1. Introduction

Fiber-optic transmission systems are susceptible to eavesdropping and require encryption for sensitive data. Fiber-optic cables are typically readily accessible and can be tapped using, e.g., evanescent coupling at an intentionally introduced fiber bend [1]. So far, the only known way to achieve perfect security which is fundamentally immune to all kinds of attacks is the one-time-pad (OTP) based on a fundamentally secure key, as may be established using quantum key distribution (QKD) [2]. However, OTP encryption requires the key to have the same length as the data/plaintext, which limits the data rate to the key distribution rate. Instead of implementing a perfectly secure system, practically secure schemes are often used. For instance, the Advanced Encryption Standard (AES) is a practically secure scheme applied in application layer. With AES, security attacks (e.g., brute force attacks on the key) are possible but are computationally hard. Besides the higher layer encryption, physical-layer encryption [3–9] that combines unavoidable physical randomness (noise) with suitable algorithms can also allow practical security. For instance, the Y-00 quantum stream cipher [3,6–8] is one of the physical layer encryption schemes that uses inevitable quantum noise/shot noise at detection to mask the information. The scheme relies on an encryption algorithm to convert a lower-order quadrature amplitude modulation (QAM) original constellation to an ultra-dense higher-order QAM constellation, which together with fundamental shot noise in photodetection makes recovery of the information impossible without the key. A crucial design parameter of the Y-00 cipher scheme is the size of the encypted QAM template. The higher the order of the ultra-dense modulation is chosen that the original data is converted to, the more security the system can provide. So far, the largest demonstrated encrypted QAM size is 1,048,576 (=2²⁰) QAM with low-speed 10-bit DACs at a symbol rate of 5 GBaud and at a line rate of 70 Gb/s [9]. Remarkably, the demonstration in Ref. [9] is a real-time demonstration which illustrates the hardware feasibility of the Y-00 stream cipher scheme. The encrypted template size can be increased by using more DACs and cascading modulators as demonstrated in Ref. [10], where two phase modulators and two 10-bit DACs were cascaded and a 2¹⁷- phase shift keying (PSK) template was used. The demonstrated Y-00 stream cipher was carrying 10 Gb/s signals.

In this paper, we design an integrated two-segment silicon photonics (SiPh) I/Q modulator which allows cascaded modulation via two sets of DACs and drivers. This dramatically increases the modulation order and therefore greatly enhances the security of the Y-00 scheme. Besides the increased security, the integrated cascaded modulator also allows us to realize the Y-00 stream cipher based transceiver in a small form factor and potentially at a low power consumption. We show that we can generate a 4,294,967,296 (=2³²) QAM based Y-00 ciphertext/encryption template that carries 22-GBaud 16-QAM information at a 160-Gb/s physical-layer secure net rate with 320-km standard single mode fiber (SSMF) transmission. Compared to our previous work [8,10], we have significantly improved the system by i) designing an integrated cascaded I/Q modulator; ii) increasing the encrypted template from 2¹⁷ PSK [10] and 2¹⁸ PSK [8] to 2³² QAM; iii) increasing the information data rate from 10 Gb/s [10] and 48 Gb/s [10] to 160 Gb/s.

2. Y-00 stream cipher and device design

The Y-00 quantum stream cipher achieves secure data transmission via two steps: i) at the transmitter, an encryption algorithm with a short seed key (e.g., 256 bits) is used to convert a low-order QAM signal to an ultra-dense QAM waveform; ii) upon photodetection, shot noise introduces detection uncertainties on the waveform. Only the legitimate user (Bob) who has the key can decrypt the waveform to the original low-order QAM signal for error-free detection. We assume that the short seed key is safe and can be delivered via a separate, highly secure distribution system such as QKD. With a sufficient number of amplitude levels on each quadrature of the ultra-dense QAM constellation, the noise induced uncertainties can lead to a symbol error ratio (SER) for an eavesdropper (Eve) closely approaching 1 [11]. As Eve without a seed key has to discriminate symbols of the ultra-dense QAM waveform to deduce data and/or seed key, the SER approaching 1 indicates high security. Given the coding of data bits is cyclically shifted and there is sufficient randomization on the amplitudes in the Y-00 encryption algorithm, SER approaching 1 in such a system will result in a bit error ratio (BER) closely approaching 0.5 [12]. As this paper focuses on the experimental demonstration of the concept of generating high order Y-00 quantum stream cipher template with a cascaded modulator, we do not provide a proof/derivation of the relationship between Eve’s SER and BER. Such detailed discussion of the security aspects is outside the scope of this paper and is provided in other papers such as Ref. [13]. For the rest of the paper, the SER for Eve will be used as a primary security measure of the system.

The conversion from low-order QAM (e.g., 16-QAM in this demonstration) to ultra-dense QAM (e.g., 4,294,967,296-QAM) is done as illustrated in Fig. 1(a). The seed key is used by two pseudorandom number generators (PRNGs) to generate two sets of practically unrepeated key streams (e.g., a 256-bit seed key generates a keystream with a period of 2²⁵⁶-1). The key stream from PRNG1 runs an exclusive OR (XOR) logic on the plaintext, and the one from PRNG2 is used for randomizing the amplitude levels via a basis combination algorithm. Details of the algorithm can be found in Ref. [7]. For each polarization, the original 4-bits 16-QAM plaintext is randomized into 32 bits and generate a 4,294,967,296 ( = 2³²) QAM ciphertext symbol.

 

Fig. 1. (a) Block diagram for the Y-00 encryption algorithm; (b) Theoretical calculation on Eve’s SER as a function of the QAM size.

Download Full Size | PDF

To understand how large the QAM size needs to be in order to be masked by shot noise, a theoretical calculation is done following Ref. [14], with results shown in Fig. 1(b). We examine Eve’s SER at two critical power levels, i) -10 dBm which is a typical power level after an optical modulator; and ii) -2 dBm which is the optimal launch power for our 160 Gb/s signal at the beginning of each fiber span. It can be seen that with only shot noise, Eve’s SER can be made to be only 0.36 at the highest by an 8-bit transmitter that can generate 2⁸×2⁸ QAM (the red star in Fig. 1(b)). A 10-bit transmitter (the orange star in Fig. 1(b)) would help to increase the SER, which is however still limited to 0.93. With our two-segment SiPh I/Q modulator, the nominal number of bits can be doubled. In other words, two 8-bit DACs can be used for each quadrature to produce a 16-bit transmitter which allows a cipher template of 4,294,967,296 ( = 2⁽⁸⁺⁸⁾×2⁽⁸⁺⁸⁾) QAM.

A schematic diagram of the two-segment modulator is shown in Fig. 2(a). As seen, the I/Q modulator consists of two Mach-Zehnder modulators (MZMs). Each MZM is formed by two waveguide phase shifters with embedded reverse-biased PN junctions in a push-pull configuration. The electrode for the phase shifter consists of two segments driven by two independent DACs. Each segment is 3 mm long and has a V_π of ∼6.2 V. The inset to Fig. 2(a) shows an example of modulating QPSK on each segment to generate a 16-QAM signal. A photo of the modulator chip is shown in Fig. 2(b).

 

Fig. 2. (a) Schematic diagram of the two-segment SiPh I/Q modulator; (b) a photo of the modulator chip.

Download Full Size | PDF

3. Experimental setup

With the two-segment I/Q modulator, we demonstrate the transmission of a 22-GBaud 16-QAM signal encrypted into a 4,294,967,296-QAM Y-00 quantum stream ciphertext. The experimental setup is shown in Fig. 3. The transmitter consists of a 1-kHz linewidth laser operating at 1550.1 nm [15] and the two-segment SiPh I/Q modulator. The modulator uses a laser input power of 17.5 dBm and the transmitter generates an output power of -16.5 dBm. The high loss is due to the packaging and the relatively high V_π of this experimental device. The optical coupling loss from the modulator packaging was ∼ 13 dB. The insertion loss of the device (excluding the optical coupling loss) was ∼ 8 dB. The DACs are 28-nm CMOS DACs which have a nominal resolution of 8 bits and operate at 88 GSa/s [16]. The output peak-to-peak voltage from the DACs are ∼0.32 V. The electrical driver amplifiers have a gain of 23 dB. Polarization-division multiplexing (PDM) is realized by a fiber-delay based PDM emulator with 10.9 meters of decorrelation delay (i.e., 54.5 ns or 1199 symbols). The polarization multiplexed signal is then boosted by an EDFA to reach the optimal launch power of -2 dBm. The transmission fiber is 4 spans of 80-km dispersion-uncompensated SSMF. The inset of Fig. 3 shows the signal spectrum at the transmitter (blue) and the receiver (orange). The received signal is detected by an integrated coherent receiver (ICR) [17] with input optical power of –10 dBm. The optical signal-to-noise ratio (OSNR) before fiber transmission (point ‘Eve (B)’ in Fig. 3) and after fiber transmission is 36 dB and 29.3 dB. The free-running local oscillator has a 1-kHz linewidth and is kept to within a frequency offset of ∼300 MHz relative to the transmit laser. The ICR has integrated transimpedance amplifiers (TIAs) and generates electrical signals with peak-to-peak voltage of ∼320 mV. The electrical signal is sampled by a real-time scope operating at 80 GSa/s with 8 nominal bits and electrical bandwidth of 32 GHz.

 

Fig. 3. Experimental setup for 22-GBaud 16-QAM signal with 4,294,967,296-QAM Y-00 quantum stream cipher encryption.

Download Full Size | PDF

The digital signal processing (DSP) procedures are shown in Figs. 4(a) and 4(b). At the transmitter, every 4 information bits (one 16-QAM symbol) generates a 32-bits (2³²-QAM) constellation point. No Nyquist pulse shaping is used, as it increases the required number of bits from the DACs. We aim to utilize all the 16-bit resolution for the ultra-dense QAM encryption. For each quadrature, the 16 bits [b₁₆, b₁₅, …, b₂, b₁] for the in-phase part of the 2³²-QAM waveform are split into two 8-bit groups, the even-indexed bits [b₁₆, b₁₄…, b₂] and the odd-indexed bits [b₁₅, b₁₃, …, b₁] for two DACs. This results in 6-dB higher RF driving power on the 1^st segment than on the 2^nd segment. The RF power on the two segments are carefully adjusted by RF attenuators and gain-tunable drivers. We choose to assign the odd and even bits to the two DACs so that there is only 6-dB RF driving power difference between the two modulators and such power difference is independent of the QAM template. In other words, if the bits are assigned in a difference manner, e.g., assigning all higher bits for one DAC and all lower bits for the other DAC, there will be a large RF driving power difference (e.g., > 30 dB) which creates unnecessary challenges for constructing the transmitter. At the receiver, coherent DSP such as dispersion compensation and multiple-input multiple-output (MIMO) adaptive filtering are done. The MIMO filter has 121 taps, and uses least mean square (LMS) algorithm with a digital phase locked (digital PLL) inside. The first 5000 symbols are used for pre-convergence, and then 3% pilot symbols are used for assisting the channel and phase estimation. After the MIMO filtering, the Y-00 decryption recovers the 16-QAM and binary bits in a symbol-by-symbol amplitude subtraction fashion [7] as illustrated in Fig. 4(c). A BER is calculated with 9.46 million received bits (2.3 million 16-QAM symbols) of the user information.

 

Fig. 4. Digital signal processing procedures for (a) transmitter and (b) receiver; (c) block diagram for the Y-00 decryption algorithm.

Download Full Size | PDF

Note that our DACs have a limited memory of 2¹⁸ samples which is significantly less than the number of points in a 2³²-QAM constellation. The 2³²-QAM constellation therefore contains only a random subset of the 2³² possible constellation points within this experiment. We emphasize that the encryption security of this work is ensured by the massive number and density of all possible points in the cipher constellation template, and this is independent of what subset of the points is actually selected by encryption in our measured time window. In fact, our encryption scheme generates ultra-dense constellation points uniformly at random, and our measurement confirms that loading different random subsets of 2³² constellation points affect neither the BER for Bob’s 16-QAM signal nor the SER for Eve’s 2³²-QAM waveform. In a real system where the bit stream has no cycle, measuring the whole 2³²-QAM constellation can be done by increasing the observation time.

4. Results and discussion

We keep the cipher template at 2³² QAM and measure the BER of the 22-GBaud 16-QAM signal as a function of ONSR at optical back-to-back setting. The results are shown in Fig. 5. A regular 22-GBaud 16-QAM signal without encryption is also measured for comparison. Assuming 7% hard-decision forward error correction (HD-FEC) with a BER threshold of 3.9×10⁻³, the required OSNRs are 23 dB for the regular 16-QAM signal and 24 dB for the encrypted 16-QAM. The resulting net data rate is (22 GBaud×16 QAM×2 pol. /(1 + 7% FEC overhead + 3% pilot)) = 160 Gb/s. Note that the Y-00 encryption scheme can also work with soft-decision FEC (SD-FEC), if FEC decoding is incorporated in the basis separation function. The constellations before and after the decryption at an OSNR of 36 dB are shown in Fig. 5. The BER after 320-km SSMF transmission is 2.5×10⁻³, shown as the red dot in Fig. 5.

 

Fig. 5. Measured BER as a function of OSNR for the 22-GBaud 16-QAM signals with and without the encryption.

Download Full Size | PDF

In order to verify the effectiveness of noise masking with our increased QAM size, we measure the SER for Eve as a function of QAM size. We give Eve access to the two best places for tapping (c.f. Fig. 3): i) Point ‘Eve (A)’, after data modulation and before the first EDFA, where the optical power may be weak but the amplified spontaneous emission (ASE) noise is the smallest. For Eve, this place is one of the best places because the detection of the signal at this point is ideally only limited by shot noise. Therefore, even in a normal situation this point may not be accessible to Eve, we still give Eve the possibility to tap from this point; and ii) Point ‘Eve (B)’, after the first EDFA where the optical power is strong but the signal is corrupted by ASE. As point B is the beginning of the fiber transmission, this is one of the other best places for Eve as any point beyond point B will be further corrupted by more ASE noise.

The measured SER is shown in Fig. 6. We can observe that, compared to our theoretical analysis of the SER shown in Fig. 1(b), our measured SERs vary in a much smaller range than those in Fig. 1(b). This is because in the theoretical analysis we assume an ideal situation for Eve where her detection is limited only by shot noise. In our experimental setup, there is also other noise such as the ASE noise from the EDFAs, thermal noise from the receiver TIAs, quantization noise from analog-to-digital converters (ADCs), etc. Especially, since our prototype chip has a relatively high insertion loss, the modulated light is relatively weak at the output of the modulator. This results in higher TIA noise for Eve at point A, and higher ASE noise for Eve at point B. Nevertheless, we can see that even with the co-existing of other noise, no cipher template equal or smaller than 2²⁰ QAM can make Eve’s SER closely approaching 1. A typical CMOS DAC can offer up to 8 bits at relatively high speed (e.g. > 10 GBaud) which gives maximum QAM cipher template of 2¹⁶. As observed from Fig. 6, Eve’s SER at cipher QAM template size of 2¹⁶ is 99.88%, which is lower than what 2³² QAM template can offer. In fact, with our 2³² QAM encryption, we observe respectively 17 and 20 correct symbols at point A and B for Eve, among our collected 2.3 million symbols. This means the SER for Eve is higher than 99.99%. It is worth nothing that, even though our SER improvement may look small (∼0.1%) because our prototype modulator has high insertion loss, such improvement should already be considered significant when it comes to system security measure.

 

Fig. 6. Measured symbol error ratio as a function of QAM template size at eavesdropping point A & B.

Download Full Size | PDF

5. Conclusions

We demonstrated a 4,294,967,296-QAM based Y-00 quantum stream cipher system carrying a 160-Gb/s net rate physical-layer secure signal. The ultra-dense QAM cipher signal generation is realized by our two-segment SiPh I/Q modulator driven by two sets of independent DACs with an aggregate nominal resolution of 16 bits per quadrature. The demonstrated encrypted QAM template is (2³² /2²⁰ =) 4,096 times larger than the previous demonstration (2²⁰ QAM), and the symbol rate is (22 GBaud/5 GBaud =) 4.4 times higher than the previous demonstration [9], although Ref. [9] is a real-time demonstration achieved with an FPGA.