Securing practical quantum communication systems with optical power limiters

Quantum key distribution (QKD) enables two remote network users to exchange provably-secure keys when it is implemented faithfully [1, 2, 3]. To ensure implementation security, the research community has been focusing on the security of practical systems in recent years, developing methods to narrow the gap between the theory and practice of QKD. On the theoretical side, robust QKD protocols have been proposed, which not only make practical systems more secure against device imperfections but also easier to calibrate and validate in practice (since fewer assumptions are required). On the experimental side, efforts have been focused on tackling quantum side-channels and a wide variety of countermeasures have been proposed and developed [4, 3].

Trojan-horse attacks (THAs) [5, 6] represent one of the biggest threats to QKD security. These attacks aim to steal the secret key information via the injection of unauthorized light pulses, seeking to carry critical modulation information out of the transmitters. More specifically, in these attacks, the adversary (henceforth called Eve) injects bright light pulses into the transmitter and collects the reflected light pulses. Consequently, this allows Eve to learn some information about the secret key. It has been shown that these kind of attacks can be readily implemented using standard optical methods [5, 6, 7, 8]. To mitigate this issue, one can use specialized security analyses to include security against specific types of THAs; for instance, by modeling the unauthorized input light pulses as coherent states. Then, under the assumption that the energy of the reflected light pulses is bounded, one can compute the secret key rate, as was done in Refs. [9, 10].

The bright illumination attacks are another particularly powerful class of side-channel attacks. These include laser damage attacks [11, 12, 13] and blinding attacks [14, 15, 16]. In these attacks, bright light pulses are used to control QKD devices by exploiting their implementation knowledge. Consequently, these allow Eve to avoid eavesdropping detection and hence security is no longer guaranteed. Fortunately, there exist countermeasures which are pretty effective against such attacks [17, 16] and innovative QKD protocols which are completely immune against detection side-channel attacks are known as well, e.g., see measurement-device-independent QKD (MDI QKD) [18, 19].

Based on the above, it can therefore be said that the injection of (unauthorized) bright light pulses into quantum communication systems is a catalyst for side-channel attacks. This is not so surprising since the presence of bright light pulses essentially breaks one of the most important assumptions of quantum cryptography—that the energy of the underlying quantum signals is at the single-photon level (or sufficiently small). To overcome these potential loopholes, one promising solution is to limit the energy of incoming light. Indeed, if this is achieved, one can be sure that the QKD system is operating at the single-photon level and the energy of any outgoing light pulse is bounded as well. Consequently, this will allow the system to operate faithfully in the quantum regime.

In practice, this solution would mean introducing a kind of quantum power limiting device into the QKD system. Based on current research on side-channel attacks, we believe an ideal quantum power limiter should possess the following properties: (a) able to provide a reliable and adjustable photon energy limiting down to the order of a few photons to hundreds of photons for each quantum state, (b) have a minimum insertion loss if the input power is below the threshold and stop the transmission or maintain at the threshold power once the input power exceeds the threshold, and (c) the power limiting effects are independent of other physical degrees of freedoms, e.g., frequency, polarization, etc. In terms of practical considerations, the power limiter device should also be cost-effective, passive, and easily replaceable (if it cannot recover to its normal state after being exposed to strong light).

Here, we propose and demonstrate a novel and practical quantum power limiter that can secure a broad class of QKD setups [20]. The device is based on a form of thermo-optical defocusing effect, which effectively bounds the output optical power by some predetermined threshold. By modeling the system using a set of physically relevant assumptions, we show that the output-input optical power relation of the proposed device can be precisely controlled by changing the system parameters, e.g. the length of the prism and the diaphragm width. Consequently, this allows us to tailor the device to different quantum cryptographic applications. The feasibility and performance of our proposed power limiter device are confirmed using COMSOL (a multi-physics simulation software) and experimental data.

The paper is organized as follows. In Section. II, we first present the design details and the modeling of our power limiter. Thereafter, simulation and experimental results are illustrated. Section. III discusses the potential implementation loopholes and the robustness of the proposed power limiter. In Section. IV, we experimentally verify that the power limiter is essentially transparent to standard quantum encoding choices such as intensity, phase, and polarization degrees of freedom. In Section. V, we illustrate the broad utility of the proposed power limiter over three different QKD systems. In the first application, we provide a general security analysis of MDI QKD that allows for Eve to inject in any kind of state in a given Trojan-horse optical mode. Thereafter, a detailed study on the application of our power limiter in MDI QKD is presented, followed by the simulation results. In the second and third applications, we discuss how the proposed power limiter could be utilized to deter bright illumination attacks and to enhance the implementation security of plug-and-play QKD [21, 22, 23]. In Section. VI we end with a conclusion.

Our power limiter design is shown in Fig. 1. The input light and output light are collimated using a pair of fiber collimators. An acrylic prism is placed along the optical path as the core part of our proposal, whose negative thermo-optical coefficient (TOC) $dn/dT$ is exploited, where $n$ is the refractive index and $T$ is the temperature. Noted here any material with negative TOC could be used with similar analysis. The absorption of input light generates a heat gradient inside the prism, which is then converted to a refractive index gradient accordingly. The negative TOC leads to a relatively smaller reflective index at the center of the prism, resulting in the whole optical architecture works as a concave lens and diverges the transmitting light, as shown in the inset of Fig. 1. By adding a diaphragm with customizable width, the amount of output power can be suitably controlled. An optical filter is then introduced to restrict the working wavelength range of the device for security analysis, which will be discussed in detail in Section. III. We remark that all the components used here are cost-effective and commercially available.

The mechanism of thermal optical defocusing and related power limiting phenomenon have been widely studied in both theory and experiments [24, 25, 26]. In our case, We first simulate the temperature and electric field distribution inside a 10 cm acrylic prism with 7.9 mW input power using COMSOL, whose results are shown in 2 (a) and (b). The simulation results indicate a distinct temperature distribution inside the medium, and a clear divergence of the light field. Towards a better quantitative understanding, we model our power limiter design by balancing the optical absorption and the heat transfer inside the prism under steady-state condition [27]:

where $\alpha$ is the absorption coefficient of the material, $I$ represents the input light power density, $T$ is the temperature, and $k$ is the thermal conductivity. If we assume that the light propagates along the $z$-direction and follows a Gaussian profile, temperature gradient in the $z$-direction is negligible, and the radiative and convective heat transfer is minimal, the steady-state laser radiation intensity at position $(r,z)$ can be solved as [27]

where the input intensity $I(r,0)=\frac{P_{0}}{\pi a^{2}}e^{-r^{2}/a^{2}}$, $a$ is the radius where the light intensity drops to $1/e$ of its axial value, and $P_{0}$ is the incident laser power. The output optical power can be obtained by integrating the light intensity over a certain area which depends on the position (prism length) and the width of diaphragm.

The maximum output power (defined as power limiting threshold) and the insertion loss at different prism length and diaphragm width are shown in Fig. 2 (c) and (d). Since a larger prism length will lead to a greater photon absorption as well as a larger light divergence, a higher insertion loss and a smaller power limiting threshold can thus be expected. Likewise, a smaller diaphragm collects less photon energy, which also results in a higher insertion loss and a smaller power limiting threshold. Therefore, depending on the application, it is possible to choose a set of parameters that balance the insertion loss and power limiting threshold that meet system requirements.

Note here that the Gaussian profile assumption only holds when the beam divergence is relatively small, thus the analytical model may only be able to provide a quick guidance for parameter selection. Hence, experiments are conducted to verify the feasibility of our proposal.

A proof-of-concept experiment is performed using a simplified version of Fig. 1. A collimator is used for light coupling from single mode optical fiber to free-space. Here a transmissive collimator based on graded-index (GRIN) lens is used in the setup for feasibility demonstration, and it can be conveniently replaced by reflective collimators to ensure the proper functioning over a wide range of wavelengths for security reasons (See Section.III for details). Then the Gaussian beam with a beam width of 0.4 mm is directed into the Acrylic Prism. Three acrylic prisms with lengths of 25.4, 50.8, and 101.6 mm are tested. The output light will then be collected after the diaphragm. Diaphragm width of 25, 50, 380, 750 and 1300 µm are used in our experiment. Fig. 2 (e) shows the measured output-input relationship at different diaphragm width and the same prism length of 101.6 mm, while Fig. 2 (f) shows the result at different prism length with the same diaphragm width of 25 µm. The results clearly show the power limiting effect in various conditions. The output power linearly increases with the input power at low power region. As the input power further increases, the output power will increase slowly, and finally be limited to a certain threshold.

Besides, the experimental results verified that the power limiting feature of our proposal can be readily adjusted by modifying the prism length and diaphragm width. Among all of our system configurations, the lowest power limiting threshold of -27.9 dBm is measured, with a insertion loss of -34.0 dB, when a 101.6 mm prism and 25 µm diaphragm are chosen. Similarly, a lower insertion loss of -5.1 dB can be obtained, together with a 10.3 dBm output power limiting threshold, when a 50.8 mm prism and 750 µm diaphragm are used. For different applications, one can expect different requirements for power limiting device. For example, for protecting transmitters against THA, the insertion loss of the power limiter is less concerned since we can always adjust the optical attenuators to generate expected quantum states. While in order to protect receivers from bright illumination attacks, the insertion loss of the device can be a critical factor to system performance. Thus, we would imagine customised power limiter configurations for different application scenarios.

The above analyses so far only show the feasibility of the proposed power limiter under a steady-state condition. Below, we analyze the robustness of the proposed device against potential implementation loopholes that could happen via the variation of standard optical properties.

One important consideration is the finite response time of the proposed device. To investigate this property, we install an electronic variable optical attenuator (EVOA) after a continuous-wave (CW) laser source to create a laser pulse with relatively long pulse width and measure the output response of the power limiter. The experimental results are shown in Fig. 3 (a), where a 101.6 mm prism is used with a 750 µm diaphragm. The settling time of our power limiter is measured to be 300 ms. We observed that the peak output power close to the starting time can be a few times higher than the steady-state output power (which happens after about 300 ms). Crucially, this suggests that one could exploit the finite response time of the power limiter to breach the desired energy threshold.

However, as we will show in Section. V. A, the information leakage due to THAs can, in fact, be bounded using only the average energy constraint (integrated over the finite response time); it is not necessary to bound the maximum (peak) energy for security. Thus, in the experiment, we study the average output optical power at constant-energy pulse input but with different duty cycles. The time domain results are shown in Fig. 3 (b), where a 101.6 mm prism is used with a 25 µm diaphragm. The input laser pulse is modulated at 1 Hz frequency with average input power of 10.5 dBm and 13 dBm. The corresponding average output power is shown in Fig. 3 (c). The results indicate that the average output power is higher at a larger duty cycle. The maximum appears at duty cycle equals 1, i.e. CW light input. In other words, given fixed average input power, CW input will give the largest averaged output power, where Eve is getting the most amount of information about the transmitter. As such, we will be using the power limiting threshold obtained under the CW Trojan horse input assumption for THA analysis; see Section. V. A. To explain this effect, we study the temperature response inside the medium under constant-energy pulse input with different peak power and different duty cycles using COMSOL. The results are shown in Fig. 3 (d). The simulation results indicate that a higher input peak power will lead to a higher maximum temperature, even with the same amount of average power. Therefore, a higher refractive index gradient and larger divergence of input laser are expected with a higher instantaneous power of the input light, leading to a larger thermo-optical defocusing effect and consequently a lower output power.

Another possible attack is to try to change the power limiting threshold by varying the wavelength of the incoming light. This could allow Eve to send in brighter light pulses with a different wavelength. To investigate the possibility of such an attack, we analyze how different input wavelength could affect the TOC and heat generation of the power limiter device.

Generally, the TOC can be modeled by [31, 32]

where $f(n(\lambda))$ is defined as $(n^{2}-1)(n^{2}+2)/(6n)$, $n$ is the reflective index, $\lambda$ is the wavelength of input light, $\Phi$ is the electronic polarizability and $\beta$ is the volumetric expansion coefficient. In most polymers, the volumetric expansion coefficient is more dominant, i.e. $\Phi\ll\beta$, and hence the overall TOC is typically negative [31]. More importantly, notice that the volumetric expansion coefficient is physically independent of the wavelength. As such, the wavelength dependency of TOC is only related to $f(n(\lambda))$. The $f(n(\lambda))$ for acrylic as the function of wavelength is shown in Fig. 4 (a). The corresponding TOC change will introduce a small difference in the output power threshold calculation, as referenced to the power at 1550 nm, which is shown as the red curve in Fig. 4 (a).

As for heat generation, it is related to the absorption loss of the material. A lower loss indicates less energy converted from the optical energy to heat energy, thereby resulting in a lower temperature gradient and a higher power limiting threshold. Based on this, a spectral filter with a large power handling capability can be applied to limit the transmission spectrum of the device; in which case the peak power (over the transmitted spectrum) is considered for the security analysis.

Considering optical fiber-based applications at 1550 nm, the optical fiber itself is, in fact, a bandpass filter for about 300-2100 nm wavelength, beyond which the transmission loss is higher than 100 dB/km [33]. Thus, by applying a secure fiber with adequate length, light beyond this wavelength range can be suppressed to a negligible level. In this way, it is effective to only consider the wavelength dependency feature within this band.

For the material of our power limiter, acrylic, its absorption loss spectrum is shown in Fig. 4 (b) with some low loss bands marked [29, 34]. The loss is about 1.29 dB/cm at 1550 nm and 0.82 dB/cm at 1310 nm, which are standard communication bands. The loss below 1100 nm is even lower. The minimum occurs at about 800 nm with 0.15 dB/cm loss. Based on the absorption spectrum and considering a prism length of 10 cm with 750 µm diaphragm, the maximum output power spectrum and the corresponding input power is calculated based on Eq. 2, as shown in Fig. 4 (c). The power threshold below 1100 nm is about 11 dB higher than the 1310 nm band and more than 17 dB higher than the 1550 nm band. Although a pessimistic power bound of about 8 dBm can be set and used as the system power bound (marked as a red triangle), it is better to use an optical filter to block the light below 1100 nm wavelength. The silicon absorber can be a good candidate, which provides a stable and robust filtering performance. By adding a thin layer of silicon sheet after the power limiter, the output power can be significantly suppressed. As shown in Fig. 4 (c), with only about 1 mm thick silicon, the maximum output power shifts back to the communication bands. The maximum output photon number per second can be further calculated, as shown in Fig. 4 (d). The maximum output photon number per second appears at 1260 nm wavelength with a photon energy of $1.58\times 10^{-19}~{}J$; as such, this wavelength is considered in the security analysis using the worst-case approach.

Similarly, for other degrees of freedom, e.g. the state of polarization, the polymer acrylic used in our design inherently possesses isotropic behavior. Thus, by nature, it will not introduce any birefringence related changes and is independent of the thermo-optical effect, which avoids introducing related loopholes to the system.

Another consideration is laser damage attacks [11, 12, 13]. Preliminary simulations indicate that the acrylic prism could be damaged with only about 400 mW of input power [35, 36]. If the acrylic is damaged or burnt, the thermal defocusing effect is not applicable anymore and the light might be collected by the output collimator directly. Consequently, the power limiting effect may not hold. However, this issue can be resolved by replacing the crossing-through prism with a total internal reflection structure, where the input beam is non-coaxial with the output. In this way, any damage to the material will not weaken the robustness of our proposal; instead the device works as an optical fuse to permanently block the optical path.

To determine if the proposed power limiter is useful for practical use, it is also important to study if the quantum signals will be disturbed when passing through the device. To this end, experiments based on time-bin (intensity), phase, and polarization encoding are implemented to see whether the quantum signal integrity will be affected.

Here, we study the QBER of the system, which is defined as the number of errors ($N_{error}$) over the total number of detection counts ($N_{correct}+N_{error}$),

In addition, given that the detector is well characterised (e.g., its background noise and single-photon efficiency are known), we may further write ${\rm QBER}={\rm QBER}_{opt}+{\rm QBER}_{det}$, where QBER_opt comes from quantum optical imperfections (e.g., imperfect state preparation, optical misalignment, etc) and QBER_det comes from the detector dark counts. Here, as mentioned above, our main focus is the QBER_opt for intensity, phase and polarization encoding schemes, which represent three of the most popular choices for QKD in practice.

The QBER of intensity or time-bin encoding scheme is measured first. As shown in Fig. 5 (a), the intensity extinction ratio of a pulsed laser is measured to infer the QBER. The pulsed laser is attenuated to about 0.1 photon per pulse and measured by an avalanche photodiode (APD) operating in the Geiger mode (gated). The laser pulse has a repetition frequency of 100 MHz and a pulse width of 400 ps. The APD has a gate width of 1 ns. The delay on the APD gate signal is scanned to cover both the laser pulse (bit 1) and dark region (bit 0). The dark counts here are subtracted after the data acquisition for an accurate extinction ratio measurement of the optical pulse. The power limiter used here has a length of 101.6 mm and a diaphragm width of 750 µm. An average input power of 14.49 dBm and -19.72 dBm are tested to demonstrate the cases when the input power is close to and far below the power limiting threshold, respectively. The schematic of the signal controls are shown in Fig. 5 (b). The resulting counts as a function of delay is shown in Fig. 5 (c) and (d). For the input power and the cases with and without the power limiter, the resulting extinction ratios are all above 35 dB, indicating a QBER of less than 0.032%. Therefore, we conclude that the introduction of the proposed power limiter will not introduce any significant noise to QKD systems based on time-bin encoding.

For the phase encoding scheme, the experimental setup is shown in Fig. 6 (a). The input CW laser is modulated using a phase modulator switching between 0 and $\pi$ phase with 50 MHz frequency. The laser output power is 10.28 dBm. Schematics of the signal controls are shown in Fig. 6 (b). The modulated signal is then decoded using an asymmetric Mach-Zehender interferometer (AMZI) with a path delay of around 10 ns. Moreover, a phase shifter is added in one of the paths of the AMZI to lock the relative phase. As such, the interference visibility as well as the QBER can be obtained. Finally the output is attenuated to 0.1 photon per gate and measured by an APD. The counts as a function of delay are shown in Fig. 6 (c) and (d), which corresponds to the case with and without power limiter installed, respectively. The interference visibility $V$ is shown in Fig. 6 (e) as $(1-V)$ for a clear view. The maximum visibility with and without power limiter are 0.9844 and 0.9836, corresponding to a QBER of 0.78% and 0.82%, respectively. Thus like in the case of time-bin encoding, we conclude that the proposed power limiter device is also suitable for phase-encoding QKD systems.

Finally, we study the impact of the device on polarization encoding. The experimental setup is shown in Fig. 7, where a CW laser with an output power of 11.41 dBm is used and polarization is manually tuned with a polarization controller. The attenuated output goes through a polarization beam splitter (PBS) and the outputs are measured by two APDs. The polarization extinction ratio is calculated from the ratio between the two APD counts. The result shows a polarization extinction ratio of 30.1 dB and 32.6 dB for the case with and without the power limiter, corresponding to QBERs of 0.098% and 0.055%, respectively. This clearly shows that the power limiter will not significantly disturb the state of polarisation of the photon.

All in all, we experimentally confirmed that our power limiter device does not introduce any significant noise (in terms of the QBER) to standard QKD systems based on time, phase, and polarization encoding schemes. However, it should be noted that the power limiter does introduce extra losses (insertion loss) to the signal so the photon collection efficiency would decrease when it is deployed on the receiver side. In our experiment, a minimum insertion loss of -5.1 dB is measured, which is equivalent to an transmission efficiency of around 31%, or a transmission distance of 25.5 km(assuming single mode fiber with a transmission loss of 0.2 dB/km). We note that this issue could be mitigated by using materials with higher TOC values so that smaller amount of light absorption is required to trigger the power limiting effect.

In this report, we have proposed and demonstrated a passive power limiter design based on the thermo-optical defocusing effect of an acrylic prism. By numerical simulations and the experimental demonstration, we rigorously studied the feasibility and performance of our power limiter design. In our experiment, the lowest optical power limiting threshold of -27.9 dBm with an insertion loss of -34.0 dB is measured. With a different setting, a low insertion loss of -5.1 dB is achieved with a 10.3 dBm power limiting threshold. The values are adjustable according to different system requirements. It is possible to further reduce the insertion loss at a certain power threshold by switching to a material with higher TOC values or/and reduce the beam width. Besides, our design possess desirable features like compactness, robustness, plus polarization and spectrum-dimension independence.

To illustrate the applicability of our proposed power limiter, we have quantitatively developed a general security analysis that allows for arbitrary of Trojan-horse states. By properly limiting the THA energy leakage in a MDI QKD system, a desirable secure key rate and transmission distance can be achieved. Moreover, based on the previous evidences, we remarked that the power limiter can be useful for deterring bright illumination attacks in a quantum cryptography system. We took the thermal CW-blinding attack on the APD detectors as an example, and show how the power limiter can be designed to prevent such an attack. We further discussed the possibility of using a power limiter to secure the plug-and-play QKD systems without active elements.

As demonstrated in our paper, by simply limiting the incoming/outgoing optical energy, a broad class of QKD protocols can be practically protected without introducing cumbersome device modification. Beyond these, one can also expect such a power-limiting device to find applications in securing semi-device-independent quantum protocols based on energy constraints [52, 53, 54, 55], line-topology or ring-topology multiparty quantum communication systems [56, 57]. As such, we believe it will attract much interest and possess the potential to become a standard tool for quantum cryptography applications.