Amplify, generate or prove randomness

Abstract

The security test logic system may include a non-transitory memory configured to store measurements from a measurement device, the measurement output including an indication of whether there is a coincidence, wherein particles are detected at more than one detector substantially simultaneously at the coincidence, the detectors being located at the ends of channels different from the particle source and having substantially the same length. The system may include a processor configured to calculate a test statistic from the stored measurements. The test statistic may represent a Bell inequality, and the system may compare the test statistic to a threshold. The processor may be configured to generate and output a certificate proving that the measurement value is from a quantum system if the value of the calculated test statistic exceeds the threshold.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of priority to U.S. Provisional Patent Application No. 62 / 607,719, filed on December 19, 2017, entitled “Systems and Methods for Amplifying, Generating, or Certifying Randomness,” the entire contents of which are incorporated herein by reference. Background Art

[0003] Encryption and authentication used in computer security use random bit generators because random numbers are important in generating symmetric keys and freshness values ​​(nonces) that form part of the encryption and authentication process. The way to generate random bit sequences is typically divided into three different types, including: deterministic random bit generators, which use software to generate pseudo-random bit sequences; nondeterministic random number generators based on classical physics; and nondeterministic random number generators based on quantum systems. Summary of the invention

[0004] The following is a high-level summary of the disclosure, simplified in some respects, as a prelude to the more detailed description presented later. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0005] In one embodiment, a safety test logic system has a non-transitory memory configured to store measurements from a measuring device, the measurement output including an indication of whether there is a coincidence, wherein at the time of coincidence, particles are detected at more than one detector substantially simultaneously, the detector being located at the end of a channel different from the particle source and having substantially the same length. The system includes a processor configured to calculate a test statistic from the stored measurements. The test statistic may represent a Bell inequality, and the system may compare the test statistic with a threshold. The processor may be configured to generate and output a certificate credential proving that the measurement value is from a quantum system if the value of the calculated test statistic is, for example, below a threshold. Bell inequalities may include any inequalities for determining whether a set of measurements conforms to quantum mechanics or conforms to classical physics. Bell inequalities include any of Bell's original inequalities, CHSH inequalities (ClauserHorne Shimony Holt inequalities), or any other such inequalities. Violation of Bell's inequalities indicates that the measurement conforms to the rules of quantum mechanics and conforms to the rules of classical physics.

[0006] Many of the attendant features will be better and more readily understood by referring to the following detailed description considered in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The present specification will be better understood from the following detailed description read with the accompanying drawings.

[0008] Figure 1 is a schematic diagram of an example of an apparatus for proving that a number has been generated by a quantum device and an example of a randomness extractor configured to generate random numbers for various downstream applications.

[0009] Figure 2A Yes, you can Figure 1 Schematic diagram of an example of a four-device quantum device used in the apparatus.

[0010] Figure 2B yes Figure 2A Another schematic of the four-device quantum setup.

[0011] Figure 2C Such as Figure 2A or Figure 2B A flowchart of an exemplary method of operating a four-device quantum device is shown;

[0012] Figure 3A Yes, you can Figure 1 Schematic diagram of an example of a two-device quantum device used in the apparatus.

[0013] Figure 3B Yes, you can Figure 1 Another schematic diagram of an example of a two-device quantum device used in the apparatus.

[0014] Figure 3C Such as Figure 3A or Figure 3B A flow chart of an exemplary method of operating a two-device quantum apparatus is shown.

[0015] Figure 4 is a flow chart of an exemplary security test A in a four-device case.

[0016] Figure 5 is a flow chart of an exemplary safety test B.

[0017] Figure 6 is a flow chart of an exemplary security test A in a two-device case.

[0018] Figure 7 Such as in Figure 1 A flowchart of an exemplary method of operation of a randomness extractor in an arrangement of.

[0019] Figure 8is a stereoscopic view of an example of a waveguide of an optical state expander.

[0020] Fig. 9 It is installed in the housing and the cover is omitted. Figure 8 A stereoscopic view of the waveguide.

[0021] Fig.10 is through Figure 8 Schematic longitudinal cross section of a waveguide.

[0022] Fig.11A is the explanation Figure 8 Schematic diagram of the operation of the waveguide.

[0023] Fig. 11B and Figure 8 Same, but with reference numerals to indicate air gaps.

[0024] Fig.12 Yes, you can Figure 2A Schematic diagram of a pair of exemplary measurement devices used in the apparatus.

[0025] In the drawings, like reference numerals are used to denote like parts. The provided drawings are not necessarily drawn to scale and are provided to illustrate exemplary embodiments described herein and are not intended to limit the scope of the present disclosure. DETAILED DESCRIPTION

[0026] The specific embodiments provided below in conjunction with the accompanying drawings are intended to be a description of this example, and are not intended to represent the only form of constructing or utilizing this example. This description sets forth the functions of the example and the sequence of operations for constructing and operating the example. However, the same or equivalent functions and sequences can be implemented by different examples.

[0027] Random bits have too many applications to enumerate, from cryptography to scientific computing. However, traditional random number generators are based on deterministic classical physics. Therefore, the randomness of the output cannot be trusted without additional assumptions, because the apparent randomness is based on ignorance that may not be shared by the adversary. For this reason, random numbers generated by any kind of deterministic software are in principle vulnerable to hacking. Quantum mechanics is inherently probabilistic, and can therefore be used to generate randomness. Generating random numbers using quantum mechanics allows for a kind of security based on the uncertainty principle; for example, under the right conditions, an adversary may be unable to observe a qubit without it being instantly destroyed.

[0028] When considering a device that allegedly produces a random output based on quantum mechanics, one can only believe that the output is random if one trusts or assumes that the quantum device is operating correctly. Once a system has generated a random number, there is usually no easy way to prove that the random number has been produced by a quantum system. In order to determine whether the alleged quantum system actually utilizes quantum phenomena to produce its output, the operator usually needs to not only be an expert in the field, but also visually inspect the internal structure of the alleged quantum system (including the mechanics) and even test the system independently.

[0029] The embodiments described below are not limited to implementations that address any or all of the shortcomings of known techniques for amplifying, generating, or proving randomness. For example, different embodiments may address different shortcomings or challenges related to amplifying, generating, or proving randomness.

[0030] Although there are commercial quantum systems that produce so-called random bits, verifying that such a device is working as intended will remain a difficult task even for experts who have access to the inner workings of the device. It would be much more preferable if the output of the device could be verified as genuine simply by considering the output without knowing the inner workings of the device. This property is called device independence.

[0031] In the following detailed description, various non-limiting examples of the randomness amplification process and various embodiments of real-world systems that implement examples of the process are described. These examples and embodiments are intended to illustrate rather than limit the scope of the present disclosure.

[0032] Figure 1 1 is a schematic diagram of an example of an apparatus 100 for proving that a quantum device 102 has generated a number in an independent manner and an example randomness extractor 110 configured to generate random numbers 116 for use in various downstream applications 120, 122, 124, 128. The randomness extractor receives input from a weak randomness source 114 (here and in the figure as WSR-2), which can be a classical device for calculating pseudo-random numbers. In addition, the apparatus 100 also has a weak randomness source 104 (here and in the figure as WSR-1), which can be a classical device for calculating pseudo-random numbers.

[0033] A weak randomness source refers to a randomness source whose randomness cannot be proven due to or based on the existence of quantum effects. The term "weak" itself does not mean that the randomness source is somehow unsuitable or insufficient to meet industry standards for randomness. In some embodiments, a weak randomness source can be at least partially uncertain, or even completely uncertain. Therefore, a weak randomness source includes a source that outputs a random number whose uncertainty cannot be proven. A weak randomness source is sometimes simply referred to as a randomness source.

[0034] The quantum device 102 includes a device for generating a plurality of qubits and preparing the qubits in a particular quantum state, and a device for measuring the qubits in at least two different bases. The device 100 has a safety test logic 106 for automatically proving that a given plurality of qubit measurements 108 violates Bell's inequality.

[0035] As used herein, Bell's inequality generally refers to any inequality associated with measurements of a quantum or classical system, where a violation of the inequality means that the measurement value conforms to the rules of quantum mechanics (e.g., entanglement or non-locality) but not to the rules of classical physics (e.g., local realism or hidden variables). Bell's inequalities include inequalities that are always satisfied by any local probability distribution of the measurement results of the two parties, which are inequalities that can be achieved when the device of each party has its own internal state. Bell's inequalities include any original inequalities derived by John Stewart Bell and inequalities derived by others, such as the CHSH inequality (Clauser Horne ShimonyHolt inequality), Leggett's inequality, Leggett-Garg inequality, etc. As further described herein, a violation of Bell's inequality ensures that the output of the quantum device 102 is derived from quantum effects and is therefore independent of other sources, including, for example, classical weak randomness sources.

[0036] It is shown that the qubit measurement value 108 violates Bell's inequality, indicating that the qubit measurement value has been produced due to quantum effects rather than classical effects, and also that the qubit measurement value 108 is independent of any other classical weak randomness sources, such as Figure 1 In this sense, proving that qubit measurement 108 has been produced from a quantum effect proves that qubit measurement 108 is truly random. This proof allows a user to trust the randomness of the output without having to access the internals of quantum device 102 (so, for example, without having to arrange for an expert to inspect the internal structure of quantum device 102 and test it).

[0037] The security test logic 106 may be implemented using any combination of one or more of the following: software, firmware, or hardware logic components. For example, but not limited to, exemplary types of hardware logic components that may be selected for use include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), graphics processing units (GPUs), central processing units (CPUs), or any other type of hardware processor.

[0038] exist Figure 1In the illustrated embodiment, the set of qubit measurements 108 has a fixed size that may not be suitable for use in downstream applications 120, 122, 124, 128. Therefore, in some embodiments, a randomness extractor is used to calculate multiple appropriate sizes / lengths. Once multiple qubit measurements 108 are obtained and proven to be generated by quantum effects, the measurements 108 are input to a randomness extractor 110. A classical randomness extractor, such as a Trevisan extractor, can be used. In some such embodiments, the randomness extractor 110 takes as input a pseudo-random number 112 from a weak randomness source 114 and a proven qubit measurement 108. The randomness extractor calculates a number that can be of any specified length as an output. Compared to the pseudo-random number 112, the number generated by the randomness extractor 110 has amplified randomness and is truly random because, as explained in more detail below, the inputs to the randomness extractor are proven to be independent of each other.

[0039] In some embodiments, the number 116 with amplified randomness is input to one or more downstream applications. A non-exhaustive list of downstream application examples includes: computer security 120, where random numbers are often used as one-time keys (OTPs) that are pre-shared between entities and used for encryption; weather forecasting 122, where random numbers are sometimes generated and used to initialize parameter values ​​for weather system models; telecommunications systems 124, where random numbers are sometimes generated and used for resource allocation schemes; and manufacturing control systems 128, where random numbers are sometimes generated and used to model noise present in sensor readings.

[0040] Classical approaches to random number generation typically assume access to two independent sources of randomness and use a randomness extractor to compute near-ideal random bits, based on results such as those obtained by Santha and Vazirani, "Generating quasi-random sequences from slightly-random sources," Journal of Computers and Systems Science, 33, I(1):75-87, 1986. However, the claim that the two sources of randomness are independent usually has to rely on further assumptions. This is one of the main drawbacks of this classical approach; it is usually not possible to guarantee that the two weak sources of randomness are independent, and thus this classical approach is not device independent.

[0041] In contrast, the present technique is able to guarantee the independence of the quantum device 102 and the WSR-2, i.e., the classical weak randomness source 114. The violation of the Bell inequality guarantees that the output of the quantum device 102 is from quantum effects and is therefore independent of other sources including the WSR-2, i.e., the classical weak randomness source 114. Thus, the randomness extractor 110 takes inputs from two sources that are proven to be uncorrelated sources. In this sense, the output signal 116 of the randomness extractor is truly random.

[0042] Commercial quantum randomness generators have not shown provable device independence to date, as a human operator needs to check the randomness generator and confirm that it is using quantum mechanics. Such devices use quantum preparation and measurement schemes to exploit the operational probabilistic nature of quantum mechanics to create random number strings that are in many ways preferable to classical pseudo-random number generation methods. Commercial quantum randomness generators perform measurements in a single quantum background in a way that makes them unsuitable for device-independent implementations. Existing quantum randomness generators do not guarantee any security, and it can be difficult even for experts to verify that the device is working as specified. For example, in some previously developed photonics-based systems, it is difficult to verify that the reported measurement results are genuine, given that measurements on the photonic system destroy the photons when they are incident on the detector: without being able to guarantee that the reported measurement results are due to quantum effects, the device may produce a pre-generated, but apparently random, bit string known to the adversary.

[0043] Many existing quantum-based randomness generators offer security guarantees that are valid only if the device is discarded after each round of measurements, or only if a large number of devices are used in parallel (which scales with the number of random bits generated). These approaches are not good options for commercial devices.

[0044] Many existing quantum randomness generators cannot tolerate realistic noise levels from viable quantum devices and are therefore not good choices for practical applications.

[0045] One advantageous aspect of the apparatus 100 is its robustness to noise: the safety test logic can only work correctly (and not crash) if the quantum states and quantum measurements that make up the quantum device have low levels of noise. In particular, the apparatus 100 can operate and prove its output even if the different quantum systems of the quantum device 102 are only approximately non-signaling, not strictly non-signaling. It is unlikely that a strictly non-signaling quantum system can be implemented in a single device.

[0046] The various embodiments of the four-device and two-device quantum devices 102 described in this document are unique in their design and application. They use quantum systems to obtain results that are not feasible using classical sources. The embodiments described herein are realistic and achievable for practical everyday use. The embodiments use a small fixed number of quantum devices and can tolerate practical noise levels in quantum devices. In addition, quantum states are generated by quantum circuits that require only a few gates and have a low circuit depth.

[0047] An apparatus 100 that is capable of generating true randomness and is also capable of proving in a device-independent manner that it is working as intended and producing random bits provides a distinct advantage over weak sources of randomness in any environment where the likelihood of an adversary attacking the random bits is minimal. Additionally, the ability to certify random numbers is important for legal reasons in the financial industry. When Monte Carlo simulation models are used to calculate predictions, the initial pseudo-random seeds currently used must often be submitted to regulators, but there has previously been no effective way to prove that these seeds were indeed chosen randomly and, for example, were not chosen to influence the results in a particular way. The present apparatus 100 produces the required random bits as well as a certificate 108 of the presence of quantum effects, and in this sense also produces a certificate of true randomness. We describe various non-limiting examples of a process for amplifying any weak source of randomness into an almost ideal source of randomness using a quantum mechanical system. The process has the following key distinguishing features:

[0048] The benefit of the device 102 is that the device is independent, which means that the user does not have to trust the internal workings of the device. This is because the security test logic that performs statistical tests on the input / output of the device proves to the user that the output bits 108, 116 are indeed random. In addition to providing randomness credentials, the device 102 is additionally secure in the sense that the output bits 108, 116 are unknown to anyone other than the user. The security or correctness given by the device 100 does not rely on any computational complexity assumptions, and is unconditional at least in this sense. The only assumption used to prove the correctness and security of certain embodiments of the device 100 is that there can be no signaling from the device to a non-trusted party (such as an eavesdropper). Where appropriate, this can be ensured by shielding the device. In sharp contrast to earlier work on device-independent randomness generation, the device 100 avoids the need for a no-signal assumption between different parties of the device. This is achieved by introducing a new test (security test B), which can be passed even when the individual quantum systems are only approximately signal-free. The device is optionally used with a classical random number generator or a classical pseudo-random generator. Since the output bits are completely independent of any other source of randomness in the universe, they can be optionally used as seeds for classical randomness extractors to generate larger sequences of random bits. This allows for significantly higher bit rates.

[0049] The apparatus 100 operates in approximately linear running time in the length of the final bit string. In various examples, the apparatus uses 2 or 4 separate (substantially signal-free) quantum devices to generate an arbitrary number of random bits.

[0050] Figure 2A is used as Figure 1 Schematic diagram of an example of a four-device quantum device 102. A two-device quantum device may also be used (e.g., see Figure 3A ) as Figure 1 Quantum device 102. An advantage of the four-device quantum device in this embodiment is that it can reliably resist attacks by an adversary using a Popescu-Rohrlich (PR) box and a locally distributed convex mixture, which is not the case with a two-device quantum device. In at least some embodiments, the four-device quantum device uses a simpler security test than the two-device quantum device. Moreover, in at least some two-device embodiments, the two-device quantum device prepares the qubits to enter different quantum states than in the four-device quantum device in at least some four-device embodiments. In at least some two-device embodiments, the two-device quantum device gives sensor measurements that can be proven to be from quantum effects, where the correctness of quantum mechanics is assumed as an axiom for the process used to compute the proof. In at least some four-device embodiments, the validity of the credential does not depend on the correctness of quantum mechanics as an axiom.

[0051] refer to Figure 2A In the example embodiment shown in , there is an energy source 200 for emitting qubits, and there are four quantum systems 202, 204, 206, 208 that receive input from the energy source 200. Each quantum system includes a state expander 210 that prepares the qubit to enter a specified quantum state. Each quantum system includes a measurement device 212 that detects the qubit in one or more measurement bases. The measurement basis of the measurement device 212 can be configured by a driver 216 according to a pseudo-random value of the measurement device setting generated by a weak randomness source 218. The measurement device 212 detects the qubit received from the source 200 via the corresponding state expander 210.

[0052] Source 200 generates pairs of qubits, with each pair of qubits being sent along a different channel. A channel may include a path from source 200 through state expander 210 to a detector in measurement device 212. The lengths of these paths are substantially the same, so that the time taken for a qubit to travel along each path is substantially the same.

[0053] The occurrence signals from each path are detected at a detector in the measurement device 212, and coincidences are identified. Coincidences may include substantially simultaneous detection of qubits at more than one detector. For example, coincidences may include detection of qubits at two or more detectors within a specified time period. The specified time period may depend at least in part on the flux of paired qubits produced by the source 200. The specified time period may tend to be inversely related to the flux, for example, when the flux of paired qubits is large (e.g., there may be many detections per unit time), the specified time period may be shorter, and when the flux of paired qubits is small (e.g., there may be fewer detections per unit time), the specified time period may tend to be longer. In some embodiments, the specified time period is in the range of from about 1 ns to 1 μs, from 1 μs to 1 ms, from 1 ms to 0.1 s, or in other ranges. For example, the time period may be in the range of 5 to 15 ns, such as about 10 ns.

[0054] In some embodiments, an event in which a qubit is detected is represented by a 1 (one), while an event in which a qubit is not detected is represented by a 0 (zero). In this manner, measurement device 212 generates output signal 214 that includes a string of bits. However, the use of binary representation is not required, and in some embodiments, other representation methods may be used for output signal 214.

[0055] The output signal 214 is checked using security test A 220 and optional security test B. In a preferred embodiment, hardware is used to implement security tests A and B, as hardware is generally more secure than software or firmware. However, it is not required to implement security tests A and B using only hardware.

[0056] Safety test A checks whether the output signal 214 is from a quantum effect or from a classical effect by testing for violations of Bell's inequality. If safety test A is passed, it is proved 226 that the output signal 214 is from a quantum effect and is truly random in this sense. If safety test A fails 224, there is no proof and the output signal 214 is discarded. Because the source 200 and the quantum systems 202, 204, 206, 208 may be affected by noise, the particles prepared in the quantum system may not always be qubits, and may sometimes be classical particles. Therefore, safety test A is particularly beneficial because, in addition to having the ability to prove whether the output signal 214 is quantum without having to examine the internals of the quantum systems 202, 204, 206, 208, it is also robust to noise (because it is a statistical test of many observations of particle detection at the detector of the measuring device).

[0057] Safety test A involves monitoring the emergence signal from each channel. For each detector, there is a unique path or channel that a qubit can follow from source 200 to the detector, and the paths are arranged to be substantially the same length so that entangled qubits in a superposition of states will arrive at multiple designated detectors in the detector at the same time. The paths are configured to accept only qubits in a specific polarization and / or mode. By comparing the number of times a particle is detected at a detector, it can be inferred whether the particle is a qubit with entanglement and superposition, or whether the particle is classical. More formally, in at least some embodiments, safety test A includes measuring violations of Bell's inequality by observing the number of times a particle is detected at different detectors.

[0058] Some four-device embodiments will now be described in the next few paragraphs without repeating phrases such as "in some embodiments" at each step. The four quantum systems 202, 204, 206, 208 are four spatially separated parties with measurement settings {u1, u2, u3, u4} and corresponding results {x1, x2, x3, x4}. Each of the four quantum systems has a specific two-dimensional Hilbert subspace that is subject to quantum control; each system is capable of storing a qubit. The physical implementation of the qubit and its measurement device follows one of many possible designs including linear optics, ion traps, and superconducting qubits.

[0059] Bell's inequality consists of an inequality that always holds for any local probability distribution of the results of measurements by two parties, and this inequality can be realized when the device on each party has its own internal state. This state may be related to the state maintained by the other party, but each system they have has its own separate description, without having to describe the pair as a whole. Ensemble (ensemble) . This means that in principle, the apparent randomness found by measuring one subsystem can be thought of as arising from ignorance of what state the subsystem is in fact in. However, entangled states in quantum mechanics give rise to a non-local probability distribution. Since this distribution cannot be thought of as arising from ignorance of what state each subsystem is in, since the subsystems cannot be said to be in fact in any state at all: the state must be described as a whole. This opens the door to the possibility of true randomness, and so the present technique seeks to measure violations of Bell's inequalities, in order to be able to prove that random bits are being output as a measurement from a measuring device. While it is impossible to violate Bell's inequalities classically, for a particular choice of measurements, purely entangled quantum states can be found to violate one of them without any loopholes.

[0060] Safety Test B is optional and checks whether the quantum system is signal-free (i.e., the quantum systems 202, 204, 206, 208 do not affect each other). Safety Test B is performed after Safety Test A because Safety Test B is related to the signal-free nature of the quantum system when it operates as a quantum system, and not to any classical particles passing through the quantum system due to noise. Safety Test B involves making repeated measurements using the measurement device 212, and testing to see if the measurement results are correlated between the quantum systems, even if the measurement references are set in a way that is partially correlated between the measurement devices.

[0061] Figure 2B yes Figure 2A Another schematic diagram of a four-device quantum device of FIG. Four state expanders are depicted as boxes 210, and these boxes receive as input quantum particles represented by circles inside the squares. Each state expander 210 is attached to a measurement device 212.

[0062] One in Figure 2B The method of operating the four-device quantum device includes: in operation A, by preparing the state of the quantum particle in the state expander, the state expander attached to each measurement device interacts. Figure 2B 2 is indicated by the dashed line around box 210. This may be a probabilistic interaction rather than a deterministic interaction, in which case the process of the ready state does not have a fixed length.

[0063] In operation B, once the correct entangled quantum state is prepared, it is input into U i Provided to four measurement devices, and measure the quantum system. Input U i is a measurement setting selected using a weak randomness source and used to set a measurement reference at the measurement device 212. Figure 2B The symbol X in i The measurement results shown are output by the measurement device 212 (operation C).

[0064] repeat Figure 2B Operations A to C shown in the figure. Input U i and output X i There is no interaction between the boxes in between. Note that between operations A and B, the system is in a state that cannot be described as consisting of the individual states of its subsystems: the system is therefore described holistically between operations A and B.

[0065] Figure 2C yes Figure 2A and Figure 2BFlowchart of a method of operating a four-device quantum device. Generate 230 qubits in a plurality of quantum systems such as four quantum systems. For example, as shown in equation 3 below, prepare 232 qubits in a specified entangled quantum state. This can be done using a state expander. Prepare four qubits so that they interact with each other to produce a specified quantum state for the device, which is a quantum state of a type called an entangled state. This utilizes both two-qubit interactions and single-qubit interactions. Use input from a weak randomness source to configure 234 the settings of the measurement device. The weak randomness source is used to independently configure settings for each measurement device 212. These settings are derived from the measurement reference used in the method of operation. For example, a weak randomness source can be used to select a measurement setting for each of the four measurement devices 212 from two measurement references (e.g., a calculation reference and a Hadamard reference, which can each have two basic states or basic vectors). The measurement setting is used to configure the setting of the measurement device 234. Each of the four qubits is measured according to its measurement setting. Depending on the precise implementation of the quantum device, this may include changing the settings of the detector or converting the qubits on the channel of the measurement device. Then, the qubit is measured. Remarkably, this effectively destroys the quantum state. The detector will then output a value containing the measurement result x i bits, and then the next round of measurements begins. In one example, the settings include two possible orthogonal polarizations (e.g., horizontal and vertical) and two possible qubit patterns. Once these settings are configured, the detectors in the measurement device begin sensing detected particles received on the path from the source to each detector. The measurement process 236 produces a measurement result when measuring, and the measurement result is stored 238 together with the relevant values ​​of the settings of the measurement device. Check 240 whether to repeat to obtain more measurement results. The check includes checking criteria, such as whether a specified time has passed, whether a specified number of measurement iterations have passed, or whether the memory storing the measurement results is full. Once the check at operation 240 indicates that no further repetition is required, the stored measurement result is output 242.

[0066] Additional details of at least four certain quantum device embodiments are now given.

[0067] Consider two strings set by the measurement given by:

[0068] U0={{0001},{0010},{0100},{1000}} and

[0069] U1={{0111}, {1011}, {1101}, {1110}},

[0070] Therein, U0 is a set of four possible measurement setups, and U1 is a different set of four possible measurement setups.

[0071] The Bell inequality used in this example is as follows:

[0072]

[0073] where B is the indicator vector for Bell’s inequality and P(x|u) is the conditional probability distribution of the outcome or measurement value x given the input or measurement setting u.

[0074] In some embodiments, B is a 4 ×2 4 Index vector of entries:

[0075]

[0076] Among them, if the expression E is true, then the indicator function is equal to 1, otherwise it is equal to 0.

[0077] In some embodiments, the Bell inequality indicator function B is implemented using a 16×16 array or matrix whose entries are either zero or one. The columns of the array represent possible configurations of the detectors, and the rows of the array represent possible observations at the detectors. In some embodiments, since there are four measurement devices, each with four detectors, there are 16 possible detector configurations. Instead of an array or matrix, many other data structures may be used, such as a bitmap, a hash table, a lookup table, or a search tree. In some embodiments, data structures that allow fast searching or lookups are preferred, because in some embodiments, an array or data structure is used as a lookup mechanism, where a combination of four input bits and four output bits is effectively used as a key to find the value of the Bell inequality indicator function.

[0078] An example of an array is given as follows: Let the four input bits of the device be V1, ..., V4 and the four outputs S1, ..., S4. Then the function B(V, S) is defined as follows, where Represents the XOR (exclusive OR) operation:

[0079]

[0080] Where U0 and U1 are as defined above. Although there are 16 possible combinations of values ​​for the detector settings, only 8 are used in this example for clarity. If the function B(V,S) is implemented as an array or matrix, the remaining 8 values ​​in the detector settings can be filled with zeros.

[0081] Make V i and S i is the vector of inputs / outputs of the protocol’s round i. The security test will calculate:

[0082]

[0083] The use of Bell's inequality indicator vectors provides an efficient and accurate way to evaluate coincidences observed at detectors. If coincidence is observed at detectors on different channels in the same measurement device, the coincidence is classical noise. If coincidence is found at detectors in different measurement devices of a pair of measurement devices, the coincidence comes from quantum effects. The security logic uses the array (or similar data structure) and the observed coincidences to perform a coincidence evaluation to see if the result is less than 2 for each possible configuration setting. Since there are 16 possible configuration settings, the security logic will look for a coincidence evaluation result that is less than one eighth (i.e., 2 divided by 16).

[0084] The quantum states used in this protocol are:

[0085]

[0086] in,

[0087]

[0088]

[0089]

[0090]

[0091] where, in at least some embodiments, {|0>,|1>} is a computational basis (sometimes referred to as a standard basis), and in at least some embodiments, {|+>,|->} is determined by and Given a Hadamard or Fourier datum.

[0092] The quantum state |Ψ> in this example is two quantum states ( and ), which are the maximally entangled states of the two qubits. There are several ways to generate the state |Ψ>. For example, one possibility is to implement a quantum unitary that maps the direct product state |0>|0>|0>|0> to |Ψ>. To implement this example unitary, it can be decomposed into simpler one-qubit unitary and two-qubit unitary using the Solovay-Kitaev construction.

[0093] Enter u i = 0 corresponds to measurement on the X basis (or Hadamard or Fourier basis), while input u i= 1 corresponds to a measurement on the Z basis (or computation basis) (for each of the inputs i∈{1,2,3,4}). To measure the Z basis, for example, one can first apply a single-qubit unitary rotation to a Hadamard or Fourier basis and then measure on the computation basis. Under ideal conditions, an implementation of the above Bell test using such an entangled state and quantum measurement gives B·{P(x|u)}=0.

[0094] Now refer to Figure 4 Security Test A for the four-quantum device embodiment is formally described.

[0095] The string from the weak random source w2 is used to select the measurement input in the above-mentioned Bell experiment; for example, for each of the n realizations of the experiment, 4 bits from w2 can be used to select (u i ) j , j ranges from 1 to n. Then collect the output (x i ) j , these outputs are concatenated together to form the string w3. 400 test statistics are calculated based on the values ​​of the outputs in string w3. The statistical test includes the calculation function:

[0096]

[0097] This can be expressed in words as follows: The test statistic is calculated as the inverse of the number of measurements, times the sum of the number of measurements of the appropriate entries from an array of 16 by 16 values ​​(or similar data structure) as the Bell inequality indicator vector. The appropriate array entries are found using the observed measurements and the detector settings for the observed measurements.

[0098] If the test statistic L n The calculated value is less than the threshold b (see Figure 4 If the check 402 in the process is not completed, the process continues 404. Otherwise, the process fails 406 and returns to Figure 2C Operation 408.

[0099] In general, unless L n<b, otherwise the process is terminated, where b is a free parameter selected according to the quality of the initial weak random source 218; the smaller the increment, the less noise the protocol can tolerate, but on the other hand, it can amplify the randomness of the weak random source. For a practical implementation, b=0.01 can be selected, for example, which gives an output random bit that differs from a truly random bit (in variational distance) by at most 0.0001 (which is negligible in most applications). At the same time, a value of b=0.01 means that the protocol can be successfully run even with accurate currents achieved in linear optical devices, ion traps, and superconducting systems (measured with an accuracy of about 99.2%). In another embodiment, b=0.125 and the Bell inequality tested for it is equation 1 above. However, in some cases, other thresholds b can be used with the Bell inequality of the above equation or other Bell inequalities.

[0100] Quantum mechanics exhibits a property called signallessness, which means that despite the existence of entangled states that produce nonlocal probability distributions, this nonlocality cannot be exploited to provide instantaneous communication between parties that own the quantum system. Many Bell inequalities have the property that there are other physical theories that, while still obeying the signallessness principle, lead to larger Bell violations than quantum mechanics. A famous example is the CHSH inequality, which allows for a value of , compared to the classical value of 2. ; however, the signal-free theoretical implementation of the Popescu-Rohrlich (PR) box allows for a value of 4. If the correctness of quantum mechanics is not taken as an additional axiom of the current technology, then the CHSH calculated value is cannot be considered completely secure, because the quantum system could have been replaced by a convex mixture of PR boxes and local distributions. In theory, this could result in an adversary knowing 29% of the random bits. Although such attacks may be unlikely, the four-device procedure is secure against them. This is because, in some embodiments, the Bell inequality used has the property that there is no signaling theory that allows a larger violation than quantum mechanics, so attacks based on alternative physical theories are infeasible. This is an example of the maximum non-locality accessible to quantum; it is an example of quantum accessibility to logical non-locality. It is worth noting that both Einstein's special and general theories of relativity affirm the no-signaling principle. Therefore, the methods used in the four-quantum-device arrangement are guaranteed by general physical principles, rather than necessarily relying on the absolute correctness of quantum mechanics.

[0101] In the four-quantum device embodiment (and the two-quantum device embodiment), an example of security test B is formally described as follows:

[0102] Safety test B consists of checking whether the four different quantum systems are approximately signal-free with respect to each other. To precisely explain what it means to be signal-free with respect to each other, consider the probability distribution of the outputs x1,...,x4 conditional on the inputs u1,...,u4:

[0103] p(x1,x2,x3,x4|u1,u2,u3,u4)

[0104] For any pair of measuring devices using the settings u1, ..., u4 for the first time and u′2, u′3, u′4 for the other time, and also for the three other combinations of paired measuring devices, the approximate no-signal condition is expressed as:

[0105]

[0106] That is, the distribution of the edges of any measurement device is almost unaffected by the measurement choices in other measurement devices (technically assuming that the variational distances of all edges are the same with some small error ε, which is a parameter of the test and is considered to be, for example, ε=0.02 in the embodiments discussed above). A weak random source is used to generate (u i ) j , which is input to the measurement device to configure the detector settings. The measured output is (x i ) j . The device then calculates the empirical distribution q(x1,x2,x3,x4|u1,u2,u3,u4) based on the obtained frequencies. For any u1,...,u4 and u′2,u′3,u′4, and similarly for the other quantum systems 2, 3 and 4, the process is terminated unless the following is satisfied:

[0107]

[0108] In summary, reference Figure 5 , Safety Test B includes configuring the measurement setup of the apparatus for all measurement devices of the apparatus using a weak randomness source 104 such as WSR-1 (block 500). For each measurement device 502, the Safety Test B process repeatedly measures 504 for each possible configuration of the setup of the measurement device. A baseline histogram is stored 506 for each measurement device, which shows the detection frequency of particles for each configuration of the measurement setup.

[0109] For each combination of measurement settings 508, the process falsifies one of the settings to make it match the settings from the other measurement device. The measurements are repeated and the results are stored 512 in a test histogram.

[0110] A check 514 is performed to see if any of the test histograms for the measurement device is significantly different from the baseline histogram for that measurement device. If there is a significant difference, an alarm or abort step 516 is taken because there is some degree of interaction between the measurement devices that indicates they are not signal-free. Otherwise, the process continues 518 to prove that the measurement device is approximately signal-free.

[0111] Figure 3A In some embodiments, the Figure 1 An example of an exemplary two-device quantum device of the quantum device 102. In the two-device quantum device, there are two quantum systems 302, 304, each system including a state expander 310 and a measurement device 312. A source of qubits is connected to each state expander 310 and produces qubits. The qubit travels into the state expander 310, and as the qubit travels through the state expander 310, the state of the qubit is prepared to enter a specified state. The prepared states of the qubit are formally listed below. The measurement devices 312 each include a plurality of detectors that detect qubits and can be configured into one or more configurations according to a set value generated by a weak randomness source 318. The weak randomness source 318 generates a random bit string (or other random number) and inputs it to a driver 316. The driver 316 drives the configuration of the detectors in the measurement device 312 so as to change the value of the polarization and / or the value of the mode of the detector.

[0112] The prepared qubits travel from state expander 310 into measurement devices 312. Each measurement device has multiple possible paths that the particle can follow. Each path goes from a state expander to a detector. The lengths of these paths are substantially the same, so the time it takes for the qubit to travel along each path is roughly the same. Measurements are made at almost the same time on each detector, and an output signal 314 is generated, which in some examples is in the form of a bit string, one bit per detector, where a bit of 1 indicates a detected particle and a bit of 0 indicates that a particle was not detected. Output signal 314 is input to component 320 that performs security test A. Component 320 receives information from a weak randomness source 318 so that component 320 knows the configuration settings of measurement device 312 used to obtain output signal 314.

[0113] In some embodiments, security test A implemented by component 320 differs from security test A for a four-device quantum apparatus because it implements an additional test represented by security test C.

[0114] If security test A passes, security test B is optionally performed using component 322. In some embodiments, security test B is the same as described above for a four-device quantum device. Output signal 326 includes output signal 314 and information that security test A (and optionally, security test B) has passed. Thus, the downstream system has information proving that output signal 326 was generated by a quantum system and therefore has true randomness.

[0115] Figure 3B is used for Figure 1 Another schematic diagram of an exemplary two-device quantum device in the apparatus of . Figure 3B A state expander 310 and a measurement device 312 are shown. Qubits (represented by circles within squares) are input to the state expander 310, and the state expanders interact so that the qubits become entangled and placed in superposition (the states of the qubits prepared by the state expander 310 in the two-device arrangement given below). Detector settings u1 and u2 are input to the measurement device 312 to set the configuration of the detectors in the measurement device according to the input from the weak randomness source. The measurement device measures the particles that reach the detectors and outputs signals x1, x2.

[0116] In the case of an exemplary two-device quantum system, the method of operation is very similar to the method of operation of the exemplary four-device device quantum system described above. However, in at least some embodiments, the states formed in operation A are different, and the detector settings are different in both number and definition. Some two-device embodiments will now be further described in the next few paragraphs without repeating phrases such as "in some embodiments" in each step.

[0117] Figure 3A and 3B A two-device quantum device of involves measuring four qubits: two located at each of the two physical devices (as opposed to the exemplary four-device quantum device which has four physical devices). Figure 3C , the process at the two-device quantum device is as follows: qubits are generated 330 in a plurality of quantum systems within two quantum devices 310. The two quantum devices 310 interact to form an entangled quantum state. An entangled quantum state is prepared 332 as defined in equation 10 below.

[0118] The weak randomness source is used to independently configure settings for each measurement device 312. These settings are derived from measurement benchmarks available in the operating method. For example, the weak randomness source can be used to select measurement settings from nine measurement benchmarks for each of the two measurement devices 312. The measurement settings are used 334 to configure the settings of the measurement devices.

[0119] Measurements are performed at both measurement devices 336 and the measurements are stored 338 together with the values ​​of the measurement reference (settings). The process checks at operation 340 whether repetition is required, and if so, the process repeats from operation 330. If the check at operation 340 indicates that the stored measurements are not to be repeated, the associated settings are output 342. The decision whether to repeat is made at operation 340 using criteria such as one or more of the following: time interval, number of repetitions, number of stored measurements, amount of available memory for storing measurements.

[0120] The output measurement is checked against Bell's inequality. If it is violated, the output measurement is known to be from quantum effects and is input to the reference Figure 1 In the explained randomness extractor. If the Bell inequality is satisfied, then the output measurement result is known to come from a classical effect and is rejected. Optionally, another check (safety test B) is performed as described below.

[0121] The Bell inequality to be tested can be expressed as:

[0122]

[0123] Where B is the indicator vector, including the B The indicator function is defined as:

[0124]

[0125] It can be expressed in words as follows: If the measured value and the measured setting value are in the set S B , then the value of the indicator function B for a given measurement value x and the associated measurement setting value u is equal to 1; otherwise the value of the indicator function is zero.

[0126] The set S B A collection of 18 quantum states is included, represented herein as non-normalized quantum states, which are grouped into 9 different bases represented below as M1 to M9. In this example, each channel is a path that a quantum bit can follow from the source to the detector, and the lengths of the channels are substantially the same.

[0127]

[0128] M1={|v1>, |v2>, |v3>, |v4>}

[0129] M2={|v4>, |v5>, |v6>, |v7>}

[0130] M3={|v7>,|v8>,|v9>,|v10 >}

[0131] M4={|v 10 >,|v 11 >,|v 12 >,|v 13 >}

[0132] M5={|v 13 >,|v 14 >,|v 15 >,|v 16 >}

[0133] M6={|v 16 >,|v 17 >,|v 18 >,|v1>}

[0134] M7={|v2>,|v9>,|v 11 >,|v 18 >}

[0135] M8={|v3>,|v5>,|v 12 >,|v 14 >}

[0136] M9={|v6>,|v8>,|v 15 >,|v 17 >} (9)

[0137] Thus, when the measurement device is configured for measurement reference M1, it can only receive on channels 1, 2, 3 and 4. When the measurement device is configured for measurement reference M2, it can only receive on channels 4, 5, 6 and 7; and so on for the other measurement references.

[0138] A context-independent hidden variable assignment for each possible measurement would mean assigning 0 and 1 to each vector so that there is exactly one vector with 1 assigned to it in each measurement basis. There are 9 measurement basis, so there is an odd number of 1 assignments in total. However, note that each vector appears in exactly two measurements, so any arbitrary assignment of 0 and 1 to the vectors must result in an even number of 1s in the measurement basis. Such context-independent assignments are therefore impossible: this is called a proof of contextuality. Note that it is not necessary to consider the actual probability of getting any measurement outcome, or even their likelihood: this is an example of a maximal contextuality that manifests itself in a state-independent way.

[0139] The two measuring devices 312 enable all nine measurement references M iavailable to them and randomly choose between them. Thus, there are eighty-one different possibilities for the estimate of u, which represents the measurement equipment setting. If the result x1 in u1 is proportional to the result x2 in u2, then the pair (x,u) is defined as B Select the entanglement state:

[0140]

[0141] (which can be expressed in words as half the sum of the tensor product of |0> with itself plus the tensor product of |1> with itself plus the tensor product of |2> with itself plus the tensor product of |3> with itself; |i> can represent a qubit on channel i) to obtain the set S B Every measurement in is impossible, so the left side of the Bell inequality is 0 (eg, Equation 6 above). Therefore, there is a maximum amount of nonlocality with respect to the set of signal-free physical devices.

[0142] Now refer to Figure 6 The security test for the two-device quantum device embodiment is described. By calculating the test statistic L at operation 600 n to complete security test A. Security test A is the same as described above with reference to the four-device quantum device embodiment. If the test statistic L at check 602 n If the value is below the threshold, the process proceeds to the safety test C, thereby calculating 610 the test statistic S n (x,u). Using mathematical notation to describe a safety test A, the device computes the test statistic defined by:

[0143]

[0144] Unless L n <b, the device stops (see Figure 6 Failure block 606) of the process, where b is a free parameter selected for the quality of the initial weak random source 318. In one embodiment, b = 0.125.

[0145] If the test statistic L n If is less than the threshold value b, the process continues to perform an additional safety test called safety test C. Safety test C consists in setting u for any fixed measurement * Define the random variable as D(x j ,u j ):

[0146]

[0147] where x * is the measurement result, u* is the preferred measurement setup. In words, a random variable D for an observed measurement value and corresponding detector setup is equal to 1 if the observed measurement value is equal to the specified measurement result and the measurement setup is a fixed measurement setup; otherwise D is zero. The value of the random variable can be looked up from an array of zeros and ones, where the array has one column for each combination of measurement setups and one row for each combination of measurement values. The array is populated using the same principles as for the four quantum system device embodiments described earlier in this document. As before, other data structures such as hash tables can also be used.

[0148] The test statistic for the safety test C is defined as:

[0149]

[0150] It can be expressed in words as the test statistic for the safety test C is equal to the inverse of the number of measurements made times the sum of the values ​​of the random variable D corresponding to the observed measurement values ​​and the corresponding values ​​of the measurement settings. In some embodiments, as described above, the value of the random variable D is looked up in an array or other data structure that provides a lookup mechanism.

[0151] The parameter μ is fixed at a value greater than zero (μ>0), and a test statistic of the safety test C is checked to see whether it is greater than or equal to the value of the parameter μ, which is mathematically expressed as S n (x,u)≥μ. When the test accepts (e.g., the test statistic of the safety test C is greater than the value of the parameter μ), this is taken as an indication that the measurement device 312 is correctly generating the input setting u * The randomness of and the process continues to 614. However, if the test fails (for example, the test statistic of the safety test C is less than the value of the parameter μ), the process aborts and returns to Figure 2C Operation 230, such as Figure 6 As shown in box 608.

[0152] In summary, in the two-device embodiment, security tests A and C act as tests of Bell's inequality. If these tests pass, the detector's measurements are proven to be produced by qubits rather than classical particles.

[0153] In another embodiment, Figure 1 The quantum device 102 may include a quantum system of only two qubits with four free modes, and has a measurement device that obtains only two different quantum measurement values ​​for each quantum system. In this case, the security test A may implement a CHSH test. The CHSH inequality may be used in the proof of Bell's theorem.

[0154] Now give the Figure 1 More details of the randomness extractor 110 of the present invention. Typically, the randomness extractor 110 is a deterministic function that takes one or more random bit strings as input and produces a completely random bit sequence as its output signal 116. The one or more random bit input strings can be one or more strings of weak random bits (for example, a weak random bit string can have a deviation close to 0, rather than being uniformly random). Unprovable uncertainty random numbers are an example of weak random numbers. Typically, random extraction is not possible unless there are two or more sources (although they may not be completely random themselves, they are independent of each other). Typically, this cannot be achieved in a device-independent manner; however, the present technology proves that the output string 108 given by the measurement result is independent of the weak random number 112 (provided by WSR-2, i.e., weak randomness source 114), which is also sent to the randomness extractor 110. The assumption that the WSR-2 can be considered as a Santha-Vazirani source is sufficient to prove that the measurement results 108 of the quantum device 102 are completely independent of the weak random numbers 112 sent directly from the WSR-2 to the classical randomness extractor 110. The presence of quantum noise does not weaken this fact so that it no longer applies: even taking into account the noise, the measurement results form a random source of extremely low minimum entropy.

[0155] This means that the randomness extractor 110 must only operate in a classical setting for which there are known methods for extracting truly random strings. Although it is classically impossible to guarantee the independence of the two inputs 108, 112 relative to the randomness extractor 110, this guarantee has been made possible by exploiting the non-local measurement properties of entangled quantum systems in the quantum device 102. There are many such classical randomness extractors 110, including but not limited to: von Neumann extractors, chaos machines, cryptographic hash functions. An example is Li's randomness extractor ("Improved constructions of two-source extractors", Xin Li, arXiv:1508.01115, August 5, 2015), which provides a practical option for the protocol. Other suitable example randomness extractors include implementations of Trevisian's randomness extractor and / or a Toeplitz hash extractor as described in Ma et al., "Postprocessing for quantum random-number generators: entropy evaluation and randomness extraction," arXiv:1207.1473v2, June 22, 2013.

[0156] Figure 7 Such as in Figure 1 Flowchart of an exemplary method of operation of the randomness extractor 110 in an arrangement of . At 700, if the measurement performed by the quantum device passes the security test, the measurement string output by the quantum device can be proven to be generated by quantum effects. The measurement string may include reference Figure 1 The output string 108 described herein. As described herein, the security test may include one or more of a security test A (eg, for a two-device quantum device), an optional security test B, or a security test C. See, for example, reference Figure 2A and Figure 3A At 702, the measurement string is passed to a two-source extractor. At 704, the two-source extractor receives input from a second weak randomness source (e.g., WSR-2 114). Because the security test passed at 700, it can be known with certainty that the measurement string and the second weak randomness source are independent. The two-source extractor combines these inputs and outputs a random number at 706. The random number may include the random number as described in reference to Figure 1 The output signal 116, Figure 2A The output signal 226 or Figure 3A The output signal 326 describes a completely and provably random bit sequence.

[0157] So far, the technology has been described in this article using general language to explain the technology in terms of qubits, measurements, channels, quantum states, etc. This is to emphasize that the technology can be implemented in a variety of different physical platforms. Now three specific platforms suitable for implementing the technology are given. The following three platforms are intended to illustrate but not limit example implementations of the technology.

[0158] Optics:

[0159] In optical systems for quantum information processing, units of light in a given mode, called photons, are used to represent qubits. Operations by optical elements (beam splitters, mirrors, and phase shifters) are used to implement quantum gates on qubits. In order to prepare the states of many photon qubits, a well-established optical parametric down-conversion procedure is used. In optical parametric down-conversion, a light beam is sent through a nonlinear crystal, which then outputs a pair of photons entangled in its polarization (or momentum). Another method is to generate single photons of well-defined quantum states. Again, this can be done using optical elements. Another element that can be used to implement a general quantum circuit is a quantum gate (conversion of the quantum state of one or more photons). The basic principle is that any arbitrary 1-qubit unitary operation can be constructed using a beam splitter and / or a phase shifter. For a two-qubit gate, an optical device (e.g., with Kerr nonlinearity) can be used like a Kerr nonlinear scheme or a measured value can be used to simulate nonlinearity. The measurement of photons can be performed with an industrially manufactured photodetector including a pn junction that converts photons into current.

[0160] In an example using optics, four individual photons are created by using parametric down-conversion to generate four pairs and detecting one photon from each pair to herald the other. The photons are then made to interact using the scheme of Knill, Laflamme, and Milburn, "A scheme for efficient quantum computation with linear optics," Nature, 409(6816): 46-52. Alternatively, the photons are made to pass through a nonlinear optics with a large third-order nonlinear susceptibility x as described in Pritchard, Weatherill and Adams, "Non-linear optics using cold Rydberg atoms," Annual review of cold atoms and molecules, 1(301), 2013. (3) The avalanche photodiode then measures the photon, and outputs the result (either a photon has been seen, or not) as the measurement result x. i . These steps will be repeated in the next round.

[0161] Ion trap:

[0162] The device can be a linear array of trapped atoms (e.g., via an electromagnetic standing wave). Each ion stores a qubit in two ground state hyperfine levels. Hyperfine qubits are extremely long lived (e.g., thousands to millions of years of decay time) and are stable in phase and frequency (hence traditionally used for atomic frequency standards). The ion's qubit state is prepared into a specific qubit state using the well-known process of optical pumping.

[0163] The measurement can be done as follows. Laser light is applied to an ion in only one coupled qubit state. When the ion collapses into this state during the measurement, the laser will excite it, causing photons to be released as the ion decays from the excited state. After decay, the ion is continuously excited by the laser and repeatedly emits photons. These photons can be collected by a photomultiplier tube (PMT) or charge-coupled device (CCD) camera. If the ion collapses into another qubit state, it does not interact with the laser and does not emit photons. By counting the number of photons collected, the state of the ion can be determined with very high accuracy (e.g., greater than about 99.9%).

[0164] Quantum gates can be implemented as follows. Single qubit gates can be implemented using magnetic dipole transitions or stimulated Raman transitions for hyperfine qubits and electric quadrupole transitions for optical qubits. Two qubit gates can be implemented by coupling the electronic state of an ion to a collective molecule. Using the Cirac-Zoller scheme, four entangled ions can be generated. The Cirac-Zoller scheme is described in "Quantum Computations with Cold Trapped Ions" by Cirac, JI, Zoller, P. (1995-05-15) (Physical Review Letters. 74 (20): 4091–4094).

[0165] In the example using an ion trap, four entangled ions are generated, Figure 2A Each of the four measurement devices of the quantum device receives an input bit u i , i∈{1,2,3,4}, which selects a specific measurement setup. To measure each of the four qubits stored in the ion, the setup detects it using a CCD camera (if u i = 0 and wish to perform measurements on a computational basis), or first the device applies a laser to rotate the qubit to a Fourier basis and then performs a measurement using a CCD camera to measure the ion (if u i =1). The detector output then contains the measurement result x iRepeat these steps for the next round.

[0166] Superconducting circuits:

[0167] Randomness generation protocols can also be implemented in superconducting circuits.

[0168] Examples of quantum devices using optical systems

[0169] Reference now Figures 8 to 12 A detailed embodiment is described in Figures 8 to 12 In the embodiment, an optical system is used to implement the quantum device 102. The following detailed description is intended to illustrate the reference Figures 8 to 12 The embodiments are described but are not intended to limit the scope or design of the device.

[0170] A conventional laser can be used to generate photons, some of which are classical and others of which are entangled quantum photons. The photons from the laser are input to one or two pairs of parametric down-conversion waveguides, so that the entangled quantum photons have more than one path to follow in the waveguides, and so that the quantum photons interact with each other. The parametric down-conversion waveguides cause at least some of the photons to interact with each other because the scheme of Knill, Laflamme and Milburn, "A scheme for efficient quantum computation with linear optics" (see Nature, 409(6816): 46-52) is used in this embodiment. As a result, the output of the waveguides includes a stream of photons, some of which are classical photons, and some of which are entangled and interact in a quantum state according to the Knill Laflamme Milburn scheme.

[0171] The photon stream enters multiple measurement devices. Each measurement device has multiple possible paths that the photon can follow, each ending in an avalanche photodiode or other photon detector. The paths are the same length. Therefore, a quantum photon in a superposition state will travel along all the paths available to it and arrive at each photon detector at the end of these paths at the same time. By looking for coincidences at the detectors (multiple detectors detecting photons at the same time), evidence of quantum photon superposition can be found. Classical photons can also travel along the paths in the measurement devices, but not in superposition. Therefore, by looking at the output pattern at the detectors, evidence of classical photons can also be found. The measurement settings of the detectors are changed in order to increase security and avoid any risk of a malicious party knowing the measurement settings and tampering with the results. In some embodiments, millions of measurements can be made, and the evidence for and against the existence of quantum photons can be summarized before a decision is made as to whether the output of the measurement device comes from a quantum system.

[0172] In this example, Figure 2A The state expander 210 has two optical waveguides 810, and Figure 8 is a perspective view of such an optical waveguide. Waveguide 810 is suitable for use in other types of quantum devices as well as Figure 2A quantum device.

[0173] In the optical case, the state expander 210 can exploit quantum superpositions of entangled photons. The state expander 210 can have at least one pair of waveguides, each waveguide 810 comprising a plurality of blocks of light-shifting material 800 interspersed with a plurality of polarization modifiers 802. The waveguide 810 has an input end 804 to receive a pair of entangled photons from a source (e.g., a laser). The photons are transmitted through the waveguide and are deflected by the blocks 800 and polarized by the polarization modifiers 802. The waveguide has two output ends 806, 808, one for each of two mutually orthogonal polarizations.

[0174] Each member of the pair of entangled photons has a mutually orthogonal polarization relative to the other member of the pair. Input 804 is connected to the pair of waveguides (although Figure 8 Only one waveguide is shown in the figure), so that each waveguide receives one of the pair of entangled photons and guides the entangled photons in the waveguide through the light shifting material block 800 and the polarization modifier 802 to produce a quantum superposition of photons, whereby there are multiple paths followed by the photons in the waveguide, and the polarization changes along the path. Fig.10 A number of possible paths are shown in more detail in .

[0175] The size and shape of each waveguide 810 is determined so that for each entangled photon, the length of the path traveled by the photon through the waveguide is substantially the same regardless of the mutually orthogonal polarizations of the entangled photons.

[0176] Each waveguide 810 has a pair of output fibers 806, 808, with each output fiber 806, 808 of the pair being configured to accept light polarized at one of the mutually orthogonal polarizations and to reject light polarized at the other mutually orthogonal polarization.

[0177] Fig. 9 The waveguide 810 is shown in a housing (also referred to as an enclosure) 900 having a longitudinal channel 902 sized and shaped to accommodate the waveguide so that the block of light displacement material 800 fits against the side of the channel 902. The housing 900 has a removable cover that seals the channel 902 once the waveguide is inside the channel. The enclosure housing 900 and cover act to protect the waveguide from environmental conditions such as humidity, dust, movement, temperature changes, and other environmental changes. The enclosure may be formed of a material that reduces the effects of atmospheric pressure, vibration, humidity on the waveguide.

[0178] Fig.10 is through Figure 8 Schematic longitudinal cross-section of a waveguide 810. In this example, there are six blocks of light-displacing material 800, although other numbers of blocks are used in other examples. In this example, there are six polarization modifiers 802, although other numbers of polarization modifiers are used in other examples. In this example, there is one polarization modifier at the output end of the waveguide 802, and the other five polarization modifiers are each located between two different blocks 800. Horizontally polarized photons (represented by H) entering the waveguide are deflected to have two possible paths 1000, 1006 through the waveguide. Vertically polarized photons (represented by V) entering the waveguide are deflected to have two possible paths 1002, 1004 through the waveguide. Note that the multiple paths through the waveguide have substantially the same length because all paths pass through a fixed length of the waveguide.

[0179] like Fig.11A As shown, the light displacement material block 800 includes at least one block 1100 (eg, Fig.11A 1100) and at least one block 1102 (as shown by an upward arrow in the block 1100) formed of a material that causes light to shift in a second direction different from the first direction. Fig.11A 1102). Fig.11A Repeating waveguides are shown to aid understanding of the technique. Fig.11A The upper waveguide in the waveguide shows a horizontally polarized photon entering the waveguide on path 1000 and being deflected / shifted by the block so that the photon (which is an entangled photon output from the laser) can pass through the waveguide along two possible paths 1000 and 1006 simultaneously. Fig. 11B The lower waveguide in the waveguide in shows the same situation for a vertically polarized photon entering the waveguide. Note that, in reality, Fig. 11B The upper and lower waveguides are the same waveguide, and the paths 1000, 1002, 1004, 1006 pass through the Fig.10 A single waveguide is shown.

[0180] At least one block 1100 that displaces light in a first direction is made of an up-air crystal, and at least one block 1102 that displaces light in a second direction is made of a down-air crystal. In this way, the displacement of photons is facilitated, which creates multiple possible paths for entangled photons from the laser to follow, the up-air crystal displacing light in a first direction away from the longitudinal axis of the waveguide. The down-air crystal displaces light in a second direction away from the longitudinal axis of the waveguide and substantially opposite to the first direction.

[0181] Preferably, the plurality of blocks 800 of light-displacing material are made of the same material, as this facilitates manufacturing. However, it is not essential that the same material be used. A non-exhaustive list of examples of materials from which the blocks 800 are made is one or more of calcite or lithium niobate. In a preferred example, the waveguide 810 comprises six blocks of light-displacing material, as this gives a practical working solution that is relatively easy to manufacture. However, in other examples other numbers of blocks 800 are used.

[0182] exist Fig.11A In FIG. 8 , a waveguide 810 is shown having six blocks of light-shifting material made of upper and lower air crystals arranged in the following order from the output end of the waveguide to the input end of the waveguide: lower air crystal, upper air crystal, upper air crystal, lower air crystal, lower air crystal, upper air crystal. This arrangement was found to be suitable for Figure 2A Embodiments of the invention are particularly effective in providing multiple optical paths for quantum states and / or qubits as defined in Equation 3 above.

[0183] exist Fig.11A and Fig. 11B In the example of , the polarization modifiers are placed in the order of blocks of light-shifting material arranged in the following order from the output end of the waveguide to the input end of the waveguide and with or without the following air gaps: polarization modifier 1124, air gap 1122, lower air crystal, polarization modifier 1120, upper air crystal, air gap 1118, polarization modifier 1116, air gap 1114, upper air crystal, polarization modifier 1112, lower air crystal, air gap 1110, polarization modifier 1108, air gap 1106, lower air crystal, polarization modifier 1104, upper air crystal.

[0184] The polarization modifiers may be half wave plates, some of which are separated from the polarization modifiers of adjacent blocks of light shifting material by air gaps. Others of the polarization modifiers may be in contact with the polarization modifiers of adjacent blocks of light shifting material. By selecting the location or size of the air gaps, the ability of photons to be diffracted or shifted within the waveguide is facilitated.

[0185] At least one polarization modifier includes a region 1126 through which light passes without changing polarization. The region is configured to allow light to be transmitted without polarization change. Fig. 11B In the example of FIG. 1 , region 1126 is located in the third polarization modifier 1116 from the output end of the waveguide.

[0186] In some examples, there is a cooling chamber that houses the waveguide and is configured to reduce the temperature of the waveguide to approximately twenty degrees Celsius during operation, as this reduces noise in the generated qubits (i.e., the waveguide 810 generates a higher proportion of qubits in the desired state opposite to classical photons).

[0187] The state expander in the optical embodiment just described receives a pair of entangled photons from a generator such as a laser, each member of the pair having mutually orthogonal polarizations relative to the other member of the pair. The state expander inputs the entangled photons into a pair of waveguides such that each waveguide 810 receives one of the pair of entangled photons and guides the entangled photons along its length within the waveguide to produce a quantum superposition of the photons, such that there are multiple possible paths followed by the photons in the waveguide, along which the deflection varies. The size and shape of each waveguide is determined so that for each entangled photon, the length of the path traveled by the photon through the waveguide is substantially the same regardless of the mutually orthogonal polarizations of the entangled photons.

[0188] Fig.12 is a schematic diagram of an example of a pair of measurement devices 1200 and 1202 for measuring particles received from state expander 810. In this example, measurement devices 1200 and 1202 are optical, and qubits are measured using the same method as described in reference Figures 8 to 11B Note that although in reality Figure 2A There can be four such measuring devices in the device, Fig.12 Only one pair of measuring devices 1200 and 1202 is shown. Figure 3A In the example shown, there are only two such measuring devices.

[0189] Each measuring device 1200, 1202 has multiple possible paths that a photon can follow, each of which ends in an avalanche photodiode or other photon detector. The paths have substantially the same length. Therefore, a quantum photon in a superposition state will travel along all the paths available to it and arrive at each photon detector at the end of these paths substantially at the same time. By looking for coincident patterns at the detector (multiple detectors detecting photons at the same time), evidence of quantum photon superposition can be found, which gives evidence of a violation of Bell's inequality. Classical photons can also travel along paths in the measuring device, but do not overlap and present a different pattern from the quantum photons at the detector. The measurement settings of the detector can be changed to increase safety. Millions of measurements can be made, and evidence supporting or ranging the existence of quantum photons can be summarized to decide whether Bell's inequality is violated.

[0190] Fig.12A pair of measuring devices 1200 and 1202 in are part of an apparatus for detecting entangled photon pairs that are superimposed in a photon stream comprising entangled photon pairs and classical photons. Each measuring device 1200, 1202 has a plurality of detectors (1204, 1206, 1208 and 1210 for measuring device 1200 and 1212, 1214, 1216 and 1218 for measuring device 1202), each detector being arranged to detect a single photon. Each measuring device 1200, 1202 has a detector configuration device to automatically configure the measurement reference of the detector for each detector according to the value of a control parameter. In Fig.12 In the example of FIG. 1 , the detector configuration means in the measurement device 1200 includes polarization modifiers 1240 , 1244 and the optical mode setter 1232 . The detector configuration means in the measurement device 1202 includes polarization modifiers 1242 , 1246 and the optical mode setter 1234 .

[0191] Each measurement device 1200, 1202 has a photon input from a corresponding state expander 810. Each photon input has two photon paths: one for each of two possibly mutually orthogonal photon polarizations (e.g., horizontal (H) and vertical (V)), each photon path travels to a different detector, and wherein the lengths of the photon paths in a single measurement device are substantially the same. Fig.12 , the photons input to the measurement device 1200 are denoted by A, and the photons input to the measurement device 1202 are denoted by A'. The polarization states of the photons are indicated using vertical bars; for example, A|H represents the horizontal polarization state of photon A, while A'|V represents the vertical polarization state of photon A'.

[0192] Furthermore, the photon paths of the paired measurement devices have substantially the same length. That is, the distance from the source to the detector in measurement device 1200 is substantially the same as the distance from the source to the detector in measurement device 1202, and for clarity Fig.12 The same is true for the other two measuring devices not shown.

[0193] Each measuring device includes two polarization beam splitters (PBS) 1228, 1224, 1230, 1226 and one or more mirrors 1236, 1238. When a vertically polarized photon A ( Fig.12A photon A|V) enters the measurement device 1200, it is transmitted to the beam splitter (BS) 1220, through which it is reflected from a mirror and through an optical mode modifier 1232 that potentially changes the optical mode of the photon (depending on how the optical mode setter 1232 is set), reflected from another mirror 1236 back to the beam splitter 1220, and reflected from another mirror into the polarization modifier 1244. Since the photon is already vertically polarized, if the polarization modifier 1244 does nothing, the vertically polarized photon will enter the polarization beam splitter 1224 before being detected by the detector 1210 and not by the detector 1208. If the polarization filter 1244 is configured to change the polarization of the photon passing through it, the photon becomes horizontally polarized and is detected by the detector 1208. Input from the state expander 810 giving a horizontally polarized photon (A|H) follows a path having a configurable polarization modifier 1240 and through a configurable optical mode setter 1232 to the detectors 1204, 1206. The function of the measurement device 1202 when acting on a photon A' in a polarization state A'|H or A'|V is substantially similar to that described for the device 1200.

[0194] The measurement devices detect coincidence, which is the detection of qubits at detectors at substantially the same time. As described in more detail earlier in this document, coincidence is evaluated to see if Bell's inequality is violated. If a detector in a first measurement device in a pair of measurement devices detects a photon at a first time and a detector in another measurement device in the pair of measurement devices detects a photon within a specified time of the first time (coincidence), then the detected photons are likely to be superimposed entangled photons. For example, the specified time period can be in the range of 5 to 15 ns, such as approximately 10 ns.

[0195] However, if a detector in a single measuring device detects a photon at a first time, and another detector in the single measuring device detects a photon within a specified time of the first time (coincidence), then the detected photon may be a classical photon. Again, for example, the specified time period may be in the range of 5 to 15 ns, such as approximately 10 ns.

[0196] In each measuring device 1200, 1202, there are four detectors, including: a first pair of detectors for each of two mutually orthogonal polarizations (1204, 1206 in measuring device 1200; 1212, 1214 in measuring device 1202), and a second pair of detectors for each of two mutually orthogonal polarizations (1208, 1210 in measuring device 1200; 1216, 1218 in measuring device 1202); wherein the first pair of detectors operates for the first optical mode and the second pair of detectors operates for the second optical mode. As shown in reference Fig.12As described, the two mutually orthogonal polarizations may be horizontal (H) polarization and vertical (V) polarization.

[0197] The detector configuration means includes means for changing the number of radians of the phase shift (also referred to as the optical mode) between two specified values ​​(e.g., π radians and π / 2 radians, or another pair of phase shifts that are orthogonal) and changing a plurality of polarization degrees between two specified values ​​(e.g., horizontal and vertical or zero and 22.5 degrees, or another pair of polarization values) for use by each detector. The detector configuration means receives the value of the control parameter from the first weak source of randomness 104 via the device driver 1250.

[0198] In an example, the detector configuration means receives the value of the control parameter as four bits, as this is particularly efficient. However, in other examples other numbers of bits are used.

[0199] In an example, the output of the measurement devices includes two bits for each measurement device, each bit indicating whether a photon was detected at a given measurement reference. In one example, there are four measurement devices, and a lookup table is used to convert the resulting 8-bit output of the measurement devices to a 4-bit output.

[0200] In some embodiments, there is Figure 3A and Figure 3C An example of a two-device photonics implementation. In this case, Figure 3A The source 300 may be a laser that emits photons, some of which are classical and some of which are entangled quantum photons. Figure 3A As shown, there are two quantum physics devices 302 and 304, and Figure 2A Different from the embodiments of the present invention, each quantum device is capable of storing two qubits. Device 302 includes a state expander 310, which includes two waveguides so that it can store two qubits. Device 304 also includes a state expander 310, which includes two waveguides so that it can store two qubits. Figures 8 to 11A and Fig. 11B The quantum states of at least some of the photons stored in state expander 310 in the two-device photonics embodiment are different from the quantum states of the four-device photonics embodiment described above in an example not limited to any particular type of qubit implementation.

[0201] In a two-device photonics embodiment, as Figure 3A The two measuring devices 312 are shown. The measuring devices are usually Fig.12 , but can be modified to use nine different measurement references for each detector. This can be accomplished by using nine different polarization and / or optical mode settings.

[0202] Using the same principles as the four-device photonics embodiment, the pattern of detection events at the photon detectors of the measurement devices is recorded by many measurements at the photon detectors. The pattern of detection events is used as evidence for or against the presence of qubits and violation of Bell's inequality. Optionally, further checks are done (safety test B) as described above.

[0203] As an alternative or in addition to other examples described herein, examples include any combination of the following:

[0204] Clause 1: A method of generating a random bit string, the method comprising: providing a weak source of randomness;

[0205] Providing a quantum device configured to entangle a plurality of quantum particles in a quantum state; measuring each particle of the plurality of particles with two different references;

[0206] Determine the degree of violation of Bell's inequality;

[0207] determining whether to accept or suspend based at least in part on the extent of the determined violation;

[0208] A random bit string is extracted by a two-source extractor. By determining the degree of violation of Bell's inequality, it can be determined whether the output of the quantum device including the measured particle comes from classical effects or quantum effects. If the output comes from classical effects, the process can be aborted. If the process accepts, the output of the quantum device is known to come from quantum effects without the need for human vision or manual inspection of the quantum device itself. When the process accepts, the output includes a measurement of the quantum effect, and the two-source extractor uses this uncertainty output to generate a random bit string according to the requirements required by downstream processes (such as encryption or authentication processes or other downstream processes that use random bit strings). Since the input of the two-source extractor is a random bit string known to come from a quantum source, the output of the two-source extractor is random.

[0209] Clause 2: The method of clause 1, wherein the Bell inequality comprises a Clauser Horne Shimony Holt (CHSH) inequality, wherein when the CHSH inequality is used, there is an accurate and effective method to determine whether the measured output is from a quantum effect or a classical effect.

[0210] Clause 3: The method of clause 1 or clause 2, wherein the plurality of quantum particles is 2 or 4. By using pairs of quantum particles, Bell's inequalities can be evaluated in a particularly efficient manner.

[0211] Clause 4: A method according to any of clauses 1-3, wherein determining whether to accept or abort comprises determining whether the quantum device meets a no-signal criterion. By determining whether the quantum device meets the no-signal criterion, accuracy and quality are improved. This is because situations where quantum systems within the quantum device affect each other are detected, and the process is aborted in these situations.

[0212] Clause 5: A method according to clause 4, wherein the no-signal criterion comprises an approximately no-signal criterion. It has been found that using an approximately no-signal criterion gives accurate working results in a practical and efficient manner. It is more practical to manufacture a system that implements the method in cases where the quantum device only needs to be approximately signal-free.

[0213] Clause 6: A system for generating a random bit string, the system comprising:

[0214] A weak randomness source configured to repeatedly generate a first bit string and a second bit string;

[0215] a quantum device configured to receive the second bit string and output an associated third bit string;

[0216] a security testing device configured to calculate a test statistic by comparing the second bit string and the third bit string for each second bit string and the associated third bit string; a security testing device configured to determine whether to accept or reject an output of the quantum device based on the calculated test statistic; and

[0217] A two-source extractor configured to receive the first and third bit strings if the security test device accepts the output of the quantum device, and to generate a random bit string. The advantage of this system is that it is able to generate truly random bit strings because only outputs of quantum devices that pass the security test and are therefore known to be from quantum effects are used.

[0218] Clause 7: The system of clause 6, wherein the quantum device comprises an optical device, an ion trap, or a superconducting circuit. Thus, a variety of different types of technologies may be used to implement the system.

[0219] Clause 8: A system according to clause 6 or clause 7, wherein the quantum device comprises 2 or 4 quantum systems, each quantum system comprising a qubit. By using pairs of quantum systems, Bell's inequality can be accurately evaluated.

[0220] Clause 9: The system of clause 8, wherein the quantum system comprises a measurement device configured to perform a measurement on a qubit and output a bit comprising the measurement result. The measurement device outputs bits forming a random bit string.

[0221] Clause 10: A system according to any one of clauses 6-9, wherein the security testing comprises:

[0222] A first test, in which violations of Bell's inequalities are measured; and

[0223] The second test is used to determine whether the quantum device meets the no-signal criterion. By using two tests, it can be determined that the output quality from the quantum device comes from quantum effects and also from quantum systems that do not affect each other within the quantum device. Bell inequalities can include the Clauser Horne Shimony Holt (CHSH) inequality.

[0224] Clause 11: The system of clause 10, wherein the no-signal criterion includes use of a near no-signal criterion. Use of a near no-signal criterion is efficient and effective.

[0225] Clause 12: A system configured to output random bits, the system comprising:

[0226] a quantum generator configured to generate a pair of entangled particles a and a';

[0227] a first state extension device configured to generate an entangled state including a and b;

[0228] a second state extension device configured to generate an entangled state including a' and b';

[0229] a first measuring device configured to perform a coincidence measurement related to a double coincidence of ab or a'b or ab' or a'b';

[0230] a second measurement device configured to measure a violation of the Bell inequality and determine whether the entangled state is signal-free; and

[0231] A two-source extractor configured to receive input from a second measurement device and output random bits. The system is a practical device whose output is known to be random bits generated from a quantum system without having to manually inspect the inner workings of the system itself.

[0232] Clause 13: A security testing logic having:

[0233] a memory storing measurements from a measurement device, the measurement output including an indication of whether there is a coincidence, wherein particles are detected substantially simultaneously at more than one detector, the detectors being located at ends of channels different from the particle source and having substantially the same length;

[0234] a processor configured to calculate a test statistic representing a Bell inequality from the stored measurements and compare the test statistic to a threshold;

[0235] The processor is configured to: if the value of the calculated test statistic is below the threshold, generate and output a certificate proving that the measurement value comes from the quantum system. The security test logic is a practical and effective device that can automatically prove that the measurement value comes from the quantum system without manually checking the operation of the quantum system.

[0236] Clause 14: The security test logic of clause 13, wherein the processor is configured to calculate the reciprocal of the number of measurements multiplied by the sum of the appropriate entries in the array storing the binary values, and when each measurement is made, the appropriate entry is looked up in the array according to the value of the measurement setting of the detector used in the quantum measurement device. Because the array is easy to operate, the security test logic can calculate the test statistic in an efficient and accurate manner.

[0237] Clause 15: The safety test logic of clause 14, wherein the array is used to evaluate coincidence as evidence for or against a quantum effect with each measurement value generated. The array is easy to use and store and makes the safety test logic efficient.

[0238] Clause 16: Security testing logic according to any of clauses 13 to 15, wherein the channel carries qubits in any of the following quantum states: a quantum state equal to the inverse of the square root of two times the sum of the quantum states of two pairs of qubits, where the quantum states of the two pairs of qubits are entangled and superimposed; or a quantum state equal to half the sum of the tensor products of the qubits on channel i with the same qubit from 0 to 3. By using these quantum states, Bell's inequalities can be evaluated in an efficient manner. Bell's inequalities can include the Clauser Horne Shimony Holt (CHSH) inequality.

[0239] Clause 17: The security test logic of any of clauses 13 to 16, wherein the processor is further configured to test interactions between individual measurement devices within the measurement device by creating a baseline histogram from the measurement values ​​and comparing the baseline histogram to one or more test histograms of measurement values ​​obtained from the measurement device. In this way, interactions between measurement devices are detected in an efficient and effective manner.

[0240] Clause 18: The security testing logic of any of clauses 13 to 17, wherein the processor is further configured to calculate a second test statistic and take the second test statistic into account before deciding whether to generate the credential. The second test statistic enables accurate and high quality results to be obtained.

[0241] Item 19: A device for forming a quantum superposition of photons, comprising:

[0242] at least one pair of waveguides, each waveguide comprising a plurality of blocks of light-shifting material interspersed with a plurality of polarization modifiers; an input receiving a pair of entangled photons, each member of the pair having mutually orthogonal polarizations relative to the other member of the pair, the input connected to the pair of waveguides such that each waveguide receives one of the pair of entangled photons and directs the entangled photon within the waveguide through the blocks of light-shifting material and the polarization modifiers to form a quantum superposition of the photon, thereby having a plurality of possible paths that the photon follows in the waveguide, along which the polarization changes; and

[0243] The size and shape of each waveguide are designed so that, for each entangled photon, the length of the path the photon travels through the waveguide is substantially the same, regardless of the mutually orthogonal polarizations of the entangled photons. The device is practically deployable and is capable of generating quantum superpositions of photons in a robust and accurate manner.

[0244] Clause 20: The apparatus of clause 19, comprising, for each waveguide, a pair of output fibers, each output fiber of the pair being configured to accept light polarized at one of the mutually orthogonal polarizations and to reject light polarized at the other mutually orthogonal polarization. In this manner, the output fibers provide an output suitable for input to a quantum measurement device for use in evaluating Bell's inequalities.

[0245] Clause 21: The apparatus of clause 19 or clause 20, wherein the plurality of blocks of light-displacing material comprises at least one block formed of a material that displaces light in a first direction and at least one block formed of a material that displaces light in a second direction different from the first direction. In this way, light is displaced in different directions to produce a quantum superposition of photons.

[0246] Clause 22: The device of clause 21, wherein at least one block that shifts light in a first direction is made of an upper air crystal and at least one block that shifts light in a second direction is made of a lower air crystal. Using crystals in this way helps create quantum superpositions of photons.

[0247] Clause 23: The device of any of clauses 19 to 22, wherein the plurality of blocks of light-displacing material are made of the same material. Using the same material reduces manufacturing costs and facilitates easy manufacture and / or repair of the device.

[0248] Clause 24: The device of any one of clauses 19 to 22, wherein the block of light-displacing material is made of one or more of calcite, lithium niobate, etc. These materials are easy to manufacture because they are suitable for cutting or forming into specified sizes and shapes within specified tolerances.

[0249] Clause 25: A device according to any one of clauses 19 to 24, comprising six blocks of light-displacing material. The use of six blocks of light-displacing material has been found to be particularly effective in producing a quantum superposition of photons.

[0250] Clause 26: A device according to clause 25, wherein the six blocks of light-shifting material are made of upper air crystals and lower air crystals arranged in the following order from the output end of the waveguide to the input end of the waveguide: lower air crystal, upper air crystal, upper air crystal, lower air crystal, lower air crystal, upper air crystal. It has been found that this arrangement has particularly good results in generating quantum superpositions of photons.

[0251] Clause 27: The device according to clause 26, wherein the polarization modifier is placed in a sequence of blocks of light-shifting material from the output end of the optical waveguide to the input end of the optical waveguide and with or without the following air gaps in the following order: polarization modifier, air gap, lower air crystal, polarization modifier, upper air crystal, air gap, polarization modifier, air gap, upper air crystal, polarization modifier, lower air crystal, air gap, polarization modifier, air gap, lower air crystal, polarization modifier, upper air crystal. It was found that this arrangement has particularly good results in generating quantum superpositions of photons.

[0252] Clause 28: The device of any of clauses 19 to 27, wherein the polarization modifier is a half-wave plate. The use of a half-wave plate may achieve good results while simplifying the manufacture of the device.

[0253] Clause 29: The device of any of clauses 19 to 28, wherein a plurality of polarization modifiers are separated from adjacent blocks of the light shifting material by air gaps. The use of air gaps is a light weight, low cost solution.

[0254] Clause 30: Apparatus according to any of clauses 19 to 29, wherein the second plurality of polarisation modifiers are in contact with adjacent blocks of light shifting material. Using a 'contacting' arrangement is easy to manufacture and allows for a compact arrangement.

[0255] Clause 31: Apparatus according to any of clauses 19 to 30, wherein at least one of the polarisation modifiers comprises a region through which light passes without changing the polarisation. Using regions in this way is an efficient way of passing light without changing it.

[0256] Clause 32: The device according to any one of clauses 19 to 31, further comprising: a housing for housing the device, the housing being formed of a material that reduces the effects of atmospheric pressure, vibration, and humidity on the waveguide. The use of a housing facilitates the actual deployment of the device.

[0257] Clause 33: The apparatus of any of clauses 19 to 32, further comprising: a cooling chamber housing the waveguide and configured to reduce the temperature of the waveguide to approximately negative twenty degrees Celsius. Use of a cooling chamber helps reduce classical noise.

[0258] Clause 34: A method for generating a state superposition, the method comprising:

[0259] receiving from the generator a pair of entangled photons, each member of the pair having mutually orthogonal polarizations with respect to the other member of the pair,

[0260] inputting the entangled photons into a pair of waveguides such that each waveguide receives one of the pair of entangled photons and guiding the entangled photons in the waveguides along their lengths to produce a quantum superposition of the photons such that there are multiple possible paths followed by the photons within the waveguides, with polarization varying along the multiple possible paths, and

[0261] The size and shape of each waveguide are designed so that: for each entangled photon, the length of the path traveled by the photon through the waveguide is substantially the same, regardless of the mutually orthogonal polarizations of the entangled photons. The method is a practical and effective way to produce a superposition of states. The method is suitable for use with an apparatus that detects entangled photon pairs to evaluate the existence or non-existence of Bell's inequality.

[0262] Item 35: A device for detecting an entangled photon pair in superposition in a photon stream, the device comprising the entangled photon pair and a classical photon, the device comprising:

[0263] At least one pair of measuring devices, each measuring device comprising:

[0264] a plurality of detectors, each detector arranged to detect a single photon;

[0265] A detector configuration device, for automatically configuring a measurement reference of the detector according to a value of a control parameter for each detector;

[0266] A photon input having two photon paths, one for each of two possible mutually orthogonal photon polarizations, each photon path travelling to a different one of said detectors, and wherein the lengths of the photon paths within a single measurement device are substantially the same; and wherein the lengths of the photon paths of the measurement devices in the pair are substantially the same. The apparatus is a practical device for detecting entangled photon pairs.

[0267] Clause 36: The apparatus of clause 35, comprising: safety test logic for evaluating a coincidence detected at a detector, the coincidence being a photon detected at more than one detector within a specified time interval, and wherein the safety test logic performs a check whether a detector in a first measurement device of a pair of measurement devices detects a photon at a first time, and whether a detector in another measurement device of the pair of measurement devices detects a photon within a specified time of the first time, such that the detected photon is likely to be a superimposed entangled photon. In this way, the apparatus is able to gather evidence as to whether a particle detected at a measurement device is from a quantum effect or from a classical effect.

[0268] Clause 37: The apparatus of clause 36, wherein the safety test logic checks for coincidences at which photons are detected at detectors within a single measurement device, such that if a detector within the single measurement device detects a photon at a first time and another detector within the single measurement device detects a photon within a specified time of the first time, then the detected photon is likely to be a classical photon. In this way, the apparatus is able to gather evidence as to whether a particle detected at a measurement device is from a quantum effect or from a classical effect.

[0269] Clause 38: Apparatus according to any of clauses 35 to 37, wherein in each measuring device there are four detectors, comprising a first pair of detectors for each of two mutually orthogonal polarizations, and a second pair of detectors for each of the two orthogonal polarizations; wherein the first pair of detectors operates for a first optical mode and the second pair of detectors operates for a second optical mode. In this way, the detectors are able to detect quantum particles in a superposition state.

[0270] Clause 39: Apparatus according to any of clauses 35 to 38, wherein the detector configuration means comprises means for varying the number of radians of the phase shift between two specified values ​​and varying the degree of polarisation between two specified values ​​for use by each detector. The configuration means has the advantage of being able to easily vary what each detector detects.

[0271] Clause 40: Apparatus according to any of clauses 35 to 39, wherein the detector configuration means receives the value of the control parameter from a first weak source of randomness. This provides a simple and efficient method of configuring the detector.

[0272] Clause 41: Apparatus according to any of clauses 35 to 39, wherein the detector configuration means receives the value of the control parameter as four bits. This provides a compact signal for configuring the detector.

[0273] Clause 42: Apparatus according to any of clauses 35 to 39, wherein the output of the monitoring means comprises two bits for each measuring device, each bit indicating whether a photon was detected at a given measurement reference. This gives a digital measurement output as opposed to an analog output. The digital output facilitates use with downstream digital processes.

[0274] Clause 43: A device for providing a random number, the device comprising:

[0275] an energy source configured to output a qubit;

[0276] A plurality of quantum systems in communication with an energy source, each of the plurality of quantum systems comprising:

[0277] a state expander configured to generate qubits in an entangled quantum state; and

[0278] a measurement device configured to detect the qubits with at least one measurement reference;

[0279] a driver configured to accept a first input from a source of randomness and to adjust at least one measurement reference of each measurement device based at least in part on the first input;

[0280] A hardware processor configured to:

[0281] qubit detection for analytical measurement devices;

[0282] Determine that a violation of Bell's inequality has occurred;

[0283] Determine that multiple quantum systems satisfy the no-signal condition;

[0284] outputting a quantum provable string according to the analyzed qubit detection; and

[0285] A random number is extracted based on the quantum provable string and a second input from a source of randomness.

[0286] Clause 44: The apparatus of clause 43, wherein the energy source comprises a laser.

[0287] Clause 45: The apparatus of clause 43 or 44, wherein the state expander comprises a pair of waveguides.

[0288] Clause 46: The apparatus of any of clauses 43 to 45, wherein the plurality of quantum systems comprises two quantum systems.

[0289] Clause 47: The apparatus of clause 46, wherein the at least one measurement reference comprises two measurement references.

[0290] Clause 48: The apparatus of any of clauses 43 to 45, wherein the plurality of quantum systems comprises four quantum systems.

[0291] Clause 49: The apparatus of clause 48, wherein the at least one measurement reference comprises nine measurement references.

[0292] Clause 50: The apparatus of any of clauses 43 to 49, wherein the source of randomness comprises a weak randomness source or a non-provably nondeterministic random number source.

[0293] Clause 51: An apparatus according to any one of clauses 43 to 50, wherein, in order to determine that a violation of the Bell inequality has occurred, the hardware processor is configured to determine that a test statistic is below a threshold, wherein the test statistic includes: a Bell indicator vector applied to coincidences detected by a measuring device.

[0294] Clause 52: An apparatus according to any one of clauses 43 to 51, wherein, in order to determine that the plurality of quantum systems satisfy a no-signal condition, the hardware processor is configured to compare a first probability distribution of an output of a measurement device conditioned on a measurement setting of the measurement device at a first time with a second probability distribution of an output of the measurement device conditioned on a measurement setting of the measurement device at a second time.

[0295] Clause 53: An apparatus according to any one of clauses 43 to 52, wherein, in order to determine that a violation of the Bell inequality has occurred, the hardware processor is configured to evaluate the value of the random variable corresponding to the observed measurement value of the measuring device and the corresponding value of the measurement setting of the measuring device.

[0296] Clause 54: The apparatus of any one of clauses 43 to 53, wherein the hardware processor is configured to output a certificate that the random number is a product of a quantum effect.

[0297] Clause 55: The apparatus of clauses 43 to 54, further comprising: an application configured to receive the random number, the application comprising a computer security application, a weather forecast application, a telecommunications application, or a manufacturing control application.

[0298] The term "computer" or "computing-based device" is used herein to refer to any device that has processing capabilities to enable it to execute instructions. Those skilled in the art will appreciate that such processing capabilities are incorporated into many different devices, and thus the terms "computer" and "computing-based device" include personal computers (PCs), servers, mobile phones (including smartphones), tablet computers, set-top boxes, media players, game consoles, personal digital assistants, wearable computers, and many other devices, respectively.

[0299] In some examples, the methods described herein are performed by software in a machine-readable form (e.g., in the form of a computer program) on a tangible, non-transitory storage medium, the computer program including computer program code that is suitable for performing the operations of one or more methods described herein when the program is run on a computer, and wherein the computer program is embodied on a non-transitory computer-readable medium. The software is suitable for execution on a parallel processor or a serial processor so that the method operations can be performed in any suitable order or simultaneously.

[0300] This recognizes that software is a valuable, separately tradable commodity. It is intended to cover software that runs on or controls "dumb" or standard hardware to perform a desired function. It is also intended to cover software that "describes" or defines the configuration of hardware such as used in designing silicon chips or configuring general-purpose programmable chips, such as HDL (hardware description language) software, to perform a desired function.

[0301] Those skilled in the art will recognize that the storage device for storing program instructions is optionally distributed across a network. For example, a remote computer can store an example of a process described as software. A local or terminal computer can access a remote computer and download part or all of the software to run the program. Alternatively, a local computer can download a fragment of software as needed, or execute some software instructions at a local terminal and execute some software instructions at a remote computer (or computer network). Those skilled in the art will also recognize that, by utilizing conventional techniques known to those skilled in the art, all or part of the software instructions can be executed by a dedicated circuit (e.g., a digital signal processor (DSP), a programmable logic array, etc.).

[0302] As will be apparent to one skilled in the art, any range or device value given herein may be expanded or altered without losing the effect sought.

[0303] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0304] It will be understood that the benefits and advantages described above may relate to one embodiment or may relate to several embodiments. The embodiments are not limited to embodiments that solve any or all of the problems described or embodiments that have any or all of the benefits and advantages described. No single feature or set of features is necessary or essential to every embodiment.

[0305] Conditional language used herein, such as "can", "may", "might", "could", "for example", etc., unless otherwise expressly stated, should be understood as used in the context, and is generally intended to convey that certain embodiments include and other embodiments do not include certain features, elements and / or steps. Therefore, such conditional language is generally not intended to imply that one or more embodiments require features, elements and / or steps in any way, or that one or more embodiments must include features, elements and / or steps for determining whether these features, elements and / or steps are included or will be performed in any particular embodiment with or without author input or prompting. The terms "include", "comprise", "have", etc. are synonyms, used inclusively in an open-ended manner, and do not exclude other elements, features, actions, operations, blocks, etc. Similarly, the term "or" is used in its inclusive sense (not in its exclusive sense), so, for example, when used to connect a list of elements, the term "or" means one, some or all of the elements in the list. In addition, the articles "a", "an" and "the" used in this application and the appended claims should be interpreted as meaning "one or more" or "at least one", unless otherwise stated.

[0306] As used herein, a phrase referring to "at least one" of a list of items refers to any combination of those items, including single members. For example, "at least one of A, B, or C" is intended to cover: A; B; C; A and B; A and C; B and C; and A, B, and C. Unless expressly stated otherwise, use of conjunction language such as the phrase "at least one of X, Y, and Z" should be understood in context and is generally used to convey that an item, term, etc. can be at least one of X, Y, or Z. Thus, such conjunction language is generally not intended to imply that certain embodiments require that at least one of X, Y, or Z each be present.

[0307] The operations of the methods described herein may be performed in any suitable order, or simultaneously where appropriate. In addition, individual blocks may be deleted from any block, combined with other blocks, or rearranged in any method without departing from the scope of the subject matter described herein. Aspects of any of the examples described above may be combined with aspects of any other example described to form other examples without losing the effect sought.

[0308] It will be understood that the above description is given by way of example only, and that various modifications may be made by those skilled in the art. The above description, examples, and data provide a complete description of the structure and use of the exemplary embodiments. Although various embodiments have been described above with a certain degree of particularity or with reference to one or more separate embodiments, those skilled in the art may make various changes to the disclosed embodiments without departing from the scope of this specification.

Claims

1. A system for generating a random bit string, characterized in that The system comprises: a weak randomness source configured to repeatedly generate a first bit string and a second bit string, wherein the first bit string and the second bit string generated in one situation do not necessarily have the same value as the first bit string and the second bit string generated in another situation; a quantum device configured to receive one or more of said second bit strings and to output an associated third bit string for each of said one or more second bit strings received by said quantum device, wherein said quantum device comprises a plurality of quantum systems; a security testing device configured to: for each of the one or more second bit strings received by the quantum device, calculate a test statistic using the second bit string and the associated third bit string; The security testing device is configured to determine whether to accept or reject the associated third bit string based at least in part on the calculated test statistic and to determine whether the plurality of quantum systems are approximately signal-free; and A two-source extractor is configured to receive a string based on one or more of the first bit strings and a bit string based on one or more of the associated third bit strings and generate the random bit string if the security testing device accepts the associated third bit string.

2. The system according to claim 1, wherein: The quantum device comprises an optical apparatus.

3. The system according to claim 1, wherein: The plurality of quantum systems comprises 2 or 4 quantum systems, wherein each of the 2 or 4 quantum systems comprises a qubit.

4. The system according to claim 3, wherein: Each quantum system comprises a measurement device configured to perform a measurement on the qubit and to output a bit comprising the result of the measurement.

5. The system according to claim 1, wherein: The safety testing device is configured to calculate: a first test in which a violation of Bell's inequality is measured; and a second test for determining whether the plurality of quantum systems are approximately signal-free; and accepting the associated third bit string and determining that the plurality of quantum systems are approximately signal-free in response to a violation of the Bell inequality.

6. The system according to claim 1, wherein: The weak randomness source and the quantum device are configured to provide: A quantum generator configured to generate a pair of entangled particles and ; A first state expansion device is configured to generate a state expansion device comprising and The entangled state; The second state expansion device is configured to generate a and entangled state; and The safety testing device is configured to provide: a first measuring device, the first measuring device is configured to perform or or or and a second measuring device configured to measure a violation of Bell's inequality; and The two-source extractor is configured to receive input from the second measurement device and output random bits for the random bit string.

7. A method for generating a random bit string using a system, characterized in that, The method comprises: configuring a weak randomness source to repeatedly generate a first bit string and a second bit string, wherein the first bit string and the second bit string generated in one situation do not necessarily have the same value as the first bit string and the second bit string generated in another situation; configuring a quantum device to receive one or more of the second bit strings and to output an associated third bit string for each of the one or more second bit strings received by the quantum device, wherein the quantum device comprises a plurality of quantum systems; configuring a security testing apparatus to calculate a test statistic using the second bit string and the associated third bit string for each of the one or more second bit strings received by the quantum device; configuring the security testing device to determine whether to accept or reject the associated third bit string based on the calculated test statistic and to determine whether the plurality of quantum systems are approximately signal-free; and The two-source extractor is configured to: receive a string based on one or more of the first bit strings and a string based on the associated third bit string and generate the random bit string if the security testing equipment accepts the output of the quantum device.

8. The method according to claim 7, wherein: The method includes configuring the security testing device to compute a Bell inequality from the test statistic to thereby determine whether to accept or reject the associated third bit string based on the computed test statistic.

9. The method according to claim 8, wherein: The Bell inequality includes the CHSH (Clauser HorneShimony Holt) inequality.

10. The method according to claim 7, wherein: The quantum device comprises an optical apparatus.

11. The method according to claim 7, wherein: The plurality of quantum systems comprises 2 or 4 quantum systems, and wherein each of the 2 or 4 quantum systems comprises a qubit.

12. The method according to claim 11, wherein: The method includes configuring the quantum device to include a measurement device to perform a measurement on the qubit and output a bit including a result of the measurement.

13. The method according to claim 7, wherein: The method includes configuring the safety testing device to calculate: a first test in which a violation of Bell's inequality is measured; and A second test is used to determine whether the plurality of quantum systems are approximately signal-free.

14. The method according to claim 7, wherein: The method comprises: The source of weak randomness and the quantum device are configured to provide: A quantum generator configured to generate a pair of entangled particles and ; A first state expansion device is configured to generate a state expansion device comprising and The first entangled state of; and The second state expansion device is configured to generate a and The second entangled state; The security testing device is configured to provide a first measurement device, the first measurement device being configured to perform or or or a double coincidence-related coincidence measurement; and a second measurement device, the second measurement device being configured to measure a violation of the Bell inequality; and The two-source extractor is configured to receive input from the second measurement device and to output random bits for the random bit string.

Images