A Phase Fluctuation Based Practical Quantum Random Number Generator Scheme with Delay-Free Structure

Abstract

Quantum random number generators are widely used in many applications, ranging from sampling and simulation, fundamental science to cryptography, such as a quantum key distribution system. Among all the previous works, quantum noise from phase fluctuation of laser diodes is one of the most commonly used random source in the quantum random number generation, and many practical schemes based on phase noise with compact systems have been proposed so far. Here, we proposed a new structure of phase noise scheme, utilizing the phase fluctuation from two laser diodes with a slight difference of center wavelength. By analyzing the frequency components and adopting an appropriate band-pass filter, we prove that our scheme extracts quantum noise and filtered other classical noises substantially. Results of a randomness test shows that the extracted random sequences are of good performance. Due to lack of delay-line and the low requirement on other devices in this system, our scheme is promising in future scenarios for miniaturized quantum random number generation systems.

1. Introduction

Random numbers are of great significance in many fields, including statistical analysis, numerical simulation, fundamental science [1] and cryptography [2]. The randomness of a random number generator (RNG) could seriously affect the applications of high security demands, one of the outstanding example is the quantum key distribution (QKD) system in quantum cryptography [3,4,5,6]. Based on the determined algorithm, a classical random number generator, also called a pseudo-RNG, could generate pseudo random sequences in an efficient method, expanding the randomness from short random seeds with extremely fast speed, and compatible with portable devices. However, due to the deterministic and predictable intrinsic nature of computational algorithms, pseudo random number generators face severe security issues in applications such as secure communication systems.

In contrast, quantum random number generators (QRNG) [7,8,9], based on the intrinsic random nature of quantum processes, stand out as a promising alternative for its non-deterministic and unpredictable characteristics. QRNG schemes are classified into three categories, based on various requirements of physical devices, namely full-device-independent [10,11,12], semi-device- independent [13,14,15,16,17,18], and full-trusted-device, i.e., practical QRNG schemes. Among the three categories, practical QRNG has been developed rapidly due to its convenience and huge demand. By adopting a certain post-processing method, practical QRNG scheme is information theoretically proved secure under the trusted-device scenario, which is adequent for the security requirements of most applications.

During the last two decades, plenty of practical QRNG schemes have been realized with high generation rate and relatively low cost, including primarily developed discrete variable schemes, which measure photon path (spatial mode) [19,20,21], photon arrival time (temporal mode) [22,23,24,25,26,27], photon number distribution [28,29,30]. A couple of years later, another category with relatively better performance was proposed, namely the continuous variable schemes. Due to the utilization of conventional high bandwidth photo-detector (PD) and analog-to-digital converter (ADC), continuous variable schemes could reach a generation rate several orders of magnitude higher than its discrete counterpart, while the volume of practical devices is also much more compact, and thus far more popular in recent research. Continuous variable QRNG schemes measure phase fluctuation of laser [31,32,33,34,35,36,37,38,39], vacuum fluctuation of quantum state [40,41,42,43,44,45], amplified spontaneous noise (ASE) [46,47,48,49,50] and so on. Among the schemes mentioned above, phase noise, or phase fluctuation, is one of the major schemes adopted as random source (the other is vacuum fluctuation), for its high generation rate and relatively simple implementation setup.

Traditional phase noise schemes utilize a self-delayed interference structure, thus inevitably introducing a delay-line in an unbalanced Mach-Zender interferometer (MZI) in the experimental setup [31,32,38,39]. However, due to the bandwidth of phase noise in the laser, it usually takes several meters for the delay-line to reduce the auto-correlation coefficient of raw data effectively. In practical devices, space for the delay-line is one of the most difficult parts to be compressed, unless this part can be totally removed by adopting a novel scheme.

In this paper, we demonstrate a QRNG scheme based on phase noise with a delay-free structure. We theoretically analyze our scheme, and point out three main frequency components in the electric signal to be measured. After adopting appropriate implementation settings, namely center wavelength of laser diodes and passband of a band-pass filter, we distill phase noise from the original signal for further randomness extraction. Two extraction methods, the m-Least significant bit (m-LSB) method [51] and universal (Toeplitz) hashing method [34,36,44,52] are used in post-processing phase. Our scheme could achieve a generation rate of 600 Mbps, which is six times the sampling rate, and passes widely used randomness test batteries. Compared with previous schemes utilizing phase noise as a random source, our scheme is delay-line free, while the devices are conventional and performance of QRNG remains similar. Thus, it has great potential in compact and portable QRNG devices in the future.

The structure of this article is described as follows. In Section 2, the schematic setup of our scheme is demonstrated, followed by analysis on different noises in the system and the principle to distill the quantum noise of phase fluctuation. An experimental implementation is built according to the scheme. Two post-processing methods are realized, namely the m-LSB method and universal (Toeplitz) hashing method. Section 3 shows the various results of randomness test batteries.

2. Delay-Free Phase Noise QRNG Scheme

2.1. Principle of Scheme

The schematic setup of our scheme is shown in Figure 1. Two laser diodes with very close center wavelength are used as random source. The intensity of lasers are carefully tuned by variable optical attenuator (VOA) to the exact same level, then optical signals of two lasers are injected into a 50:50 beam splitter (BS). Electric fields at the input ports (P1, P2) of the BS could be written as:

$$\begin{array}{ccc}\hfill E_1\left(t\right)& =& {\mathbf{E}}_1\left(t\right)exp\left[i\left({\omega }_{1}t+{\phi }_1\left(t\right)\right)\right]\hfill \end{array}$$

(1)

$$\begin{array}{ccc}\hfill E_2\left(t\right)& =& {\mathbf{E}}_2\left(t\right)exp\left[i\left({\omega }_{2}t+{\phi }_2\left(t\right)\right)\right]\hfill \end{array}$$

(2)

Since the amplitude of laser is tunable and could be very stable during the experiment, the amplitude part of field could be regarded as a constant in our scheme, which means ${\mathbf{E}}_i\left(t\right)={\mathbf{E}}_i,i=1,2$. Two signals are interfered at the beam splitter, thus field at the output ports (P3, P4) of the BS could be written as:

$$\begin{array}{ccc}\hfill E_3\left(t\right)& =& \sqrt{T}{E}_1\left(t\right)+\sqrt{1-T}{E}_2\left(t\right)\hfill \end{array}$$

(3)

$$\begin{array}{ccc}\hfill E_4\left(t\right)& =& \sqrt{1-T}{E}_1\left(t\right)-\sqrt{T}{E}_2\left(t\right)\hfill \end{array}$$

(4)

where T refers to the transmittance, thus $R=1-T$ refers to the reflectivity of the beam splitter.

Signals of port P3 and P4 take $t_1,t_2$ time before arriving at the detectors (D1, D2) respectively. Hence, the intensity of electric signal at detector D1 (which comes from port P3) is:

$$\begin{array}{ccc}\hfill I_{D1}(t+t_1)& =& E_3(t+t_1)E_3^{*}(t+t_1)\hfill \\ & =& T{E}_1^2+(1-T)E_2^2\hfill \\ & & +2\sqrt{T(1-T)}{E}_1{E}_{2}exp\left[i\left({\omega }_1(t+t_1)+{\phi }_1(t+t_1)-{\omega }_2(t+t_1)-{\phi }_2(t+t_1)\right)\right]\hfill \end{array}$$

(5)

while the electric signal at detector D2 (which comes from port P4) has a similar expression:

$$\begin{array}{ccc}{I}_{D2}(t+t_2)& =& (1-T)E_1^2+T{E}_2^2\hfill \\ & & -2\sqrt{T(1-T)}{E}_1{E}_{2}exp\left[i\left({\omega }_1(t+t_2)+{\phi }_1(t+t_2)-{\omega }_2(t+t_2)-{\phi }_2(t+t_2)\right)\right]\hfill \end{array}$$

(6)

Apparently $I_{D1}\left(t\right)$ includes both DC term and AC term:

$$I_{D1}\left(t\right)={\left[I_{D1}\left(t\right)\right]}_{DC}+{\left[I_{D1}\left(t\right)\right]}_{AC}$$

(7)

According to (5), the DC term is $T{E}_1^2+(1-T)E_2^2$, and AC term is the rest. Therefore, if we use AC coupling photo-detectors in our scheme, we can only keep the AC terms in the following analysis and processing. After being detected by photo-detectors, the optical signal turns into an electric signal and the intensity $I_{D1}\left(t\right)$ is converted into optoelectric current $i_{D1}\left(t\right)$ proportionally:

$$\begin{array}{ccc}{\left[i_{D1}\left(t\right)\right]}_{AC}& \propto & {\left[I_{D1}\left(t\right)\right]}_{AC}\hfill \\ & =& +2\sqrt{T(1-T)}{E}_1{E}_{2}exp\left[i\left(({\omega }_1-{\omega }_2)(t+t_1)+({\phi }_1(t+t_1)-{\phi }_2(t+t_1))\right)\right]\hfill \end{array}$$

(8)

$$\begin{array}{ccc}{\left[i_{D2}\left(t\right)\right]}_{AC}& \propto & {\left[I_{D2}\left(t\right)\right]}_{AC}\hfill \\ & =& -2\sqrt{T(1-T)}{E}_1{E}_{2}exp\left[i\left(({\omega }_1-{\omega }_2)(t+t_2)+({\phi }_1(t+t_2)-{\phi }_2(t+t_2))\right)\right]\hfill \end{array}$$

(9)

Finally, the voltage signals $V_{D1}\left(t\right),V_{D2}\left(t\right)$ are combined in a mixer by frequency mixing (only the real part is considered here), and the new signal is denoted as $V_{mix}$:

$$\begin{array}{ccc}\hfill V_{mix}& =& {\left[V_{D1}\right]}_{AC}{\left[V_{D2}\right]}_{AC}\hfill \\ & \propto & -4T(1-T)E_1^2{E}_2^{2}cos\left[({\omega }_1-{\omega }_2)(t+t_1)+{\phi }_1(t+t_1)-{\phi }_2(t+t_1)\right]\hfill \\ & & cos\left[({\omega }_1-{\omega }_2)(t+t_2)+{\phi }_1(t+t_2)-{\phi }_2(t+t_2)\right]\hfill \\ & =& -4T(1-T)E_1^2{E}_2^{2}cos\left[\Delta \omega (2t+t_1+t2)+\Delta \phi (t+t_1)+\Delta \phi (t+t_2)\right]\hfill \\ & & -4T(1-T)E_1^2{E}_2^{2}cos\left[\Delta \omega (t_1-t_2)+\Delta \phi (t+t_1)-\Delta \phi (t+t_2)\right]\hfill \end{array}$$

(10)

where $\Delta \omega ={\omega }_1-{\omega }_2$, $\Delta \phi \left(t\right)={\phi }_1\left(t\right)-{\phi }_2\left(t\right)$.

It is clear that from (10), the final signal includes several frequency components, in which three of them are dominating. Two of them are from the phase term $\Delta \phi \left(t\right)$, where $\Delta {\phi }^{\mathrm{fiber}}$ is due to the fiber jitter, and $\Delta {\phi }^{\mathrm{phase}}$ comes from phase noise of laser diode, from which we expect to extract randomness. Another part of frequency term $2\Delta \omega t$ is due to the difference of center wavelength of two laser diodes. In fact, there exist a crucial relationship between these three frequency components in our scheme:

$$f(2\Delta \omega )>>f(\Delta {\phi }^{\mathrm{phase}})>>f(\Delta {\phi }^{\mathrm{fiber}})$$

(11)

and all the implementation settings in our experimental setup is based on (11).

2.2. Experimental Setup

We experimentally realized our scheme as Figure 1 shows above, and the setup is described as follows. Two distributed feedback (DFB) laser diodes emit continuous wave (CW) light with center wavelength at around 1550 nm. Specifically, the center wavelength of two DFB laser diodes are originally set at 1549.865 nm and 1549.858 nm respectively, which is 880 MHz separated from each other. The laser output power is set slightly higher than the threshold to obtain highest proportion of quantum noise [31,34,36], which is 1.3 mW in our setup. Intensity of signals from two laser diodes are carefully tuned by variable optical attenuator (VOA) to keep the intensity equal. After the signals interfere at a 50:50 beam splitter (BS), optical signals are detected by two homemade photo-detectors with AC coupling (measurement bandwidth 100 MHz). Electric signals are mixed by a frequency mixer, then the signal is filtered by a band-pass filter with 10–1000 MHz passband range to select the frequency component of phase noise, which is the appropriate frequency range in our scheme decided by the implementation. The electric signal after the filter is sampled by an analog-to-digital converter (ADC, ADS5400, sampling frequency 100 MHz, sampling precision 12 bits and input voltage range 1.5 V peak-to-peak). Finally, a field programmable gate array (FPGA, KC705 evaluation board) is adopted to realize randomness extraction and data precision adjustment. The sampling range is 1.5 V, however the peak-to-peak value of the noise signal is only 190 mV, hence there is approximately three unoccupied bits in raw data, which should be eliminated at the beginning in post-processing.

As mentioned above, we set the difference of center wavelength at around 880 MHz (0.007 nm at 1550 nm wavelength), which is higher than the noise bandwidth from phase fluctuation of laser diodes in our implementation. Noticing that, the difference of center wavelength should not be too large, since the waveform after interfering at the beam splitter may not able to keep stability for heavily mismatched laser diode wavelength, as shown in Figure 2. On the other hand, frequency of fiber jitter noise is usually no greater than 10 MHz. By utilizing a band-pass filter with a 10–1000 MHz passband range at the output port of the mixer, one can substantially eliminate the influence of the fiber jitter term $\Delta {\phi }^{\mathrm{fiber}}$, as well as the difference of center wavelength term $2\Delta \omega t$. Hence the term of phase noise is distilled and used for further randomness extraction process.

2.3. Post-Processing Method

The raw data, measured from the phase noise of laser diode, is approximately a Gaussian variable on the probability distribution function (PDF) [53,54]. However, random sequences of general QRNG schemes and applications should be a uniform distribution, hence post-processing is essential. Another function of post-processing is eliminating the unexpected randomness from the environment, which may be utilized by the adversary Eve, specifically the classical noise. Therefore, generally speaking, a traditional post-processing method includes two phases: entropy estimation and randomness extraction. The entropy estimation phase calculate the upper bound of randomness, which can be extracted from the raw data as a discretized random variable $X_{dis}$, based on the observable parameters. Then, one can adopt various extractors to distill the randomness calculated before in the randomness extraction phase. There exist two efficient methods in QRNG post-processing, based on different devices in implementation and application requirements, namely the m-least significant bit (m-LSB) method and universal (Toeplitz) hashing method.

The former one, m-LSB method, belongs to the deterministic extractor. The m-LSB method is extremely simple to implement both on hardware and software, and could run at very high sampling and generation rate. One just truncates the raw data, takes the last m-bit random numbers and outputs the final sequence (logical exclusive OR (XOR) operation is also optional if necessary). The reason for taking the LSB instead of its counterpart, the most significant bit (MSB), is that the LSB has a better distribution and lower auto-correlation coefficient after post-processing, and thus is more difficult to be predicted by the adversary. This method is quite effective if the implementation is trusted and has a relatively high quantum-to-classical noise ratio (QCNR). However, in untrusted device scenarios, one can still extract several bits with high sampling resolution.

We adopt a m-LSB method by treating our implementation as a trusted-device scenario and according to the analysis in [51]. It is secure for m-LSB to truncate four bits out of a 16-bit discretized signal in noise-free cases, and secure to truncate five (seven) bits out of 16 bits with the deviation of classical noise ${\sigma }_E$ three (four) times larger than quantum noise ${\sigma }_Q$. In fact, quantum noise is dominate in our implementation, thus truncate a moderate number of six bits from raw data (including the unoccupied three most significant bits) to form the extracted sequence is adequately conservative for our scheme. Therefore, the generation rate of adopting m-LSB method is $100\times 6=600$ Mb/s.

Universal hashing method is another post-processing method often chosen in QRNG schemes, which belongs to the seeded extractor, indicating that this method should consume some short random seed to generate the universal hashing functions. Among these functions, the Toeplitz matrix is an outstanding solution for its low complexity in computation and implementation. For a binary Toeplitz matrix utilized for QRNG post-processing, the size of the original matrix is $M\times N$, where N is the size of raw data, and M is the size of extracted sequence. The ratio $M/N$ is a crucial parameter which is closely related to the min-entropy $H_{\infty }\left(X\right)$ calculated in the entropy estimation phase:

$$H_{\infty }\left(X\right)=-{log}_2(\underset{x\in {[0,1]}^n}{max}Pr(X=x)).$$

(12)

The output sequence of Toeplitz hashing, based on the input, is almost unique, for it has a collision probability of only $2^{-M+1}N$ for a different input to share the same output. According to information theory, the security parameter $\epsilon$ should satisfy:

$$M=N·H_{\infty }-2{log}_2(1/\epsilon )$$

(13)

where $\epsilon$ also indicated the distance between the output sequence and ideal uniform sequence.

Therefore, by designing a Toeplitz matrix with ratio $M/N$ slightly smaller than the min-entropy and adopting different matrix size, the security parameter $\epsilon$ could be arbitrarily close to zero. Noticing that, the seeds consumed in generating Toeplitz matrix is $N+M-1$. Since the data size is huge in QRNG systems, post-processing should be run by block: $N=Bn,M=Bm$, where $m\times n$ is the size of practical Toeplitz matrix, and B is the number of blocks. After discarding the unoccupied bits in raw data, the min-entropy in our system is 6.60 bits/sample, hence we set our Toeplitz matrix at a moderate size of $1536\times 3072$ and run the post-processing method by block, which means $3072÷12=256$ consecutive samples are collected and process in one Toeplitz hashing operation. The security parameter is $\epsilon =7.6\times {10}^{-24}$ in our implementation. Since the extracting ratio decided by the Toeplitz matrix is also 50%, the generation rate of adopting Toeplitz hashing method is also 600 Mb/s.

3. Test Results

The test is divided into two parts, including $3\sigma$ criterion and widely used test batteries such as DIEHARD or NIST-STS. Uniformity are also included in the batteries. Firstly, data are randomly chosen to perform the $3\sigma$ test to compare the difference between raw data and extracted numbers. For raw data, the sample size equals the sampling depth of 50 M points/samples with 12-bit resolution in our implementation. While for extracted sequence, the sample size is 420 Mbits, which is consecutive data in 0.7 s after post-processing. The results are shown in Figure 3 and Figure 4. Apparently post-processing methods impressively reduce the low-order auto-correlation coefficient, due to the limited bandwidth of devices may cause some correlation in the adjacent samples of raw data, particularly in oversampled scenarios, where sampling rate and auto-correlation trade-off should be carefully dealed with in practical devices.

In order to evaluate randomness, we also adopt widely-accepted randomness test batteries, namely DIEHARD and NIST-STS test, both of which are hypothesis tests of a statistically based randomness test, with a couple of p-values indicating whether to accept or reject the hypothesis in each sub-test. Generally speaking, if all the final p-values located between $[0.01,0.99]$ (with default significance level $\alpha =0.01$), the whole test is considered successful. Random sequences extracted from either the m-LSB or Toeplitz hashing method should pass both test batteries, and we choose one typical sequence from the Toeplitz hashing method as an example: the result of DIEHARD test is shown in

Table 1. The result of the DIEHARD test after post-processing. DIEHARD includes 18 terms and 20 randomness test results, each with a p-value. For the sub-tests with multiple p-values, a Kolmogorov-Smirnov (KS) test is performed to obtain the final p-value. It is considered successful for certain sub-tests if the final p-value is between $[0.01,0.99]$ (significance level $\alpha =0.01$). The length of test sequence is 420 Mbits.

Statistical Test	p-Value	Result
Birthday spacings	0.122824[KS]	success
Overlapping permutations	0.430620	success
Ranks of 31 × 31 matrices	0.605645	success
Ranks of 32 × 32 matrices	0.427548	success
Ranks of 6 × 8 matrices	0.260611[KS]	success
Monkey tests on 20-bit words	0.136669[KS]	success
Monkey test OPSP	0.43930[KS]	success
Monkey test OQSO	0.68062[KS]	success
Monkey test DNA	0.61412[KS]	success
Count 1’s in stream of bytes	0.662425	success
Count 1’s in specific bytes	0.561794[KS]	success
Parking lot test	0.312073[KS]	success
Minimum distance test	0.377192[KS]	success
Random spheres test	0.440218[KS]	success
Squeeze test	0.019830[KS]	success
Overlapping sums test	0.053688[KS]	success
Run test(up)	0.314213	success
Run test(down)	0.492526	success
Craps test No. of wins	0.420491	success
Craps test throw/game	0.965724	success

, and result of NIST-STS test is shown in

Table 2. The result of the NIST-STS test after post-processing. The NIST-STS includes 15 terms and respective test results, each with a p-value. For the sub-tests with multiple p-values, a Kolmogorov-Smirnov (KS) test is performed to obtain final p-value. It is considered successful for certain sub-test if the final p-value is between $[0.01,0.99]$ and the success proportion is between $[0.9778,1]$ (significance level $\alpha =0.01$). The length of test sequence is 420 Mbits.

Statistical Test	p-Value	Proportion	Result
Frequency	0.372076	597	Success
Block Frequency	0.292462	596	Success
Cumulative Sums	0.045724[KS]	590	Success
Runs	0.294970	593	Success
Longest Run	0.940051	592	Success
Rank	0.316426	595	Success
FFT	0.959554	590	Success
Non-overlapping	0.743782[KS]	595	Success
Overlapping	0.065969	596	Success
Universal	0.494772	598	Success
Approx. Entropy	0.908376	596	Success
Excursions	0.558001[KS]	593	Success
Excursions Var.	0.032325[KS]	590	Success
Serial	0.225053[KS]	592	Success
Complexity	0.869431	595	Success

.

4. Conclusions

We proposed and experimentally realized a QRNG scheme utilizing quantum noise from phase fluctuation of laser diode with a novel structure. Optical signals from two laser diodes with very close center wavelength interfere at a beam splitter before detected by AC coupling photo-detectors. Electric signals from two detectors did frequency mixing with a mixer. After analyzing the frequency components, we pointed out there are three dominating frequency terms in the noise: difference of the center wavelength of laser, phase fluctuation of laser, and fiber jitter of the system. Due to the different frequency range between these components, we found it possible to substantially eliminate the unexpected terms by a well selected band-pass filter, before extracting randomness with the phase noise term. We use two conventional post-processing methods, the m-least significant bit method (m-LSB) and universal (Toeplitz) hashing method, to distill randomness from electric signal, and realize a generation rate of 600 Mb/s on hardware, which is six times higher than the sampling rate.

Our scheme has three major merits. Firstly, the structure of our scheme is delay-line free, which means the space for delay-line in practical system could be removed. Secondly, the requirement for laser diode is not so strict. One only need to make sure the center wavelength of lasers are close enough, and work with a power stabilization module, instead of a possible frequency stabilization module. Thirdly, the post-processing methods, either m-LSB or universal hashing method, can be realized on hardware in real-time. These merits make our scheme highly potential as a compact QRNG system.

We should admit that the generation rate in our scheme is relatively low in contrast to current schemes. However, this is due to building our scheme in a very conservative way and this work is just a demonstration. The bandwidth of photo-detectors and the sampling rate are both set at 100 MHz, where devices used in major schemes of phase noise are one or two orders of magnitude higher than this value. Since the generation rate is mainly limited by the detectors, it still have huge space to improve. In fact, our colleagues have realized balanced detectors with bandwidth over 1 GHz [55]. By utilizing this technique, the generation rate of our scheme is highly potential to be increased to 6 Gbps, which is the level the other QRNG scheme based on vacuum fluctuation proposed before [44]. Furthermore, the corresponding post-processing method can also be more efficient, including carefully setting the driven current of laser diode to achieve a higher quantum-to-classical noise ratio, which could lead to an even tighter upper bound of min-entropy in Toeplitz hashing method.