Secured Quantum Identity Authentication Protocol for Quantum Networks
 

The authors in [1] proposed a protocol for quantum identity authentication based on a shared classical secret key. However, some information may leak from the shared secret, and avoiding this would require authenticated classical channels. Also, in [2], a protocol is proposed for quantum identity authentication and key agreement by adopting random numbers to agree on the session key. The secret key is refreshed by the end of the protocol, which improves security but affects the efficiency of the protocol due to the associated overheads. Based on quantum key distribution, [3] presents a quantum identity authentication protocol that can also be used to refresh the authentication key between the participants. Another authentication protocol is proposed in [4] based on the BB84 version of quantum key distribution. In addition, [5] proposes a quantum identity authentication protocol using a cluster state of five qubits. However, from a practical standpoint, it is not easy to prepare and maintain such cluster states. Moreover, a semi-quantum identity authentication protocol was proposed in [6] using single-qubit measurement and XOR operations. Also, in [7], a protocol is introduced for quantum identity authentication by employing non-orthogonal states. Despite showcasing resilience against MitM attacks, it is important to note that the protocol’s security is contingent upon the one-time utilization of authentication keys to maintain its effectiveness. Lastly, [8] proposed a quantum identity authentication protocol centered on the utilization of quantum rotation properties and public key cryptography in a bit-oriented approach. While the protocol demonstrated commendable robustness against various attacks, the protocol of [8] operates under the assumption of an ideal environment. Real-world imperfections within the quantum channel and detection mechanisms can directly influence the accuracy and security of the authentication process. Furthermore, potential losses within the communication channel may lead to authentication failures or create opportunities for malicious entities to exploit the noise for concealed attacks.

To overcome the existing limitations, the following contributions have been carried out:

• •

  We propose a protocol that establishes authentication between communication parties in quantum networks. The proposed protocol relies on entanglement and reusable shared secret keys.

• •

  We perform a security analysis of the proposed protocol, which demonstrates that the detection probability of a malicious entanglement increases based on multiple authentication rounds from $50\%$ to reach $100\%$ by the fourth round of the authentication process.

• •

  We simulated the proposed protocol in a quantum network, which provided numerical results that support our security analysis. The simulations were carried out on a quantum network simulator, QuNetSim [9].

The rest of this paper is organized as follows. Section II defines the problem of malicious entanglement in quantum networks and presents the proposed quantum identity authentication protocol and provides an illustration example. Section III presents a security analysis of the proposed protocol and discusses the simulation setup and results. Section IV concludes the paper.

Consider a quantum network represented as a graph $G=(V,E)$, where $V=\{v_{i}\}_{i=1}^{N}$ represents a set of $N$ nodes while $E=\{e_{i,j};v_{i},v_{j}\in V\}$ represents the set of edges connecting the nodes. Consider entangled pairs being already distributed among adjacent nodes. Let node $v_{i}$ want to send quantum data to a non-adjacent node $v_{j}$ and there is no direct quantum channel between $v_{i}$ and $v_{j}$. Hence, nodes $v_{i}$ and $v_{j}$ communicate via quantum teleportation. Being non-adjacent nodes, there is no entangled pair shared between $v_{i}$ and $v_{j}$. Consider an intermediate node $v_{k}$ that shares entangled pairs with $v_{i}$ and $v_{j}$ such that $e_{i,k}\in E$ and $e_{j,k}\in E$. Then, $v_{k}$ can perform entanglement swapping to directly entangle $v_{i}$ and $v_{j}$. Given the aforementioned model, this paper aims to provide a protocol that enables $v_{i}$ and $v_{j}$ to authenticate each other and ensure that $v_{k}$ did not perform a malicious entanglement. The proposed protocol works on any number of intermediate nodes and the adoption of a single intermediate node herein is meant only for illustration purposes.

The proposed authentication protocol assumes that the two end users share a secret key in advance, which can be done using a key management protocol such as quantum key distribution. Following the common terminology, let the end users be called Alice and Bob. Let Alice want to use teleportation to send quantum data to Bob. Through entanglement swapping via intermediate node(s), Alice and Bob can share an entanglement pair. Alice wants to authenticate Bob to ensure that she is sending the quantum information only to Bob and that the intermediate node(s) did not create a malicious entanglement.

Assume Alice wants to send quantum data to Bob and an intermediate node (Eve) attempts to perform malicious entanglement. In this case, Alice and Bob are not directly entangled which means that Eve shares an entanglement pair with Bob and an entanglement pair with Alice. Alice and Bob share a secret key and Eve does not know the key. Suppose only Alice wants to authenticate Bob which is sufficient in some cases. Alice and Bob start the authentication process after a few transmitted qubits. Bob will prepare the authentication qubit and teleport it to Alice. In the malicious entanglement case, Eve will receive the qubit instead. Because Eve does not know the key, she will never know that this is an authentication qubit and will measure it. The arbitrary measurement performed by Eve on the authentication qubit will enforce the qubit to collapse in one of two possible states $\ket{0}$ or $\ket{1}$ and then Eve sends the qubit to Alice. The quantum information in the qubit prepared by Bob has been destroyed and Alice will detect the attack with a probability of $50\%$ after the first authentication round. This is because the authentication qubit has the chance to get collapsed to the correct value with a probability of $50\%$. After the second, third, and fourth authentication rounds, Eve will be detected with a probability of $75\%$, $87.5\%$, and $93.75\%$, respectively. Within $7$ authentication rounds, Eve will be detected with a probability of $99.2\%$.

Also, Eve cannot impersonate Bob by constructing an authentication qubit because she does not know the key. So, she cannot know the initialization and encoding bases. Also, she does not know when Alice and Bob will perform the authentication because Alice and Bob do the authentication dynamically and secretly. The transfer length controls the amount of data transferred before each authentication. For example, a transfer length of $2$ can allow a maximum of $3$ qubits to be transferred before each authentication. A transfer length of $4$ can allow a maximum of $15$ qubits to be transferred before each authentication process. On one hand, if Alice and Bob transfer sensitive data, they may decrease the transfer length to do more authentication rounds and increase the probability to detect Eve before transmitting much data. On the other hand, Alice and Bob can increase the transfer length for higher throughput with fewer overheads if they are not transferring sensitive data.

Lastly, it is important to highlight that within their quantum communication setup, Alice and Bob do not rely on classical communication beyond the essential exchange of two classical bits needed for the recovery of teleported quantum states. This classical channel does not necessitate stringent security measures and remains unaffected by compromise.

This paper used QuNetSim [9] to simulate the proposed protocol and evaluate its performance. To test the security level of the proposed protocol, a malicious entanglement attack was simulated where Alice wants to communicate with Bob and there is a malicious node (Eve) performing a malicious entanglement attack between Alice and Bob. Alice shares an entangled pair with Eve, and Eve shares an entangled pair with Bob. It is supposed that Eve applies entanglement swapping to entangle Alice and Bob directly, but in this malicious scenario, Eve will not perform the entanglement swapping, which results in a MitM attack. The simulation scenario is tested for transfer lengths $T=\{1,2,3,4,5\}$, which means that the maximum number of data qubits transferred between two authentication rounds are $1,3,7,15,31$, respectively. For each transfer length, the simulation scenario is repeated $200$ times attempting to send $150$ data qubits from Alice to Bob. In each transfer, Eve receives a qubit from Alice, measures it in a random base, and then teleports it to Bob.

The success rate of the protocol is measured as shown in Fig. 2 where the proposed protocol is able to detect the attack with a probability of $100\%$ for the transfer lengths $1,2,$ and $3$ while it degrades to $99.5\%$ and $96.5\%$ for the transfer lengths $4$ and $5$, respectively. This is because the number of authentication rounds performed is not enough compared with the amount of transferred data. The average number of authentication rounds required to detect an attack has been measured for each case as shown in Fig. 3. The simulation results demonstrate that the proposed protocol is able to detect an attack within $4$ authentication rounds on average. Although the security analysis presented in section III-A calculates that an eavesdropper would be detected within $7$ rounds with a probability of $99.2\%$, the simulation results showed that an eavesdropper can be detected with a probability of $100\%$ within just $4$ rounds. The security analysis focuses on calculating the worst-case scenario of detecting eavesdropping, while the simulation results calculate the average number of authentication rounds required to detect an attack within $200$ trials.

The average data leakage has been measured for each case and shown in Fig. 4. The data leakage is the number of qubits that are transmitted from Alice to Bob before detecting the presence of Eve. The results presented in Fig. 4 clearly demonstrate that the average data leakage increases as the transfer length increases. The underlying reason for this phenomenon is that as the transfer length increases, more qubits are transferred between two authentication rounds on average, providing Eve with more opportunities to gain information before being detected. Given the clear relationship between transfer length and data leakage demonstrated in Fig. 4, it is important for Alice and Bob to carefully consider the confidentiality level of the data they are transferring when selecting an appropriate transfer length. If the data is highly sensitive, Alice and Bob should prioritize security over speed and choose a shorter transfer length. This will allow for more frequent authentication rounds, increasing the probability of detecting Eve before she can intercept and gather a significant amount of data. On the other hand, if the data is less sensitive, Alice and Bob may be able to afford a longer transfer length for faster communication. Ultimately, the decision of transfer length should be based on a careful balance between the confidentiality level of the data being transferred and the desired communication speed. By taking a thoughtful and strategic approach, Alice and Bob can ensure the highest level of security and protection for their data. The data leakage can lead to data integrity loss. Data integrity loss refers to the situation where the integrity or accuracy of data is compromised or altered, leading to inaccuracies, errors, or unauthorized modifications in the stored or transmitted data. It is essential to note that the data integrity loss significantly depends on the type of quantum data being exchanged. Without knowing the specific type of quantum data involved, providing accurate values for data integrity loss could be challenging. For instance, in scenarios where unknown quantum states are delivered and utilized without measurements, such as in distributed quantum computing, where qubits control another target qubit, the data integrity loss in this case is hard to quantify. This is because of the infinite number of quantum states a single qubit can represent if it exists in superposition. On the other hand, if the exchanged data involves classical data encoded as qubits, the integrity loss might be around $50\%$ of the data leakage. This occurs because the malicious repeater may measure the qubits in the wrong basis approximately $50\%$ of the time.

To assess the practicality of using the proposed quantum authentication protocol, a simulation was conducted to measure the communication overhead of the authentication process. The communication overhead is defined as the ratio of the number of authentication qubits involved in the communication process to the number of data qubits. The simulation involved attempting to transmit 100 data qubits and the average of communication overhead was measured over 200 trials using transfer lengths of 1, 2, 3, 4, and 5. As shown in Fig. 5, the communication overhead of the proposed protocol is $64\%$, $37\%$, $20\%$, $10\%$, and $4\%$ for transfer lengths 1, 2, 3, 4, and 5, respectively. These results demonstrate that while there is some overhead associated with using the proposed quantum authentication protocol, it is relatively small for reasonable transfer lengths. Therefore, the proposed protocol can be considered a viable and practical solution for secure communication between two parties.

The number of qubits that can be transmitted by a single use of the shared secret key depends on the transfer length. For example, if the shared secret key is $1024$ bits long and the transfer length is $2$, then the key can support up to $512$ authentication rounds. During each round, up to $3$ qubits of data can be sent, but on average only $1.5$ qubits are sent. Thus, the total number of qubits that can be sent by a single use of the $1024$-length key is $768$ qubits on average. If the transfer length is $3$, then the same key can support up to $341$ authentication rounds. During each round, up to $7$ qubits of data can be sent, but on average only $3.5$ qubits are sent. Thus, the total number of qubits that can be sent through a single use of the shared key is $1193$ qubits on average. Equation (1) can be used to calculate the average number $q$ of qubits that can be transmitted using a transfer length $T$ and a single use of a shared secret key with length $L$

However, if the shared secret key is used up, the two parties involved in the communication can start the process again from the first bit. Therefore, the number of qubits that can be sent is multiplied by the number of times the key is used. It is important to note that the shared secret key is highly reusable, as it does not reveal any information about the authentication process during transmission. This allows for a secure, covert authentication process that outside parties cannot detect. Because qubits are closed systems, it is impossible for anyone other than the communication parties to differentiate between the data qubit and the authentication qubit. Also, both the encoding bit and the base bit are fully secure, no one can determine the value encoded into the qubit or the encoding base used even if the authentication qubit is captured.