Patent Grant
11856093
One-out-of-m oblivious transfer is useful in transactions between mistrustful parties A and B, where party A has a secret database with m entries and party B requests one of the m entries. Party B may be guaranteed the secrecy of its choice, and party A may be guaranteed that party B can only obtain one entry of its database. One-out-of-m oblivious transfer enables the implementation of other complex cryptographic tasks such as secure multi-party computation. Current implementations of one-out-of-m oblivious transfer fall into two broad categories. The first category is based on the processing and transmission of classical information. The second category relies on the processing and transmission of quantum systems. Both categories are considered non-relativistic.
The security of the first category of non-relativistic implementations of one-out-of-m oblivious transfer is based on the assumed difficulty of solving some mathematical problems, for example, the problem of finding the factors of large integer numbers. With the progressive development of more powerful computers, and better computing algorithms, solving mathematical problems that once were thought difficult may become less difficult, thereby potentially making these implementations vulnerable. The security of the second category of non-relativistic implementations of one-out-of-m oblivious transfer is based on assumptions on the quantum technologies that are accessible to the parties. With the development of better quantum technologies these implementations become vulnerable too.
In general, in one aspect, the disclosed technology relates to a method for performing spacetime-constrained oblivious transfer between a plurality of laboratories of a first party A and a plurality of laboratories of a second party B. The method includes providing the spacetime-constrained oblivious transfer to satisfy a first condition by a first spacetime region and a second spacetime region that there does not exist any causal curve in spacetime that connects any spacetime point of the first spacetime region to any spacetime point of the second spacetime region. The method further includes encoding, by the plurality of laboratories of the first party A, a first plurality of messages in a quantum state selected from a plurality of non-orthogonal quantum states; transmitting, by the plurality of laboratories of the first party A, the quantum state to a first laboratory of the second party B; applying, by the first laboratory of the second party B, a quantum measurement on the quantum state to obtain a classical measurement outcome; transmitting, by the first laboratory of the second party B, the classical measurement outcome to a plurality of laboratories of the second party B; providing the spacetime-constrained oblivious transfer to satisfy a second condition selected from a group consisting of a condition (2.1) and a condition (2.2). The condition (2.1) states that a plurality of laboratories of the second party B receive, in the causal past of at least one spacetime point of the first spacetime region, a second plurality of messages comprising information about the quantum state from the plurality of laboratories of the first party A, and the classical measurement outcome obtained by the first laboratory of the second party B; a plurality of laboratories of the second party B use the classical measurement outcome received from the first laboratory of the second party B and the messages received from the plurality of laboratories of the first party A to decode, in a plurality of spacetime regions comprising the first spacetime region, a first message from the first plurality of messages encoded by the plurality of laboratories of the first party A; no laboratory among the plurality of laboratories of the second party B can decode, in the second spacetime region, a second message from the first plurality of messages encoded by the plurality of laboratories of the first party A. The condition (2.2) states that no laboratory among the plurality of laboratories of the second party B receive, in the causal past of any spacetime point of the first spacetime region, any message comprising information about the quantum state from the plurality of laboratories of the first party A and no laboratory among the plurality of laboratories of the second party B can decode, in the first spacetime region, any message from the first plurality of messages encoded by the plurality of laboratories of the first party A.
Other aspects will be apparent from the following description and the appended claims.
Specific embodiments will now be described in detail with reference to the accompanying figures. Like elements in the various figures are denoted by like reference numerals for consistency.
In the following detailed description of embodiments, numerous specific details are set forth in order to provide a more thorough understanding. However, it will be apparent to one of ordinary skill in the art that the invention may be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid unnecessarily complicating the description.
Throughout the application, ordinal numbers (e.g., first, second, third, etc.) may be used as an adjective for an element (i.e., any noun in the application). The use of ordinal numbers is not to imply or create any particular ordering of the elements nor to limit any element to being only a single element unless expressly disclosed, such as by the use of the terms “before”, “after”, “single”, and other such terminology. Rather, the use of ordinal numbers is to distinguish between the elements. By way of an example, a first element is distinct from a second element, and the first element may encompass more than one element and succeed (or precede) the second element in an ordering of elements.
Further, although the description includes a discussion of various embodiments, the various disclosed embodiments may be combined in virtually any manner. All combinations are contemplated herein.
In general, embodiments provide a method for spacetime-constrained oblivious transfer. Spacetime-constrained oblivious transfer (SCOT) is a variant of the cryptographic task of one-out-of-m oblivious transfer in which relativistic signaling constraints are imposed. From the imposition of relativistic signaling constraints and the use of quantum systems, various embodiments may provide unconditional security.
One-out-of-m oblivious transfer is useful in transactions between mistrustful parties A (“Alice”) and B (“Bob”), where Alice has a secret database with m entries and Bob requests one of the m entries. More specifically, Alice has m messages x0, x1, . . . xm-1 initially secret to Bob, for some integer m≥2. Bob has a number bϵIm≡{0, 1, . . . , m−1} initially secret to Alice. In what follows, Im denotes the set Im≡{0, 1, . . . , m−1}, for any integer m≥2. As a result of the one-out-of-m oblivious transfer protocol Bob obtains xb. Bob may obtain the secrecy of his choice, and Alice may be guaranteed that Bob can only obtain one entry of her database. In other words, two security conditions must be fulfilled by a one-out-of-m oblivious transfer protocol. First, Alice cannot learn Bob's input b, and second, Bob can only obtain one of Alice's messages. One-out-of-m oblivious transfer may, thus, be useful in transactions between mistrustful parties Alice and Bob, where Alice has a secret database with m entries. One-out-of-m oblivious transfer enables the implementation of other complex cryptographic tasks such as secure multi-party computation.
Methods to implement one-out-of-m oblivious transfer generally fall in two broad categories. One category is based on protocols in which Alice and Bob process classical information and communicate classical messages between near laboratories, one controlled by Alice, and the other one controlled by Bob. These protocols are denoted as classical non-relativistic. Another category is based on protocols in which in addition to classical information, Alice and Bob process quantum systems and transmit quantum systems between near laboratories, again, one controlled by Alice, and the other one controlled by Bob. These protocols are denoted as quantum non-relativistic.
In classical-cryptography methods, classical information is communicated and processed by classical computers. These methods base their security in mathematical and computational assumptions, for example, on the assumed difficulty of finding the prime factors of a large integer number. These methods become vulnerable with the development of better algorithms and more powerful computers. For example, in methods based on the assumed difficulty of the mathematical problem consisting in finding the prime factors of large integer numbers a dishonest party runs a factoring algorithm in a computer and outputs the prime factors after some time of computation. Universal quantum computers can obtain the prime factors of large integer numbers much faster than classical computers can do. Thus, with the eventual development of universal quantum computers these methods will become insecure.
Lo's no-go theorem states that there cannot be any classical or quantum non-relativistic protocol for one-out-of-m oblivious transfer that achieves unconditional security (H.-K. Lo, Phys. Rev. A, 56, 1154 (1997) (“Lo”) is hereby incorporated by reference in its entirety). Lo's no-go theorem states in particular that if a protocol to implement one-out-of-m oblivious transfer is unconditionally secure against Alice, meaning that Alice cannot obtain any information about Bob's input b, then Bob can obtain the desired message xb by following the protocol honestly, and then by implementing a quantum operation on his quantum systems, he can obtain also Alice's message xk, for any k∈{0, 1, . . . , m−1}\{b}.
Spacetime-constrained oblivious transfer (SCOT) is a cryptographic task where relativistic signaling constraints are imposed on the cryptographic task of one-out-of-m oblivious transfer. SCOT is implemented by two mistrustful parties A (“Alice”) and B (“Bob”). Alice and Bob synchronize to a reference frame F in a spacetime that is at least approximately Minkowski, and specify m output spacetime regions R0, R1, . . . , Rm-1 in the frame F, with the property that every pair of output spacetime regions is spacelike separated, i.e., there is not any pair of output spacetime regions that is connected by any causal curve in spacetime. Alice has m messages x0, x1, . . . xm-1 initially secret to Bob, for some integer m≥2. Bob has a number bϵ{0, 1, . . . , m−1} initially secret to Alice. As a result of the SCOT protocol Bob obtains xb in the output spacetime region Rb. Two security conditions must be fulfilled by a SCOT protocol. First, Alice cannot learn Bob's input b anywhere in spacetime and second, Bob cannot obtain xi in Ri for more than one i from the set {0, 1, . . . , m−1}.
By defining SCOT in such a way that Bob must not obtain xi in Ri for more than one i from the set {0, 1, . . . , m−1}, where every pair from the output spacetime regions R0, R1, . . . , Rm-1 is spacelike separated, SCOT evades Lo's no-go theorem.
SCOT is a cryptographic task in the setting of relativistic quantum cryptography. In the setting of relativistic quantum cryptography, the security of the cryptographic methods is guaranteed from the properties of quantum information and the causality of spacetime. In particular, the no-superluminal principle of relativity theory, stating that physical systems and information cannot travel faster than light is satisfied by quantum theory, and is exploited to guarantee security of the cryptographic tasks.
Although relativistic-quantum cryptography is usually considered for Minkowski spacetime or for curved spacetimes that are close to Minkowski, as near the Earth surface, it can apply to arbitrary curved spacetimes with well defined causal structure. It is assumed in relativistic quantum cryptography that, within the region of spacetime where the cryptographic tasks take place, there are not wormholes or other mechanisms to send signals faster than the speed of light, that the parties participating in the cryptographic tasks have a well description of the spacetime geometry and that they cannot substantially alter the geometry of spacetime. It is also assumed that each of the parties participating in the cryptographic tasks, here denoted as Alice and Bob, consist of various agents participating in the task at different points of spacetime. The parties may agree on a reference frame F, which may have global spacetime coordinates (t, x, y, z), where the first entry is temporal and the others are spatial, and where units are used in which the speed of light is unity. It is assumed that all the agents keep their frames synchronized to the agreed frame F during the whole implementation of the cryptographic tasks, and that they do this in a cryptographically secure way. In the case of mistrustful cryptography, which includes the task of SCOT, Alice's (Bob's) agents work in collaboration and trust each other, but Alice's agents do not trust Bob's agents and vice versa. Particularly, relativistic quantum cryptography, and various embodiments of the present invention, can be used in the spacetime on the Earth surface and its surroundings, including the region of satellites orbiting the Earth and beyond into the solar system.
SCOT is a variant of one-out-of-m oblivious transfer with relativistic signalling constraints, defined as follows. SCOT is implemented by two parties, denoted as Alice and Bob, each having one or more agents, who may control laboratories at different regions of spacetime. Alice and Bob agree on a reference frame F in spacetime, and on m spacetime regions R0, R1, . . . , Rm-1 in the frame F, denoted as the output spacetime regions, with the property that for any pair of different numbers j, k∈Im, Rj and Rk are not causally connected; i.e for any spacetime point P in Rj and any spacetime point Q in Rk, there is not any causal curve connecting P with Q, which means that any physical system traveling at a speed not higher than the speed of light cannot leave the spacetime point P and arrive to the spacetime point Q and vice versa. Bob obtains an input number b∈Im in the spacetime region G, which may consist in the intersection of the causal pasts of at least one spacetime point of the output spacetime region Ri, for all i∈Im. For i∈Im, Alice obtains an input number xi in a spacetime region Ei; the spacetime region Ei being, for example, the intersection of the causal pasts of all the spacetime points of Ri, or the causal past of a spacetime point of Ri, which may be previously agreed by Alice ad Bob, for i∈Im. A SCOT protocol works correctly if Bob obtains the message xb in the output spacetime region Rb. The SCOT method may allow for a small error in Bob's output: Alice and Bob may previously agree on a threshold for which Bob's output within the spacetime region Ri is considered correct, for i∈Im. A method or protocol to implement SCOT is said to be unconditionally secure if the two following conditions are satisfied: 1) if Bob follows the actions specified by the method honestly and Alice tries to cheat, Alice having access to various quantum technology, which may be arbitrarily advanced, Alice cannot obtain any information about Bob's input b anywhere in spacetime, i.e., the probability that Alice guesses b is 1/m or arbitrarily close to 1/m by taking some security parameter to be sufficiently large; and 2) if Alice follows the actions specified by the method honestly and Bob tries to cheat, Bob having access to quantum technology, which may be arbitrarily advanced, Bob cannot succeed in obtaining xi in Ri (or a message xi′ sufficiently close to xi satisfying a threshold previously agreed by Alice and Bob) for more than one i from the set Im, unless with some probability that can be made very small by increasing some security parameter.
An illustration of the task of SCOT for the case m=2 is given in
The spacetime region Ri can consist, for example, in the set of spacetime points that define the three-dimensional space coordinates ΔLiB of one of Bob's laboratories adjacent to the location Li within a time interval [h, h+v], that is, in the agreed reference frame F, Ri={(t, x, y, z)|h≤t≤h+v, (x, y, z)∈ΔLiB}, where v>0, for i∈Im. In order to satisfy the condition that no pair of regions Ri and Rk are causally connected, the shortest time that light takes to travel between any spatial point in ΔLiB and any spatial point in ΔLkB must be greater than v, for all pair of different numbers i and k from the set Im; for example, since the speed of light through vacuum is approximately 300 000 km/s, and since the spacetime geometry near the Earth surface is approximately Minkowski, by setting the pair of Bob's laboratories whose sets of spatial coordinates are ΔLiB and ΔLkB on (or near) the Earth surface with a straight line distance separation of at least 150 km, for all i, k∈Im with i≠k, and by setting the value of the time interval v to be shorter than 0.5 ms, the condition that no pair of spacetime regions from R0, R1, . . . , Rm-1 are causally connected is provided.
SCOT may have the important property that it evades Lo's no-go theorem stating that one-out-of-m oblivious transfer cannot be achieved with unconditional security in the setting of quantum cryptography without relativistic signaling constraints. By defining SCOT so that Bob must not obtain xi in Ri for more than one i ∈Im, where the spacetime regions R0, R1, . . . , Rm-1 are pair-wise not causally connected, SCOT evades Lo's no-go theorem. SCOT can be achieved with unconditional security, without contradicting Lo's no-go theorem, because if Bob obtains xb in the spacetime region Rb by following the protocol honestly then, in agreement with Lo's theorem, Bob is also able to obtain xk in another spacetime region R′k, for any k∈Im\{b}, but due to the causality of spacetime, R′k must be necessarily in the causal future of Rb, which is consistent with the security definition of SCOT because the output spacetime regions Rb and Rk in SCOT are by definition not causally connected.
SCOT can have applications where, with high levels of security, a party Bob wants to learn an entry of a database from another party Alice, in some specific region of spacetime (e.g., at a specific location and at a specific time), while keeping his entry choice private from Alice, and by guaranteeing to Alice that if Bob access a first entry of her database in a first spacetime region, then Bob cannot access a second entry of her database in a second spacetime region that is spacelike separated from the first spacetime region. For example, potential applications of SCOT are in high frequency trading strategies (HFT) in the stock market, where transactions require high levels of security, and where transactions must be completed within very short time intervals (e.g. of half a millisecond). Other potential applications of SCOT correspond to situations where Alice and Bob own moving objects traveling at high speeds for which they want to keep their locations and trajectories secret from the other party, even though some information on their future trajectories must be disclosed in some situations, for example, if there is danger of collision.
Consider, for example, applications of SCOT in the stock market. Alice is a company that sells information about the stock market in real time in a set of different possible locations and Bob is a company that trades in the stock market using HFT strategies. Alice offers Bob one piece of her database x0, x1, . . . , xm-1, each being information on the stock market at the respective location L0, L1, . . . , Lm-1 at real time. Each Li could be the location of a stock market in some part of the world, e.g. New York, Toronto, Paris, London, Brussels, etc. Bob pays Alice a fixed amount of money to obtain an entry xb in the location Lb in real time. Bob requires that his choice b remains private from Alice, while Alice requires that Bob cannot access her entry xi in Li at real time, for more than one i from the set Im. SCOT guarantees with unconditional security that Alice cannot learn Bob's choice b anywhere in spacetime and that within a time interval smaller than 0.5 ms, which is relevant for HFT strategies, Bob cannot obtain xi in Li and also xj in Lj for any pair of different numbers i, j from the set {0, 1, . . . , m−1} if the distance between any pair of locations from the set L0, L1, . . . , Lm-1 is at least 150 km, which is the maximum distance that light can travel in 0.5 ms, in the approximately Minkowski spacetime of the Earth surface.
SCOT can be applied to the problem of private communication of the trajectories of moving objects in case of danger of collision. Consider, for example, that Alice and Bob each own a satellite orbiting the Earth and that they want to avoid their satellites to collide without revealing unnecessary information about the location and programmed trajectory of their satellite to the other party. Alice and Bob can perform this task by implementing SCOT as follows. In a reference frame F agreed by Alice and Bob, let Δτ=[h, h+v] be a time interval and let {ΔLjB}j=0m-1 be a set of regions of three-dimensional space known by Alice and Bob, such that Bob's satellite is programmed to be within ΔLbB in the time interval Δτ, with b∈Im being unknown to Alice. For i∈Im, Alice's input xi is such that if her satellite is programmed to pass within a neighborhood of ΔLiB within a given time interval Δτ′ immediately after the time h+v in such a way that if b=i there is danger of collision between Alice's and Bob's satellites within the time interval Δτ′ then xi indicates the programmed trajectory of Alice's satellite within the time interval Δτ′. In this way, if Bob's satellite obtains Alice's message xb in ΔLbB within the time interval Δτ, and if there is danger of collision, xb indicates the trajectory that Alice's satellite is programmed to follow within the time interval Δτ′; Bob's satellite is then able to adapt its trajectory on time in order to avoid collision with Alice's satellite in the time interval Δτ′. SCOT guarantees with unconditional security that Alice cannot learn Bob's input b, hence that Alice cannot learn the location of Bob's satellite, and that within the time interval Δτ, Bob's satellite can only learn the programmed trajectory of Alice's satellite for the time interval Δτ′ if there is danger of collision.
An illustration of SCOT applied to the problem described above is given in
With respect to
It would seem that the following simpler method in which Alice and Bob share secret key material achieves the same security conditions than the method based on SCOT discussed above. Consider that Alice and Bob share private key material that is secret from Charlie or any other party. Alice's satellite (310) may simply encode her information trajectory xi using the key material shared with Bob, for example, using the one-time pad, and broadcast this to the space region ΔLiB within the time interval Δτ, if it is programmed to pass within a neighborhood of ΔLiB within the time interval Δτ′ immediately after the time h+v. This method achieves the following: 1) Bob decodes the programmed trajectory (311) of Alice's satellite (310) for the time interval Δτ′ only if there is danger of collision; 2) Alice cannot learn Bob's input b; and 3) Charlie, or any third party cannot learn any information about the programmed trajectory (311) of Alice's satellite (310).
However, various embodiments of the SCOT method of the present invention may be more powerful and have advantages over the previously described method using shared keys in more complex situations. For example, consider that in addition to a satellite, Bob has N other devices that are capable of traveling through space. N may be much smaller than m, and particularly N may satisfy N+1<m; or N may satisfy N+1≥m. These extra devices may as well be other satellites, but may be labeled as ‘devices’ in order to distinguish them from the particular Bob's satellite (320). It could be that Bob's satellite (320) is in general difficult to maneuver; hence, it requires a sufficiently long time to change its trajectory (321) in an emergency situation in which it is about to collide, with Alice's satellite (310) for example. On the other hand, Bob's flying devices could maneuver their trajectories much more easily, perhaps because they are much smaller. Some embodiments include a situation in which Bob wants to know Alice's programmed trajectory (311) for the time interval Δτ′ in case that there is danger of collision with Bob's satellite (320) within the time interval Δτ′. Bob does not worry about his devices colliding with Alice's satellite (310), perhaps because these can maneuver their trajectories much better and hence avoid collision better. Bob could spread his N devices along space, so that they are at N of the m space regions ΔLiB within the time interval Δτ, trying to find the position and trajectory (311) of Alice's satellite (310). Assume that Alice's satellite passes through the space region ΔLiB within the time interval Δτ, for some i∈{0, 1, . . . , m−1}. In the method discussed above in which Alice and Bob use shared secret keys, if any one of N Bob's devices is in ΔLiB within Δτ, this device owned by Bob could decode Alice's information on her satellite's programmed trajectory (311) for the time interval Δτ′. In particular, if N+1=m, with unit probability either Bob's satellite (320), or one of his devices, learns the programmed trajectory (311) of Alice's satellite for the time interval Δτ′. This is a clear violation of the security condition for Alice, according to which only Bob's satellite (320) should learn the programmed trajectory (311) of Alice's satellite in case that there is danger of collision, i.e. if both Alice's and Bob's satellites are within the space region ΔLiB within the time interval Δτ (i.e. if b=i). However, the method based on SCOT may guarantee to Alice that Bob can only learn the programmed trajectory of her satellite for the time interval Δτ′ if Bob has input the number b=i in the SCOT protocol, i.e. with probability 1/m if Bob has no prior information about i, independently of how many devices Bob can spread through space.
Previous methods to implement SCOT may require the secure transmission of quantum systems over distant laboratories by Bob, for example. Depending on the application, SCOT methods could require the spatial separation of the output spacetime regions Ri to be considerably large in order to make their time lengths sufficiently large, which may require the transmission of quantum systems over long distances. For example, considering the output spacetime regions near the Earth surface described above, and illustrated in
Transmission of quantum states over long distances can be very expensive and challenging, and providing that the quantum channel is secure is even more challenging. For example, transmission of quantum states over long distances is usually done via optical fibre, with the quantum systems encoding the quantum states being photons. State-of-the-art optical fibre may have an attenuation of 0.142 db/Km, for example. This means, for example, that the transmission probability of a photon over an optical fibre of 1500 km is 10−1500(0.142)/10=5×10−22. Thus, not only it is very expensive to establish and maintain optical fibre over long distances, but also, due to the great losses of photons in the fibre, a great number of photons must be generated in order to achieve a desired level of security, which may require impractically large times for the preparation, transmission and reception of the required number of photons.
Even for optical fibre of shorter length, which have higher transmission probabilities, where the required number of photons sent through the fibre to achieve a desired level of security could be generated in a reasonable time τ, e.g., from a few seconds to several hours, this time could be too large to allow one of Bob's agents, agent Bb, to receive all the incoming photons and to measure them all within the small time interval v, which is of the order of a few milliseconds if Bob's laboratories are restricted to be on the Earth surface, unless Bob's agent Bb has a quantum memory that is able to store all the received quantum states reliably during the time τ. But quantum memories may have coherent times of the order of only a fraction of a second, for example. Therefore, for a broad range of applications in which the output spacetime regions Ri are such that Bob's laboratories are very far apart, producing a great amount of losses of the transmitted quantum states through the quantum channels (e.g., optical fibre), previous SCOT methods that rely on the transmission of quantum states among Bob's laboratories may not be practical to implement with current technology.
The present invention overcomes the above difficulties, by introducing a method to implement SCOT that is practical to implement with current technology, where the communication over distant laboratories is only classical, and can be easily implemented, for example via internet channels, and where the transmission of quantum states takes place at a single location, between laboratories that can be as close as a few meters or a few centimetres, something which is relatively easy to implement in practice with current technology. Furthermore, some embodiments do not require quantum memories, and the quantum communication between adjacent laboratories is allowed to take an arbitrarily long time, while still giving Bob the freedom to choose his input b only slightly in the past of the output spacetime regions Ri.
Furthermore, some embodiments of the present invention consider the more general situation, with respect to previous SCOT methods, in which the number M of output spacetime regions R0, R1, . . . , RM-1 could be different to the number m of input messages by Alice x0, x1, . . . , xm-1. Moreover, some embodiments explicitly consider the possibility that Alice and Bob cannot access all the output spacetime regions R0, R1, . . . , RM-1, because they have a limited amount of laboratories that may be smaller than M, for example. This property of some embodiments of the present invention is in contrast with previous SCOT method where it is explicitly stated that Alice has m agents that are able to send information close to the output spacetime regions R0, R1, . . . , Rm-1, and Bob has m agents receiving and processing information in, or close to, the output spacetime regions. This property of some embodiments of the present invention provides a broader range of applications than previous SCOT methods, which includes, for example, applications like the one illustrated in
The main part of some embodiments of the present invention consists in the following actions. For some integer M≥2, Alice and Bob specify M spacetime regions R0, R1, . . . , RM-1, denoted as the output spacetime regions, satisfying the property that there does not exist any causal curve in spacetime that connects any spacetime point of Ri to any spacetime point of Rj, for any pair of different numbers i and j from the set IM≡{0, 1, . . . , M−1}. Alice (Bob) has a laboratory LA (LB) and a plurality of laboratories LiA (LiB), for i∈IA (i∈IB), where IA (IB) is a non-empty subset of IM with all elements being different. For an integer m≥2, Alice encodes a string of m classical messages r=(r0, r1, . . . , rm-1) in a quantum state |Ψrs of a quantum system from a set of non-orthogonal quantum states {|Ψrs
r∈Ωoutcome, s∈Ωbasis}, where Ωoutcome is the set of possible values for the classical messages r and Ωbasis is the set of possible values for the classical labels s. The quantum state is transmitted to Bob's laboratory LB by the exchange of signals between the laboratories LA and LB, which may include quantum and classical signals, via communication channels that may include classical and quantum channels. In some embodiments the laboratories LA and LB are close to each other during the transmission of the quantum state. The values of M and m may in general not be equal, but in various embodiments discussed below it holds that M=m.
The set of quantum states {|Ψrsr∈Ωoutcome, s∈Ωbasis}, the probability distributions for r∈Ωoutcome and for S∈Ωbasis satisfy the following physical properties. First, for all i∈Im there exists a quantum measurement Mi independent of s and independent of r that implemented on the quantum state |Ψrs
gives a classical measurement outcome d, such that knowing d, the measurement Mi that is implemented, and the label s it is possible to effectively decode the message ri, or a message ri′ that is very close to ri according to a predetermined threshold previously agreed by Alice and Bob, with a probability equal or very close to unity, for r∈Ωoutcome, s∈Ωbasis and i∈Im. Second, for any pair of different numbers i, j from the set Im, for any quantum operation O independent of s and independent of r acting on the quantum state |Ψrs
that produces at least two quantum systems B0 and B1, and for any sets of quantum measurements {{tilde over (M)}0s}s∈Ω
The laboratory LB applies a quantum measurement Mc on the quantum state and obtains a classical measurement outcome d, for some c∈Im. The measurement outcome d is communicated via a communication channel CiB, of Bob, from the laboratory LB to Bob's laboratory LiB, for a plurality of numbers i from the set IB. In some embodiments the communication channel CiB is a classical channel, and may be secure and authenticated, for i∈IB.
The value of s is communicated from the laboratory LA to Alice's laboratory LiA via a communication channel CiA of Alice, which may be a secure and authenticated classical channel, for i∈IA.
The laboratory LiA transmits the value of s within a spacetime region Qi, wherein Qi satisfies the properties that it lies within the causal past of at least one spacetime point of the spacetime region Ri, and that there is not any causal curve in spacetime that connects any spacetime point of Qi to any spacetime point of the spacetime region Rj for all j∈IM\{i}, for i∈IA. Bob's laboratory LiB receives the value of s within the causal past of at least one spacetime point of the spacetime region Ri, for i∈IA∩IB. Bob's laboratory LiB uses the values of s and d, and the label c of the implemented measurement Mc, to effectively decode a message rc′ that is equal to the message rc, or very close to rc according to a predetermined threshold, in the spacetime region Ri, or in the causal past of at least one spacetime point of Ri, for a plurality of numbers i from the set IA∩IB.
Alice and Bob may agree on a reference frame F of global coordinates in spacetime in order to specify the output spacetime regions R0, R1, . . . , RM-1 in the frame F. Alice's and Bob's laboratories may keep their reference frames aligned to F during the whole implementation of the method; some embodiments may do this in a way that is cryptographically secure from the other party, for example, using GPS devices with the GPS signals being encrypted. For i∈IM, Alice and Bob may agree on a spacetime region Qi where one of Alice's laboratories may transmit the value of s, satisfying the property described above that Qi lies within the causal past of at least one spacetime point of Ri and that there is not any causal curve in spacetime that connects any spacetime point of Qi to any spacetime point of Rj for all j∈IM\{i}, and for i∈IM, or for i∈IA.
Alice and Bob specify sets IA and IB, with kA and kB elements respectively, where each of these sets is equal to the set IM or is a non-empty proper subset of IM. As mentioned above, Alice has laboratories LiA and Bob has laboratories LjB, for i∈IA and j∈IB. The set IA is known by Alice and the set IB is known by Bob. In some embodiments, Alice knows IB or has some knowledge about IB (e.g, Alice knows the value of kB), while in other embodiments Alice does not have any knowledge about IB, except that it is a subset of IM. Similarly, in some embodiments Bob knows IA or has some knowledge about IA (e.g, Bob knows the value of kA), while in other embodiments Bob does not have any knowledge about IA, except that it is a subset of IM. For example, in some embodiments IA=IB=IM, for which the discussion below is simplified. Furthermore, in some embodiments, Alice's laboratory LA is the laboratory LiA, for a i∈IA; in which case, the laboratory LB may be the laboratory LiB, if i∈IB.
For the correct functioning of the embodiments described above, the worldlines in spacetime of Alice's and Bob's laboratories must satisfy some constraints. In order to transmit the value of s within the spacetime region Qi, the worldline of Alice's laboratory LiA must intersect Qi, for i∈IA. For i∈IA∩IB, in order to receive the value of s within the causal past of at least one spacetime point of Ri, the worldline of Bob's laboratory LiB must intersect the causal future of at least one spacetime point of Qi and the causal past of at least one spacetime point of Ri. In some embodiments the worldline of LiB intersects the causal future of all spacetime points of Qi and the causal past of all spacetime points of Ri, for i∈IA∩IB, e.g., for all i∈IB. For a plurality of numbers i from the set IA∩IB that includes a number b∈IA∩IB, in order for Bob to be able to effectively compute rc (or a message rc′ very close to rc according to a predetermined threshold) in the spacetime region Ri, the worldline in spacetime of Bob's laboratory LiB must intersect the spacetime region Ri. In one or more embodiments, the worldline of LiB intersects Ri for all i∈IB.
In order for Bob to be able to effectively compute rc in a spacetime region Rb, for some b∈IM, the quantum state |Ψrs must be transmitted to Bob's laboratory LB within the causal past of at least one spacetime point of Rb, hence, the worldline of LB must intersect the causal past of at least one spacetime point of Rb. In order to give Bob the freedom of effectively computing rc (or a message rc′ very close to rc according to a predetermined threshold) in Ri for any i∈IB, it may be a feature that |Ψrs
is transmitted to LB within the intersection of the causal past of at least one spacetime point of Ri, for all i∈IB, hence, that the worldline of LB intersects the causal past of at least one spacetime point of Ri, for all i∈IB. For this reason, in some embodiments the worldline of Alice's laboratory LA also intersects the causal past of at least one spacetime point of Ri, for all i∈IB. In order to have complete freedom on the output spacetime regions where Bob can effectively compute rc (or a message rc′ very close to rc according to a predetermined threshold), in some embodiments the worldlines of the laboratories LA and LB intersect the causal past of at least one spacetime point of Ri, for all i∈IM, and the quantum state |Ψrs
is transmitted to Bob's laboratory LB within the intersection of the causal pasts of at least one spacetime point of Ri for all i∈IM.
to Bob's laboratory LB is represented by the filled arrow with label 1, which occurs within the intersection of at least one spacetime point of R0 and at least one spacetime point of R1. For i∈{0,1}, Qi lies within the causal past of at least one spacetime point of Ri, in fact of all spacetime points of Ri; and there is not any causal curve in spacetime that connects any spacetime point of Qi to any spacetime point of R
to Bob's laboratory LB by the exchange of signals with Alice's laboratory LA, which may include quantum and classical signals, through communication channels (not shown), which may include a quantum and a classical channel. In particular, the step 1 may include signals from LB to LA indicating that the quantum state was transmitted to a quantum system A. In some embodiments s is randomly (or close to randomly) generated from the set of possible values Ωbasis, and r=(r0, r1) is generated in a way such that ri is randomly (or close to randomly) generated from the set of possible values Ωi, for i∈{0,1}. The step 2 (3) corresponds to Alice's laboratory L0A (L1A) communicating s to Bob's laboratory L0B (L1B) in the causal past of a spacetime point of R0 (R1), through a communication channel (not shown), which begins with a transmission step from Alice's laboratory L0A (L1A) in the spacetime region Q0 (Q1). The step 4 corresponds to Bob's laboratory LB generating an input c∈{0,1}. In the step of the transmission of the quantum state to Bob's laboratory LB, in some embodiments any signals sent to Alice's laboratory LA do not leak any (or do not leak much) information about Bob's input c. The step 5 consists in implementing the quantum measurement Mc on the transmitted quantum state, giving as outcome a classical message d. The step 6 (7) consists in communicating the outcome d from LB to Bob's laboratory L0B (L1B) through a communication channel C0B(C1B), not shown, which may be a secure and authenticated classical channel. The step 8 (9) consists in communicating s from Alice's laboratory LA to Alice's laboratory L0A (L1A) through a communication channel C0A (C1A), not shown, which may be a secure and authenticated classical channel. A step (not shown) in which the value of c is transmitted from Bob's laboratory LB to Bob's laboratory LiB via the communication channel CiB may be required if c is not previously known by LiB, for i∈{0,1}. For i∈{0,1}, after reception of d and s, and using the label c of the implemented measurement Mc, Bob's laboratory LiB can compute and effectively obtain rc (or a message rc′ that is very close to rc according to a predetermined threshold) in Ri, which corresponds to the steps 10 and 11. If Bob only requires to effectively obtain rc in R0 (R1), the steps 7 and 11 (6 and 10) may be discarded.
Turning to
Turning to . Then, the quantum state is sent through the quantum channel (138) to the laboratory LB, controlled by Bob.
Turning to
Returning to
For i∈IA∩IB, there exists a communication channel, which may be a classical channel, between the laboratory LiA and the laboratory LiB, which communicates messages at least from LiA to LiB, and which exists at least within the spacetime region where communication between LiA and LiB takes place.
For i∈IA, there exists a communication channel CiA, which may be a classical channel, between Alice's laboratory LA and Alice's laboratory LiA. For i∈IB, there exist a communication channel CiB, which may be classical, between Bob's laboratory LB and Bob's laboratory LiB. In some embodiments the communication channel between the laboratories of agents of the same party are authenticated and secure, which can be implemented with shared secure keys that are previously distributed to them in a secure way, in the case that the channels are classical, for example.
It is important to clarify that the label ‘laboratory’ for each of LA, LB, LiA and LiB, for i∈IA and i′∈IB does not restrict the form of any of these. For example, some or all laboratories could be offices or scientific laboratories, they could be small and portable devices (e.g., within smartphones, or within desktop computers or laptops), or they could be satellites orbiting the Earth. A combination of laboratories from these of other forms are possible too. Some laboratories could have fixed locations while other could be displacing, in a particular reference frame F. For example, some laboratories could have fixed locations on the Earth surface, others could be portable and displacing devices, while other laboratories could be within satellites orbiting the Earth.
In some embodiments, the message ri is generated randomly from a set of possible messages Ωi, for i∈In, i.e. r=(r0, r1, . . . , rm-1) is generated randomly from the set of possible messages Ωoutcome=Ω0×Ω1× . . . ×Qm-1, and s is generated randomly from the set of possible labels Ωbasis. In this way, a priori, Bob's laboratory LB does not have any information about the possible messages ri encoded by Alice's laboratory LA, nor about the label s, apart from the fact that they belong to respective sets Ωi and Ωbasis, for i∈Im. In practice, it may not be possible for Alice's laboratory to provide that ri and s are randomly generated from Ωi and Ωbasis, for i∈Im. Thus, in some embodiments ri and s are generated with probability distributions that are close to be totally random, so that the information that Bob's laboratory LB may initially have about ri and s be very small, for i∈Im.
In some embodiments, in the step of the quantum state being transmitted to the laboratory LB, the laboratory LB sends a classical message to the laboratory LA indicating a quantum system A to which the quantum state was transmitted. This could be, for example, due to the fact that the quantum channel between the laboratories LA and LB may be subject to losses. For example, in embodiments in which LA sends photon pulses to LB through a quantum channel, which may be an optical fibre, for example, some photons are lost in the channel and only a fraction of them arrive to Bob's laboratory LB. Furthermore, in this kind of embodiments using photons as the quantum systems, the laboratory LB may apply the quantum measurement Mc by using single-photon detectors, in addition to other optical components. Because the single-photon detectors may not have unit detection efficiency, not all photons arriving at LB and then being subject to the corresponding quantum measurement may activate a detection event in the detectors in the laboratory LB. For this reason Bob's laboratory LB may require to report to Alice's laboratory LA the labels of a set of photon pulses that activated a detection event. Thus, in practice, in this case, the quantum system A that Bob's laboratory LB indicates to Alice's laboratory LA as the quantum system to which the quantum state |Ψrs is transmitted consists in the set of quantum systems encoded in the photons activating a detection and being reported by LB. More precisely, A may correspond, for example, to the polarization degrees of freedom of the photons activating a detection and being reported by LB in embodiments in which Alice's laboratory LA encodes the message r in the polarization degrees of freedom of photons.
In some embodiments in the step corresponding to the quantum state being transmitted from Alice's laboratory LA to Bob's laboratory LB, if signals are sent from LB to LA, these may leak no more than a small amount of information about the label c of the measurement Mc that is implemented by Bob's laboratory LB, or these may not leak any information about c at all.
In some embodiments Alice's laboratories and the communication channels among her laboratories are secure from Bob, and Bob's laboratories and the communication channels among his laboratories are secure from Alice.
The previous actions correspond to the main part of some embodiments of the present invention. In particular, the embodiments described above may satisfy the following conditions: I) Bob can effectively obtain a message rc′ equal to rc, or very close to rc according to a predetermined threshold with a probability equal, or very close, to unity, in any output spacetime region Ri for i∈IA∩IB, according to the label c∈Im of his implemented measurement Mc; II) Alice cannot effectively learn Bob's input c anywhere in spacetime; and III) for any pair of different numbers i, j∈IM and for any pair of different numbers li, lj∈In, Bob cannot effectively obtain a message rl
With respect to condition I), according to the embodiments discussed above, for all c∈Im, for all s∈Ωbasis, and for all messages r=(r0, r1, . . . , rm-1) ∈Ωoutcome encoded by Alice, there exists a quantum measurement Mc independent of s and independent of r that implemented on the quantum state |Ψrs gives a classical measurement outcome d, such that knowing d, s and c it is possible to effectively obtain a message rc′ that is equal to rc or very close to rc according to a predetermined threshold, with a probability that is equal, or very close, to unity. Bob applies the measurement Mc on the quantum state and obtain a classical measurement outcome d in the laboratory LB, which sends d and c to a plurality of laboratories LiB, for i∈IB, which may include some laboratory LbB—requiring that b∈IB. The laboratory LiB receives s in the causal past of at least one spacetime point of Ri, for i∈IA∩IB. Thus, if b∈IA∩IB, the laboratory LbB receives s in the causal past of at least one spacetime point of Rb and can effectively compute a message rc′, that is equal to rc, or very close to rc according to a predetermined threshold, with a probability equal or very close to unity, after reception of the outcome d and the label c, which can take place within the spacetime region Rb, if d and c are sent by LB in the causal past of at least one spacetime point of Rb, such that their reception by LbB takes place in the causal past of at least one spacetime point of Rb. For this to happen, it is a requirement that the world line in spacetime of LbB intersects the causal future of at least one spacetime point of Qb and the causal past of at least one spacetime point of Rb. In other words, Bob's laboratory LbB must be at the right location and at the right time in order to receive s from Alice's laboratory LbA and then be able to use this to compute effectively the message rc in Rb. Thus, Bob can effectively obtain rc (or a message rc′ that is very close to rc according to a predetermined threshold, with probability equal or very close to unity) in the output spacetime region Ri, for a plurality of numbers i from the set IA∩IB, for any c∈Im. In embodiments in which IA=IB=IM, Bob can effectively obtain rc (or a message rc′ that is very close to rc according to a predetermined threshold, with probability equal or very close to unity) in the output spacetime region Ri, for a plurality of numbers i from the set IM, for any c∈Im.
Turning to condition II), in the embodiments described above, Bob does not explicitly communicate to Alice his choice of c∈Im. If in the step in which the quantum state is transmitted to Bob's laboratory LB, Bob sends signals to Alice's laboratory LA, Alice may in principle obtain some information about c. But in some embodiments these signals do not leak much information about c, or they do not leak any information about c at all. Furthermore, in embodiment in which Bob's laboratories and communication channels among his laboratories are secure, Alice does not obtain any information about c. It follows that if Bob can make his laboratories and the communication channels among his laboratories secure, and if Bob can provide that the signals that his laboratory LB sends to Alice's laboratory LA do not leak any information (or do not leak much information) about c—in the step in which the quantum state is transmitted to LB—then Alice cannot obtain any information (or cannot obtain much information) about c anywhere in spacetime. Secure and authenticated classical communication channels can be implemented using secure keys that are previously distributed among the communicating laboratories. How to provide that the laboratories are secure and that the signals from LB to LA in the step of the transmission of the quantum state does not leak (much) information about c depends specifically on the embodiments. This is discussed further later with respect to embodiments with photonic implementations.
Turning to condition III), this condition may follow from the combination of the causality of spacetime and the properties of quantum information. What this condition says is that Bob cannot effectively obtain one of Alice's messages rl
In principle, Bob could send the quantum state |Ψrsthat he receives in his laboratory LB to another of his laboratories, say to a laboratory LbB, for some b∈IB. Then, after reception of s from Alice's laboratory LbA, assuming that b∈IA, Bob could apply a measurement depending on s on the quantum state and in principle decode the whole message r=(r0, r1, . . . , rm-1) encoded by Alice in the quantum state |Ψrs
, for example, in some embodiments in which s indicates an orthogonal basis and r indicates an outcome from the orthogonal basis labeled by s. Thus, Bob could in principle effectively obtain all messages r0, r1, . . . , rm-1 in one output spacetime region Rb, for some b∈IA∩IB, or for some b∈IA assuming that Bob has sufficient laboratories, for example if IB=IM. However, this is in no-contradiction with the security condition III) of some embodiments, which states that Bob cannot effectively obtain a message rl
Furthermore, according to Lo's no go theorem, assuming that the protocol is secure against Alice, i.e. that Alice cannot obtain any information about Bob's input c∈Im, Bob can follow the protocol honestly and effectively obtain a message rc in at least one output spacetime region Ri and then also obtain another message rl
More precisely, the security condition III) (also called security against Bob), states that for any cheating strategy by Bob, for any pair of different numbers i, j from the set IM and for any pair of different numbers li, lj from the set Im, the probability that Bob obtains the message rl
For clarity of the exposition and without loss of generality, an arbitrary cheating strategy by Bob may be considered in which he tries to effectively obtain rl
In some embodiments, Alice's laboratories are secure and the communication channels among her laboratories are secure and authenticated. It follows that Bob effectively learns the value of s chosen by Alice only after Alice deliberately communicates its value. In particular, for i∈IA, Alice's laboratory LiA transmits s within a spacetime region Qi, which satisfies a first property that it lies within the causal past of at least one spacetime point of Ri and a second property that there is not any causal curve in spacetime that connects any spacetime point of Q with any spacetime point of Rj, for all j∈IM\{i}.
Since 0, 1 ∈IA, the first property satisfied by Qi implies that Bob's laboratory LiB can receive s from Alice's laboratory LiA in Ri, or more generally within the intersection of the causal past of at least one spacetime point of Ri and the causal future of at least one spacetime point of Qi, for i∈{0,1}. For this to happen, it is a requirement that the world line in spacetime of LiB intersects the causal future of at least one spacetime point of Qi and the causal past of at least one spacetime point of Ri, for i∈{0,1}. In other words, Bob's laboratory LiB must be at the right location and at the right time in order to receive s from Alice's laboratory LiA and then be able to use this to try to effectively compute the message rl
For i∈IA, the second property satisfied by Qi says that for any element j∈IM satisfying j≠i, the spacetime region Qi where Alice's laboratory LiA transmits s is not causally connected to Rj, which means in particular that a light signal leaving Qi cannot arrive to Rj. Because the causality of spacetime implies that information cannot travel faster than light, it follows that the value of s transmitted by LiA cannot arrive to the spacetime region Rj, for any i∈IA and any j∈IM\{i}. Thus, for i∈{0,1}, the value of s can only be effectively known by Bob's laboratory LiB in the causal future of at least one spacetime point of Qi because of the transmission of s performed by Alice's laboratory LiA within Qi. Therefore, in general, for i∈{0,1}, Bob's guess of rl to Bob's laboratory LB, the laboratory LB applies a quantum operation O independent of s and independent of r on the quantum state |Ψrs
and obtains quantum systems B0 and B1. For i∈{0,1}, the system Bi is sent to Bob's laboratory LiB; then a quantum measurement Mis, which may depend on s, is applied on Bi after reception of s from Alice's laboratory LiA, and the outcome rl
|r∈Ωoutcome, s∈Ωbasis}, the probability distributions for r=(r0, r1, . . . , rm-1) ∈Ωoutcome and for s∈Ωbasis satisfy the following physical property: for any pair of different numbers l0, l1 from the set Im, for any quantum operation O independent of s and independent of r acting on the quantum state |Ψrs
that produces two quantum systems B0 and B1, and for any sets of quantum measurements {{tilde over (M)}0s}s∈Ω
In one or more embodiments, a physical property is satisfied by the set of quantum states {|Ψrs|r∈Ωoutcome, s∈Ωbasis} and the probability distributions for r=(r0, r1, . . . , rm-1) ∈Ωoutcome and for s∈Ωbasis, according to which for any pair of different numbers li, lj from the set Im={0, 1, . . . , m−1}, for any quantum operation O independent of s and independent of r acting on the quantum state |Ψrs
that produces two quantum systems B0 and B1, and for any sets of quantum measurements {{tilde over (M)}0s}s∈Ω
In some embodiments the quantum state |Ψrs cannot be effectively cloned without knowing s. If the state |Ψrs
could be effectively cloned without knowing s then, in Bob's dishonest strategy considered above, Bob's laboratory LB could produce two copies of the state |Ψrs
in the quantum systems B0 and B1, then by performing the measurement {tilde over (M)}is=Ml
|r∈Ωoutcome, s∈Ωbasis}contains states that are not orthogonal, because if all states from the set are orthogonal then the can be perfectly cloned.
In some embodiments, for a plurality of messages r∈Ωoutcome, the quantum states |Ψrs and |Ψrs′
are not orthogonal for any pair of different numbers s and s′ from the set Ωbasis. This property makes it even more difficult for Bob's laboratory LB to clone the transmitted quantum states |Ψrs
, hence, increasing the security guarantee against violation of the condition III) above in Bob's dishonest strategies discussed above in which he tries to clone the transmitted quantum state and send one copy to L0B and the other one to L1B. More generally, because non-orthogonal quantum states cannot be perfectly distinguished, this feature implies that any pair of quantum states |Ψrs
and |Ψrs′
are not perfectly distinguishable, for different s, s′∈Ωbasis. In the most general dishonest strategies by Bob, this feature provides that Bob cannot effectively obtain rl
A quantitative analysis is given in the examples below of the physical property discussed above.
The following notation is used below. The sets IM={0, 1, . . . , M−1}, Im={0, 1, . . . , m−1} and [n]={1, 2, . . . , n} are defined for any integer numbers M≥2, m≥2 and n≥1. For a string a of n entries, the jth entry is denoted by aj, for j∈[n]. The Hamming distance between strings of bits a and b is denoted by d(a, b). The Hamming weight of a string of bits a is denoted by w(a). When applied to bits (bit strings) ‘⊕’ denotes (bitwise) sum modulo 2. The complement of a bit a is denoted by ā=a⊕1, and of a bit aj by āj. The binary entropy of γ∈(0,1) is given by h(γ)−γ log2 γ−(1−γ)log2(1−γ), and of γ∈{0,1} is defined as zero.
A set Ω with l distinct elements is defined for some integer l≥2. A set Λ={(a0, a1, . . . , am-1)|ai∈Im and ai≠ai, if i≠i′, for i, i′∈lm} is defined, i.e. the set Λ is in one-to-one correspondence with the set of permutations of m distinct elements. The strings s=(s1, s2, . . . , sn)∈Λn and ri=(ri1, ri2, . . . , rin)∈Ωn are defined, i.e., with sj=(s0j, s1j, . . . , sm-1j)∈Λ and rij∈Ω, for j∈[n] and i∈Im. The number of elements of the set Λ is m!, hence, the number of elements of the set Λn is (m!)n. Similarly, as the number of elements of the set Ω is l, the number of elements of the set Ωn is (l)n.
A class of embodiments of the method of the present invention is described below. The quantum state |Ψrs is transmitted to a quantum system with Hilbert space A at Bob's laboratory LB, by exchange of quantum and classical signals with Alice's laboratory LA, where the strings s∈Λn and ri∈Ωn are randomly generated, for i∈Im. The quantum state is of the form
where r=(r0, r1, . . . , rm-1) denotes the string of m messages encoded by Alice, and where the Hilbert space A is a tensor product of mn Hilbert spaces Δij, as follows:
A=⊗i∈I
with the dimension of the Hilbert space Aij being equal to l for all j∈[n] and all i∈Im, and where i={|αri
}r∈Ω is an orthonormal basis of an l-dimensional Hilbert space, for i∈Im. A parameter λ is defined by
where the maximum is taken over all r, r′∈Ω and over all i, i′∈Im with i≠i′.
It is explained now how the property I) is satisfied. Bob generates the input c∈Im and applies a quantum measurement Mc on the received quantum state |ΨrsA. The quantum measurement Mc consists in measuring the quantum subsystem Aij of A in the basis
c, whose classical measurement outcome is denoted by dij, for j∈[n] and i∈Im. Further, dj=(d0j, d1j, . . . , dm-1j) is denoted for j∈[n], and Bob's total classical measurement outcome is denoted by d=(d1, d2, . . . , dn). Thus, the outcomes satisfy ds
is prepared by Alice in the quantum state
i.e. in the orthonormal basis c encoding the classical outcome rcj, for j∈[n]. Thus, for c∈Im, following this method honestly and using c, d and s, Bob can decode Alice's input rc. Therefore, in the ideal case that there are not errors nor losses, the example discussed above works correctly, i.e., the property I) is satisfied.
In this example, Bob may require to obtain a message rc in one output spacetime region (or in a plurality of output spacetime regions) in order to satisfy the property I) above. In this example there is no information given by Bob to Alice, hence security against Alice, i.e. property II), is satisfied too. In this example, the satisfaction of security against Bob, i.e. condition III), consists in the property that Bob cannot obtain rl
In order to implement security against a dishonest Bob (property III) above), the set of bases {i}i∈I
λ<1 (4)
For fixed values of l and n, the smaller the value of λ is, the greater the security that can be provided. For this reason, in some embodiments the bases i are mutually unbiased, i.e., |
αri|αr′i′
|2=l−1 for all r, r′∈Ω and all i, i′∈Im with i≠i′, in which case λ=l−1. For example, in the case M=2, some embodiments may set l=2, and a pair of mutually unbiased bases can be given by the computational and Hadamard bases.
In order to quantitatively prove the security against Bob in the examples of this subsection, it is considered that the set of bases {i}i∈I
of two l-dimensional quantum systems a and a′ such that |ϕ
can be expressed by
for all i∈Im.
If Bob is dishonest, he could perform a cheating strategy with the goal of obtaining the message rl
Thus, since λ<1 as given by (4), it holds that pn→0 exponentially with n, meaning that these embodiments are unconditionally secure against Bob (the property III) is satisfied).
Some embodiments may tolerate a small error in Bob's output rc′ with respect to Alice's original input rc, for c∈Im. For example, if the messages r0, r1, . . . , rm-1 are expressed as strings of bits, an output rc′ by Bob may be considered correct if the Hamming distance d(rc′, rc) to Alice's input rc is smaller than a predetermined threshold, which may be agreed a priori by Alice and Bob. For example, in the example embodiments discussed in the previous paragraphs, consider the case Ω={0,1}, i.e. ri is a string of n bits, for i∈Im. Bob's output rc′ may be considered correct if d(rc′, rc)≤nγ for some small allowed error rate γ∈(0,1), i.e. if the number of bit errors in rc′ with respect to rc is not greater than n γ, for c∈Im. In this case, Bob succeeds in cheating if, for at least two different numbers i, j∈IM and two different numbers li, lj∈Im, Bob obtains a message r′l
for some γ∈(0, Γm(λ)), where Γm(λ) is the smallest solution to the following equation
which satisfies Γm(λ)≤½ and where h(γ) denotes the binary entropy of γ. It follows from (8) that since γ<Γm(λ), the term inside the brackets in (7) is smaller than unity, hence, the upper bound on p′n given by (7) decreases exponentially with n.
Those of skill in the art will appreciate that the security bounds (6) and (7) may not be optimal and that they may be improved with mathematical techniques different to the ones used here. Furthermore, although the disclosed mathematical techniques may use the condition (5), this may not be essential. Moreover, particular examples have been given here in order to provide some quantitative security analyses. However, those of skill in the art will appreciate that the embodiments of the present invention are not limited to these particular examples. For example, while the transmitted quantum state IF) may be expressed as a pure state, in practice due to inevitable errors in the preparation procedure, only states that are close to be pure may be prepared and transmitted in practice. This implies some errors in Bob's outcomes, as well as errors during the measurement procedure and at other stages in the implementation of the method of the present invention. Some embodiments consider that Bob's output rc′ may be allowed to be only approximately equal to Alice's original input rc, for c∈Im, as exemplified above.
Two specific examples are provided below of the embodiments considered in this subsection that satisfy the conditions (1)-(5), from which the security bounds (6) and (7) follow. Those of skill in the art will appreciate that the invention does not limit to these examples, and that more general embodiments may be considered.
Example 1. For the case m=l=2 with Ω={0,1}, the state |ϕ is defined as |ϕ
=|Φ+
, where |Φ+
is the Bell state
Since l=2, 0 and
1 are qubit orthonormal bases, which without loss of generality are fixed on the same plane of the Bloch sphere. Without loss of generality,
0 is set to be the computational basis, given by the states |αr0
=|r
, for r∈{0,1}. The basis
1 is defined by the states
for r∈{0,1}, for some θ∈(0,π). This example provides that
Since θ∈(0,π), some embodiments have λ<1, hence, (4) holds. It is easy to see that |α01|α01
+|α11
|α11
=|0
|0
+|1
|1) for any θ, hence, by setting |ϕ
=|Φ+
(5) holds too. In this example, in order to enhance the security, some embodiments may have
in which case 0 and
1 correspond respectively to the computational and Hadamard bases, which are mutually unbiased, giving from (11) the value λ=½.
This example is very practical to implement. In particular, the case
corresponds to preparing the Bennett Brassard 1984 (BB84) states, which are very common to implement with current technology. However, this example limits to the simple case of two input messages by Alice, m=2. This example is generalized for arbitrary m below.
Example 2. An arbitrary value for m≥2 is set, with Ω={0,1}, hence l=2. Since l=2, i are qubit orthonormal bases, for i∈Im. The bases are set to lie on the same plane of the Bloch sphere. Without loss of generality this plane is set to be the x-z plane, and the basis
0 is set to lie on the z axis, i.e.
0 is the computational basis, which is given by the states |αr0
=|r
, for r∈{0,1}. The other bases can be expressed by the states
for r∈{0,1}, for different parameters θi∈(0,π), for i∈{1, 2, . . . , m−1}, which without loss of generality are ordered like θ1<θ2< . . . <θm-1. In this example, the following equation is provided:
for i∈{1, 2, . . . , m−1}, which gives
satisfying (4). As in the example 1 above, the state |ϕis set to |ϕ
=|Φ+, given by (9), which as above satisfies (5).
A.3.1 Security Against Bob
As shown below, using the mathematical formalism of quantum mechanics, the probability pn that Bob obtains rl to the quantum system A at Bob's laboratory LB, the laboratory LB applies a quantum operation O independent of s and independent of r on the quantum state and obtains quantum systems B0 and B1. For i∈{0,1}, the system Bi is sent to Bob's laboratory LiB; then a quantum measurement {tilde over (M)}is, which may depend on s, is applied on Bi after reception of s by Bob's laboratory LiB, and the outcome is output as Bob's guess of rl
of the quantum system A and a fixed quantum state |χ
of an ancillary system E, which is assumed to be of arbitrary finite Hilbert space dimension, to obtain the state
|ΦrsB
A|χ
E (15)
where the notation has been simplified by writing r=(r0, r1, . . . , rm-1), where AE=B0B1, and where the quantum systems B0 and B1 have arbitrary finite dimensions. Bob's laboratory LB partitions the global system AE into two quantum systems B0 and B1. Then, for i∈{0,1}, Bob's laboratory LB sends Bi to Bob's laboratory LiB, who receives it in the causal past of at least one spacetime point of Ri; then, using the message s, LiB applies a projective measurement {tilde over (M)}is={Πise
where r∈Ωnm denotes that ri∈Ωn for i∈Im, as the notation r=(r0, r1, . . . , rm-1) is used, and where l0, l1∈Im with l0≠l1. Then, using (1)-(5), and in particular, using the property of non-perfect distinguishability of non-orthogonal quantum states exploited in Alice's quantum state preparation (1), as quantified by (3) and (4), the proof of the bound (6) follows from the Appendix I of the filed provisional patent application. More precisely, the Appendix I of the filed provisional patent application presents a mathematical proof of a bound given in the main text of the filed provisional patent application, which is labelled as the bound ‘(6)’, using the equations from the main text of the filed provisional patent application labelled as ‘(1)’ to ‘(5)’, and ‘(15)’ and ‘(16)’. The equations ‘(1)’ to ‘(4)’, ‘(15)’ and ‘(16)’, and the bound ‘(6)’ of the filed provisional patent application are clearly identified with the equations (1) to (4), (15) and (16), and the bound (6) here, respectively, whereas the equation ‘(5)’ in the filed provisional patent application is replaced here by the equation (5). This is due to a minor typo in equation ‘(5)’ of the filed provisional patent application that has been corrected in the equation (5) here. The proof of the bound (6) follows straightforwardly from the Appendix I of the filed provisional patent application by simply replacing the equations ‘(1)’ to ‘(6)’, and ‘(15)’ and ‘(16)’ of the filed provisional patent application by the equations (1) to (6), and (15) and (16) given here, respectively.
From the bound (6) and the equation (16), it is straightforward to derive the bound (7) on the probability p′n with which, for at least two different numbers i, j∈IM and two different numbers li, lj ∈Im, Bob cheats successfully, i.e. Bob succeeds in obtaining a message r′l
where w(a) denotes the Hamming weight of the n-bit string a, i.e. the number of bit entries of a equal to ‘1’, and w(b) denotes the Hamming weight of the n-bit string b. The bound (6) applies to any pair of projective measurements on B0 and B1, hence, in particular to the projective measurement {tilde over (M)}is,a={Πise
where in the second inequality it has been used the well known mathematical fact by those of skill in the art that the number of n-bit strings a with Hamming weight not greater than nγ is upper bounded by 2nh(γ), for γ≤½, and where h(γ) is the binary entropy of γ. The bound (7) follows.
The embodiments of the present invention can be implemented with any type of quantum system, with some implementations being with photons. The quantum state |Ψrs may be encoded in degrees of freedom of photons, for example, in polarization degrees of freedom. For example, the transmitted quantum state |Ψrs
may be a tensor product of qubit states, with each qubit state being encoded with one or more photons. For example, each qubit state may be encoded in the polarization degrees of freedom of one or more photons.
The quantum channel between Alice's laboratory LA and Bob's laboratory LB could be, for example, optical fibre, the atmosphere near the Earth surface—or even the empty space if LA and LB were on the region of satellites orbiting the Earth or beyond into the solar system. As previously discussed, in some embodiments Alice's laboratories are secure from Bob and Bob's laboratories are secure from Alice. In photonic implementations, this means in practice that the laboratories must be checking side channel attacks in which the other party tries to obtain information about the inner working of the laboratory of the other party. For example, using reflectometry techniques, Alice's laboratory LA could analyse the light that is reflected from the optical devices in Bob's laboratory LB, for example through the optical fibre acting as quantum channel, and obtain some information about the interior of LB. In order to countermeasure these security attacks, called Trojan horse attacks, Bob's laboratory could be equipped with a power meter at the entrance of the quantum channel in order to detect light that is sufficiently intense that could be subject to Trojan horse attacks.
Different kind of photonic sources could be used in the step of the transmission of the quantum state |Ψrs. For example, Alice's laboratory may have a single photon source that works by preparing pairs of entangled photons in the polarization degrees of freedom—using parametric down conversion, for example—and then measure the polarization degrees of freedom of one photon in the pair along one of several bases, and then send the other unmeasured photon to Bob's laboratory LB. This process may be repeated many times in order to encode messages r0, r1, . . . , rm-1 of one or several bits in the quantum state |Ψrs
. Other type of single-photon sources may be used. Another type of source is a weak coherent source that emits single-photon pulses with some probability, but also pulses of zero photons with non-zero probability and pulses of two or more photons with non-zero probability.
The quantum measurement implemented by Bob's laboratory LB may require the adjustment of various optical components, and may also require photon-detectors, which may be single-photon detectors.
In photonic implementations, as in any other physical implementation, there are imperfections of the devices. For example, there are losses of photons through the quantum channel, the single-photon detectors have detection efficiencies smaller than unity, the detectors have small but finite dark count probabilities, etc.
Because of losses through the quantum channel and because of the non-unit detection efficiencies of the detectors, Bob's laboratory LB is not able to detect all photons prepared by Alice's laboratory LA. LB may send signals to LA indicating which photon pulses sent by LA activated a detection in his detectors. In this way, LB is informing to LA of a quantum system A to which a quantum state |Ψrswas effectively transmitted to LB, and LA knows in this way what quantum state |Ψrs
was effectively transmitted to LB. It may be a feature that such signals from LB to LA do not leak any information about the choice c of measurement implemented by LB, or that the leaked information about c is bounded to be small.
Measures to avoid that information from Bob's laboratory LB about his choice of measurement c∈Im to Alice's laboratory LA in a step in which LB reports to LA photon pulses that activate a detection may include, for example, verifying that the probabilities with which LB reports detection of photon pulses to LA are the same for all measurements Mc for c∈Im, which may require Bob to previously test the detection probabilities by the detectors in his laboratory LB and correct by appropriate factors so that the reported detection events by LB occur with the same probability for all c∈Im. Another measure by LB may include testing the statistics of the detection events in his detectors according to various experimental parameters, including the implemented measurement Mc for all c∈In, and provide that the detection events reported to LA do not leak any information about c, even for different parameters that could be controlled by Alice's laboratory LA.
A.4.1 Embodiments with Weak Coherent States
In a particular embodiment of the present invention, Alice's laboratory LA has a weak coherent source of photon pulses with small average photon number μ. The polarization degrees of freedom of the photons of each pulse are prepared along one of various states. For example, the polarization of some photon pulses may be prepared by Alice to be vertical, horizontal, diagonal, etc., and then sent to Bob's laboratory LB through an optical fibre or through empty space. As such, the laboratories LA and LB are close to each other in order to decrease the amount of losses of transmitted photons. Alice's laboratory may include a phase randomizer so that the photon pulses received by Bob's laboratory can be treated as mixed in the number of photons, with the probability that a photon-pulse has k photons be qk=e−μμk/k!, for k=0, 1, 2, 3, . . . , i.e. a Poisson distribution. For small average photon number μ, the probability of generating pulses of two or more photons is small, but positive. One then needs to consider attacks by Bob in which he can measure one photon in one basis and the other photon in another basis, or more general attacks. But for average photon number μ small enough, for example for average photon number μ<<1, the probability that Bob's laboratory receives multi-photon pulses is very small, hence, the probability that security against Bob is violated can be made small.
In the SCOT method of the present invention described above, the quantum state |Ψrs encoding Alice's string of m messages r=(r0, r1, . . . , rm-1) must be transmitted to Bob's laboratory LB in the intersection of the causal past of at least one spacetime point of Ri, for all i∈IM in order to allow Bob to effectively obtain his chosen message rc (or a message rc′ sufficiently close to rc according to a predetermined threshold), for any c∈Im, in a plurality of the output spacetime regions R0, R1, . . . , RM-1 of his choice. It is discussed below how the SCOT method of the present invention is extended so that Alice has the freedom of choosing her input message xi within the causal past of at least one spacetime point of the output spacetime region Ri, for i∈IM, but without requiring her to generate xi within the causal past of any spacetime point of Rj, for any j∈IM\{i}.
For i∈IA, Alice's laboratory LiA generates an input xi in the causal past of at least one spacetime point of Ri; the laboratory LiA computes a message ti in the causal past of at least one spacetime point of Ri, wherein ti is an encoding of xi using rl
Some embodiments are considered in which m=M and li=π(i), wherein r is a permutation of the elements from the set Im={0, 1, . . . , m−1}. The properties I), II) and III) discussed for the method of previous embodiments applies to the extended SCOT method here. Firstly, property I) provides that Bob may effectively obtain a message equal to, or very close to, rc in any output spacetime region Ri for i∈IA∩IB, according to his choice c∈Im. As discussed in the previous paragraph, in this extended SCOT method, Bob can use rc=rπ[π
However, if Alice's laboratories transmit tπ
The property of security against Alice, property II), in the method of embodiments described above (in previous sections) provides that Alice cannot effectively learn Bob's choice c anywhere in spacetime. In the extended method described here, since Bob does not give any further information to Alice, this property implies that Alice cannot effectively learn which of her messages xi, with i∈IA, Bob has obtained.
The property of security against Bob, property III), in various embodiments described above (in the previous sections) provides that Bob cannot effectively obtain rj in Rπ′(j) and rj′ in Rπ′(j′) for any pair of different numbers j and j′ from the set Im and for any permutation π′ of the m elements from the set Im, which implies π′(j),π′(j′)∈Im and π′(j)≠π′(j′) as used in the discussion of satisfaction of the security condition III). In the extended method of the present invention described here (in this section), Bob cannot effectively obtain xi in Ri and xi′, in Ri′, for any pair of different numbers i, i′ from the set Im. For j∈In, since xj is only effectively obtained from tj and rπ(j) for a permutation π of the m elements from the set Im, in order for Bob to obtain xi in Ri and xi′, in Ri′, Bob needs to obtain rπ(i) in Ri and rπ(i′) in Ri′. But as previously discussed, the SCOT method of the present invention satisfies the security condition that Bob cannot effectively obtain rj in Rπ′(j) and rj′ in Rπ′(j′) for any pair of different numbers j and j′ from the set Im and for any permutation π′ of the m elements from the set Im. In particular, where π′=π−1, Bob cannot effectively obtain rπ(i) in Rπ′[π(i)]=Ri and rπ(i′) in Rπ′[π(i′)]=Ri′, hence, Bob cannot effectively obtain xi in Ri and xi′ in Ri′ for any pair of different numbers i, i′ from the set Im. More precisely, the probability that Bob obtains a message xi′ equal or sufficiently close to xi according to a predetermined threshold in the output spacetime region Ri for more than one element i from the set Im is smaller than unity, which may be negligible, and which may decrease exponentially with n in embodiments in which r0, r1, . . . , rm-1 are expressed as strings of n bits.
is transmitted to Bob's laboratory LB; in a step 2 (3), s is communicated from Alice's laboratory L0A(L1A) to Bob's laboratory L0B(L1B), with the spacetime region Q0(Q1) where the transmission step from Alice's laboratory takes place is illustrated as a small rectangle.
In
In
For i∈IA, in embodiments in which the messages xi and rl
This extension of the SCOT method of the present invention is particularly useful in embodiments in which it takes a considerably long time to complete the step in which the quantum state |Ψrs is transmitted to Bob's laboratory LB and is convenient that Alice chooses her input message xi just slightly in the past of a spacetime point of Ri, for i∈IA. For example, in embodiments in which Alice's laboratory LA encodes the quantum state |Ψrs
by transmitting photons to Bob's laboratory LB, because of the losses on the quantum channel and the non-unit detection efficiencies of the photon-detectors, it could take a considerably long time for Bob's laboratory LB to detect a sufficiently large number of photons able to encode messages ri of many bits, for i∈Im. This time could be, for example, some seconds, minutes, hours, or even a few days. However, in some applications, it would be necessary that messages xi are chosen by Alice in real time, for i∈IA, i.e choosing these messages hours or days, or even a few seconds, in advance to the time at which Bob is able to receive them might not be useful for Bob.
For example, in some applications in the stock market, for i∈IM, xi may correspond to some financial information generated by Alice in some local stock market with location Li at real time, and the output spacetime region may correspond to the location Li of the corresponding market slightly in the future of Alice generating xi. In some embodiments relating to the stock market, small latencies of the order of fractions of a millisecond are very important. For example, in high frequency trading strategies (HFT) in the stock market, many transactions are completed within half a millisecond. Alice may be a financial institution selling financial information about several international stock markets at real time. Bob may be a trader who buys information from Alice in order to trade using HFT strategies. The output spacetime regions may correspond to the locations of some international stock markets within a small interval of time (e.g. of the order of half a millisecond). Alice's input messages xi may be the messages that Alice offers to Bob, from which Bob may only access one of his choice at the respective stock market within the corresponding small interval of time.
In the SCOT method described above, Bob must choose what message rc to obtain from Alice's encoded messages r0, r1, . . . , rm-1 at the time, or before, his laboratory LB performs the quantum measurement Mc on the transmitted quantum state |Ψrs. This means, for example, in the extended SCOT method considered above that Bob chooses to obtain Alice's message xi (or a message xi′ sufficiently close to xi according to a predetermined threshold) in a plurality of output spacetime regions that may include Ri, for a plurality of numbers i∈IM with the property that li=c, at the time or before the quantum measurement Mc is implemented on the quantum state by his laboratory LB—recalling that Alice encodes her message xi with a message ti and the message rl
Below, embodiments satisfying M=m and Alice's message xi being encoded by a message ti and by the message rl
. It is also illustrated how the laboratory LB inputs b=1 and then computes b′=b+c modulo 2, which corresponds to b′=b⊕c=1 in the illustrated example, and then b′ is transmitted to Alice's laboratory LA, which then communicates it to LiA, for i∈{0,1}. In this example the step is illustrated in which Bob outputs xb=x1 in the output spacetime region Rb=R1.
The extended SCOT method of the present invention described above allows Bob to have more freedom on the time when he chooses the number b∈IB, as he can choose this number after the quantum measurement Mc is completed. It may be a feature that the steps in which Bob's laboratory LB obtains b∈IB, computes b′=b+c modulo m, and transmits it to the laboratory LA, are completed within the intersection of the causal past of at least one spacetime point of Ri for all i∈IA, or for all i∈Im. This property allows Alice's laboratory LA to transmit b′ to Alice's laboratory LiA on time so that it receives it within the intersection of the causal past of at least one spacetime point of Ri, and can then compute ti using xi and rb′-i and then transmit it within the intersection of the causal past of at least one spacetime point of Ri, for all i ∈IA.
If c is randomly chosen by Bob's laboratory LB from Im, and the security condition that Alice cannot obtain any (or much) information about c anywhere in spacetime is satisfied, as stated by the property II) in the method of some embodiments described above (in previous sections), then Alice cannot obtain any (or much) information about b from the message b′=b+c modulo m that Alice's laboratory LA receives from Bob's laboratory LB. Thus, the condition of security against Alice, property II), may still hold in this extended method.
The security condition III) (security against Bob) holds in the extended method of the present invention described here. This means that Bob cannot effectively obtain a message xi′ in the output spacetime region Ri and a message xj′ in the output spacetime region Rj, with xi′ and xj′ being respectively equal or close to xi and xj according to a predetermined threshold, for any pair of different numbers i, j from the set Im. Consider a general cheating strategy by Bob in which he tries to output a message xi′ in the output spacetime region Ri and a message xj′ in the output spacetime region Rj, with xi′ and xj′ being respectively equal or close to xi and xj according to a predetermined threshold, for some pair of different numbers i, j from the set Im. Since Alice encodes the message xi with the messages ti and rb′-i, satisfying the property that xi cannot be decoded effectively with ti only, or with rb′-i only, for i ∈Im and since Alice gives Bob the message ti (in the causal past of a spacetime point of Ri) and encodes the messages r0, r1, . . . , rm-1, in the quantum state |Ψrs that she gives Bob, Bob's general cheating strategy consists in obtaining a guess r′b′-i of rb′-i in the causal past of a spacetime point of Ri and a guess r′b′-j of rb′-j in the causal past of a spacetime point of Rj using s, respectively, in order to obtain a message xi′ in Ri, using r′b′-i and ti, and a message xj′ in Rj, using r′b′-j and tj, wherein xi′ and xj′ are respectively equal or close to xi and xj according to a predetermined threshold, if r′b′-i and r′b′-j are respectively equal to or close to rb′-i and rb′-j according to a predetermined threshold.
In order to show unconditional security against Bob, it is assumed that IB=Im, i.e. that Bob has enough laboratories for this to hold. It is recalled that embodiments satisfying M=m are being considered. Similarly, it is assumed that IA=Im, as if Bob cannot cheat if IA=Im then it is even more difficult for Bob to cheat if IA is a proper subset of Im. Therefore, Bob's general strategy consists of three main steps. In the first step, Bob's laboratory LB receives the quantum state |Ψrs in a quantum system A from Alice's laboratory LA and applies a quantum operation O on A and an extra ancillary system E consisting in a unitary operation U on AE, independent of r and independent of s, producing two quantum systems B0 and B1, including also a measurement {tilde over (M)}′ producing a classical outcome (b′, i, j)∈Γ encoded in a system B″, where Γ={(k, i, j)∈Im×Im×Im|i≠j}. LB then sends b′ to LA (who sends b′ to LkA, for k∈Im) and he sends the quantum system B0 and the classical message (b′, i, j) encoded in a classical system B0″ to Bob's laboratory LiB, and the quantum system B1 and the classical message (b′, i, j) encoded in a classical system B1″ to Bob's laboratory LjB. Thus, LB sends B0B0″ to LiB and B1B1″ to LjB, while B″ is held by LB, except for b′, which LB sends to LA.
In the second step, after reception of s from LiA, and after reception of the classical message (b′, i, j) and of the quantum system B0 from LB, LiB applies a quantum measurement {tilde over (M)}0,b′,i,js—depending on both s and (b′, i, j)—on B0 and obtains the guess r′b′-i of rb′-i. Similarly, after reception of s from LjA, and after reception of the classical message (b′, i, j) and of the quantum system B1 from LB, LjB applies a quantum measurement {tilde over (M)}1,b′,i,js on B1 and obtains the guess r′b′-j of rb′-j.
As shown in the Appendix, the two steps above are mathematically equivalent to the following situation. More precisely, for any pair of different numbers i, j∈Im, it is shown that the joint probability that Bob's laboratory LiB obtains a particular outcome r′b′-i as his guess of rb′-i and Bob's laboratory LiB obtains a particular outcome r′b′-j as his guess of rb′-j in the procedure of the two steps above is the same in the procedure described in the paragraph below.
Bob's laboratory LB applies a quantum operation O′ on the received quantum state |ΨrsA and an extra ancillary system E′=EB0″B1″B″, producing two quantum systems B0′=B0B0″B″ and B1′=B1B1″. The operation O′ consists in LB applying the unitary operation U on AE of the quantum operation O above, partitioning AE into two subsystems B0 and B1, applying the quantum measurement {tilde over (M)}′ on B0B1 and preparing each of the quantum systems B0″, B1″ and B″ in a quantum state |μb′,i,j
, conditioned on the outcome of {tilde over (M)}′ being (b′, i, j), for (b′, i, j)∈Γ, where {|μb′,i,j
|(b′, i, j)∈Γ} is an orthonormal basis of each of the quantum systems B0″, B1″ and B″. Conditioned on the outcome of {tilde over (M)}′ being (b′, i, j), LB sends b′ to Alice's laboratory LA in part of the system B″, and LB sends the joint system B0B0″ (B1B1″) to Bob's laboratory LiB (LjB). A quantum measurement {tilde over (M)}0s is applied on the joint system B0′=B0B0″B″, with LiB obtaining the outcome r′b′-i from B0B0″, which is his guess of rb′-i. Bob's laboratory LjB applies a quantum measurement {tilde over (M)}1s on the joint system B1′=B1B1″ and obtains a classical outcome r′b′-j, which is his guess of rb′-j.
Finally, in the third step, after reception of the message ti from LiA, LiB computes his guess xi′ of xi, using ti and r′b′-i, and outputs it in Ri. Similarly, after reception of the message tj from LjA, LjB computes his guess xj′ of xj, using tj and r′b′-j, and outputs it in Rj.
As follows from the method of the present invention, for any quantum operation O independent of r and independent of s on the quantum state |Ψrs producing quantum systems B0′ and B1′, the probability to obtain respective outcomes r′b′-i and r′b′-j that are respectively very close to rb′-i and rb′-j according to a predetermined threshold, by respectively applying {tilde over (M)}0s on B0′ and {tilde over (M)}1s on B1′, is smaller than unity, which may be negligible, and which may decrease exponentially with n in embodiments in which r0, r1, . . . , rm-1 can be expressed as strings of n bits, for any pair of different numbers i, j∈Im. It follows that for any pair of different numbers i, j∈Im, the probability that Bob obtains a message xi′ in the output spacetime region Ri sufficiently close to xi according to a predetermined threshold, and a message xj′ in the output spacetime region Rj sufficiently close to xj according to a predetermined threshold, is smaller than unity, which may be negligible, and which may decrease exponentially with n in embodiments in which r0, r1, . . . , rm-1 can be expressed as strings of n bits.
The extension above allows Bob's laboratory LB to have the freedom to choose his input b after the quantum state that is transmitted to LB by Alice's laboratory LA has been received and measured; this is useful in situations where the transmission, reception and measurement of the quantum state takes a long time (e.g., from seconds to minutes, hours, or even days), while Bob wants to decide which message to obtain within a short time (e.g., a fraction of a second) in the past of the output spacetime regions R0, R1, . . . , Rm-1. Additionally, Alice's laboratory LA has the freedom to send the messages s, r0, r1, . . . , rm-1 to Alice's laboratory LiA before knowing b′, for i∈IA; this is helpful when b′ is announced by LB to LA slightly in the past (e.g., a fraction of a second in the past) of the spacetime regions R0, R1, . . . , Rm-1 and given that the size of the messages s, r0, r1, . . . , rm-1 could be considerably large it could be easier and less expensive for Alice to send these via conventional classical channels (e.g., Internet channels) which could take a considerably long time to transmit the messages (e.g., a few minutes) rather than via faster classical channels.
Different variations may be considered. For example, in one variation Bob's laboratory LB does not send b to the laboratory LiB, which acts assuming that b=i, for i∈IB. In another variation, Alice's laboratory LA obtains or generates xi in the causal past of at least one spacetime point of Ri and sends xi to the laboratory LiA, who receives it in the causal past of at least one spacetime point of Ri, for i∈IA.
As mentioned above, a potential application of SCOT corresponds to situations where Alice and Bob have moving objects, probably at high speeds, for which they want to keep their locations and trajectories secret to the other party. But some information about their locations or trajectories must be disclosed to the other party in some situations, for example if there is danger of collision. Particularly, one potential application of SCOT is related to the avoidance of the collision of satellites. Consider that the owners of two satellites want to keep their satellite's trajectories secret, while avoiding their satellites to collide.
Consider that Alice has a satellite LaA and Bob has another satellite LbB. They want to keep their trajectories secret from each other, but they want to avoid their satellites to collide. In addition to LaA (LbB), Alice (Bob) may have further satellites or laboratories in different regions of space. Alice and Bob perform a SCOT protocol, which might reveal some information from Alice to Bob about the planned trajectory of Alice's satellite LaA. The SCOT method of the present invention may provide to Bob that Alice does not obtain much information about the location of Bob's satellite for large m: the larger is m the less information Alice has about the location of Bob's satellite LbB. It may be provided to Alice and Bob that if they follow the protocol honestly, then Bob's satellite LbB obtains information about the planned trajectory of Alice's satellite LaA only if there is risk of collision, in which case Bob's satellite can change its planned trajectory and avoid collision. Additionally, some embodiments may provide to Alice that if Bob does not follow the protocol honestly, the probability that any of Bob's laboratories learns the future trajectory planned for Alice's laboratory LaA is small for large m. Moreover, some embodiments also may provide that satellites from a third party Charlie, who does not perform SCOT with Alice (nor with Bob), do not obtain any information about the planned trajectories of Alice's and Bob's satellites.
is transmitted to Bob's laboratory LB, where r=(r0, r1, . . . , rm-1). Alice and Bob agree that the output spacetime region Rj of some embodiments is the three-dimensional region of space ΔLjB within a time interval Δτ, which is slightly in the past of the time interval Δτ′, where ΔL′jB is a neighborhood of ΔLjB, as illustrated, for j∈Im. The spacetime region Ri is defined as the set of spacetime points with three dimensional space coordinates ΔLiB and time interval Δτ, for i∈Im. The regions ΔL0B, ΔL1B, . . . , ΔLm-1B are sufficiently far away and the time interval ΔT is short enough so that the spacetime regions R0, R1, . . . , Rm-1 are pair-wise causally disconnected, as required by the method. Alice and Bob perform the extended SCOT method of the present invention in which Alice can input messages xi in real time, i.e. slightly in the past of Ri, for i∈IA, and Bob can input b∈Im slightly in the past of the output spacetime regions R0, R1, . . . , Rm-1 using the encoding b′=b+c modulo m. Bob inputs the set IB={b} for some b∈Im, where the value of b indicates that Bob's satellite is planned to be in ΔL′bB within the time interval Δτ′. For a∈Im, if Alice's satellite is programmed to pass by ΔL′aB within the time interval Δτ′, then Alice performs the following actions: Alice inputs the set IA={a}; Alice's satellite inputs a message xa indicating her future programmed trajectory within the time interval Δτ′; Alice's satellite transmits the message ta that encodes xa using rb′-a, and also the message s so that these messages can be received in ΔLaB within the time interval Δτ. If a=b then Bob's satellite receives s and tb in ΔLbB within the time interval Δτ and decodes rb′-b=rc using s, and c and the measurement outcome d received from LB, and then decodes xb using rc and tb, in which case if there is danger of collision Bob's satellite can change his trajectory on time to avoid collision. It follows that satellites of a third party Charlie who has not performed SCOT with Alice or Bob cannot learn Alice's information xa nor the location of Bob's satellite. If Alice's satellite sends ta (and s) within a spacetime region Qa satisfying a property that it is not causally connected to any output spacetime region Rj, for j∈Im\{a} (in addition to be in the causal past of at least one spacetime point of Ra), and if a≠b, then Bob's satellite does not learn xa within the time interval Δτ. Bob could in principle learn xa in a future time, but he would require sufficient resources in space to be able to intercept Alice's transmitted messages s and ta. Furthermore, Bob could have other satellites, laboratories, or devices in different regions of space trying to track Alice's satellite and/or trying to learn its programmed future trajectory. The method guarantees to Alice that within the time interval Δτ, Bob cannot effectively learn the information xa on the programmed trajectory of Alice's satellite LaA for the time interval Δτ′ unless Bob followed the SCOT method honestly and input b=a, which has a small probability for large m if Bob does not have a priori any, or much, information about Alice's input a from the set {0, 1, . . . , m−1}. Moreover, Alice cannot learn Bob's input b, hence, she has little information about the location that Bob's satellite has within the time interval Δτ′, for m large: the larger m the less information Alice has.
The method of the present invention can be extended to situations in which, in addition to the steps of the method described above (in previous sections), for a plurality of numbers i∈IA: Alice's laboratory LiA inputs a plurality of messages xi(k), for k∈IN
In some embodiments, for a plurality of numbers i∈IA and for k∈IN
Turning to
In Step 1300, a spacetime-constrained oblivious transfer is provided that satisfies a first condition by various spacetime regions in accordance with one or more embodiments. The conditions may be similar to one or more conditions described above with respect to
Multiple variations of the above described systems and methods in accordance with one or more embodiments exist. For example, information may be encoded in qubits implemented in quantum systems in various ways, including the polarization degrees of freedom of photons, the time-bin degrees of freedom of photons, or the spin degrees of freedom of electrons, atoms, nucleus, molecules, etc. Further, while the above described systems and methods do not rely on quantum memory, alternatives that include quantum memories may be implemented in accordance with various embodiments. Alice's and Bob's laboratories may contain quantum memories, which allow the generated quantum states by Alice to be stored in Alice's and Bob's laboratories at different steps of the above described method.
Embodiments may be implemented on a computing system. Any combination of mobile, desktop, server, router, switch, embedded device, or other types of hardware may be used. For example, as shown in
Software instructions in the form of computer readable program code to perform embodiments may be stored, in whole or in part, temporarily or permanently, on a non-transitory computer readable medium such as a CD, DVD, storage device, a diskette, a tape, flash memory, physical memory, or any other computer readable storage medium. Specifically, the software instructions may correspond to computer readable program code that when executed by a processor(s), is configured to perform embodiments.
Further, one or more elements of the aforementioned computing system (1400) may be located at a remote location and connected to the other elements over a network (1412). Additionally, embodiments may be implemented on a distributed system having a plurality of nodes, where each portion of the invention may be located on a different node within the distributed system. In one embodiment, the node corresponds to a distinct computing device. Alternatively, the node may correspond to a computer processor with associated physical memory. The node may alternatively correspond to a computer processor or micro-core of a computer processor with shared memory and/or resources.
While the invention has been described with respect to a limited number of embodiments, those skilled in the art, having benefit of this disclosure, will appreciate that other embodiments can be devised which do not depart from the scope of the invention as disclosed herein. Accordingly, the scope of the invention should be limited only by the attached claims.
Here it is shown that the following two procedures (1) and (2) described below are mathematically equivalent. More precisely, for any pair of different numbers i, j∈Im, it is shown that the joint probability that Bob's laboratory LiB obtains a particular outcome ei as its guess of rb′-i and Bob's laboratory LjB obtains a particular outcome ej as its guess of rb′-j in procedure (1) is the same in procedure (2), for any ei, ej∈Ω, where it is assumed that Ω is the set of possible values of rk, for k∈m.
In the procedure (1), Bob's laboratory LB receives the quantum state |Ψrs in a quantum system A from Alice's laboratory LA, it introduces an ancillary system E and applies a unitary operation U on AE, then it applies a quantum measurement {tilde over (M)}′ on AE obtaining a classical outcome (b′, i, j)∈Γ, with (b′, i, j) being recorded in systems B0″, B1″ and B″, where Γ={(k, i, j)∈Im×Im×Im×Im|i≠j}. LB partitions the joint system AE into B0 and B1. LB inspects (b′, i, j) from its system B″ and then it sends b′ to Alice's laboratory LA, and B0 (B1) and B0″ (B1″) to Bob's laboratory LiB (LjB). Bob's laboratory LiB (LjB) obtains the value (b′, i, j) from the system B0″ (B1″) and then applies a projective measurement {tilde over (M)}0,b′,i,js ({tilde over (M)}1,b′,i,js) on B0 (B1) and obtains a classical outcome ei (ej) which is its guess of the message rb′-i (rb′-j).
In the procedure (2), LB applies the following quantum operation O′ on AE′, where E′=EB0″B1″B″: LB prepares the quantum system B0″B1″B″ in a quantum state |μ0,0,1B
B
B″ it applies a unitary operation U on AE, and then it applies a unitary operation U′ on the total system B0B1B0″B1″B″, where the joint system AE is partitioned into the subsystems B0 and B1 (as in the procedure (1)). The unitary operation U′ consists in LB applying the quantum measurement {tilde over (M)}′ on B0B1 and preparing each of the quantum systems B0″, B1″ and B″ in a quantum state |μb′,i,j
, conditioned on the outcome of {tilde over (M)}′ being (b′, i, j), where {|μb′,i,j
|(b′, i, j)∈Γ} is an orthonormal basis of each of the quantum systems B0″, B1″ and B″, for (b′, i, j)∈Γ. Conditioned on the outcome of {tilde over (M)}′ being (b′, i, j), LB sends b′ to Alice's laboratory LA in part of the system B″, and LB sends the joint system B0B0″ (B1B1″) to Bob's laboratory LiB (LjB). A quantum measurement {tilde over (M)}0s is applied on the joint system B0′=B0B0″B″, with LiB obtaining the outcome ei from B0B0″, which is its guess of rb′-i. Bob's laboratory LjB applies a quantum measurement {tilde over (M)}1s on the joint system B1′=B1B1″ and obtains a classical outcome ej, which is its guess of rb′-j.
Now details are given of the procedures (1) and (2) described above. The quantum state |ΨrsA is transmitted to Bob's laboratory LB. Bob's laboratory LB introduces an ancillary system E′, which includes a system E of arbitrary finite Hilbert space dimension and extra ancillary systems B0″, B1″ and B″, each one of Hilbert space dimension m2(m−1). The system E is set initially to an arbitrary quantum state |χ
, and the systems B0″, B1″ and B″ are set initially to the state |μ0,0,1
, where {|μk,i,j
|(k, i, j)∈Γ} is an orthonormal basis of B0″, B1″ and B″, and where Γ={(k, i, j)∈Im×Im×Im|i≠j}. Bob's laboratory LB applies an arbitrary unitary operation U on the joint quantum system AE. The global state is transformed into the state
|ΦrsB
A|χ
E (A1)
and where the joint quantum system AE is partitioned into two subsystems B0 and B1.
Consider the unitary operation U′ applied on the whole system AE′=B0B1B0″B1″B″:
U′=Σ(b′,i,j)∈Γ(Rb′,i,j)B
where Wb′,i,j is a unitary operation acting on a Hilbert space of dimension m2(m−1) satisfying Wb′,i,j|μ0,0,1=|μb′,i,j
, for (b′, i, j)∈Γ; and where {tilde over (M)}′={Rb′,i,j}(b′,i,j)∈Γ is a projective measurement on B0B1. Consider the projective measurement {tilde over (M)}a,b′,i,js {Πa,s,b′,i,j}e∈Ω on Ba, for a∈{0,1}, (b′, i, j)∈Γ and s∈Ωbasis, where Ωbasis is the set of possible values of s.
Consider the projectors
Π0,se=Σ(b′,i,j)∈Γ(Π0,s,b′,i,je)Bμb′,i,j|)B
acting on B0′=B0B0″B″, and the projectors
acting on B1′=B1B1″, for e∈Ω and s∈Ωbasis. It is straightforward to see that {tilde over (M)}as={Πa,se}e∈Ω is a projective measurement acting on Ba′, for a∈{0,1} and s∈Ωbasis.
It is straightforward to see that, for any pair of different numbers i, j∈Im, the joint probability that LiB obtains a particular outcome ei as its guess of rb′-i and LjB obtains a particular outcome ej as its guess of rb′-j in procedure (1) is the same in procedure (2), for any ei, ej∈Ω, as claimed.
This application claims the benefit of U.S. Provisional Application 62/650,791 filed on Mar. 30, 2018, and entitled “METHOD FOR SPACETIME-CONSTRAINED OBLIVIOUS TRANSFER”, and PCT Application PCT/IB2019/000426 filed on Mar. 29, 2019, and entitled “METHOD FOR SPACETIME-CONSTRAINED OBLIVIOUS TRANSFER.” The entire disclosures of both applications are hereby expressly incorporated by reference herein.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/IB2019/000426 | 3/29/2019 | WO |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2019/186279 | 10/3/2019 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 7184555 | Whaley et al. | Feb 2007 | B2 |
| 8171051 | Fattal | May 2012 | B2 |
| 8897449 | Broadbent | Nov 2014 | B1 |
| 10715319 | Pital a Garcia | Jul 2020 | B2 |
| 20020106084 | Azuma et al. | Aug 2002 | A1 |
| 20060045269 | Freedman et al. | Mar 2006 | A1 |
| 20090012938 | Lloyd et al. | Jan 2009 | A1 |
| 20100094842 | Fattal | Apr 2010 | A1 |
| 20100150349 | Choi et al. | Jun 2010 | A1 |
| 20180287788 | Pitalúa García | Oct 2018 | A1 |
| 20200259800 | Masny | Aug 2020 | A1 |
| 20220045994 | Masny | Feb 2022 | A1 |
| Entry |
|---|
| International Search Report issued in Application No. PCT/IB2019/000426, dated Aug. 30, 2019 (3 pages). |
| Written Opinion issued in International Application No. PCT/IB2019/000426, dated Aug. 30, 2019 (3 pages). |
| Pitalúa-García, D.; “Spacetime-constrained oblivious transfer;” Physical Review A; vol. 93; No. 6; Sep. 12, 2018; XP055613532 (9 pages). |
| Kent A.; “Location-Oblivious Data Transfer with Flying Entangled Qudits,” arxiv.org, Cornell University Library; Feb. 14, 2011; XP080498949 (5 pages). |
| Lo H.; “Insecurity of quantum secure computations;” Physical Review A; vol. 56; No. 2; Aug. 1997 (9 pages). |
| Nielsen M. et al.; “Quantum Computation and Quantum Information;” Cambridge University Press; 10th Anniversary Edition; 2010 (704 pages). |
| Kent A.; “Quantum Tasks in Minkowski Space;” University of Cambridge; Apr. 2012 (17 pages). |
| Pitalúa-García, D.; “Spacetime-constrained oblivious transfer;” Physical Review A; vol. 93, 062346; 2016 (8 pages). |
| Number | Date | Country | |
|---|---|---|---|
| 20210021414 A1 | Jan 2021 | US |
| Number | Date | Country | |
|---|---|---|---|
| 62650791 | Mar 2018 | US |
