A QUANTUM RANDOM NUMBER GENERATOR

Abstract

A quantum random number generator includes an entropy source having a laser source, a single photodiode configured for generating photo current based on received light from the laser source, where the photodiode has a non-unity quantum efficiency for allowing interference of the light from the laser source with a vacuum state to obtain entropy from the vacuum state, a transimpedance amplifier to convert the photo current into voltage, an analog-to-digital converter for converting the analog voltage to a digital output, a security proof which establishes a lower bound on the entropy from the vacuum state, and a processing unit configured to convert the digital output from the analog-to-digital converter to random numbers based on the security proof.

Claims

1-19. (canceled)

20. A quantum random number generator comprising: an entropy source comprising a radiation source, such as a laser source; a single photodiode configured for generating photo current based on received light from the radiation source, where the photodiode has a non-unity quantum efficiency for allowing interference of the radiation from the radiation source with a vacuum state to obtain entropy from the vacuum state; a transimpedance amplifier to convert the photo current into voltage; an analog-to-digital converter for converting the analog voltage to a digital output; and a processing unit; wherein the quantum random number generator is configured for applying a security proof for establishing a lower bound on the entropy from the vacuum state, and wherein the processing unit is configured for converting the digital output from the analog-to-digital converter to random numbers based on the security proof.

21. The quantum random number generator according to claim 20, wherein the lower bound on the entropy is determined by or only determined by any one or all of the quantum efficiency of the photodiode; power of the radiation source; and resolution of the analog-to-digital converter.

22. The quantum random number generator according to claim 20, wherein the vacuum states used as randomness source interfere with the radiation from the radiation source at the photodiode due to the non-unity quantum efficiency of the photodiode.

23. The quantum random number generator according to claim 20, wherein the only vacuum states used as randomness source interfere with the radiation from the radiation source at the photodiode due to the non-unity quantum efficiency of the photodiode.

24. The quantum random number generator according to claim 20, wherein the radiation source is a Fabry-Perot diode laser, a distributed feedback laser, a distributed Bragg reflector laser, a vertical cavity surface-emitting laser, coherent microwave source, or an incoherent radiation source, such as an LED lamp, a fluorescent lamp, an incandescent lamp like e.g. a halogen lamp, an arc lamp, a gas-discharge lamp, or a microwave source.

25. The quantum random number generator according to claim 20, wherein the single photodiode is an Indium Gallium Arsenide diode, a Silicon diode or a Germanium diode.

26. The quantum random number generator according to claim 20, wherein the single photodiode has a quantum efficiency at the wavelength or band of wavelengths of the received light from the laser source, where the quantum efficiency is less than 90%.

27. The quantum random number generator according to claim 20, wherein the single photodiode has a quantum efficiency at the wavelength or band of wavelengths of the received light from the laser source, where the quantum efficiency is more than 10%.

28. The quantum random number generator according to claim 20, wherein the processing unit is configured to convert the digital output from the analog-to-digital converter to random numbers using a randomness extraction algorithm.

29. The quantum random number generator according to claim 28, wherein the randomness extraction algorithm is based on hash functions.

30. The quantum random number generator according to claim 20, wherein the radiation source and/or the photodiode, is/are integrated on a photonic integrated circuit (PIC).

31. The quantum random number generator according to claim 20, wherein the quantum random number generator is integrated on an integrated circuit (IC).

32. The quantum random number generator according to claim 31, wherein the IC comprises the PIC.

33. The quantum random number generator according to claim 20, wherein the quantum random number generator comprises a waveguide for guiding the light from the radiation source to the photodiode.

34. The quantum random number generator according to claim 20, wherein the quantum random number generator comprises a beam splitter with a non-unity reflectivity positioned between the radiation source and the single photodiode.

35. The quantum random number generator according to claim 34, wherein the quantum random number generator is modified in that the quantum efficiency of the photodiode is unity.

36. The quantum random number generator according to claim 34, wherein the lower bound on the entropy is determined by or only determined by any one or all of: reflectivity of the beam splitter, power of the radiation source, and resolution of the analog-to-digital converter or reflectivity of the beam splitter, the quantum efficiency of the photodiode, power of the radiation source, and resolution of the analog-to-digital converter.

37. The quantum random number generator according to claim 34, wherein the vacuum states as randomness source interfere with the radiation from the radiation source at the beam splitter due to the non-unity reflectivity of the beam splitter.

38. The quantum random number generator according to claim 34, wherein the vacuum states as randomness source interfere with the radiation from the radiation source at the single photodiode due to the non-unity quantum efficiency of the photodiode and at the beam splitter due to the non-unity reflectivity of the beam splitter.

Description

DESCRIPTION OF THE DRAWINGS

[0075] The invention will in the following be described in greater detail with reference to the accompanying drawings:

[0076] FIG. 1a a schematic view of the set-up for generating random numbers;

[0077] FIG. 1b another schematic view of the set-up with a beam splitter for generating random numbers;

[0078] FIG. 2 a flow-chart for the random number generation and extraction;

[0079] FIG. 3 a schematic view of the power spectral density of the signal;

[0080] FIG. 4a a graph plotting H.sub.min, versus R with constant η; and

[0081] FIG. 4b a graph plotting H.sub.min, versus η for different R.

DETAILED DESCRIPTION OF THE INVENTION

[0082] FIG. 1a shows a schematic view of the set-up. The set-up comprises a photodiode 110 receiving radiation like light or laser light from a radiation source like e.g. a laser or an incoherent radiation source 115. A signal generated by the photodiode is amplified by an amplifier 120 and is sent to an analog-to-digital converter (ADC) 125 so that the analog signal from the amplifier is converted to a digital signal. The amplifier amplifies the signal so that the analog signal optimally covers the range of the ADC so that the entropy from the vacuum state in the digital signal from the ADC has the highest possible amount.

[0083] Since the signal from the ADC not only comprises the desired vacuum fluctuations but also deterministic noise, which cannot be used in this context, a randomness extractor 130 has to turn the digital signal from the ADC 125 into a signal whose entropy is solely determined by the vacuum fluctuations.

[0084] FIG. 1b has in addition to the set-up shown in FIG. 1a a beam splitter 135 positioned between the radiation source 115 and the photodiode 110. With the beam splitter 135, the vacuum states can enter the system via the beam splitter 135 instead of or in addition to the photodiode 110.

[0085] In FIG. 1b radiation source 115 emits quantum states of radiation, which impinge on a beam splitter 135. No radiation—corresponding to the quantum mechanical vacuum state—enters the other input port of the beam splitter. At one output of the beam splitter, the radiation intensity is then measured with a photodiode 110, while the other output is ignored. In the security analysis the beam splitter (and in particular the splitting ratio) is trusted, as well as the detector. Trusted thereby means that the physical properties can be characterized beforehand and do not change during random number generation. The radiation source, however, is not trusted, and randomness can be guaranteed even against attackers which have some control over the radiation source. So an untrusted radiation source, the radiation source 115, emits quantum states which are mixed with trusted vacuum on the beam splitter 135, for which an upper bound on the transmittivity is known. The intensity of transmitted radiation is measured by the photodetector 110, providing the raw data for randomness extraction.

[0086] Random numbers are generated by post-processing the detection outcomes from the ADC 125, based on a lower bound on the entropy present in the raw data. Such a bound can be obtained by observing the mean intensity over several experimental rounds. The idea is as follows. From the perspective of an attacker, when the transmittivity of the beam splitter is not perfect, the only way to ensure a definitive, perfectly predictable outcome of the intensity measurement in a given round is to input no radiation at all. Any non-zero amount of input radiation will lead to randomness in the number of photons after the beam splitter—and hence in the intensity measurement—because each input photon will be probabilistically transmitted or reflected. However, if in every round no radiation is input, the average observed intensity will be zero. Hence, if one conditions on observing a non-zero average intensity over multiple rounds, such an attack is ruled out. A non-zero average intensity implies a non-zero amount of input radiation and hence a non-zero amount of randomness. The amount of randomness can be quantified based on the observations.

[0087] It is noted that mixing with the vacuum is crucial for the security of this scheme. If the transmittivity of the beam splitter is unity, by controlling the radiation source an attacker can perfectly predict the outcomes of the measurements and hence no randomness can be extracted.

[0088] FIG. 1a illustrates a possible implementation of the QRNG in practice. As we have seen, in this setup, radiation from the radiation source 115 irradiates the single photodetector or photodiode 110 with limited quantum efficiency without a beam splitter in between and the output is recorded. The radiation source is untrusted while the photodiode—and in particular an upper bound on the efficiency of the photodiode—is trusted. A limited-efficiency photodiode can be understood as a perfectly efficient photo detector preceded by a beam splitter with transmittivity equal to the efficiency of the photo diode. Hence, this setup maps exactly to the conceptual scheme above, provided that an upper bound on the detection efficiency is known.

[0089] In contrast to other schemes based on amplitude quadrature measurements of vacuum fluctuations in the scheme, the radiation source does not have to be trusted to emit certain states. The randomness rather solely stems from the vacuum state entering through the beam splitter, respectively through the non-unity quantum efficiency of the photodiode. This has not only practical but also security advantages as it is experimentally impossible to prove with a single quadrature measurement (as obtained by a single photodiode) which quantum states are emitted by a source.

[0090] The flow-chart in FIG. 2 shows the procedure to generate entropy solely from the vacuum states or vacuum fluctuations so that a list of random numbers can be generated.

[0091] A radiation source 200, which can be a laser or an incoherent radiation source emits radiation or light that reaches a photodiode 205 with a quantum efficiency less than 100%.

[0092] The signal from the photodiode is amplified by an amplifier 210 to cover the whole range of an input of an analog-to-digital converter (ADC) 215, where the signal is made discrete, so that the entropy from the vacuum state of the discrete digital signal from the ADC is as high as possible.

[0093] The Power Spectral Density (PSD) of the signal that comes out of the ADC comprises contributions from the optical signal, from excess noise and from vacuum fluctuations as shown in FIG. 3.

[0094] The amount of quantum randomness that can be extracted from the measurement of vacuum fluctuations has an upper limit as given in part I “Setting the Stage” of the Article.

[0095] To be able to extract that part of the signal that is purely random, which is the vacuum fluctuations, the signal has to be analysed, using the steps Verification of assumption 220, Determination of parameters 225, Calculate Min-Entropy 230 and finally Randomness Extraction 235.

[0096] In the step Verification of assumption 220, it has to be shown that the extracted part fulfils some assumptions.

[0097] These assumptions are that the noise has a Gaussian distribution, that the amount of phase noise has an upper limit, which can be determined by the measurement of power of the radiation source, that, if there is a beam splitter in the set-up in FIG. 1, so that the radiation like e.g. light or laser light is split in a first and a second trajectories, where the first trajectory has the photo diode, the second trajectory cannot be accessed by an adversary, which means that the beam splitter is positioned in a hermetically sealed device or something similar, and that the beam splitter ratio/quantum efficiency of the photodiode has an upper bound for the noise in the phase quadrature.

[0098] The analysis is further disclosed in part II “Security Analysis” of the Article. In the Article, the set-up comprises two photodiodes one for each of the first and a second trajectories after the beam splitter, where the beam splitter is arranged such that 50% of the signal reaches each of the photodiodes so that the noise can be removed by subtraction. The skilled person when reading the part II will understand what parts relate specifically to the arrangement of the two photodiodes, which is not relevant according to this invention.

[0099] From the PSDs and based on the assumptions, the parameters: signal variance σ.sup.2, conditional signal variance σ.sub.χ.sup.2, and conditional excess noise variance σ.sub.v.sup.2 can be determined 225, and subsequently the min-entropy can be obtained 230, see parts II and III in the Article for details.

[0100] Part I in the Article discloses that the upper limit of the vacuum fluctuations is dependent on the min-entropy of a single measurement outcome drawn from a random variable conditioned on the quantum side-information held by an adversary. Since we have the min-entropy, we can calculate the lower limit on the min-entropy of the vacuum fluctuations.

[0101] After that, random numbers can be extracted 235 as described in part IV in the Article. The extraction is done by using a strong extractor based on a Toeplitz matrix hashing algorithm.

Example

[0102] Sketch of Security Proof

[0103] Here, we provide a sketch of how to demonstrate security and derive an entropy bound for the scheme above for the set-ups shown in FIGS. 1a and 1b. First, is the case of inefficient, but otherwise ideal, photodetectors disclosed. Other realistic imperfections are discussed below.

[0104] Inefficient Detectors

[0105] A proof for inefficient, but otherwise ideal, detectors proceeds in three steps.

[0106] First, one shows that entangling input states across rounds does not aid an attacker in predicting the measurement outputs.

[0107] Second, one shows that the optimal strategy for an attacker is to input states with a definite photon number (Fock states) in every round.

[0108] Finally, one gives an expression for the min-entropy of the raw data relative to the attacker, conditioned on a given observed mean intensity.

[0109] Entanglement does not Help

[0110] We consider the measurement as an ideal photon counter preceeded by a beam splitter with transmittivity η (c.f. FIG. 1b). The signal is incident in one port of the beam splitter while in the second port a vacuum state is input. The probability for observing an output n given an input signal in state ρ is

p(n)=Tr[U(η)(ρ.Math.|0.sub.B(|)U†(η)|n.sub.An|.Math.1.sub.B)],  (1)

[0111] where U(η) is the unitary transformation corresponding to the beam splitter, □k□ with k=0, 1, . . . are the Fock states, and A and B label the signal and vacuum ports of the beam splitter. We can rewrite this as

p(n)=Tr.sub.A|ρ.sub.B0|U†(η((|n(n|.Math.1)U(η)|0.sub.B|.  (2)

[0112] From this, we see that the measurement, including the beam splitter, is described by a positive operator-valued measure (POVM) acting on the signal mode, with POVM elements

[00001]$\begin{array}{cc}.Math.\text{?}{=}_B{\left(0.Math.U\text{?}\left(\eta \right)\left(.Math.n\right)\left(n.Math.\text{?}\right)U\left(\eta \right).Math.0\right)}_B=\underset{k=0}{.Math.}\text{?}\left(\begin{array}{c}n+k\\ k\end{array}\right){{\eta }^n\left(1-\eta \right)}^k.Math.n+k)(n+k.Math..& \left(3\right)\end{array}$$\text{?}\text{indicates text missing or illegible when filed}$

[0113] This measurement is diagonal in the Fock basis, i.e. all the POVM elements are diagonal in this basis. We can write Π.sub.n=Σ.sub.mq.sub.m.sup.n|mm|. Consider now a sequence of N such measurements on a joint, possibly entangled, state |.sub.ΨA.sub.1.sub., . . . A.sub.N.sub.,E, between N modes and potentially some additional system E held by an eavesdropper, Eve. The probability for observing a particular sequence of outcomes n.sub.1, . . . , n.sub.N is

[00002]$\begin{array}{cc}P\left(n_1,.Math.,n_N\right)=\mathrm{Tr}\left[\rho \text{?}\left(.Math.\text{?}.Math..Math..Math..Math.\text{?}.Math.\text{?}\right)\right]& \left(4\right)\end{array}$$\begin{array}{cc}=\underset{m_1,.Math.,m_N}{.Math.}\text{?}.Math.\text{?}.Math.m_1,.Math.,m_N.Math.{\mathrm{Tr}}_E\left[\text{?}\right].Math.m_1,.Math.,m_N.Math..& \left(5\right)\end{array}$$\text{?}\text{indicates text missing or illegible when filed}$

[0114] From this expression, we see that only diagonal (in the Fock basis) terms in pw contribute. It follows that entanglement does not help an adversary predict the measurement outcomes.

[0115] The Optimal Input is a Fock State

[0116] Consider that the average intensity is estimated every R rounds of the experiment, and denote the observed average photon number by μ. The adversary thus needs to pick the distribution of input states such that this observation is reproduced, while maximising her probability for predicting the measurement outcomes over the R rounds. Since entanglement does not help, and off-diagonal terms in the Fock basis do not alter the probabilities, in a given round, the most general state an adversary can effectively prepare is of the form

[00003]$\begin{array}{cc}\underset{k}{.Math.}q\left(k\right).Math.k.Math..Math.k.Math.,& \left(6\right)\end{array}$

[0117] which would, on average, give an observed photon number Σ.sub.kq(k)kη. The probability for Eve to guess the output is just equal to the probability of the most likely measurement outcome, which is

[00004]$\begin{array}{cc}\underset{n}{\max }\underset{k}{.Math.}q\left(k\right)\left(\begin{array}{c}k\\ n\end{array}\right){{\eta }^n\left(1-\eta \right)}^{k-n},& \left(7\right)\end{array}$

[0118] We note that the averaging over the distribution q(k) will tend to flatten the distribution over outcomes (since mixing multiple distributions will produce a less peaked distribution). Hence, the optimal choice for an adversary to maximise her guessing probability will be to make q(k) equal to a delta function for some k. That is, to input a Fock state. Note that the adversary is free to (classically) correlate her inputs across rounds, so she can choose to input different Fock states in different rounds.

[0119] Computing the Entropy

[0120] In fact, to maximise her information (that is, to minimise the entropy from her perspective) in the measurement sequence, her best option is to input a large Fock state in a single round, and no light at all in the remaining R−1 rounds. When the input is vacuum, the measurement outcome is always zero and hence perfectly predictable. So only the bright round will have non-zero entropy. The entropy grows with the size of the Fock states (since more outcomes are possible, and the variance is larger, when there are more input photons). So the adversary should use the smallest state possible which will still reproduce (at least) the required average μ. That is, she should input ┌Rμ/η┐ photons. In that case, the total min-entropy over the R rounds will be (this is roughly the number of extractable random bits)

[00005]$\begin{array}{cc}-\frac{1}{R}{\log }_2\left(\begin{array}{c}.Math.R\mu /\eta .Math.\\ .Math.\left(.Math.R\mu /\eta .Math.+1\right)\eta .Math.\end{array}\right){{\eta }^{.Math.\left(.Math.R\mu /\eta .Math.+1\right)\eta .Math.}\left(1-\eta \right)}^{.Math.R\mu /\eta .Math.-.Math.\left(.Math.R\mu /\eta .Math.+1\right)\eta .Math.}& \left(8\right)\end{array}$

[0121] Note that, as discussed in the concept section above, limited transmittivity of the beam splitter is crucial. For η=1, the entropy becomes zero and no randomness can be extracted. This is in contrast to other QRNG schemes based on quadrature measurements of e.g. shot noise limited lasers.

[0122] An illustration of the expression of total min-entropy, H.sub.min, is shown in FIGS. 4a and 4b for an intensity of 10.sup.6 photons per round, which corresponds to 1 mW power at a wavelength of 850 nm, assuming a round takes 1 ns. In FIG. 4a, η=0.5 and H.sub.min is plotted against R as defined above. As expected, the extractable randomness decreases with the length of the averaging interval as shown in FIG. 4a.

[0123] FIG. 4b shows H.sub.min plotted against the beam splitter transmissivity, □. If we had used the non-unity quantum efficiency of a photodiode, the graph would look the same. Fixing the average input intensity the min-entropy has a maximum at 50% reflectivity as shown in FIG. 4b. FIG. 4b shows four graphs, where the graphs seen from above has R=1, 5, 10, and 20, respectively. Note that the randomness increases with the average observed intensity.

[0124] Final Comments

[0125] In a full security proof, the coarse-graining entailed by the analog-to-digital conversion of the detector output may advantageously also be accounted for, as well as the noise from the analog-to-digital converter, other electronic noise sources and the effect of detector saturation on the randomness. The latter implies that in addition to dark rounds, the detector output is also predictable for very bright rounds. This imposes further constraints on the combinations of mean intensity and length of averaging intervals, which will lead to good randomness generation.