CN105959113B - For preventing the quantum key distribution method of detector side channel attack - Google Patents

Abstract

The invention relates to a quantum cipher distribution method for preventing detector side-channel attacks. Under the condition that the detection device used in the existing preparation and measurement quantum cipher distribution scheme does not need to be improved, the Bob at the receiving end performs random Bell detection to check the quantum correlation between Alice and Bob, thereby detecting the existence of detector side-channel attacks. In the process of preparing and measuring quantum cryptography, it can effectively detect the existing detector side channel attack and solve the problem of detector side channel information leakage.

Description

A Quantum Cryptography Method for Preventing Detector Side-Channel Attacks

technical field

The invention relates to the field of quantum cryptography, in particular to a quantum cryptography distribution method for preventing detector side channel attacks.

Background technique

The preparation and measurement quantum cipher distribution scheme has the advantages of fast speed, high cipher generation rate and easy implementation. However, the side-channel attack of the detector greatly undermines its security. The eavesdropper Eve can use the defect of the detector to obtain its illegal information without violating the quantum principle, which means that she can eavesdrop on the communication without being discovered. Detector side-channel attacks do great harm to the security of quantum cryptography. Therefore, the detector must be greatly improved to avoid the attack of the detector side channel.

Some measures have been taken to prevent these attacks, such as quantum cryptography that is independent of the measurement device. In this case, the security of the measurement results relies on the monogamous nature of entanglement, which is more complex to implement and has a lower rate of cryptographic generation. Or use more perfect detectors to prevent attacks.

Contents of the invention

The purpose of the present invention is to provide a quantum cipher distribution method for preventing side-channel attacks on detectors, so as to solve the problem that existing methods rely on entanglement or detectors.

To achieve the above object, the solution of the present invention includes:

Step 1. The sending end A randomly selects an information embedding method, encodes random 0 or 1 into the quantum state of the photon, and sends it to the receiving end B;

Step 2. The receiving end B sets two modes: signal mode and test mode; receiving end B randomly selects one of the modes according to the probability; in the signal mode, randomly selects an information reading method to read the 0 or 1 carried by the photon; When the receiving end B selects the signal mode, the sending end A and the receiving end B announce their information embedding and reading methods through the public channel, and those bits whose information embedding method is consistent with the reading method are used as password bits; in the test mode, select A specific information reading method is used to perform the Bell test; when the receiver B selects the test mode, the transmitter A and the receiver B calculate the value of S _CHSH through the public channel to announce their base loss selection and measurement results.

Step 3. After the password is assigned, the sending end A and the receiving end B implement error correction and privacy amplification on the password bits to generate a secure password; the value of the S _CHSH is used for privacy amplification, according to the size and formula of S _CHSH (6) Determine the amount of marked information, and discard if the amount of marked information exceeds the preset threshold; if it is below the preset threshold, the marked information can be eliminated by relevant means. Since the specific elimination method has nothing to do with the content of this application, and many papers in the field of quantum cryptography are involved, it will not be repeated here.

Further, the information embedding method of the sending end A includes a slash base and straight basis In signal mode, the base vector of receiver B is at and randomly selected from.

Furthermore, in the test mode, the base vector of receiving end B is and Randomly selected in ; S _CHSH ≡<A ₁ B ₁ +A ₁ B ₂ +A ₂ B ₁ -A ₂ B ₂ >.

Further, the upper limit of the amount of information of the marked receiver B is estimated by the following formula:

Wherein H ₂ (x)=-xlog ₂ x-(1-x)log ₂ (1-x) is binary information entropy.

Furthermore, in addition to the detectors used to decode 0 and 1 marked as D ₀ and D ₁ respectively, the receiving end B also has a detector D _t ; each detector sets a time window, and the detector can effectively detect Incoming signal pulses, detectors outside the window cannot obtain effective pulses; the detection efficiency of D ₀ and D ₁ is marked as η, and the detection efficiency of D _t is η _t , compare η and η _t , when η _t > η , to determine the detector side channel attack.

According to the practice in this field, the sending end A is Alice, the receiving end B is Bob, and the eavesdropper Eve. The present invention checks the quantum correlation between Alice and Bob by performing random Bell detection on Bob at the receiving end without improving the detection device used in the existing preparation and measurement quantum cryptography distribution scheme, so as to detect the detection Whether there is a side-channel attack on the server. In the process of preparing and measuring quantum cryptography, it can effectively detect the existing detector side channel attack and solve the problem of detector side channel information leakage. The advantages of the present invention also include: there is no need to change the preparation and measurement quantum cryptography distribution scheme (such as changing to a quantum cryptography system that has nothing to do with the measurement device), which can ensure that the quantum cryptography distribution speed and password generation rate are not affected. In this scheme, there is no need to worry about the efficiency of the detector, because only the labeled photons can be used to calculate the CHSH polynomial. This scheme is implemented in the preparation and measurement quantum cryptography distribution method, so entanglement does not need to be considered.

Detailed ways

The present invention is described in further detail below.

The basic idea of the present invention is to use the preparation-measurement Bell test in the distribution of quantum ciphers, and the basic principle is:

According to the practice in this field, the sending end A is Alice, the receiving end B is Bob, and the eavesdropper Eve. Assuming that Alice has a single photon source (a weakly coherent light source can be used in practical experiments), she randomly chooses or and 0 or 1 to prepare photon B, before measuring photon B, the state of photon B always maintains the quantum state prepared by Alice;

Bob randomly chooses the base and measure photons entering the lab;

Alice and Bob use their base selection and preparation (measurement) results to calculate CHSH polynomials. If the classical limit of CHSH inequality is broken, it means that quantum correlation exists, otherwise quantum correlation does not exist.

If Alice’s choice of base loss and value for photon B is completely random, then in S _CHSH ≡<A ₁ B ₁ +A ₁ B ₂ +A ₂ B ₁ -A ₂ B ₂ >, we can get

In the same way,

use and to replace B ₁ and B ₂ , to get so you can get

Quantum theory is completely incompatible with local hidden variable theory, and the conflict of the loophole-free Bell inequality means that local hidden variable theory can be ruled out. Otherwise, failure to obtain a violation of the hole-free Bell's inequality means that quantum theory is wrong. Recently, the violation of the loophole-free Bell inequality has been experimentally verified by three groups. These important results imply that the local hidden variable theory is incorrect. Based on this fact, we can prevent the detector side-channel attack in the preparation-measurement quantum cryptography process through a simple and effective method. Under the condition that the experimental device does not need to be improved, the quantum correlation between Alice and Bob is checked by performing a random Bell test on Bob at the receiving end, so as to detect whether there is a side-channel attack on the detector.

The method of the present invention is described below by taking the improved BB84 scheme as an example. It should be noted that the method of the present invention can be used not only for the BB84 scheme, but also for other quantum cipher distribution schemes.

BB84 scheme based on the prep-measurement Bell test:

Step 1. Generate n single photons in Alice’s laboratory, and Alice straight line basis and any value between 0 and 1 are randomly selected to prepare these photons, and then these photons are sent to Bob.

Step 2, Bob has two modes: the probability that he selects the signal mode is p, and the probability that he selects the test mode is 1-p (preferably, only Bob himself knows the value of p). In signal mode the base vector is measured at and Randomly selected in , the base vector is measured in test mode at and randomly selected from.

When Bob selects the signaling mode, Alice and Bob publish their measurement base vectors through a common channel, and they store their measurement results in the same base vector as filtered cipher bits.

When Bob selects the test mode, Alice and Bob calculate the value of S _CHSH through the public channel to announce their base loss selection and measurement results.

Step 3. After the password is assigned, Alice and Bob perform error correction and privacy amplification on the selected password bits. If a secure password can be generated, the password assignment task is completed, otherwise the task fails. The above error correction process is related to the results of the above signal mode, and the privacy amplification is related to the measurement results of the test mode. Error correction is the process of judging whether there is fatal eavesdropping through the bit error rate.

The principle of the above scheme is that by adding a test mode in the password distribution process, the privacy amplification is performed through the result of the test mode, so that a secure password can be generated.

The specific theoretical analysis is as follows: Because Alice randomly selects the basis vector and value of photon B, the state The preparation of the states under the condition of loss of the conjugated group is consistent, and Eve cannot find out which state is prepared. If she were to perform a state-recognition task on photons, she would have to introduce interference. Without any loss, it can be assumed that Eve acts on photon B with a probe. If the interaction between the probe and the photon is regarded as a unitary process, we can get

Here |E> is the blank state of the Eve probe, f and e are the probability that the polarization of photon B remains unchanged and the polarization flips, respectively, and e usually also indicates the qubit error rate in the information Eve eavesdrops. The amount of information H ₂ (e) between Alice and Bob is usually used to correct their bit string errors, and the binary entropy is H ₂ (x)=-xlog ₂ x-(1-x)log ₂ x.

After being attacked by Eve, the result of <A ₂ B ₁ > recalculation is

Similarly, one can get

After Eve attacks, get In preparation-measurement quantum cryptography, Eve's eavesdropping can be subject to collective attack. The upper limit of the amount of information that Eve marks Bob can be estimated by the following formula:

Wherein H ₂ (x)=-xlog ₂ x-(1-x)log ₂ (1-x) is binary information entropy.

If Bob's detector is not so perfect, then detector side-channel information leakage may occur. Eve will use the shortcoming of Bob's detector side channel to attack the detector side channel. In the above example, Bob does not need to modify Bob's detector. Furthermore, Bob can also add improvements to the detector, as detailed below:

Assume that in addition to the detectors used to decode 0 and 1 marked as D ₀ and D ₁ respectively, Bob also has a detector D _t . In order to reduce the influence of the secret number, a time is often added to each detector during the password generation process. Window, the detector can effectively detect the incoming signal pulses within the window, and the detector cannot obtain effective pulses outside the window. Experimentally, the time window is realized by opening and closing the detector. Suppose D _t has the same detection efficiency as D ₀ and D ₁ but has a time window large enough to ensure that all signals that can be detected by D ₀ and D ₁ can also be detected by D _t . The detection efficiencies of D ₀ and D ₁ are denoted by η and that of D _t is η _t , η _t =η if there is no detector side-channel attack. Once the detector side channel attack occurs, it can be found that η _t > η, Therefore, the amount of information obtained by Eve during the detector side channel attack can be effectively estimated:

The theoretical analysis is as follows:

Theorem 1: The detector side-channel attack can be successfully carried out if and only if Alice's bit value obtained by Eve is partially or completely determined relative to Bob's measurement result.

Eve interacts with photon B to obtain the state Alice gave to photon B, and after Bob has measured the received photon, he and Alice announce their basis vector choice. The entropy reduction of Eve's state will limit the information Eve can obtain from Alice.

I _E ＝H _{a priori} -H _{a posteriori} (7)

Under the attack of the detector side channel, Eve's task is to eliminate the uncertainty of Alice's state. Although Bob's detector has various flaws, it is necessary to assume that no redundant information leaks from his laboratory. Otherwise, the security of quantum cryptography distribution cannot be guaranteed, which means that Eve should steal information from the detector indirectly. If Alice's state preparation for photon B is the same, H _{a priori} =1.

Considering H _{a posteriori} = ∑ _r P(r)H(i|r), let P(r) represent the probability that Bob obtains the measurement result of r, and H(i|r) represents the quantum state of Alice when the measurement result is r is the probability of i. Ideally, Bob's measurements should be evenly distributed between 0s and 1s. If Eve does not interact with photon B, then H _{a posteriori} = 1 after Bob announces his base choice, so I _E = 0, and Eve cannot steal any information from Alice. In order to satisfy I _E >0, H _{a posterior} <1 must be satisfied, and because ∑ _r P(r)=1 must be satisfied at any time, then Eve cannot get H(i|r)=1, which means that Eve is Under the condition that Bob obtains the measurement result r, the information of Alice's quantum state i is partially or completely determined.

Therefore, if the detector side-channel attack can be successfully implemented, Eve must control the detectors D ₀ and D ₁ to produce a detection efficiency difference, which is random and cannot be discovered by Bob from the time average. But this efficiency difference can be estimated by η/η _t and reflected in Therefore, it can be used to estimate the amount of information obtained by Eve in the detector side channel attack.

The specific embodiments related to the present invention are given above, but the present invention is not limited to the described embodiments. Under the idea given by the present invention, the technical means in the above-mentioned embodiments are transformed, replaced, and modified in ways that are easy for those skilled in the art, and the functions played are basically the same as those of the corresponding technical means in the present invention. 1. The purpose of the invention realized is also basically the same, and the technical solution formed in this way is formed by fine-tuning the above-mentioned embodiments, and this technical solution still falls within the protection scope of the present invention.

Claims (5)

1. for preventing the quantum key distribution method of detector side channel attack, which is characterized in that steps are as follows：

Step 1: transmitting terminal A selects an information embedded mode at random, random 0 or 1 are incorporated into the quantum state of photon, issues and connects Receiving end B；

Step 2: both of which is arranged in receiving end B：Signal mode and test pattern；Receiving end B is randomly choosed wherein according to probability One mode；In the signal mode, it randomly chooses an information reading manner and reads photon carries 0 or 1；When receiving end B is selected When selecting signal mode, transmitting terminal A and receiving end B announce their information insertion and reading manner by common signal channel, by information Those of consistent with the reading manner bit of embedded mode is as cipher bits；In test pattern, specific information reading side is selected Formula carries out Bell test；When receiving end B selects test pattern, transmitting terminal A and receiving end B calculate S by common signal channel_CHSH's Value come announce they base lose selection and measurement result；

Step 3: transmitting terminal A and receiving end B carry out error correcting and privacy amplification to cipher bits after password distribution, it is used for Generate security password；The S_CHSHValue for carrying out privacy amplification.

2. according to claim 1 for preventing the quantum key distribution method of detector side channel attack, feature exists In the information embedded mode of the transmitting terminal A includes oblique line baseWith straight line baseUnder signal mode, receiving end B basic vector existsWithMiddle random selection.

3. according to claim 2 for preventing the quantum key distribution method of detector side channel attack, feature exists In under test pattern, receiving end B basic vector existsWithMiddle random selection；S_CHSH≡< A₁B₁+A₁B₂+A₂B₁-A₂B₂>。

4. according to claim 3 for preventing the quantum key distribution method of detector side channel attack, feature exists In the upper limit of the information content of labeled receiving end B is estimated by following formula：

Wherein H₂(x)=- xlog₂x-(1-x)log₂(1-x) is binary information entropy.

5. according to claim 1 for preventing the quantum key distribution side of detector side channel attack described in any one of -4 Method, which is characterized in that receiving end B is respectively labeled as D in addition to being used to decode 0 and 1 detector₀And D₁, also there is a detector D_t；A time window is arranged in each detector, and detector can effectively detect the signal pulse of entrance in window, in window Mouth external detector cannot obtain effective pulse；D₀And D₁Detection efficient be labeled as η, and D_tDetection efficient be η_t, compare η And η_t, work as η_tWhen > η, detector side channel attack is judged.