Cryptographic Aspects of Quantum Reading

Abstract

Besides achieving secure communication between two spatially-separated parties, another important issue in modern cryptography is related to secure communication in time, i.e., the possibility to confidentially store information on a memory for later retrieval. Here we explore this possibility in the setting of quantum reading, which exploits quantum entanglement to efficiently read data from a memory whereas classical strategies (e.g., based on coherent states or their mixtures) cannot retrieve any information. From this point of view, the technique of quantum reading can provide a new form of technological security for data storage.

1. Introduction

Quantum cryptography [1,2] aims to realize a completely unbreakable scheme for the distribution of a secret key between two remote parties, usually called Alice and Bob. Indeed quantum key distribution (QKD) relies its security on one of the the most fundamental physical laws, the uncertainty principle, which is actively exploited for detecting and overcoming the presence of a malicious eavesdropper, usually called Eve. In this scenario, an important role is also played by quantum entanglement [3], which can be exploited to make QKD protocols device-independent, i.e., more robust to practical flaws (e.g., in the detectors) which may potentially be exploited by Eve. Very recently, quantum discord [4] (see [5] for its computation with Gaussian states) has also been identified as a useful resource for device-dependent QKD with trusted noise [6], e.g., in scenarios such as measurement-device independent QKD [7–10].

In this preliminary study, we investigate a different but still important problem: The confidential storage of information on a physical device, such as an optical memory. It has been recently proven that quantum entanglement can provide an advantage in the readout of classical data from optical memories, especially in the low-energy regime, i.e., when a few photons are irradiated over the memory cells. This approach is known as quantum reading [11] (see also follow-up papers [12–23]), a notable application of quantum channel discrimination to a practical task as the memory readout. From this point of view, another well-known protocol is quantum illumination, which aims at improving target detection [25–31], and has been recently extended to its most natural domain, the microwaves [32].

Here we show how the performance advantage given by quantum reading can be exploited to completely hide classical information in optical memories. The strategy is to design a photo-degradable optical memory whose cells have very close reflectivities (each reflectivity encoding a bit-value). Because of the photodegrable effects, each cell can only be read with a limited number of photons. In these low-energy conditions, we find that only well-tailored quantum sources (in particular, entangled) are able to discriminate two very close reflectivities and, therefore, retrieve the information stored in the cell. Specifically, we derive a simple analytical formula which relates the reflectivities of the memory cell with the mean number of photons to be employed by the quantum source.

This approach would provide a layer of technological security to the stored data, in the sense that only an advanced laboratory equipped with quantum-correlated sources would be able to read the information, whereas any other standard optical reader based on classical states, such as coherent states or even thermal states, can only extract a negligible number of bits.

The paper is organized as follows. In Section 2, we briefly review the basic setup of quantum reading and we discuss the performances achievable by quantum entanglement and classical (coherent) states. Then, in Section 3 we show how to design memories which are not accessible to classical methods. Finally, Section 4 is for conclusions.

2. Basic Setup for Quantum Reading

For our purpose we consider the simplest version of quantum reading, considering only ideal optical memories, i.e., with high reflectivities, and neglecting decoherence effects (see [11] for more advanced models). Each memory cell is assumed to be in one of two hypotheses: Non-unit reflectivity r₀ := r < 1 (encoding bit-value 0) or unit reflectivity r₁ = 1 (encoding bit-value 1). Mathematically, this is equivalent to distinguish between a lossy channel ε_r whose loss parameter is the reflectivity r < 1 and an identity channel $ℐ$.

In symmetric quantum hypothesis testing, these two hypotheses have the same cost, so that we aim to optimize the mean error probability. In other words, we need to minimize $\overline{p}:=p(1|0)p_0+p(0|1)p_1$, where p₀ and p₁ are the a priori probabilities of the two hypotheses, while p(1|0) is the probability of a false positive and p(0|1) is the probability of a false negative. For simplicity, we consider here equiprobable hypotheses, i.e., p₀ = p₁ = 1/2, which means that a bit of information is stored per cell. The amount of information which is retrieved in the readout process is therefore given by $I_{\text{read}}(\overline{p})=1-H(\overline{p})$, where $H(\overline{p})=-\overline{p}{\log }_2\overline{p}-(1-\overline{p}){\log }_2(1-\overline{p})$ is the binary formula of the Shannon entropy [33].

2.1. Classical Benchmark

To distinguish between the two hypotheses Alice exploits an input source of light (a transmitter) and an output detection scheme (a receiver). In the classical reading setup, the transmitter consists of a single bosonic mode, the signal (S), which is prepared in a coherent state |α〉 sent to the memory cell. At the output, the receiver is typically a photodetector counting the number of photons reflected, followed by a digital processing based on a classical hypothesis test. The performance of this receiver can be bounded by considering an optimal quantum measurement, constructed from the Helstrom matrix ρ₀ – ρ₁ of the two possible output states ${\rho }_0=|\sqrt{r}\alpha \rangle \langle \sqrt{r}\alpha |\text{and}{\rho }_1=|\alpha \rangle \langle \alpha |$.

The minimum error probability is given by the Helstrom bound [34] which is here very simple to compute since the two states are pure. In fact, for two arbitrary pure states |φ₀〉 and |φ₁〉, the Helstrom bounds reads

$$\overline{p}=\frac{1-D(|{\phi }_0\rangle ,|{\phi }_1\rangle )}{2},$$

(1)

where the trace distance [3] D is determined by the fidelity

$$D(|{\phi }_0\rangle ,|{\phi }_1\rangle )=\sqrt{1-F(|{\phi }_0\rangle ,|{\phi }_1\rangle ),}$$

(2)

$$F(|{\phi }_0\rangle ,|{\phi }_1\rangle )=|\langle {\phi }_0|{\phi }_1\rangle {|}^2.$$

(3)

In our specific case, we have [2]

$$F(|\sqrt{r}\alpha \rangle ,|\alpha \rangle )=\exp \left(-|\alpha -\sqrt{r}\alpha {|}^2\right)=\exp [-\overline{n}{(1-\sqrt{r})}^2],$$

(4)

where $\overline{n}=|\alpha {|}^2$ is the mean number of photons of the input coherent state. As a result, we achieve the following Helstrom bound for the coherent state transmitter

$${\overline{p}}_{\mathrm{coh}}(\overline{n},r)=\frac{1-\sqrt{1-e^{-\overline{n}{(1-\sqrt{r})}^2}}}{2},$$

(5)

which is therefore able to read an average of $I_{\text{read}}^{\text{class}}=I_{\text{read}}({\overline{p}}_{\text{class}})$ bits per cell.

2.2. Quantum Transmitter

In the quantum reading setup, we consider a transmitter composed of two entangled modes, that we call signal (S) and reference (R). This is taken to be an Einstein–Podolsky–Rosen (EPR) state, also known as a two-mode squeezed vacuum state [2]. An EPR state is a zero-mean pure Gaussian state |μ〉_SR with covariance matrix (CM)

$$\mathbf{V}(\mu )=\left(\begin{array}{cc}\mu \mathbf{I}& \sqrt{{\mu }^2-1}\mathbf{Z}\\ \sqrt{{\mu }^2-}1\mathbf{Z}& \mu \mathbf{I}\end{array}\right),\begin{array}{c}\mathbf{Z}:=\mathrm{diag}(1,-1),\\ \mathbf{I}:=\mathrm{diag}(1,1),\end{array}$$

(6)

where μ ≥ 1 quantifies both the mean number of thermal photons in each mode, given by $\overline{n}=(\mu -1)/2$, and the amount of entanglement between the signal and reference modes [2].

The signal mode, with $\overline{n}$ mean photons, is sent to read the memory cell and its reflection S′ is combined with the reference mode in an optimal quantum measurement. Given the state ρ_SR = |μ〉_SR 〈μ| of the input modes S and R, we get two possible states

$${\sigma }_0=({\mathcal{E}}_r\otimes ℐ)({\rho }_{SR}),$$

(7)

$${\sigma }_0=(ℐ\otimes ℐ)({\rho }_{SR})={\rho }_{SR},$$

(8)

for the output modes S′ and R at the receiver. One is just the input EPR state, while the other state σ₀ is a mixed Gaussian state with CM

$${\mathbf{V}}_0(\mu ,r)=\left(\begin{array}{cc}(r\mu +1-r)\mathbf{I}& \sqrt{r({\mu }^2-1)}\mathbf{Z}\\ \sqrt{r({\mu }^2-1)}\mathbf{Z}& \mu \mathbf{I}\end{array}\right).$$

(9)

The minimum mean error probability is given by the Helstrom bound ${\overline{p}}_{\mathrm{quantam}}=[1-D({\sigma }_0,{\sigma }_1)]/2$, where D(σ₀, σ₁) is the trace distance between σ₀ and σ₁. The Helstrom bound is difficult to compute when one or both the output states are mixed. For this reason, we resort to an upper-bound, known as quantum Chernoff bound (QCB) [35–37]. This can be written as

$${\overline{p}}_{\mathrm{quantum}}^{\mathrm{QCB}}:=\frac{C}{2},C:=\underset{s\in (0,1)}{\inf }{C}_s,$$

(10)

where $C_s:=\mathrm{Tr}({\sigma }_0^s{\sigma }_1^{1-s})$ is the s-overlap between the two states. In the specific case where one of the output states is pure σ₁ = |φ〉〈φ|, we may write C = F, using the quantum fidelity F = 〈φ|σ₀|φ〉. For zero-mean Gaussian states, this fidelity can easily be computed in terms of their CMs [38,39]. In fact, we have

$$F=\frac{4}{\sqrt{\det [\mathbf{V}(\mu )+{\mathbf{V}}_0(\mu ,r)]}}=\frac{4}{{[1+\mu +\sqrt{r}(1-\mu )]}^2}={(1+\overline{n}+\overline{n}\sqrt{r})}^{-2}.$$

(11)

As a result, the mean error probability associated with this quantum transmitter is upperbounded by the QCB as follows

$${\overline{p}}_{\mathrm{quantum}}\le {\overline{p}}_{\mathrm{quantum}}^{\mathrm{QCB}}=\frac{{(1+\overline{n}+\overline{n}\sqrt{r})}^{-2}}{2}.$$

(12)

Thus, the EPR transmitter is able to read at least $I_{\text{read}}^{\text{quant}}=I_{\text{read}}({\overline{p}}_{\text{quantun}}^{\mathrm{QCB}})$ bits per cell.

3. Data Secured by Quantum Reading

We can compare the readout performances of the two transmitters by considering the information gain $\mathrm{\Delta }:=I_{\text{read}}^{\text{quant}}-I_{\text{read}}^{\text{class}}$. Its positivity means that quantum reading outperforms the classical readout strategy. In particular, for Δ ≃ 1 bit per cell we have that the EPR transmitter reads all data, while the classical transmitter is not able to retrieve any information. Here we aim to exploit this feature to make the data storage secure in absence of entanglement (and, more generally, quantum resources). As we can see from Figure 1, the value of the gain Δ is close to the maximum value of 1 bit per cell when the memory cell is characterized by very high reflectivities, i.e., r ≃ 1. In particular, the good region where Δ > 0.95 is particularly evident at low photon numbers, while it tends to shrink towards r = 1 for increasing energy.

We now discuss how we can exploit this advantage of quantum reading for designing a secure classical memory. Let us expand the information quantities $I_{\text{read}}^{\text{class}}$ and $I_{\text{read}}^{\text{quant}}$ at the leading order in (1 − r) ≃ 0. We find

$$I_{\text{read}}^{\text{class}}\simeq \frac{\overline{n}{(1-r)}^2}{\ln 256},I_{\text{read}}^{\text{quant}}\simeq \frac{{\overline{n}}^2{(1-r)}^2}{\ln 4}.$$

(13)

As we can see, at high reflectivities, there is a different behaviour of these quantities in the mean number of photons $\overline{n}$. In particular, we may write

$$I_{\text{read}}^{\text{quant}}\simeq 4\overline{n}{I}_{\text{read}}^{\text{class}}.$$

(14)

According to Equation (13), a non-trivial difference between $I_{\text{read}}^{\text{class}}$ and $I_{\text{read}}^{\text{quant}}$ arises by imposing the condition

$$1-r={\overline{n}}^{-1}.$$

(15)

Indeed this leads to the following behaviour for large $\overline{n}$

$$I_{\text{read}}^{\text{class}}\simeq \frac{1}{\overline{n}\ln 256}\to 0,I_{\text{read}}^{\text{quant}}\simeq \frac{\ln \left(\frac{2048}{81}\right)-7\ln \left(\frac{9}{7}\right)}{\ln 512}\simeq \mathrm{0.235.}$$

(16)

We can see that only quantum reading enables to retrieve non-zero information from the memory (combining this performance with suitable error correcting codes would enable us to achieve a complete readout of the memory). In the following Figure 2, we show the behaviour of the two information quantities $I_{\text{read}}^{\text{class}}$ and $I_{\text{read}}^{\text{quant}}$ in terms of the mean photon number $\overline{n}$ and assuming the condition of Equation (15).

We can see that, at any fixed energy $\overline{n}$ irradiated over the memory cell, there is a memory with reflectivity r satisfying Equation (15) which is readable by using a quantum transmitter with signal energy $\overline{n}$ but unreadable by a classical transmitter with the same irradiated energy $\overline{n}$. More precisely, any classical transmitter with energy up to $\overline{n}$ is inefficient. In fact, let us fix some value ${\overline{n}}_{max}$ and consider a memory with $1-r={\overline{n}}_{max}^{-1}$, then the performance of all classical transmitters with signal energy $\overline{n}\le {\overline{n}}_{max}$ is shown in Figure 3. We see that the optimal classical transmitter is that with the maximal energy ${\overline{n}}_{max}$ as clearly expected from the monotonic expression in Equation (5).

Thus, if we construct a theoretical memory which can be irradiated with at most ${\overline{n}}_{max}$ photons per cell (otherwise data is lost, e.g., due to photodegrable effects) and having reflectivity r satisfying Equation (15), then this will be unreadable by any classical transmitter based on coherent states while its data can be retrieved by a quantum transmitter with signal energy $\simeq {\overline{n}}_{max}$.

Note that in general, we can design a memory with reflectivity r such that

$$1-r=c{\overline{n}}^{-1},$$

(17)

for some constanton c. For large $\overline{n}$, we have $I_{\text{read}}^{\text{class}}\to 0$, while $I_{\text{read}}^{\text{quant}}$ tends to a constant ≤ 1 which depends on c. For instance, we have $I_{\text{read}}^{\text{quant}}\to 0.895$ for c = 01, and $I_{\text{read}}^{\text{quant}}\to 0.997$ for c = 0.01. In the following Figure 4, we show the behaviour of the two information quantities $I_{\text{read}}^{\text{class}}$ and $I_{\text{read}}^{\text{quant}}$ assuming the condition of Equation (17) with c = 0.1. We see how the memories remains unreadable by classical means while the peformance of quantum reading approaches 1 bit per cell.

4. Conclusions

In this preliminary study on the cryptographic aspects of quantum reading, we have shown how it is possible to construct classical memories which cannot be read by classical means, namely coherent states (and mixtures of coherent states, by invoking the same convexity arguments of Ref. [26]) but still they can be read using quantum entanglement. In particular, we have considered an EPR state and we have connected the mean number of photons to be employed by this quantum source with the reflectivies to be used in the memory cells, see Equation (15) and also its generalization in Equation (17). Note that other non-classical states may also provide non-trivial advantages with respect to coherent states and their mixtures. In general, the security provided by the scheme relies on the technological difference between two types of labs, one limited to classical sources and the other able to access quantum features, such as entanglement or squeezing.

It is interesting to discuss the connections between our scheme of data-hiding by quantum reading and the traditional technique of quantum data hiding [40,41]. The latter is about to store classical information into entangled states, so that it can only be retrieved by joint measurements. It is clearly an application of quantum state discrimination. By contrast, data-hiding by quantum reading is related to the problem of quantum channel discrimination. Classical data is stored in a channel (not a state) and quantum entanglement is used as an input resource to be processed by the channel. This is a crucial difference, also for practical purposes, since data stored in a classical memory does not decohere (like the entangled states typically prepared in quantum data hiding), and quantum entanglement is used a resource on demand, which is needed only for the readout of the information (not for the storage process).

Note that our study can be extended in several ways. We have only considered ideal memories where the cells are addressed individually and have very high reflectivities (in particular, we have assumed unit reflectivity for one of the two bit values stored in the cell). There is no inclusion of additional noise sources in the model, e.g., coming from stray photons scattered during the readout process, neither analysis of diffraction or other optical effects. Finally, we have also assumed that high values of entanglement can be generated. While this is possible theoretically, it is very hard to achieve experimentally. This would not be a problem if we were able to construct memories which are extremely photo-sensitive, so that that the maximum values of tolerable energies are of the order of ${\overline{n}}_{max}\lesssim 10$ photons per cell.