Security of Optical Beam Splitter in Quantum Key Distribution

Abstract

The optical beam splitter is an essential device used for decoding in quantum key distribution. The impact of optical beam splitters on the security of quantum key distribution was studied, and it was found that the realistic device characteristics closely influence the error rate introduced by the wavelength-dependent attack on optical beam splitters. A countermeasure, combining device selection and error rate over-threshold alarms, is proposed to protect against such attacks. Beam splitters made of mirror coatings are recommended, and the variation of splitting ratio should be restricted to lower than 1 dB at 1260–1700 nm. For the partial attack scenario where the eavesdropper attacks only a portion of the quantum signal, a modified secure key rate formula is proposed to eliminate the revealed information of the attacked portion. Numerical results show that the QKD system adopting this countermeasure exhibits good performance with a secure key rate of over 10 kbps at 100 km and a maximum transmission distance of over 150 km, with only a small difference from the no-attack scenario. Additionally, a countermeasure to monitor the light intensity of different wavelengths is proposed to protect against the wavelength-dependent attack on optical beam splitters.

1. Introduction

With the rapid development of quantum computing technology, the security of classical encryption systems, which are based on computational complexity, has been challenged [1,2]. Quantum key distribution (QKD) provides another secure means for confidential communication and is attracting growing interest. QKD enables two separated communicating parties to establish secure keys, which can be used for confidential communication [3]. The security of quantum key distribution is guaranteed by the basic principles of quantum mechanics [4]. Since the BB84 protocol [5] was proposed, QKD has undergone fast development. Both theoretical descriptions [6,7,8,9] and experimental techniques [3,10] have matured, gradually moving from experimental verification [11,12,13,14,15,16,17,18,19,20,21,22] to the stage of large scale application [10,23,24].

Although QKD systems based on bulky optics have shown good performance, photonic integrated circuit technology holds promise for QKD, aiming at miniaturizing the device size [25,26,27,28]. The performance of various kinds of components on chip has been verified, such as sources [29], filters [30], beam splitters [31], and modulators [32]. Based on these advances, chip-based QKD has been developing rapidly. Optical transmitters on silicon photonics has been proposed for polarization-encoding QKD [33]. Multi-protocol compatible QKD has been realized using an indium phosphide-based transmitter and a silicon oxynitride-based receiver [32]. Measurement-device-independent QKD has been demonstrated on a silicon photonic chip operating at 1.25 GHz [34]. A complete quantum secure communication system has been presented with photonic integrated circuits, both the QKD chip and the quantum random number generator chip, assembled into compact modules [35]. Field tests of QKD with silicon photonics have been demonstrated in an intercity metropolitan range [36].

QKD has theoretically been proven to be information-theoretically secure. However, practical QKD systems do not necessarily reach the security level described in theory. This is mainly due to imperfect physical properties of the devices, which do not strictly match the abstraction of the device model in the theoretical proof [6]. Such imperfections may be used to design attacks against specific systems, which are known as quantum attacks [37]. For example, time-shift attacks [37,38] and blinding attacks [39] have been developed by exploiting the imperfections of single-photon detectors. In practical QKD systems, necessary countermeasures against known quantum attacks should be involved to ensure security of the system [40].

The basic QKD system can be divided into a transmitter, which is responsible for quantum state preparation and encoding, and a receiver, which is responsible for quantum state decoding and measurement. QKD based on polarization encoding is widely used in quantum communication [11,23]. In the polarization-encoded QKD system, the transmitter can use multiple lasers to represent different polarization states [11,23], or use a single laser to encode different quantum states with an additional modulator [23], while the receiver often uses passive decoding [11,23], where an optical beam splitter (BS) is used to split the quantum signal into two paths for measurements in two conjugate bases. Therefore, beam splitters are indispensable components in QKD. Bulky beam splitters made by fused biconical taper (FBT) or mirror-coating (MC) technology are commercial off-the-shelf products, and have been widely used in optical applications. Compact beam splitters can be achieved by integrated photonics. Both directional couplers [25] and multimode interference (MMI) couplers [32,33] have been used to act as beam splitters on silicon quantum chips. Beam splitters of other structures have also attracted much attention, such as non-uniform adiabatic couplers [31], photonic crystals [41], metamaterials [42], metasurface [43,44], polymers [26,45], and so on. The ideal BS in QKD should have a constant splitting ratio independent of external conditions. However, a realistic beam splitter is usually imperfect as the splitting ratio between the two ports is wavelength-dependent [46]. Adopting this imperfection, wavelength-dependent attacks on beam splitters were proposed [46], which are able to steal some information about the key and threaten the security of the actual system.

In this paper, by carefully looking into the wavelength-dependent characteristics of beam splitters and the features of such an attack, we propose two different kinds of countermeasures against the wavelength-dependent attack on beam splitters. The first countermeasure is to detect the qubit error rate and alert when it exceeds the pre-set threshold. The second countermeasure is to monitor the input light intensity of different wavelengths. These solutions can effectively protect against wavelength-dependent attacks and enhance the implementation security for QKD systems.

2. Wavelength-Dependent Attack of Beam Splitters

We first review the wavelength-dependent attack on optical beam splitters [46]. The schematic diagram of this attack is shown in Figure 1. Near the normal wavelength of the QKD system ${\lambda }_0$, the splitting ratio of the beam splitter is very close to 50:50, i.e., the splitting ratio $r\left({\lambda }_0\right)=I_{port1}\left({\lambda }_0\right)/\left(I_{port1}\left({\lambda }_0\right)+I_{port2}\left({\lambda }_0\right)\right)=0.5$, where $I_{port1}$ and $I_{port2}$ are the intensity of the different output ports of the beam splitter. However, if deviating far from the normal wavelength, the splitting ratio may change dramatically. Without loss of generality, we assume that $r_1=r\left({\lambda }_1\right)\ge 0.5,r_2=r\left({\lambda }_2\right)\le 0.5$. The extreme case is $r\left({\lambda }_1\right)=1,r\left({\lambda }_2\right)=0$, where all incident light of wavelength ${\lambda }_1$ exits from port 1 and all incident light of wavelength ${\lambda }_2$ exits from port 2. Using this property, the following intercept-and-resend attack [46] can be designed to steal the key of the QKD system: (1) intercept the quantum signal emitted by the QKD system and randomly select the measurement basis and record the measurement results; and (2) select the attack wavelength according to the measurement basis, prepare the polarization state according to the measurement result, and then resend the signal to the QKD receiver. For example, if an eavesdropper chooses the Z basis and the measurement result is 0, then the horizontal polarized attacking signal of wavelength ${\lambda }_1$ is prepared and sent to the receiver. Due to the characteristics of the optical beam splitter, all the attacking signals go to port 1 for measurement in the Z basis, leading to a certain result of 0. In this way, the eavesdropper can control the QKD receiver to be the same as their measurement result. This kind of attack is known as the wavelength-dependent attack on optical beam splitter [46].

To achieve such an attack, stringent conditions are required. The first requirement is that the splitting ratio deviates severely from 0.5, and the ideal attack conditions are $r\left({\lambda }_1\right)=1,r\left({\lambda }_2\right)=0$. It also requires that the attacking wavelength deviates far from the normal wavelength of the QKD system. For these two conditions, we propose two kinds of countermeasures, one provides protection by error rate alerting, and the other provides protection by light intensity monitoring.

3. Countermeasure of Error Rate Alerting

In practice, the beam splitter’s splitting ratio rarely equals to 1 or 0. For a BS made by fused biconical taper (FBT) technology in Ref. [46], $r_1=r\left(1470 \mathrm{nm}\right)=0.986$, $r_2=r\left(1270 \mathrm{nm}\right)=0.003$, i.e., 98.6% of the 1470 nm light is emitted from port 1 and 99.7% of the 1270 nm light is emitted from port 2. Thus, the above attack method will introduce an increase in the error rate detected between the QKD sender and receiver. The additional error rate introduced due to the wavelength-dependent attack on optical beam splitters can be calculated by the following equation [46]:

$$e_{Err}=\frac{1}{4}\left(\frac{1-r_1}{2-r_1-r_2}+\frac{r_2}{r_1+r_2}\right),$$

(1)

Near the wavelength ${\lambda }_0$, $r_1=r_2=0.5$, the attack will cause an error rate of $e_{Err}=25\%$, which is too high to generate secure keys. In the extreme case, $r\left({\lambda }_1\right)=1,r\left({\lambda }_2\right)=0$, the introduced error rate $e_{Err}=0$, and the eavesdropper obtains the same information as the receiver. The attacker will get 100% of the key’s information. We numerically simulated the additional error rate with different beam splitting ratios and present the results in Figure 2 below. Different colors in Figure 2 indicate different error rate ranges. The gray region in the upper left corner indicates that the additional error rate introduced by the attack has exceeded 11%, which will cause the QKD system to fail to generate secure keys. Thus, the attack will fail as it is impossible to steal information about the final keys, which means that the QKD system is secure. The colored area indicates that the attack introduces an error rate of less than 11%. Adjacent color blocks between them indicate a 1% increase in the error rate range. For example, the yellow area indicates an error rate of 7–8% and the orange range indicates an error rate of 8–9%. The objective of the attacker is to steal the key’s information, so the error rate introduced by the attack needs to be reduced as much as possible to hide the traces of the attack and maximize the information obtained. If the introduced error rate caused is limited to be less than 1%, the splitting ratio should meet $r_1\ge 0.95$ and $r_2\le 0.05$.

Since a severe deviation of the splitting ratio from 0.5 is necessary for the success of this attack, we propose a countermeasure by combining device selection and error rate over-threshold alarms to protect against this attack. Firstly, by selecting device types and device characteristics, we ensure that the beam splitters used feature a small variation of splitting ratio in a wide range of wavelength. The splitting ratios of the filtered BS are noted as $r_1\le r_{\max }$ and $r_2\ge r_{\min }$. Combining the single-mode cut-off wavelength of standard communication fibers [47] and the operating wavelength range of single-photon detectors [48], the spectral range for inspecting the splitting ratio of the BS can be determined as 1260–1700 nm. The two most commonly used beam splitters in optical communication are BS made by fused biconical taper (FBT) technology and BS made of mirror coatings (MC). The most commonly used integrated beam splitters are the MMI-type beam splitters on QKD chips. The FBT BS is generally wavelength dependent [46,49]. The splitting ratio of FBT BS exhibits an approximately periodic variation from nearly 0 to nearly 1 [46]. The splitting ratio of MMI-type BS features a similar variation pattern to that of FBT BS [50,51]. The variations in the splitting ratio of these two types of beam splitters are too large to ensure the safety of QKD systems. The MC BS can achieve a small change in splitting ratio over a wide wavelength range, as shown in Figure 3. Therefore, the MC BS is more suitable for the practical QKD system. Within current technology, we suggest selecting devices featuring wavelength dependence lower than 1 dB at 1260–1700 nm, i.e., $0.5\le r_1\le 0.63$ and $0.5\ge r_2\ge 0.38$. $e_{th}$ denotes the minimum error rate that can be introduced by performing the wavelength-dependent attack under this spectral splitting ratio condition. According to Equation (1) and Figure 2, it is easy to conclude that the attack introduces the smallest error rate when $r_1=0.63$ and $r_2=0.38$, and this minimum value can be easily calculated to be $e_{th}\approx 18\%$.

Secondly, we monitor the error rate of the QKD system in real-time and alert when a preset threshold $e_{monitor}$ is exceeded. As an alarm implies a likely attack, the system should stop QKD and discard relevant data to prevent information leakage. Considering the performance of commercial QKD devices, the monitoring threshold can be set to $e_{monitor}\le 3\%$ [23,52], which can effectively detect wavelength-dependent attacks of beam splitters.

The eavesdropper can further optimize the attack, to reduce the error rate caused, by only attacking part of the quantum signals. If the percentage of attacked signals is $p_{attack}$, the error rate caused by the attack is approximately $p_{attack}{e}_{th}$. The eavesdropper may attack only a few signals to make $p_{attack}{e}_{th}<e_{monitor}$, where the system cannot trigger an alarm. Fortunately, the amount of information that the attacker can obtain is also limited in this case. We can remove this amount of information to obtain the security key by modifying the secure key rate formula as follows:

$$\begin{array}{l}R\ge 0.5p_{\mu }{f}_{freq}\left[\left(1-p_{attack}\right)Q_1\left(1-H_2\left(e_1\right)\right)-lea{k}_{EC}\right]\\ \ge 0.5p_{\mu }{f}_{freq}\left[\left(1-e_{monitor}/e_{th}\right)Q_1\left(1-H_2\left(e_1\right)\right)-lea{k}_{EC}\right]\end{array}$$

(2)

where $Q_1$ is the detection gain of a single photon state, $e_1$ is the error rate of a single photon state, $H_2\left(x\right)=-x{\log }_{2}x-\left(1-x\right){\log }_2\left(1-x\right)$ is the binary Shannon function, and $lea{k}_{EC}=f_{EC}{Q}_{\mu }{H}_2\left(E_{\mu }\right)$ is the amount of information leaked in the error correction stage, $f_{EC}$ is the efficiency of error correction, $E_{\mu }$ is the quantum bit error rate of the signal state under the decoy-state scheme.

We numerically simulated the performance of the QKD system after partial-attack modification, as shown in Figure 4. For simplicity, we calculated the secure key rate at infinite key size and ignored the detector’s dead time and the after-pulse effect. Low after-pulse or a key size more than 1 Mbit have little effect on the secure key rate [53,54]. The dead time effect significantly reduces the secure key rate at short-distance transmission, but has little impact for long-distance transmission. In our simulation, the model of signal state + decoy state + vacuum state was used [55]. The average photon number of the signal state, the decoy state, and the vacuum state was set to 0.4, 0.1, and 0, respectively. The probabilities of the signal state, the decoy state, and the vacuum state were set to 80%, 10%, and 10%, respectively. We assumed a balanced basis choice, i.e., 50% for choosing any basis for both the transmitter and the receiver. The repetition frequency at the transmitter was set to 625 MHz, and the insertion loss at the receiver side was set to 3 dB. The detection efficiency was set to 20%, and the dark count was set to 1000 cps. The error rate caused by the basis mismatch was set to 1%. The equations used in our simulation are presented in the Appendix A. The results showed that after partial-attack modification, the QKD system exhibited good performance, with a secure key rate of over 10 kbps at 100 km and a maximum transmission distance of over 150 km, which is of small difference from the no-attack scenario. Experimental demonstration is important to rate the simulated performance, which we would like to leave for future work.

4. Countermeasure of Monitoring

As previously analyzed, to perform a successful wavelength-dependent attack on the optical beam splitter, it is necessary to select two attack wavelengths that are far from the normal operating wavelength of the QKD system, where the splitting ratio deviates severely from 0.5. We propose a countermeasure by monitoring the light intensity of different wavelengths to protect the optical beam splitter from wavelength-dependent attack. The principle of this protection scheme is shown in Figure 5. A filtering module is added at the QKD receiver before the quantum state decoding. The light of operating wavelength is used for the quantum state decoding. The light of non-operating wavelength is separated and measured by a monitoring detector. If the monitoring detector receives a strong light, an alarm is triggered as there is likely a wavelength-dependent attack from the channel. The system should stop QKD and discard relevant data to prevent information leakage. Commonly used fiber optic system filters are available for Wavelength Division Multiplexer (WDM) or Dense Wavelength Division Multiplexer (DWDM), the combination of which can effectively improve the filtering bandwidth and isolation of the filter. Filters also increase the isolation of the system in the non-operating wavelength region, making it necessary for an eavesdropper to increase the light intensity to conduct the attack, thus also increasing the probability of detecting the attack and reducing the sensitivity requirements for monitoring detectors.

5. Discussions

In addition to our proposed countermeasures, measurement-device-independent (MDI) QKD [56,57] or even device-independent (DI) QKD [58,59] can also be adopted to eliminate this vulnerability and avoid wavelength-dependent attacks on beam splitters. Our approach is easy to implement, cost-effective, compatible with commercial QKD systems, and has a relatively high secure key rate. The MDI scheme requires high stability to perform the single-photon interference during the measurement, and the secure key rate is relatively lower than our proposal. The DI approach, with better security, is a huge challenge for current technology, and the secure key rate is too low for practical usage. The recently proposed twin-field quantum key [60,61] is an improvement of the MDI scheme, which is expected to promote the transmission distance and the secure rate, thus being the key breakthrough route in MDI QKD research.

It is worth noting that the integrated beam splitters, such as the MMI-type BS commonly used in current QKD chips, show similar wavelength-dependent characteristics of splitting ratios with the FBT BS. Due to the large variation of the splitting ratio, QKD systems using integrated optical beam splitters alone are also affected by wavelength-dependent attacks and cannot guarantee safety. Thus, Figure 3 does not show the simulation results on the secure rate of the integrated BS. The security of the integrated chip-based QKD requires further study. QKD systems using integrated optical beams splitters require additional means to ensure their safety. The countermeasure of error rate alerting is not suitable for chip-based QKD system. Fortunately, the proposed countermeasure of monitoring is more applicable.

Although previous discussions focus on the security of optical beam splitters with unbiased basis choice, both proposed countermeasures apply to QKD systems using the biased basis choice [62]. It is natural for the splitting ratio to be unbalanced, as shown in Figure 2. In the biased scenario, the QKD system is required to monitor the error rates of the Z and X basis separately, rather than only focusing on the overall error rate [62]. Although the overall additional error rate caused by the attack can be lower, there will be a significant increase in the error rate of one of the two bases, which can be used to protect against the attack by the countermeasure of error rate alerting. Perhaps different thresholds should be set for the two bases respectively, and the secure key rate equation would need to be modified according to the biased basis choice.

6. Conclusions

First, we studied the necessary conditions for wavelength-dependent attacks of beam splitters, and numerically calculated the additional error rate introduced by the attack under different beam splitting ratios. Then, we proposed a countermeasure of error rate alerting to protect against this kind of attack. The MC BS was recommended, and devices with a splitting ratio variation of no more than 1 dB in the range of 1260–1700 nm were selected. Combined with an alerting threshold of 3% error rate, the system can effectively be protected against wavelength-dependent attacks of beam splitters. In the case of partial attack, a modified formula is given for estimating secure key rate. We also proposed a light intensity monitoring countermeasure to protect against wavelength-dependent attacks by measuring the incident light intensity at non-operating wavelengths. This work would help guide the design of QKD systems and improve the implementation security for practical systems.