includes the step of generating, when the optical signal is received, using a detector, an electrical signal from the optical signal; the step of processing, when the optical signal is received and when the detector and an electric circuitry are coupled, using the electric circuitry, the electrical signal; the step of controlling to either couple the electric circuitry and the detector or to decouple the electric circuitry from the detector; and the step of estimating, when the electric circuitry is decoupled from the detector, a first noise of the electric circuitry.

In a further implementation of the second aspect, the method may further include the step of generating a raw key from the electrical signal processed by the electric circuitry; and the step of estimating a second noise of the optical signal by subtracting the first noise from a noise of the raw key, wherein the second noise includes quantum excess noise.

In any of the above exemplary implementations, the decoupling of the detector from the electric circuitry may be performed for one or more time periods during a reception period of the optical signal; and the estimating of the first noise may be performed during the reception period of the optical signal and when the detector is decoupled from the electric circuitry.

Estimating the noise of the electric circuitry during the reception of the optical signal may increase the representativeness of the estimated noise of the electric circuitry for the noise of the electric circuitry experienced during the reception of the optical signal.

In the above exemplary implementations, in particular in those in which the controller is configured to decouple the detector from the electric circuitry during the reception period of the optical signal, the one or more time periods may have a predetermined, predefined, or random length.

In any of the above exemplary implementations, in particular in those in which the controller is configured to decouple the detector from the electric circuitry during the reception period of the optical signal, the one or more time periods may be distributed in a predetermined, predefined, or random manner over the reception period of the optical signal.

In any of the above exemplary implementations, the method may further be for continuous variable quantum key distribution.

In any of the above exemplary implementations, the method may further include the step of performing, using a local oscillator for coherent detection, a measurement on the optical signal thereby generating the electrical signal from the optical signal.

In any of the above exemplary implementations, in particular in those using a local oscillator for coherent detection, the method may further comprise the step of randomly modulating a phase and/or an amplitude of the local oscillator. By randomly modulating the phase and/or amplitude of the local oscillator, it may be justified to treat the quantum excess noise and the estimated noise of the electric circuitry as if they were decorrelated (even if they are correlated). This may allow to accurately estimate the quantum excess noise by subtracting the estimated noise of the electric circuitry from the noise of the raw key even if the quantum excess noise and the noise of electric circuitry are correlated (neglecting here other noises, such as the shot noise, that may be subtracted from the noise of the raw key as well).

According to a third aspect, a computer program product is provided including program code for performing the method according to the second aspect and any one of its implementations, when the program code is run by a processor.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following embodiments of the invention are described in more detail with reference to the attached figures and drawings, in which:

Fig. 1 is a schematic flow diagram which shows the general structure of an

exemplary QKD protocol;

Fig. 2 is a schematic drawing illustrating influence of noise in a QKD system;

Fig. 3 is a block diagram illustrating a QKD receiver including a switch;

Fig. 4 is a schematic drawing illustrating localized pre-calibration phase;

Fig. 5 is a schematic drawing illustrating distributed calibration phase;

Fig. 6 is a block diagram illustrating an example structure for an electronic switch after the optical-to-electronic conversion;

Fig. 7 is a block diagram illustrating an exemplary CV-QKD transmitter and a heterodyne QKD receiver;

Fig. 8a is a schematic drawing illustrating an in-line local oscillator;

Fig. 8b is a schematic drawing illustrating a local oscillator implemented at the

receiver side; Fig. 9 is a block diagram illustrating an exemplary QKD receiver without phase modulation applied to the local oscillator;

Fig. 10 is a block diagram illustrating an exemplary QKD receiver with randomized phase applied to the local oscillator; and

Fig. 11 is a block diagram illustrating a QKD receiver including a switch and a phase modulator.

In the following identical reference signs refer to identical or at least functionally equivalent features.

DETAILED DESCRIPTION OF THE EMBODIMENTS

In the following description, reference is made to the accompanying figures, which form part of the disclosure, and which show, by way of illustration, specific aspects of embodiments of the invention or specific aspects in which embodiments of the present invention may be used. It is understood that embodiments of the invention may be used in other aspects and comprise structural or logical changes not depicted in the figures. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of embodiments of the present invention is defined by the appended claims.

For instance, it is understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if one or a plurality of specific method steps are described, a corresponding device may include one or a plurality of units, e.g. functional units, to perform the described one or plurality of method steps (e.g. one unit performing the one or plurality of steps, or a plurality of units each performing one or more of the plurality of steps), even if such one or more units are not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on one or a plurality of units, e.g. functional units, a corresponding method may include one step to perform the functionality of the one or plurality of units (e.g. one step performing the functionality of the one or plurality of units, or a plurality of steps each performing the functionality of one or more of the plurality of units), even if such one or plurality of steps are not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary embodiments and/or aspects described herein may be combined with each other, unless specifically noted otherwise.

In general, a QKD protocol, as schematically illustrated in Figure 1, requires that Alice and Bob can communicate via two different transmission channels, a quantum channel and a (classic) public channel. In the context of QKD, the quantum channel is an optical channel which may provide increased privacy, and the public channel may be a channel on any medium (optical or electrical, wired or wireless). The public channel is authenticated so that any tempering attempts by any eavesdropper are detected by Alice and Bob.

In the quantum channel, the properties of quantum mechanics are exploited in order to detect eavesdropping on signals transmitted through said channel. The quantum channel thus provides (increased) privacy. These signals,“ protected” by the laws quantum mechanics, are henceforth referred to as quantum signals. Depending on the particular quantum mechanical principle(s) exploited in the quantum channel, QKD protocols can be divided into prepare-and-measure protocols and entanglement-based protocols.

Prepare-and-measure protocols are usually based on using individually unentangled signals to derive a secret key. In these protocols, Alice generates a quantum signal (e.g., by encoding information in quantum states 115 of the electromagnetic field) and subsequently sends it to Bob. Bob performs measurements 120 (e.g., using a detector) on the received quantum signal, which may be concluded to have come from a quantum state different from the quantum signal sent by Alice, in particular, in case of

eavesdropping by Eve.

Entanglement-based protocols are usually based on quantum entanglement. In these protocols, entangled quantum states, each comprising at least two entangled particles (e.g., polarized photons), are generated (not necessarily by/at Alice or Bob). Alice and Bob each receive at least one of the entangled particles of such an entangled quantum state, and perform a measurement thereon. In this case, eavesdropping can be detected by an increased error rate or by testing Bell’s inequality.

The public channel is a classic channel, i.e., properties of quantum mechanics are not exploited to detect eavesdropping and, hence, the signals transmitted in this channel can have a much higher intensity than the intensity of the quantum signals. Consequently, in the security analysis, it is usually assumed that any message exchanged between Alice and Bob over the public channel is known to Eve. However, the messages are always authenticated so that any attempt by Eve to modify them will be detected by Alice and Bob, triggering them to abort the QKD procedure. The public channel is an important part of any QKD protocol as it is used, e.g., for QKD post-processing 190, as explained below.

In the following, the generic structure of a prepare-and-measure protocol is discussed referring to the example shown in Fig. 1.

Alice, corresponding to the transmitting device (i.e., the left hand side of Fig. 1), generates, using a random number generator 100, a raw key 105, which is henceforth denoted also as Alice’s raw key 105. In general, in the present disclosure, a key may be a string (e.g., sequence) of symbols or of bits. Alice then encodes 110 her raw key 105 onto quantum states 115 of an optical signal (e.g., light, electromagnetic wave, photons), thereby generating a quantum signal. The quantum signal (e.g., the quantum states 115), generated in accordance with Alice’s raw key 105, are sent to Bob over the quantum channel, i.e., to the receiving device. Bob, when receiving a quantum signal (the received quantum signal is usually different from the sent quantum signal), performs

measurements 120 on the received quantum signal and thereby obtains a raw key 125, henceforth denoted also as Bob’s raw key 125.

After Bob has generated, based on results of the measurements 120, the raw key 125, Alice and Bob each have a respective raw key. However, Alice’s raw key 105 is, in general, different from Bob’s raw key 125. Furthermore, neither Alice’s raw key 105 nor Bob’s raw key 125 is, in general, with certainty, (completely) secret to a potential eavesdropper (It cannot be excluded that an eavesdropper may have obtained some information about one or both of the raw keys 105 and 125).

For this reason, Alice and Bob subsequently perform QKD post-processing 190. QKD post-processing 190, which is usually performed on classical computing devices, is a procedure which allows Alice and Bob to generate, from the two raw keys (Alice’s raw key 105 and Bob’s raw key 125), a shared secret key 195. Any information exchanged between Alice and Bob during QKD post-processing 190 is exchanged via the public channel. QKD post-processing 190 usually includes information reconciliation 150 or 160, and privacy amplification 170 or 180. These steps are outlined in turn below. It is noted that, depending on the used QKD protocol, QKD post-processing 190 may also include a sifting step/phase (not shown in Fig. 1).

It is noted that the parameter estimation step 140, the information reconciliation 160, and the privacy amplification step 180 are performed by Alice, whereas the parameter estimation step 130, the information reconciliation 150, and the privacy amplification step 170, are performed by Bob. In general, these steps performed by Alice during QKD post-processing may correspond to the respective steps performed by Bob during QKD post-processing (depending on the QKD protocol, they may even be identical). However, as far as the parameter estimation is concerned, of course only Bob can estimate the noise of Bob’s receiver. Likewise, only Alice may be able to estimate the noise of the transmitter laser (if this is required) or to provide Bob with phase information about said transmitter laser for digital processing. Such information (that is only available to one of Alice/Bob) may then have to be exchanged as parameter estimation information 135 between Alice and Bob.

The information reconciliation 150 or 160 may include an error estimation phase and includes an error correction phase.

In the error estimation step (or parameter estimation phase 130), Alice and/or Bob estimate the (total) error/error rate of a raw key (Alice’s raw key 105 and/or Bob’s raw key 125). More specifically, the total error may be the count/number of differences between Alice’s raw key 105 and Bob’s raw key 125 (e.g., bits/symbols of one raw key 105 or 125 that have a different value than the respective corresponding bit/symbol of the respective other raw key 105 or 125 ). The error rate may, e.g., be said total number of errors divided by (total) length of the respective raw key 105 or 125. Consequently, the total error or total noise of a raw key 105 or 125 includes errors caused by

eavesdropping as well as errors caused by imperfections in the transmission line (optical fiber(s), detectors, etc.).

It is noted that, in general, in this disclosure, since any difference/error between the raw keys 105 and 125 may be interpreted as caused by a corresponding noise, the terms error and noise are used interchangeably. In order to estimate said total noise of a raw key 105 or 125, henceforth denoted simply as the total noise, Alice and/or Bob have to disclose some information (parameter estimation information 135), which is preferably selected randomly, about one or both raw keys 105 and/or 125 via the public channel. Alice and/or Bob can then compare the corresponding information (bits/symbols) of their own raw key 105 or 125 with the information about the other raw key 105 or 125, obtained via the public channel, which allows Alice and/or Bob to estimate the total noise.

For instance, Alice may announce/disclose, via the public channel, a randomly chosen subset of symbols/bits of her raw key 105. Bob, for instance, then compares said subset of Alice’s raw key 105 with the corresponding subset of his own raw key 125. Thereby, Bob can determine the number of errors between the two subsets. By dividing the number of errors determined in this way by the length of the disclosed subset (number of bits/symbols of the disclosed subset). Bob can further estimate, the error rate of his (entire) raw key 125. Moreover, for instance, by multiplying this error rate with the length of his raw key 125, Bob may obtain an estimate for the total noise in his raw key 125.

If the subsets are sufficiently large and chosen randomly (of course, the two subset are not chosen one subset completely determines the other subset), the estimate of the total noise can be expected to be accurate.

It is noted that it may not be necessary to estimate the total error in each information reconciliation 150, e.g., the total error obtained in a previous information reconciliation 150 (e.g., an information reconciliation 150 performed with respect to another pair of raw keys 105 and 125) may be used to estimate the total noise for the current information reconciliation 150.

In general, the parameter estimation phase 130 or 140 may include all phases/steps in which statistics, e.g., quantum excess noise (describe below) and/or channel loss, are calculated. In particular, the parameter estimation step 130 may also include the estimation of the quantum excess noise, which is described below as a part of the privacy amplification 170.

In the error correction step, Alice and Bob generate/establish, from Alice’s raw key 105 and Bob’s raw key 125, a shared key 165. More specifically, at the end of the error correction step, Alice and Bob share, with high probability, a same (e.g., identical) key. Said same key, obtained from Alice’s raw key 105 and Bob’s raw key 125 as a result of the error correction step, is henceforth denoted as the shared key 165.

It is noted that, in the error correction step, Alice and Bob attempt to correct any errors whether they are caused by eavesdropping or not (i.e., they are“natural” noise, e.g., imperfections in the transmission line detectors, etc.).

It is also noted that it is not important whether Alice“corrects” her raw key 105 (changes the bits/symbols in her raw key 105 that are different than the corresponding

bits/symbols of Bob’s raw key 125 such that they match the corresponding bits/symbols of Bob’s raw key 125), Bob“corrects” his raw key 125, or a combination thereof. In principle, since the raw keys 105 and 125 have no inherent meaning (usually Alice’s raw key 105 is generated randomly), the erroneous (e.g., differing) bits/symbols may as well be removed from both raw keys 105 and 125.

In order to perform error correction, Alice and/or Bob have to disclose, as in the estimation step above, information 155 about their respective raw keys 105 and/or 125 on the public channel. However, individual bits/symbols that have been disclosed cannot be used to increase the size of the secret key (to be generated in the next step).

Therefore, techniques such as the cascade protocol, in which the parity (e.g., parity bits) of blocks of bits are compared via the public channel. If an error is found, so as to find the error, a binary search is performed. At this, the block containing an (more specifically, at least one) error is halved, and the parity of Alice’s halves is compared with the parity of Bob’s respective halves. In this way, the interval including the error is halved in each step of the binary search.

In general, after information reconciliation, Eve has at least partial information about the shared key 165. Firstly, in order to correct errors and to obtain the shared key 165 in the first place, information about the shared and/or raw key was transmitted via the public channel during information reconciliation 150, in particular, during error correction where Eve may have gained all possible parity information. In a reasonable security analysis, all this information exchanged over the public channel is assumed to be known to Eve. Therefore, privacy amplification 170 is usually performed after error correction. Secondly, Eve could have also gained information by eavesdropping on the quantum channel during key transmission (thus introducing additional noise/errors).

In the privacy amplification 170, Eve's information about the shared key 165 is reduced (i.e., effectively eliminated). More specifically, in privacy amplification 170, Alice and Bob produce, from the shared key 165, a new, shorter key, in such a way that Eve has, with high probability, only negligible information about the new key, which is henceforth denoted as the shared secret key 195. Of course, if Eve’s information about the shared key 165 is not partial (e.g., if Eve has complete information about the shared key 165) no such shared secret key 195 can be generated. In order to perform the individual steps of the privacy amplification 170, described below, Alice and Bob may, in general, exchange privacy amplification information 175.

In order to generate the shared secret key 195, Alice and Bob first have to estimate how much information about the shared key 165 Eve may have been able to obtain.

After Eve’s information about the shared key 165 has been estimated, the shared secret key 195 may be generated using a universal hash function, chosen at random from a publicly known set of such functions, which takes as its input a binary string of length equal to the shared key 165 and outputs a binary string of a chosen shorter length (e.g., outputs the shared secret key 195). The amount by which the shared secret key 195 is shortened with respect to the shared key 165 is calculated, based on the aforementioned estimate of how much information Eve could have gained about the shared key 165: In this way, Alice and Bob can decrease Eve’s information about the shared secret key 195, with high probability, to an arbitrarily small value (a higher probability and/or smaller value entails a smaller shared secret key 195).

As mentioned above, Alice and Bob first have to estimate how much information about the shared key 165 Eve may have been able to obtain (in other words, usually, an upper bound for the amount of information leaked to Eve is determined). Since the Alice and Bob knew what they have revealed on the public channel during QKD post-processing 190, the main issue is to estimate the information Eve might have gained by

eavesdropping on the quantum channel.

Since, in order to gain information from the quantum channel, Eve has to interact with the quantum states 115, Eve’s information gain necessarily causes transmission errors or quantum excess noise 250 or loss, as illustrated in Fig. 2. In other words, from now on referring to Fig. 2, which roughly illustrates different noise sources in an exemplary QKD system, the quantum excess noise 250 may be a signature of Eve’s interaction with the quantum state 115 sent from Alice (e.g., the transmitter 230) to Bob (e.g., Eve’s attack 240 on Alice’s quantum signal travelling on the quantum channel to Bob). For instance, if Eve tries to clone a quantum state 115, she must introduce loss or noise 250 which is henceforth denoted as quantum excess noise 250. In other words, the quantum excess noise is related to information gain of an eavesdropper. Therefore, an upper bound for Eve’s information gain, required for privacy amplification 170, can be derived from the quantum excess noise 250 (e.g., from an estimated value/amount of the quantum excess noise 250) and the channel loss.

In particular, so that the Eve’s information about the shared secret key 195 can, with high probability, be reduced to an arbitrarily small value, only the quantum excess noise has to be attributed to Eve. In other words, all other noises (the noises that are not the quantum excess noise) can, in the security analysis (e.g. the privacy amplification step 170), be treated differently (in particular, without reducing the level of security, they may not be attributed to Eve).

Of course, in a realistic environment, there is always noise in the quantum channel - even when no attack/eavesdropping 240 is performed. In general, it may not be possible to distinguish/differentiate between natural noise caused, e.g. by the non-ideal characteristics of the transmission medium (such as an optical fibre), and the quantum excess noise due to Eve. In fact, in accordance with the common assumption of QKD that Eve has an arbitrary/unlimited technical advantage, it is usually assumed that Eve is capable of hiding an attack 240 within (indistinguishable from) the total noise 290.

Therefore, all noise 250 added in the quantum channel (i.e., in the quantum domain 200, described later) may/may have to be, depending on the security assumptions/model, be treated as quantum excess noise. In other words, the quantum excess noise is not known (by Alice or Bob), and, in general, cannot be determined directly. Thus, the quantum excess noise (e.g., its variance) has to be estimated. All noises for which Alice and Bob cannot exclude that they are caused by Eve may, for reasons of security and secrecy, are treated, by Alice and Bob, as quantum excess noise. Furthermore, since the quantum excess noise can usually not be determined precisely, there may be other noises that are (or, have to be) treated as quantum excess noise (in the present disclosure also denoted as noise attributed to Eve). All noises attributed to Eve are used to estimate an upper bound for Eve’s information gain (and thus reduce the size of the shared secret key 195).

Fig. 2 further shows two different domains namely a quantum domain 200 and a classical domain 210. Both domains are associated with respective different noise sources as described in turn below.

The classical domain 210 begins at the output(s) of Bob’s detector 260, that is, in particular, it begins after the quantum detector 260 has performed the quantum state measurements 120. In other words, the classical domain 210 is after the optical-to- electric conversion of the detector 260.

Correspondingly, the information from which Bob’s raw key 125 is to be generated is no longer encoded in quantum states 115, but in a classical signal (e.g., the measured signal 265), which is usually an electric signal.

The quantum domain 200, on the other hand, includes the transmission line from Alice to Bob (e.g., the optical fiber) and the part of Bob’s receiver up to the entry(ies)/input(s) of the detector 260 (e.g., the component of Bob’s receiver that performs the quantum state measurements 120). In the quantum domain 200, the information from which Bob’s raw key 125 is to be generated is encoded in the quantum states 115 of a quantum signal (which is usually an optical signal). Thus, the quantum domain 200 may be the optical domain up to/except for Bob’s detector.

It is noted that, in the present disclosure, the detector 260 is neither considered as part of the quantum domain 200 nor the classical domain 210.

Thus, in QKD systems, the size of the shared secret key 195 that is generated from a certain amount of information shared between Alice and Bob (e.g., the shared key 165) crucially depends on the amount of noise that is attributed to an eavesdropper (i.e., the amount of noise that is treated as quantum excess noise in the privacy amplification stage 170). Of course, the amount of quantum excess noise depends on the security model/assumptions. Thus, key rates can be calculated with different security models each producing a different key rate carrying certain security assumptions.

Some embodiments may provide advantage of a tighter quantum excess noise estimation which enables increasing the key rate. In particular, the estimation of the quantum excess noise is improved by identifying/estimating classical noise, originating in the electric part of the receiver (e.g., the receiver amplifier noise and, possibly, the noise of other electronic components). The classicality of the estimated noise is ascertained by estimating/measuring the noise of electrical components that are decoupled from the optical components and channel. Such estimated noise may then be used to correct or better bound the estimation of the quantum excess noise.

Thus, since classical noise is generally not related to (potential) information gain of Eve in the quantum channel, it is a crucial issue for QKD systems to isolate and accurately determine classical noise. It is noted that other noises, such as the (quantum) shot noise, may also not be related to information gain of Eve in the quantum channel.

Therefore, according to an embodiment, an apparatus is provided for receiving an optical signal. The apparatus is configured to operate in a quantum key distribution system and comprises a detector 260 operable to generate an electrical signal 265 from the optical signal; an electric circuitry operable to process the electrical signal; a controller operable to either couple the electric circuitry and the detector 260 or to decouple (e.g., electrically) the electric circuitry from the detector 260; and a first noise estimator for estimating, when the electric circuitry is decoupled from the detector 260, a first noise of the electric circuitry (in other words, the first noise estimator estimates the noise of the electric circuitry).

In particular, the first noise is a classical noise (or electronic noise) and is added after detection of the quantum signal (e.g., after the optic-to-electronic conversion of Bob’s detector).

In general, the detector 260 may generate, from the optical signal, the electrical signal by performing a quantum state measurement 120. In this case, the electrical signal generated by the detector 260 may be the measured signal 265. In general, the noise estimation may be performed at outputs of the electric circuitry.

This noise estimation (of the first noise estimator) can, in general, be performed when an optical signal is received by the detector 260, but may also be performed when no optical signal is received by the apparatus. Consequently, said noise estimation may be performed when the detector 260 performs a measurement 120 and thereby generates a measured signal 265 or the estimation may be performed when the detector 260 performs no measurement 120 and consequently generates no measured signal 265.

However, even when no optical signal is received and measured by the detector 260, the detector 260 in general may still generate an electrical signal (e.g., in this case the detector still generates noise). Thus, in order to estimate the noise of the electric circuitry (without noise contribution from the detector 260, which are potentially non-classical noises), it is not sufficient to perform the noise estimation when no optical signal is received and measured by the detector 260. For this reason, in the present embodiment, the noise estimation of the electric circuitry is only performed when the detector 260 is decoupled from the electric circuitry. However, when detector 260 and electric circuitry are decoupled, the noise estimation of the electric circuitry can either be performed when an optical signal is received/measured by the detector 260 or when no optical signal is received/measured by the detector 260. In either case, by estimating the noise of the electric circuitry when detector 260 and electric circuitry are decoupled, it is ascertained, in an efficient way, that the estimated noise of the electric circuitry is a classical noise. In other words, it is ascertained that the estimated noise is generated in the classical domain 210, and thus, in particular, after the optical-to-electric conversion (note that all noise added starting after the optical-to-electric conversion are classical noises).

Since classical noise is not a signature of Eve’s interaction 240 with the quantum state 115, even if the classical noise is known or influenced by Eve, the classical noise is not related to information gain of Eve due to her quantum attack on the quantum channel. Embodiments of the present invention thus allows to estimate a noise of Bob’s receiver (i.e., the noise of the electric circuitry) that is justified to be treated as classical noise.

In particular, it is possible to not attribute the noise of the electric circuitry to Eve without risking an insecure shared secret key 195. This has the benefit of obtaining a larger shared secret key 195 (or higher shared secret key rate) than in a strict security model that attributes the total/entire noise to Eve. At the same time, the level of security of such a strict model can be maintained.

It is noted that it is not important for embodiments of the present invention how the decoupling of detector 260 and electric circuitry is achieved as long as

essentially/substantially no output/signal generated by the detector 260 can

reach/influence the electric circuitry.

However, in order to be able to generate a shared secret key 195, it must still be possible to couple the detector 260 with the electric circuitry such that the measured signal 265 can reach the electric circuitry for further processing.

In general, couple means that the (electrical) output of the detector 260 is electrically connected to the input of the electric circuitry. Conversely, decouple means that the (electrical) output of the detector 260 is not electrically connected with the input of the electric circuitry.

In some embodiments, the apparatus further comprises a raw key generator for generating a raw key 125 from the electrical signal processed by the electric circuitry; and a quantum noise estimator for estimating a second noise (e.g., the quantum excess noise) of the optical signal by subtracting the first noise (the noise of the electric circuitry) from a noise of the raw key 125 (e.g., the total noise, or an estimate of the total noise), wherein the estimate of the second noise includes quantum excess noise.

Here, the second noise may be the noise based on which an upper bound for the information gained by a potential eavesdropper is determined. In particular, the second noise or part of it may be treated as quantum excess noise in the privacy amplification step 170 and/or the second noise or part of it may be (e.g., considered to be) the quantum excess noise in the privacy amplification step 170. In particular, the quantum noise estimator may further (i.e., in addition to subtracting the noise of the electric circuitry) subtract other noises that are (assumed to be) unrelated to information of Eve (e.g., the shot noise) from the total noise for estimating the second noise/quantum excess noise.

It is noted that the term“(quantum) shot noise” refers, in the present disclosure, to noise that originates from the intrinsic uncertainty of the quadratures of the electromagnetic field (e.g., from the quantum nature of photons) and that is necessarily present (in particular, is present in absence of Eve). Thus, the shot noise sets a lower limit for the total noise when both quadratures of the electromagnetic field are considered. However, since it is not related to information gain of Eve, it may be justified to subtract them from the total noise as well.

It is further noted that, in general, in the present disclosure, the term“ noise” refers to any statistical characteristic or statistical property of said noise (e.g., describing said noise). For instance, a noise may be a moment of any order of said noise, in particular, the variance of said noise. Thus, estimating of noise may refer here to, for example, estimating statistical properties of the noise such as statistical moments or other functions based on theoretical models and/or based on measured values.

Moreover, it is noted that, in general, in the present disclosure,“ subtracting a first noise from a second noise” refers to an operation/measure that yields, from the first noise and the second noise, a third noise. In other words, the third noise is obtained from the first and the second noise. It is noted that this subtraction may be based on some theoretical model/assumption and, thus, the subtraction may yield an estimate for the third noise.

In particular, the subtraction may be based on the assumption that the second noise includes a contribution of the first noise. For instance, the third noise may be obtained by removing/subtracting, from the second noise, the contribution of the first noise to the second noise, or by compensating the contribution of the first noise to the second noise.

In other words, the third noise may be an estimate of the second noise if the first noise (or the source of the first noise) didn’t exist, and the third noise may be obtained by removing the impact/influence of the first noise (or its source) to the second noise.

Thus, the noise of the electric circuitry may, for instance, be estimated (e.g., by first noise estimator) by estimating the variance of the noise. Furthermore, the noise of the raw key may be the variance of the noise of the raw key (or an estimate thereof).

Moreover, the quantum excess noise may be the variance of the quantum excess noise. The quantum excess noise may be estimated (e.g., by the quantum noise estimator) by subtracting (the estimated variance of) the noise of the electric circuitry from (the estimated variance of) the noise of the raw key. The raw key generator may be a processing circuitry. Such a processing circuitry may further be configured to perform a QKD protocol, as outlined above (e.g., the part of the protocol to be performed on the receiver side/Bob). The raw key generator or a processing circuitry may also be configured to determine the noise of the raw key 125.

As explained above, the total noise (e.g., the noise of the raw key 125), is

determined/estimated during QKD post-processing 190 (via communication with Alice over the public channel). The total noise includes the noise of multiple sources, e.g., the quantum excess noise, the shot noise, and the classical noise of Bob’s receiver.

As noted above, only the quantum excess noise is potentially related to information gain of Eve in the quantum channel. Therefore, in order to maintain a high security level and a high secret key rate, only the quantum excess noise must/should be used to determine an upper bound for Eve’s information gain (in other words, must/should be attributed Eve).

However, if we do not know how to differentiate/distinguish the quantum excess noise from the other noises (in particular, the classical noise, which is usually large, e.g. 1% of the shot noise), in a strict security analysis, the total noise, including the classical noise of the receiver, has to be attributed to information gain of Eve (and, thus, must be treated as quantum excess noise). However, if all noises are treated as quantum excess noise due to Eve’s attack, the secret key rate could be low.

Therefore, a higher key rate can be obtained by attributing only the quantum excess noise to Eve.

Ideally, we want to estimate the quantum channel, that is, the quantum excess noise 250 directly. However, in practice, this cannot be done directly, e.g., in the quantum domain 200, based on the weak optical signal. Instead, as illustrated in Fig. 2, usually, a quantum detector 260 performs a quantum state measurement 120 on the optical signal/quantum state 115, and thereby, generates a measured signal 265, which is usually an electrical signal.

In embodiments of the present invention, the estimated noise of the electric circuitry is established as a classical noise. The (estimated) noise of the electric circuitry can thus be subtracted, without loss of security, from the total noise when estimating the quantum excess noise. In other words, the noise of the electric circuitry may be removed in the calculation of Eve’s information in the privacy amplification step 170, without reducing the level of security substantially.

It is noted that, since the second noise is determined by subtracting the first noise (e.g., the estimated noise of the electric circuitry) from the noise of the raw key 125, in general, the second noise still includes other noises that may not be related to

information gain of Eve, such as the shot noise. Thus, in general, the shot noise and the noise of the electric circuitry (as well as other noises that are assumed to be unrelated to Eve) may be subtracted from the total noise, and only the noise then remaining may then be used as an estimate for the quantum excess noise and attributed to Eve.

The standard way to estimate the receiver noise mentioned above is to turn of the LO and QKD paths with optical switches before the optical-to-electronic conversion. However, this does not guarantee that the noise seen is classical since there is still a quantum portion between the optical switches and the optical-to-electronic conversion. Note that this receiver noise can still be known to Eve or unknown to Eve. These cases result in different performance.

In some embodiments, the controller further includes an electrical switch 340. For example, the controller may include any hardware and/or software which controls the switch as well as the switch. In particular, the controller may be implemented in an ASIC (Application-Specific Integrated Circuit), FPGA (Field Programmable Gate Array), DSP (Digital Signal Processor) or the like.

As shown in the illustrative example of Fig. 3, in some embodiments an electrical switch 340 is placed after the optical-to-electronic conversion. The electrical switch 340 may, for example, be implemented as an electric or electronic element such as a transistor or the like.

Figure 3 further shows a coherent balanced detector 1070, comprising a beams splitter 320, two photo detectors 330 and 331, and a subtractor 335. The coherent detector 1070 performs balanced coherent detection on the quantum signal received from Alice using the local oscillator 300. In general, the electrical switch 340 may be placed in the classical (electronic) domain 210, and/or the electrical switch 340 may be placed after the optical domain 200, and/or the electrical switch 340 may be placed after the optical-to-electronic conversion 205 (e.g., after the detector 260). The switch ensures that the estimation result for the receiver noise is not due to influence in the quantum domain; i.e., in order to guarantee/ensure that the noise being estimated is classical. The switch allows to estimate the classical noise variance (in other words, the amount of classical noise) accurately.

Furthermore, in some embodiments, the electric circuitry includes an amplifier 270. This is illustrated, e.g., in Fig. 2 or Fig 3. In general, the measured signal 265 may have to be amplified by an amplifier 270, which introduces/adds amplifier noise 280, before the raw key 125 is obtained and can further be processed (e.g., digitally) by Bob.

In general, in the present disclosure, since the amplifier 270 is usually the main classical noise generator, the amplifier 270 is, for sake of simplicity, the only classical noise generating component of the receiver explicitly mentioned. However, in general, the concept of embodiments of the present invention works even if there are other classical noise generating components after the optical-to-electronic conversion stage. The amplifier 270 may thus be understood as a placeholder for any classical noise

generator(s) in Bob’s receiver following the optical detector 260. Likewise, in the present disclosure, the term amplifier noise means any classical noise generated after the optical-to-electronic conversion (e.g., detector output), that is, if not explicitly stated otherwise, the terms amplifier noise, classical noise, and classical receiver noise are used interchangeably.

In some embodiments, the apparatus is further configured to operate in a continuous variable quantum key distribution system. In these embodiments, Alice encodes, when generating the quantum signal, information of her raw key 105 in quantum states that are the continuous degrees of freedom of some physical system. More specifically, Alice may modulate the quadratures (phase and amplitude) of the light/electromagnetic field, to encode and transmit her raw key 105 to Bob. Correspondingly, in order to obtain his raw key 125 from the received quantum signal, Bob determines a continuous variable in his quantum state measurement 120 performed on said received quantum signal. Thus, in practice, continuous variable (CV) QKD systems/protocols are usually based on the transmission of coherent or squeezed states of light.

Fig. 7 shows a QKD system with a local independent LO with software defined TX (left hand side) and RX (right hand side).

In particular, an exemplary CV-QKD transmitter is shown in the upper half of Fig. 7. A Digital Signal Processor (DSP) may provide the raw key data to be modulated onto the quantum signal. Then, the digital to analog converters (DAC) convert the in-phase and quadrature parts of the raw key data into analog signal which is then modulated onto the optical signal generated by a light source (e.g. a laser, a laser diode or the like). Then the optical signal is split into a weak signal, with a low intensity (i.e. the quantum signal) that is transmitted to the receiver, and a strong signal (high intensity), which is monitored on a power monitor.

On the lower half of Figure 7, an exemplary heterodyne detector (receiver) is illustrated. In particular, a local oscillator generates oscillator signal E L, whereas the optical signal E_S is received via the optical fiber and, possibly, first subjected to a polarization controller. The receiver then detects/measures the optical signal and converts it into an electrical (analog) signal, which is further amplified and entered to a software defined receiver part. In this part of the receiver, phase demodulation is performed, and the demodulated in-phase and quadrature portions of the electric signal are converted by an analog to digital converter (ADC) into a digital signal, which is further processed by a receiver-side DSP.

For further details and explanations regarding such a QKD system as shown in Fig. 7, it is also referred to“4 low-complexity heterodyne CV-QKD architecture”, 19th

International Conference on Transparent Optical Networks (ICTON), published by IEEE on July 2017).

In some embodiments, the detector 260 is operable to perform the measurement using a local oscillator 300 for coherent detection.

In some embodiments, the local oscillator (LO) 300 is an inline LO 800, as illustrated in Fig. 8a. An inline LO 800 is sent by Alice (e.g., the transmitter 810) to Bob (e.g., the receiver 820), usually in the same optical fiber as the quantum signal (e.g., with a different polarization than the quantum signal 115 or time interleaved with the quantum signal). In case of an inline LO 800, the repetition rate, which is how often a quantum signal is sent by Alice to Bob over the quantum channel, is usually low (e.g., 1 MHz).

However, embodiments of the present invention are not limited thereto and the LO 300 may be a local LO 850, as illustrated in Fig. 8b. A local or independent LO 850 is usually generated locally at Bob’s receiver (e.g., at the receiver 870). In this case, Alice (e.g., the transmitter 860) may send only a quantum signal. With respect to the inline LO 300, the independent LO 850 offers a higher security since Eve cannot manipulate the LO 850 to her advantage (e.g., to hide an attack 240 on the quantum signal).

Furthermore, a local LO 850 allows for a high repetition rate of, e.g., 100 MHz or higher. Therefore, the independent LO 850 usually allows key generation at longer distances between Alice and Bob (or higher key rates at a given distance) than an inline LO 800 (this is also because the inline LO 800, which is sent with a much higher power than the quantum signal, introduces noise to the quantum channel). However, since the local LO 850 is different from the transmit side laser additional phase/frequency synchronization or digital processing may be required.

As shown in Fig 4, the estimation of the noise of the electric circuitry, i.e., the estimation of the electronic noise (which corresponds to the calibration phase 400), may be performed before Alice starts transmitting a quantum signal from which a shared secret is to be generated by Bob (henceforth denoted as a QKD phase 450). In particular, the noise of the electric circuitry may be estimated when no optical signal is

received/measured by the detector 260.

However, when the noise of the electric circuitry is estimated beforehand, the estimate may not be representative in the QKD block to the noise of the electric circuitry experienced in the QKD phase 450. For example, the electronic noise level might be pre programmed to align with the calibration schedule, which may lead to a wrong estimation of Eve information gain.

Therefore, embodiments of the present invention are not limited thereto, and, in some embodiments, the controller is configured to decouple, for one or more time periods, during a reception period (e.g., a QKD phase 550) of the optical signal, the detector from the electric circuitry; and the first noise estimator is configured to estimate, during the reception period of the optical signal and when the detector is decoupled from the electric circuitry, the first noise.

This is illustrated in Fig. 5. As shown therein, the estimation of the noise of the electric circuitry, i.e., the estimation of the electronic noise (which corresponds to the calibration phase 500), may be performed during Alice’s transmission of a quantum signal from which a shared secret is to be generated by Bob (henceforth denoted as a QKD phase 550). In particular, the noise of the electric circuitry, denoted as electronic noise in Fig.

5, may be estimated when no optical signal is received/measured by the detector 260.

In particular, the electronic noise is estimated during the calibration phase(s) 500. In these calibration phase(s) 500, the detector 260 is decoupled from the electric circuitry as described above. However, since the estimation of the noise of the electric circuitry is performed during the QKD phase 550, an optical signal is still received and possibly measured by the detector 260. However, the electrical signal generated by the detector 260, e.g., by performing a quantum state measurement 120 on the optical signal, does not reach the electric circuitry. Therefore, Bob cannot use the part of the optical signal that is received in the calibration phase(s) 500 to generate his raw key 125. However, by decoupling the detector 260 from the electric circuitry, the classicality of the estimated noise of the electric circuitry can be established even when the estimation is performed during the QKD phase 550.

It is note that a reception period 550 of an optical signal, also denoted as a QKD phase 550, is a period in which an optical signal transmitted by Alice arrives at the detector 260 and, thus, can be measured by said detector 260. To be explicit, in a reception period 550, the optical signal transmitted by Alice must not, necessarily, be received by the electric circuitry, i.e., decoupling the detector 260 from the electric circuitry does not end a reception period 550.

In the QKD timeslots 555 of the QKD phase 550, on the other hand, the detector 260 is coupled to the electric circuitry. Consequently, Bob may generate his raw key 125 (only) from the part of the optical signal that is received in the QKD timeslots 555.

Estimating the noise of the electric circuitry in the calibration phase(s) 500 during the QKD phase 550 has the advantage that the estimated noise of the electric circuitry is more representative for the noise of the electric circuitry experienced during the QKD timeslots 555 of the QKD phase 550.

Furthermore, in some embodiments, the one or more time periods have a predetermined, predefined, or random length.

Moreover, in some embodiments, the one or more time periods are distributed in a predetermined, predefined, or random manner over the reception period of the optical signal.

In order to estimate the classical receiver noise (i.e., the noise of the electric circuitry) that would have been observed during QKD operation (i.e., a QKD phase 550), the classical receiver noise is estimated during a period of QKD operation by randomly sampling symbol times. Thus, during a QKD phase 550, the receiver switches randomly between the classical receiver noise estimation state and the QKD operation state. The statistics of the former state can be used to infer the statistics of the latter state in the same QKD phase 550. Such a random distribution of calibration phases 500 over the QKD phase 550 is illustrated in Fig 5. In general, for each timeslot of the QKD phase 550 it may be switched randomly between QKD phase(s) 555 and classical receiver noise estimation phase(s) 500. For instance, after each timeslot it may be decided randomly whether or not the next timeslot is QKD phase(s) 555 or a classical receiver noise estimation phase(s) 500. The duration of a time slot may be determined based on the (average) transmission time of a symboFbit.

By randomly spreading the electronic/classical receiver noise estimation over the QKD phase 550, the estimate obtained for the noise of the electric circuitry is even more representative for the noise for the noise of the electric circuitry experienced during the QKD timeslots 555 of the QKD phase 550.

Fig. 6 illustrates an example structure for an electronic/electric switch, which can operate during the QKD phase 550 and is implemented after the optical-to-electronic conversion. In particular Fig. 6 shows that a quantum signal carrying the key data is transmitted over a single mode fiber (SMF) and another optical signal generated by a local oscillator is transmitted over another fiber. At the receiver, the quantum signal is coherently detected using the received local oscillator. A switch is operated to couple and decouple the optical part from the electric part as already described above. Figure 6 further illustrates the signal controlling the switch (above the switch). In particular, the signal controls the “On” and“Off’ phases of the switch. In this Figure 6, the on and off phases are regularly alternating and have the same length. However, this is only an example and in practice, the duration of the phases may be different, or even random (cf. Figure 5).

The estimation of the classical noise of the receiver requires the receiver to enter into a state (corresponding to the switch“off’ phase) which is different from that of QKD operation (corresponding to the switch“on” phase). Specifically, the LO and the QKD input signal paths are turned off. The electronic noise is observed at the receiver output.

In some embodiments, the apparatus further comprises a modulator (e.g., a phase modulator) 1000 operable to randomly modulate a phase and/or an amplitude of the local oscillator.

In general, the quantum excess noise may be estimated/calculated using the following formula (e.g., by knowing the three other terms; the below formula may be extended with further noises on the right hand side contributing to the total noise - for the sake of simplicity, such additional terms are henceforth neglected): total noise variance = shot noise variance + quantum excess noise variance + classical noise variance

However, strictly speaking, the above formula in general only holds when all noise components on the right hand side (shot noise, quantum excess noise and classical noise) are (statistically) uncorrelated. Thus, if the above formula is used and it turns out that the classical noise of the receiver is correlated with Eve, the quantum excess noise will be underestimated and the generated shared secret key 195 will be insecure since Eve has information about it.

This instance is exemplified in Fig. 9. In particular, suppose that Eve can influence the classical noise, henceforth denoted as e. Using the classical noise, Eve may then try to cancel out the quantum excess noise, henceforth denoted as n, by adjusting, during an attack 240, the classical noise to e=-n/2 (setting, for sake of simplicity, the amplification factor G=l). In consequence, using simplified mathematical descriptions, the output of the amplifier, henceforth denoted as z, becomes z=y+e=x+n+e=x+n/2, where y denotes the output of the detector 260 and x denotes the Alice’s quantum signal which is assumed to contain the shot noise. Thus, the inferred quantum excess noise, which in general is z-Gx, becomes n/2, which is less than the actual quantum excess noise n.

In other words, the LO sets the reference phase for measuring the incoming quantum signals. The classical noise of the receiver could be aligned with the LO phase and this allows correlation between the classical noise and the incoming quantum signals which include the quantum excess noise. This, in turn, allows the classical noise to have correlation with the quantum excess noise, which is added by Eve. Furthermore, in case there is a correlation between the classical noise e and the quantum excess noise n such that e=-n/2, in a standard system, these two noises partially cancel out and Bob sees a smaller total noise from which he infers the quantum excess noise to be n/2. This underestimation of the quantum excess noise will lead to security problem when the quantum excess noise but not the classical receiver noise is attributed to Eve.

Thus, when the different noises on the right hand side of the above formula are correlated, the above formula may not hold. More specifically, this separation of quantum excess noise and classical noise variances may not hold, and only if the classical noise is uncorrelated with the quantum excess noise, a calculation based on the above formula gives an accurate estimate for the quantum excess noise variance.

For this reason, in the present embodiment, a phase (and/or amplitude) modulation is performed on the LO during QKD signal operation (e.g., during a QKD phase 550 as described above).

This is illustrated in Fig. 10. As before, Eve tries to cancel out the quantum excess noise n by adjusting, during an attack 240, the classical noise to e=-n/2. However, in this case the modulator 1000 randomly modulates the phase of the measured signal 265. In this particular example, the phase modulation of the LO is done by a direct phase modulator that randomly modulates the LO phase by either 0 or pi by 0 or pi (each with a probability of 50%).

However, embodiments of the present invention are not limited thereto. Alternatively, more than 2 different phase modulations of the LO can be used. In the present example, the phase modulation corresponds to a multiplication of measured signal 260 with either of q=±l (with equal probability). In general q is the phase factor applied by the phase modulator 1000 to the LO 300.

Assuming as before for sake of simplicity that G=l, the output of the amplifier is observed to be z=x+n/2 or z =-x-3n/2, with equal probability. This effectively means that the classical noise of the receiver is in-phase and out-of-phase 50% of the time.

In this example, the classical noise is -e or +e relative to the quantum excess noise, corresponding to the total noise n/2 or 3n/2 respectively. The total noise variance is thus (E[(h/2)^L2] + E[(3h/2)^L2])/2 = 5E[h^L2]/4. Subtracting the classical receiver noise variance E[h^L2/4] from it and we get as the quantum excess noise variance E[h^L2] Therefore, the quantum excess noise variance is correctly estimated and security can be maintained (assuming that the classical noise variance is correctly quantified).

In general, when more than two different values for the phase modulation q are used, the above example is modified E[ (q n + e)² ] where the expectation is also over q. In the above example, q=l or -1, and thus E[ (q n + e)² ] = E[ n² ] + E[ e² ], which holds even when the classical noise e and the quantum excess noise n are correlated. When more than two different values for the phase modulation q are used, it is also possible to choose values of q to make E[ (q n + e)² ] = E[ n² ] + E[ e² ], even when the classical noise e and the quantum excess noise n are correlated.

In general, the phase modulation can be performed by changing the frequency of the LO, which introduces a phase changes to the LO.

By randomly modulating the phase and/or amplitude of the local oscillator, it is justified to treat the quantum excess noise and the classical receiver noise as if they were decorrelated (even if they are correlated). This allows estimating the correct quantum excess noise variance by using the formula E[ (q n + e)² ] = E[ n² ] + E[ e² ] (neglecting here other noises, such as the shot noise).

In other words, it can be guaranteed that the electronic noise does not affect a correct estimation of channel statistics (Eve’s attack) due to a correlation with quantum excess noise. As shown in Fig. 10, a phase modulator 1000 may also be implemented in a device that does not comprise a controller operable to decouple the electric circuitry from the optical detector, and, thus, in particular, the device does not comprise a switch 340:

According to an embodiment, an apparatus is provided for receiving an optical signal, the apparatus being configured to operate in a quantum key distribution system and comprising: a coherent detector 1070 operable to perform, using a local oscillator, coherent detection on the received optical signal; and a phase modulator operable to randomly modulate a phase and/or an amplitude of the local oscillator.

In such a device, the classical noise (or the classical noise variance) has to be determined by other means. For example, one could take out the amplifier and quantify the noise it generates. Or one could cut out all optical signals on the optical paths and measure the amplifier noise. It is noted that the phase modulation provides benefits irrespectively of the way how the amplifier noise is estimated. In other words, the above phase modulation embodiment may be implemented without providing a switch for decoupling the optical from the electrical part of the receiver. In particular, the amplifier noise estimation may be performed in a way including the noise of the optical detector, or the estimation of the electrical noise may be provided a priori, i.e. by a known characteristic of the amplifier component.

What makes the provision of the switch after the detector special is that the switch operates in the classical domain and this makes sure the observed noise is classical. (In the end, a real switch could be leaky, and it is not unimaginable that some quantum noise leaks into the classical domain even when the switch cuts it off).

The combination of the switch with the phase modulation, as shown in Figure 11, provides even more advantages: Using the switch alone does not say whether this classical noise can be treated as uncorrelated with the quantum excess noise. The switch gives us an accurate estimate for the noise of the amplifier. By means of the random phase modulation, on the other hand, the above formula total noise variance = shot noise variance + quantum excess noise variance + classical noise variance can be made to hold even if the classical noise is correlated with the quantum excess noise. Without the random phase modulation, one can assume the formula to hold by assuming that the classical noise is uncorrelated with the quantum excess noise. What this entails is that when we quote a key rate, it carries with it such a security assumption, and the validity and acceptability of such assumption are passed on further to the users for evaluation. In general, the less assumptions, the key rate quantification is more valuable. For example, it is of little value when we quote a key rate that holds only when

Eve launches a very specific attack which we cannot prove this is case in the real operation of QKD. In summary, the formula holds if the classical noise is uncorrelated with the quantum excess noise OR random phase modulation is used.

The phase modulation thus allows to estimate the variance of the quantum excess noise accurately even if the classical noise is correlated with the quantum excess noise.

Even though it is presently difficult to implement an attack where the quantum excess noise is correlated with the classical noise, the concept here is still beneficial since the philosophy of QKD is to protect against current and future attacks (not just what can be done now or in the foreseeable future). QKD started out as a way to protect against eavesdropping in the channel with unlimited computational power (well beyond what can be achieved now). Later, the field of QKD developed into exploring ways to attack QKD using side channels and how to protect against these side-channel attacks. So future ways to correlate the quantum excess noise and classical noises should be covered. One argument that such a correlation is possible is that the amplifier is manufactured by Eve and somehow she can correlate the noise generated in the amplifier with the quantum excess noise she introduces in the quantum channel.

Merely assuming that the quantum excess noise and the amplifier are uncorrelated (e.g., by using the above formula without a random phase modulation), implies a loss of security. According to an embodiment, a method for receiving an optical signal is provided. The method is for quantum key distribution and includes the step of generating, when the optical signal is received, using a detector, an electrical signal from the optical signal; the step of processing, when the optical signal is received and when the detector and an electric circuitry are coupled, using the electric circuitry, the electrical signal; and the step of controlling to either couple the electric circuitry and the detector or to decouple the electric circuitry from the detector; estimating, when the electric circuitry is decoupled from the detector, a first noise of the electric circuitry.

The method according to the above embodiment may further include the step of generating a raw key from the electrical signal processed by the electric circuitry; and the step of estimating a second noise of the optical signal by subtracting the first noise from a noise of the raw key, wherein the second noise includes quantum excess noise.

In any of the above methods the decoupling of the detector from the electric circuitry may be performed for one or more time periods during a reception period of the optical signal; and the estimating of the first noise may be performed during the reception period of the optical signal and when the detector is decoupled from the electric circuitry.

In the above method, the one or more time periods may have a predetermined, predefined, or random length.

Alternatively or in addition, the one or more time periods may be distributed in a predetermined, predefined, or random manner over the reception period of the optical signal.

INDUSTRIAL APPLICABILITY

Important issues for practical QKD systems are the key generation rate, distance, cost, compatibility with wavelength division multiplexing (WDM), e.g., classical signals. CV

QKD works on inline LO or local LO schemes; direct-detection-based QKD (except the part for phase modulating the LO).

Claims

1. An apparatus for receiving an optical signal, the apparatus being configured to operate in a quantum key distribution system and comprising: a detector (260) operable to generate an electrical signal (265) from the optical signal; an electric circuitry (270) operable to process the electrical signal (265); a controller operable to either couple the electric circuitry (270) and the detector (260) or to decouple the electric circuitry (270) from the detector (260); and a first noise estimator for estimating, when the electric circuitry (270) is decoupled from the detector (260), a first noise (280) of the electric circuitry (270).

2. The apparatus according to claim 1, further comprising: a raw key generator for generating a raw key (125) from the electrical signal (265) processed by the electric circuitry (270); and a quantum noise estimator for estimating a second noise of the optical signal by subtracting the first noise (280) from a noise of the raw key (125), wherein the estimate of the second noise includes quantum excess noise (250).

3. The apparatus according to claim 1 or 2, wherein the controller is configured to decouple, for one or more time periods (500), during a reception period (550) of the optical signal, the detector (260) from the electric circuitry (270); and the first noise estimator is configured to estimate, during the reception period (550) of the optical signal and when the detector (260) is decoupled from the electric circuitry (270), the first noise (280).

4. The apparatus according to claim 3, wherein the one or more time periods (500) have a predetermined, predefined, or random length.

5. The apparatus according to claim 3 or 4, wherein the one or more time periods (500) are distributed in a predetermined, predefined, or random manner over the reception period (550) of the optical signal.

6. The apparatus according to any of the claims 1 to 5, wherein the apparatus is further configured to operate in a continuous variable quantum key distribution system.

7. The apparatus according to any of the claims 1 to 6, wherein the detector (260) is operable to perform, using a local oscillator (300) for coherent detection, a measurement (120) on the optical signal thereby generating the electrical signal (265) from the optical signal.

8. The apparatus according to claim 7, further comprising: a modulator (1000) operable to randomly modulate a phase and/or an amplitude of the local oscillator (300).

9. The apparatus according to any of the claims 1 to 7, wherein the controller includes an electrical switch (340).

10. The apparatus according to any of the claims 1 to 8, wherein the electric circuitry (270) includes an amplifier.

11. A method for receiving an optical signal, the method being for quantum key distribution and including the steps of: generating, when the optical signal is received, using a detector (260), an electrical signal (265) from the optical signal; processing, when the optical signal is received and when the detector (260) and an electric circuitry (270) are coupled, using the electric circuitry (270), the electrical signal (265); and controlling to either couple the electric circuitry (270) and the detector (260) or to decouple the electric circuitry (270) from the detector (260); and estimating, when the electric circuitry (270) is decoupled from the detector (260), a first noise (280) of the electric circuitry (270).

12. The method according to claim 11, further including the steps of: generating a raw key (125) from the electrical signal (265) processed by the electric circuitry (270); and estimating a second noise of the optical signal by subtracting the first noise (280) from a noise of the raw key (125), wherein the second noise includes quantum excess noise (250).

13. The method according to claim 11 or 12, wherein the decoupling of the detector (260) from the electric circuitry (270) is performed for one or more time periods (500) during a reception period (550) of the optical signal; and the estimating of the first noise (280) is performed during the reception period (550) of the optical signal and when the detector (260) is decoupled from the electric circuitry (270).

14. The method according to claim 13, wherein the one or more time periods (500) have a predetermined, predefined, or random length.

15. The method according to claim 13 or 14, wherein the one or more time periods (500) are distributed in a predetermined, predefined, or random manner over the reception period (550) of the optical signal.

16. A computer program product including program code for performing the method according to any one of claims 11 to 15, when the program code is run by a processor.