Method for determining existence of wiretapper on quantum channel of quantum cryptography communication system by using TDC and quantum cryptographic key distribution apparatus therefor

Abstract

Disclosed are a reception apparatus of a quantum cryptographic key distribution system comprising a detection device configured to detect a quantum signal transmitted through a quantum channel and output a data signal corresponding to the detected quantum signal, and a TDC configured to measure a generation time difference between a generation time of a first encoding pulse included in the data signal and a generation time of a first reference pulse included in a predetermined reference timing signal. If the measured generation time difference is outside a predetermined threshold range, it is determined that a wiretapper exists in the quantum channel.

Description

Method for determining the presence of an eavesdropper on a quantum channel of a quantum cryptography communication system using TDC and a quantum cryptography key distribution device therefor

[0001] The present invention relates to a quantum cryptographic key distribution technology, and more particularly, to a technology for determining the presence of an eavesdropper on a quantum channel using a TDC (Time to Digital Converter).

[0002] Quantum cryptography is a branch of quantum information technology. Quantum cryptography is a digital information technology that leverages the principles of quantum physics and serves as a physical layer security technology for communications networks. Because its security is based on quantum mechanics, eavesdropping and wiretapping are impossible, ensuring absolute security. Quantum cryptography can be implemented using existing optical fiber infrastructure, making large-scale commercialization feasible.

[0003] Unlike asymmetric public-key cryptosystems like RSA, symmetric cryptosystems, which share a one-time random number table (a one-time pad) between the sender and receiver and use this as an encryption key, guarantee absolute security. Quantum cryptography technology, also known as "quantum key distribution (QKD)," securely distributes this one-time random number table between the sender (transmitting device) and receiver (receiving device) in real time based on the laws of quantum physics, such as the impossibility of quantum cloning.

[0004] Typically, quantum cryptography uses two communication channels: a quantum channel (secret channel) that transmits quantum states, and a classical channel (public channel) that is completely open to the outside world, including eavesdroppers. In other words, the quantum channel is the core of quantum cryptography and maintains complete secrecy based on the principle of quantum unclonability, whereas the classical channel is a communication channel that the sender (Alice) and receiver (Bob) use to publicly compare randomly selected bases or portions of generated cryptographic keys to detect eavesdroppers. It refers to existing digital optical transmission channels or wireless communication channels. In quantum cryptography, the classical channel is, in principle, considered a channel through which eavesdroppers can freely eavesdrop or monitor. The classical channel is necessary not only for the distribution of quantum cryptographic keys, such as for the sender (Alice) and receiver (Bob) to compare their bases, but also for the function of publicly authenticating each other. That is, in the absence of a classical channel, the encryption key can be leaked through a so-called impersonation attack, in which an eavesdropper impersonates the sender (Alice) or the receiver (Bob). Thus, classical or public channels are core elements of quantum cryptography and should be considered important when implementing a practical quantum cryptography system. However, since they utilize existing developed technologies, the quantum cryptography channel referred to in this specification refers to the quantum channel used for quantum state transmission.

[0005] There are two ways to physically implement quantum cryptography communication channels: using optical fiber (wired) and distributing encryption keys through the air (wireless). Optical fiber, the standard for conventional optical communications, maintains spatial modes very well using single-mode optical fiber. Furthermore, its transmission loss is very low, at approximately 0.2 dB / km in the 1550 nm band, making it suitable for implementing long-distance quantum cryptography channels.

[0006] Quantum cryptography encryption keys can be implemented using various methods, including coding using light polarization, phase coding, frequency coding, and continuous variable coding. Coding techniques utilizing light polarization or phase require additional technology to continuously compensate for fluctuations in polarization or optical paths caused by factors such as temperature and ambient conditions.

[0007] The BB84 protocol, a quantum cryptography protocol that uses two bases, X-basis and Y-basis, uses four quantum states that make up the two bases. For example, it uses the four polarization states of a single photon.

[0008] A common way to share a cryptographic key between a sender (Alice) and a receiver (Bob) and detect the presence of an eavesdropper (Eve) is as follows:

[0009] That is, in step 1, the sender (Alice) randomly selects either the X basis or the Y basis.

[0010] In the second step, the sender (Alice) randomly selects one of the two quantum states (cryptographic key values) of the selected basis, 0 or 1, and sends it to the receiver (Bob).

[0011] In step 3, the receiver (Bob) who receives the quantum state also randomly selects one of the two bases.

[0012] In step 4, the receiver (Bob) measures the received quantum state using the selected basis.

[0013] In step 5, after the receiver (Bob) completes his measurement, the sender (Alice) and the receiver (Bob) reveal to each other the basis they randomly chose. If the basis chosen by the sender (Alice) and the basis chosen by the receiver (Bob) are the same, the result measured by the receiver (Bob) matches the quantum state randomly chosen by the sender (Alice), and therefore, both users have the same encryption key (sifted key).

[0014] If an eavesdropper (Eve) attempts to eavesdrop in the middle, the basic principles of quantum mechanics will cause an error in the encryption key values ​​obtained by the two users (Alice and receiver (Bob)). The sender (Alice) and receiver (Bob) can reveal part of the generated key to each other and calculate the error rate to determine whether an eavesdropper (Eve) exists.

[0015] There are two main types of eavesdropping methods that an eavesdropper (Eve) can perform: an individual attack (incoherent attack) that attempts to access only one qubit at a time, and a joint attack (coherent attack) that accesses several qubits at once to obtain information.

[0016] An example of an individual attack is the intercept-resend attack. This method involves an eavesdropper (Eve) intercepting a qubit sent by a sender (Alice) to a receiver (Bob), performing a desired measurement, and then sending the qubit to Bob in a state favorable to her. The eavesdropper (Eve) can measure based on any of the two BB84 protocol bases, or she can measure based on a middle ground between the two.

[0017] Another example of an individual attack is the cloning attack (also known as a symmetric individual attack). This attack involves quantum cloning of the qubit being transmitted. While complete cloning is impossible under quantum mechanics (no cloning theorem), it is a form of attack that allows for the acquisition of some information about the cryptographic key.

[0018] These attack methods target perfect quantum cryptography devices and introduce errors into the encryption keys of the sender (Alice) and receiver (Bob), making them detectable to the user. In addition to these methods, there are also attacks that exploit vulnerabilities in devices used in quantum cryptography systems.

[0019] Conventional techniques rely on the error rate in generated cryptographic keys to detect eavesdroppers, making it impossible to detect eavesdroppers or attackers on quantum channels in real time. The present invention aims to provide a technology capable of precisely measuring the reception timing of transmitted qubits and detecting the presence of an attacker in real time based on the difference between the measured reception timing and the reference timing.

[0020] According to one aspect of the present invention, a receiving device of a quantum cryptographic key distribution system may be provided, including a detection device (260) configured to detect a quantum signal transmitted through a quantum channel and output a data signal (Sd) corresponding to the detected quantum signal; and a TDC (250) configured to measure a time difference between the time of occurrence of a first encoding pulse included in the data signal and the time of occurrence of a first reference pulse included in a predetermined reference timing signal, and if the measured time difference is outside a predetermined threshold range, determining that an eavesdropper is present in the quantum channel.

[0021] At this time, the reference timing signal (Srt) may be a pulse train signal synchronized with the quantum signal output by the transmitter (100).

[0022] At this time, the reference timing signal (Srt) may be a pulse train signal having the same period as the generation period of the quantum signal output by the transmitter (100).

[0023] At this time, the occurrence time difference may be the time difference between the rising edge of the first encoding pulse and the rising edge of the first reference pulse.

[0024] At this time, the first encoding pulse may be an encoding pulse that is closest to the first reference pulse on the time axis among the plurality of encoding pulses included in the data signal (Sd).

[0025] At this time, the TDC may include a first delay line part (20) into which an input pulse having a time difference as a width between the first occurrence time of the first reference pulse and the second occurrence time of the first encoding pulse is input; and an operation part (60) that determines the occurrence time difference using a thermometer code output by the first delay line part.

[0026] At this time, the TDC further includes a code conversion part (30) that converts and outputs the order of elements of the thermometer code, and the operation part is configured to determine the occurrence time difference using the conversion code output by the code conversion part, and the conversion code is a code that arranges the order of elements of the thermometer code according to a predetermined standard, and the predetermined standard may be a data path delay from the output node of the input pulse to the output nodes of each of the plurality of flip-flops (FF) included in the first delay line part.

[0027] At this time, the TDC is implemented by any one of a FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), and an IC (Integrated Circuit), and any one of the devices may be programmed to include the first delay line part and the operation part.

[0028] At this time, the TDC further includes a second delay line part into which the input pulse is input, and the code conversion part is configured to generate the conversion code by arranging and merging elements of the thermometer code output by the first delay line part and elements of the thermometer code output by the second delay line part according to a predetermined second criterion, and the predetermined second criterion may be a data path delay from an output node of the input pulse to output nodes of each of a plurality of flip-flops included in the first delay line part and the second delay line part.

[0029] At this time, the TDC is configured to use a clock signal (clk) having a shorter period than the generation period of the quantum signal output by the transmitting device, and the TDC may further include: an input signal generation part (10) that generates the input pulse having a width of a time difference between a rising edge generation time of the first reference pulse and a rising edge generation time of the first encoding pulse; a clock pulse count part (40) that counts the number of clock pulses of the clock signal generated during the maintenance period of the input pulse; and the operation part that determines a value of the generation time difference by using the first thermometer code (TC1) output by the code conversion part at the rising edge time of the first clock pulse among the generated clock pulses, the second thermometer code (TC2) output by the code conversion part at the rising edge time of a clock pulse generated immediately after the last clock pulse among the generated clock pulses, and the number of the counted clock pulses.

[0030] According to another aspect of the present invention, a receiving device of a quantum cryptographic key distribution system may be provided, comprising: a detection device (260) configured to detect a quantum signal transmitted through a quantum channel and output a data signal (Sd) corresponding to the detected quantum signal; and a TDC (250) configured to measure a time difference between the occurrence times of encoding pulses included in the data signal and the occurrence times of reference pulses included in a predetermined reference timing signal, and if a dispersion of the measured time differences is outside a predetermined threshold range, determining that an eavesdropper is present in the quantum channel.

[0031] At this time, the reference timing signal (Srt) may be a pulse train signal having the same period as the generation period of the quantum signal output by the transmitter (100).

[0032] At this time, the occurrence time of any first encoding pulse among the encoding pulses can be compared with the occurrence time of the first reference pulse that is closest to the first encoding pulse on the time axis among the plurality of reference pulses included in the data signal (Sd).

[0033] At this time, the TDC may include a first delay line part (20) into which an input pulse having a time difference as a width between the first occurrence time of the first reference pulse and the second occurrence time of the first encoding pulse is input; and an operation part (60) that determines the occurrence time difference using a thermometer code output by the first delay line part.

[0034] According to another aspect of the present invention, a receiving device of a quantum cryptographic key distribution system may be provided, including a sensing device that outputs a data signal corresponding to a quantum signal detected through a quantum channel, and a TDC that measures a time difference between a first occurrence time of a first reference pulse included in a reference timing signal and a second occurrence time of a first encoding pulse included in the data signal. At this time, the TDC includes a delay line part to which an input pulse having the time difference as a width is input; and a code conversion part that generates a conversion code by arranging elements of a thermometer code output by the delay line part according to a data path delay from an output node of the input pulse to each of output nodes of a plurality of flip-flops included in the delay line part. At this time, the receiving device is configured to determine the time difference using the generated conversion code, and determine that an eavesdropper is present in the quantum channel when the measured time difference falls outside a predetermined threshold range.

[0035] At this time, the TDC may further include an operation part configured to determine the time difference using the generated conversion code.

[0036] At this time, the TDC may further include a second delay line part to which the input pulse is input. And the code conversion part may be configured to generate the conversion code by arranging and merging elements of the thermometer code output by the delay line part and elements of the thermometer code output by the second delay line part according to a data path delay from an output node of the input pulse to each of the output nodes of a plurality of flip-flops included in the delay line part and the second delay line part.

[0037] At this time, the TDC may be configured to use a clock signal having a shorter period than the generation period of the quantum signal output by the transmitter. In addition, the TDC may further include an input signal generation part that generates the input pulse having a width of a time difference between the time of occurrence of a rising edge of the first reference pulse and the time of occurrence of a rising edge of the first encoding pulse; and a clock pulse count part that counts the number of clock pulses of the clock signal generated during the maintenance period of the input pulse. At this time, the calculation part may be configured to determine the value of the time difference by using the first thermometer code (TC1) output by the code conversion part at the time of the rising edge of the first clock pulse among the generated clock pulses, the second thermometer code (TC2) output by the code conversion part at the time of the rising edge of a clock pulse generated immediately after the last clock pulse among the generated clock pulses, and the number of the counted clock pulses.

[0038] According to another aspect of the present invention, a receiving device of a quantum cryptographic key distribution system may be provided, including a sensing device that outputs a data signal corresponding to a quantum signal detected through a quantum channel, and a TDC configured to measure time differences between first occurrence times of first reference pulses included in a reference timing signal and second occurrence times of first encoding pulses included in the data signal. In this case, the TDC includes a delay line part to which input pulses each having a width of the time difference are input; and a code conversion part configured to generate a conversion code by arranging elements of a thermometer code output by the delay line part according to a data path delay from an output node of the input pulse to each output node of a plurality of flip-flops included in the delay line part. In this case, the receiving device is configured to determine the time difference using the generated conversion code, and to determine that an eavesdropper is present in the quantum channel when a dispersion of the measured time differences exceeds a predetermined threshold range.

[0039] At this time, the TDC may further include a second delay line part into which the input pulse is input. And the code conversion part may be configured to generate the conversion code by arranging and merging elements of the thermometer code output by the delay line part and elements of the thermometer code output by the second delay line part according to a data path delay from an output node of the input pulse to each of the output nodes of the plurality of flip-flops included in the delay line part and the second delay line part.

[0040] According to the present invention, a technology can be provided that precisely measures the reception timing of a transmitted qubit and detects the presence of an attacker in real time based on the difference between the measured reception timing and the reference timing.

[0041] FIG. 1 illustrates an example configuration of a quantum key encryption distribution system provided according to one embodiment.

[0042] FIG. 2 illustrates an example configuration of a quantum key encryption distribution system provided according to one embodiment of the present invention.

[0043] FIG. 3 is a diagram for explaining the interaction of the TDC, the sensing device, and the receiving control unit presented in FIG. 2.

[0044] Figure 4 illustrates a situation in which an eavesdropper in a quantum channel of a quantum key cryptography distribution system intercepts a qubit sent from a sender to a receiver, performs a measurement of his choice, and then sends the receiver a qubit in a state favorable to him.

[0045] Figure 5 shows an example of a data signal generated by a detection device of a receiving device detecting quantum signals retransmitted by an eavesdropper.

[0046] FIG. 6 illustrates a concept in which a TDC of a receiver provided according to one embodiment of the present invention measures a time difference between pulses of a predetermined reference timing signal provided by a receiving control unit and pulses of a data signal output by a detection device.

[0047] Figure 7 illustrates a situation where the roles of the start signal and the end signal are switched in the configuration presented in Figure 6.

[0048] FIG. 8 is a flowchart illustrating a method for determining the presence of an eavesdropper in a quantum channel provided according to one embodiment of the present invention.

[0049] FIG. 9 is a flowchart illustrating a method for determining the presence of an eavesdropper in a quantum channel provided according to another embodiment of the present invention.

[0050] FIG. 10 is a block diagram of an FPGA that implements a TDC according to one embodiment of the present invention.

[0051] FIG. 11 is a drawing for explaining an input pulse input to a first delay line part of an FPGA according to one embodiment of the present invention.

[0052] Fig. 12 illustrates the configuration of a first delay line part according to one embodiment of the present invention.

[0053] Figure 13 is a drawing for explaining the indexes of the buffers of Figure 12.

[0054] Figure 14 shows a table for explaining data path delay.

[0055] FIG. 15a and FIG. 15b illustrate a parallel configuration of multiple delay line parts according to one embodiment of the present invention.

[0056] FIG. 16a illustrates the configuration of the first delay line part and the second delay line part of FIG. 15b, and FIG. 16b is for explaining the operation of the code conversion part when two delay line parts are used according to one embodiment of the present invention.

[0057] Figure 17 is a graph showing delay depending on whether a code conversion part is applied according to one embodiment of the present invention.

[0058] FIG. 18 is a drawing for explaining the arrangement criteria of flip-flop output values ​​and the increase value of the number of taps of FIG. 17 depending on whether a code conversion part is applied according to one embodiment of the present invention.

[0059] Hereinafter, embodiments of the present invention will be described with reference to the attached drawings. However, the present invention is not limited to the embodiments described herein and may be implemented in various other forms. The terminology used herein is intended to aid understanding of the embodiments and is not intended to limit the scope of the present invention. Furthermore, the singular forms used below also include the plural forms, unless the meanings clearly indicate the opposite.

[0060] FIG. 1 illustrates an example configuration of a quantum key encryption distribution system provided according to one embodiment.

[0061] A quantum key encryption distribution system (1001) may be configured to include a sender (Alice) (100), a receiver (Bob) (200), a quantum channel (300), and a public channel (400).

[0062] The transmitter (Alice) (100) may include a laser diode (LD) (110), an intensity modulator (IM) (140), an unbalanced Mach-Zehnder interferometer, a fiber-integrated beam-splitter (BS) (150), a phase modulator (PM) (180), a final polarizing BS (PBS) (190), a variable attenuator (VA) (160), a second beam splitter (175), and an optical power meter (OPM) (195).

[0063] The above laser diode (LD) (110) can emit, for example, a light pulse of 1550 nm at a frequency of 1 GHz.

[0064] The intensity modulator (IM) (140) and the unbalanced Mach-Zehnder interferometer transmit the emitted light pulse to the fiber optic integrated beam splitter (BS) (150).

[0065] One of the outputs of the beam splitter (BS) (150) reaches the final polarization BS (PBS) (190) through a first path passing through a phase modulator (PM) (180), and the other reaches the final polarization BS (PBS) (190) through a second path longer than the first path.

[0066] The variable attenuator (VA (160) sets the pulse intensity of the signal output by the final polarization BS (PBS) (190) to a desired level.

[0067] The optical power meter (OPM) (195) measures the total flux of the optical fiber observed through the second beam splitter (175) and adjusts the VA (160) in real time to keep it constant.

[0068] The receiver (200) includes a polarization control (PC) (250), a second interferometer, a receiving-side polarization BS (PBS) (290), a fiber-stretcher (FS) (233), a receiving-side phase modulator (PM) (280), a final BS (210), and a detection unit (DU) (260). The detection unit (DU) (260) may include a sensor that detects a single photon. The detection unit may be configured to receive an optical signal and output an electrical signal.

[0069] The signal output from the transmitter (Alice) (100) passes through the optical fiber spool (300), which is a quantum channel, and passes through the second interferometer and polarization control (PC) (250) having a configuration that matches that of the transmitter (Alice) (100).

[0070] In one arm, a fiber optic extender (FS) (233) is used to match the arm lengths between two distant interferometers to produce interference at the final BS (210).

[0071] The pulse output from the final BS (210) is ultimately measured by the detection device (DU). A portion of the photons that passed through the receiving phase modulator (280) and a portion of the photons that passed through the optical fiber extender (233) are input to the final BS (210). The final BS (210) has a first output port and a second output port. When the portions of the photons constructively interfere with each other, the photons can be output through the first output port, and when they destructively interfere with each other, the photons can be output through the second output port.

[0072] The detection device (260) has a first input port and a second input port. The first output port of the final BS (210) is connected to the first input port of the detection device (DU), and the second output port of the final BS (210) is connected to the second input port of the detection device (DU). A photon representing one qubit is input to only one of the first input port and the second input port of the detection device (260). The detection device (260) can determine that a bit of '1' is encoded when a photon is input through the first input port, and can determine that a bit of '0' is encoded when a photon is input through the second input port.

[0073] The detection device (260) can output a digital signal (Sd) representing a binary value decoded from the photon at the time the photon is detected. The digital signal (Sd) is provided to the receiving control unit (270).

[0074] The transmitter control unit (170) included in the transmitter (100) can perform a function of randomly selecting the basis and encoded binary information used to encode each qubit transmitted by the transmitter (100).

[0075] The receiving side control unit (270) included in the receiver (200) can perform a function of randomly selecting a basis used to decode each received qubit.

[0076] The transmitting control unit (170) and the receiving control unit (270) can exchange predetermined information through a public channel (400) via a communication unit (not shown). The predetermined information may include information regarding a series of bases used by the transmitting control unit (170) and the receiving control unit (270).

[0077] The above-mentioned transmitting control unit (170) and the receiving control unit (270) may be configured as a single device having a single package, or may be configured as a set of multiple devices. The set of multiple devices may include a high-speed FPGA, memory, and RAM.

[0078] A transmitter (100) and a receiver (200) can share information about the transmission period of a series of qubits. In addition, the receiver (200) can obtain information about the point in time or the time period at which the transmitter (100) begins transmitting a series of qubits, so that the receiver (200) can prepare to receive the transmitted qubits. In addition, the receiver (200) can synchronize the point in time at which a single photon reaches the receiver (200) and the point in time at which the receiver (200) detects the single photon. Specific configurations for the above-described technology are already well known in the art.

[0079] In one embodiment, the single photon detector may be configured to operate only when an enable signal input to the detector (260) is in a specific logic state (e.g., logical high). A predetermined reference timing signal (Srt) may be provided as the enable signal. The generation cycle of a series of pulses included in the reference timing signal (Srt) may be consistent with the generation cycle of qubits generated by the transmitter (100).

[0080] A public channel (400) is used as a communication channel for a sender (Alice) and a receiver (Bob) to publicly compare randomly selected bases or portions of generated encryption keys. The public channel (400) may be a conventional digital optical transmission channel or a wireless communication channel.

[0081] FIG. 2 illustrates an example configuration of a quantum key encryption distribution system provided according to one embodiment of the present invention.

[0082] The configuration of a quantum key cryptographic distribution system (1000) provided according to one embodiment of the present invention is identical to the configuration of a quantum key cryptographic distribution system (1001) presented in the comparative example presented in FIG. 1, except that it further includes a configuration for connecting a TDC (250) to a receiver (200) and other devices within the TDC (250). Hereinafter, descriptions of common contents with those of FIG. 1 will be omitted, and descriptions will be centered on parts that are different from those of FIG. 1.

[0083] FIG. 3 is a diagram for explaining the interaction of the TDC, the sensing device, and the receiving control unit presented in FIG. 2.

[0084] The TDC (250) can receive a data signal (Sd) output by the detection device (DU) (260). The data signal can also be provided to the receiving control unit (270).

[0085] The TDC (250) can receive the reference timing signal (Srt) prepared and provided by the receiving control unit (270). The reference timing signal (Srt) may be a pulse train signal having the same period as the generation period of the qubit generated by the transmitter (100) or a pulse train signal synchronized with the generation period of the qubit.

[0086] The TDC (250) can provide a timing error (Te) value, which is information that can determine whether the synchronization state between the data signal (Sd) and the reference timing signal (Srt) is continuously maintained, to the receiving control unit (270).

[0087] The TDC (250) can additionally use the clock signal (clk) provided by the receiving control unit (270) to generate the above timing error (Te). An example of the clock signal (clk) is illustrated in FIG. 11 described below.

[0088] The above data signal (Sd) and the above reference timing signal (Srt) are both signals having a pulse train form. If there is no eavesdropper (Eve) in the quantum channel (300), the pulses included in the data signal (Sd) are maintained in a state of synchronization with the pulses included in the corresponding reference timing signal (Srt). That is, for example, if the time difference between the rising edge of the first pulse included in the data signal (Sd) and the rising edge of the first pulse of the corresponding reference timing signal (Srt) is ΔT1, the time difference between the rising edge of any other second pulse included in the data signal (Sd) and the rising edge of the second pulse of the corresponding reference timing signal (Srt) also becomes ΔT1.

[0089] However, if an eavesdropper (Eve) exists in the quantum channel (300), the pulses included in the data signal (Sd) and the pulses included in the reference timing signal (Srt) may be out of synchronization (the specific reason for this will be described later in FIG. 4). That is, for example, if the time difference between the rising edge of the first pulse included in the data signal (Sd) and the rising edge of the first pulse of the corresponding reference timing signal (Srt) is ΔT1, the time difference between the rising edge of any other second pulse included in the data signal (Sd) and the rising edge of the second pulse of the corresponding reference timing signal (Srt) may be ΔT1, or may be ΔT2 or ΔT3, which are different from this.

[0090] Figure 4 illustrates a situation in which an eavesdropper in a quantum channel of a quantum key cryptography distribution system intercepts a qubit sent by a sender (Alice) to a receiver (Bob), performs a desired measurement, and then sends a qubit in a state favorable to the eavesdropper (Eve) to the receiver (Bob).

[0091] FIG. 4 illustrates five quantum signals (QI1 to QI5) transmitted by a transmitter (100) through a quantum channel (300).

[0092] An eavesdropper (700) can intrude into the quantum channel (300) and block the quantum signal transmitted by the transmitter (100) so that the quantum signal does not reach the receiver (200).

[0093] The eavesdropper (700) can measure the quantum signals transmitted by the transmitter (100) and retransmit the regenerated quantum signals to the receiver (200) according to the rules set by the eavesdropper (700). At this time, the regenerated quantum signals are regenerated based on the quantum signals measured by the eavesdropper (700), and the rules for regeneration may be set by the eavesdropper (700). That is, the eavesdropper (Eve) (700) can perform an attack (time shift attack) that determines the output by arbitrarily adjusting the delay of signal generation toward a higher efficiency side by utilizing the efficiency mismatch of the single photon detector (single photon detection unit).

[0094] In the example of FIG. 4, the eavesdropper (700) determines that the qubits represented by the quantum signals (QI1), (QI2), (QI3), (QI4), and (QI5) detected through the quantum channel (301) are 1, 1, 1, 0, and 0, respectively. The eavesdropper (700) can retransmit the determined qubits and the quantum signals (QI1' to QI5') regenerated according to the basis selected by the eavesdropper to the receiver (200).

[0095] The graph (@700) in the middle right of Figure 4 is a graph showing the timing at which the eavesdropper (700) detects a quantum signal input to the eavesdropper (700) through the quantum channel (301) in the form of a pulse.

[0096] Since the quantum signals (QI1 to QI5) transmitted by the transmitter (100) are generated at a constant generation interval T, the eavesdropper (700) detects the quantum signals at a constant time interval T. However, the eavesdropper (700) does not fix the generation interval of the quantum signals (QI1' to QI5') that it regenerates to T. That is, the generation interval of the quantum signals (QI1 to QI5) transmitted by the transmitter (100) may be a fixed value T, but the generation interval of the quantum signals (QI1' to QI5') retransmitted by the eavesdropper (700) may not be a fixed value. The variation in the generation interval of the quantum signals (QI1' to QI5') retransmitted by the eavesdropper (700) may be intentional by the eavesdropper (700). For example, the difference in the occurrence times of two consecutive quantum signals retransmitted by the eavesdropper (700) may be the above T, or may be T+2*ΔTad, T-2*ΔTad, or another value.

[0097] Here, ΔTa may be a very small value compared to the above T. Therefore, in order to detect a variation in the reception time interval of the quantum signals (QI1' to QI5') received by the receiver (200), the receiver (200) must use a very precise timing measurement device. In Fig. 4, the difference in the occurrence interval between the quantum signals (QI1' to QI5') retransmitted by the eavesdropper (700) is visually clearly shown, but this may be exaggerated for the convenience of explanation.

[0098] Even if ΔTad is a very small value compared to the above T, the state of the quantum signal determined when the detection device (260) of the receiver (200) measures a quantum signal at time t1 may be different from the state of the quantum signal determined when the signal is measured at time t1+ΔTad or t1-ΔTad.

[0099] In this way, the eavesdropper (700) can intervene in the quantum key encryption distribution system (1000) by intercepting quantum signals transmitted by the transmitter (100), adjusting the transmission interval of the quantum signals, and retransmitting the regenerated quantum signals to the receiver (200).

[0100] Figure 5 shows an example of a data signal generated by a detection device of a receiving device detecting quantum signals retransmitted by an eavesdropper.

[0101] The detection device (260) can output detection information at the time of receiving quantum signals (QI1' to QI5') retransmitted by the eavesdropper (700) through the quantum channel (302), and the detection information can be provided as a pulse of the data signal (Sd) output by the detection device (260). In the example presented in FIG. 5, since the time interval between the received quantum signals is not synchronized with a predetermined reference timing signal having a constant period (as exemplified in FIG. 6), the interval between the pulses of the data signal (Sd) is also not fixed to a value called T. That is, the time difference between the rising edge of any selected encoding pulse among the data signals (Sd) and the rising edge of the reference pulse of the reference timing signal corresponding to the selected encoding pulse is not fixed to a constant value for each pulse.

[0102] FIG. 6 illustrates a concept in which a TDC of a receiver provided according to one embodiment of the present invention measures a time difference between pulses of a predetermined reference timing signal provided by a receiving control unit and pulses of a data signal output by a detection device.

[0103] As described above, the receiving side control unit (270) of the receiver (200) can prepare a reference timing signal (Srt) consisting of pulses having a constant time interval and provide it to the TDC (250). In this specification, each pulse of the reference timing signal (Srt) is referred to as a reference pulse.

[0104] Additionally, the detection device (260) of the receiver (200) can provide the data signal (Sd) to the TDC (250). If an eavesdropper (700) exists in the quantum channel (200), the time intervals of the pulses included in the data signal (Sd) may not be constant, as shown in FIG. 5. In this specification, each pulse of the data signal (Sd) is referred to as an encoding pulse.

[0105] According to one embodiment of the present invention, a TDC (250) provided is configured to measure and output a difference value between the occurrence times of a start signal and an end signal input to the TDC (250). In one embodiment, the start signal may be each of the reference pulses, and the end signal may be each of the encoding pulses. To this end, as shown in FIG. 3, a reference timing signal (Srt) and a data signal (Sd) may be input to the TDC (250). There are a plurality of start signals in the reference timing signal (Srt), and there are a plurality of end signals in the data signal (Sd). Each pulse present in the reference timing signal (Srt) is each start signal, and each pulse present in the data signal (Sd) is each end signal.

[0106] In the reference timing signal (Srt), a reference pulse is generated at a certain reference time interval (T), but in the data signal (Sd), an encoding pulse may not exist for a time longer than twice the reference time interval (T). This is because, even if the transmitter (100) transmits a photon signal, some of the photon signals may not be output from the transmitter (100) due to realistic factors of the device of the transmitter (100), and there may be cases where the photon signal traveling in the quantum channel (300) is lost due to environmental influences. FIG. 6 shows an example in which all five photon signals continuously transmitted by the transmitter (100) were detected by the eavesdropper (700), and all photon signals retransmitted by the eavesdropper (700) were detected by the receiver (200).

[0107] The example presented in Figure 6 illustrates a case where all photons intended by the sender are transmitted and detected. This example is provided for convenience of explanation. In real environments, the measurement probability is very low due to quantum efficiency, and there is a high possibility of loss occurring during the photon generation and transmission process using a laser.

[0108] As shown in Fig. 6, the rising edge of the first reference pulse (Pr1) of the reference timing signal (Srt) lags behind the rising edge of the first encoding pulse (Pq1) of the data signal (Sd) by ΔTad. And the rising edge of the second reference pulse (Pr2) lags behind the rising edge of the second encoding pulse (Pq2) by ΔTad. And the rising edge of the third reference pulse (Pr3) lags behind the rising edge of the third encoding pulse (Pq3) by ΔTad. And the rising edge of the fourth reference pulse (Pr4) leads the rising edge of the fourth encoding pulse (Pq4) by ΔTad. And the rising edge of the fifth reference pulse (Pr5) leads the rising edge of the fifth encoding pulse (Pq5) by ΔTad.

[0109] That is, the occurrence times of the five encoding pulses presented in Fig. 6 are respectively +ΔTad, +ΔTad, +ΔTad, -ΔTad, and -ΔTad ahead of the occurrence times of the five corresponding reference pulses.

[0110] That is, when an eavesdropper (700) exists in a quantum channel (300), the values ​​of the time difference between the occurrence times of the encoding pulses included in the data signal (Sd) output by the detection device that detects the quantum signal and the occurrence times of the reference pulses included in a predetermined reference timing signal (Srt) have a non-zero variance.

[0111] In contrast, when there is no eavesdropper (700) in the quantum channel (300), it can be understood that the dispersion of values ​​regarding the time difference between the occurrence times of encoding pulses included in the data signal (Sd) output by the detection device that detects the quantum signal and the occurrence times of reference pulses included in a predetermined reference timing signal (Srt) is theoretically 0.

[0112] Figure 7 illustrates a situation where the roles of the start signal and the end signal are switched in the configuration presented in Figure 6.

[0113] In Fig. 7, the start signal is each encoding pulse, and the end signal is each reference pulse.

[0114] FIG. 8 is a flowchart illustrating a method for determining the presence of an eavesdropper in a quantum channel provided according to one embodiment of the present invention.

[0115] In step (S110), the TDC (250) of the receiver (200) can measure the time difference between the occurrence time of the first encoding pulse included in the data signal (Sd) output by the detection device (260) of the receiver (Bob) (200) and the occurrence time of the first reference pulse included in a predetermined reference timing signal (Srt).

[0116] The above reference timing signal (Srt) may be a pulse train having the same period as the generation period of the qubit generated by the transmitter (100) or a pulse train signal synchronized with the generation period of the qubit.

[0117] The above reference timing signal (Srt) may be a pulse train signal having the same period as the generation period of the quantum signal transmitted by the transmitter (100).

[0118] In one embodiment, the time difference may be the time difference between the rising edge of the first encoding pulse and the rising edge of the first reference pulse.

[0119] Here, the first encoding pulse may be an encoding pulse that is closest to the first reference pulse on the time axis among the plurality of encoding pulses included in the data signal (Sd).

[0120] Here, the first reference pulse may be a reference pulse that is closest to the first reference encoding pulse on the time axis among a plurality of reference pulses included in the reference timing signal (Srt).

[0121] In step (S120), the receiving side control unit (270) of the receiver (200) can determine that an eavesdropper exists in the quantum channel through which the quantum signal passes for quantum cryptography communication if the measured time difference is outside a predetermined threshold range.

[0122] FIG. 9 is a flowchart illustrating a method for determining the presence of an eavesdropper in a quantum channel provided according to another embodiment of the present invention.

[0123] In step (S210), the TDC (250) of the receiver (200) can measure the time differences between the occurrence times of encoding pulses included in the data signal (Sd) output by the detection device (260) of the receiver (Bob) (200) and the occurrence times of reference pulses included in a predetermined reference timing signal (Srt).

[0124] In step (S220), the receiving side control unit (270) of the receiver (200) can determine that there is an eavesdropper in the quantum channel through which the quantum signal passes for quantum cryptography communication if the dispersion of the measured time differences is outside a predetermined threshold range.

[0125] For example, in one embodiment, if the variance of the measured time differences is substantially 0, it can be determined that no eavesdropper exists, and if the variance is substantially greater than 0, it can be determined that an eavesdropper exists.

[0126] In another embodiment, if the variance of the measured time differences is less than δ, it may be determined that no eavesdropper exists, and if the variance is substantially greater than δ, it may be determined that an eavesdropper exists (provided that δ>0).

[0127] Hereinafter, the operating principle of the TDC (250) provided according to one embodiment of the present invention will be described in detail. The TDC (250) is implemented as an FPGA (1). Alternatively, in another embodiment, the TDC (250) may be implemented as an IC or ASIC.

[0128] FIG. 10 is a block diagram of an FPGA that implements a TDC according to one embodiment of the present invention.

[0129] In the case where the receiving side control unit (270) shown in Fig. 2 is an FPGA, the FPGA (1) implementing the TDC (250) may be the receiving side control unit (270).

[0130] In contrast, if the receiving side control unit (270) shown in FIG. 2 is not an FPGA, the TDC (250) may be implemented as an FPGA provided separately from the receiving side control unit (270).

[0131] The above TDC (250) can be implemented not with a high-speed FPGA operating at a clock of, for example, 10 GHz, but with a relatively low-speed FPGA operating at a clock of, for example, 100 to 300 MHz.

[0132] FIG. 11 is a drawing for explaining an input pulse input to a first delay line part of an FPGA according to one embodiment of the present invention.

[0133] Hereinafter, the description will be made with reference to FIGS. 10 and 11.

[0134] FPGA (1) may include an input signal generation part (10), a first delay line part (20), a code conversion part (30), a clock pulse counter part (40), a priority encoder part (50), and an operation part (60).

[0135] Specifically, the configurations of the FPGA (1) described above may be configurations of a TDC (Time to Digital converter).

[0136] As shown in FIGS. 10 and 11, the input signal generation part (10) can generate an input pulse (P1) having a width equal to the time difference (T) between the rising edge (E1) of a given start signal (S1) and the rising edge (E2) of a given end signal (S2). The input signal generation part (10) can be composed of logic gates necessary for the above generation.

[0137] The first delay line part (20) can receive an input pulse (P1) having a width equal to the time difference (T) between the occurrence of a start signal (S1) and an end signal (S2). In addition, the first delay line part (20) can output a thermometer code (O1). At this time, the thermometer code is a value of, for example, 8 bits, composed of output values ​​of flip-flops included in the first delay line part (20), and the output value of each flip-flop can be referred to as an element of the thermometer code.

[0138] Fig. 12 illustrates the configuration of a first delay line part according to one embodiment of the present invention.

[0139] Figure 13 is a drawing for explaining the indexes of the buffers of Figure 12.

[0140] The first delay line part (20) may include a delay line (D_L) including a plurality of buffers (delay elements, delay components) (B) and D-flip-flops (FF) tapped to the output terminals of each buffer (B) of the delay line.

[0141] Multiple buffers can be connected in a cascade delay manner. That is, multiple buffers can be arranged in the order in which the input pulses (P1) flow.

[0142] The waveform (Signal) of the input pulse (P1) of Fig. 12 can be output with a predetermined delay from the output terminal of each buffer (B). That is, the output value of the first buffer (B1) is output with a predetermined delay from the output terminal of the first buffer (B1), and the output terminal of the first buffer (B1) is connected to the input terminal of the second buffer (B2). The output value (e.g., '1') of the first buffer (B1) can also be input to the first flip-flop (FF1).

[0143] At this time, a data path delay may occur between each buffer (B) and through the flip-flop (FF). For example, a delay of d1 may occur until the input value ('1') of the first buffer (B1) is transmitted to the second buffer (B2), and a delay of d11 may occur until the output value ('1') of the first buffer (B1) is transmitted to the first flip-flop (FF1). Similarly, a delay may occur whenever data is transmitted from the previous buffer to the next buffer, and a delay may occur whenever data is transmitted from any buffer to a flip-flop connected to any buffer.

[0144] FIG. 13 is a diagram for explaining the index of a buffer according to one embodiment of the present invention.

[0145] Each field in the table in Figure 13 represents the buffer name, index, and output value of the buffer.

[0146] Each buffer may be assigned an index that defines the order of each buffer. For example, the first buffer (B1) may be assigned an index of '1', the second buffer (B2) may be assigned an index of '2', and similarly, the eighth buffer (B8) may be assigned an index of '8'. In this way, when each buffer (B) is arranged according to the order in which the input pulse (P1) flows and the indexes are arranged according to that order, for example, 1000 buffers may each be assigned an index of 1 to 1000.

[0147] Figure 14 shows a table for explaining data path delay.

[0148] Referring to FIGS. 10 and 14, the code conversion part (30) can convert and output the order of elements (e.g., 1, 2, 3, 4, 5, 6, 7, 8) of the thermometer code (O1) (e.g., 11100000) output from the first delay line part (20). At this time, the code (e.g., 11010000) (the order of the indexes of the corresponding buffer is 1, 2, 4, 5, 3, 6, 7, 8) output by the code conversion part (30) can be referred to as a 'conversion code (CO1)'.

[0149] The conversion code (CO1) output by the code conversion part (30) may be a sequence of elements of the thermometer code (O1) arranged according to a predetermined standard. In this case, the predetermined standard may be the data path delay from the output node (N1) of the input pulse (P1) to the output nodes (N2) of each of the plurality of flip-flops (FF) included in the first delay line part (20). This will be described in detail with reference to Fig. 14.

[0150] Each field in the table may represent a buffer index number, a first delay value, a second delay value, and a sum (rank). The rank may represent a ranking of all sums. The buffer with the smallest sum may have the first rank, while the buffer with the highest sum may have the last rank. Alternatively, the reverse may be true in other embodiments.

[0151] As described above in Fig. 12, the above sum value may mean the time taken for data to be transmitted from the node (N1) where the input pulse (P1) is output to an arbitrary flip-flop (e.g., FF4).

[0152] A first delay, which is the time it takes for an input value of an arbitrary buffer to be transmitted to another buffer connected to the arbitrary buffer, and a second delay, which is the time it takes for an output value of the arbitrary buffer to be transmitted to an input of a flip-flop connected to the arbitrary buffer, may occur.

[0153] At this time, the value obtained by adding the value of the first delay and the value of the second delay for each buffer can be referred to as the data path delay.

[0154] Referring to FIGS. 12 and 14 together, when the indexes of each buffer are listed in order, the order of the sum of the first delay value and the second delay value may be different from the order of the index numbers of each buffer. For example, in the case of the third buffer, since the buffer array order is 3rd, the index number may be '3', but the order of the sum value may be '5'. Looking at it in detail, in order for data to be transmitted to the third flip-flop (FF3), it passes through the first buffer (B1), the second buffer, and the third buffer. At this time, a predetermined delay (d1, d2, d3) occurs each time it passes through the first buffer (B1), the second buffer (B2), and the third buffer (B3), and a delay (d13) may also occur until the data output from the third buffer (B3) is output as the output value of the third flip-flop (FF3). That is, the delay until data is transmitted from the output node (N1) of the input pulse (P1) to the output node (N2, N23) of the third flip-flop (FF3) may be the sum of d1, d2, d3, and d13.

[0155] In this way, the delay (i.e., the sum value) until data is transmitted to the output node of each flip-flop (FF3) can be calculated.

[0156] For example, in this embodiment, the buffer index for the third flip-flop (FF3) is 3 and the buffer index for the fourth flip-flop (FF4) is 4. That is, the fourth flip-flop (FF3) must pass through one more buffer than the third flip-flop (FF4), but despite this, the sum of the delays to the output node of the third flip-flop with a buffer index of 3 may be greater.

[0157] The code conversion part (30) can convert the order of elements of the thermometer code (O1) based on the calculated delay (sum value) (e.g., from the smallest sum value).

[0158] The conversion code (CO1) output by the code conversion part (30) can be provided to the priority encoder part (50).

[0159] The priority encoder part (50) can digitize a long thermometer code. For example, the priority encoder part (50) can convert a 5200-bit thermometer code into a 13-bit thermometer code. For example, if the number of buffers (delay elements) (B) described above in FIG. 12 and the number of flip-flops (FFs) connected to the buffers are 5200, 5200 consecutive binary number sequences are output, which can be expressed as 13-bit binary numbers.

[0160] That is, the priority encoder part (50) can express the first thermometer code (TC1) of 5200 bits and the second thermometer code (TC2) as a 13-bit binary number as the time-dependent output value (CO1) of the code conversion part (30).

[0161] Referring to Fig. 11, the first thermometer code (TC1) may be a code output by the code conversion part (30) in relation to the rising edge of the input pulse (P1) at the time of the rising edge (E4) of the clock pulse (CK2) that first occurs after the rising edge (E1) of the input pulse (P1) among the generated clock pulses (CK). The first thermometer code (TC1) expressed in 13 bits may be provided as an input to the operation part (60).

[0162] And the second thermometer code (TC2) may be a code output by the code conversion part (30) in relation to the falling edge (E2) of the input pulse (P1) at the time of the rising edge (E6) of the clock pulse (CK4) that first occurs after the falling edge (E2) of the input pulse (P1) among the generated clock pulses (CK). The second thermometer code (TC2) expressed in 13 bits may be provided as an input to the operation part (60).

[0163] At this time, the time period of the first thermometer code (TC1) and the time period of the second thermometer code (TC2) may be smaller than the period of the clock pulse (CK).

[0164] Referring again to FIGS. 10 and 11, the clock pulse counter part (40) can receive an input pulse (P1) from the input signal generation part (10).

[0165] The clock pulse counter part (40) can count the number of clock pulses (CK) generated during the maintenance period (T) of the input pulse (P1). For example, in Fig. 11, since there are two rising edges of the clock pulses generated during the period when the input pulse (P1) is in the ON state, such as edges (E4, E5), the counted value can be two.

[0166] The output value (Coarse count) of the clock pulse counter part (40), i.e. the counted value, can be provided to the operation part (60).

[0167] Referring to FIGS. 10 and 11, the operation part (60) can determine the value of the occurrence time difference using the first thermometer code (TC1), the second thermometer code (TC2), and the number of counted clock pulses. For example, the occurrence time difference can be 2*Period+TC1-TC2.

[0168] FIG. 15a and FIG. 15b illustrate a parallel configuration of multiple delay line parts according to one embodiment of the present invention.

[0169] As shown in Fig. 15a, two or more delay line parts (20) may be connected in parallel. At this time, the input pulse (P1) output from the input signal generation part (10) may be input to the first delay line part (21), the second delay line part (22), the third delay line part (23), and the fourth delay line part (24), respectively. In addition, the first thermometer code (O1), the second thermometer code (O2), the third thermometer code (O3), and the fourth thermometer code (O4) output from the first delay line part (21), the second delay line part (22), the third delay line part (23), and the fourth delay line part (24) may be input to the code conversion part (30).

[0170] In another embodiment, as shown in Fig. 15b, it can be assumed that two delay line parts (20) are connected in parallel.

[0171] For example, an input pulse (P1) output from an input signal generating part (10) can be provided along a first path (path1) in which the output terminal of the input signal generating part (10) and the input terminal of the first delay line part (21) are connected to each other, and a second path (path2) in which the output terminal of the input signal generating part (10) and the input terminal of the second delay line part (22) are connected to each other.

[0172] At this time, the time at which the input pulse (P1) output from the input signal generation part (10) reaches the input terminal of the first delay line part (21) and the input terminal of the second delay line part (22) may be different. This is because there is an input delay due to the difference in length between the first path (path1) and the second path (path). In the embodiment of Fig. 15a, since the length of the first path (path1) is shorter than the length of the second path (path2), it can be seen that the input time interval of the input pulse (path1) through the first path (path1) is shorter than the input time interval of the input pulse (path2) through the second path (path2).

[0173] FIG. 16a illustrates the configuration of the first delay line part and the second delay line part of FIG. 15b, and FIG. 16b is for explaining the operation of the code conversion part when two delay line parts are used according to one embodiment of the present invention.

[0174] For convenience of explanation in Fig. 16a, each delay line part is illustrated as containing four buffers and four flip-flops.

[0175] In Fig. 16b, each field of the table may represent a delay line part number, a buffer index number, a first delay value, a second delay value, a first sum value (first priority), and a first sum value (overall ranking). At this time, the first priority may represent a rank for each sum value for the buffer index of the buffers in each delay line part. And the overall ranking may represent a rank for each sum value for the buffer index of all buffers in the first delay line part and the second delay line part. At this time, the first priority and the overall ranking may be such that the buffer with the smallest sum value may have the first rank and the buffer with the highest sum value may have the last rank. Or, in another embodiment, the opposite may be possible. The method for obtaining the sum value may be the same as described in Fig. 10.

[0176] The code conversion part (30) may be configured to generate one conversion code by merging the elements of the first set (e.g., {(D1, 1), (D2, 2), (D3, 3), (D4, 4)}) in which the sum of the elements of the thermometer code output by the first delay line part (21) and the buffer index pairs are listed in descending order of sum values, and the elements of the second set (e.g., {(D5, 5), (D6, 6), (D7, 7), (D8, 8)}) in which the sum of the elements of the thermometer code output by the second delay line part (22) and the index pairs are listed in descending order of sum values.

[0177] That is, each element of the first set and each element of the second set can be sorted in order of lowest sum value.

[0178] For example, in the first delay line part (21), the output values ​​based on the buffer index may be {1, 2, 3, 4}, and in the second delay line part (22), the output values ​​based on the buffer index may be {5, 6, 7, 8}. In addition, in the embodiments of FIGS. 15b and 16a, the delay (d1) may be smaller than the delay (d5). Therefore, the sorted order may be (D1, 1), (D2, 2), (D5, 5), (D3, 3), (D6, 6), (D4, 4), (D7, 7), (D8, 8). The output values ​​of the flip-flops for each buffer index may be sorted in the sorted order. For example, the sorted values ​​(buffer indices) can be 0(1), 0(2), 1(4), 1(6), 1(3), 1(5), 0(7), 0(8).

[0179] As described above, when multiple delay line parts (20) are used, slightly different input delays may be achieved depending on the arrangement. Figure 17, described below, shows the delays according to the arrangement when multiple delay line parts are used.

[0180] Fig. 17 is a graph showing delay depending on whether a code conversion part is applied according to one embodiment of the present invention.

[0181] FIG. 18 is a drawing for explaining the arrangement criteria of flip-flop output values ​​and the increase value of the number of taps of FIG. 17 depending on whether a code conversion part is applied according to one embodiment of the present invention.

[0182] Figure 17 (a) shows a delay graph according to the number of taps in a state where the code conversion part (30) is not applied, and Figure 17 (b) shows a delay graph according to the number of taps in a state where the code conversion part (30) is applied.

[0183] The fields in the table of Figure 18 include the arrangement order of the flip-flop output values ​​before and after sorting, and the arrangement order of the total delay sum value.

[0184] Hereinafter, the description will be made with reference to FIGS. 17 and 18.

[0185] The horizontal axis of graphs (g1, g2) represents the number of taps. Referring to Fig. 16b, one tap may mean a pair of buffers (delay elements) (e.g., B1) and flip-flops (FF1) connected thereto. For example, if the total number of buffers and pairs of flip-flops connected thereto is 1000, the total number of taps may be 1000.

[0186] The vertical axis of graphs (g1, g2) represents the delay time (ns). The delay time may refer to the sum of the delays required for data to be transmitted to the output nodes of the flip-flops tapped in each buffer described above in Fig. 14.

[0187] Referring to FIGS. 16a to 18 together, an increase in the number of taps in the graph (g1) may mean, for example, an increase in the buffer index. For example, if the number of taps on the horizontal axis of the graph (g1) is 4, it may mean a buffer index of 4. At this time, the delay value on the vertical axis of the graph (g1) may be D4 (= d1 + d2 + d3 + d4 + d14) as in FIG. 16b. For example, if the number of taps is 5, it may mean a buffer index of 5. At this time, the delay value on the vertical axis of the graph (g1) may be D5 (= d5 + d15) as in FIG. 16b. At this time, referring to FIG. 18, D4 > D5. Here, it can be seen that the delay observed in the flip-flop of each tap does not increase as the index of the tap (e.g., index 4 -> index 5) increases, but sometimes decreases locally even when the index of the tap increases.

[0188] On the other hand, an increase in the number of taps in the graph (g2) may not mean an increase in the buffer index, but may mean an increase in the position according to the sorting order in which the output values ​​of each flip-flop are sorted by the code conversion part (30). For example, if the number of taps on the horizontal axis of the graph (g2) is 4, the position order of the sorted buffer index may be 1, 2, 5, 3, which may mean buffer index 3. In this case, the delay value on the vertical axis of the graph (g2) may be D3 (= d1 + d2 + d3 + d13). For example, if the number of taps is 5, the position order of the sorted buffer index may be 1, 2, 5, 3, 6, which may mean buffer index 6. In this case, the delay value may be D6 (= d5 + d6 + d16). At this time, referring to FIG. 18, D3 <D6 일 수 있다.

[0189] That is, as shown in (a) of Fig. 17, when the code conversion part (30) of the present invention is not applied, it can be seen that the graph (g1) for the delay according to the increase in the number of taps does not have a monotonically increasing property. On the other hand, as shown in (b) of Fig. 17, when the code conversion part (30) of the present invention is applied, it can be seen that the graph (g2) for the delay according to the increase in the number of taps shows an increasing phenomenon without a decreasing phenomenon.

[0190] For example, unlike ASICs, which are application-specific integrated circuits (ASICs), FPGAs can be directly designed through programming, allowing the chip's functionality to be changed based on programming. Therefore, unlike ASICs, the functionality of each component within an FPGA can vary (or depend on the configuration). Therefore, as the number of taps increases, delay may not always increase but instead decrease, preventing a phenomenon of constant increase without decreasing.

[0191] However, as explained, it can be confirmed through the graph (g2) that the code conversion part (30) can compensate for the monotonically increasing nature of the first delay line part (20).

[0192] As described above, when multiple delay line parts (20) are used, delay alignment can be provided through the code conversion part. As a result, errors due to jitter can be compensated for and a TDC with high temporal resolution can be provided. For example, when four delay line parts are configured in parallel to have a total of 9,600 taps, a TDC with a resolution of 0.8 ps per tap can be provided.

[0193] By utilizing the embodiments of the present invention described above, those skilled in the art will be able to easily implement various changes and modifications without departing from the essential characteristics of the present invention. The content of each claim may be combined with other claims that are not in a citation relationship within the scope of this specification, as long as it is understood.

Claims

1. A detection device that outputs a data signal corresponding to a quantum signal detected through a quantum channel, and a TDC that is configured to measure the time difference between the first occurrence time of a first reference pulse included in a reference timing signal and the second occurrence time of a first encoding pulse included in the data signal, The above TDC is, A delay line part into which an input pulse having the above time difference is input; and A code conversion part configured to generate a conversion code by arranging elements of a thermometer code output by the delay line part according to a data path delay from the output node of the input pulse to the output nodes of each of a plurality of flip-flops included in the delay line part; Includes, The time difference is determined using the above-generated conversion code, If the measured time difference exceeds a predetermined threshold range, it is determined that there is an eavesdropper in the quantum channel. A receiving device in a quantum cryptographic key distribution system.

2. A receiving device of a quantum cryptographic key distribution system, wherein the reference timing signal in the first paragraph is a pulse train signal synchronized with a quantum signal output by a transmitting device.

3. A receiving device of a quantum cryptographic key distribution system, wherein the reference timing signal in the first paragraph is a pulse train signal having a period identical to the generation period of a quantum signal output by the transmitting device.

4. A receiving device of a quantum cryptographic key distribution system, wherein the time difference in the first paragraph is a time difference between the rising edge of the first encoding pulse and the rising edge of the first reference pulse.

5. A receiving device of a quantum cryptographic key distribution system, wherein the first encoding pulse is an encoding pulse that is closest in time to the first reference pulse among a plurality of encoding pulses included in the data signal.

6. A receiving device of a quantum cryptographic key distribution system, wherein in the first paragraph, the TDC further includes an operation part configured to determine the time difference using the generated conversion code.

7. In paragraph 1, The above TDC further includes a second delay line part into which the input pulse is input, The above code conversion part is configured to generate the conversion code by merging elements of the thermometer code output by the delay line part and elements of the thermometer code output by the second delay line part, aligned according to the data path delay from the output node of the input pulse to the output nodes of each of the plurality of flip-flops included in the delay line part and the second delay line part. A receiving device in a quantum cryptographic key distribution system.

8. In the 6th paragraph, the TDC is implemented by any one of a device selected from the group consisting of a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), and an Integrated Circuit (IC), and the receiving device of a quantum cryptographic key distribution system is programmed to include the delay line part and the operation part.

9. In paragraph 8, The above TDC is configured to use a clock signal having a shorter period than the generation period of the quantum signal output by the transmitter, The above TDC is, An input signal generating part that generates the input pulse having a width equal to the time difference between the occurrence time of the rising edge of the first reference pulse and the occurrence time of the rising edge of the first encoding pulse; and A clock pulse counter part that counts the number of clock pulses of the clock signal that occur during the maintenance period of the input pulse; Including more, The above operation part is configured to determine the value of the time difference by using the first thermometer code (TC1) output by the code conversion part at the time of the rising edge of the first clock pulse among the generated clock pulses, the second thermometer code (TC2) output by the code conversion part at the time of the rising edge of the clock pulse generated immediately after the last clock pulse among the generated clock pulses, and the number of the counted clock pulses. A receiving device in a quantum cryptographic key distribution system.

10. A detection device that outputs a data signal corresponding to a quantum signal detected through a quantum channel, and a TDC that is configured to measure time differences between first occurrence times of first reference pulses included in a reference timing signal and second occurrence times of first encoding pulses included in the data signal, The above TDC is, A delay line part into which input pulses having the above time difference width are input; and A code conversion part configured to generate a conversion code by arranging elements of a thermometer code output by the delay line part according to a data path delay from the output node of the input pulse to the output nodes of each of a plurality of flip-flops included in the delay line part; Includes, The time difference is determined using the above-generated conversion code, If the dispersion of the measured time differences exceeds a predetermined threshold range, it is determined that there is an eavesdropper in the quantum channel. A receiving device in a quantum cryptographic key distribution system.

11. A receiving device of a quantum cryptographic key distribution system, wherein the reference timing signal is a pulse train signal having a period identical to the generation period of a quantum signal output by the transmitting device.

12. In paragraph 10, The occurrence time of any encoding pulse selected from the first encoding pulses is characterized in that it is compared with the occurrence time of a reference pulse that is closest to the selected encoding pulse from the first reference pulses on the time axis. A receiving device in a quantum cryptographic key distribution system.

13. In paragraph 12, The above TDC further includes a second delay line part into which the input pulse is input, The above code conversion part is configured to generate the conversion code by merging elements of the thermometer code output by the delay line part and elements of the thermometer code output by the second delay line part, aligned according to the data path delay from the output node of the input pulse to the output nodes of each of the plurality of flip-flops included in the delay line part and the second delay line part. A receiving device in a quantum cryptographic key distribution system.

Images