Light injection attack detection method and device and quantum key distribution system

Abstract

The application discloses a light injection attack detection method applied to a quantum key distribution system, and comprises the following steps: receiving a light signal output by a light source in the quantum key distribution system, and performing light splitting processing on the light signal to form a target light signal; detecting first phase information of the target light signal; detecting second phase information of an external light signal output by a quantum channel in the quantum key distribution system; generating a detection result according to a first correlation between the first phase information and the second phase information; and the detection result is used for indicating whether there is a light injection attack in the quantum key distribution system. According to the scheme, the phase correlation between the source-end light signal and the external light from the quantum channel is used as a judgment basis, the accuracy of attack detection can be significantly improved without increasing additional detection circuits, and the information security in the quantum key distribution system is better ensured.

Description

Technical Field

[0001] This application belongs to the field of quantum key distribution technology, specifically relating to a method, device and quantum key distribution system for detecting optical injection attacks. Background Technology

[0002] With the rapid development of the information age, information security has gradually gained importance, and quantum key distribution systems (QKDS) have been widely adopted due to their theoretical ability to achieve unconditionally secure key transmission. However, in the actual deployment of QKDS, they are vulnerable to various light injection attacks, which can lead to information leakage and pose a significant challenge to security. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus and quantum key distribution system for detecting optical injection attacks, so as to improve information security by detecting whether optical injection attacks exist in the quantum key distribution system.

[0004] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part by practice of this application.

[0005] According to one aspect of the embodiments of this application, a method for detecting optical injection attacks is provided, applied to a quantum key distribution system, comprising:

[0006] The system receives an optical signal output from a light source in the quantum key distribution system and performs spectral splitting on the optical signal to form a target optical signal; the intensity of the target optical signal is less than the intensity of the optical signal output from the light source. Detect the first phase information of the target optical signal; Detect the second phase information of the external optical signal output by the quantum channel in the quantum key distribution system; A detection result is generated based on the first correlation between the first phase information and the second phase information; the detection result is used to indicate whether the quantum key distribution system is subjected to an optical injection attack.

[0007] According to one aspect of the embodiments of this application, a light injection attack detection device is provided, applied to a quantum key distribution system, comprising: A beam splitting module is disposed between the light source and the quantum channel in the quantum key distribution system; the beam splitting module is used to receive the optical signal output by the light source and perform beam splitting processing on the optical signal to form a target optical signal; the light intensity of the target optical signal is less than the light intensity of the optical signal output by the light source; A first phase analysis module is connected to the beam splitting module; the first phase analysis module is used to detect the first phase information of the target optical signal. The second phase analysis module is connected to the beam splitting module; the second phase analysis module is used to detect the second phase information of the external optical signal output by the quantum channel in the quantum key distribution system. The detection module is connected to both the first phase analysis module and the second phase analysis module. The detection module is used to generate a detection result based on a first correlation between the first phase information and the second phase information. The detection result is used to indicate whether the quantum key distribution system is subjected to an optical injection attack.

[0008] According to one aspect of an embodiment of this application, the optical splitting module has a first port, a second port, a third port, and a fourth port; The first port of the beam splitter is connected to the light source and is used to receive the light signal output by the light source; The second port of the beam splitting module is connected to the first phase analysis module and is used to output the target optical signal to the first phase analysis module; The fourth port of the beam splitter is connected to the quantum channel and is used to receive the external optical signal output by the quantum channel, so that the external optical signal is split and output from the first port and the third port of the beam splitter respectively. The third port of the beam splitter is connected to the second phase analysis module and is used to output the external optical signal to the second phase analysis module.

[0009] According to one aspect of the present application, the first phase analysis module includes a first interference unit and a first photoelectric conversion unit; the first interference unit is connected to the beam splitting module and is used to perform interference processing on the target light signal output by the beam splitting module. One end of the first photoelectric conversion unit is connected to the first interference unit, and the other end is connected to the detection module; the first photoelectric conversion unit is used to generate the first phase information according to the optical signal output by the first interference unit, and transmit the first phase information to the detection module. The second phase analysis module includes a second interference unit and a second photoelectric conversion unit; the second interference unit is connected to the beam splitting module and is used to perform interference processing on the external optical signal; One end of the second photoelectric conversion unit is connected to the second interference unit, and the other end is connected to the detection module; the second photoelectric conversion unit is used to generate second phase information based on the optical signal output by the second interference unit, and transmit the second phase information to the detection module.

[0010] According to one aspect of the embodiments of this application, a quantum key distribution system is provided, characterized in that it includes a source end, a quantum channel, and a receiver end; The source includes a light source, a quantum state preparation module, and a light injection attack detection device for the quantum key distribution system described in this embodiment; the light signal output from the light source is output from the quantum state preparation module after passing through the light injection attack detection device. The quantum channel is connected to the quantum state preparation module and is used to receive the optical signal output by the quantum state preparation module; The receiving end is connected to the quantum channel; the receiving end is used to generate a quantum key based on the optical signal transmitted by the quantum channel.

[0011] The technical solution provided in this application embodiment offers a method for detecting optical injection attacks, comprising: first, receiving an optical signal output from a light source in the quantum key distribution system and performing beam splitting on the optical signal to form a target optical signal; the intensity of the target optical signal is less than the intensity of the optical signal output from the light source; then detecting a first phase information of the target optical signal and a second phase information of an external optical signal output from the quantum channel in the quantum key distribution system; finally, generating a detection result based on a first correlation between the first phase information and the second phase information; the detection result is used to indicate whether an optical injection attack exists in the quantum key distribution system.

[0012] In this way, only beam splitting and phase detection are needed on the light source side to complete the determination of optical injection attack, without the need to add a complex external detection optical path, which helps to reduce hardware costs. At the same time, by using the phase correlation between the target optical signal and the external optical signal as the basis for attack judgment, the inherent characteristic that optical injection attack inevitably introduces phase correlation at the physical level can be utilized to identify attack behavior in a timely manner for early warning, thereby effectively ensuring the information security of the quantum key distribution system.

[0013] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0014] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0015] Figure 1 A schematic diagram of a quantum key distribution system architecture provided in one embodiment of this application is shown.

[0016] Figure 2A The optical injection attack detection device provided in one embodiment of this application is illustrated schematically.

[0017] Figure 2B The optical injection attack detection device provided in one embodiment of this application is illustrated schematically.

[0018] Figure 2C The optical injection attack detection device provided in one embodiment of this application is illustrated schematically.

[0019] Figure 3 A flowchart illustrating the optical injection attack detection method provided in an embodiment of this application is shown.

[0020] Figure 4 A schematic block diagram of the detection device provided in an embodiment of this application is shown.

[0021] Figure 5 A schematic diagram of the computer system architecture used to implement the technical solution of this application is shown. Detailed Implementation

[0022] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0023] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0024] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0025] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0026] Figure 1A schematic diagram of a quantum key distribution system architecture provided in one embodiment of this application is shown. Figure 1 As shown, the quantum key distribution system of this embodiment includes a source 100, a quantum channel 200, and a receiver 300.

[0027] The source end 100 is the signal transmission core of the quantum key distribution system, specifically including a light source 110, a light injection attack detection device 120, and a quantum state preparation module 130. The optical signal output from the light source 110 first passes through the light injection attack detection device 120. This device, without causing significant insertion loss to the main optical path, sends most of the optical energy to the subsequent quantum state preparation module 130, while simultaneously extracting a small portion of the optical signal for security monitoring.

[0028] In one embodiment, the light source 110 employs a gain-switched laser diode, which generates light pulses primarily by alternately driving it above and below a preset laser threshold. When the laser is below the preset laser threshold, photons in the resonant cavity are emptied, so that when the laser is driven above the preset laser threshold again, the generated light pulse has a random phase due to spontaneous emission. This is the phase randomization mechanism necessary to ensure the security of the quantum key distribution protocol.

[0029] The quantum state preparation module 130 receives the optical signal transmitted from the optical injection attack detection device 120 and encodes it into a quantum state. Specifically, depending on the type of quantum key distribution protocol, the quantum state preparation module 130 can attenuate the optical signal using an intensity modulator, reducing it from a weakly coherent state to a single-photon level, making the average number of photons much less than 1, ensuring that the probability of multiple photons in a single optical pulse is sufficiently low. Simultaneously, it can also encode key information onto the phase or polarization degrees of freedom of photons using a phase modulator or polarization modulator. For example, for discrete-variable quantum key distribution protocols, the quantum state preparation module 130 can randomly select encoding basis vectors, randomly encoding bit values ​​onto one of four non-orthogonal quantum states to satisfy the encoding requirements of protocols such as BB84; for continuous-variable quantum key distribution protocols, quantum state information can be carried by modulating the orthogonal components of the optical field. After completing the quantum state encoding, the quantum state preparation module 130 can couple the modulated optical signal to the quantum channel 200 via an optical fiber or free-space interface.

[0030] The quantum channel 200 is connected to the quantum state preparation module 130 in the source end 100, and is used to receive the optical signal output by the quantum state preparation module 130 and transmit it to the receiver end 300. Exemplarily, the quantum channel 200 can be constructed from standard single-mode fiber, multimode fiber, or a free-space optical path. In practical deployments, the quantum channel 200 inevitably introduces transmission loss and noise, including absorption and scattering losses of the fiber, dispersion effects, and polarization drift and phase drift caused by environmental disturbances. These non-ideal factors will affect the transmission efficiency of signal photons and the fidelity of the quantum state.

[0031] It should be noted that the quantum channel 200 is not only a forward transmission channel for optical signals, but it may also become a reverse transmission channel for attackers to inject external light. That is, attackers can inject strong coherent light (i.e., external optical signals) into the quantum channel 200, and the injected light can propagate backward from the receiving end 300 to the source end 100, and enter the optical injection attack detection device 120 in reverse through the interface of the quantum state preparation module 130, and may then be injected into the light source 110 to destroy its phase randomness.

[0032] Receiver 300 is connected to quantum channel 200 and is used to generate a quantum key based on the optical signal transmitted by quantum channel 200. Receiver 300 typically includes a decoding module and a single-photon detector array. The decoding module is used to project and measure the received quantum state using the corresponding decoding basis vectors according to the encoding protocol agreed upon with source 100, in order to reconstruct the encoded information. The single-photon detector is used to count and detect photons in the decoded optical pulses, then converts the detected photon arrival events into electrical pulse signals, and a time-to-digital converter records the detection time and basis vector selection information for each pulse. Based on this, receiver 300 can compare the detection results with the basis vector information sent by source 100, select detection events using the same basis vectors as the original key bits, further assess the risk of eavesdropping through bit error rate estimation, and then perform classical post-processing operations such as error correction and privacy amplification to eliminate information that may be leaked to attackers, ultimately generating a secure and reliable quantum key.

[0033] Figure 2A A block diagram of an optical injection attack detection device according to an embodiment of this application is shown schematically. Figure 2A As shown, the optical injection attack detection device 120 in this embodiment includes a beam splitting module 121, a first phase analysis module 122, a second phase analysis module 123, and a detection module 124.

[0034] The beam splitting module 121 is disposed between the light source 110 and the quantum channel 200 in the quantum key distribution system. It is used to receive the optical signal output by the light source 110 and split the optical signal to form a target optical signal. The intensity of the target optical signal is less than the intensity of the optical signal output by the light source.

[0035] The first phase analysis module 122 is connected to the beam splitting module 121 and is used to detect the first phase information of the target optical signal. The second phase analysis module 123 is connected to the beam splitting module 121 and is used to detect the second phase information of the external optical signal output by the quantum channel 200 in the quantum key distribution system.

[0036] The detection module 124 is connected to the first phase analysis module 122 and the second phase analysis module 123, respectively. The detection module 121 is used to generate a detection result based on the first correlation between the first phase information and the second phase information. This detection result is used to indicate whether the quantum key distribution system is subjected to optical injection attacks.

[0037] In this embodiment, the beam splitting module of the optical injection attack detection device is located on the main optical path between the light source and the quantum channel. It extracts only a small portion of the light energy for monitoring, while transmitting most of the light energy to the subsequent quantum state preparation module. This achieves "non-invasive" monitoring of the main optical path signal, without affecting the normal key distribution performance and quantum state fidelity of the quantum key distribution system. Furthermore, the first phase analysis module and the second phase analysis module independently extract the phase information corresponding to the target optical signal and the external optical signal, respectively. Then, the detection module performs time-synchronous acquisition and correlation calculation of the two phase information paths. This fully utilizes the physical correlation characteristics between the target optical signal and the external injected light in terms of phase, enabling early warning before the injected light power is low and before it causes a significant increase in the system's bit error rate, thereby ensuring the system's information security.

[0038] In one embodiment, such as Figure 2B As shown, the beam splitter module 121 has four optical ports: a first port 1.1, a second port 1.2, a third port 2.1, and a fourth port 2.2.

[0039] The first port 1.1 of the beam splitter module 121 is connected to the light source 110 and is used to receive the raw signal light output by the light source 110. This port serves as the input interface of the beam splitter module 121, introducing the light pulses generated by the light source 110 into the beam splitter module 121 for beam splitting processing.

[0040] The second port 1.2 of the beam splitting module 121 is connected to the first phase analysis module 122 and is used to output the target optical signal to the first phase analysis module 122. Specifically, after the optical signal output by the light source 110 is split by the beam splitting module 121, a small portion of the optical energy (the target optical signal) is output from the second port 1.2 to the first phase analysis module 122, and the other portion is input to the quantum channel 200 for generating a quantum key.

[0041] The fourth port 2.2 of the beam splitter module 121 is connected to the quantum channel 200 via the quantum state preparation module 130, and is used to output most of the optical energy to complete the normal quantum key distribution process. Simultaneously, the fourth port 2.2 is also used to receive external optical signals transmitted in the reverse direction from the quantum channel 200. That is, when the system is subjected to an optical injection attack, the strong coherent light injected by the attacker propagates in the reverse direction along the quantum channel 200 to the source end 100, and enters the beam splitter module 121 from the fourth port 2.2. The external optical signal entering the beam splitter module 121 is then split into beams according to a preset beam splitting ratio and output from the first port 1.1 and the third port 2.1 respectively. Furthermore, a portion of the injected light output from the first port 1.1 is injected back into the light source 110 in an attempt to disrupt its phase randomness.

[0042] The third port 2.1 of the beam splitter module 121 is connected to the second phase analysis module 123 for outputting external optical signals to the second phase analysis module 123. It can be understood that the beam splitter module 121 splits the external optical signal entering from the fourth port 2.2 and outputs it to the second phase analysis module 123 through the third port 2.1. When there is no injected light (external optical signal), there is no effective optical signal output from the third port 2.1, and the output of the second phase analysis module 123 is only the system noise floor.

[0043] Optionally, the beam splitter module 121 can be a beam splitter, an optical fiber coupler, a planar waveguide beam splitter, or a fused biconical taper optical splitter.

[0044] In this embodiment, the beam splitter module splits the optical signal output from the light source into two paths in the forward transmission direction: one path outputs most of the optical energy through the fourth port to the main optical path, ensuring the normal operation of the quantum key distribution process; the other path outputs a smaller proportion of the optical energy through the second port to the first phase analysis module to generate the first phase information. In the reverse transmission direction, the beam splitter module receives the external optical signal from the direction of the quantum channel through the same fourth port, splits it, and outputs it through the third port to the second phase analysis module, thereby effectively capturing the second phase information of the potential injection light (external optical signal). Thus, through the reasonable allocation of the above port functions, the beam splitter module can complete the three tasks of main optical path transmission, signal light phase monitoring, and injection light capture simultaneously with only a single optical device without compromising the original key distribution performance of the quantum key distribution system, without adding discrete components such as optical switches or circulators, simplifying the system structure and reducing insertion loss and system complexity.

[0045] In one embodiment, continue as follows Figure 2BAs shown, the first phase analysis module 122 includes a first interference unit 1221 and a first photoelectric conversion unit 1222. The input end of the first interference unit 1221 is connected to the second port 1.2 of the beam splitting module 121, and is used to receive the target optical signal output by the beam splitting module 121 and perform interference processing on the target optical signal. Through interference, the phase information carried in the target optical signal is converted into a change in the interference light intensity, thereby realizing the mapping from phase information to light intensity information. One end of the first photoelectric conversion unit 1222 is connected to the optical signal output end of the first interference unit 1221, and the other end is electrically connected to the detection module 124. The first photoelectric conversion unit 1222 is used to receive the interference optical signal output by the first interference unit 1221, convert it into an analog electrical signal as the first phase information, and then transmit the first phase information to the detection module 124.

[0046] In one embodiment, the first phase analysis module 122 can be implemented using a Mach-Zehnder interferometer, a Michelson interferometer, a microring resonator, or a quantum interferometer; wherein, the first interference unit 1221 is the optical structure part of the interferometer used to realize beam splitting, beam combining, and interference functions. Optionally, one arm of the interferometer may also include a phase modulator (such as an electro-optic phase modulator or a piezoelectric fiber phase modulator) for actively applying a phase modulation signal; the first photoelectric conversion unit 1222 can be a photodiode, a photomultiplier tube, or a single-photon avalanche diode.

[0047] In one embodiment, the second phase analysis module 123 includes a second interference unit 1231 and a second photoelectric conversion unit 1232. The input terminal of the second interference unit 1231 is connected to the third port 2.1 of the beam splitter module 121, and is used to receive the external optical signal output by the beam splitter module 121, and to perform interference processing on the external optical signal, converting the phase information carried in the external optical signal into changes in the interference light intensity. One end of the second photoelectric conversion unit 1232 is connected to the optical signal output terminal of the second interference unit 1231, and the other end is electrically connected to the detection module 124. The second photoelectric conversion unit 1232 is used to receive the interference optical signal output by the second interference unit 1231, convert it into an analog electrical signal as the second phase information, and then transmit the second phase information to the detection module 124.

[0048] In this embodiment, the two phase analysis modules extract phase information and convert it into electrical signals for the signal light and any potential injection light, respectively. This transforms the optical phase information, which is difficult to measure directly, into easily processed electrical signals, providing a data foundation for the subsequent correlation calculation by the detection module 124. Furthermore, the two phase analysis modules employ the same interferometric-photoelectric conversion architecture, ensuring the consistency of the two signals in the time domain, which is beneficial for improving the accuracy and reliability of subsequent calculations.

[0049] In one embodiment, the second phase analysis module 123 can be implemented using a Mach-Zehnder interferometer, a Michelson interferometer, a microring resonator, or a quantum interferometer; wherein, the second interference unit 1231 is the optical structure part of the interferometer used to realize beam splitting, beam combining, and interference functions. Optionally, one arm of the interferometer may also include a phase modulator (such as an electro-optic phase modulator or a piezoelectric fiber phase modulator) for actively applying a phase modulation signal; the second photoelectric conversion unit 1232 can be a photodiode, a photomultiplier tube, or a single-photon avalanche diode.

[0050] In one embodiment, the detection module 124 internally includes a data acquisition unit, a data processing unit, and a decision output unit. The data acquisition unit synchronously acquires the first phase information output by the first phase analysis module 122 and the second phase information output by the second phase analysis module 123, ensuring strict time alignment between the two signals. This avoids introducing additional phase errors due to the correlation at sampling times and guarantees the accuracy of subsequent correlation calculations. The data processing unit performs correlation calculations on the acquired two phase information streams to obtain a quantitative index characterizing the phase similarity between the two signals. The decision output unit compares the calculated first correlation with a correlation threshold range and generates a corresponding detection result signal based on the comparison result. This signal is then output to the system security monitoring unit to trigger subsequent alarm or defense responses.

[0051] In one embodiment, the correlation threshold interval is determined as follows: First, the optical path connection between the beam splitter 121 and the quantum channel 200 is disconnected to simulate a baseline state where the system is not subject to injected light attacks. In this state, no effective optical signal enters the input port of the second phase analysis module 123, and its output is only the system's background noise. The detection module 124 collects the first phase information output by the first phase analysis module 122 and the third phase information (i.e., noise phase information) output by the second phase analysis module 123 in this state. Then, within a preset time period T, the two signals are continuously collected at a preset unit time t, and the second correlation between the first phase information and the third phase information in each period is calculated to obtain multiple second correlations. Next, the data processing unit determines the maximum correlation C_max and the minimum correlation C_min from these second correlations, and determines the interval [C_min, C_max] as the correlation threshold interval.

[0052] After completing the above steps, the optical path connection between the splitter module 121 and the quantum channel 200 is reconnected, and the system enters the normal operation monitoring phase. During the normal operation phase, the detection module 124 continuously calculates the real-time correlation C between the first phase information and the second phase information at the same preset unit time t, and compares this real-time correlation C with the calibrated correlation threshold interval [C_min, C_max]. If C_min ≤ C ≤ C_max, it is determined that the quantum key distribution system is not subject to optical injection attacks; if C continuously exceeds this interval, it is determined that the quantum key distribution system is subject to optical injection attacks.

[0053] The calibration process for determining the correlation threshold range in the detection module of this embodiment fully utilizes the system's inherent noise characteristics, enabling the threshold range setting to adapt to the actual working conditions and noise environments of different systems, avoiding the poor environmental adaptability problem caused by using a fixed threshold. Furthermore, the detection module employs a fully automated process of data acquisition, correlation calculation, threshold comparison, and result output, allowing it to continuously perform monitoring tasks during system operation without manual intervention, providing a fast response and timely warnings of attack behaviors. Additionally, the detection module is only connected to the main optical path by electrical signals, causing no optical interference to the normal key distribution process of the quantum key distribution system, exhibiting good system compatibility and engineering practicality.

[0054] Optionally, the detection module can be an oscilloscope, a data acquisition card, a digital signal processor, or a correlation analyzer.

[0055] In one embodiment, such as Figure 2C As shown, the light source 110 in the optical injection attack detection device is a laser, the beam splitting module 121 is a beam splitter, the first phase analysis module 122 includes a phase modulator and a photodiode, the second phase analysis module 123 includes a phase modulator and a photodiode, and the detection module is an oscilloscope.

[0056] Specifically, the optical signal output from the laser enters the first port 1.1 of the beam splitter. After being split into beams according to a preset ratio, the target optical signal output from the second port 1.2 enters the phase modulator in the first phase analysis module. The interferometer converts the phase information of the target optical signal into a change in the intensity of the interference light. The interference light signal illuminates the photodiode in the first phase analysis module, which converts it into a first electrical signal as the first phase information. Then, the first phase information is transmitted to the first input channel of the oscilloscope for display and recording. At the same time, a signal light output from the fourth port 2.2 enters the quantum state preparation module and is finally sent to the quantum channel. An external optical signal (if present) from the direction of the quantum channel enters the beam splitter through port 2.2 (fourth port). After being split, it is output from port 2.1 (third port) to the phase modulator in the second phase analysis module. This interferometer converts the phase information of the external optical signal into changes in the intensity of the interference light. The interference light signal illuminates a photodiode in the second phase analysis module, which converts it into a second electrical signal as the second phase information. This phase information is also transmitted to the second input channel of the oscilloscope for display and recording. Next, the oscilloscope synchronously acquires the electrical signal waveforms of the two channels at a preset time interval with a preset unit time period. Internally, it calculates the correlation between the two electrical signals (phase information) and compares it with a correlation threshold range to finally output the detection result of whether an optical injection attack exists.

[0057] This embodiment constructs a well-structured and easily implemented optical injection attack detection device by employing a laser as the light source, a beam splitter as the beam splitting module, a phase modulator combined with a photodiode as the phase analysis module, and an oscilloscope as the detection module. The device achieves the following technical effects: First, the laser's stable output power and narrow linewidth provide a high-quality coherent light source for phase analysis, which is beneficial for the phase modulator to output high-contrast interference signals, thereby improving the accuracy and sensitivity of phase detection. Second, the phase modulator, as the core device for phase-to-intensity conversion, has a simple structure and fast response speed, capable of converting minute phase changes into detectable intensity changes. Combined with the high responsivity of the photodiode, it can sensitively capture weak signals from externally injected light. Third, the oscilloscope as the detection module has multi-channel synchronous acquisition capabilities and high bandwidth characteristics, enabling precise recording of the timing waveforms of two electrical signals, ensuring the data integrity and time alignment accuracy of correlation analysis. Finally, all the above-mentioned devices are mature commercial devices in the field of optical communication, with controllable costs, a stable supply chain, and high integration.

[0058] The optical injection attack detection method provided in this application will be described in detail below with reference to specific implementation methods.

[0059] Figure 3A flowchart illustrating the optical injection attack detection method provided in an embodiment of this application is shown schematically. Figure 3 As shown, the optical injection attack detection method provided in this embodiment can be applied to the aforementioned optical injection attack detection device, and specifically includes the following steps: Step 310: Receive the optical signal output from the light source in the quantum key distribution system and perform optical signal splitting to form the target optical signal.

[0060] Specifically, Quantum Key Distribution (QKD) is a technology that uses the principles of quantum mechanics to securely distribute shared keys between communicating parties. Its core characteristic is that any eavesdropping on a quantum channel will inevitably disturb the quantum state, thus being detected by the legitimate communicating party. A QKD system typically consists of three main parts: a source, a quantum channel, and a receiver. The source is responsible for generating and encoding the quantum optical signal, the quantum channel is responsible for transmission, and the receiver is responsible for detection and decoding.

[0061] An optical signal is a physical signal that uses light waves as information carriers; in this application, it specifically refers to a laser pulse generated by the light source of a QKD system. This optical signal has multiple degrees of freedom, including frequency, intensity, phase, and polarization, among which phase and polarization can be used to encode quantum key information. The target optical signal is a low-intensity optical signal obtained by splitting the original optical signal output from the light source; it is specifically used for phase monitoring and subsequent detection of optical injection attacks. Unlike the high-power signal light used for quantum key distribution in the main optical path, the target optical signal only performs a security monitoring function, and its intensity is typically much lower than the original optical signal to avoid affecting the normal encoding and transmission of the QKD system. Simultaneously, the target optical signal carries the same phase information as the original optical signal output from the light source, thus accurately reflecting the output phase characteristics of the light source and providing an accurate benchmark for subsequent correlation analysis.

[0062] Step 320: Detect the first phase information of the target optical signal.

[0063] Specifically, the target optical signal is interfered with to form an interference optical signal. The intensity of this interference optical signal and the phase of the target optical signal satisfy the interference formula. Then, the interference optical signal is converted into a time-varying electrical signal after photoelectric conversion. This electrical signal has a definite functional relationship with the phase of the target optical signal. In this way, optical phase information, which is difficult to measure directly, can be converted into an electrical signal that is easy to acquire and process through photoelectric conversion. Then, conventional electronic equipment can be used to record, store, and calculate the phase information.

[0064] The first phase information is used to characterize the phase change of the target optical signal.

[0065] In one embodiment of this application, the intensity of the interfering optical signal and the phase of the target optical signal satisfy the following interference formula:

[0066] Among them, I in This refers to the light intensity of the target optical signal, I. out Δφ refers to the light intensity of the interference light signal formed after the target light signal is split and interfered (the light intensity changes with the phase according to a cosine law), Δφ refers to the amount of phase change between two consecutive pulses in the target light signal, and φ0 refers to the initial phase difference introduced by the preset optical path difference between the first and second optical paths in the interference light path.

[0067] As can be seen from the above formula, the light intensity I of the interference light signal out The phase difference Δφ and the initial phase difference φ0 of the target optical signal change in a cosine manner. Then, the intensity of the interference optical signal is converted into an electrical signal through photoelectric conversion. The amplitude of the electrical signal can be used to represent the light intensity. Then, the first phase information of the target optical signal can be obtained based on the correlation between light intensity and phase.

[0068] For example, detecting the first phase information of the target optical signal includes: acquiring the optical path difference between a first optical path propagating the first optical signal and a second optical path propagating the second optical signal; the first optical signal and the second optical signal are obtained based on the beam splitting processing of the target optical signal; calculating the initial phase difference between the first optical signal and the second optical signal based on the optical path difference; acquiring the correlation between the intensity of the interference optical signal and the phase information of the target optical signal; the interference optical signal is obtained by combining the first optical signal propagated by the first optical path and the second optical signal propagated by the second optical path; and generating the first phase information based on the intensity of the interference optical signal, the initial phase difference, and the correlation.

[0069] Specifically, the acquisition of the first phase information can be achieved by the first phase analysis module in the optical injection attack detection device. The specific operation is as follows: the optical signal output from the light source first enters the first port of the beam splitter module. After being split into beams according to a preset beam splitting ratio, one of the optical signals is output from the second port of the beam splitter module to the first phase analysis module as the target optical signal. The first interference unit inside the first phase analysis module receives the target optical signal and performs interference processing, that is, splits the target optical signal into a first optical signal and a second optical signal, so that the first optical signal propagates along the first optical path and the second optical signal propagates along the second optical path. Then, the initial phase difference between the first optical signal and the second optical signal is calculated according to a preset optical path difference. The first optical signal and the second optical signal are then combined to form an interference optical signal. Subsequently, the first photoelectric conversion unit converts the interference optical signal into a first electrical signal, and continuously collects the first electrical signal within a preset time period T with a preset unit time t as the period to obtain the first phase information.

[0070] Step 330: Detect the second phase information of the external optical signal output by the quantum channel in the quantum key distribution system.

[0071] Specifically, external optical signals refer to optical signals input from the quantum channel of the QKD system to the source. The source may include backscattered light in the quantum channel when the system is working normally, but may also include strongly coherent light injected into the quantum channel from the receiver by an attacker.

[0072] The second phase information is used to characterize the phase changes of the external optical signal.

[0073] It should be noted that after interference and photoelectric conversion, the external optical signal can also form a second electrical signal that varies with time, and the phase of this electrical signal has a definite functional relationship with the target optical signal. Therefore, the phase difference between the second electrical signal and the external optical signal also satisfies the aforementioned interference formula, which will not be elaborated here.

[0074] In one embodiment of this application, the acquisition of the second phase information can be achieved by the second phase analysis module in the optical injection attack detection device. Specifically, the beam splitter receives an external optical signal from the direction of the quantum channel. This external optical signal enters the beam splitter through its fourth port and is split according to a preset beam splitting ratio. One of the external optical signals is then output from the third port of the beam splitter to the second phase analysis module. The second interference unit inside the second phase analysis module receives the external optical signal and performs interference processing, splitting it into a third optical signal and a fourth optical signal. The third optical signal propagates along the third optical path, and the fourth optical signal propagates along the fourth optical path. There is a preset optical path difference between the third and fourth optical paths. The initial phase difference between the third and fourth optical signals is calculated based on this preset optical path difference. The third and fourth optical signals are then combined to form an interference optical signal. Subsequently, the second photoelectric conversion unit converts the interference optical signal into a second electrical signal and continuously collects the second electrical signal as the second phase information within the same preset time period T, with the same preset unit time t as the first phase analysis module.

[0075] It is understandable that when injected light is present in the system, the second phase information will carry the phase characteristics of the injected light. Therefore, the correlation between the second phase information and the first phase information directly reflects whether there is a phase correlation between the external optical signal and the target optical signal, and is the core basis for determining whether the QKD system has been subjected to an optical injection attack.

[0076] Step 340: Generate detection results based on the first correlation between the first phase information and the second phase information.

[0077] Specifically, the correlation between the first phase information and the second phase information is used to quantify the degree of difference in waveform changes between the two optical signals in the time domain. Mathematically, this can be obtained by calculating the correlation coefficient (such as the Pearson correlation coefficient) or covariance between the two sets of time-series data. When there is no injection light in the QKD system, the second phase information only reflects the phase change of random noise and has no significant correlation with the phase change of the first electrical signal (corresponding to the target optical signal), and the correlation increases significantly. When there is injection light, the target optical signal will inherit the phase of the external injection light, making the waveforms of the target optical signal and the external optical signal highly synchronized, and the correlation close to zero.

[0078] The detection results are used to indicate whether an optical injection attack exists in the quantum key distribution system. For example, after obtaining the detection results, they can also be output to the security monitoring unit of the QKD system to trigger corresponding follow-up operations, such as status display, logging, audible and visual alarms, or active defense response.

[0079] The technical solution provided in this application embodiment offers a method for detecting optical injection attacks, comprising: first, receiving an optical signal output from a light source in a quantum key distribution system and performing beam splitting on the optical signal to form a target optical signal; the intensity of the target optical signal is less than the intensity of the optical signal output from the light source; then detecting first phase information of the target optical signal and second phase information of an external optical signal output from a quantum channel in the quantum key distribution system; finally, generating a detection result based on a first correlation between the first phase information and the second phase information; the detection result is used to indicate whether an optical injection attack exists in the quantum key distribution system.

[0080] This solution only requires beam splitting and phase detection at the light source side to complete the attack determination, without the need to add a complex external detection optical path, which helps to reduce hardware costs. At the same time, it uses the phase correlation between the target optical signal and the external optical signal as the basis for judging optical injection attacks. It takes advantage of the essential characteristic that optical injection attacks inevitably introduce phase correlation at the physical level, which can identify attack behavior in time for early warning, thereby effectively ensuring the information security of the quantum key distribution system.

[0081] In one embodiment of this application, generating a detection result based on a first correlation between first phase information and second phase information includes: detecting third phase information of noise in the quantum key distribution system, and determining a correlation threshold interval based on the third phase information and the first phase information; calculating the first correlation between the first phase information and the second phase information; and generating a detection result based on the first correlation and the correlation threshold interval.

[0082] Specifically, noise refers to various random interference signals in a quantum key distribution system other than the effective optical signal, including shot noise, thermal noise, dark counts, and background noise caused by ambient stray light. Although noise signals are chaotic, their statistical characteristics (such as mean, variance, and power spectral density) remain relatively stable within a certain time range, and therefore can be used to determine the correlation threshold interval.

[0083] The third phase information refers to the third electrical signal obtained after phase detection of noise in the quantum key distribution system in the absence of external light injection attacks. This signal shares the same signal path as the second electrical signal (external light signal) during normal detection. The third electrical signal corresponds to the reference state of "no injected light", while the second electrical signal corresponds to the actual operating state of "possible injected light".

[0084] Unlike the second phase information, the third phase information is collected under conditions where external light input is deliberately excluded. Therefore, it only represents the noise characteristics of the system itself and does not carry any effective external light phase information. In the scheme of this application, since the first phase information reflects the phase change of the target light signal and the third phase information reflects the random fluctuation of pure noise, the correlation between the two represents the maximum and minimum correlation that the QKD system may have under the condition of "no injected light attack", and thus the correlation threshold range can be obtained.

[0085] In one embodiment of this application, the acquisition of the third phase information can be achieved by a light injection attack detection device, which specifically includes: firstly, disconnecting the optical path connection between the beam splitter and the quantum channel, so that external light signals from the direction of the quantum channel cannot enter the beam splitter, thereby ensuring that there is no effective light signal input at the input port of the second phase analysis module, and its output terminal only outputs the system background noise. In this disconnected state, the third electrical signal output by the second phase analysis module is continuously acquired within a preset time period T with a preset unit time t as the period, and used as the third phase information.

[0086] The correlation threshold range refers to the pre-defined range of correlation values ​​used to determine whether a QKD system is under optical injection attack. If the real-time correlation falls within the correlation threshold range, it indicates that the current external signal is no different from noise and the system is safe. If the real-time correlation continues to exceed the correlation threshold range, it indicates that the external signal carries effective phase information related to the target optical signal and the QKD system is under injection attack.

[0087] In one embodiment of this application, determining a correlation threshold interval based on third phase information and first phase information includes: acquiring multiple first phase information of the target optical signal within a preset time period, and multiple third phase information of noise within a preset time period; wherein each preset unit time within the preset time period corresponds to one first phase information and one third phase information; for each preset unit time within the preset time period, calculating a second correlation between the first phase information and the third phase information corresponding to the preset unit time; determining the maximum correlation and minimum correlation between the first phase information and the third phase information based on the multiple second correlations corresponding to the multiple preset unit times; and determining a correlation threshold interval based on the maximum correlation and minimum correlation.

[0088] Specifically, the preset time period is a pre-defined time window for acquiring electrical signals in a quantum key distribution system. Its length and sampling period directly affect the temporal resolution and real-time performance of optical injection attack detection. A shorter preset time period can improve detection sensitivity but may introduce larger statistical fluctuations; a longer preset time period is beneficial for improving the signal-to-noise ratio but will reduce response speed. Therefore, the parameters of the preset time period can be flexibly configured according to the actual application scenario and security requirements of the quantum key distribution system.

[0089] The preset unit time refers to further subdividing a preset time period into multiple time units of equal length. Each unit serves as an independent calculation window for calculating the correlation between the two phase information streams at that moment. In this application's scheme, the preset time period T consists of several preset unit times t (for example, T=100ms, t=1ms, which contains 100 unit times), and the correlation can be calculated once within each unit time.

[0090] Maximum correlation refers to the maximum correlation between the first and third phase information calculated across all preset time units within a preset time period. Minimum correlation refers to the minimum correlation between the first and third phase information calculated across all preset time units within a preset time period. In actual operation, if the real-time correlation exceeds the maximum correlation, it indicates that the correlation between the external optical signal and the signal light has exceeded the range that the background noise can explain, and there is a high probability of an injected optical attack. If the real-time correlation is lower than the minimum correlation, it indicates that the characteristics of the external optical signal do not match the expected noise characteristics, which may reflect interference or injection of abnormal signals. Therefore, the maximum and minimum correlations together define the safety threshold range [C_min, C_max]. If the real-time correlation falls within this range, it is determined that there is no optical injection attack in the QKD system; if it exceeds either boundary, a warning of an optical injection attack is triggered.

[0091] This embodiment calculates the correlation between the first phase information and the noise signal (third phase information) on a unit-time basis under conditions without injected light, and defines the correlation threshold range by statistically determining the maximum and minimum values ​​among multiple correlations. This allows the threshold range to adapt to noise differences in different QKD systems, different working environments, and different device aging states, thereby avoiding the problems of missed attacks due to an overly wide threshold setting or frequent false alarms due to an overly narrow threshold setting.

[0092] In one embodiment of this application, the calculation of the first correlation between the first phase information and the second phase information can be implemented using an oscilloscope. Specifically, the first phase information is converted into a first electrical signal by a first photoelectric conversion unit and then input to the first channel of the oscilloscope; the second phase information is converted into a second electrical signal by a second photoelectric conversion unit and then input to the second channel of the oscilloscope. The oscilloscope simultaneously acquires the waveforms of the two electrical signals. Since the two electrical signals have definite functional relationships with the phases of the target optical signal and the external optical signal, respectively, the oscilloscope can extract the phase correlation between the two signals by comparing the phase difference between the two waveforms at the same moment. This phase correlation can be calculated and displayed in real time using the oscilloscope's built-in mathematical operation function, for example, by converting the time difference between the zero-crossing points of the two waveforms into a phase difference, or by directly reading the phase difference through the elliptical shape of a Lissajous figure. In this way, the first correlation between the first phase information and the second phase information can be obtained.

[0093] In another embodiment of this application, the first correlation between the first phase information and the second phase information can also be obtained through actual mathematical calculation. That is, multiple first phase information of the target optical signal within a preset time period and multiple second phase information of the external optical signal within a preset time period are first obtained; wherein, each preset unit time in the preset time period corresponds to one first phase information and one second phase information; the covariance between the multiple first phase information and the multiple second phase information is calculated; and the covariance is normalized to obtain the correlation between the first phase information and the second phase information.

[0094] Specifically, covariance is a quantitative indicator in statistics used to measure the cooperative relationship between two random variables, reflecting the degree of synchronization between two sets of data when they change around their respective means. In the scheme of this application, when the electrical signals (phase information) corresponding to the two optical signals show a synchronous increasing or decreasing trend, the covariance is positive; when they show opposite trends, the covariance is negative; when the two signals are independent and have no cooperative relationship, the absolute value of the covariance approaches zero. Therefore, the magnitude of the covariance directly reflects the degree of difference between the phase of the target optical signal and the phase of the external optical signal.

[0095] Normalization refers to the process of converting covariance into a dimensionless, standardized correlation coefficient through mathematical transformation. Since covariance is significantly affected by signal amplitude, even if two signals have identical phase change trends, the larger the signal amplitude, the larger the absolute value of the covariance, making it difficult to directly set a uniform judgment threshold. However, the correlation value obtained after normalization has a uniform numerical range, eliminating the influence of signal amplitude differences on the judgment result. This allows for the judgment of system security based on the correlation threshold range, greatly simplifying the judgment logic and improving the reliability of the detection results.

[0096] In one embodiment of this application, calculating the covariance between the first phase information and the second phase information includes: calculating a first average phase value corresponding to the target optical signal based on the first phase information, and calculating a second average phase value corresponding to the external optical signal based on the second phase information; calculating the difference between each phase value in the first phase information and the first average phase value to obtain a first difference sequence, and calculating the difference between each phase value in the second phase information and the second average phase value to obtain a second difference sequence; for each preset unit time in a preset time period, calculating the product between the difference in the first difference sequence corresponding to the preset unit time and the difference in the second difference sequence corresponding to the preset unit time; and accumulating the multiple products corresponding to multiple preset unit times to obtain the covariance.

[0097] Specifically, the first average phase value refers to the average phase value of the first electrical signal in all unit time periods within the preset time period, which reflects the average phase level corresponding to the average light intensity of the target optical signal in that time period; similarly, the second average phase value refers to the average phase value of the second electrical signal in all unit time periods within the preset time period, which reflects the average phase level corresponding to the average light intensity of the external optical signal in that time period.

[0098] The first difference sequence refers to a data set consisting of a series of differences obtained by subtracting the first average phase value from each instantaneous phase value in the first phase information. Each difference corresponds to a preset unit time. This sequence essentially removes the signal fluctuation component after removing the DC component, retaining only the phase fluctuation characteristics caused by the phase change of the target optical signal. In this application, positive values ​​in the first difference sequence indicate that the instantaneous phase is higher than the average value within that unit time, while negative values ​​indicate that the instantaneous phase is lower than the average value within that unit time. The alternation of positive and negative values ​​and the changes in the difference reflect the phase fluctuation of the target optical signal.

[0099] The second difference sequence refers to a set of data consisting of a series of differences obtained by subtracting the second average phase value from each instantaneous phase value in the second phase information. Each difference corresponds to a preset unit of time, representing the fluctuation component of the external optical signal after removing the DC bias. When the external optical signal is only noise, the second difference sequence exhibits random alternation of positive and negative values ​​with irregular amplitude fluctuations. When injected light is present, the sequence exhibits regular fluctuations corresponding to the phase changes of the injected light. It should be noted that the second difference sequence corresponds point-by-point with the first difference sequence in the time domain. By comparing the positive and negative signs and amplitude relationships of the two at the same moment, the degree of synchronization between the external optical signal and the target optical signal in phase changes can be quantified.

[0100] This embodiment constructs a difference sequence by subtracting the average phase values ​​of each signal, effectively eliminating the DC component introduced by the difference in light intensity and device bias in the two signals. This allows the covariance to truly reflect the dynamic cooperative relationship of phase fluctuations, significantly improving the detection accuracy. On the other hand, through point-by-point multiplication and accumulation, it fully utilizes the temporal information of all preset unit times within a preset time period. This allows the random noise fluctuations at a single moment to be smoothly suppressed during the accumulation process, while the true phase correlation is enhanced by the continuous accumulation of the same-direction correlation, thereby effectively improving the sensitivity to the identification of weak injected light signals.

[0101] It should be noted that although the steps of the method in this application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0102] The following describes an embodiment of the apparatus of this application, which can be used to execute the optical injection attack detection method described in the above embodiments of this application. Figure 4 A schematic block diagram of the detection device provided in an embodiment of this application is shown. Figure 4 As shown, the detection device provided in this application embodiment includes: The signal processing module 410 is used to receive the optical signal output by the light source in the quantum key distribution system and perform optical signal splitting to form a target optical signal; the light intensity of the target optical signal is less than the light intensity of the optical signal output by the light source. The first phase detection module 420 is used to detect the first phase information of the target optical signal; The second phase detection module 430 is used to detect the second phase information of the external optical signal output by the quantum channel in the quantum key distribution system; The detection result generation module 440 is used to generate a detection result based on the first correlation between the first phase information and the second phase information; the detection result is used to indicate whether there is an optical injection attack in the quantum key distribution system.

[0103] In one embodiment of this application, the first phase detection module 420 is specifically used for: The optical path difference between the first optical path that propagates the first optical signal and the second optical path that propagates the second optical signal is obtained; the first optical signal and the second optical signal are obtained based on the beam splitting processing of the target optical signal; Calculate the initial phase difference between the first optical signal and the second optical signal based on the optical path difference; The correlation between the intensity of the interference light signal and the phase information of the target light signal is obtained; the interference light signal is obtained by combining the first light signal propagating in the first optical path and the second light signal propagating in the second optical path. First phase information is generated based on the light intensity of the interference light signal, the initial phase difference, and the correlation relationship.

[0104] In one embodiment of this application, the detection result generation module 440 is specifically used for: The third phase information of noise in the quantum key distribution system is detected, and a correlation threshold range is determined based on the third phase information and the first phase information. Calculate the first correlation between the first phase information and the second phase information; Detection results are generated based on the first correlation and the correlation threshold interval.

[0105] In one embodiment of this application, the detection result generation module 440 is specifically used for: The target optical signal is acquired in multiple first phase information within a preset time period, and the noise is acquired in multiple third phase information within the preset time period; wherein each preset unit time in the preset time period corresponds to one first phase information and one third phase information. For each preset unit time within the preset time period, calculate the second correlation between the first phase information and the third phase information corresponding to the preset unit time; Based on multiple second correlations corresponding to multiple preset unit time periods, determine the maximum and minimum correlations between the first phase information and the third phase information; The correlation threshold range is determined based on the maximum correlation and the minimum correlation.

[0106] In one embodiment of this application, the detection result generation module 440 is specifically used for: The system acquires multiple first phase information of the target optical signal within a preset time period, and multiple second phase information of the external optical signal within the preset time period; wherein each preset unit time in the preset time period corresponds to one first phase information and one second phase information. Calculate the covariance between multiple first-phase information and multiple second-phase information; The covariance is normalized to obtain the first correlation.

[0107] In one embodiment of this application, the detection result generation module 440 is specifically used for: Compare the first correlation with the correlation threshold interval; If the first correlation is within the correlation threshold range, a detection result indicating that the quantum key distribution system is not subject to optical injection attack is generated; if the first correlation is not within the correlation threshold range, a detection result indicating that the quantum key distribution system is subject to optical injection attack is generated.

[0108] The specific details of the data processing apparatus provided in the various embodiments of this application have been described in detail in the corresponding method embodiments, and will not be repeated here.

[0109] Figure 5 A schematic diagram of the computer system architecture used to implement the technical solution of this application is shown.

[0110] It should be noted that, Figure 5 The computer system 500 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0111] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or programs loaded from storage section 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for system operation. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output interface 505 (I / O interface) is also connected to the bus 504.

[0112] The following components are connected to the input / output interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 505 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a local area network card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0113] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0114] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0115] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0116] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0117] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0118] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting optical injection attacks, characterized in that, Applications in quantum key distribution systems include: The system receives an optical signal output from a light source in the quantum key distribution system and performs spectral splitting on the optical signal to form a target optical signal; the intensity of the target optical signal is less than the intensity of the optical signal output from the light source. Detect the first phase information of the target optical signal; Detect the second phase information of the external optical signal output by the quantum channel in the quantum key distribution system; A detection result is generated based on the first correlation between the first phase information and the second phase information; the detection result is used to indicate whether the quantum key distribution system is subjected to an optical injection attack.

2. The optical injection attack detection method according to claim 1, characterized in that, The detection of the first phase information of the target optical signal includes: The optical path difference between the first optical path that propagates the first optical signal and the second optical path that propagates the second optical signal is obtained; the first optical signal and the second optical signal are obtained based on the beam splitting processing of the target optical signal; Calculate the initial phase difference between the first optical signal and the second optical signal based on the optical path difference; The correlation between the intensity of the interference light signal and the phase information of the target light signal is obtained; the interference light signal is obtained by combining the first light signal propagating in the first optical path and the second light signal propagating in the second optical path. First phase information is generated based on the light intensity of the interference light signal, the initial phase difference, and the correlation relationship.

3. The optical injection attack detection method according to claim 1, characterized in that, The step of generating a detection result based on the first correlation between the first phase information and the second phase information includes: The third phase information of noise in the quantum key distribution system is detected, and a correlation threshold range is determined based on the third phase information and the first phase information. Calculate the first correlation between the first phase information and the second phase information; Detection results are generated based on the first correlation and the correlation threshold interval.

4. The optical injection attack detection method according to claim 3, characterized in that, The step of determining the correlation threshold range based on the third phase information and the first phase information includes: The target optical signal is acquired in multiple first phase information within a preset time period, and the noise is acquired in multiple third phase information within the preset time period; wherein each preset unit time in the preset time period corresponds to one first phase information and one third phase information. For each preset unit time within the preset time period, calculate the second correlation between the first phase information and the third phase information corresponding to the preset unit time; Based on multiple second correlations corresponding to multiple preset unit time periods, determine the maximum and minimum correlations between the first phase information and the third phase information; The correlation threshold range is determined based on the maximum correlation and the minimum correlation.

5. The optical injection attack detection method according to claim 3, characterized in that, The calculation of the first correlation between the first phase information and the second phase information includes: The system acquires multiple first phase information of the target optical signal within a preset time period, and multiple second phase information of the external optical signal within the preset time period; wherein each preset unit time in the preset time period corresponds to one first phase information and one second phase information. Calculate the covariance between multiple first-phase information and multiple second-phase information; The covariance is normalized to obtain the first correlation.

6. The optical injection attack detection method according to claim 3, characterized in that, The step of generating a detection result based on the first correlation and the correlation threshold interval includes: Compare the first correlation with the correlation threshold interval; If the first correlation is within the correlation threshold range, a detection result indicating that the quantum key distribution system is not subject to optical injection attacks is generated. If the first correlation is not within the correlation threshold range, a detection result indicating that the quantum key distribution system is subjected to an optical injection attack is generated.

7. A device for detecting optical injection attacks, characterized in that, Applications in quantum key distribution systems include: A beam splitting module is disposed between the light source and the quantum channel in the quantum key distribution system. The beam splitting module is used to receive the optical signal output by the light source and perform beam splitting processing on the optical signal to form a target optical signal. The light intensity of the target optical signal is less than the light intensity of the optical signal output by the light source. A first phase analysis module is connected to the beam splitting module; the first phase analysis module is used to detect the first phase information of the target optical signal. The second phase analysis module is connected to the beam splitting module; the second phase analysis module is used to detect the second phase information of the external optical signal output by the quantum channel in the quantum key distribution system. The detection module is connected to both the first phase analysis module and the second phase analysis module. The detection module is used to generate a detection result based on a first correlation between the first phase information and the second phase information. The detection result is used to indicate whether the quantum key distribution system is subjected to an optical injection attack.

8. The optical injection attack detection device according to claim 7, characterized in that, The beam splitter module has a first port, a second port, a third port, and a fourth port; The first port of the beam splitter is connected to the light source and is used to receive the light signal output by the light source; The second port of the beam splitting module is connected to the first phase analysis module and is used to output the target optical signal to the first phase analysis module; The fourth port of the beam splitter is connected to the quantum channel and is used to receive the external optical signal output by the quantum channel, so that the external optical signal is split and output from the first port and the third port of the beam splitter respectively. The third port of the beam splitter is connected to the second phase analysis module and is used to output the external optical signal to the second phase analysis module.

9. The optical injection attack detection device according to claim 7, characterized in that, The first phase analysis module includes a first interference unit and a first photoelectric conversion unit; the first interference unit is connected to the beam splitting module and is used to perform interference processing on the target light signal output by the beam splitting module. One end of the first photoelectric conversion unit is connected to the first interference unit, and the other end is connected to the detection module; the first photoelectric conversion unit is used to generate the first phase information according to the optical signal output by the first interference unit, and transmit the first phase information to the detection module. The second phase analysis module includes a second interference unit and a second photoelectric conversion unit; the second interference unit is connected to the beam splitting module and is used to perform interference processing on the external optical signal; One end of the second photoelectric conversion unit is connected to the second interference unit, and the other end is connected to the detection module; the second photoelectric conversion unit is used to generate second phase information based on the optical signal output by the second interference unit, and transmit the second phase information to the detection module.

10. A quantum key distribution system, characterized in that, This includes the source, the quantum channel, and the receiver; The source includes a light source, a quantum state preparation module, and a light injection attack detection device as described in any one of claims 7 to 9; the light signal output from the light source is output from the quantum state preparation module after passing through the light injection attack detection device. The quantum channel is connected to the quantum state preparation module and is used to receive the optical signal output by the quantum state preparation module; The receiving end is connected to the quantum channel; the receiving end is used to generate a quantum key based on the optical signal transmitted by the quantum channel.

Images