Patent Application
20250168632
This patent application claims priority from Italian patent application no. 102023000024831 filed on Nov. 22, 2023, the entire disclosure of which is incorporated herein by reference.
The present invention relates, in general, to a Quantum Key Distribution (QKD) transmission system.
Nowadays, Quantum Key Distribution (QKD) systems are one of the most promising solutions for improving security in encrypted communications. A QKD system finds applications in many domains, for example space transversally infrastructures, wherein the QKD system is used both as a communication service and for encryption of critical data in the Navigation and Observation (e.g., Earth Observation) field.
In general, the term Quantum Key Distribution (QKD) refers to a set of protocols aiming at generating a secret string of bits, called key, among two parties, typically called Alice and Bob, by exploiting the properties of quantum mechanics. The successful realization of a QKD protocol is based on the generation of secret keys comprising a sequence of bits (i.e., 1 or 0) evenly and randomly distributed and whose sequence is only known to Alice and Bob. In particular, QKD protocols are based on typical properties such as
Moreover, a property of QKD protocols is that Alice and Bob can detect the presence of a malicious third party/eavesdropper, typically called Eve, whose aim is to infer the secret key without being noticed. Indeed, the possibility to directly identify an eavesdropper stems from the laws of quantum mechanics which assures that any interaction of a quantum system with an environment alters the state thereof. In particular, the change in quantum state properties can be measured and analysed by Alice and Bob who can choose to stop the protocol if Eve is listening in the communication.
From a theoretical point of view, since the article by Bennett and Brassard published in 1984 wherein they proposed a first QKD protocol called BB84, many protocols have been conceived by exploring different approaches, different functioning principles and different implementation concepts. In this respect, reference can be made to:
Furthermore, several QKD protocols have been proven to be theoretically secure. The research work did not stop at conceiving QKD protocols theoretically secure, but also the experimental conditions under which a QKD can take place were analysed, taking into account non ideal functioning of setups, environmental conditions and real-life scenarios.
In order to classify QKD protocols, two main grouping are usually done, wherein
PM protocols, or “trusted” protocols, imply that one of the parties, for example Alice, generates a classical random string of bits, encodes each bit in the state of a quantum system and sends it to a second party, for example Bob, who in turn measures the encoded bit in order to extract the information encoded by Alice.
In this connection,
EB protocols, or “untrusted protocols”, are based on the entanglement property of quantum mechanics, wherein entangled particles can be described as a system whose parts can't be described independently of each other. In general, protocols based on the entanglement property do not require any preparation step, and it is possible to suppose that the source of the quantum state is in the hands of an eavesdropper without any loss in communication security. In this connection, FIG. 2 schematically illustrates an example of implementation of a BBM92 protocol. In this regard, attention is drawn to the fact that
Regardless of the type of implemented protocol, typical realizations of QKD are carried out by encoding information in the degrees of freedom of single photons (wherein, as is known, a photon is the smallest amount of energy of an electromagnetic field), wherein photons are chosen as the encoding quantum system because of their suitability for communication purposes. In particular, in a CV protocol, the quadratures of the electric field are considered as encoding degrees of freedom, while in DV protocols, the encoding degrees of freedom used for QKD are the polarizations of a photon, arrival time of a photon to a detector or a phase difference between two successive photons.
As in known, a non-negotiable property in the realization of QKD systems is that each bit of a secret key must be encoded by only one photon. In fact, if a same bit is encoded by more than one photon, an eavesdropper can steal one of the photons encoding the same bit, extracting the information encoded in the stolen photon without the possibility for Alice and Bob to notice the eavesdropper's presence. Although some countermeasures have been conceived to deal with the possibility of more than one photon encoding a same bit of a secret key, the single-photon requirement must be met, thus making this single-photon requirement one of the main bottlenecks in the realisation of QKD protocols. It's worth noting that photons suffer scattering and high losses during their propagation, in particular in fibre f links as fibre propagation undergoes exponential decay due to absorption.
In particular, losses are detrimental for QKD protocols because the no-cloning theorem prevents the quantum state to be copied or amplified during photons' propagation (for example for extending the propagation distance), posing limitations in the realization of QKD protocols in a fibre-based infrastructure. Indeed, no more than few hundreds of km can be covered with fibre-based technology (in this case it can be done with dedicated ultra-low-loss fibres), while, nowadays, is extremely relevant to achieve long distances and wide coverage.
An experimental realisation of a free space and satellite QKD was carried out by a Chinese research group in 2017, achieving high distance reach and wide coverages. However, in the best-case scenario, despite the relative increase in the number of photons that can be successfully exchanged with respect to fibre-based implementation, their absolute value is still limited by the losses which are about 30-40 dB in a typical LOW Earth Orbit (LEO) satellite; moreover, the achievable key rate and the key volume in a typical QKD session is limited to tens of kilobits per seconds.
Then, the extremely high relevance of security in communications and the increasing request for cryptographic keys in several applications require smart solutions able to increase the known reachable key rates. In fact, one of the main limitations of QKD systems is the achievable key rate, specifically in networks featured by long distances among users, wherein the key rate is always extremely low and often not compatible with key rates required by users. Currently, the limitation relating to the achievable key rate, that is inherent in a QKD protocol, is commonly accepted a priori, limiting the applicability of a QKD solution in terms of performance and distances achievable.
A realization of a PM protocol is typically based on a pulse technique, wherein a pulsed laser is attenuated down to the level of a single-photon by means of high-performance attenuators. In detail, the number of photons within each pulse follows a Poisson distribution and it is not constant because of light statistical properties. In particular, after the attenuation of the laser pulse, each photon is polarized independently one to the other in order to encode each bit of a secret key in each single-photon-level pulse wherein, because of number of photons' Poisson distribution, there is no certainty that each attenuated laser pulse generates exactly a single photon; typically, the attenuation is such that for the largest part of the pulses no photons are contained in each pulse, but this does not prevent to have, sometimes, more than one photon per pulse, thus posing risks to the security in QKD. A typical way to overcome this limitation is represented by the decoy state method that, in contrast to the standard BB84 protocol, uses pulses containing more than one photon per pulse, wherein, the presence of an eavesdropper is inferred by monitoring the statistic of the arriving pulses. However, despite the decoy state method represents a countermeasure to a photon number splitting attack, the decoy state method can't be implemented by simply increasing the number of transmitted photons per pulse; in fact, the typical average number of photons per pulse is lower than one, whereby it can't increase the communication distance, thus it is clear that the main limitation characterizing QKD implementation is the impossibility to work with multiphoton states.
Nowadays, typical commercial systems are being developed to overcome the limitations described above but their application to real life scenarios is limited by propagation losses.
In recent years, several patents have been granted for inventions facing the above problem; for example, reference can be made to U.S. Pat. No. 9,294,191 B2, U.S. Pat. No. 7,831,050 B2 and U.S. Pat. No. 10,348,493 B2.
From a theoretical point of view, QKD has been proven to be information-theoretic secure, therefore it guarantees that an eavesdropper does not get any information correlated to the secret key, except with negligible probability.
In general, quantum mechanics predicts the impossibility to observe a quantum mechanical system without changing its state, so if the eavesdropper tampers with the quantum channel, the protocol recognizes the attack and interrupts the computation of the key.
As is known, the main limitation of QKD protocols relates to losses and noise in the quantum communication channel; in a theoretical analysis of QKD systems, the potential eavesdropper is assumed to be able to fully control the quantum channel and he/she can use unlimited classical and quantum resources to hack the secret communication between Alice and Bob; from an experimental point of view this means that all losses must be attributed to the presence of said eavesdropper, because it is not possible to discriminate between natural noise and eavesdropper's action.
In this regard,
As shown in
In general, QKD is based on pulses that include single photons, wherein it intrinsically conveys small amount of energy leading to a high probability of losing these pulses during transmission, thereby QKD is extremely hard to implement in highly noisy channels as a satellite-to-ground and long-fibre-based communications.
Indeed, even assuming ideal sources and detectors, losses are related to distance between Alice and Bob thus, after a certain distance, it's not possible to use QKD because the secret key rate drops to zero. Currently, the SKR-distance tradeoff is the main limiting factor to long distance direct communications in QKD, both on ground and satellite.
It has been shown that the upper bound of the Secure Key Rate (SKR) is a function of the channel loss, specifically of the maximum tolerated channel noise, regardless of how much optical power the protocol may use.
Nowadays, quantum repeaters and/or trusted nodes architectures are the main technological solution to overcome said limitations, but these solutions are not technologically ready and/or require strong assumptions about network typology.
In view of the foregoing, nowadays there is a strong need for an efficient QKD solution to overcome the limitation in direct communications, in particular the limitation relative to the SKR-distance tradeoff.
In the light of the limitations and drawbacks of the known Quantum Key Distribution (QKD) systems, an object of the that of present invention is introducing controllable tradeoffs between security and performance in QKD transmission systems (the achievable communication distance and Secret Key Rate (SKR)).
This and other objects are achieved by the present invention in that it relates to a QKD transmission system, as defined in the appended claims.
In particular, the QKD transmission system according to the present invention comprises a transmitter and a receiver, wherein the transmitter is configured to transmit a multiphoton pulse to the receiver through a trusted area that extends from the transmitter towards the receiver up to a trusted distance from the transmitter, and wherein the transmitter is configured to transmit the multiphoton pulse with a transmission power such that a single-photon pulse propagates out from the trusted area up to reach the receiver.
For a better understanding of the present invention, preferred embodiments, which are intended purely by way of non-limiting, non-binding examples, will now be described with reference to the attached drawings (all not to scale), wherein:
The following description is presented to enable a person skilled in the art to comprehend, make and use the invention. Various modifications to the embodiments will be readily apparent to those skilled in the art, without departing from the scope of the present invention as claimed. Thence, the present invention is not intended to be limited to the embodiments shown and described, but is to be accorded the widest scope of protection consistent with the features defined in the appended claims.
The present invention concerns a Quantum Key Distribution (QKD) transmission system that comprises a transmitter and a receiver.
The transmitter is configured to transmit a multiphoton pulse to the receiver through a trusted area that extends from the transmitter towards the receiver up to a trusted distance from the transmitter.
In particular, the transmitter is configured to transmit the multiphoton pulse with a transmission power such that a single-photon pulse propagates out from the trusted area up to reach the receiver.
Preferably, the QKD transmission system according to the present invention has the capability to control security/performance tradeoff by:
In the following, for the sake of description simplicity and without losing generality, the expression “trusted area” will be used as synonym of the expression “area of a predetermined size assumed to be secured/secure”, where also multiphoton states that encode the secret key bits can be considered secure. This is because in the trusted area, by definition, there is no eavesdropper.
The QKD transmission system according to the present invention increases the key transmission rate proportionally to the trusted distance D, thus a higher D leads to high transmission performances (i.e., higher Secret Key Rate-SKR) but lower security guarantees, while lower D leads to lower transmission performances (i.e., lower SKR) but higher security.
In the following, a satellite QKD transmission system according to a preferred embodiment of the present invention will be described in detail. However, the satellite application of the invention is not limiting, nor bounding, since the latter can be advantageously exploited, mutatis mutandi, also for terrestrial applications.
In the satellite scenario, it is legitimate to assume that it is easy to detect the presence of a potential observer within a certain area from the source, whereby some constraints on single-photon states can be relaxed.
In this context,
Preferably, as shown in
In use, the TX transmits to the RX, through the trusted area 23, high-power, multiphoton pulses, thereby increasing the overall probability that a photon reaches the RX. However, the transmission of high-power, multiphoton pulses implies that for the trusted area 23 the communication cannot be considered to be intrinsically secure, but the trusted area 23 can be assumed to be secured, either because in the proximity of the TX, for the geometry of the satellite QKD transmission system 2, an eavesdropper cannot be present, or because actively monitoring of the trusted area 23 is implemented.
The satellite QKD transmission system 2 has the following advantages compared to the satellite QKD transmission system 1 of the known type (more in general compared to all known satellite QKD systems):
Moreover, said advantages lead to:
Furthermore, the satellite QKD transmission system 2 is able to introduce these benefits with a minimal impact on a QKD standalone transmission system design, specifically:
In detail, by relaxing the constraint of single-photon-based coding key exchange for a certain portion of a link (i.e., for a trusted distance D from a transmitter), it's possible to increase the achievable communication distance and the achievable key rate. However, it's worth noting that the trusted area 23 is not secured by a single-photon pulse thus opening said trusted area 23 to photon splitting attacks, that is a strong vulnerability in QKD protocols.
In the following, two features of the satellite QKD transmission system 2 will be described in detail, namely how the definition of the trusted area 23 implies an increase in achievable communication distance and key rate, and how the above vulnerability is handled.
The trusted area 23 is used to transmit multiphoton pulses conveying a higher energy per pulse, thereby increasing the probability that one or more photons survive during their propagation. The satellite QKD transmission system 2 exploits a multiphoton bucket whose size is computed in order to allow the statistical achievement of single-photon conditions at the trusted distance D. In this way, a single-photon transmission and, hence, a secure communication are achieved outside the trusted area 23 (or safe region).
The concept of safe region is advantageously exploitable for space-earth, space and terrestrial communications, over guided means (e.g., fibers) or over free space.
The safe region (i.e., the trusted area 23) is actively monitored to detect possible eavesdroppers (e.g., unauthorized users).
In use, the TX of the satellite QKD transmission system 2 determines, based on the trusted distance D (that defines the size of the trusted area 23), a transmission power PTx such that to ensure, in statistical terms, that a single-photon pulse propagates from the boundary of the trusted area 23. Namely, in mathematical terms: the secured distance D will be the value for which Number_photons (D)=1, where Number_photons (·) is a decreasing function of the distance of the photons from the TX (i.e., Number_photons (·) decreases as the distance of the photons from the TX increases). The photon decrease is modelled using a channel model, wherein the more accurate the channel model, the better estimation of the trusted distance D. It's worth noting that, for satellite applications, the main parameters to consider are the atmospheric losses.
In use, the TX 31 emits a high-energy multiphoton pulse that travels through the trusted area 33 via a multiphoton link 34 while the number of photons decreases as the distance from the TX 31 increases until, at the boundary of the trusted area 33, the high-energy multiphoton pulse has become a single-photon pulse that travels via a single-photon link 35 and reaches the receiver 32.
The high-energy multiphoton pulse emission by the TX 31 is repeated as many times as necessary to obtain the entire key exchange, enabling the compatibility and the advantages of QKD protocols, but with a higher data rate and a better Quantum Bit Error Rate (QBER).
It's worth to notice that a user, that has the right to a Class of Service (CoS) for encryption, together with its priority and amount of keys required, can use the CoS, the priority and the amount of keys required as information to define the trusted area's size, thus the trusted distance D thereof. For example, if the CoS requires a small amount of key bits for encryption, extending the trusted area 33 and thus the key rate may not be of relevance, whereby the QKD transmission system 3 may choose to decrease the size of said trusted area 33, thus the trusted distance D from the transmitter 31.
In particular, the logic of operation 4 of the QKD transmission system 3 shown in
where N denotes the number of photons transmitted associated to a transmission power PTx, Channel_Model denotes a predefined model assumed for the transmission channel and modelling channel losses during photon propagation, Nphotons denotes a function providing the number of photons present at distance D (i.e., the trusted distance) from the transmitter 31 based on the number of transmitted photons N, the trusted distance D, the transmission power PTx and the channel model Channel_Model, P denotes a probability function, specifically that the function Nphotons is equal to one, and Threshold denotes a numerical value (between 0 and 1), defined as input (e.g. by system design), that represents how conservative and how tolerant the system is to security leakages; specifically, this parameter characterizes the admissible probability that an error occurs in achieving the single photon transmission at the exit of the specified area (if Threshold is low, e.g. 0.3, the system could achieve high communication performance, at the cost of possibly accepting a transmitted power such that the probability that multiphoton occur could be as high as 70% (0.7=1.0−0.3), possibly leading to security issues); as for the channel model, it is worth noting that the more accurate the channel model, the more efficient the QKD transmission system 3 in determining the trusted distance D; for example, in case of simple channel modelling, an arbitrarily conservative trusted area 33 can be assumed, leading to a decrease in efficiency in determining the trusted distance D, reducing the benefits of the solution itself; and
In this way, a bidirectional classical communication can be established between two users and an agreement protocol can be implemented by the two users to agree on a secret key.
It's worth noting that, the above logic of operation 4 of the QKD transmission system 3 ensures the security of the trusted area 33 in which it is possible to have a secure photon propagation from the transmitter 31. The concept of security is to be intended from the point of view of communications, whereby it is assured that no sniffing of transmitted photons is possible.
In particular, security is assured inside the trusted area 33 by monitoring the area and by making sure that no eavesdroppers are present. Monitoring of the sensitive area, such as to ensure the trusted area 33, can be conveniently carried out by detecting:
It is important to draw the attention to the fact that also the satellite QKD transmission system 2 shown in
With specific reference to satellite application, these two ways of detection can already be achieved with ground-based facilities (e.g., Kratos Sensor Network), while with the commercial push on SSA, SDA and safeguarding security there are already studies underway to expand the concept of space asset monitoring also with space-based sensors.
It's worth noting that the present invention can be advantageously exploited, in addition to satellite/space-earth communications, by any pairs of users adopting a DV QKD protocol on the basis of pulses implementation. More in general, the present invention can be applied to any couple of users connected through an absorptive media, implementing QKD.
As shown in
The receiver 52 includes a symmetric beam splitter 521 that splits the received laser beam for implementing the basis choice.
It's worth noting that photons are low-intensity pulses of light, thus the optical fibre losses limit maximum QKD distance on ground to about 400 km, whereby this distance is not sufficient to cover the needs of a national QKD infrastructure for direct communication.
In view of the foregoing, the QKD transmission system shown in
In particular, the achievable speed up in secret key rate (SKR) can be better than in the satellite scenario, but the trusted area is difficult to define; indeed, even if it is a well-defined part of the ground (i.e., a surface), the trusted area is strongly dependent on the level of assumption that is made on the security of the territory and on the possible presence of eavesdroppers. For example, the trusted area can be:
Based on these assumptions, the extension of the trusted area can result in a large range of possible values and it's difficult to quantify the real performance increase. In this respect,
In view of the foregoing, it's relevant to remark that the present invention, that concerns an adaptive QKD solution based on the trusted area concept, is capable of enabling a high-performance key rate transmission by relaxing the security conservativeness of QKD protocols.
In fact, the present invention teaches to:
In conclusion, it is clear that numerous modifications and variants can be made to the present invention, all falling within the scope of the invention, as defined in the appended claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102023000024831 | Nov 2023 | IT | national |
