Single-photon-memory measurement-device-independent quantum secure direct communication

Quantum communication relies on quantum physical principles to ensure secure transmission of information. Bennett and Brassard proposed the first quantum key distribution (QKD) protocol in 1984 [1], which is deemed to be the earliest form of quantum communication conceived for secure key negotiation between two distant legitimate users. An important step in secure communication, namely the negotiation of a symmetric random secret key, is constituted by QKD. The secret key is then used for the one-time-pad encryption of messages to obtain the ciphertexts, but the transmission of ciphertext relies on classical communication.

Quantum secure direct communication (QSDC) is another quantum communication protocol that uses a quantum channel for directly transmitting secret messages. But indeed, QSDC can also be utilized for distributing secret keys from the transmitter to the receiver. In 2000, Long and Liu proposed the first QSDC protocol  [2], in which the messages are mapped onto block-based entangled pairs. Then, in 2003, Deng et al. [3] developed the so-called two-step QSDC protocol for encoding the messages. Inspired by these protocols, many other entanglement-based QSDC protocols have been conceived, such as the high-dimensional QSDC protocol of  [4], the multi-step QSDC protocol of  [5], the quantum secure direct dialogue protocol of  [6], the single-photon-memory two-step QSDC of  [7], the continuous-variable QSDC of  [8], the QSDC network of  [9], and so on. A QSDC protocol based on a single photon was proposed by Deng and Long in 2004  [10], which is termed as the DL04 protocol. A review of QSDC protocols was given in Ref. [11].

Recently, there have been several experimental demonstrations of QSDC both in fiber  [12, 13, 14] and in free-space [15, 16] relying on the QSDC protocols proposed in Refs. [3, 17, 10]. In 2021 multi-user QSDC networks relying on secure-repeaters or on direct links [18, 9, 19] have been reported. It has been demonstrated that a secure and reliable communication can be achieved over a noisy quantum channel in the face of eavesdropping based on Wyner’s wiretap theory [20, 14, 21, 22, 23].

But again, in the original QSDC protocols, quantum memory is required so that the level of security can be examined in the course of transmission. However, practical quantum memory [24, 25] is still decades away. To solve this difficulty, quantum-memory-free (QMF) protocols were proposed. Explicitly, in the QMF QSDC [24, 25], the information is transformed by the transmitter to the ciphertext using a shared secure transmission sequence (SSTS), which is similar to a secret key. Then using module 2 additions, Alice encodes the ciphertext into a codeword, which is mapped into quantum states, which are transmitted to Bob. Both then demodulates, decodes and recovers the plaintext message. The SSTS is then extracted from the ciphertext by the pair of communicating parties for later transmission. In the communication process, the coding efficiency and the length of the SSTS extracted from the ciphertext are determined by the channel’s security capacity, which can be calculated from the error rate. The QMF coding scheme enables simultaneous ciphertext transmission and SSTS negotiation. In this scheme, the ciphertext bits can be transmitted one by one upon mapping them to the quantum state, hence eliminating the requirement for block-based transmission of quantum states. The security of the message will be guaranteed by SSTS encryption, which is effectively the classic one-time-pad encryption. QMF-DL04-QSDC using dynamic joint encryption and error-control coding has been experimentally demonstrated over a maximum communication distance of 18.5 km [25]. QMF coding is suitable not only for single-photon QSDC, but also for entanglement-based QSDC [7].

There is always a gap between theory relying on idealized simplifying assumptions and practice in any technology, hence quantum communication is no exception. Hence, realistic imperfect devices cannot meet the idealized simplifying assumptions of theory, which might lead to security loopholes. The measurement-device-independent version of quantum communication protocols [26, 27, 28, 29, 30, 31, 32] bridges this gap between theory and practice by removing the detector-side channels. The MDI QSDC protocol uses quantum teleportation and message encoding to send the messages  [28]. It has a pair of eavesdropping detection facilities. The first one is used to detect whether there is an eavesdropper in the vicinity before encoding the information, while the second one for integrity detection, namely for detecting whether the transmitted information is tampered with. The eavesdropping detection relies on block-based transmission, since some samples of qubits will be randomly chosen for eavesdropping detection, and the remaining qubits in the block will wait for the results of checking in quantum memory. However, similar to the original QSDC protocol’s block-based transmission regime, it is difficult to realize by current quantum memory technology. Normally, we use an optical delay line instead of quantum memory to store photons [13], which inevitably introduces high attenuation. Hence, for the practical application of MDI QSDC, the conception of a new quantum-memory-free coding-assisted MDI QSDC protocol is essential.

Here we use QMF coding to replace the quantum memory required for block-transition-based MDI QSDC. Our SPMQC-DL04 protocol is illustrated in Fig. 1. We use the following single qubit states:$|0\rangle$, $|1\rangle$, $|\pm\rangle=(|0\rangle\pm|1\rangle)/\sqrt{2}$, and $|\widetilde{\pm}\rangle=(|0\rangle\pm i|1\rangle)/\sqrt{2}$. The four Bell-basis states are, $|\phi^{\pm}\rangle=(|00\rangle\pm|11\rangle)/\sqrt{2}$, $|\psi^{\pm}\rangle=(|01\rangle\pm|10\rangle)/\sqrt{2}$ and $M\in\{0,1\}^{m}$ represents the message that Alice wants to transmit to Bob. Furthermore, $K\in\{0,1\}^{m}$ represents the keys in the key sink used for encryption and decryption, while $M^{\prime}\in\{0,1\}^{m}$ and $C\in\{0,1\}^{c}$ represent the ciphertext and code word, respectively. We divide the code word into frames, and each round of communication includes the following six steps to send a frame of information. We note that the key sink is empty in the first round. So Alice and Bob should select the appropriate values to estimate the secrecy capacity and the key $K$ [25].

Step 1, state preparation. Alice randomly prepares a Bell-state $|\psi^{-}\rangle$ or a single photon state which is randomly in one of the four states $\left\{|+\rangle_{\rm A},|-\rangle_{\rm A},|0\rangle_{\rm A},|1\rangle_{\rm A}\right\}$. The entangled state and single photon state is used for information transmission and security check, respectively. Bob prepares a single photon state, which is randomly in one of the four states $\left\{|+\rangle_{\rm B},|-\rangle_{\rm B},|0\rangle_{\rm B},|1\rangle_{\rm B}\right\}$.

Step 2, transmission and measurement. Alice and Bob send their own qubit to Charlie at the same time. Note that if Alice has prepared a pair of entangled qubits, one of the qubits will be forwarded to Charlie and the remaining one is retained by Alice. Charlie receives the qubits sent by Alice as well as Bob, and then he performs a Bell-state measurement (BSM) and announces the measurement result through classical channels.

Step 3, security check. If Alice prepares a single photon, she informs Bob through the classical channel and then they complete the eavesdropping detection and estimate the detection bit error rate (DBER), as detailed in Ref. [28]. This procedure completes the first security check. If the DBER is below the maximum tolerable threshold, then they move to the next step. Otherwise, they return to Step 1.

Step 4, state recovery and transmitted message coding. As shown in Table I, if Alice prepares an entangled state, the qubit which is retained by her will have one of the four single-photon states with equal probabilities after Charlie’s BSM. Bob announces the basis that he used for prepareing the initial state. Alice then recovers the qubit she retained by performing the unitary operation $U_{T}\in\{I,i\sigma_{y}\}$ according to the BSM result. To elaborate a little further, if Bob’s initial state is prepared in the basis $Z$ and the BSM result is $|\phi^{-}\rangle$ or $|\phi^{+}\rangle$, applying a unitary operation $U_{T}=i\sigma_{y}$ to Alice’ qubit will transform it to the same state as Bob’s initial state. We refer to this step as the state recovery, since it completes the teleportation of Bob’s initial state to Alice. Alice applies the exclusive or (XOR) operation both to the message $\mathnormal{M}$ and to the key $\mathnormal{K}$ distilled from the previous round of information, for producing an encrypted ciphertext $\mathnormal{M^{\prime}}$, where $\mathnormal{M^{\prime}=M\oplus K}$. Next Alice performs dynamic joint encryption and error-control coding [25] to ensure the secure and reliable transmission of the ciphertext. Then Alice maps the ciphertext onto the qubit by using $U_{m}\in\{I,i\sigma_{y}\}$, where $\mathnormal{I}$ is used for bit 0, $i\sigma_{y}$ for bit 1. Alice also randomly chooses some qubits for transmission to carry out a subsequent integrity check, rather than mapping them to the ciphertext.

Step 5, qubit transmission and measurement. Alice sends the qubit containing the ciphertext to Charlie. Charlie measures it in the specific preparation basis that Bob has announced and publishes the measurement results through the classical channel.

Step 6, message decoding and integrity check. Alice announces the random check bits and their position via the classical channel. Then the quantum bit error rate (QBER) is estimated both by Alice and Bob. If the QBER is below the maximum tolerable threshold, the ciphertext transmission is deemed reliable. This procedure represents the integrity check. Then Bob decodes the ciphertext to get the message $\mathnormal{M}$. If the message frame has not been transmitted, they return to Step 1. Otherwise, Alice and Bob use the DBER and the QBER to estimate the secrecy capacity of the current round of communication and calculate the number of keys they can distill from the ciphertext. Finally, both of them distill and insert the same keys into the key sink to encrypt and decrypt the next round of transmission. The current round of communication is over. Note that the recently proposed solution of increasing the channel capacity using masking (INCUM)  [33] in QSDC can be invoked for improving performance as detailed in V-A.

Note that only a single-photon storage is required for the qubit retained by Alice, which can be realized by an optical delay line. This is a common characteristic of entanglement-based protocols  [34, 35, 7]. In this sense, we simply term the proposed protocol as SPMQC.

Based on the security analysis of MDI DL04 QSDC  [30], there exists a secrecy capacity $C_{s}$, which allows us to use a forward encoding scheme having a coding rate lower than $C_{s}$ to transmit the message reliably and securely to receivers. The associated asymptotic secrecy capacity lower bound $C_{s}$ is given by  [30]

where $Q$ is the signal gain of Bob for message decoding and $g$ is the gain difference between the channels of $AB$ and $AE$, while $e$ and $\epsilon_{u}$ represent the QBER and DBER, respectively. This is presented in more detail in V-B. The DBER $\epsilon_{u}$ originates from the three bases $u\in\{X,Y,Z\}$ that are used for the security check [30] in Step 3. Subsequently, Alice chooses one of the unitary operations $U_{m}\in\{\sigma_{x},i\sigma_{y},\sigma_{z}\}$ for encoding bit 1 in Step 4, and the paired qubits containing the eigenstate of the encoding operation $\sigma_{u}$ will be discarded. However, this optimal procedure has not been taken into account in our protocol’s description.

To determine the DBER of the proposed protocol using different bases, we perform simulation under the assumption of having ideal quantum sources. The detail derivation is presented in V-C. The key parameter settings for our simulations are shown in Table II.

As seen in Fig. 2, the DBER $e_{Z}$ is higher than $e_{X}$ and $e_{Y}$. Both the DBER $e_{X}$ and $e_{Y}$ exhibit the same trends. This means that Alice and Bob will have different secrecy capacity, if they use different security check bases. The difference between $C^{Z}_{s}$ and $C^{X}_{s}$ ($C^{Y}_{s}$) can only be seen, when we focus our attention on a very short distance, as shown in the inset graph of Fig. 3. Hence, we can choose an optimized security check basis $X$ or $Y$ to obtain a higher secrecy capacity. Note that the above results were obtained under the simplifying assumeption of having ideal quantum sources. It is plausible that the difference between $C^{Z}_{s}$ and $C^{X}_{s}$ ($C^{Y}_{s}$) will be larger, if practical light sources, such as weak-coherent pulses and parametric down-conversion, are considered. This is because the distribution of the number photons may play an important role in the associated DBER estimation.

Under such circumstances, the importance of choosing an optimised basis for security check becomes plausible. The results demonstrate the feasibility of SPMQC for applications in metropolitan quantum communications with a range for a few tens of kilometers.

Fig. 4 shows the secrecy capacity of the SPMQC protocol both with and without increasing the capacity using masking (INCUM). Indeed, the INCUM technology  [33] can substantially increase the secrecy capacity and the transmission distance of the protocol.

Finally, we performed numerical simulations for characterizing the influence of dark count on the upper limit of transmission distance. As shown in Fig. 5, the dark count has a significant impact on the transmission distance. The secrecy capacity will be significantly reduced, when the signal is attenuated to be comparable to the dark count. Therefore, we can improve the transmission distance of our SPMQC protocol by reducing the dark count rate of the detector.

We have proposed the SPMQC protocol and analyzed its performance. Selecting the optimal security basis $X$ or $Y$ increases beneficially the security capacity of the proposed protocol. The results show our SPMQC is eminently suitable for metropolitan areas covering a range of a few tens of kilometers. with given the rapid evolution of experimental techniques, our SPMQC protocol has the potential of finding its way into practical applications.

But before that, there are some further open issues for future research. Firstly, practical imperfect light sources have to be integrated into our proposed protocol. Secondly, the method of decoy-state based techniques could be utilized to estimate the error rate and reception rate. Thirdly, the family of optimal QMF coding techniques may be combined with optimal MDI protocols [36, 37, 38, 39] for supporting high-rate and long-distance MDI QSDC.