Security proof of quantum communication protocols

Abstract

Disclosed is a method for sharing information between a sender node and a receiver node in accordance with a quantum communication protocol. The method comprises: determining an attack configuration for access by a third party to the quantum channel, the attack configuration being defined by at least a quantum circuit system having specific parameters and an attack success bound, the quantum circuit system being configured to intercept a qubit on the quantum channel, determine the state of the intercepted qubit; using the quantum circuit system to measure first and second metrics by at least intercepting qubits on the quantum channel; determining whether the second metric fulfils an error tolerance bound and whether the first metric fulfills the attack success bound; aborting the communication protocol if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound.

Description

SECURITY PROOF OF QUANTUM COMMUNICATION PROTOCOLSFIELD OF THE INVENTION

[0001] The invention relates to the field of data communication, and particularly to a method for sharing information between nodes in accordance with a quantum communication protocol.BACKGROUND

[0002] Quantum communication is a field that uses the quantum mechanical properties of a quantum system; properties like superposition and entanglement, to enable secure and efficient communication protocols. It offers a wide range applications like Quantum Key Distribution (QKD) which enables two parties to securely exchange cryptographic keys between them, wherein any attempt to intercept the quantum signal by a third party may disturb the quantum state, alerting the legitimate users. Another major application of quantum communication is the quantum teleportation and quantum cryptography. However, there is a need for improved use of QKD.SUMMARY

[0003] It is an objective to provide a method for sharing information using a data sharing system comprising a sender node and a receiver node using a quantum channel in accordance with a quantum communication protocol. The objectives underlying the invention are solved by the features of the independent claims.

[0004] Embodiments provide a method (security proof method) for sharing information between a sender node and a receiver node in accordance with a quantum communication protocol using a quantum channel, the quantum communication protocol requiring or defining an error tolerance bound for thereceiver node, the method comprising: determining an attack configuration for access by a third party to the quantum channel, the attack configuration being defined by at least a quantum circuit system having specific parameters and an attack success bound, the quantum circuit system being configured to intercept a qubit on the quantum channel, determine the state of the intercepted qubit and send the qubit to the receiver node through the quantum channel; defining a first metric representing a level of success of an attack by the third party and a second metric indicating a level of reception success at the receiver node; evaluating the second metric using the receiver node and using the quantum circuit system to evaluate the first metric by at least intercepting qubits on the quantum channel; determining whether the first metric fulfils the attack success bound and whether the second metric fulfills the error tolerance bound; aborting the communication protocol if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound.

[0005] Embodiments provide a quantum computing system for enabling sharing information between a sender node and a receiver node in accordance with a quantum communication protocol, the quantum computing system comprising a quantum circuit system having specific parameters, the quantum circuit system being configured to intercept a qubit on a quantum channel, determine the state of the intercepted qubit and send the qubit to the receiver node through the quantum channel; the quantum computing system being configured to evaluate a second metric using the receiver node and use the quantum circuit system to evaluate a first metric by at least intercepting qubits on the quantum channel, wherein the first metric represents a level of success of an attack using the quantum circuit system and the second metric indicates a level of reception success at the receiver node; determine whether the first metric fulfils an attack success bound and whether the second metric fulfil Is an error tolerance bound; aborting the communication protocol if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound.

[0006] It is understood that one or more of the aforementioned embodiments may be combined as long as the combined embodiments are not mutually exclusive.BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In the following, examples are described in greater detail making reference to the drawings in which:

[0008] Fig. 1 is a block diagram of a system in accordance with an example of the present subject matter.

[0009] Fig. 2 is a flowchart of a method for sharing information between a sender node and a receiver node in accordance with a quantum communication protocol.

[0010] Fig. 3A is a diagram representing an example quantum communication system in accordance with an example of the present subject matter.

[0011] Fig. 3B schematically depicts an example quantum circuit system for the third-party quantum computing system in accordance with an example of the present subject matter.

[0012] Fig. 3C schematically depicts an example quantum circuit system for the third-party quantum computing system in accordance with an example of the present subject matter.

[0013] Fig. 3D schematically depicts an example quantum circuit system for the third-party quantum computing system in accordance with an example of the present subject matter.

[0014] Fig. 4A is a diagram representing an example quantum communication system in accordance with an example of the present subject matter.

[0015] Fig. 4B schematically depicts an example quantum circuit system for the third-party quantum computing system in accordance with an example of the present subject matter.

[0016] Fig. 5 is a flowchart of a method for optimizing the parameters of a quantum circuit system in accordance with an example of the present subject matter.DETAILED DESCRIPTION

[0017] In the following, similar elements are denoted by the same reference numerals.

[0018] The present subject matter may enable two or more distant parties to communicate securely with each other. In particular, the present subject matter may provide an accurate evaluation of the security level of the communication through the quantum channel.

[0019] Quantum computing may enable secure access to information. For that, quantum channels may be used. The quantum channel may be a communication channel which may transmit quantum information. The quantum channel may further be used to transmit classical information. An example of quantum information may be information that indicates the state of a qubit. The state of the qubit may refer to the computational basis state of a given basis. The qubit may physically be implemented using a quantum system having two states, wherein the quantum system may, for example, be a photon or ion. The quantum channel may, for example, be implemented using optical fibers or free space. For example, the vertical and horizontal photon’s polarization may be used as a qubit state. The two energy levels of an ion may, for example, be used as a qubit state. For example, in case of a qubit represented by a photon, the computational basis states may be horizontal and vertical polarization states or may be diagonal and antidiagonal polarization states.

[0020] The quantum channel may be used to share or provide information. For example, a system (named data sharing system or quantum communication system) comprising sender and receiver nodes is provided. The sender node may, for example, comprise a sender quantum computing system and the receiver node may, for example, comprise a receiver quantum computing system. The terms "receiver node" and "receiver quantum computing system" are used interchangeably. The terms "sender node" and "sender quantum computing system" are used interchangeably. The data sharing system may comprise the sender quantum computing system which is connected through the quantumchannel with the receiver quantum computing system. For example, the sender quantum computing system may use the quantum channel to share information with the receiver quantum computing system or vice versa. The shared information may, for example, be encoded in states of qubits that travel through the quantum channel from the sender quantum computing system to the receiver quantum computing system.

[0021] The sharing of the information between the sender quantum computing system and the receiver quantum computing system may be performed in accordance with the quantum communication protocol. The quantum communication protocol may be a system of rules that allows two or more entities of a communications system to share (e.g., transmit) information. The quantum communication protocol may, for example, define the rules, syntax, semantics, and synchronization of communication and possible error recovery methods. In one example, the quantum communication protocol may be used by the sender quantum computing system and the receiver quantum computing system for obtaining two identical copies of a sequence of bits, wherein the shared information may comprise at least the sequence of bits. The sequence of bits may, for example, be random and secret. The sender quantum computing system may, for example, prepare qubits in states representing the sequence of bits respectively.

[0022] The quantum communication protocol may, for example, be a single-qubit- based protocol or entangled-state-based protocol. The quantum communication protocol may control the security of the sharing of information using security bounds. The security bounds may, for example, be defined by using a theoretical method through theoretical analysis, a simulation method by creating models and performing simulations on the modeled systems, or a statistical method by analyzing data and using statistical techniques to identify patterns.

[0023] A security bound may be defined for the reception of the qubits at the receiver node. For example, this security bound may be named or referred to as the error tolerance bound. The error tolerance bound may refer to a value or a range of values. The error tolerance bound may refer to a value or a range of values of an error rate, a reception success or a fidelity. The error tolerance bound may, forexample, represent a maximum error rate in the transmission of quantum information or represent a minimum level of success of the reception of the qubits that should not be exceeded for the secure sharing of the information; otherwise, the sharing of information may be classified as being unsecure. A low error rate may indicate a high level of accuracy in the transmitted qubits, while high reception success may indicate the ability to reliably detect and measure those qubits. For example, a higher reception success probability may indicate a lower probability of errors occurring during the transmission and measurement of qubits. Thus, a higher reception success may be associated with a lower error rate. In one example, the error tolerance bound may represent an error caused by a maximum level of eavesdropping.

[0024] The present subject matter may further use another security bound representing the eavesdropping. This security bound may be referred to as attack success bound. The attack success bound may be used to evaluate the security of the quantum communication protocol. The attack success bound may indicate the level of success of an (simulated) attack or eavesdropping by the third party. The attack success bound may refer to a value or a range of values. The attack success bound may refer to a value or a range of values of a fidelity or of a level of success of the eavesdropping.

[0025] The present subject matter may enable two or more distant parties to communicate securely with each other. In particular, the present subject matter may provide an accurate evaluation of the security level of the communication through the quantum channel. For that, a third-party quantum computing system (also referred to as the third party) may be provided. The third-party quantum computing system may be configured to connect to the quantum channel between the sender quantum computing system and the receiver quantum computing system. The sender quantum computing system may prepare qubits in respective basis states and send them through the quantum channel to the receiver quantum computing system. The receiver quantum computing system may be configured to receive the prepared qubits through the quantum channel, and measure their states. The third- party quantum computing system may be configured to intercept the prepared qubits on the quantum channel, determine or estimate their states and send(resend) the intercepted qubits to the receiver node through the quantum channel. In one example, the third-party quantum computing system may be configured to intercept the prepared qubits on the quantum channel and determine their states without destroying or changing the states of the intercepted qubits and send the qubits to the receiver node. In one example, the third-party quantum computing system may be configured to intercept the prepared qubits on the quantum channel, create approximate copies of the intercepted qubits, send the approximate copies to the receiver node through the quantum channel and use the approximate copy of the intercepted qubit to estimate the state of the intercepted qubit. The third-party quantum computing system may enable to simulate attacks or eavesdropping on the quantum channel. The third-party quantum computing system may be used to evaluate the level of success of an attack (e.g., the level of success of eavesdropping the quantum channel).

[0026] The level of success of the attack may be evaluated using the states of intercepted qubits which are determined by the third-party quantum computing system. The determined states by the third-party quantum computing system may be compared against the prepared states of the intercepted qubits in order to evaluate the level of success of the attack. Once arrived at the receiver quantum computing system, the states of the intercepted qubits may be measured at the receiver quantum computing system, and the measured states may be compared against the prepared states of the intercepted qubits in order to evaluate the level of success of reception at the receiver quantum computing system. The level of success of the attack may be represented by the first metric. The level of success of reception may be represented by the second metric. For example, the third-party quantum computing system may be used to evaluate the first metric. The first metric may, for example, be a distance measure such as a fidelity. For example, the third- party quantum computing system may be used to determine elements of the density matrices that may be used to compute the fidelity between the state of the intercepted qubit and a state of the prepared qubit as prepared by the sender node. The receiver quantum computing system may be used to evaluate the level of reception success. For example, the receiver quantum computing system may be used to evaluate the second metric that represents the level of reception success. The second metric may, for example, be a distance measure such as a fidelity. Forexample, the receiver quantum computing system may be used to determine elements of the density matrices that may be used to compute the fidelity between the state of the received qubit and a state of the prepared qubit as prepared by the sender node.

[0027] Each quantum computing system of the sender quantum computing system, the receiver quantum computing system and the third-party quantum computing system may, for example, comprise a quantum circuit system. The quantum circuit system may utilize the principles of quantum mechanics to perform quantum computations by operating one or more qubits. Said quantum circuit system may further utilize the principles of quantum mechanics to perform quantum communication to transmit or receive quantum information. The quantum circuit system may, for example, be a quantum computer. For example, the each quantum computing system may be a photonic quantum computer using photons to represent the qubits, wherein the quantum circuit system may, for example, comprise components such as: a polarization controller, a pulse pattern generator, a light source, a planar light-wave circuit or any other component that may enable the quantum circuit system to perform quantum computation and / or quantum communication. The each quantum computing system may, for example, be configured to perform classical computations using a classical computer or by simulating classical computations. The classical computer may or may not be part of the each quantum computing system. The classical computer may include the hardware such as processor and memory and software such as an operating system.

[0028] The third-party quantum computing system may be configured to provide a third-party quantum system. The third-party quantum computing system may be defined according to an attack configuration of a simulated attack. For example, the third-party quantum system may be defined by the prepared qubit which is intercepted on the quantum channel and a set of one or more additional qubits. For example, the third-party quantum computing system may comprise the quantum circuit system which comprises the intercepted qubit and the set of additional qubits. The quantum circuit system may further be configured to perform a set of one or more quantum operations having specific parameters. The quantum operation maybe a unitary operation. The application of the set of one or more quantum operations may enable to determine or predict the state of the intercepted qubit by measuring one or more additional qubits of the quantum circuit system after application of the set of one or more quantum operations. After application of the set of one or more quantum operations, the intercepted qubit may remain unchanged and may be resent by the quantum circuit system to the receiver node through the quantum channel. The quantum operation may, for example, be one operation or a sequence of operations of a defined set of universal quantum gates including, for example, the rotation operators and controlled NOT (CNOT) operator.

[0029] For example, the set of one or more quantum operations may be a controlled operation using the intercepted qubit as a control qubit. The controlled operation may, for example, be a controlled rotation applied on the additional qubit and using the intercepted qubit as control qubit. The controlled operation may, for example, be CNOT operation that acts on two qubits in order to perform the NOT operation on the additional qubit based on the state of the intercepted qubit. After application of the controlled operation, the intercepted qubit may remain unchanged and may be resent by the quantum circuit system to the receiver node through the quantum channel. After application of the controlled operation, the state of the additional qubit involved in the controlled operation may indicate the state of the intercepted qubit. In another example, the set of quantum operations may comprise the controlled operation in addition to additional quantum operations. The additional quantum operations may be applied on at least part of the set of additional qubits. After application of the set of quantum operations, at least one of the set of additional qubits may be measured and the result of the measurement may be used to determine or estimate the state of the intercepted qubit.

[0030] For example, the third-party quantum computing system may comprise control means that control the states of the qubits of the quantum circuit system e.g., that control the quantum circuit system to perform the set of quantum operations. The quantum operation may be applied on at least part of the qubits of the quantum circuit system. The quantum operation may be a controlled quantum operation, where the intercepted qubit acts as a control for the quantum operation. The specific parameters of the quantum circuit system may, for example, beparameters of the quantum operations such as rotation angles of rotation operations. For example, the state of the qubit may be transformed by rotating it around axis x, y, and z in the Bloch sphere.

[0031] The value of the first metric may be compared (first comparison) against the attack success bound in order to determine whether the value of the first metric fulfils the attack success bound. The value of the first metric fulfils the attack success bound may mean that the attack is successful. For example, the level of success of the attack fulfils the attack success bound may mean that the level of success of the attack is higher than the attack success bound e.g., fidelity metric (representing the level of success of the attack) may be higher than 80%, where 80% may be the attack success bound. The value of the second metric may be compared (second comparison) against the error tolerance bound in order to determine whether the value of the second metric fulfils the error tolerance bound. The value of the second metric fulfils the error tolerance bound may mean that the reception of information at the receiver node is successful (e.g., secure). For example, the level of reception success at the receiver node fulfils the error tolerance bound may mean that the level of reception success at the receiver node is higher than the error tolerance bound, wherein the error tolerance bound may be a minimum level of success of the reception. In another example, in case the error tolerance bound is a maximum error rate, the reception error rate at the receiver node fulfills that bound if it is smaller than the error tolerance bound e.g., the error rate at the receiver node may be smaller than 10%, where 10% may be the error tolerance bound.

[0032] The present subject matter may use not only the second comparison results to decide on the security of the quantum communication protocol, rather, it may use the results of both the first and second comparisons in order to decide on the security of the quantum communication protocol. For example, the quantum communication protocol may be aborted if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound. In another example, the quantum communication protocol may be aborted if the second metric does not fulfil the error tolerance bound and the first metric fulfills the attack success bound. The quantum communication protocol may not be aborted if the secondmetric fulfils the error tolerance bound and the first metric does not fulfill the attack success bound.

[0033] The present subject matter may thus enable two or more distant parties to communicate securely with each other e.g., the data sharing system may be a real system (i.e., not simulated system) which is being used for real sharing of information through the quantum channel. This communication may be useful in a wide range of applications where security may be critical, such as in financial transactions, government communications, and military operations.

[0034] Aborting the quantum communication protocol may, for example, comprise providing warning or error signals to the sender quantum computing system and the receiver quantum computing system. The signal may indicate that the communication is not secure and that the shared information may be accessed by an eavesdropper.

[0035] In one example, upon receiving the signal, the sender quantum computing system and the receiver quantum computing system may share the information by adapting the quantum communication protocol or may repeat the information sharing another point of time or may stop sharing information. In one example, in response to aborting the quantum communication protocol, the information may be shared again (e.g., at a later point of time) between the sender quantum computing system and the receiver quantum computing system, the first and second metrics may be evaluated and a further check whether to abort or not the quantum communication protocol may be performed. This may be advantageous in case the security issue is temporal e.g., it may only occur due to some temporal misconfigurations. In one example, in response to aborting the quantum communication protocol, the quantum communication protocol may be adapted and the security proof method may be repeated using the adapted quantum communication protocol in order to share information between the sender quantum computing system and the receiver quantum computing system.

[0036] In one example, the information may be shared between the sender quantum computing system and the receiver quantum computing system by atleast: sending by the sender quantum computing system qubits to the receiver quantum computing system. The sender quantum computing system may prepare each qubit in a respective computational basis state before sending the prepared qubit through the quantum channel to the receiver quantum computing system. The states of the prepared qubits provide the information shared between the sender quantum computing system and the receiver quantum computing system. This example may be advantageous as it may enable a seamless integration of the present subject matter with existing communication protocols e.g., the quantum communication protocol may be the BB84 protocol. For example, the sender quantum computing system may prepare the qubit using predefined bases. For example, in order to encode or prepare a qubit, the sender quantum computing system may select one of the predefined bases and prepare the qubit in a computation basis state using the selected base. The receiver quantum computing system may measure the prepared qubit once received over the quantum channel by selecting a base of the predefined bases and using the selected base to measure the prepared qubit which is received at the receiver quantum computing system. This example may enable the sharing of information in accordance with the single- qubit-based protocol.

[0037] In one example, the information may be shared between the sender quantum computing system and the receiver quantum computing system by using entanglement. For that, a two-qubit system may be defined for each pair of qubits of a set of pairs of qubits, where one qubit of the two-qubit system may be part of the sender quantum computing system and the other qubit may be part of the receiver quantum computing system. The state of the two-qubit system may be an entangled state. For example, the entangled state of the two-qubit system may be any one of the Bell states e.g., the sender quantum computing system and the receiver quantum computing system may each receive one photon of a polarization- entangled pair.

[0038] The present subject matter may make use of the entangled state of the two- qubit system to transmit or share information between the sender quantum computing system and the receiver quantum computing system. The information may be teleported from the sender’s qubit to the receiver’s qubit by means ofentanglement. For example, the two qubits may be entangled such that when a particular property is measured in one qubit, the opposite state may be observed on the entangled qubit instantaneously.

[0039] The entangled state may be provided as a distributed entangled state such that the entangled pair of qubits are located at different locations in the respective sender quantum computing system and the receiver quantum computing system. The distributed entangled state between the pair of qubits may, for example, be formed by first forming locally at the sender quantum computing system the entangled state of the pair of qubits, and subsequently sending by the sender quantum computing system one of the pair of qubits to the receiver quantum computing system. The entangled state may, for example, be formed by applying a CNOT operation on the pair of qubits. Thus, for sharing the information between the sender quantum computing system and the receiver quantum computing system, multiple distributed entangled states may be created using the pairs of qubits respectively. Using entanglement may further secure the sharing of information in accordance with the present subject matter. In one example, the quantum communication protocol may be an Entangled QKD protocol e.g., an entangled BB84 variant.

[0040] In one example, the sender quantum computing system and the receiver quantum computing system may further be configured to communicate through a classical public channel e.g., to exchange public data such as the bases used to prepare or measure the qubits. The third-party quantum computing system may be configured to intercept and receive data communicated on the classical public channel. The third-party quantum computing system may, for example, use this intercepted information for determining or improving the attack configuration and for determining the first metric.

[0041] The present subject matter may use advantageous techniques to provide different (simulated) attack configurations of the third-party quantum computing system that may enable a reliable proof of security of the quantum communication protocol using the quantum channel. For that, one or more attack configurations may be defined using an offline analysis and a quantum simulator. The offlineanalysis may be referred to as an attack simulation method. The quantum simulator may, for example, be configured to simulate the quantum communication protocol using a model of a real communication system that enables communication of quantum information. For example, the quantum simulator may be configured for controlling parameters for individual components and sub-protocols in the system including quantum channel and communicating parties. The quantum simulator may, for example, be implemented as a software application.

[0042] In one first optimization example, the attack simulation method may use the quantum simulator to optimize the specific parameters of the third-party quantum computing system in order to improve the attack success rate. The attack simulation method may comprise defining a quantum circuit system comprising at least the intercepted qubit and one or more additional qubits and performing one or more quantum operations having the specific parameters, wherein the quantum operation(s) enable to determine the state of the intercepted qubit e.g., without affecting the prepared state of the intercepted qubit. The attack simulation method may further comprise the evaluation of the first metric using the determ ined / estimated states of the intercepted qubits. The attack simulation method may be repeated multiple times, wherein in each repetition, different values of the specific parameters are used. The repetition may be performed until a desired target of the first metric is reached, wherein the values of the parameters that provide the desired target are provided as optimal parameters. Alternatively, the repetition may be performed for a predefined number of times, the resulting first metric values may be compared and the values of the parameters that provided the best first metric may be provided as the optimal parameters. Thus, the attack simulation method may enable to obtain optimized values of the specific parameters. These optimized values (and the associated quantum circuit system) may be used by the present security proof method in order to proof security of the sharing information between the sender quantum computing system and the received quantum computing system.

[0043] In one second optimization example, the attack simulation method may use the quantum simulator to optimize the specific parameters of the third-party quantum computing system in order to improve the attack success using machinelearning. For that, an objective function may be defined. The attack simulation method may be repeated multiple times, wherein in each repetition, different values of the specific parameters are defined based on the evaluated objective function. The repetition may be performed until the objective function fulfils a convergence criterion. This example may enable an accurate determination of the optimal parameters. This may further improve the security proof according to the present subject matter. The objective function may be defined based on the type of the first metric being used.

[0044] In one example, the second metric may be a fidelity between the state of the prepared qubit as prepared by the sender node and the measured state of the qubit which is received at and measured by the receiver quantum computing system. The state of the prepared qubit may be represented by a density matrix p and the state measured by the receiver quantum computing system may be represented by a density matrix p2. The second metric may thus be defined as follows: F1(1,2) = (tr-x / -\ / PiP2'\ / Pi)2■ This may enable to compare the effects of eavesdropping on qubits in terms of the fidelity of the qubits prepared at the sender node and the qubits obtained at the receiver node.

[0045] In one example, the first metric (F2) may be the fidelity between the state of the intercepted qubit as determined or estimated by the third-party and a state of the prepared qubit as prepared by the sender. The first metric may thus be defined as follows: F2The references Charles H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. Smolin. Experimental quantum cryptography. Journal of cryptology, 5:3-28 and llrnesh Vazirani and Thomas Videck. Fully device-independent quantum key distribution. Physical Review Letters, 113(14), Sep 2014 provide example implementations for the evaluation of the first metric and the second metric.

[0046] The first metric may, for example, have the value 1 , if the states are identical and the value 0, if both are orthogonal. The third-party quantum computing system may provide a quantum circuit system in order to keep its fidelity and the fidelity at the receiver as close to 1 as possible. In this case, the attack may only be noticedwith a low probability. For example, in case the quantum communication protocol is the BB84 protocol, four different states may be selected with equal probability. In this case, the average fidelity (e.g., fidelity is measured for all different states and averaged over four distinct states) may be used as the first metric and second metric for the third-party quantum computing system and the receiver quantum computing system respectively.

[0047] The quantum communication protocol may be used by the sender quantum computing system and the receiver quantum computing system for obtaining two identical copies of a sequence of bits, wherein the shared information may be the sequence of bits. The sequence of bits may, for example, be random and secret. The third-party quantum computing system may try to learn original bits. During this sharing of information process, each of the three parties may obtain a string of bits. The three strings may be interpreted as binary random variables. The degree of dependence between two random variables may be measured in terms of the mutual information. In one example, the first metric may alternatively comprise the mutual information (transinformation) between binary random variables of the sender node and of the third party.

[0048] The mutual information may, for example, be defined as follows: / (X, T) = where X may be the random variable associated with bitsat the sender quantum computing system and Y may be the random variable associated bits at the third-party quantum system, where p(x,y) is the joint probability, and p(x) and p(y) are the individual probabilities.

[0049] For example, two random bits b1 , b2 e [0, 1 ] are input for the quantum channel and the output may be the XOR value b1 ®b2. The corresponding probabilities are shown in the following table:

[0050] For example, the input 00 occurs together with the output 0 with the probability 1 / 4. Thus, the value of the transinformation may be 1 , e.g., out of two possible bits of information, 1 bit is transmitted through the channel. However, no information about the individual bits may have been received, because even after knowledge of b1 ®b2, the value of b1 and b2 is still equally distributed. Nevertheless, the information about the value of b1 ®b2 may be valuable for an attacker (or eavesdropper) because it may allow to restrict the search space in a brute force search of 4 possibilities to 2.

[0051] For example, the fidelity for the receiver quantum computing system may be referred to as F and the fidelity for the third-party quantum computing system may be referred to as F2. The objective function of the second optimization example may, for example, be defined as: — F2+10 x (Fx— target)2, where target is a predefined target value for the fidelity F . The mutual information for the third-party quantum computing system may be referred to as 12. In this case, the objective function may, for example, be defined as: 12+10 x (Fx— target)2.

[0052] The first and second metrics may be evaluated using a metric determination system. The metric determination system may or may not be part of the third-party quantum computing system. The metric determination system may be a classical computer system or quantum computer system. For example, the metric determination system may use quantum state tomography to construct the density matrices p and p2e.g., with a series of measurements performed in different bases, and estimate the fidelity.

[0053] In one example, the quantum communication protocol may be the quantum key distribution (QKD) protocol, wherein the shared information comprises a key. The QKD protocol may, for example, be the BB84 protocol or the Eckert protocol E91. The transmitted qubits may be photons which are prepared in computational basis states, wherein the computational basis sates may be horizontal and vertical polarization states or may be diagonal polarization states.

[0054] The present subject matter may further improve the proof of security the quantum communication protocol using the quantum channel. For that, different structures of the quantum circuit system of the third-party quantum computing system may be used.

[0055] In one example, different quantum circuit systems may be defined and for each quantum circuit system, the quantum circuit system may be used in order to intercept the qubit on the quantum channel and evaluate the first metric. The quantum circuit system that has the best value of the first metric may be selected and used in order to perform the security proof method according to the present subject matter. Each quantum circuit system may include the intercepted qubit, a defined number of additional qubits and perform a set of quantum operations including a controlled operation and zero or more additional quantum operations. The parameters (e.g., rotation angles) of the set of quantum operations may be the specific parameters of the quantum circuit system. The number of additional qubits and additional quantum operations of each quantum circuit system may, for example, be randomly selected or may be user defined.

[0056] In one first circuit example, the quantum circuit system comprises the intercepted qubit and one or more qubits. The quantum circuit system is configured to perform a sequence of one or more quantum operations on the qubits for determining the state of the intercepted qubit without destroying the state of the intercepted qubit.

[0057] In one second circuit example, the quantum circuit system comprises the intercepted qubit and a target qubit. The target qubit is prepared in an initial basis state. In addition, the sequence of one or more quantum operations is a single quantum operation that transforms the initial basis state of the target qubit dependent on the state of the intercepted qubit without destroying the state of the intercepted qubit. The state of the intercepted qubit is determined or estimated using a state of the target qubit which is measured after application of the transformation.

[0058] In one third circuit example, the quantum communication protocol may be a QKD protocol such as BB84 protocol. According to this quantum communication protocol, the sender quantum computing system may send to the receiver quantum computing system over a classical public channel the bases that have been used to prepared the intercepted qubits. The third-party quantum computing system may be configured to intercept communicated data over the classical public channel and have access to the bases used. The third-party quantum computing system may further be configured to save the intercepted qubits e.g., for a later operation. The attack simulation may make use of this to control the quantum circuit system to perform a basis dependent operation using the saved qubit and information gained on the bases. For that, the quantum circuit system comprises the intercepted qubit and a target qubit. The target qubit is prepared in an initial basis state. The sequence of one or more quantum operations comprises one controlled quantum operation transforming the initial basis state of the target qubit dependent on the state of the intercepted qubit, and another quantum operation transforming the state of transformed target qubit taking into account the basis being used to prepare the intercepted qubit. The state of the intercepted qubit may be determined or estimated using a state of the target qubit which is measured after application of the two transformations without destroying the state of the intercepted qubit.

[0059] In one fourth circuit example, the quantum circuit system comprises the intercepted qubit, a first target qubit and a second target qubit. The sequence of quantum operations comprises a controlled quantum operation enabling the determination of the state of the first target qubit dependent on the state of the intercepted qubit and a quantum operation enabling the determination of the state of the second target qubit in a specific computation basis. The quantum operations may be applied by the quantum circuit system without destroying the state of the intercepted qubit.

[0060] In one fifth circuit example, the quantum circuit system may be configured to make one or more approximate state copies of the intercepted qubit. This quantum circuit system may enable to prepare a state that has as high fidelity as possible, and at the same time the fidelity for the receiver is also preserved as well as possible. The quantum circuit system may comprise the intercepted qubit havingstate p and one additional qubit which may be prepared in a basis state e.g., |0 > . The quantum circuit system may be configured to perform a set of one or more quantum operations on the input state ®|0 >< 0| in order to obtain a state p®p where p is the approximate state copy of the state p of the intercepted qubit. The approximate copy p may be received at the receiver quantum computing system, but since it is an approximate copy, the fidelity at the receiver node may still be of high value. The approximate copies may be used to estimate the first metric and second metric. The approximate copy p may be compared with the original state p in order to estimate the first metric. The approximate copy p which is received at the receiver quantum computing system may be compared with the original state p in order to estimate the second metric.

[0061] In one example, each quantum circuit system of the above circuit examples may further be used to determine the first metric and configured to send the intercepted qubit to the receiver node.

[0062] In one example, the present security proof method may be implemented in a quantum repeater. This may enable a seamless integration of the present subject matter in existing systems. The present quantum computing system for enabling sharing information may, for example, be comprised in the quantum repeater.

[0063] FIG. 1 is a diagram of a system 100 in accordance with an example of the present subject matter. The system 100 comprises a quantum communication system 110 and a metric determination system 105. The quantum communication system 110 comprises a sender quantum computing system 101 and a receiver quantum computing system 102 which are configured to exchange or share information through a quantum channel 104. The quantum communication system 110 further comprises a third-party quantum computing system 103 that is configured to intercept qubits on the quantum channel 104 and estimate the states of the intercepted qubits e.g., without destroying the states of the intercepted qubits and send the qubits to the receiver node 102. For that, the third-party quantum computing system 103 may comprise a quantum circuit system which may be an experimental implementation of the schematically depicted circuit of FIGs 3B-3Dand 4B. The third-party quantum computing system 103 may be located on any point of the quantum channel 104. For example, the third-party quantum computing system 103 may be located near the receiver node 102 e.g., the third-party quantum computing system 103 may or may not be part of the receiver node 102.

[0064] The metric determination system 105 may include a classical computer or quantum computer and communicate with components of the quantum communication system 110. The metric determination system 105 may be configured to control the operation of the third-party quantum computing system 103. The metric determination system 105 may cause the quantum circuit system of the third-party quantum computing system 103 to be used for interceptions of one or more qubits which are transmitted on the quantum channel 104 and perform respective measurements to determine output information that enables to determine the metric such as the first metric. The metric determination system 105 may be configured to control the operation of the receiver node 102 in order to evaluate the second metric.

[0065] FIG. 2 is a flowchart of an example method for sharing information between a sender node and a receiver node in accordance with a quantum communication protocol. For the purpose of explanation, the method described in FIG 2 may be implemented using the system illustrated in FIG. 1 , but is not limited to this implementation. The sender node may, for example, be the sender quantum computing system 101 and the receiver node may be receiver quantum computing system 102.

[0066] An attack configuration for access by the third party to the quantum channel may be determined in step 201. The attack configuration is defined by at least a quantum circuit system having specific parameters and an attack success bound. The quantum circuit system is configured to intercept a qubit on the quantum channel, determine the state of the intercepted qubit and send the qubit (or an approximate copy of it) to the receiver node. FIGs 3B-3D provide examples of attack configurations.

[0067] A first metric representing a level of success of an attack by the third party and a second metric indicating a level of reception success at the receiver nodemay be defined in step 203. For example, the first and second metrics may be user defined metrics e.g., an input may be received in step 203 which provides the definition of the first and second metrics. In another example, the first and second metrics may be defined by selecting them (e.g., randomly) from a list of predefined metrics.

[0068] The quantum circuit system may be used in step 205 to evaluate the first metric by at least intercepting qubits on the quantum channel. The second metric may be evaluated in step 205 using the receiver node.

[0069] It may be determined in step 207 whether the second metric fulfils the error tolerance bound and whether the first metric fulfills the attack success bound.

[0070] The quantum communication protocol may be aborted in step 209 if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound. In one example, if the first metric fulfills the attack success bound and the second metric does not fulfil the error tolerance bound, the quantum communication protocol may be aborted.

[0071] In one example, if the first metric does not fulfill the attack success bound and the second metric fulfils the error tolerance bound, the shared information may be classified as being secure and thus can be used by the sender and the receiver.

[0072] Fig. 3A is a diagram representing an example quantum communication system in accordance with an example of the present subject matter. Specifically, the quantum communication system is represented by a quantum circuit 300. The quantum circuit 300 represents a qubit qO which is the qubit transmitted from the sender (Alice) 301 to the receiver (Bob) 302. The qubit qO may be intercepted by the third-party quantum computing system (Eve) 303 and used as control qubit for another qubit q1 of the quantum circuit 300. The quantum circuit 300 further shows measurement devices for measuring the qubits qO and q1 , where the qubit qO is measured at the receiver 302 and the qubit q1 is measured at the third-party quantum computing system 303. The third-party quantum computing system 303 may comprise a quantum circuit system as the schematically depicted circuit of FIG.3B, 3C or 3D. The quantum circuit systems of FIGs, 3B and 3C may enable the interception of the qubit and estimation of its state without destroying or changing its state, that is, the receiver may receive the qubit as prepared by the sender.

[0073] Fig. 3B schematically depicts an example quantum circuit system 310 for the third-party quantum computing system in accordance with an example of the present subject matter. The quantum circuit system 310 may consist of a controlled rotation on Eve's system, while Alice's and Bob's systems serve as the controlling system. The quantum circuit system 310 may be configured to perform a rotation along y axis on the qubit q1 using the angle a, where the angle a is the parameter of the quantum circuit system 310. The rotation may use the qubit q1 as target and the intercepted qubit qO as control qubit.

[0074] Fig. 3C schematically depicts an example quantum circuit system 311 for the third-party quantum computing system in accordance with an example of the present subject matter. The quantum circuit system 311 is an extension of the controlled rotation of quantum circuit system 310 on the Eve’s system by another, but uncontrolled operation on the Eve’s system. The quantum circuit system 311 may be configured to perform on the qubit q1 a first rotation along y axis using the angle a and using the qubit qO as control qubit, and followed by the uncontrolled rotation along the y axis using angle b, where the angles a and b are the parameters of the quantum circuit system 311 .

[0075] Fig. 3D schematically depicts an example quantum circuit system 312 for the third-party quantum computing system for the BB84 protocol in accordance with an example of the present subject matter. The quantum circuit system 312 may be configured to perform a rotation along y axis on the qubit q1 using the angle TT / 2 followed by a CNOT operation using the qubit q1 as the control qubit and qO as the target. The rotation may use the qubit q1 as target and the intercepted qubit qO as control qubit. The quantum circuit system 312 may be configured to make approximate copies of the intercepted qubit. This quantum circuit system 312 may enable to prepare a state that has as high state quality as possible with the transmitted state, so that at the same time the state quality for the receiver is also preserved as well as possible. The quantum circuit system may comprise theintercepted qubit having state p and one additional qubit which may be prepared in a basis state |0>. The quantum circuit system may be configured to perform a set of one or more quantum operations on the input state p® 10 >< 0| in order to obtain a state p®p where p is the approximate state copy of the state p of the intercepted qubit.

[0076] The copied states may be defined in a specific basis in which the original states of the transmitted qubit are defined according to the BB84 protocol. The basis states may, for example, be: Each of the copied statesmay be compared with the respective original state. The first and second metrics may be evaluated by using partial tracing of the approximate states for enabling the comparison of the approximate state at the receiver node and at the third-party with the original state of the transmitted qubit. Additionally, the approximate states which are defined in the specific basis may not be orthogonal to each other and may not be distinguished from each other without error. The Pretty Good Measurement (PGM) may, for example, be used for distinguishing the approximate states. For that, the density matrices pLwith the associated probabilities ptmay be added up to a matrix G and then the root of the pseudoinverse of G is calculated. This may provide the operators fl; = pp / G~ pplG~ of a Positive Operator-Valued Measure (POVM) on the space spanned by the states. If the simulated attack has the ability to store the approximate copy of the state until Alice and Bob exchange information about the chosen basis, the third-party may perform operations on the stored state that depend on the basis. Since Bob and Eve may receive the same state, it is expected that Bob and Eve can also have the same probability of success in identifying the transferred states. In this case, the measurement may be performed in one of the two bases:

[0077] In one example, if the third-party is configured to save the intercepted qubit, the simulated attack can be divided into two parts: the first part is the interaction with Alice and Bob's system and the third-party system, which can be saved. After disclosing the selected bases, the third-party system can perform a base-dependent operation on the stored qubit before measuring the qubit. This may, for example, be implemented using the circuit of FIG. 4A.

[0078] Fig. 4A is a diagram representing a quantum communication system in accordance with an example of the present subject matter. Specifically, the quantum communication system is represented by a quantum circuit 400. The quantum circuit 400 represents a qubit qO which is the qubit transmitted from the sender (Alice) 401 to the receiver (Bob) 402. The qubit qO may be intercepted by the third-party quantum computing system (Eve) 403 and used as control qubit for another qubit q1. The quantum circuit 400 further shows measurement devices for measuring the qubits qO and q1 , where the qubit qO is measured at the receiver 402 and the qubit q1 is measured at the third-party quantum computing system 403. The third-party quantum computing system 403 may comprise a first quantum circuit system as described with reference to FIG. 3B or 3C. In addition, the third- party quantum computing system 403 may comprise two second quantum circuit systems shown in FIG. 4B, each being associated with one specific basis (e.g., in case the qubits are photons the basis may comprise horizontal and vertical polarization states).

[0079] In this example, the intercepted qubit may be stored or saved by the third- part quantum computing system. In addition, the third-party quantum computing system may have access to the basis used by the sender to prepare the state of the intercepted qubit e.g., this may be the case with the BB84 protocol where the bases are sent over a classical public channel and intercepted by the third-party quantum computing system.

[0080] As indicated in FIG. 4A, the quantum circuit 400 may enable to perform a sequence of at least two operations (rotations around y axis) on the qubit q1 e.g., the operation implemented by third-part quantum computing system 403 and operation 406. The qubit q1 is prepared in an initial basis state. The sequence of quantum operations comprises one quantum operation which is performed by the first quantum circuit system for transforming the initial basis state of the qubit q1 dependent on the state of the intercepted qubit qO. The sequence of quantum operations further comprises another quantum operation transforming the state oftransformed qubit q1 taking into account the basis being used to prepare the intercepted qubit qO. This other quantum operation may be performed by one of the second quantum circuit systems associated with the basis used for the preparation of the intercepted qubit qO. This other quantum operation may be referred to as basis-dependent operation. As indicated in FIG. 4A, this basis-dependent operation 406 may be performed even after Bob’s system has measured the qubit qO. The state of the intercepted qubit qO may be determined by the third-party quantum computing system using a state of the qubit q1 which is measured after application of the sequence of operations.

[0081] Fig. 4B schematically depicts an example of two quantum circuit systems 410 and 411 for the third-party quantum computing system in accordance with an example of the present subject matter. Each of the two quantum circuit systems is shown in FIG. 3C. The two quantum circuit systems may be used depending on the basis used by the Alice’s system to prepare the intercepted qubit. Since two bases may be used by the Alice’s system, these two quantum circuit systems 410 and 411 are provided to be used for the two bases respectively. For that, each of the two quantum circuit systems is configured to perform on the qubit q1 one controlled operation and a subsequent uncontrolled operation. The controlled operation in the two circuits uses the same angle a, while the uncontrolled operation uses two different angles b and c in the two quantum circuit systems.

[0082] FIG. 5 is a flowchart of a method for optimizing the parameters of the quantum circuit system in accordance with an example of the present subject matter. The parameters may be set to current values in step 501. The quantum circuit system may be used in order to measure the first metric in step 503. It may be determined in step 505 whether the first metric fulfills a convergence criterion. In case the first metric fulfills the convergence criterion, the parameter values may be provided in step 507 e.g., in order to be used in the method of FIG. 2. If the first metric does not fulfill the convergence criterion, the method goes back to step 501 for setting the parameters to other values. The convergence criterion may, for example, require the first metric to be in a target range of values.

Claims

CLAIMS1. A method for sharing information between a sender node (101 ) and a receiver node (102) using a quantum channel (104) in accordance with a quantum communication protocol, the quantum communication protocol requiring an error tolerance bound for the receiver node, the method comprising: determining (201 ) an attack configuration for access by a third party to the quantum channel, the attack configuration being defined by at least a quantum circuit system (310, 311 , 312) having specific parameters and an attack success bound, the quantum circuit system being configured to intercept a qubit on the quantum channel, determine the state of the intercepted qubit and send the qubit to the receiver node; defining (203) a first metric representing a level of success of an attack by the third party and a second metric indicating a level of reception success at the receiver node; evaluating the second metric using the receiver node and using (205) the quantum circuit system to evaluate the first metric by at least intercepting qubits on the quantum channel; determining (207) whether the second metric fulfils the error tolerance bound and whether the first metric fulfills the attack success bound; aborting (209) the communication protocol if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound.

2. The method of claim 1 , comprising: repeatedly: preparing by the sender node a qubit in a respective basis state; sending the prepared qubit by the sender node through the quantum channel to the receiver node for enabling sharing of information;wherein the intercepted qubits are the prepared qubits.

3. The method of claim 1 , comprising: repeatedly forming an entanglement state between a sender qubit in the sender node and a receiver qubit; sending by the sender node the receiver qubit to the receiver node through the quantum channel; wherein the intercepted qubits are the receiver qubits.

4. The method of any of the preceding claims, further comprising: using a quantum simulator for optimizing parameters of the quantum circuit system, the optimizing comprising repeatedly changing values of the parameters of the quantum circuit system and evaluating the first metric, the repetition being performed for obtaining a target value of the first metric; providing the specific parameters of the quantum circuit system as optimized parameters associated with the target value of the first metric.

5. The method of any of the preceding claims, the quantum circuit system comprising the intercepted qubit and one or more qubits, the quantum circuit system being configured to perform a sequence of one or more quantum operations on the qubits for determining the state of the intercepted qubit.

6. The method of claim 5, the quantum circuit system comprising the intercepted qubit and a target qubit being prepared in an initial basis state, wherein the sequence of one or more quantum operations is one quantum operation transforming the initial basis state of the target qubit dependent on the state of the intercepted qubit, wherein the determination of the state of the intercepted qubit is performed using a state of the target qubit which is measured after application of the transformation.

7. The method of claim 5, the quantum circuit system comprising the intercepted qubit and a target qubit being prepared in an initial basis state, wherein the sequence of one or more quantum operations comprises one quantum operation transforming the initial basis state of the target qubit dependent on the state of the intercepted qubit, and another quantum operation transforming the state of transformed target qubit taking into account the basis being used to prepare the intercepted qubit, wherein the determination of the state of the intercepted qubit is performed using a state of the target qubit which is measured after application of the two transformations.

8. The method of claim 5, the quantum circuit system comprising the intercepted qubit and a first target qubit and a second target qubit, wherein the sequence of quantum operations comprises a quantum operation enabling the determination of the state of the first target qubit dependent on the state of the intercepted qubit and a quantum operation enabling the determination of the state of the target qubit in a specific computation basis.

9. The method of any of the preceding claims 5 to 8, the quantum operation being a rotation operation around a specific axis.

10. The method of any of the preceding claims, the second metric being a fidelity between the state of the qubit received at the receiver node and a state of the prepared qubit.

11. The method of any of the preceding claims, the first metric being a fidelity between the state of the intercepted qubit and a state of the prepared qubit or a mutual information between the sender node and the third party.

12. The method of any of the preceding claims, wherein the quantum communication protocol is Quantum Key Distributed protocol.

13. The method of any of the preceding claims, wherein the shared information comprises an encryption key, a token, or a secret.

14. The method of any of the preceding claims, being implemented in a quantum repeater.

15. A quantum computing system (100) for enabling sharing information between a sender node (101 ) and a receiver node (102) in accordance with a quantum communication protocol, the quantum computing system comprising a quantum circuit system (310, 311 , 312) having specific parameters, the quantum circuit system being configured to intercept a qubit on a quantum channel (104), determine the state of the intercepted qubit, and send the qubit to the receiver node; the quantum computing system being configured to evaluate a second metric using the receiver node and to use the quantum circuit system to evaluate a first metric by at least intercepting qubits on the quantum channel; determine whether the second metric fulfils an error tolerance bound and whether the first metric fulfills an attack success bound; abort the communication protocol if the second metric fulfils the error tolerance bound and the first metric fulfills the attack success bound.

Images