JP2008245053A - Method and device for optical-communication quantum cryptographic communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve safety against an attacker by further complicating processing for common-key extraction. <P>SOLUTION: A plurality of m pseudo-random number generators having different primitive polynomials and different initial values are driven in parallel corresponding to a multi-valued number in order to obtain output; the output is set as one block; a pseudo-random number generator for changing a binary random number is used so as to execute the change of a binary random number in one block unit; and a binary optical-signal pair (a base) is selected, by using one block as a running key in order to set a multi-valued signal. Accordingly, the positions and the number of errors in a random-number sequence in one pseudo-random number generator, as seen from an eavesdropper are made random so as to further complicate the processings for common-key extraction by the eavesdropper. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an optical communication quantum cryptography communication method and an apparatus therefor, and more particularly to complication of processing for extracting a common key used for encryption communication.

  As an optical communication quantum cryptography, the common key quantum cryptography that cannot be decrypted even with infinite computational power is known by spreading the quantum fluctuation (quantum shot noise) of light by modulation and preventing an eavesdropper from receiving an optical signal accurately. It has been. In this common key quantum cryptography, a binary optical signal carrying binary transmission data is set as one set (referred to as a base), M bases are prepared, and which base is used to send data is a cipher. Randomly determined by pseudo-random numbers according to the key. As a result, the optical multilevel signal is designed so that the inter-signal distance is so small that it cannot be identified by quantum fluctuations, so that an eavesdropper cannot read the data information from the received signal at all. .

  Since the optical modulator / demodulator of the authorized sender / receiver switches the binary M bases in accordance with the common pseudo-random number and communicates, the authorized receiver reads the data by binary signal judgment with a large inter-signal distance. In the end, errors due to quantum fluctuations can be ignored, and accurate communication is possible.

An encryption scheme based on this principle is called Yuen quantum cryptography according to Yuen-2000 cryptographic communication protocol (abbreviated as Y-00 protocol). Currently, as a communication method for realizing the Y-00 protocol, P.I. Kumar and H. Yuen et al., Northwestern University, published an optical phase modulation method according to Non-Patent Document 1. In addition, Tamagawa University Group has announced a light intensity modulation method according to Non-Patent Document 2.
Note that this Y-00 protocol does not utilize the quantum fluctuations of light (referred to as classical Y-00). For example, wireless communication and electrical communication have higher encryption strength than ordinary stream ciphers. It is a protocol that can be realized.

G. A. Barbosa, E .; Corndorf, P.M. Kumar, H.C. P. Yuen, “Secure communication using mesoscopic coherent state,” Phys. Rev. Lett. vol-90, 229011, (2003) O. Hirota, K.K. Kato, M.M. Sohma, T .; Usuda, K .; Harasawa, “Quantum stream cipher based on optical communication” SPIE Proc. on Quantum Communications and Quantum Imaging vol-5551, (2004)

In the optical communication quantum cipher Y-00 whose security is ensured by quantum fluctuations, multi-level modulation is performed in order to effectively use quantum fluctuations. When performing multi-level modulation, if the base number is M, the output random number sequence of the pseudo random number generator is divided into blocks each of log ₂ M bits, and one of the M bases is set as a running key (M types). select.

  When an eavesdropper performs decryption, an attempt is made to obtain a Running key sequence corresponding to the measured value from the measured value of the signal. However, an error that cannot be avoided in principle occurs in the measured value due to the effect of quantum fluctuation. Therefore, an eavesdropper must extract a correct common key from a running key sequence in which an error is mixed. At this time, the process for extracting the common key by the eavesdropper can be complicated by making the position and number of errors in the output random number sequence close to complete randomness.

  An object of the present invention is to further improve the security against an attacker by further complicating the process for extracting a common key by an eavesdropper.

  The present invention drives a plurality of pseudo-random number generators having different initial values and connection structures in parallel, sets the output as one block, and replaces a binary random number sequence in units of blocks, thereby outputting an output in the pseudo-random number generator. This randomizes the position and number of errors in the random number sequence and complicates the process for extracting the common key.

In the communication method according to the present invention, it is preferable that the transmission side uses the Running key to transmit data that has been multi-value modulated and encrypted, and the reception side uses the same Running Key In the optical communication quantum cryptography communication method for decrypting using
On the transmission side, the output obtained by parallel driving a plurality of m pseudo random number generators having different connection structures from the initial value is regarded as one block, and the binary random number sequence is replaced in units of blocks, and the output in the pseudo random number generator Generate random data with random position and number of random number errors,
On the receiving side, using a plurality of pseudo-random number generators with different initial values and connection structures, the binary random number sequence is replaced in units of blocks, and the received encrypted data is binary detected and decrypted. Configured as a communication method.

In a preferred example, the sending side selects the plaintext base after performing an exclusive OR with the plaintext and the most significant bit (MSB) of the Running key, and sets the MSB of the Running key according to the 0 and 1 polarities of the base. A multilevel signal is selected by inversion or non-inversion, and the receiving side performs exclusive OR with the most significant bit of the Running key after binary detection.
Preferably, the pseudo-random number generator uses an LFSR (Linear Feedback Shift Register), and the linear complexity of the equivalent LFSR that outputs the same sequence as the output Running key sequence is equal to the cycle of the Running key. Set as follows.
Preferably, the structure of each LFSR of a plurality of m is performed on an eavesdropper by making the linear complexity of the equivalent LFSR that outputs the same sequence as the output running key sequence equal to the cycle of the running key. Make it.
The present invention can also be understood as a transmission method on the transmission side and a reception method on the reception side.

  In addition, the transmitter according to the present invention is preferably a transmitter that transmits a multilevel optical signal encrypted by multilevel modulation of transmission data using a Running key. Replacement of different m pseudorandom number generators and the output obtained by driving plural m pseudorandom number generators in parallel as one block, by exchanging binary random number sequences in units of blocks and generating one Running key Multi-level modulation of the transmission data in bit units according to the value of the random number for the exchanging device, the pseudo random number generator for the exchanging device that gives the random number to the exchanging device in order to change the exchanging position by the exchanging device And a multi-value intensity modulator that generates encrypted data.

  Also, the receiver according to the present invention is preferably a transmitter for binarizing and decrypting received encrypted data using a Running key, and a plurality of m pseudorandom number generators having different connection structures from the initial value K A swapper that replaces a binary random number sequence in units of blocks and generates one Running key for a plurality of random number blocks generated by driving a plurality of m pseudorandom number generators in parallel; A pseudo-random number generator for a changer that gives a random number to the changer in order to change the replacement position by means of, and generates data obtained by decrypting the encrypted data in bit units according to the value of the Running key output from the changer And a receiver having a binary detector.

  According to the present invention, the number of narrowing down of the eavesdropper key in the optical communication quantum cryptography Y-00 is increased, and the position and number of random number sequence errors in one pseudo random number generator are randomized. The process for extracting the common key becomes more complicated. As a result, the correlation attack or the high-speed correlation attack becomes useless, and the safety is further improved.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
First, the principle of complicating common key extraction processing by an eavesdropper will be described.
In optical communication quantum cryptography, an error occurs due to quantum fluctuations at the time of signal measurement, and an error occurs in the lower few bits of the Running key. In this state, since the position of the error is specified, it becomes weak against a correlation attack, a fast correlation attack, and the like.
Therefore, in order to improve this, m pseudo-random number generators having different initial values from the primitive polynomial are prepared according to the multi-value number. At this time, the primitive polynomials of all m pseudorandom number generators must be different. The reason is that the connection structure of the pseudo random number generator is determined by the primitive polynomial, and that the primitive polynomial is equal, the connection structure of the pseudo random number generator is also equal, and the structure of one pseudo random number generator is estimated. This is because the connection structure of other pseudo-random number generators is also known. Also, in order to prevent the initial values of other pseudorandom number generators from being estimated from the initial values of one pseudorandom number generator that also has initial values, all different initial values are prepared. These multiple pseudo-random number generators are driven in parallel, and the resulting output is set as one block, and binary random number replacement is performed every time using a pseudo-random number generator for binary random number replacement in units of blocks. Is selected as a running key, and a multi-value signal is selected.

  If an eavesdropper attempts to decode, an error due to the lower few bits of the Running key occurs due to quantum fluctuations during signal measurement. Errors due to quantum fluctuations have no correlation and the number is random. In optical communication quantum cryptography (having probabilistic significance), the inter-signal distance of the optical multilevel signal is designed so that the number of errors is about the lower 0 to 3 bits of the Running key by default.

  From the above, although the error position in the Running key is almost fixed, by performing binary random number replacement every block, all the pseudo random number generators composing one block are in error. The position and number of errors in the output random number sequence in one pseudo-random number generator will be random.

  By the above method, it is understood that the position and number of errors in the output random number sequence in one pseudorandom number generator viewed from the eavesdropper are random. However, there are equivalent pseudo-random number generators that drive m pseudo-random number generators having different initial values from the primitive polynomial in parallel and output exactly the same sequence as the Running key sequence after the binary random number is replaced. In this case, the eavesdropper may try to estimate the structure of the equivalent pseudorandom number generator from the Running key sequence. In this case, the process for extracting the common key of the eavesdropper is not complicated.

Therefore, in order to prevent an eavesdropper from creating an equivalent pseudorandom number generator that outputs a running key sequence, the following contrivances are required as cryptographic random numbers.
First, the Running key is the key for the final encryption because it performs base selection at the time of multilevel intensity modulation. Therefore, all m running keys must be generated with a probability of 1 / m without any bias.
Next, the linear complexity of the equivalent pseudo-random number generator that outputs the same sequence as the Running key sequence is set to be equal to the cycle of the Running key sequence. At this time, the eavesdropper must perform structure estimation of each of the m pseudorandom number generators. The linear complexity indicates the number of stages of the smallest pseudo-random number generator that generates a given sequence. There is always a pseudo-random number generator that generates a given sequence. In an extreme case, a shift register having the same length as the given sequence is prepared, and the sequence given as the initial value may be set as it is. The Berlekamp-Massy method is generally used for calculating the linear complexity. This algorithm is composed of a linear complexity and a minimum generation pseudo-random number generator sequentially from a given random number sequence. When calculation is performed for each bit, a primitive polynomial and linear complexity for outputting the sequence up to that point can be obtained sequentially. If the calculation is continued beyond the linear complexity of the given random number sequence, the primitive polynomial does not change, and the primitive polynomial at this time becomes correct. As a result, the correct linear complexity and connection structure are known, and an equivalent pseudorandom number generator is obtained.

  The Berlekamp-Massy method can be applied to any sequence, but if the linear complexity of the equivalent pseudorandom number generator is designed to be equal to the period of the Running key sequence, the primitive polynomial will always change and be unique. Therefore, all the periods of the Running key sequence are terminated without obtaining an equivalent pseudorandom number generator. Therefore, the eavesdropper cannot predict the remaining series from a part of the output random number series, and needs to estimate the structure of each of the m pseudorandom number generators.

When an eavesdropper has to make structure estimates for each of the m pseudorandom number generators, the safety index is as follows:
In general, assuming that the number of registers (linear complexity) of the pseudorandom number generator is n, all sequences can be generated if there are continuous 2n bits. This is because an n-ary simultaneous equation relating to the connection structure can be obtained from 2n-bit continuous output. Therefore, an eavesdropper measures a 2n-bit signal corresponding to the output random number sequence of one pseudo-random number generator.

Next, the eavesdropper narrows down the possible number of true keys in consideration of errors that occur during signal measurement. Then, a known plaintext attack is performed to find the true key from the narrowed down keys. This number of refinements has already been evaluated as the safety index Q at Y-00.
The safety index of the basic model Y-00 is

It is.
Here, n is the number of registers, M is the number of bases, and J is the number of indistinguishable signals due to quantum fluctuations.

It becomes. m is the number of pseudo-random number generators to be prepared, and is a value that changes according to the multi-value number.

It is a stand.

  From equations (1) and (2),

Therefore, it can be seen that the safety is greatly improved.

Here, the number of errors and their dispersion range will be described with reference to FIGS.
FIG. 2 shows the number and range of errors associated with each block key (Running key) K ¹ _R to K ⁵ _R. It shows that an error has occurred in the range written as error in FIG. FIG. 3 shows the relationship between the number of errors (Δ mark) and the number of errors by each pseudo-random number generator.
For example, in the running key K ¹ _R , K ₍₁₎ , K _(6), and K _(m) are errors, and referring to FIG. 3, there are errors in three places of the pseudo random number generators 112, 116, and 11m. Corresponding to that. As another example, in the running key K ³ _R , two errors K ₍₁₎ and K ₍₃₎ are errors, and referring to FIG. 5, there are errors in two places of the pseudo random number generators 111 and 113. Corresponding to that.
As described above, when errors that occur in units of blocks (units of running keys) are collected as errors in one pseudo-random number generator, it can be understood that the position and number of errors in the output random number sequence are random.

Next, a specific example of optical communication quantum cryptography communication will be described with reference to FIG.
In FIG. 1, the communication system based on the optical communication quantum cryptography Y-00 is configured by connecting a transmitter 1 and a receiver 2 via a communication path 3 such as an optical fiber.
The transmitter 1 is driven in parallel with a plurality of m pseudo-random number generators 111, 112, 11m-1, and 11m that generate a running key by generating a pseudo-random number sequence by inputting an initial encryption key | k |. of m random number generated from the pseudo-random number generator 111,112,11m-1,11m as one block, a binary random number replacement 12 for outputting a final Running key K _R interchanged positions in blocks , a pseudo random number generator 13 for generating a pseudo-random number for determining the bit position of the replacement in the binary random number replacement unit 12, transmission data (plain text) bit by bit Xi of one or 0, Running key K _R of MSB in (MSB) XORing (i.e. the polarity of bit plain text reversed by Running key K _R) and XOR (Tx) 15, inverting processing of at XOR (Tx) 15 And the base of the transmission data Xi 'corresponding to the value of the Running key K _R was, by 0,1 polarity having a base, by inverting or non-inverting the MSB of the Running key K _R, multilevel modulation plaintext bit by bit The multi-level intensity modulator 14 that generates a multi-level analog signal (ciphertext C _i ) is provided.

Here, for example, a linear feedback shift register (Linear Feedback Shift Register (LFSR)) is used for the plurality of pseudo random number generators 111 to 11m and 13 by default, and these pseudo random number generators have initial values. The connection structure is all different. Similarly, a plurality of m pseudo-random number generators 211 to 21m and 23 to be described later use LFSR, and their initial values and connection structures are all different. Here, the sender and the receiver is because the encryption communication by using the same Running key K _R, the pseudo-random number generator 111~11m pseudorandom number generator 211~21m is the initial value and the connection structure is the same.
In the figure, | K ¹ | to | K ^m | are initial keys of the pseudo random number generators 111, 112, and 11m, and K _{(1) to} K _(m) are outputs of the pseudo random number generators 111, 112, and 11m, K _R indicates a Running key.

The receiver 2 receives a plurality of m pseudorandom number generators 211, 212, 21m-1, 21m that generate a running key by generating a pseudorandom number sequence by inputting an initial cipher | k | A binary random number changer 22 that replaces the position of each block in units of m random numbers generated from the random number generators 211, 212, 21m-1, and 21m and finally outputs the Running key K _R. A pseudo random number generator 23 for generating a pseudo random number for determining a bit position for replacement in the binary random number replacer 22, and a binary random number replacer for transmission data (C _i ) received via the communication path 3. block as a threshold to which the Running key K _R to be output by removing the MSB (most significant bit) from 22, with the same 0,1 polarity as the base of the transmitting side, performing determination (discrimination) between 0 and 1 A binary detector 24 for outputting reception data of two values, one bit data received binary exclusive-ORed with the MSB of Running key K _R, and XOR (Rx) 25 for outputting the plaintext , And is configured.

In the system having such a configuration, in the transmitter 1, the transmission data Xi is generated by driving the plurality of pseudo-random number generators 111, 112, 11m-1, and 11m in parallel to generate one Running key K _R. Is modulated into a multilevel optical signal by the multilevel intensity modulator 14 and sent to the communication path 3. The receiver 2 decrypts the received data (ciphertext C _i ) based on one running key K _R generated by driving a plurality of pseudo-random number generators 211, 212, 21 m in parallel to obtain plaintext Xi. Is output.

In addition, this invention is not limited to said Example, A various deformation | transformation can be implemented.
For example, the XORs 15 and 25 shown in FIG. 1 are not necessarily required. Even without these XORs, optical communication quantum cryptography communication can be realized.
Further, each function of the transmitter 1 or the receiver 2 shown in FIG. 1 may be configured as a circuit as hardware, or at least a part thereof may be realized by software. When realized by software, the transmitter 1 or the receiver 2 has a CPU, and executes a program for realizing a predetermined function.

The figure which shows the structure of the communication system which employ | adopted optical communication quantum cryptography Y-00 in one Embodiment of this invention. The figure which shows the mode of the error mixing in the Running key series seen from an eavesdropper in one Embodiment. The relationship between the position and number of errors for each pseudorandom number generator as seen by an eavesdropper in one embodiment.

Explanation of symbols

1: transmitter, 111, 112, 11m-1, 11m, 13: pseudo-random number generator, 12: binary random number changer, 14: multi-value intensity modulator, 15: XOR,
2: Receiver 211, 212, 21m-1, 21m, 23: Pseudo random number generator,
22: binary random number changer, 24: binary detector, 25: XOR, 3: communication channel,
Xi: plaintext, Xi ': the result of XOR with plaintext and MSB of running key,
C _i : Ciphertext, | K ¹ | to | K ^m |: Initial key of each pseudo random number generator, K _R : Running key, K _{(1) to} K _(m) : Pseudo random number generator output,

Claims (12)

An optical communication quantum cipher that transmits data obtained by multi-level modulation of transmission data using a running key on the transmission side and decrypts the multi-value modulated encrypted data on the reception side using the same running key In the communication method,
On the transmission side, the output obtained by driving a plurality of pseudo-random number generators having different initial values and connection structures in parallel is regarded as one block, and a binary random number sequence per unit is replaced as a running key. Modulating value, randomizing the position and number of errors in the output random number sequence in the pseudo-random number generator,
Similarly, on the receiving side, the output obtained by driving a plurality of pseudo-random number generators having different initial values and different connection structures in parallel is regarded as one block, and a random number sequence obtained by exchanging binary random number sequences in units of one block. A communication method characterized by performing binary detection and decoding. On the transmitting side, when the least significant bit (LSB) of the Running key is 1, the upper part of the base is 1 and the lower part is 0, and when the LSB of the Running key is 0, the upper part of the base is 0, and the lower part is 1. When the LSB of the key is 1, the top of the base is 0, the bottom is 1, and when the LSB of the Running key is 0, the top of the base is 1 and the bottom is 0.
Similarly, on the receiving side, when the least significant bit (LSB) of the Running key is 1, the upper part of the base is 1 and the lower part is 0. When the LSB of the Running key is 0, the upper part of the base is 0, and the lower part is 1. Or when the LSB of the Running key is 1, the top of the base is 0, and the bottom is 1, and when the LSB of the Running key is 0, the top of the base is 1 and the bottom is 0. 2. The communication method according to claim 1, wherein:   On the sending side, after performing an exclusive OR with the plaintext and the most significant bit (MSB) of the Running key, the plaintext base is selected, the multilevel signal is determined according to the 0 and 1 polarities of the base, and the reception is received. The binary side is detected by the polarity of 0 and 1 of the same base as that of the transmission side with the block from which the most significant bit (MSB) of the Running key is removed as a threshold on the side, and the most significant bit (MSB) of the Running key after the binary detection. 2. The communication method according to claim 1, wherein an exclusive OR is performed on the same. An LFSR (linear feedback shift register) is used as the pseudo-random number generator, and the linear complexity of the equivalent LFSR that outputs the same sequence as the output running key sequence is set to be equal to the cycle of the running key. The communication method according to claim 1, 2, or 3.   5. The communication according to claim 4, wherein the structure estimation of each of a plurality of m LFSRs is performed by making the linear complexity of an equivalent LFSR that outputs the same sequence as the output Running key sequence equal to the cycle of the Running key. Method. In a transmitter for transmitting a multilevel optical signal encrypted by multilevel modulation of transmission data using a running key,
A binary random number sequence in units of blocks regarding a plurality of m pseudo random number generators having different connection structures with m types of initial values K and random number blocks generated by driving the plurality of m pseudo random number generators in parallel. A changer that generates one Running key, and a changer for changing the change position by the changer, a changer pseudo-random number generator that gives a random number to the changer, and an output from the changer And a multi-level modulator that generates encrypted data by performing multi-level modulation of transmission data in units of bits according to a value of a running key. The transmitter has an exclusive OR means for taking an exclusive OR with the plaintext as transmission data and the most significant bit (MSB) of the Running key output from the exchanger. Invert or non-invert the MSB of the running key according to the polarity of 0 or 1 determined by the least significant bit (LSB) of the running key possessed by the plaintext and the plaintext base selected by the running key 7. The transmitter according to claim 6, wherein a multi-level signal is determined by multi-level modulation. In the receiver that detects and decrypts the received encrypted data in binary using the Running key,
A binary random number sequence in units of blocks regarding a plurality of m pseudo random number generators having different connection structures with m types of initial values K and random number blocks generated by driving the plurality of m pseudo random number generators in parallel. A changer that generates one Running key, and a changer for changing the change position by the changer, a changer pseudo-random number generator that gives a random number to the changer, and an output from the changer And a binary detector for generating data obtained by decrypting the encrypted data in bit units, with a block obtained by removing the most significant bit (MSB) of the running key as a threshold value . 9. The receiver according to claim 8, further comprising an exclusive OR means for performing an exclusive OR operation on the data output from the binary detector and the MSB of the Running key from the exchange. An LFSR (linear feedback shift register) is used as the pseudo-random number generator, and the linear complexity of an equivalent LFSR that outputs the same sequence as the output running key sequence is set to be equal to the cycle of the running key. Item 9. The transmitter or receiver according to any one of Items 6 to 8. In an optical communication quantum cryptography transmission method for transmitting data encrypted by multilevel modulation of transmission data using a Running key,
Using a plurality of pseudo-random number generators having different initial values and connection structures, the binary random number sequence is replaced in units of blocks, and the position and number of errors in the output random number sequence in the pseudo-random number generator are randomized, A transmission method comprising generating the encrypted data. In an optical communication quantum cryptography receiving method for decrypting modulated encrypted data using the same Running key,
Using a plurality of pseudo random number generators with different initial values and connection structures, the binary random number sequence was replaced in units of blocks, and the error random number position and number of random numbers in the pseudo random number generator were randomized. A receiving method comprising: decrypting binary data from the encrypted data.

Images