Open Access
Add to BibSonomy
Abstract
Heterodyne-based continuous-variable source-independent quantum random number generator (CV-SI-QRNG) can produce true random numbers without any assumptions on source. However, practical implementations always contain imperfections, which will greatly influence the extractable randomness and even open loopholes for eavesdroppers to steal information about the final output. In this work, based on the theoretical model, we systematically analyzed the effects of imperfect implementations on the practical security of heterodyne-based CV-SI-QRNG. The influences of local oscillator (LO) fluctuation under imbalanced heterodyne detection are first analyzed. The simulation results show that the lower bound of extractable randomness will be overestimated without considering the influence of LO fluctuation, which will threaten the practical security of CV-SI-QRNG system. Moreover, we analyze the effects of the degree of imbalance and the magnitude of LO fluctuation on evaluating the extractable randomness. Finally, we investigate the impact of an imperfect phase modulator on the practical security of CV-SI-QRNG and find it will reduce the extractable randomness. Our analysis reveals that one should carefully consider the imperfections in the actual implementations of CV-SI-QRNGs.
© 2023 Optica Publishing Group under the terms of the Optica Open Access Publishing Agreement
1. Introduction
Quantum random number generators (QRNGs) based on the uncertainty principle of quantum mechanics are considered to be the most possible way to obtain true random numbers which play an important role in many fields, such as information security and scientific simulation fields [1,2]. Till now, various QRNG schemes based on different randomness sources have been proposed and demonstrated, including measuring photon arrival time [3–5], photon number distribution [6,7], photon path [8], phase noise [9–14], amplified spontaneous emission noise [15–20] and vacuum fluctuation [21–24]. Practically, many QRNGs can only produce true random numbers under the assumption that the performances of the source and measurement devices are trusted and perfect. However, the practical implementation may be vulnerable to imperfections and even controlled by an adversary, resulting in the introduction of noise into the output signals or random number information leakage, which will inevitably compromise the security of QRNG systems. Thus, the QRNG protocols requiring fewer assumptions are proposed, such as device-independent (DI) and semi-device-independent QRNGs. DI-QRNGs require the loophole-free violation of a Bell inequality without any assumptions on source and measurement devices [25–27], but the relatively low generation rate and the complexity of implementation limit their practical use. Semi-device-independent QRNGs could achieve a better trade-off between the generation rate and practical security, which require the assumptions on the dimension of the Hilbert space [28,29], the measurement device [30,31] or source [32–39]. Particularly, the quantum source is a very complicated physical device that is difficult to characterize in detail, so the source-independent (SI) QRNG protocol with untrustworthy source is an important protocol and has made great progress in theoretical analysis and experimental implementations in recent years.
SI-QRNG protocols can be divided into discrete-variable (DV) SI-QRNG protocols and continuous-variable (CV) SI-QRNG protocols. DV-SI-QRNG protocols are mainly based on repeated measurements of a single photon source by swapping between two mutually unbiased measurement bases [32,40], but its low generation rate cannot meet practical requirements. Different from the DV-SI-QRNG protocol, the CV-SI-QRNG protocols exploit CV observables of the electromagnetic field to generate random numbers, which has been demonstrated to achieve generation rates up to Gbps [33–37]. To measure quadrature fluctuations of quantum optical field, the receiver usually adopts homodyne detector [32,33,41–43] or heterodyne detector [36,37]. Particularly, the heterodyne-based CV-SI-QRNG can measure two conjugate quadratures simultaneously, i.e., $X$ and $P$ quadratures, and does not require an initial random seed to actively switch the measurement basis, which offers a simpler optical setup and higher generation rate [36,37].
For the heterodyne-based CV-SI-QRNGs, there are two main methods to evaluate the lower bound of the extractable randomness value. One is that exploiting the properties of the positive operator value measurement (POVM) implemented by the heterodyne detection gives a direct lower bound to the conditional min-entropy, where the conditional min-entropy $H_{\min }(M_{\delta }|\varepsilon )$ satisfies $H_{\min }(M_{\delta }|\varepsilon )\geq \log _{2}\frac {\pi }{\delta _{X}\delta _{P}}$ [36]. $H_{\min }(M_{\delta }|\varepsilon )$ means that the number of extractable random bits from the discrete heterodyne measurement results $M_{\delta }$ taking into account the quantum side information $\varepsilon$, and $\delta _{X}$ and $\delta _{P}$ represent the measurement resolutions of the $X$ quadrature and $P$ quadrature, respectively. In the CV-SI-QRNG protocol based on POVM, the bound of conditional min-entropy is only determined by the measurement resolutions of the trusted measurement apparatus. Thus, by measuring the well-characterized apparatus before the experiment, a legitimate user can obtain a constant conditional min-entropy without updating its value. The other is based on the entropic uncertainty principle (EUP) [37]. Exploiting heterodyne detection composed of two balanced homodyne detectors and an optical phase modulator (PM), an untrusted state can be divided into two identical states to measure $X$ quadrature and $P$ quadrature simultaneously. Then the quadrature of one state can be used to test the conjugate quadrature of the other state, and the lower bound of extractable randomness is also estimated based on EUP.
Although the CV-SI-QRNG protocols can guarantee the security of generated random numbers in the case of untrusted sources, the imperfection of practical physical devices, especially the measurement implementations, may still be exploited by an eavesdropper to threaten the security of CV-SI-QRNG. For the above-mentioned two heterodyne-based CV-SI-QRNG protocols of POVM and EUP, it is necessary for the security analysis to calibrate the vacuum fluctuation. However, the non-ideal beam splitter (BS) and photodiode (PD) will both cause the imbalance of heterodyne detection, and the imperfections of source devices or malicious control by an eavesdropper will lead to the fluctuations of the local oscillator (LO) intensity. Under imbalanced heterodyne detection, the LO fluctuation may introduce extra noise and influence the calibration of the vacuum fluctuation, which will affect the estimation of lower bound of extractable randomness and leave a loophole for the eavesdropper to operate an attack. So far, the influence of LO fluctuation in the asymmetric homodyne detection system has been analyzed and quantified [44,45], but analysis on the asymmetric heterodyne detection system is still absent. Moreover, in the CV-SI-QRNG protocol using the heterodyne detection, a PM is usually added to measure the $P$ quadrature. However, the PM may be imperfect under defects of the device itself or attacks from an eavesdropper, resulting in a deviation of the ideal value of $\pi /2$, which violates the measurement assumptions of the heterodyne-based CV-SI-QRNG protocol and influences the evaluation of extractable randomness. Consequently, the security problem caused by the imperfections of practical implementations is an urgent issue to be analyzed and solved.
In this paper, we focus on analyzing the influences of imperfect implementations on the security of the heterodyne-based CV-SI-QRNG protocols, including the LO fluctuation under imbalanced heterodyne detection and the imperfect phase modulation. The security analysis and simulation show that the number of extractable random bits would be overestimated without considering the influences of LO fluctuation and imperfect phase modulation. Moreover, the effects of imbalance degree and LO fluctuation magnitude in the CV-SI-QRNG are quantitatively analyzed. The rest of the paper is organized as follows. In Sec. 2, we give a general theoretical model of the practical heterodyne-based CV-SI-QRNG. In Sec. 3, the influences of LO fluctuation under imbalanced heterodyne detection are simulated and analyzed in the CV-SI-QRNG protocols of POVM and EUP, respectively. Then, we study the impacts of the non-ideal $P$ quadrature measurement caused by the imperfect PM on the practical security of EUP-based protocol in Sec. 4. Finally, we conclude and discuss this paper in Sec. 5.
2. Theoretical model of practical heterodyne-based CV-SI-QRNG
In the untrusted source scenario, the eavesdropper has full control of the quantum system $E$ correlated with the system $A$ to obtain the side information of untrusted source with state $\rho _{A}$. The quantum correlations between user and eavesdropper are modeled by a shared pure state $\rho _{AE}$. Based on the results of the heterodyne measurement and the estimation method of the extractable randomness, unpredictable and secure random numbers can be obtained even though the eavesdropper controls the source of quantum state. The general structure of the heterodyne-based CV-SI-QRNG based on vacuum fluctuation is shown in Fig. 1. The LO signal and untrusted source $\rho _{A}$ are divided into two beams via 50:50 BSs. Then, the quadratures $X$ and $P$ of $\rho _{A}$ are measured simultaneously by two homodyne detectors on the upper and lower arms. Notably, the phase of LO on the lower arm is shifted by $\pi /2$ to measure the quadrature $P$. The measurement results on quadratures $X$ and $P$ are discretized by two analog-to-digital converters (ADCs), and the raw data is obtained. Finally, a randomness extractor is applied on the raw data to extract true random numbers, which will be operated at the field programmable gate array platform.
Fig. 1. The structure of the heterodyne-based CV-SI-QRNG. LO: local oscillator; PM: phase modulator; BS: beam splitter; PD: photodiode; ADC: analog-to-digital converter; FPGA: field programmable gate array.
In the practical heterodyne-based CV-SI-QRNG, the intensity of LO may fluctuate due to the imperfection of laser or manipulated by an eavesdropper. Under ideal heterodyne detection, the LO fluctuation can be canceled by the balanced heterodyne detector. However, the imperfections of practical devices, such as the non-ideal splitting ratio of the BS and the different quantum efficiencies of PDs, make the heterodyne detection unbalanced. Hence, the LO fluctuation will not be canceled. Suppose the electric fields of LO and the untrusted source signal are $E_{L}(t)=E_{L}+\delta X_{L}(t)+i\delta P_{L}(t)$ and $E_{s}(t)=E_{s}+\delta X_{s}(t)+i\delta P_{s}(t)$, where $E_{L}$ and $E_{s}$ are time-independent terms, and $\delta X_{L(s)}(t)$ and $\delta P_{L(s)}(t)$ are time-dependent items that describe the changes of $X$ and $P$ quadratures of LO (vacuum state) field. The input untrusted source could be any quantum states and the time-independent term $E_{s}$ can be regarded as 0 because these quantum states are symmetric in any direction with a mean value of 0.
The transmissivities of the BS denotes $\frac {1}{2}-\Delta$ being dependent on the imbalance $\Delta$ and the Jones matrix of BS is $\begin{bmatrix} \sqrt{\frac{1}{2}-\Delta} & \sqrt{\frac{1}{2}+\Delta} \\ \sqrt{\frac{1}{2}+\Delta} & -\sqrt{\frac{1}{2}-\Delta}\\ \end{bmatrix}$, where $-\frac {1}{2}\leq \Delta \leq \frac {1}{2}$. Define the imbalances of four BSs, $\textrm{BS}_{1}$, $\textrm{BS}_{2}$, $\textrm{BS}_{3}$ and $\textrm{BS}_{4}$, are $\Delta _{1}$, $\Delta _{2}$, $\Delta _{3}$ and $\Delta _{4}$, respectively. The two homodyne detectors transform the optical signal into a voltage signal. And the conversion efficiencies of the PDs of the homodyne detectors are different, denoted by $\eta _{1}$, $\eta _{2}$, $\eta _{3}$ and $\eta _{4}$, respectively. Assuming the phase of LO is shifted by $\pi /2$, the corresponding electric fields at the four PDs can be expressed as follows
The differential output on the upper and lower arms can be derived as
Based on Eq. (2) and Eq. (3), we can find that the quadrature $X$ measurement is independent of $\textrm{BS}_{4}$ and the quadrature $P$ measurement is independent of $\textrm{BS}_{3}$. In practice, all the BSs and PDs may be imperfect. The imperfections in $\textrm{BS}_{3}$, $\textrm{BS}_{4}$, and PDs would cause the heterodyne detector imbalance. In the following analysis, we discuss two cases of BS imperfection. One is that $\textrm{BS}_{1}$ and $\textrm{BS}_{2}$ are ideal, while $\textrm{BS}_{3}$ and $\textrm{BS}_{4}$ are imperfect. The other is that $\textrm{BS}_{3}$ and $\textrm{BS}_{4}$ are ideal, while $\textrm{BS}_{1}$ and $\textrm{BS}_{2}$ are imperfect.
To simplify the analysis and ensure the validity of the protocol, we assume the imbalances of $\textrm{BS}_{3}$ and $\textrm{BS}_{4}$ are the same, i.e., $\Delta _{3}=\Delta _{4}=\Delta$. In the first case, Eq. (2) and Eq. (3) can be rewritten as
The term $[\frac {1}{2}\eta _{1(3)}(\frac {1}{2}-\Delta )-\frac {1}{2}\eta _{2(4)}(\frac {1}{2}+\Delta )]E_{L}^{2}$ represents the bias of the detection output, $2E_{L}\delta X_{L}(t))[\frac {1}{2}\eta _{1(3)}(\frac {1}{2}-\Delta )-\frac {1}{2}\eta _{2(4)}(\frac {1}{2}+\Delta )]$ is the influence of LO intensity fluctuation, and $E_{L}\delta X(P)_{s}(t)(\eta _{1(3)}+\eta _{2(4)})\sqrt {(\frac {1}{2}-\Delta )(\frac {1}{2}+\Delta )}$ represents the information about quantum noise signal in a practical system. Based on Eq. (4) and Eq. (5), the variances of LO fluctuation and measured quantum noise can be obtained [44,45]. For the $X$ quadrature, the variance of LO fluctuation will be
For the $P$ quadrature, the variance of LO fluctuation will be
In the above equations, $P_{LO}$ is the power of LO, $D(\delta X_{L}(t))$ represents the initial variance of LO fluctuation, and $D(\delta X(P)_{s}(t))=D(\delta X(P)_{QV}(t))+D(\delta X(P)_{QN}(t))$ denotes the initial variances of the $X(P)$ quadrature of the measured quantum noise composed of two independent initial signals of vacuum fluctuation $X(P)_{QV}(t)$ and quantum side information $X(P)_{QN}(t)$.
Generally, the initial variances of the vacuum fluctuation are the same, i.e., $D(\delta X_{QV}(t))=D(\delta P_{QV}(t))$. And the multiple of the initial variance of the LO fluctuation relative to the initial variance of the vacuum fluctuation is expressed by the coefficient $l$, $l=D(\delta X_{L}(t))/D(\delta X_{QV}(t))$. Since the initial variance of the vacuum fluctuation is theoretically constant, the magnitude of LO fluctuations can be measured by the coefficient $l$. The greater $l$ value indicates larger LO fluctuation. By taking into account the electronic noise variance $\sigma _{E,X(P)}^{2}$, the total variance of $X(P)$ quadrature of the measured signals can be expressed as
Similarly, the theoretical model corresponding to the second case can also be derived, where $\textrm{BS}_{1}$, $\textrm{BS}_{2}$ are imperfect and $\textrm{BS}_{3}$, $\textrm{BS}_{4}$ are ideal. Assuming the imbalances of $\textrm{BS}_{1}$ and $\textrm{BS}_{2}$ are same, $\Delta _{3}=\Delta _{4}=\Delta ^{'}$. For the $X$ quadrature, the variance of LO fluctuation will be
and the variance of measured quantum noise isFor the $P$ quadrature, the variance of LO fluctuation will be
and the variance of measured quantum noise isThe corresponding total variance of $X(P)$ quadrature of the measured signals $\sigma _{t,X(P)}^{'2}$ can also be derived.
Under imbalanced heterodyne detection, LO fluctuation cannot be eliminated which contributes to the excess noise. Without considering LO fluctuation, the variance of vacuum fluctuation would be exaggerated when calibrating the variance of vacuum fluctuation. It is necessary to analyze the influence of LO fluctuation on the security of CV-SI-QRNG under imbalanced heterodyne detection.
3. Impacts of LO fluctuation under imbalanced heterodyne detection
In the CV-SI-QRNG protocol, the extractable randomness is evaluated by the lower bound of quantum conditional min-entropy $H_{\min }(M_{\delta }|\varepsilon )$. Ref. [36] and Ref. [37] show two different methods to estimate the lower bound of $H_{\min }(M_{\delta }|\varepsilon )$, which are based on secure POVM and EUP theories. In this section, we analyze the impacts of LO fluctuation on the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ of the POVM-based and EUP-based protocols under imbalanced heterodyne detection, respectively. Both the non-ideal splitting ratio of the BS and the efficiency mismatch of the PDs would cause an imbalance in heterodyne detector. In this section, we mainly study the imbalance of heterodyne detection caused by the imperfect BS and suppose that the detector efficiencies of four PDs are the same.
3.1 CV-SI-QRNG protocol based on POVM
For the CV-SI-QRNG protocol based on POVM, the quantum conditional min-entropy is lower-bounded by
Thus, the bound of secure random bits extracted from each measurement only depends on the measurement resolution and is a constant if the measurement device can be trusted. To obtain the measurement resolution of well-characterized apparatus, it is necessary to perform a calibration of detection stage before running the experiment. Because the output voltage of the heterodyne detector is linked to the relative quantities in the phase space and is discretized by two ADCs, the coarse-grained version $\delta _{X}$ and $\delta _{P}$ of the quadrature operators can be obtained by the sampling precision $\delta _{ADC}$. The sampling range is selected for $[-N+\delta _{ADC}/2, N-3\delta _{ADC}/2]$ so that the central bin of discretized sampled signal is centered at 0 and the sampling resolution is $n$, so the sampling precision can be expressed as $\delta _{ADC}=N/2^{n-1}$.
During the calibration process, the input state is the pure vacuum state. Thus, the variance of measured quantum noise is equivalent to the variance of vacuum fluctuation, $\sigma _{Q,X(P)}^{2}=\sigma _{QV,X(P)}^{2}$. By changing the power of LO, the total variances of measured signals are recorded for each quadrature and we can fit a calibration line
where $c_{X(P)}$ is related to electronic noise. By convention, the theoretical quadrature variances in vacuum units for the vacuum state are given by $\sigma ^{2}_{X(P)}=\frac {1}{2}$. Then, the relationships between the variances in physical units and vacuum units areAccording to the fitted line, the constant $t_{X(P)}$ are determined by $t_{X(P)}=2m_{X(P)}$. Under balanced heterodyne detection, the LO fluctuation is canceled and the total variances of the measured signal are $\sigma ^{2}_{\textrm{total,X(P)}}=\sigma _{QV,X(P)}^{2}+\sigma _{E,X(P)}^{2}$, where only the variance of vacuum fluctuation is proportional to the LO power. In the ideal condition with no electronic noise, the variances in vacuum units can be expressed as
But the electronic noise cannot be eliminated in practice. In this case, the measured variances in vacuum units are given by [36]
Through the calibration function, the resolution of the ADC can be directly converted to the measurement resolution in vacuum units $\delta _{X(P)}$ which can be derived as [36]
where $k=N/\sigma _{t,X(P)}$ is related to the sampling range of the ADC. According to Eq. (15), the quantum conditional min-entropy $H_{\min }(M_{\delta }|\varepsilon )$ can be calculated.However, the above analysis does not consider the influence of vacuum fluctuation under the imbalanced detection, which may affect the calibration of the resolution $\delta _{X(P)}$ and the evaluation of extractable randomness. We first analyze the case that $\textrm{BS}_{1}$, $\textrm{BS}_{2}$ are imperfect and $\textrm{BS}_{3}$, $\textrm{BS}_{4}$ are ideal. According to Eq. (11) and Eq. (13), we find that the variances of LO fluctuation of $X$ quadrature and $P$ quadrature are equal to 0, where the detector efficiencies of four PDs are the same, i.e., LO fluctuation does not affect the estimation of extractable randomness. And the value of $H_{\min }(M_{\delta }|\varepsilon )$ would not be overestimated. However, based on Eq. (6) and Eq. (8), the variance of LO fluctuation cannot be canceled when $\textrm{BS}_{1}$, $\textrm{BS}_{2}$ are ideal and $\textrm{BS}_{3}$, $\textrm{BS}_{4}$ are imperfect, which influences the estimation of extractable randomness. Hence, in the following analysis, we mainly study the impacts of imperfect $\textrm{BS}_{3}$ and $\textrm{BS}_{4}$ on the practical security of CV-SI-QRNG.
With imbalanced heterodyne detection caused by imperfect $\textrm{BS}_{3}$ and $\textrm{BS}_{4}$, the total variances of measured signal are
In this situation, the variance of LO fluctuation is mistakenly treated as a part of vacuum fluctuation, which leads to an error in calibrating $\delta _{X(P)}$, and the corresponding measurement resolutions are $\delta _{\textrm{without,X(P)}}=k\sigma _{\textrm{without,X(P)}}/2^{n-1}$.
Taking into account the influence of LO fluctuation, the measured variances in vacuum units can be corrected as
Detailedly, the effects of practical imperfections on the security of POVM-based protocol with and without considering the influence of LO fluctuations are numerically simulated. For the convenience of analysis, we assume that the four PDs in the heterodyne detector have the same efficiency, $\eta _{1}=\eta _{2}=\eta _{3}=\eta _{4}=1$. The electronic noise follows Gaussian distribution and its variance is assumed to be a constant, $\sigma ^{2}_{E,X(P)}=c_{X(P)}=0.1$. Suppose that the LO power is $P_{LO}=1$, and the initial variance of vacuum fluctuation is $D(\delta X_{QV}(t))=D(\delta P_{QV}(t))=0.5$, the sampling range $N$ of ADC is set to 3 standard deviation confidence intervals, i.e., $k=3$, and the sampling resolution $n$ of ADC is $n=8$. Hence, the parameters of $m_{1,X(P)}$ and $m_{2,X(P)}$ can be expressed as $m_{1,X(P)}=4(\frac {1}{2}-\Delta )(\frac {1}{2}+\Delta )$ and $m_{2,X(P)}=4l\Delta ^{2}$ based on Eq. (8) and Eq. (9). For the POVM-based protocol, the following numerical simulations are performed with such assumptions.
We investigate the impacts of the imbalance degree related to the parameter $\Delta$ and the LO fluctuation magnitude related to the parameter $l$ on the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$. Figure 2 shows the simulation results for $H_{\min }(M_{\delta }|\varepsilon )$ as a function of the imbalance $\Delta$ under different initial variances of LO fluctuation, where $\Delta$ is increased from $-0.45$ to 0.45 with a step of 0.05. The dashed line is the result of $H_{\min }(M_{\delta }|\varepsilon )$ without considering LO fluctuation and the solid line is the result of $H_{\min }(M_{\delta }|\varepsilon )$ considering LO fluctuation. As shown in Fig. 2, the calculated $H_{\min }(M_{\delta }|\varepsilon )$ without considering the influence of LO fluctuation are smaller than that of considering LO fluctuation under imbalanced heterodyne detection, which indicates that the extractable randomness will be overestimated if not considering LO fluctuation. Moreover, the difference between $H_{\min }(M_{\delta }|\varepsilon )$ with and without considering LO fluctuation increases with $\Delta$. The greater the degree of imbalance, the greater the number of overestimated random bits and the greater the impact on the practical security of CV-SI-QRNG. For different values of coefficient $l$, the relationships between $\Delta$ and $H_{\min }(M_{\delta }|\varepsilon )$ without considering LO fluctuation are different. It indicates that the initial variances of LO fluctuation will affect the $H_{\min }(M_{\delta }|\varepsilon )$ if not considering LO fluctuation.
Fig. 2. Simulation results for the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ vs the imbalance $\Delta$ in the POVM-based protocol. The coefficient $l$, which indicates the magnitude of initial variances of LO fluctuation, are 0.5, 1, and 1.5, from top to bottom.
To further analyze the influence of LO fluctuation on $H_{\min }(M_{\delta }|\varepsilon )$, the relationship between $H_{\min }(M_{\delta }|\varepsilon )$ and $l$ is simulated with $\Delta =0.3$, as shown in Fig. 3, where $l$ is increased from $0$ to 5 with a step of 0.5. The red line represents the result of $H_{\min }(M_{\delta }|\varepsilon )$ without considering LO fluctuation and the black line represents the result of $H_{\min }(M_{\delta }|\varepsilon )$ considering LO fluctuation. It is obvious to notice that $H_{\min }(M_{\delta }|\varepsilon )$ considering LO fluctuation decreases with the coefficient $l$ increases, while the opposite results of $H_{\min }(M_{\delta }|\varepsilon )$ without considering LO fluctuation. Since the LO fluctuation is treated as a part of vacuum fluctuation, the effect of excess noise introduced by LO fluctuation on the evaluation of extractable randomness is ignored. Besides, the difference between $H_{\min }(M_{\delta }|\varepsilon )$ calculated with and without considering LO fluctuation increases with the coefficient $l$, which reveals the larger the LO fluctuation, the greater the impact on the evaluation of extractable randomness and the security of CV-SI-QRNG.
Fig. 3. Simulation results for the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ vs the coefficient $l$ in the POVM-based protocol, where the coefficient $l$ indicates the magnitude of initial variances of LO fluctuation.
3.2 CV-SI-QRNG protocol based on EUP
Different from the POVM-based protocol, the EUP-based protocol does not require a calibration process before running the experiment, but rather a check measurement to evaluate the amount of extractable randomness during the experiment. Check measurement is divided into three measurement steps. The first step is to block the LO and untrusted source beams to record the electronic noise. Then the untrusted source beam is blocked and the LO is unblocked, which allows us to record the vacuum shot noise. In the final step, the untrusted source and the LO beams are unblocked, and the check data are recorded. From the recorded data in the above three steps, we can obtain the variance $\sigma _{1}^{2}$, $\sigma _{2}^{2}$ and $\sigma _{3}^{2}$, respectively. In this way, the variance of vacuum fluctuation is $\sigma _{QV,X(P)}^{2}=\sigma _{2}^{2}-\sigma _{1}^{2}$ in the balanced heterodyne detection. And the measurement resolution in vacuum units can be obtained with [46]
For the CV-SI-QRNG protocol based on EUP, the total amount of extractable randomness is given by [33,37]
Under imbalanced heterodyne detection, the LO fluctuation will contribute to the excess noise and affects the calculated conditional min-entropy $H_{\min }(M_{\delta }|\varepsilon )$. In the second step of the check measurement, the variance $\sigma _{2}^{2}$ contains the contributions of LO fluctuation, vacuum fluctuation and electronic noise, which satisfies $\sigma _{2}^{2}=\sigma _{LO,X(P)}^{2}+\sigma _{QV,X(P)}^{2}+\sigma _{E,X(P)}^{2}$. Without considering LO fluctuation, the variance of vacuum fluctuation cannot be accurately estimated by $\sigma _{2}^{2}-\sigma _{1}^{2}$, because the variance of LO fluctuation is mistakenly treated as a part of vacuum fluctuation. In this case, the measurement resolution in vacuum units is misestimated by $\delta _{\textrm{without,X(P)}}=\frac {\delta _{ADC}}{\sqrt {2(\sigma _{QV,X(P)}^{2}+\sigma _{LO,X(P)}^{2})}}$. To simplify, we assume that $\eta _{1}=\eta _{2}=\eta _{3}=\eta _{4}=1$, $P_{LO}=1$, $D(\delta X_{QV}(t))=0.5$, $D(\delta P_{QN}(t))=0.25$, $\sigma ^{2}_{E,X(P)}=0.1$, $n=8$ and $N=3\sigma _{t,X(P)}$. Simulation results of $H_{\min }(M_{\delta }|\varepsilon )$ as a function of the imbalances $\Delta$ for different initial variances of LO fluctuation are shown in Fig. 4, where the imbalance $\Delta$ is increased from $-0.45$ to 0.45 with a step of 0.05.
Fig. 4. Simulation results for the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ vs the imbalance $\Delta$ in the EUP-based protocol. The coefficient $l$, which indicates the magnitude of initial variances of LO fluctuation, are 0.5, 1, and 1.5, from top to bottom. The dashed line is the result of $H_{\min }(M_{\delta }|\varepsilon )$ without considering LO fluctuation. The solid line is the result of $H_{\min }(M_{\delta }|\varepsilon )$ considering LO fluctuation.
Similar to the results of the POVM-based protocol, the excess noise introduced by LO fluctuation leads to a reduction in the number of extractable random bits. The value of $H_{\min }(M_{\delta }|\varepsilon )$ would be overestimated without considering LO fluctuation in the EUP-based protocol. As shown in Fig. 4, the $H_{\min }(M_{\delta }|\varepsilon )$ calculated considering LO fluctuation decreases with the increase of imbalance $\Delta$. Moreover, the differences of $H_{\min }(M_{\delta }|\varepsilon )$ calculated with considering LO fluctuation and without considering LO fluctuation increase with $\Delta$ and $l$, which indicates the more imbalanced the heterodyne detection and the larger the LO fluctuation, the greater the influence of LO fluctuation on $H_{\min }(M_{\delta }|\varepsilon )$. Compared to the results of the POVM-based protocol, the EUP-based protocol achieves less calculated extractable randomness. In addition, the number of overestimated random bits of the EUP-based protocol is greater than that of the POVM-based protocol, which reveals that the EUP-based protocol will be more affected by the LO fluctuation under imbalanced heterodyne detection.
Therefore, the LO fluctuation under imbalanced heterodyne detection will lead to a reduction in the extractable randomness for POVM-based and EUP-based protocols. Without considering LO fluctuation under imbalanced detection, the extractable randomness would be overestimated. To improve the practical security of heterodyne-based CV-SI-QRNG, methods such as monitoring the intensity of LO and choosing a more symmetric heterodyne detector can be applied.
4. Impacts of imperfect PM
In the heterodyne-based CV-SI-QRNG, the differential phase between the quantum signal and LO is $\pi /2$ to measure the $P$ quadrature. As shown in Fig. 1, the lower arm measures $P$ quadrature by modulating the PM to $\pi /2$. However, the modulation phase will deviate from ideal value and the actual shifting phase is $\phi =\frac {\pi }{2}-\theta$ due to the imperfection of PM, which leads to the non-ideal $P$ quadrature measurements. In this case, the practical heterodyne detection cannot perform the ideal measurement to obtain the $P$ quadrature in phase space and would affect the evaluation of extractable randomness. In this section, we investigate the impacts of imperfect PM on extractable randomness in the case of balanced heterodyne detection and imbalanced heterodyne detection.
4.1 Balanced heterodyne detection
In the case of balanced heterodyne detection, the splitting ratio of BS and the detection efficiency of PD are ideal, i.e., $\Delta =0$ and $\eta _{1}=\eta _{2}=\eta _{3}=\eta _{4}=1$. The differential output on the upper arm $v_{1}(t)$ is unchanged, but the differential output on the lower arm is changed due to the non-ideal measurement of $P$ quadrature and can be rewritten as
the variance of measured quantum noise is expressed asFor the CV-SI-QRNG protocol based on EUP, the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ is determined by the conditional max-entropy of quadratures $X$ and $P$, and the overlap of the discretized $X$ and $P$ measurements. The conditional max-entropy of quadratures $X$ and $P$ can be correctly estimated by the outcomes of the $X$ and $P$ measurements, which are not affected by LO fluctuation. On the contrary, the overlap of the discretized $X$ and $P$ measurements $c(\delta _{X},\delta _{P})$ would be affected by the imperfection of PM. If the actual measurement $P$ deviates by a phase $\theta$ from the ideal case, the $X$ and $P$ satisfy the canonical commutation relation $[X,P]=i\hbar \cos \theta$ in practice [49], which results in the overlap
Therefore, the imperfect PM will lead to an overestimation of calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$, and the overestimated extractable randomness is
The simulation results of the overestimated extractable randomness $R(M_{\delta }|\varepsilon )$ with deviation angle $\theta$ in the EUP-based protocol are shown in Fig. 5. The overestimated extractable randomness $R(M_{\delta }|\varepsilon )$ increases with deviation angle $\theta$. When the actual measurement $P$ deviates by $\frac {\pi }{4}$, the number of extractable random bits is overestimated by 1 bit. Hence, the imperfect PM would lead to an overestimation of calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ in the EUP-based protocol. It is important to consider the influence of imperfect PM on the security of QRNG system.
Fig. 5. Simulation results for the overestimated extractable randomness $R(M_{\delta }|\varepsilon )$ vs deviation angle $\theta$ in the EUP-based protocol.
4.2 Imbalanced heterodyne detection
Under imbalanced heterodyne detection, we further investigate the impacts of imperfect PM on extractable randomness. In this case, the calculated extractable randomness $H_{\min }(M_{\delta }|\varepsilon )$ is also affected by LO fluctuation. The imperfect PM results in the non-ideal measurement of $P$ quadrature and the corresponding measured quantum noise variance can be expressed as
Based on previous analysis, the imperfect PM and imbalanced heterodyne detection both lead to an overestimation of calculated extractable randomness. The overestimated number of extractable random bits can be calculated with
Fig. 6. Simulation results for the overestimated extractable randomness $R(M_{\delta }|\varepsilon )$ vs deviation angle $\theta$ and imbalance $\Delta$ in the EUP-based protocol.
5. Conclusion and discussion
This paper has analyzed the influences of the imperfect physical implementations on the evaluation of extractable randomness in the CV-SI-QRNG based on heterodyne detection, including the LO fluctuation under imbalanced heterodyne detection and the imperfect PM. The influences of LO fluctuation on the POVM-based and EUP-based protocols in the case of imbalanced heterodyne detection are analyzed, where the imbalance comes not only from the non-ideal splitting ratio of the BS but also from the PDs with different detection efficiency. By modifying the formula for the calibration of measurement resolution of the POVM-based protocol, the extractable randomness could be calculated in the presence of LO fluctuation under imbalanced heterodyne detection. Simultaneously, the simulation results show that LO fluctuation under imbalanced heterodyne detection leads to a reduction in the number of extractable random bits for the POVM-based and EUP-based protocols. As the degree of imbalance and the magnitude of LO fluctuation, the number of random bits that can be extracted decreases. Without considering LO fluctuation, the calculated extractable randomness will be overestimated, which compromises the practical security of CV-SI-QRNG. Furthermore, the overestimated number of extractable random bits increases with the degree of imbalance and the magnitude of LO fluctuation. Thus, choosing a heterodyne detection with more symmetric devices and LO with smaller fluctuation can help to resist the influence of LO fluctuation. The imperfect PM leads to the non-ideal $P$ quadrature measurements, which results in an overestimation of the number of random bits. And the number of overestimated random bits increases with the deviation angle. Besides, the simulation results reveal that imperfect BS has a greater impact on the security of CV-SI-QRNG than imperfect PM.
While the practical implementations are always imperfect, the CV-SI-QRNG protocol could tolerate some imperfections of devices and its practical security can be improved by utilizing corresponding countermeasures. With balanced heterodyne detection, the practical security of CV-SI-QRNG would not be affected by the LO fluctuation. Moreover, our simulation results show that the EUP-based protocol will be more vulnerable to LO fluctuation under imbalanced heterodyne detection than the POVM-based protocol. In other words, the POVM-based protocol is more tolerant of imperfections in BS, PD and LO. Moreover, in the calibration process of POVM-based protocol, the characterization of the measurement apparatus allows the actual POVM operators to be defined, and the calculated extractable randomness could be modified accordingly [36]. Thus, the POVM-based protocol could tolerate imperfections in PM. Additionally, we can utilize some countermeasures to improve the practical security of CV-SI-QRNG. By adding a power meter, we can monitor the LO fluctuation and characterize the variance of LO fluctuation to correct the extractable ranodmness. The heterodyne detector can be rebalanced by adding a variable optical attenuator. What’s more, the reference technique [50–52], which is a parameter estimation technique, could also be used to deal with the imperfections in devices to improve the practical security of CV-SI-QRNG. Overall, our analysis reveals the importance of considering the influences of imperfections in the actual implementations and performing corresponding countermeasures on the practical security of CV-SI-QRNG.
Funding
National Natural Science Foundation of China (61901525, 61972413, 62002385); National Key Research and Development Program of China (2021YFB3100100).
Disclosures
The authors declare that there are no conflicts of interest related to this article.
Data availability
No data were generated or analyzed in the presented research.
References
1. X. Ma, X. Yuan, Z. Cao, B. Qi, and Z. Zhang, “Quantum random number generation,” npj Quantum Inf. 2(1), 16021–16029 (2016). [CrossRef]
2. M. N. Bera, A. Acín, M. Kuś, M. W. Mitchell, and M. Lewenstein, “Randomness in quantum mechanics: philosophy, physics and technology,” Rep. Prog. Phys. 80(12), 124001 (2017). [CrossRef]
3. H.-Q. Ma, Y. Xie, and L.-A. Wu, “Random number generation based on the time of arrival of single photons,” Appl. Opt. 44(36), 7760–7763 (2005). [CrossRef]
4. J. F. Dynes, Z. L. Yuan, A. W. Sharpe, and A. J. Shields, “A high speed, postprocessing free, quantum random number generator,” Appl. Phys. Lett. 93(3), 031109 (2008). [CrossRef]
5. Y.-Q. Nie, H.-F. Zhang, Z. Zhang, J. Wang, X. Ma, J. Zhang, and J.-W. Pan, “Practical and fast quantum random number generation based on photon arrival time relative to external reference,” Appl. Phys. Lett. 104(5), 051110 (2014). [CrossRef]
6. H. Fürst, H. Weier, S. Nauerth, D. G. Marangon, C. Kurtsiefer, and H. Weinfurter, “High speed optical quantum random number generation,” Opt. Express 18(12), 13029–13037 (2010). [CrossRef]
7. M. Ren, E. Wu, Y. Liang, Y. Jian, G. Wu, and H. Zeng, “Quantum random-number generator based on a photon-number-resolving detector,” Phys. Rev. A 83(2), 023820 (2011). [CrossRef]
8. A. Stefanov, N. Gisin, O. Guinnard, L. Guinnard, and H. Zbinden, “Optical quantum random number generator,” J. Mod. Opt. 47, 595–598 (2000). [CrossRef]
9. B. Qi, Y.-M. Chi, H.-K. Lo, and L. Qian, “High-speed quantum random number generation by measuring phase noise of a single-mode laser,” Opt. Lett. 35(3), 312–314 (2010). [CrossRef]
10. C. Abellán, W. Amaya, M. Jofre, M. Curty, A. Acín, J. Capmany, V. Pruneri, and M. Mitchell, “Ultra-fast quantum randomness generation by accelerated phase diffusion in a pulsed laser diode,” Opt. Express 22(2), 1645–1654 (2014). [CrossRef]
11. J. Liu, J. Yang, Z. Li, Q. Su, W. Huang, B. Xu, and H. Guo, “117 gbits/s quantum random number generation with simple structure,” IEEE Photonics Technol. Lett. 29(3), 283–286 (2017). [CrossRef]
12. Y.-Q. Nie, L. Huang, Y. Liu, F. Payne, J. Zhang, and J.-W. Pan, “The generation of 68 gbps quantum random number by measuring laser phase fluctuations,” Rev. Sci. Instrum. 86(6), 063105 (2015). [CrossRef]
13. F. Xu, B. Qi, X. Ma, H. Xu, H. Zheng, and H.-K. Lo, “Ultrafast quantum random number generation based on quantum phase fluctuations,” Opt. Express 20(11), 12366–12377 (2012). [CrossRef]
14. F. Raffaelli, P. Sibson, J. E. Kennard, D. H. Mahler, M. G. Thompson, and J. C. F. Matthews, “Generation of random numbers by measuring phase fluctuations from a laser diode with a silicon-on-insulator chip,” Opt. Express 26(16), 19730–19741 (2018). [CrossRef]
15. C. R. Williams, J. C. Salevan, X. Li, R. Roy, and T. E. Murphy, “Fast physical random number generator using amplified spontaneous emission,” Opt. Express 18(23), 23584–23597 (2010). [CrossRef]
16. X. Li, A. B. Cohen, T. E. Murphy, and R. Roy, “Scalable parallel physical random number generator based on a superluminescent led,” Opt. Lett. 36(6), 1020–1022 (2011). [CrossRef]
17. W. Wei, G. Xie, A. Dang, and H. Guo, “High-speed and bias-free optical random number generator,” IEEE Photonics Technol. Lett. 24(6), 437–439 (2011). [CrossRef]
18. Y. Li, Y. Fei, W. Wang, X. Meng, H. Wang, Q. Duan, and Z. Ma, “Analysis of the effects of temperature increase on quantum random number generator,” Eur. Phys. J. D 75(2), 69–79 (2021). [CrossRef]
19. Y. Li, Y. Fei, W. Wang, X. Meng, H. Wang, Q. Duan, and Z. Ma, “Experimental study on the security of superluminescent led-based quantum random generator,” Opt. Eng. 60(11), 116106 (2021). [CrossRef]
20. Y. Guo, Q. Cai, P. Li, Z. Jia, B. Xu, Q. Zhang, Y. Zhang, R. Zhang, Z. Gao, K. A. Shore, and Y. Wang, “40 Gb/s quantum random number generation based on optically sampled amplified spontaneous emission,” APL Photonics 6(6), 066105 (2021). [CrossRef]
21. C. Gabriel, C. Wittmann, D. Sych, R. Dong, W. Mauerer, U. L. Andersen, C. Marquardt, and G. Leuchs, “A generator for unique quantum random numbers based on vacuum states,” Nat. Photonics 4(10), 711–715 (2010). [CrossRef]
22. Y. Shen, L. Tian, and H. Zou, “Practical quantum random number generator based on measuring the shot noise of vacuum states,” Phys. Rev. A 81(6), 063814 (2010). [CrossRef]
23. Z. Zheng, Y. Zhang, W. Huang, S. Yu, and H. Guo, “6 gbps real-time optical quantum random number generator based on vacuum fluctuation,” Rev. Sci. Instrum. 90(4), 043105 (2019). [CrossRef]
24. C. Bruynsteen, T. Gehring, C. Lupo, J. Bauwelinck, and X. Yin, “100-gbit/s integrated quantum random number generator based on vacuum fluctuations,” PRX Quantum 4(1), 010330 (2023). [CrossRef]
25. S. Pironio, A. Acín, S. Massar, A. B. de La Giroday, D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. Manning, and C. Monroe, “Random numbers certified by bell’s theorem,” Nature 464(7291), 1021–1024 (2010). [CrossRef]
26. Y. Liu, X. Yuan, M.-H. Li, et al., “High-speed device-independent quantum random number generation without a detection loophole,” Phys. Rev. Lett. 120(1), 010503 (2018). [CrossRef]
27. W.-Z. Liu, M.-H. Li, S. Ragy, S.-R. Zhao, B. Bai, Y. Liu, P. J. Brown, J. Zhang, R. Colbeck, J. Fan, Q. Zhang, and J.-W. Pan, “Device-independent randomness expansion against quantum side information,” Nat. Phys. 17(4), 448–451 (2021). [CrossRef]
28. T. Lunghi, J. B. Brask, C. C. W. Lim, Q. Lavigne, J. Bowles, A. Martin, H. Zbinden, and N. Brunner, “Self-testing quantum random number generator,” Phys. Rev. Lett. 114(15), 150501 (2015). [CrossRef]
29. P. Mironowicz, G. Ca nas, J. Cari ne, E. S. Gómez, J. F. Barra, A. Cabello, G. B. Xavier, G. Lima, and M. Pawłowski, “Quantum randomness protected against detection loophole attacks,” Quantum Inf. Process. 20(1), 39 (2021). [CrossRef]
30. Y.-Q. Nie, J.-Y. Guan, H. Zhou, Q. Zhang, X. Ma, J. Zhang, and J.-W. Pan, “Experimental measurement-device-independent quantum random-number generation,” Phys. Rev. A 94(6), 060301 (2016). [CrossRef]
31. Z. Cao, H. Zhou, and X. Ma, “Loss-tolerant measurement-device-independent quantum random number generation,” New J. Phys. 17(12), 125011 (2015). [CrossRef]
32. Z. Cao, H. Zhou, X. Yuan, and X. Ma, “Source-independent quantum random number generation,” Phys. Rev. X 6, 011020 (2016). [CrossRef]
33. D. G. Marangon, G. Vallone, and P. Villoresi, “Source-device-independent ultrafast quantum random number generation,” Phys. Rev. Lett. 118(6), 060503 (2017). [CrossRef]
34. T. Michel, J. Y. Haw, D. G. Marangon, O. Thearle, G. Vallone, P. Villoresi, P. K. Lam, and S. M. Assad, “Real-time source-independent quantum random-number generator with squeezed states,” Phys. Rev. Appl. 12(3), 034017 (2019). [CrossRef]
35. B. Xu, Z. Chen, Z. Li, J. Yang, Q. Su, W. Huang, Y. Zhang, and H. Guo, “High speed continuous variable source-independent quantum random number generation,” Quantum Sci. Technol. 4(2), 025013 (2019). [CrossRef]
36. M. Avesani, D. G. Marangon, G. Vallone, and P. Villoresi, “Source-device-independent heterodyne-based quantum random number generator at 17 gbps,” Nat. Commun. 9(1), 5365 (2018). [CrossRef]
37. J. Cheng, J. Qin, S. Liang, J. Li, Z. Yan, X. Jia, and K. Peng, “Mutually testing source-device-independent quantum random number generator,” Photonics Res. 10(3), 646–652 (2022). [CrossRef]
38. W.-B. Liu, Y.-S. Lu, Y. Fu, S.-C. Huang, Z.-J. Yin, K. Jiang, H.-L. Yin, and Z.-B. Chen, “Source-independent quantum random number generator against tailored detector blinding attacks,” Opt. Express 31(7), 11292–11307 (2023). [CrossRef]
39. X. Lin, R. Wang, S. Wang, Z.-Q. Yin, W. Chen, G.-C. Guo, and Z.-F. Han, “Certified randomness from untrusted sources and uncharacterized measurements,” Phys. Rev. Lett. 129(5), 050506 (2022). [CrossRef]
40. G. Vallone, D. G. Marangon, M. Tomasin, and P. Villoresi, “Quantum randomness certified by the uncertainty principle,” Phys. Rev. A 90(5), 052327 (2014). [CrossRef]
41. Z.-P. Liu, M.-G. Zhou, W.-B. Liu, C.-L. Li, J. Gu, H.-L. Yin, and Z.-B. Chen, “Automated machine learning for secure key rate in discrete-modulated continuous-variable quantum key distribution,” Opt. Express 30(9), 15024–15036 (2022). [CrossRef]
42. T. Matsuura, K. Maeda, T. Sasaki, and M. Koashi, “Finite-size security of continuous-variable quantum key distribution with digital signal processing,” Nat. Commun. 12(1), 252 (2021). [CrossRef]
43. W.-B. Liu, C.-L. Li, Y.-M. Xie, C.-X. Weng, J. Gu, X.-Y. Cao, Y.-S. Lu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, “Homodyne detection quadrature phase shift keying continuous-variable quantum key distribution with high excess noise tolerance,” PRX Quantum 2(4), 040334 (2021). [CrossRef]
44. H. Zhou, Z. Zheng, L. Huang, X. Wang, Z. Chen, and S. Yu, “Eavesdropping attack on a continuous-variable source-independent quantum random number generator with fluctuating local oscillator,” J. Phys. B: At., Mol. Opt. Phys. 55(6), 065502 (2022). [CrossRef]
45. W. Huang, Y. Zhang, Z. Zheng, Y. Li, B. Xu, and S. Yu, “Practical security analysis of a continuous-variable quantum random-number generator with a noisy local oscillator,” Phys. Rev. A 102(1), 012422 (2020). [CrossRef]
46. P. R. Smith, D. G. Marangon, M. Lucamarini, Z. L. Yuan, and A. J. Shields, “Simple source device-independent continuous-variable quantum random number generator,” Phys. Rev. A 99(6), 062326 (2019). [CrossRef]
47. H. J. Landau and H. O. Pollak, “Prolate spheroidal wave functions, fourier analysis and uncertainty − II,” The Bell Syst. Tech. J. 40(1), 65–84 (1961). [CrossRef]
48. F. Furrer, M. Berta, M. Tomamichel, V. B. Scholz, and M. Christandl, “Position-momentum uncertainty relations in the presence of quantum memory,” J. Math. Phys. 55(12), 122205 (2014). [CrossRef]
49. T. Gehring, V. Händchen, J. Duhme, F. Furrer, T. Franz, C. Pacher, R. F. Werner, and R. Schnabel, “Implementation of continuous-variable quantum key distribution with composable and one-sided-device-independent security against coherent attacks,” Nat. Commun. 6(1), 8795 (2015). [CrossRef]
50. J. Gu, X.-Y. Cao, Y. Fu, Z.-W. He, Z.-J. Yin, H.-L. Yin, and Z.-B. Chen, “Experimental measurement-device-independent type quantum key distribution with flawed and correlated sources,” Sci. Bull. 67(21), 2167–2175 (2022). [CrossRef]
51. M. Pereira, G. Kato, A. Mizutani, M. Curty, and K. Tamaki, “Quantum key distribution with correlated sources,” Sci. Adv. 6(37), eaaz4487 (2020). [CrossRef]
52. M. Pereira, M. Curty, and K. Tamaki, “Quantum key distribution with flawed and leaky sources,” npj Quantum Inf. 5(1), 62 (2019). [CrossRef]
