Practical Security of Continuous Variable Measurement- Device-Independent Quantum Key Distribution with Local Local Oscillator

Abstract

Continuous-variable (CV) measurement-device-independent (MDI) quantum key distribution (QKD) can remove the feasible side-channel attacks on detectors based on the accurate Bell-state measurement (BSM), where an optical amplitude modulator (AM) plays a crucial role in managing the intensity of the transmitted light pulse. However, the AM-involved practical security has remained elusive as the operating frequency of the AM usually determines the actual secret key rate of the CV-MDI-QKD system. We find that an imperfect pulse generated from the AM at high speed can lead to a challenge to the practical security as a minor intensity change of the light pulse can bring about a potential information leakage. Taking advantage of this flaw, we suggest an attack strategy targeting the embedded AM in CV-MDI-QKD without sending the local oscillator (LO). This attack can damage the AM and thus decrease the estimated secret key rate of the system even when the orthogonal local LO (LLO) scheme is carried out. To assess the practical security risk resulting from the leaked information from the AM, we conduct numerical simulations to demonstrate the influence of the AM on the CVMDI-QKD system.

1. Introduction

Quantum key distribution (QKD), which utilizes the physical characteristics of tangible particles as carriers to generate a secure one-time-pad (OTP), is a promising approach for transmitting secure messages [1]. There are many QKD protocols, which can be divided into two groups, i.e., discrete variable (DV) QKD and continuous variable (CV) QKD [2]. DVQKD employs the photons or weak coherent pulses encoded in discrete variables [3], whereas CVQKD encodes information on the quadratures x and p of light pulses, representing the amplitude and phase of an electromagnetic wave [4]. CVQKD offers an advantage in practicality: compatibility with the standard optical telecommunication network. It exhibits a tolerance to channel loss and noise; hence, it is much reliable than DVQKD [5]. However, the gap between experimental models and practical devices opens feasible loopholes in practical security, leading to the potential for attacks.

When implementing CVQKD, the sender may transmit quantum signals combined with a local oscillator (LO) to achieve a suitable phase reference for perfect detections [6]. The propagation of an LO between the sender and the receiver is a necessary factor to achieve the shot noise limit for the amplitude, phase, and timing measurements of optical signals, which is robust against noise photons in some kinds of quantum channels [7]. However, the transmitted LO (TLO) in a traditional scheme may have security loopholes as it must be brighter than quantum signals due to the shot-noise-limited demand for the homodyne detector [8], which may leak a considerable number of photons to quantum signals. In order to solve the problem of the TLO problem, the local LO (LLO) [9], which is generated locally at the reception, has been suggested to shut the LO security loophole [10]. Then, TLO attacks are considered mitigated in an LLO-based scheme [11]. Consequently, the LLO has been widely exploited in both experiments and implementations to eliminate potential attacks [12,13]. However, the reliable photon leakage in source preparation is another challenge.

Inspired by the entanglement swapping in CV circumstances, MDI-QKD has been proposed to prevent the feasible issues related to the side channel attack of measurement apparatus [14]. This is an elegant modification of the CVQKD approach, introducing an untrusted third participant, Charlie, who conducts a joint measurement on the CV quantum signals transmitted by two participants, called Alice and Bob. They both ensure the security of the transmitted quantum signals by verifying the consistency of their datum according to Charlie’s announcements. CV-MDI-QKD presents an advantage since it introduces device-independent security, eliminating trust of Charlie’s detectors [15]. Because of the key negotiation being independent of measurement equipment, it can resist side channel attacks against measurement equipment [16]. Currently, the performance of the CV-MDI-QKD system has been improved [17,18]. However, practical devices such as the AM embedded in the transmitter for source preparation can still become a target of an assault, from which an attacker can achieve the secure key shared between Alice and Bob illicitly, thus jeopardizing practical security.

As a characterization describing the performance improvement of the CVQKD system, researchers have usually focused on increasing the secret key rate. The high-speed AM has been proven to be effective in implementations [19]; hence, it has been used as a promising and practical choice for conducting high-rate CVQKD [20]. However, we find the practical AM at high-speed modulation sometimes behaves different than anticipated from experiments, and hence a challenge may arise from the AM embedded in CV-MDI-QKD. For example, when the AM generates light pulses, the imperfect light pulses consist of leaked light with lower energy and information light with higher energy, which might produce extra noise, potentially providing additional information, thus potentially leading to information leakage [21]. If an attacker can understand the patterns or inefficiencies of the employed AM, they may take advantage of this side channel information to launch feasible attack strategies [22]. As an example, in a Trojan horse attack, the attacker sends a bright light pulse into the transmitter and analyzes the reflected light pulse to learn about the measurement settings [11,23]. This may enable an eavesdropper to perform a sophisticated attack to weaken the practical security. Regarding the feasibility of eavesdropping on CV-MDI-QKD, Eve mounts an assault on the laser beam of the AM, in which it causes a permanent change in its optical properties, but, overall, it leads to the optical attenuators within the system failing to meet the requirements of theoretical security [22]. Despite the theoretical security proof of CV-MDI-QKD, its practical implementation still exhibits such vulnerabilities. We find that the AM under the high-speed modulations may be susceptible to passive attacks when Eve intercepts information on quantum channels, eavesdropping on the secure key shared between Alice and Bob [18]. The success of this attack essentially exploits the imperfections of the AM within the participants, especially the nonideal characteristics under specific conditions [24,25]. It is more covert as it does not directly assault the devices embedded in CV-MDI-QKD, avoiding causing abnormal system features.

Motivated by the vulnerability of the AM together with the feasible attack strategy, this paper proposes an AM attack scheme taking into account the imperfect devices for quantum state preparation in CV-MDI-QKD. This scheme can cause legitimate participants to overestimate the secret key rate, thus creating an opportunity for the attacker to steal the leaked key information. We focused on the high-speed AM because it is crucial to elevating the secure key rate while keeping the distance constant. Our research indicates that the AM usually generates imperfect light pulses under high-speed modulations. The experimental result shows that these deviant light pulses from the output of the high-speed AM consist of leaked light with lower energy and information light with higher energy. While the participants encode both types of light pulses and transmit them to Charlie, the leaked light could betray legitimate participants, enabling Eve to steal secure key information. To assess practical security, we conducted numerical simulations to examine the impact of the AM on the CV-MDI-QKD system. They indicate that in high-speed modulation, the risk of information leakage expands with the increase in the transmission distance.

This paper is organized as follows: In Section 2, we describe the structure of the LLO-based CV-MDI-QKD protocol and the orthogonal LLO scheme. In Section 3, we show the noise model and then the LLO structure in order to demonstrate an effect of the AM on the performance of the CV-MDI-QKD system. In Section 4, we show trhe performance of the LLO-based CV-MDI-QKD system. Moreover, we performed numerical simulations to demonstrate its implementation feasibility in experiments. Finally, the conclusions are drawn in Section 5.

2. LLO-Based CV-MDI-QKD

The LLO-based CV-MDI-QKD system was designed with the embedded AM for source preparations. The CV-MDI-QKD protocol is described at first, and then the LLO scheme is presented with the orthogonal transformation.

2.1. CV-MDI-QKD Embedded with AM

The configuration of CV-MDI-QKD embedded with an AM is shown in Figure 1. To begin, two participants, Alice and Bob, use their continuous-wave lasers together with the AM for pulse modulations to produce coherent state pulses $|{\alpha }_{sr}^A\rangle$ and $|{\alpha }_{sr}^B\rangle$, which are denoted by $|{\alpha }_{sr}^{\mu }\rangle$, $\forall \mu \in \{A,B\}$. Then, they use beam splitters (BSs) to split the resulting pulses into two portions, $|{\alpha }_r^{\mu }\rangle$ and $|{\alpha }_s^{\mu }\rangle$, $\forall \mu \in \{A,B\}$, respectively. One pulse, called the weak signal pulse $|{\alpha }_s^{\mu }\rangle$, is employed as an input of the other amplitude modulator (AM), which is then followed by the phase modulator (PM). The AM and the PM are both modulated according to the Gaussian distribution, with the optimized variances given by $V_{\mu }$, $\forall \mu \in \{A,B\}$. After using suitable variable optical attenuators (VOAs) to attenuate the intensity of the signal pulse, we obtain the resulting Gaussian-modulated coherent state (GMCS) $|X_{\mu }+i{P}_{\mu }\rangle$, $\forall \mu \in \{A,B\}$. The other pulse, called the strong reference pulse $|{\alpha }_r^{\mu }\rangle$, is delayed and separated from the weak signal pulse. This pulse is also suitably attenuated by the other VOA to generate an optimal intensity, which is then isolated from the weak signal pulse by using a polarization beam splitter (PBS). The combined pulses are all transmitted to Charlie.

Meanwhile, an intermediator Charlie produces another optical pulse $|{\beta }_{sr}\rangle$, which is the reference (LO) pulse split into two pulses $|{\beta }_{sr}^{\mu }\rangle$, i.e., $|{\beta }_{sr}^A\rangle$ and $|{\beta }_{sr}^B\rangle$, by using a 50:50 beam splitter (BS) to couple the received states from Alice and Bob. Subsequently, $|{\beta }_{sr}^{\mu }\rangle$ can be split into two pulses, $|{\beta }_s^{\mu }\rangle$ and $|{\beta }_r^{\mu }\rangle$. The signal pulse $|{\alpha }_s^{\mu }\rangle$ and the reference (LO) pulse $|{\beta }_s^{\mu }\rangle$, which are all delayed by using delay fibers, are simultaneously sent to a heterodyne detector, from which the raw key can be obtained. Meanwhile, the remaining $|{\beta }_r^{\mu }\rangle$ and $|{\alpha }_r^{\mu }\rangle$ are transmitted to another heterodyne detector for measurements, from which the phase drift can be estimated. After that, the derived phase is elegantly used for compensation of the transmitted quantum signals, from which the secret key is obtained.

As for the Bell-state measurement (BSM) of two independent quantum states, Charlie uses balanced homodyne detectors (BHDs) to measure the amplitude quadrature $x_C$ and phase quadrature $p_C$, which can be derived as $x_C=(x_A-x_B)/\sqrt{2}$ and $p_C=(p_A+p_B)/\sqrt{2}$, respectively. Charlie announces the measurement results $(x_C+i{p}_C)/\sqrt{2}$. Subsequently, Alice and Bob displace their respective raw datum as ${\widehat{x}}_{\mu }=x_A-d_x^{\mu }\left(r\right)$ and ${\widehat{p}}_{\mu }=p_{\mu }-d_p^{\mu }\left(r\right)$, where $d^{\mu }\left(r\right)$ is a displacement operation.

2.2. LLO Scheme with Orthogonal Block Transformation

A challenge with CV-MDI-QKD is coupling independent quantum signals while performing the BSM at Charlie’s station, where the precise regulation of the relative phase between the received signal pulse and the locally produced reference pulse ( LO) is required.

As shown in Figure 2, Alice (or Bob) generates a sequence of coherent states, which involves the signal pulse and pilot pulse with an interval given by $1/f$. The signal pulse is denoted by $S^{{\mu }_i}$, $\forall \mu \in \{A,B\}$, and $i\in \{1,2,\cdots ,M\}$, and the pilot pulse is represented by $R^{{\mu }_i}$, $\forall \mu \in \{A,B\}$, and $i\in \{1,2,\cdots ,M\}$, respectively. Both $S^{{\mu }_i}$ and $R^{{\mu }_i}$ are performed with the orthogonal block transformation, which is also called as the signal–pilotmultiplexed block scheme, before being transmitted. The orthogonal polarization channels are thus occupied to transmit the signal pulse and the pilot pulse simultaneously in order to resist phase noises.

At Charlie’s station, the signal pulse and the pilot pulse are generated from the same coherent state pulse. Charlie generates a reference (LO) pulse with the same interval as that of Alice and Bob, given by $1/f$. The signal and pilot pulses can be simultaneously regulated, which are accurately aligned with the reference (LO) pulse. Subsequently, Charlie’s reference (LO) pulse is split into two equivalent pulses, which are aligned with the respective signal pulse and pilot pulse of Alice (Bob). After performing the heterodyne detection, the raw key can be derived from the BSM of the interfered signal pulses, and the phase estimation is synchronously achieved from the BSM of the pilot pulses.

The proposed orthogonal signal–pilotscheme can be designed with the orthogonal block transformation. The signal–pilotsequence pulse, denoted by $\tau =(S_i^{\mu },R_i^{\mu })$, can be encoded as follows:

$$\nu =H·\tau ,$$

(1)

where H denotes an orthogonal block transformation. For example, we take a Pauli matrix ${\sigma }_x=\left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right)$ encoding the $(i-1)$-th and the i-th pulses, from which we have

$$\left(\begin{array}{cc}{S}_{i-1}^{\mu }& S_i^{\mu }\\ R_{i-1}^{\mu }& R_i^{\mu }\end{array}\right)={\sigma }_x·\left(\begin{array}{cc}{S}_{i-1}^{\mu }& R_{i-1}^{\mu }\\ S_i^{\mu }& R_i^{\mu }\end{array}\right).$$

(2)

In this LLO scheme, since the signal pulse and the pilot pulse are all produced from the same laser at the same time, we can achieve the same phase ${\theta }_{sr}^{\mu }$ for the signal pulse and the pilot pulse. After being modulated, the signal pulse has an optical phase ${\theta }_m^{\mu }$. However, we assume the signal pulse and the pilot pulse are both transmitted simultaneously through two different paths, even though they are orthogonal channels. The delayed pulse is dealt with using an accumulated phase ${\theta }_{\mu }$. As for the LO generated by Charlie, the adjacent LO pulses are generated simultaneously with the same optical phase ${\theta }_{sr}^C$. Correspondingly, the LO path is delayed with the accumulated phase ${\theta }_{\mu }^D$. Consequently, the phase measurements of $S_i^{\mu }$ and $R_i^{\mu }$ are achieved, respectively, as

$$\begin{array}{cc}\hfill {\theta }_{s,i}^{\mu }& ={\theta }_{sr}^{\mu }+{\theta }_m^{\mu }-{\theta }_{sr}^C,\hfill \\ \hfill {\theta }_{r,i}^{\mu }& ={\theta }_{sr}^{\mu }+{\theta }_m^{\mu }+{\theta }_{\mu }-{\theta }_{sr}^C-{\theta }_{\mu }^D.\hfill \end{array}$$

(3)

The phase drift compensation is aimed at the phase drift between the two lasers of Alice and Bob. After performing this compensation, we obtain the corrected quadratures $x_i^{\prime }$ and $p_i^{\prime }$ that can be used for key distillation. As the phase ${\theta }_m^{\mu }$ in Equation (3) is originally modulated for source preparation, we obtain the relative phase drift ${\varphi }_{s,i}^{\mu }$ as follows:

$$\begin{array}{c}\hfill {\varphi }_{s,i}^{\mu }={\theta }_{s,i}^{\mu }-{\theta }_m^{\mu }={\theta }_{r,i}^{\mu }+\mathrm{∆}{\theta }_{\mu },\end{array}$$

(4)

where $\mathrm{∆}{\theta }_{\mu }$ is the difference between the accumulated phase of the related delay lines given by

$$\begin{array}{c}\hfill \mathrm{∆}{\theta }_{\mu }={\theta }_{\mu }^D-{\theta }_{\mu }.\end{array}$$

(5)

Because of the equivalent delay of both delay lines, we have the theoretical result ${\theta }_{\mu }^D={\theta }_{\mu }$; thus, $\mathrm{∆}{\theta }_{\mu }=0$. Consequently, we can make use of ${\theta }_{s,i}^{\mu }$ to remap the quadratures x and p of the received quantum signal pulse due to the straightforward equivalence between ${\varphi }_{s,i}^{\mu }$ and ${\theta }_{s,i}^{\mu }$.

In the initial phase, we obtain $\mathrm{∆}{\theta }_{\mu }=0$ in the theoretical derivation while adjusting the accuracy of the length of the delay lines of Alice (Bob) and Charlie. Unfortunately, it is difficult to prevent the optical path from fluctuating. Therefore, the parameter $\mathrm{∆}{\theta }_{\mu }$ is kept a constant only for a short duration in a practical scenario, which needs a real-time calibration.

According the relative phase drift ${\varphi }_{s,i}^{\mu }$ in Equation (4), we can obtain the phase drift, which can be divided into fast drift ${\theta }_{r,i}^{\mu }$ and slow drift $\mathrm{∆}{\theta }_{\mu }$. The fast drift compensation can be performed with the fast drift between Alice’s (Bob’s) and Charlie’s lasers. Subsequently, compensation of the phase of the pilot pulse ${\theta }_{r,i}^{\mu }$, which is used to monitor the fast drift of the signals, can be conducted as follows:

$${\widehat{x}}_{s,i}^{\mu }=x_{s,i}cos{\theta }_{r,i}^{\mu }-p_{s,i}sin{\theta }_{r,i}^{\mu },{\widehat{p}}_{s,i}^{\mu }=x_{s,i}sin{\theta }_{r,i}^{\mu }+p_{s,i}cos{\theta }_{r,i}^{\mu }.$$

(6)

To estimate the slow drift $\mathrm{∆}{\theta }_{\mu }$, Alice (Bob) transmits the signal pulse and the phase reference pulse that were generated with an identical optical phase. After Charlie performs the heterodyne detection and obtains the phase shift for each pulse from the amplitude quadrature $x_{r,i}^{\prime \mu }$ and the phase quadrature $p_{r,i}^{\prime \mu }$ of the M reference pulses, $i\in \{1,2,\cdots ,M\}$, corresponding to the initial quadrature $x_{r,i}^{\mu }$ and $p_{r,i}^{\mu }$, the parameter $\mathrm{∆}{\theta }_{\mu }$ can be estimated as

$$\mathrm{∆}{\theta }_{\mu }={\displaystyle \frac{1}{M}}\sum _i[arctan({\displaystyle \frac{p_{r,i}^{\mu }}{x_{r,i}^{\mu }}})-arctan({\displaystyle \frac{{p^{\prime }}_{r,i}^{\mu }}{{x^{\prime }}_{r,i}^{\mu }}})],$$

(7)

where M is the number of the revealed pairs. Then, the compensation based on the slow drift of the signal pulse is obtained as

$${\tilde{x}}_{s,i}^{\mu }=x_{s,i}^{\prime }cos\mathrm{∆}{\theta }_{\mu }-p_{s,i}^{\prime }sin\mathrm{∆}{\theta }_{\mu },{\tilde{p}}_{s,i}^{\mu }=x_{s,i}^{\prime }sin\mathrm{∆}{\theta }_{\mu }+p_{s,i}^{\prime }cos\mathrm{∆}{\theta }_{\mu }.$$

(8)

Actually, Charlie can estimate the phase drift of the signal pulse with the adjacent pilot phase based on the interference measurements. As shown in Figure 2b, the ith signal pulse $S_i^{\mu }$ is located between two pilot pulses $R_{i-1}^{\mu }$ and $R_i^{\mu }$, and thus the approximate phase drift of the signal pulse ${\theta }_{s,i}$ can be estimated from the phases of $R_{i-1}^{\mu }$ and $R_i^{\mu }$ as follows:

$${\widehat{\theta }}_{s,i}^{\mu }={\displaystyle \frac{{\theta }_{r,i-1}^{\mu }+{\theta }_{r,i}^{\mu }}{2}},$$

(9)

where ${\widehat{\theta }}_{s,i}^{\mu }$ represents the phase drift estimator of the ith signal pulse, while ${\theta }_{r,i}^{\mu }$ denotes the phase of the reference pulse $R_i^{\mu }$. Based on the derived estimator ${\widehat{\theta }}_{s,i}^{\mu }$, the raw measurements of quadratures x and p can be described as [9]

$${\overline{x}}_{s,i}^{\mu }=x_{s,i}cos{\widehat{\theta }}_{s,i}^{\mu }-p_{s,i}sin{\widehat{\theta }}_{s,i}^{\mu },{\overline{p}}_{s,i}^{\mu }=x_{s,i}sin{\widehat{\theta }}_{s,i}^{\mu }+p_{s,i}cos{\widehat{\theta }}_{s,i}^{\mu }.$$

(10)

After that, the obtained quadratures $x^{\prime }$ and $p^{\prime }$ can be used for distilling the secure keys.

3. Noise Analysis

The excess noise is a crucial parameter for the performance estimation of CV-MDI-QKD. As controlling excess noise can increase the performance of the system, the noise model was established to show the effect of the AM on the LLO-based CV-MDI-QKD system. We considered the phase noise and the photon-leakage noise, because both of them may undermine the main performance of the CV-MDI-QKD system.

3.1. Phase Noise

According to the phase noise denoted by ${\epsilon }_{\theta }$ in CV-MDI-QKD, we have [9]

$${\epsilon }_{\theta }=2V_m^{\mu }\left(1-e^{-{\displaystyle \frac{V_{\theta }}{2}}}\right),$$

(11)

where $V_m^{\mu }$ is the variance of modulation for $\forall \mu \in \{A,B\}$. In addition, $V_{\theta }$ is the variance of phase noise, which can be given by

$$V_{\theta }=var\left({\theta }_s-{\widehat{\theta }}_s\right),$$

(12)

where ${\theta }_s$ is the initial phase, and ${\widehat{\theta }}_s$ is the estimated phase of the quantum signal pulse.

In compensation, the derived data $x_i$ and $p_i$ are required to transform with the phase drift ${\theta }_{s,i}^{\mu }$. However, the derived estimator, such as ${\widehat{\theta }}_{s,i}^{\mu }$ in Equation (9), has estimation error from time to time, leading to unavoidable phase noise in practice. Her, we treat this error as an imperfection of compensation.

In the orthogonal LLO-based CV-MDI-QKD, the signal pulse and the pilot pulse are simultaneous lytransmitted through the same orthogonal channels, thus avoiding the effect of phase noise on channel fluctuation. Based on the phase drift $V_{\mathrm{∆}\theta }$ between the signal pulse and the pilot pulse, the phase noise is derived as

$$V_{{\theta }_{s,i}^{\mu }}=V_{\varphi }+V_{ϵ},$$

(13)

where $V_{\varphi }$ denotes the intrinsic phase noise, and $V_{ϵ}$ represents the noise due to the measurement error of the pilot phase. Since the signal pulse is generated before the pilot pulse with a time $1/f$, the uncertainty of the relative phase drift causes an intrinsic phase noise given by

$$V_{\varphi }=2\pi (\delta v_{\mu }+\delta v_C)/f,$$

(14)

where $\delta v_{\mu }$ and $\delta v_C$ correspond to the line width of the lasers. It implies that $V_{\varphi }$ depends on the line width of the lasers when it comes to the pulse interval. As the pilot pulse and the signal pulse are generated simultaneously by Alice or Bob from the same laser, we have $V_{\varphi }=0$. Additionally, the pilot-involved LLO scheme suffers from measurement inaccuracy in the pilot phase, given by

$$V_{ϵ}=(\chi +1)/{\left|\alpha \right|}^2,$$

(15)

where ${\left|\alpha \right|}^2$ denotes the amplitude of the transmitted pilot pulse, and $\chi$ is the total noise resulting from the quantum system, which is given by

$$\chi ={\displaystyle \frac{2-\mu T}{\mu T}}+{\displaystyle \frac{2v_{\mathrm{el}}}{\mu T}}.$$

(16)

Here, the foregoing part is the loss-involved vacuum noise, and the following part is the electronic noise resulting from the heterodyne detection.

Consequently, when we employ the intense pilot pulse to suppress the phase noise occurring in BSM with imperfect phase compensation, the phase noise can be estimated as follows:

$${\epsilon }_{\theta }\simeq V_m^{\mu }{V}_{{\theta }_{s,i}}=V_m^{\mu }{V}_{ϵ},$$

(17)

where the deviation of ${\widehat{\theta }}_{s,i}^{\mu }$ is usually taken as a small value.

3.2. Photon Leakage Noise

Because the photons that come from the pilot pulse have the same frequency as that of the signal pulse, the leaked photons in CV-MDI-QKD may cause additional noise. As a result, we cannot ignore the effect of photon leakage on the CV-MDI-QKD system.

Taking the proposed LLO scheme into account, both Alice and Bob produce the pilot pulse and the signal pulse with Gaussian modulation, which are all transmitted to Charlie.

In the orthogonal LLO scheme, although the signal pulse and the pilot pulse are arranged in orthogonal directions, there are still some residual photons in the pilot pulse that may make incursions into the signal pulse. The resulting photon leakage noise is given by

$${\epsilon }_{\ln }=2{\left|\alpha \right|}^2/R_e,$$

(18)

where $R_e$ is the finite extinction ratio. It is the ratio of the high level and the low level of the signal pulse, which is calculated as

$$R_e=I_1/I_0,$$

(19)

where the optical power $I_1$ can be the transmitted signal pulse, and the optical power $I_0$ can be of lower power in an interval.

As for the photon-leakage noises at Alice and Bob’s station, the signal pulse and the pilot pulse are rightly arranged in orthogonal directions, and thus there is no photon leakage happening in the orthogonal LLO scheme. The imperfect operation in this scheme lies in the polarization beam splitter (PBS), which can be used to recover the signal pulse and pilot pulse pulses received at Charile’s station. Because of effect of the finite polarization extinction ratio $R_p$ of the PBS, there are still a few residual photons leaked from the pilot pulse to the signal pulse. Therefore, in order to describe the photon-leakage noise in the orthogonal LLO scheme, we have to consider the the finite polarization extinction ratio $R_p$ resulting from the pilot pulse. Namely, we obtain the derived photon leakage noise as follows

$${\epsilon }_{\ln }=2{\left|\alpha \right|}^2/(R_e+R_p).$$

(20)

4. Performance Analysis

The challenge of CV-MDI-QKD is obtaining the BSM of the received quantum signals at Charlie’s station, where the precise regulation of the relative phase between the signal and reference pulses is necessary with the phase drift when considering the relation of Alice’s (Bob’s) signal pulse and Charlie’s LO pulse. It involves fast phase drift and slow phase drift. Fast phase drift is caused by the frequency difference between the lasers, together with their channels from Alice (Bob) to Charlie. Slow phase drift comes from the BSM in time multiplexing. In what follows, we consider the performance of the system taking into account theeffect of the AM employed by Alice and Bob for pulse modulations.

4.1. AM Information Leakage

The secret key rate of CV-MDI-QKD often aligns with the lowest-frequency optical component involved in the encoding procedure. It is usually combined with the maximal quantum bit information that Alice and Bob can distill in a given unit of time. As an example, if Bob’s detection frequency is in the gigahertz range, whereas Alice’s modulation frequency is in the hundred-megahertz range, the overall system frequency is limited to the hundred-megahertz range. Therefore, all devices in the whole system should be properly designed to meet the exact requirements of the modulation frequency in the gigahertz range.

Unfortunately, the imperfect AM embedded in the transmitter may have a few security vulnerabilities due to the intrinsic defects of devices. In our experiments, we examined the modulation frequencies of the AM, as shown in Figure 1, for the pulse modulation before performing source preparation in CV-MDI-QKD.

In order to evaluate the effectiveness of the frequency, we observed the experimental results of the AM, which were modulated with the tunable frequencies for pulse modulations in CV-MDI-QKD. We found that for the low frequencies in pulse modulation of less than 1 GHz, the output pulse light appeared smooth and exhibited only a single peak. However, for the high frequency of 1 GHz, there were two adjacent pulses occurring in the output. According to the areas under the curves, the energy of the first red small pulse was close to half of the energy of the second green pulse. It is notable that in the high-speed AM-embedded CV-MDI-QKD system, the red pulse was still in a Gaussian-modulated coherent state (GMCS). Therefore, when conducting high-speed modulation for pulse modulation before source preparation, the appearance of the red pulse implies a risk of information leakage, opening up a potential security vulnerability in practical CV-MDI-QKD systems.

4.2. Security Analysis

The theoretical security of the system is usually analyzed using the entanglement-based (EB) scheme description, which is equivalent to the prepare-and-measure (PM) scheme used in an actual experiment [26]. In this section, we show the practical security of the AM-embedded CV-MDI-QKD system when considering the finite-size effects [27,28].

4.2.1. Derivation of the Secret Key Rate

Two legitimate participants, Alice and Bob, are expected to establish a secure key in CV-MDI-QKD. Each of them has a set of the AM-embedded equipment for preparing the GMCS. The AM can be used for the pulse modulations while attenuating the intensity of the light pulses before being split into the signal pulse and the reference pulse. It ensures the resulting light pulse meets the theoretically dictated safe intensity range of the system. There is an untrusted relay, Charlie, who performs a joint measurement on the received light pulses from Alice and Bob. In the EB scheme, both Alice and Bob generate a pair of dual-mode squeezed states with variances $V_A$ and $V_B$, respectively. Unfortunately, an imperfect AM can become the target of Eve’s attack because of pulse leakage. By combining the AM-involved attack with other attack strategies (such as the intercept-resend attack), Eve can steal the leaked information, jeopardizing the practical security of the CV-MDI-QKD system.

According to the finite-size effect, we have the secure key rate as follows [29]:

$$K={\displaystyle \frac{n}{N}}[\beta I_{AB}-{\chi }_{BE}-\delta \left(n\right)],$$

(21)

where n is the number of photons used for key distillation, N is the total size of the block, and $\beta$ is the parameter for efficiency description in reverse reconciliation. Moreover, the first term $I_{AB}$ is the Shannon mutual information between Alice and Bob, the second term ${\chi }_{BE}$ is the maximal value of the Holevo information, and the last term $\delta \left(n\right)$ depends on the privacy amplification. The derivation of the secret key rate under the finite-size effect is shown in Appendix A. In what follows, we delve into the attack strategy when considering the effect of information leakage on the secret key rate of the system.

Before starting the security analysis, we show the impact of the attack on the parameters of the above-derived secret key rate. In a scenario with Eve implementing an attack on the AM of the practical system, the decrease in the attenuation ability of the AM leads to a decrease in the intensity of the signal light pulse, which in turn results in a decrease in the variance of the transmitted GMCS. Let the modulation variance of Alice (or Bob) be changed from $V_{\mu }$ to $V_{\mu }^{\prime }$, $\forall \mu \in \{A,B\}$. However, during the derivation of the secret key rate for both participants, they do not notice the change in variance, and thus they use the incorrect modulation variances to estimate the secret key rate. In addition, during this process, because of the errors occurring in the variances, the transmittance $T_{\mu C}$ and the excess noise $ϵ$ of the quantum channel are also underestimated as $T_{\mu C}^{\prime }$ and ${ϵ}^{\prime }$, respectively. Therefore, the secret key rate can be incorrectly estimated as

$$K_{\mathrm{e}}=K(V_A,V_B,T,ϵ),$$

(22)

where the parameters T and $ϵ$ are given by

$$\begin{array}{cc}\hfill T& ={\displaystyle \frac{T_{AC}{V}_B}{T_{BC}(V_B+2)}}\hfill \\ \hfill ϵ& ={\displaystyle \frac{T_{BC}\left({ϵ}_{BC}-2\right)+2}{T_{AC}}}+{ϵ}_{AC}.\hfill \end{array}$$

(23)

However, the actual key rate using the correct parameters should be

$$K_{\mathrm{c}}=K(V_A^{\prime },V_B^{\prime },T^{\prime },{ϵ}^{\prime }),$$

(24)

where the parameters $V_A^{\prime }$, $V_B^{\prime }$, $T^{\prime }$, and ${ϵ}^{\prime }$ are given by

$$\begin{array}{cc}\hfill & V_A^{\prime }=g{V}_A,V_B^{\prime }=g{V}_B,\hfill \\ \hfill & T^{\prime }={\displaystyle \frac{g{T}_{AC}{V}_B}{T_{BC}(g{V}_B+2)}},\hfill \\ \hfill & {ϵ}^{\prime }={\displaystyle \frac{T_{BC}}{T_{AC}}}({\displaystyle \frac{{ϵ}_{BC}}{g}}-2)+{\displaystyle \frac{{ϵ}_{AC}}{g}}+{\displaystyle \frac{2}{g{T}_{AC}}}.\hfill \end{array}$$

(25)

The above-derived parameters play a major role in influencing the practical security of the attacked CV-MDI-QKD system. Subsequently, we considered the effect of the leakage attack on the secret key rate through numerical simulations.

4.2.2. Numerical Simulations

The secret key rate can be obviously boosted by increasing the repetition rate of the system, where the embedded AM plays an important role in pulse modulations [9]. In what follows, we continue to demonstrate the practical security through simulating the effect of the AM on the system.

In order to illustrate the performance of the CV-MDI-QKD system when performing the AM-involved attack strategy, we set a series of parameters for numerical simulations. For example, we took the attenuation coefficient of a standard fiber link as $0.2$ db/km, the detection efficiency $\eta =0.5$, the electronic noise of the imperfect heterodyne detector $v_{el}=0.05$, and the reconciliation efficiency $\beta =0.95$. Moreover, we assumed the intensity of the phase reference $E_R^2=1000$, the number of the ADC quantization $n_{\mathrm{ADC}}=10$, the AM dynamics $d_{dB}$ = 40, and the finite extinction ratio $R_e$ = 40 dB and $R_p$ = 30 dB, respectively.

In Figure 3, we depict the relationship of the secret key rate and the transmission distance for the CV-MDI-QKD system under leaked information. The parameters for numerical simulations were set to $V_A=V_B=4$, $ϵ={10}^{-10}$, and $N=7\times {10}^9$. The nonsecure region was derived from the differential equation $K_e-K_c$, where $K_e$ is the theoretical key rate in Equation (22), and $K_c$ is the actual key rate in Equation (24). This region is located between the red curve and the blue curve shown in Figure 3. It also indicates the leaked information that Eve could steal from the CV-MDI-QKD system without being discovered by legitimate participants. When the actual secret key rate falls under the insecure region, it is trustworthy, even in the presence of half of the information leakage due to the AM of 1 GHz. The secret key rate of the CV-MDI-QKD system falls within the not-secure region only when the leaked information is present and is not detected by the system. This implies that the leaked light pulse could open security vulnerabilities, allowing Eve to acquire the leaked key information.The upper region signifies that if the secret key rate falls within this area, the security of the secret key rate is compromised, irrespective of issues with the leaked light pulse. The unsecure region indicates the leaked information that Eve could use to steal the secure key from the system without being discovered by legitimate participants. Moreover, it is noted that the misestimated secret key rate increases together with the degree of being misestimated as Eve’s attack intensity increases, according to an increase in the area between the correct key rate curve and the misestimated key rate curve. It means that as the attack intensity increases, Eve can steal more key information, making the attack strategy much more effective.

While considering effect of the LLO scheme on the system, we examined the secret key rate in a scenario while using the orthogonal LLO scheme ($K_{OC}$), which we compared with the sequential LLO scheme ($K_{SC}$) and the TLO scheme ($K_{TC}$), as shown in Figure 4. We found that the orthogonal LLO scheme performed better than the other schemes because of the impact of the excess noise of the channels. The effect of excess noise is shown in Figure 5 with the orthogonal LLO scheme with excess noises ${ϵ}_{AC}={ϵ}_{BC}=0.01$ or ${ϵ}_{AC}={ϵ}_{BC}=0.05$. Though the LLO scheme can be performed for the isolation of the signal pulse and the reference pulse through optical channels, there is still excess noise generated on Charlie’s side. In the sequential LLO-involved system and the TLO-involved system, the increase in excess noise in the optical channels can enhance the effectiveness of the AM-involved attack, allowing Eve to steal more of the leaked information [27,28]. However, in the orthogonal LLO scheme, the increase in the excess noise in the optical channels has little effect on the secret key rate. Actually, the area of the space between the two curves does not change obviously with increasing excess noise.

When operating in practice, suitable appended apparatuses are usually expected to be equipped either for performance improvement or for protection of potential attacks. Fortunately, when performing the pulse modulation of the AM at high speed, the information leaked can be detected through experiments, which can be employed for detection of a potential attacker who attempts to steal the information from raw keys. As a countermeasure, one can make use of a fraction of the signal pulse before the AM to check the varied modulation variance $V_{\mu }$. We show the relationship between the secret key rate and transmission distance while taking into account the effect of modulation variance in Figure 6. We found that the area of the space between the two solid lines is larger than that of the space between two dashed lines. Therefore, for a larger modulation variance, the attack is more effective because of the impact of the modulation variance on the secret key rate of the system.

Following the above analysis, Eve can obtain the leaked information resulting from the imperfect AM while performing an AM-involved attack in CV-MDI-QKD. Even a slight increase in the intensity of the prepared quantum states results in a substantial overestimation of the secret key rate. Therefore, Eve may steal key information without being discovered by legitimate participants, which threatens the practical security of the system. As the intensity of the attacked light pulse increases, the effectiveness of the AM-involved attack becomes stronger, allowing Eve to steal more key information.

5. Conclusions

We proposed an LLO-based CV-MDI-QKD system with orthogonal block transformation, from which the signal pulse can be isolated from the reference pulse, and the access noise can hence be suppressed through the orthogonal channels. The noise mode in the LLO regime can be designed with the theoretical ability to analyze the performance of the CV-MDI-QKD system. In addition, we delved into the influence of the AM-induced leaked information in the CV- MDI-QKD system. The numerical simulations showed that the proposed orthogonal LLO scheme can outperform the previous LLO scheme. The findings also reveal that the leaked light pulse can result in deviations in the transmitted light pulse and thus underestimate the excess noise in optical channels. This effect causes an overestimation of the secret key rate, creating a security vulnerability to a feasible attack related to an imperfect AM. The result, particularly in the context of the high-speed modulation, contributes to understanding the AM-involved practical security and aids in the practical development of CV- MDI-QKD. Additionally, our assessment of the AM-involved leaked information shows that Alice and Bob can evaluate the parameters precisely, enabling the accurate analysis of the performance degradation in the CV-MDI-QKD system. This comprehensive understanding enhances the practical implementation ability of the CVQKD system.