Quantum photonic network and physical layer security

Abstract

Quantum communication and quantum cryptography are expected to enhance the transmission rate and the security (confidentiality of data transmission), respectively. We study a new scheme which can potentially bridge an intermediate region covered by these two schemes, which is referred to as quantum photonic network. The basic framework is information theoretically secure communications in a free space optical (FSO) wiretap channel, in which an eavesdropper has physically limited access to the main channel between the legitimate sender and receiver. We first review a theoretical framework to quantify the optimal balance of the transmission efficiency and the security level under power constraint and at finite code length. We then present experimental results on channel characterization based on 10 MHz on–off keying transmission in a 7.8 km terrestrial FSO wiretap channel.

This article is part of the themed issue ‘Quantum technology for the 21st century’.

1. Introduction

Photonic network is a broadband optical infrastructure to realize high-capacity and low-power communication [1]. Quantum network is to enhance photonic network in two directions. One is the enhancement of the capacity by introducing quantum communication [2]. It is to realize the maximum-capacity and minimum-power communication by re-designing optical communication at the quantum level. The other is the security enhancement by using quantum cryptography or quantum key distribution (QKD) [3,4]. It provides a means to establish the most secure communication link ever devised, that is, to distribute information theoretically secure key even against an eavesdropper (Eve) with unbounded ability in a photonic network. Quantum communication itself does not cover any security aspects but only pursues the maximum transmission efficiency. QKD, on the other hand, focuses on the strongest security at the expense of limited transmission speed and distance.

These two quantum schemes are not, of course, all the possibilities, but just two extreme examples; one for the maximum transmission efficiency, and the other for the strongest security. More general frameworks include the intermediate scheme between the two, namely, information theoretically secure communications with maximum transmission efficiency, assuming that Eve is physically bounded, for example, described as degraded channel model (wiretap channel model) [5,6] or bounded storage model [7–9]. A new paradigm to realize the maximum-capacity and minimum-power communication with information theoretic security in a photonic network is referred to as quantum photonic network [10]. Quantum photonic network consists of two kinds of link schemes. One is secret message transmission which employs channel coding not only for error correction for Bob but also for randomization to deceive Eve [11]. The other is secret key agreement which extracts symmetric keys from a random number source employing two way communications between Alice and Bob via a public channel [12,13]. QKD belongs to the latter scheme. Quantification of transmission efficiency and security level of these links is generally a non-trivial issue. This is especially so in the practical setting of finite resources, such as transmission under power constraint and at finite code/key length. Actually increasing the transmission rate and enhancing the security level are generally competing tasks. Therefore, the problem is to realize the optimal balance points or curve of the trade-off between transmission efficiency and security level. To do this at the fully quantum level is completely an open question. Even in the classical framework where the channel matrices are just given as classical probability, more research studies are still on-going. Needless to say, experimental investigations in realistic environments have been quite lacking.

In this paper, we study a wiretap channel model in free space optical (FSO) communications, such as satellite-to-ground, airborne-to-ground and drone-to-drone laser communications. In such wireless communications, we can reasonably relax the assumptions on Eve, because they are basically line-of-sight communications. So Eve cannot be in the main lobe of the channel, otherwise she can be easily visible, and hence it is reasonable to assume that Eve's channel can be physically bounded. Under such an assumption, one may pursue higher transmission rate than that of QKD. In fact, long distance FSO channels are usually very lossy, and a key rate of QKD becomes very small. We first review our theory of physical layer security and its implementation in FSO communications system [14] and then present our experimental results with a 7.8 km terrestrial FSO wiretap channel.

2. Theory of physical layer security

In this section, we focus on secret message transmission in a wiretap channel. A wiretap channel consists of the main channel with which Alice transmits a confidential message to Bob and the wiretapper channel with which Eve attempts to observe the confidential message. A conceptual view is shown in figure 1. The symbols for Alice, Bob and Eve are defined as x, y and z, drawn from the binary random variables X, Y and Z, respectively. The main and wiretapper channels are mathematically represented by the transition probabilities W_B(y|x) and W_E(z|x), respectively, which are called the channel matrices. It might be a strong assumption that we know the wiretapper channel characteristics. In the practical setting, we try to obtain such information from past data of communications and pilot signals for channel estimation and derive the transition probability W_E(z|x) so as to model the worst case scenario. The fundamental metric is then given by the secrecy capacity defined as follows [5]:

2.1

where I(X;Y) and I(X;Z) are the mutual information of the main and wiretapper channels, respectively, with

2.2

where P_X(x) is the a priori probability of x and with a similar expression for I(X;Z). Thus, there must exist a code that can transmit the amount of C_s bits faithfully per unit time, making leaked information to Eve arbitrarily small. For the secrecy capacity to be positive, the characteristics of the wiretapper channel must be worse than that of the main channel. If the wiretapper channel is superior to the main channel, secrecy transmission is generally impossible.

Figure 1.

Conceptual view of a wiretap channel, and relevant quantities to characterize the system performance.

A coding scheme for a wiretap channel consists of randomization and error correction. We add not only redundant bits to perform error correction for Bob, but also randomness bits to deceive Eve. So there are two kinds of rates, the message rate or secrecy rate R_B for Bob, and the randomness rate R_E to deceive Eve. If R_B < C_s, then the decoding error for Bob and the leaked information against Eve can simultaneously be made arbitrarily small.

The secrecy rate specifies the asymptotic performance at infinitely long code length. In practice, however, code length is finite, say n. The transmission power is also limited, which is generally modelled as the cost constraint on the input variable X as

2.3

where q(x) is a priori probability, and c(x) and Γ represent the cost and the constraint. Then stronger characterization can be made by a theory of finite length analysis under the cost constraint. So we characterize how fast the decoding error for Bob and the leaked information against Eve decrease as code length n increases. The leaked information against Eve can be measured by several quantities, such as the variable distance, the mutual information and the divergence distance. We adopt the divergence distance because this is the strongest measure in the sense that if this can be upper bounded, the other quantities are also automatically upper bounded [15]. The divergence distance measures a statistical distance between output distribution and target distribution of Z at Eve. It is known that there must exist a code with which the decoding error at Bob and the divergence distance decrease exponentially as

2.4

2.5

where the exponents F_c(q, R_B, R_E) and H_c(q, R_B) are called the reliability function and the secrecy function, respectively, and given as follows:

2.6

and

2.7

where ρ and r are optimization parameters, and the function ϕ is given by

2.8

and

2.9

Figure 2 shows a typical plot of the reliability and secrecy functions in terms of the rate. Reliability function is monotone decreasing while the secrecy function is monotone increasing. Thus, they form a dual set and represent the trade-off relation between reliability and secrecy. The secrecy capacity is the difference between the two zero points in these functions.

Figure 2.

A typical plot of the reliability and secrecy functions in terms of the rate.

Now we investigate these functions numerically to see how the power constraint affects the reliability and security. We consider a wiretap channel at a telecom wavelength, which is in the eye safe wavelength region, with on–off intensity modulation. Bob and Eve use binary intensity threshold detection. In our numerical calculation, the main channel to Bob has the channel attenuation of −60 dB and noise power of 13.61 nW while the wiretapper channel to Eve has the channel attenuation of −67 dB and noise power of 3.22 nW, namely Eve's channel is more lossy but less noisy. See §3 on details of the background as to why these parameters are chosen. In figure 3, we plot the reliability functions and secrecy functions for three kinds of power constraints of 25 mW (A), 50 mW (B) and 12.5 mW (C). The secrecy rates are calculated as 0.548 bits, 0.327 bits and 0.255 bits, respectively. As the power increases, the reliability function increases while the secrecy function decreases because the wiretap risk increases. Thus, the reliability and secrecy functions quantify the trade-off between the reliability and secrecy and indicate how long a code is necessary to suppress the decoding error at Bob and leaked information to Eve by equations (2.4) and (2.5).

Figure 3.

Reliability and secrecy functions for several power constraints.

3. Experimental characterization of optical wiretap channel

We implemented a wiretap channel in a metropolitan terrestrial FSO link testbed (Tokyo FSO Testbed). This testbed consists of one sender terminal at the University of Electro-Communications (UEC) in Chofu and two receiver terminals, one for Bob and the other for Eve, at the National Institute of Information and Communications Technology (NICT) in Koganei. Each of Bob and Eve is 7.8 km distance apart from the sender terminal. Figure 4 shows the configuration of this optical wiretap channel. We set Bob's receiver in the sixth floor of a building. On the rooftop of the building which is just above the sixth floor, we set a container type terminal which takes the role of Eve, trying to tap the beam footprint which is about 7.8 m in diameter (full width at half maximum).

Figure 4.

Experimental configuration of FSO wiretap channel in Tokyo FSO Testbed.

We transmitted pseudorandom number sequences in a 10 MHz non-return-to-zero on–off keying at 1550 nm wavelength. The on and off signals convey symbols 1 and 0, respectively. See [14] for detailed specifications. Using the output signal statistics, we estimate secrecy rates and related security metrics and then discuss design principles of wiretap channel coding.

We first reconstructed the channel matrices W_B(y|x) and W_E(z|x) by comparing the input and output signals for a measurement duration of 4 ms. The total number of events sampled for this duration is 40 000 points. Bob detects the symbols 0 and 1 by a photodiode and makes hard decision with a certain threshold, constructing a 2 by 2 channel matrix W_B(y|x). Eve also detects the symbols 0 and 1 by a photodiode, but makes soft decision which can generally extract more information, constructing a 2 by M channel matrix W_E(z|x) with M∼hundreds∼thousands. Using the measured channel matrices, we calculated the mutual information of the main and wiretapper channels and derived the secrecy rate. We call this rate for this 4 ms duration ‘instantaneous secrecy rate’ denoted as R_i. In figure 5, we summarize experimentally evaluated secrecy rates and outage probabilities taken in five different campaigns in the afternoon and evening of a day in November 2015. On that day, the sunset time was 16:33 JST. The left column shows the variations of the instantaneous secrecy rates over 2000 ms. As seen, the secrecy rates fluctuate in a scale of a few tens of milliseconds especially until sunset. The secrecy rate often falls to zero. In such time regions, Eve can discriminate the 0 and 1 clearly, and tap the message, which is the outage of secrecy message transmission. After sunset, the fluctuation of the secrecy rate becomes smaller, and there is no outage.

Figure 5.

Temporal variation of the secrecy rate and secrecy outage probability for five experiment campaigns.

The fluctuation of the secrecy rate is due to atmospheric turbulence, especially due to optical beam deformation and wandering. The outage frequency, that is, how often wiretap risk occurs, can be quantified by the outage probability P_outage (R_i < R_th) which is defined as the cumulative probability that an instantaneous secrecy rate R_i is smaller than a given target rate R_th. The right column in figure 5 shows the outage probabilities. These data can be used as a reference to know the trade-off relation between the target rate and the outage risk.

In figure 6, the probability distributions of 0 and 1 summed for the whole period of 2000 ms are listed. The distributions, especially for the 1 at Bob, are much broader or heavy-tailed. But the two peaks of the 0 and 1 at Bob can be well discriminated. On the other hand, the two distributions of the 0 and 1 at Eve overlap with each other, suffering from finite bit error. We can derive the secrecy rate from these probability distributions over the whole period, which is referred to as the long span secrecy rate R_long. As was already implied in [14], the long span secrecy rate can be larger than the average instantaneous secrecy rate over a time span of 2000 ms.

Figure 6.

Output voltage distributions at Bob and Eve for five experiment campaigns.

Now looking back at figure 5, we can clearly confirm that this is true for the longer time span of 2000 ms in all the cases (a–e). The difference between R_long and is more apparent when the fluctuation of R_i is larger. Then there must exist a good wiretap channel code for a long time span even when the instantaneous secrecy rate fluctuates largely. Actually, we can design a code to randomly distribute secret message over the whole span of time, such that Eve cannot get meaningful information even if she taps parts of the message during this outage region.

We can estimate a typical length of wiretap channel code to attain a given criterion of the decoding error at Bob and the divergence distance at Eve. For example, in the case of the campaign (d) in figures 5 and 6, there must exist a code of length 10³ to suppress the divergence distance below 10⁻²⁰ simultaneously when R_B is set to be 3.5 Mbps [14].

Finally, we mention the variability of the averaged secrecy rates (the long span secrecy rate R_long and the average instantaneous secrecy rate ) measured in the five campaigns over a few hours across sunset. The average secrecy rates do not simply improve as the daylight fades, proceeding from (a) to (e). The best performance (large value of averaged secrecy rate with small fluctuation) was seen in campaign (d) which is about an hour after sunset. This coincides with the empirically known phenomenon that atmospheric turbulence is most supressed in evening calm. The behaviours before and after this evening calm (especially before) are not simple. The rate of (b) is better than those of (a) and (c). We cannot explain the mechanism behind this variation precisely yet, but suspect that it reflects the change of optical transparency of the atmosphere and/or lighting condition from Alice to Bob and Eve. On the other hand, the behaviour of fluctuation around an average rate looks simple, i.e. it is minimized in the evening calm and becomes larger before and after that. For further investigation, we need to accumulate more data, employing meteorological sensors to monitor atmospheric conditions in future experiments.

4. Conclusion

We have reviewed our recent theory of physical layer security and then presented our experimental results on a 7.8 km terrestrial FSO wiretap channel. If we could assume that the wiretapper channel to Eve is physically bounded in channel characteristics, secrecy message transmission can be possible at a rate of Mbps scale even in a lossy channel with −60 dB attenuation. We have also shown that a good code must exist even when there is large atmospheric turbulence.

The present study is still within the classical framework, given the channel matrices W_B(y|x) and W_E(z|x) as classical probability. Extending our study into the quantum domain is an exciting future challenge. The first step is to take into account photon nature, that is, to quantize the cost constraint shown in equation (2.3) by introducing the Planck constant and to apply photon counting-based measurement at Bob and Eve. The second step is to model a wiretap channel in the quantum domain, which is mathematically a completely positive map. Given and fixed is this quantum channel, and one is to optimize the input quantum state and detection strategy at Bob. Eve's strategy could also be extended into wider classes.

Another challenge both in the classical and quantum domains is to extend the current scenario in space link to a fibre network with multiple channels. In most current fibre infrastructures, Alice and Bob can usually find many different routes connecting them. It is unlikely that Eve can know all information of geographical configuration of such fibre routes and hack all the channels. So it might be sensible to assume that Eve can only tap part of the channels, i.e. her ability can be bounded. Alice and Bob can choose multiple routes randomly and further employ a code to randomly distribute secret message over those fibre channels, such that Eve cannot get meaningful information even if she taps part of the fibres. This can be understood as a complete analogy to the long span secrecy rate in space link discussed in the previous section. In that case, there are many different channel realizations in the time domain due to fading, but the long span secrecy rate could be relatively large, implying a good code must exist. Different channel realizations in the time domain can be translated to those in the spatial domain of fibre network, and a good coding over multiple fibres may also be possible.

We may further consider the most general case of multiple Alices and Bobs with multiple channels. Then one can employ network coding over multiple terminals and multiple channels, pursuing efficient message throughputs with information theoretic security. This might be the ultimate goals of quantum wired photonic network. Thus one may find a fertile research field of the quantum photonic network both in wired and wireless links.

Authors' contributions

M.S. and M.T. conceived the research. H.E. and M.F. designed the experiment and analysed data. M.K., T.I., and R.S. carried out the experiment. M.S. wrote the manuscript with assistance from all other co-authors.

Competing interests

We declare we have no competing interests.

Funding

This work was funded by ImPACT Program of Council for Science, Technology and Innovation (Cabinet Office, Government of Japan).