Article
 WeiShao Huang, Wei Zhang, YiDong Huang
 Elimination of Spatial SideChannel Information for Compact Quantum Key Distribution Senders
 Journal of Electronic Science and Technology, 2019, 17(3): 195203
 http://dx.doi.org/10.11989/JEST.1674862X.90416014

Article History
 Manuscript received April. 15, 2019
 revised May. 31, 2019
W. Zhang and Y.D. Huang are with the Beijing National Research Center for Information Science and Technology, the Beijing Innovation Center for Future Chips, and also the Department of Electronic Engineering, Tsinghua University, Beijing 100084; with Frontier Science Center for Quantum Information, Beijing 100084; also with Beijing Academy of Quantum Information Sciences, Beijing 100193 (email: zwei@tsinghua.edu.cn; yidonghuang@tsinghua.edu.cn)
Quantum key distribution (QKD) is an technique for generating and sharing secret keys between two parties^{[1],[2]}, which is important in future security communications networks. Many efforts have been made to push QKD to real applications since the first QKD protocol (BB84^{[3]}) was proposed thirty years ago. On one hand, the transmission distance of QKD is extending continuously by new developments on QKD protocols and techniques^{[4][9]}. Using free space as quantum channels, the experimental demonstration of satellitetoground QKD has been realized, supporting a transmission distance over 1000 km^{[10]}. The transmission distance of fiber based QKD has been over 400 km^{[11],[12]} and several companies have provided commercial fiber based QKD equipment. On the other hand, shortdistance free space QKD also attracts much attention, but is still under laboratory research^{[13]}. One of difficulties on shortdistance free space QKD is the portability and mobility of QKD senders and receivers. Since single photon detectors are still difficult to be miniaturized based on current technologies, the efforts on this direction are focused on how to reduce the size of the QKD sender, which emits photons with different quantum states. In 2006, Duligall et al.^{[14]} proposed and realized a miniature QKD sender for the polarizationencoding BB84 protocol. Four commercial light emitting diodes (LEDs) were used as the light sources for photons with different polarizations, which were combined by a diffraction grating component. However, based on discrete optical components, its size was quite large for portable equipment. In 2015, Vest et al.^{[15]} proposed another scheme of a miniature QKD sender. They used vertical cavity surface emitting lasers (VCSELs) as the light sources and combined the photons by a photonic integrated chip, which has a length of 2.5 cm. Recently, a hand hold QKD sender based on resonantcavity light emitting diodes (RCLEDs) and miniature discrete optical components was reported, which supported the autoalignment function for shortdistance free space applications^{[16]}. However, its length was over 5 cm including the alignment system. In these works, photons with different quantum states (usually encoding on polarization) are generated by different light sources. Without spatial filtering, the photons with different quantum states may have different spatial distributions. An eavesdropper (usually named as Eve) may estimate the state of a photon by the spatial location at which it is detected. Hence, the QKD security requires that photons with different states should be spatially indistinguishable. It is why the way to combine these photons is important and a spatial filter is required in the compact QKD sender to guarantee the QKD security. In [16], an aperture was introduced to reduce the spatial sidechannel information introduced by the imperfect photon combination, however, its effect on the QKD security lacks of quantitative analysis.
In this paper, we analyze the mutual information between the actual keys encoded at this QKD sender and the inferred keys at Eve, demonstrating the effect of the aperture to eliminate the spatial sidechannel information leakage quantitatively. It shows that Eve’s potential on eavesdropping spatial sidechannel information is totally dependent on the optical design of the QKD sender, including the source arrangement and the aperture. We proposed a compact QKD sender scheme based on an LED array fabricated on the same chip according to this theoretical analysis. Calculation results show that its height can be controlled under several millimeters with a proper design of the aperture.
2. Spatial SideChannel Information Leakage in a Compact QKD SenderConsider a freespace QKD sender for the BB84 protocol with polarization encoding. It has four light sources emitting photons with four different polarizations. The four sources are integrated in a substrate similar to [15] and the plane of their surfaces is defined as the source plane. The sketch of the light (photon) distribution on the source plane is shown in Fig. 1 (a). Regions represent light distributions with different polarizations, which are indicated by the arrows in them. The photons emitted from the source plane should be attenuated to the single photon level and filtered to make them indistinguishable in their frequencies, then output from the QKD sender through a collimator. For simplicity, in this work the four regions are presumed to be four incoherent surfacesources on the source plane, neglecting the phase relationship among photons emitted from different positions.
As shown in Fig. 1 (a), in the QKD sender, photons with different polarizations have different spatial distributions in the source plane. Hence, Eve could expect that she could get the information of photons’ polarization encoding by measuring their spatial distribution. Therefore, she could take a sidechannel attack on the polarization encoding QKD system. To measure the spatial distribution of photons, firstly Eve should image the photons’ distribution in the source plane to an image plane in her eavesdropping apparatus. Then, she should measure the positions of imaged photons by a single photon detector array which is placed in the image plane. The measurement could be treated as an imaging system shown in Fig. 1 (b). The leftmost plane represents the source plane in the QKD sender. The four circles in the source plane denote the four regions of photons with different polarizations. The middle box is an equivalent diffractionlimited imaging system for the imaging process, which includes the optical path between the source plane in the QKD sender and the image plane in Eve’s apparatus. The gray circle on the right surface of the box is the exit pupil of the diffractionlimited imaging system whereas the entrance pupil is not explicitly shown. The rightmost plane represents the image plane where Eve places her detector array. The four larger circles in the image plane represent the images, i.e. the spatial distribution, of photons with different polarizations. Without loss of generality, in the following analysis we consider an ideal eavesdropping condition, in which the magnification of the diffractionlimited image system is 1 and the spatial resolution of the detector array is extremely high. In each pixel of the array, the efficiency of single photon detection is 1 and the dark count is 0. Under this assumption, it can be seen that the imaged distributions of photons with different polarizations on the image plane have little overlap in the case shown in Fig. 1 (b), and hence, Eve can infer the polarization of a detected photon from its position with high likelihood.
An effective way to reduce the successful rate of this sidechannel attack is introducing an aperture after the source plane in the QKD sender, which is shown in Fig. 1 (c). The intention of the aperture is to reduce the entrance pupil of the equivalent diffractionlimited imaging system. As a result, the spatial distributions of photons with different polarizations in the image plane would be diffused according to diffraction and overlap with each other. It reduces the possibility for Eve to infer a photon’s polarization correctly according to its position. Theoretically, for the incoherent surfacesources in the source plane, when a photon is emitted from a point at
$ P\!\left( {(x,y)({x_0},{y_0})} \right) = \frac{1}{{{\text{π}} {r^2}}}{\left[ {{J_1}\left( {\frac{{{\text{π}} Dr}}{{{\text{λ}} h}}} \right)} \right]^2}$  (1) 
where J_{1}(x) denotes the firstorder Bessel function and
${\rm{R\;\!\!e\;\!s\;\!o\;\,\!\!lution}} = \frac{{1.22{\text{λ}} h}}{D}$  (2) 
which is equal to the radius of the first dark fringe of the Airy pattern in the image plane. Hence, it can be expected that a small aperture is desired to eliminate this spatial sidechannel information. However, the spatial sidechannel information leakage should be quantitatively analyzed from the view of QKD security analysis based on the information theory, which may provide a clear direction to design the QKD sender with the aperture.
3. Theoretical Analysis of Mutual Information between QKD Sender and EveMutual information can be used to quantitatively measure the percentage of information transmission between two parties when they choose specific ensembles to encode or decode the information, respectively^{[18],[19]}. Fig. 2 shows the information transmission process when Eve takes the eavesdropping by the spatial sidechannel information leakage. Four symbol sequences are used to carry the information in the process. The transformation between them could be modeled by three memoryless channels between the QKD sender and Eve. In the QKD sender, the symbol sequence (A) is the random bits that form the secret key, and the symbol sequence (B) is formed by the labels for the regions that emit photons with specific polarizations (defined in Fig. 1 (a)). These two sequences are formed by ensembles
According to the BB84 protocol, a channel (E) can be treated as a noiseless channel and the related possibilities can be presumed to be
$P\left( {{b_1}{b_1} \in {B_1}} \right) = 0.5,$ 
$P\left( {ss \in S} \right) = 0.25,$ 
$P\left( {s = i{b_1} = 0,i \in \left\{ {1,2} \right\}} \right) = 0.5,$ 
$P\left( {s = j{b_1} = 1,j \in \left\{ {3,4} \right\}} \right) = 0.5.$ 
Here,
The channel (F) describes the behavior of photons travelling from the source plane in the QKD sender to the image plane in Eve’s apparatus, which is shown in Fig. 1. The related conditional probability
$ I\!\!\left( {{B_1};C} \right) = \small\sum\limits_{{b_1} \in {B_1}} {\small\sum\limits_{c \in C} {P\left( {c,{b_1}} \right){{\log }_2}\frac{{P\left( {c,{b_1}} \right)}}{{P\left( c \right)P\left( {{b_1}} \right)}}} }= \sum\limits_{{b_1} \in {B_1}} {\sum\limits_{c \in C} {\sum\limits_{s \in S} {P\left( {cs} \right)} P\left( {s{b_1}} \right)P\left( {{b_1}} \right){{\log }_2}\frac{{\small\sum\limits_{s' \in S} P \left( {cs'} \right)P\left( {s'{b_1}} \right)}}{{\small\sum\limits_{s'' \in S} {P\left( {cs''} \right)P\left( {s''} \right)} }}} } $  (3) 
here,
The property of channel (G) and the conditional probability
Let us consider a simple compact QKD sender design that four incoherent surface light sources are placed at the source plane as a sources array, which emit photons with different polarizations. It is instructive to consider a simple case where all sources are point sources, shown by the four solid points in Fig. 3 (a). They locate in the source plane with coordinates of
${\text{η}} = \frac{{{\rm{Charac\;\,\!\!t\;\!\!e\;\,\!\!ris\;\,\!\!tic  le\;\,\!\!ng\;\,\!\!t\;\!\!h}}}}{{{\rm{Re\;\,\!\!s\;\,\!\!o\;\,\!\!lution}}}} = \frac{{2.32D\!a}}{{{\text{λ}} h}}.$  (4) 
The resolution of the diffractionlimited imaging system is determined by (2). It can be seen that the information obtained by Eve is completely dependent on the design of the QKD sender. The square data (upper curve) in Fig. 3 (b) show the mutual information
Another case closer to the real application is consider here, in which all the four photon sources are incoherent surfacesources. As shown in Fig. 3 (a), the four striped squares represent the photon emission of the surfacesources with different polarizations. They locate at the four corners of the square defined by the coordinate of
$P\left( {cs} \right) = \iint\limits_{\left( {{x_s},{y_s}} \right) \in {{\text{σ}} _s}} {P\left( {c({x_s},{y_s})} \right)}P\left( {({x_s},{y_s})s} \right){\rm{d}}{x_s}{\rm{d}}{y_s}.$  (5) 
where
The CLR ratio
It is worth noting that in the calculation we do not consider the coherence between the photons emitted from different points. It is a reasonable assumption for incoherent surfacesources, such as LEDs. For coherent surfacesources, such as VCSELs, the coherence between the photons emitted from different points should be considered by modifying (1) and (5) to include the phase distribution function of subpoint sources in a surfacesource.
According to above analysis, a small CLR ratio
Taking the surfacesource case shown in Fig. 3 (a) as an example,
In this paper, we develop a method to analyze the spatial sidechannel information in a compact QKD sender for the polarization encoding BB84 protocol, in which photons with different polarizations are emitted from different incoherent surfacesources at the source plane. The effect of the aperture for eliminating the spatial sidechannel information is demonstrated theoretically. By the analysis of the mutual information between the actual keys encoded at the QKD sender and the inferred keys at Eve, it shows that Eve’s potential on eavesdropping the spatial sidechannel information is totally dependent on the optical design of the QKD sender, including the source arrangement and the aperture. For a given source arrangement, the Rayleigh criterion is not a good direction to design the aperture. It should be designed according to the requirement of QKD security, which provides a limit of the mutual information between the sender and Eve. Theoretical analysis shows that the height of the compact QKD sender could be controlled under several millimeters with an aperture to eliminate the spatial sidechannel information leakage, if an integrated LED array is used with a characteristic length of 71 μm.
[1]  N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, " Quantum cryptography,” Reviews of Modern Physics, vol. 74, no. 1, pp. 145195, Jan. 2002. 
[2]  D. J. Rogers, Broadband Quantum Cryptography, San Rafael: Morgan & Claypool Publishers, 2010. 
[3]  C. H. Bennett and G. Brassard, " Quantum cryptography: Public key distribution and coin tossing,” in Proc. of IEEE Intl. Conf. on Computers, Systems and Signal Processing, Bangalore, 1984, pp. 175179. 
[4]  H. K. Lo, X.F. Ma, and K. Chen, " Decoy state quantum key distribution,” Physical Review Letters, vol. 94, no. 23, pp. 230504:14, Jun. 2005. 
[5]  X.B. Wang, " Beating the photonnumbersplitting attack in practical quantum cryptography,” Physical Review Letters, vol. 94, no. 23, pp. 230503:14, Jun. 2005. 
[6]  M. Lucamarini, Z.L. Yuan, J. F. Dynes, and A. J. Shields, " Overcoming the ratedistance limit of quantum key distribution without quantum repeaters,” Nature, vol. 557, no. 7705, pp. 400403, May 2018. 
[7]  X.F. Ma, P. Zeng, and H.Y. Zhou, " Phasematching quantum key distribution,” Physical Review X, vol. 8, no. 3, pp. 031043:126, Aug. 2018. 
[8]  G. N. Gol’tsman, O. Okunev, G. Chulkova,et al., " Picosecond superconducting singlephoton optical detector,” Applied Physics Letters, vol. 79, no. 6, pp. 705707, Aug. 2001. 
[9]  L.X. You, H. Li, W.J. Zhang,et al., " Superconducting nanowire singlephoton detector on dielectric optical films for visible and near infrared wavelengths,” Superconductor Science and Technology, vol. 30, no. 8, pp. 084008:17, Jul. 2017. 
[10]  S.K. Liao, W.Q. Cai, W.Y. Liu,et al., " Satellitetoground quantum key distribution,” Nature, vol. 549, no. 7670, pp. 4347, Sept. 2017. 
[11]  H.L. Yin, T.Y. Chen, Z.W. Yu,et al., " Measurementdeviceindependent quantum key distribution over a 404 km optical fiber,” Physical Review Letters, vol. 117, no. 19, pp. 190501:15, Nov. 2016. 
[12]  A. Boaron, G. Boso, D. Rusca,et al., " Secure quantum key distribution over 421 km of optical fiber,” Physical Review Letters, vol. 121, no. 19, pp. 190502:14, Nov. 2018. 
[13]  O. Elmabrok and M. Razavi, " Wireless quantum key distribution in indoor environments,” Journal of the Optical Society of America B, vol. 35, no. 2, pp. 197207, Feb. 2018. 
[14]  J. L. Duligall, M. S. Godfrey, K. A. Harrison, W. J. Munro, and J. R. Rarity, " Low cost and compact quantum key distribution,” New Journal of Physics, vol. 8, no. 10, pp. 249:116, Oct. 2006. 
[15]  G. Vest, M. Rau, L. Fuchs,et al., " Design and evaluation of a handheld quantum key distribution sender module,” IEEE Journal of Selected Topics in Quantum Electronics, vol. 21, no. 3, pp. 6600607:17, MayJun. 2015. 
[16]  H. Chun, I. Choi, G. Faulkner,et al., " Handheld free space quantum key distribution with dynamic motion compensation,” Optics Express, vol. 25, no. 6, pp. 67846795, Mar. 2017. 
[17]  J. W. Goodman, Introduction to Fourier Optics, 3rd ed. Greenwood Village: Roberts and Company Publishers, 2005, ch. 6. 
[18]  S. Nauerth, M. Fürst, T. SchmittManderbach, H. Weier, and H. Weinfurter, " Information leakage via side channels in freespace BB84 quantum cryptography,” New Journal of Physics, vol. 11, no. 6, pp. 065001:18, Jun. 2009. 
[19]  A. LamasLinares and C. Kurtsiefer, " Breaking a quantum key distribution system through a timing side channel,” Optics Express, vol. 15, no. 15, pp. 93889393, Jul. 2007. 
[20]  D. J. C. MacKay, Information Theory, Inference, and Learning Algorithms, Cambridge: Cambridge University Press, 2003, ch. 8. 
[21]  C. H. Bennett, G. Brassard, C. Crépeau, and U. M. Maurer, " Generalized privacy amplification,” IEEE Trans. on Information Theory, vol. 41, no. 6, pp. 19151923, Nov. 1995. 