SHARED INFORMATION GENERATION IN CONTINUOUS-VARIABLE QUANTUM KEY DISTRIBUTION SYSTEM

Shared information generation technique including key generation rate and soft-decision error correction in CV-QKD is disclosed. A receiver is configured to: set reference bit positions for basis reconciliation according to the reference bit positions with a transmitter, to generate sifted key quantization data; performs hard decision on a part of the sifted key quantization data to generate hard-decision data; perform bit position synchronization decision whether bit position synchronization is established; and in response to establishment of bit position synchronization, performs soft-decision error correction processing to generate shared information.

INCORPORATION BY REFERENCE

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2023-025203, filed on Feb. 21, 2023, the disclosure of which is incorporated herein in its entirety by reference.

BACKGROUND ART

The present invention relates to quantum key distribution techniques, and more particularly to techniques for generating shared information between a transmitter and a receiver.

Quantum key distribution (hereinafter referred to as QKD) is a well-known technique allowing secure key sharing between two remote locations by means of single-photon transmission of a sequence of random numbers as the source of a cryptographic key. The single-photon transmission quantum-mechanically assures that the cryptographic key is leak-proof, and thus achieves a high degree of confidentiality. For this reason, it is expected to be used for cryptographic communications that handle important confidential information.

As shown inFIG.1, QKD is composed of four steps: 1) very weak light transmission, 2) basis reconciliation, 3) error correction, and 4) privacy amplification.(1) There are two types of very weak light transmission: discrete-variable QKD (DV-QKD), in which a single photon is transmitted through a quantum channel; and continuous-variable QKD (CV-QKD), in which the quadrature amplitude of the light is modulated and transmitted. In DV-QKD, the presence or absence of a photon is detected using a photon detector, and the cryptographic key is generated from the detected data (see, for example, PTL 1). Accordingly, it requires special devices such as a single-photon generating source and a single-photon detector. In contrast, in CV-QKD, the state of optical field is measured by coherent detection, and the encryption key is generated from the measured data (see, for example, PTL 2). Coherent detection is a commonly used technique in long-haul and large-capacity optical communications, so it can be realized using ordinary optical components. Accordingly, CV-QKD is expected to be less expensive than DV-QKD.(2) In basis reconciliation, basis information is exchanged between the transmitter and receiver through an optical channel of normal intensity level (classical channel) to sift basis-matched bits from the received information. At that time, it is necessary for the transmitter and receiver to agree on which bit of the transmitted basis information corresponds to which bit transmitted in the quantum channel (establishment of bit position synchronization). PTL 1 discloses a method of establishing bit position synchronization based on the error rate of received information in DV-QKD.

(3) Error correction is performed on the sifted information (sifted key) obtained by basis reconciliation. In PTL 1, hard-decision values are used as input data. The hard decision is a two-level decision with respect to an arbitrary threshold value.(4) Privacy amplification is the process of generating a new random number sequence (final key) which can be obtained by deleting the amount of information that may have been leaked during key delivery based on a random number (parity calculation bits) generated in the transmitter. An eavesdropper cannot get the final key after the privacy amplification without knowing all of the parity calculation bits.

PATENT LITERATURE

SUMMARY

As described above, it is necessary to establish synchronization of bit positions between the transmitter and receiver in a QKD system. The establishment of synchronization of bit positions is a prerequisite for the key generation flow. The final key cannot be generated unless synchronization is established.

PTL 1 discloses a bit position synchronization method based on DV-QKD, which judges the success or failure of establishing bit position synchronization by calculating the bit error rate of the sifted key obtained by hard decision. Accordingly, error correction after having established synchronization is also limited to hard-decision error correction.

Unlike hard-decision error correction, soft-decision error correction is more complex to implement, but is expected to significantly improve error correction performance and increase the key generation rate. However, the bit position synchronization method of PTL 1 needs to be limited to hard-decision error correction. PTL 2 is silent on error correction for CV-QKD.

The sifted key obtained by basis reconciliation is subjected to hard-decision error correction inputting hard-decision values as described in PTL 1. Accordingly, in CV-QKD, the bit position synchronization described in PTL 1 cannot be performed until after the completion of error correction.

However, error correction often fails. When error correction fails, it is difficult to determine whether the failure is due to loss of synchronization of bit positions in basis reconciliation or failed error correction. The handling of data that error correction fails is dependent on system implementation. For example, data that error correction fails may be discarded or error correction may be performed again.

In the method of discarding failed data, the data is discarded even when error correction fails due only to loss of synchronization of bit positions during basis reconciliation. In other words, the data is discarded even when error correction fails due to misalignment of bit positions during basis reconciliation, even though the sequence of the data is correct. As a result, the key generation rate is reduced.

In addition, the method of redoing error correction increases the computational load when soft-decision error correction is employed in CV-QKD. Furthermore, as described above, it is necessary to perform the bit position synchronization decision after error determination, which increases the feedback loop, resulting in a reduction in throughput and, consequently, a reduction in the key generation rate.

Therefore, an object of the present invention is to provide a shared information generation technique that can improve key generation rate when performing soft-decision error correction in CV-QKD.

According to an aspect of the invention, a communication device connected to another communication device through a first channel and a second channel in a continuous-variable quantum key distribution (CV-QKD) system, the communication device includes: a quantum unit configured to receive signal light from the another communication device through the first channel to generate received quantization data by coherent detection, wherein the signal light is quadrature-modulated according to a first random number sequence and a second random number sequence which have predetermined bit positions at the another communication device; and at least one processor configured to generate shared information from the received quantization data by communicating with the another communication device through the second channel, wherein the at least one processor is further configured to: a) set reference bit positions for basis reconciliation with the another communication device, wherein the basis reconciliation generates sifted key quantization data from the received quantization data according to the reference bit positions; b) perform hard decision on a part of the sifted key quantization data to generate hard-decision data; and c) perform bit position synchronization decision whether bit position synchronization is established between the hard-decision data and sifted key data which is obtained by the basis reconciliation at the another communication device, d) in response to establishment of bit position synchronization, perform soft-decision error correction processing between the communication device and the another communication device to generate the shared information.

According to an aspect of the invention, a communication control method at a communication device connected to another communication device through a first channel and a second channel in a continuous-variable quantum key distribution (CV-QKD) system, the method includes: by a quantum unit, receiving signal light from the another communication device through the first channel to generate received quantization data by coherent detection, wherein the signal light is quadrature-modulated according to a first random number sequence and a second random number sequence which have predetermined bit positions at the another communication device; and by at least one data processor, a) setting reference bit positions for basis reconciliation with the another communication device, wherein the basis reconciliation generates sifted key quantization data from the received quantization data according to the reference bit positions; b) performing hard decision on a part of the sifted key quantization data to generate hard-decision data; and c) performing bit position synchronization decision whether bit position synchronization is established between the hard-decision data and sifted key data which is obtained by the basis reconciliation at the another communication device; and d) in response to establishment of bit position synchronization, performing soft-decision error correction processing between the communication device and the another communication device to generate the shared information.

According to an aspect of the present invention, a method for generating shared information by continuous-variable quantum key distribution (CV-QKD) between a first communication device and a second communication device connected through a first channel and a second channel, the method includes: a) at the first communication device, transmitting signal light to the second communication device through the first channel, wherein the signal light is quadrature-modulated according to a first random number sequence and a second random number sequence which have predetermined bit positions at the first communication device; b) at the second communication device, generating received quantization data by performing coherent detection of signal light arriving through the first channel; c) at the second communication device, setting reference bit positions for basis reconciliation with the first communication device, wherein the basis reconciliation generates sifted key quantization data from the received quantization data according to the reference bit positions; and at the first communication device, generating sifted key data by the basis reconciliation from the second random number sequence; d) at the second communication device, performing hard decision on a part of the sifted key quantization data to generate hard-decision data; e) at one of the first and second communication devices, performing bit position synchronization decision whether bit position synchronization is established between the hard-decision data and the sifted key data, f) in response to establishment of bit position synchronization, performing soft-decision error correction processing between the first communication device and the second communication device to generate the shared information.

According to the present invention, it is possible to improve the error correction performance and the key generation rate by checking the synchronization of bit positions in basis reconciliation before soft-decision error correction in CV-QKD.

DETAILED DESCRIPTION

Outline of Example Embodiments

According to an example embodiment of the present invention, a hard decision is partly made to establish synchronization of bit positions in basis reconciliation before performing a soft-decision error correction process. More specifically, assuming that a CV-QKD system includes a transmission-side communication device (first communication device or transmitter) and a reception-side communication device (second communication device or receiver), the CV-QKD system operates as follows. The receiver makes hard decision on a part of sifted key quantization data obtained by basis reconciliation. The synchronization decision of bit positions is made based on the hard decision data thus obtained and the sifted key data on the transmitter.

When bit position synchronization has been established, data used for hard decision is discarded. Subsequently, the remaining sifted key quantization data on the receiver and the remaining sifted key data on the transmitter are used to perform the soft-decision error correction process, thereby generating shared information at both of the transmitter and receiver.

As described above, the establishment of synchronization of bit positions in basis reconciliation is completed before soft-decision error correction, allowing suppressed error correction failures due to synchronization error in bit positions. In addition, employing soft-decision error correction in CV-QKD improves error correction performance, resulting in increased key generation rate. Hereinafter, the example embodiments and examples of the present invention will be described in detail with reference to the drawings.

1.1) System Configuration

As illustrated inFIG.2, a CV-QKD system according to the present embodiment includes a transmitter10and a receiver20, which are connected by a quantum channel31and a classical channel32. Here, the quantum channel31is a communication channel through which very weak signal light is transmitted from the transmitter10to the receiver20. The very weak signal light has an optical power of less than 1 photon/bit. Accordingly, the quantum channel is a relatively lossy, noisy and error-prone channel, which means that the quantum channel is less reliable than a normal or classical channel.

The classical channel32is a commonly-used communication channel through which optical signals at normal intensities are transmitted. Accordingly, the classical channel32is a substantially error-free communication channel and has sufficiently high communication reliability. For this reason, the classical channel32is used to exchange information necessary for the transmitter10and receiver20to perform basis reconciliation, error correction, and privacy amplification. The quantum channel31and the classical channel32may be physically separate transmission channels, or may be multiplexed into a single optical transmission channel.

The transmitter10includes the following functional sections: a quantum (Q) unit100that transmits very weak signal light for CV-QKD; a data processor101that implements key generation processing functions; a random number generator (RNG)102; a random number (RN) memory103; a sifted key data storage section104; a corrected key storage section105; and a final key storage section106. Note that data communication with the receiver20through the classical channels may be performed through a communication unit (not shown inFIG.2).

Random numbers generated by the random number generator102are stored in the random number memory103. The random numbers stored in the random number memory103are accessed by the data processor101in the key generation process as described below, and are supplied as key source K0and basis A. Under the control of the data processor101, the quantum unit100transmits very weak signal light quadrature-modulated according to the random numbers (key sources K0and basis A) to the receiver20through the quantum channel31.

The data processor101may include at least one processor, which implements a function of controlling the general transmission operation of the transmitter10and a key generation function. The key generation function includes a basis reconciliation section101a, synchronization decision section101b,soft-decision error correction section101c,and privacy amplification section101d,which will be described below. The key generation function may be implemented by software running on at least one processor such as CPU (Central Processing Unit), or by hardware such as FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit). The sifted key data SSKgenerated by the basis reconciliation section101ais stored in the sifted key data storage section104. The corrected key K1Awhich is first shared information generated by the soft-decision error correction section101cis stored in the corrected key storage section105. The final key QKAgenerated by the privacy amplification section101dis stored in the final key storage section106.

The receiver20includes a quantum (Q) unit200that receives very weak signal light for CV-QKD, a data processor201that implements a key generation processing function, a received quantization data storage section202, a sifted key quantization data storage section203, a corrected key storage section204, and a final key storage section205. Note that data communication with the transmitter10through the classical channel32may be performed through a communication section (not shown inFIG.2).

The data processor201implements a function of controlling the general reception operation of the receiver20and a key generation function. The key generation function includes a basis reconciliation section201a,hard decision section201b,soft-decision error correction section201c,and privacy amplification section201d,which will be described below. The key generation function may be implemented by software running on a processor such as a CPU (Central Processing Unit) or by hardware such as an FPGA or ASIC.

The quantum unit200receives the very weak signal light arriving from the transmitter10through the quantum channel31and stores the received quantization data SQ-RCVin the received quantization data storage section202as described below. The data processor201accesses the received quantization data SQ-RCVin the process of generating a quantum key as described below. The sifted key quantization data SQ-SKgenerated by the basis reconciliation section201ais stored in the sifted key quantization data storage section203A corrected key K1B, which is second shared information generated by the soft-decision error correction section201c,is stored in the corrected key storage section204. A final key QKBgenerated by the privacy amplification section201dis stored in the final key storage section205.

1.2) Key Generation Process

As illustrated inFIG.3, the CV-QKD system according to the present example embodiment sequentially performs the following operations: very weak light transmission S301, basis reconciliation S302, hard decision S303at the receiver20, synchronization decision S304based on the error rate of data subjected to hard decision, basis position setting change S305, soft-decision error correction S306, and privacy amplification S307. These operations are sequentially performed to generate the final keys QKAand QKB. The detailed description will be given with reference toFIGS.3-7.

Very Weak Light Transmission

As illustrated inFIGS.4and5, it is assumed that the quantum unit100of the transmitter10transmits very weak signal light quadrature-modulated according to key source K0and basis A (S301). The key source K0is a sequence of random numbers from which a final key is generated. The basis A is also a sequence of random numbers consisting of 0/1 which is denoted by x/+, respectively, for the sake of explanation. A random number sequence of key source K0and basis A may be framed every predetermined number of random numbers. The random numbers in each frame may be numbered as illustrated inFIG.4. In an example as shown inFIG.4, a second bit position (bit number=1) is indicated by a pair of key source K0=“0” and basis A=“+”. The transmitter10can inform the receiver20of the bit number or basis information through the classical channel32.

As illustrated inFIG.5, a 2-bit random number consisting of key source K0and basis A is mapped to one of the four signal points on the IQ plane (IQ modulation). For example, if the basis A=“x”, then a key source K0=“1” is placed at the signal point (x, 1) and K0=“0” is placed at the signal point (x, 0). In other words, I and Q signals with a phase difference of 90° Correspond to the values (+/×) of basis A, respectively, and the respective signal values 0/1 correspond to the key source K0. In other words, when the basis A=“+”, amplitude modulation is performed along the I axis, and when A=“×”, amplitude modulation is performed along the Q axis.

Such IQ modulation can be achieved by a Mach-Zehnder QPSK (Quadrature Phase Sifted keying) modulator. InFIG.5, a phase modulation of depth 0° is performed when (base A, key source K0)=(+, 0) and a phase modulation of depth 180° when (A, K0)=(+, 1). A phase modulation of depth 90° is performed when (A, K0)=(×, 0) and a phase modulation of depth 270° is performed when (A, K0)=(×, 1). In other words, the very weak light is subjected to any one of phase modulations of 0°, 90°, 180° and 270° depending on a random sequence of key source K0and basis A and is transmitted from the quantum unit100to the receiver20through the quantum channel31.

If no quantum fluctuation exists, there would be no variation in the measured values at the receiver20as shown in the transmission signal constellation ofFIG.5. However, quantum fluctuations cause variations in the amplitude measurements of the received signal. The received state caused by quantum fluctuations may be illustrated as the received quantization data SQ-RCVofFIG.6.

As illustrated inFIG.6, the received quantization data SQ-RCVmay be imaged as partially overlapping distributions of four states of quadrature amplitude. Accordingly, they cannot in principle be clearly distinguished. Especially when the optical power of the very weak light is less than one photon/bit, it becomes difficult to precisely distinguish which state the received data is in. The received quantization data SQ-RCVis quantization data of the received signal as a continuous state in which the distributions of four states of quadrature amplitude partially overlap. The data processor201of the receiver20numbers the bits in sequence as reference bit positions and stores the receive quantization data SQ-RCVtogether with the reference bit positions in the received quantization data storage section202.

Basis Reconciliation

As illustrated inFIG.6, if the basis A (+ or ×) of the very weak light generated by the transmitter10is shown, then the receiver20can perform basis reconciliation according to the reference bit position based on the basis information to generate sifted key quantization data SQ-SK(S302inFIG.3). Assuming that the reference bit positions are correct, if the basis A is “+”, then the I axis is selected for the received quantization data SQ-RCVto generate quantization data which is one of two regions on the I axis of IQ plane (correct basis). If basis A is “x”, then the Q axis is selected for the received quantization data SQ-RCVto yield quantization data which is one of two regions on the Q axis of IQ plane. Accordingly, the two regions on the Q axis is rotated −90° to produce quantization data which is one of the two regions on the I axis (correct basis). In this manner, the correct basis reconciliation is performed at the correct reference bit positions, allowing sifted key quantization data to be generated. As described later, this sifted key quantization data can be subjected to the soft decision processing to determine a symbol value corresponding to the sifted key quantization data.

In contrast, if there is a misalignment of reference bit positions between the transmitter10and the receiver20, basis reconciliation is performed based on erroneous basis, making correct symbol determination impossible (wrong basis). More specifically, assuming that a transmission basis A is “+” but a reception basis is “x” due to the misalignment of reference bit positions, the basis reconciliation performed based on erroneous basis generates only quantization data distributed near the origin of the IQ plane as labeled with “wrong basis” inFIG.6. Such quantization data makes it impossible to determine which symbol the sifted key quantization data SQ-RCVcorresponds to.

There are two methods for basis reconciliation S302. The first method is that the transmitter10transmits all the bases A to the receiver20through the classical channel32. The second method is that the basis A of the transmitter10is compared to the basis B of the receiver20through the classical channel32, and only the matched basis is adopted. These methods will be described in detail in first and second examples, respectively.

In the transmitter10, the data processor101generates sifted key data SSKfrom the key source K0according to all or some bases adopted by the basis reconciliation and stores them in the sifted key data storage section104. In receiver20, the data processor201sets reference bit positions for generating shared key, generates sifted key quantization data SQ-SKaccording to the bases adopted by basis reconciliation, and stores it in the sifted key quantization data storage203.

Synchronization Decision Based on Hard Decision

The data processor201of the receiver20reads a predetermined frame portion of the sifted key quantization data SQ-SKand performs a hard decision to determine a value of 0 or 1 with respect to at least one threshold value for quantization of that predetermined frame portion (S303inFIG.3). The hard-decision data of the predetermined frame portion is compared with the data of a counterpart frame portion of the sifted key data SSKin the transmitter10to calculate an error rate.

If the error rate is not greater than a predetermined threshold, the synchronization is judged as OK. If the error rate exceeds the predetermined threshold, specifically in the neighborhood of 50% (within a predetermined range), the synchronization is judged as NG (S304inFIG.3). If the hard-decision data and the counterpart data of the sifted key data SSKare randomly different, there will be no correlation at all between the transmitter10and receiver20, and the error rate may be distributed in the neighborhood of 50%. Accordingly, the predetermined threshold can be set to a value smaller than 50%, e.g., between 15 and 50%, so that synchronization determination is made effectively possible.

As illustrated inFIG.7, hard decision is performed on a predetermined frame portion FHD(about several percent of the frame length) at the beginning of a received frame F in the sifted key quantization data SQ-SK. It is assumed inFIG.7that the time axis indicates the direction from bit number0to n−1 of the received frame F with respect to first reference bit positions. Sifted key quantization data indicated by bit numbers0−i (first frame portion FHD, or a portion on the time axis) of the received frame F is subjected to hard-decision to obtain hard-decision data. Since reference bit positions (bit numbers) are used as reference, the random number sequence of a frame in the sifted key quantization data SQ-SKcan be changed by sequentially incrementing the bit numbers by +1 to shift the reference bit positions. In this manner, the resultant hard decision data can be changed.

As described above, the error rate is calculated from the hard-decision data and the corresponding portion of the sifted key data SSKgenerated at the transmitter10. If the error rate is smaller than or equal to the predetermined threshold (synchronization OK), the first frame portion 1st-FHDused for hard decision is discarded and the remaining bit numbers (i+1) to (n−1) of the sifted key quantization data SQ-SKis used for soft-decision error correction processing, as described below.

If the error rate exceeds the predetermined threshold (synchronization NG), the data processor201changes the first reference bit positions to the second reference bit positions as described above (S305inFIG.3), thereby performing hard decision on the second frame portion 2nd-FHDin the sifted key quantization data SQ-SKto do the synchronization decision. As an example, the setting of the reference bit positions may be simply changed by sliding the reference bit positions by a predetermined number of bits (S305inFIG.3).

If synchronization is NG, the same synchronization decision may be repeated a predetermined number of times while discarding a predetermined frame portion used for error rate calculation. However, if synchronization is not established even after repeating the synchronization decision a predetermined number of times, the frame in question may be discarded and the synchronization decision may be performed for the next frame. The error rate for synchronization decision is calculated from the hard decision data obtained at the receiver20and the corresponding portion of the sifted key data obtained at the transmitter10. Accordingly, the synchronization decision may be performed at either the transmitter10or the receiver20.

Soft-Decision Error Correction

If synchronization is OK at synchronization decision S304(seeFIG.3), the data processor201of the receiver20executes the soft-decision error correction processing on the remaining quantization data SQ-SKby communicating with transmitter10(S306inFIG.3). As described in detail below, the data processor201calculates error correction information (syndrome) for soft-decision error correction and transmits it to the transmitter10. The data processor101of the transmitter10uses the syndrome to correct the sifted key data SSK, thereby generating a corrected key K1A. The data processor201of the receiver20generates a corrected key K1Bby performing hard decision on the remaining quantization data SQ-SK.

Privacy Amplification

When the corrected keys K1Aand K1Bhave been generated at the transmitter10and the receiver20, respectively, the data processors101and201execute the privacy amplification processing (S307inFIG.3). The privacy amplification is a process of removing the amount of information that may have been leaked during the key generation process and generating new random numbers as final keys QKAand QKB, respectively.

As described above, according to the present example embodiment, the receiver performs hard decision on a portion of the sifted key quantization data obtained by basis reconciliation. The hard-decision data and the sifted key data generated at the transmitter are used to perform synchronization decision of bit positions.

When synchronization is established, the data used for synchronization decision between the transmitter10and the receiver20are discarded, and the remaining sifted key quantization data at the receiver and the remaining sifted key data at the transmitter are used to perform soft-decision error correction processing. As a result, shared information (corrected key K1Aand corrected key K1B) is generated in both of the transmitter and the receiver.

According to the present example embodiment, the establishment of synchronization of bit positions in basis reconciliation is confirmed by hard-decision of a portion of the quantization data on the receiver before performing the soft-decision error correction. This can suppress error correction failures caused by synchronization errors in bit position, thereby improving error correction performance and key generation rate in CV-QKD.

Even if the bit positions are out of synchronization, the bits of received data are renumbered to generate shared information again without terminating the key generation flow. In this manner, in the CV-QKD system, even if the synchronization is lost, the received quantization data generated by QKD can be used as it is for the synchronization decision, allowing stable and fast key generation in CV-QKD.

2. First Example

2.1) System Configuration

As illustrated inFIG.8, it is assumed that a CV-QKD system according to a first example of the present invention includes a transmitter10and a receiver20which are connected through a quantum channel31and a classical channel32, as in the case of the QKD system shown inFIG.2. Hereafter, blocks similar to those previously described with reference toFIG.2are denoted by the same reference numerals to simplify their explanations.

The transmitter10according to the present example includes a quantum unit100, a data processor101, a sifted key data storage section104, a random number generator102and a random number memory103, a corrected key storage section105and a final key storage section106, as in the above example embodiment. However, inFIG.8, some blocks are omitted for simplification.

The quantum unit100of the transmitter10includes a laser source110, an IQ modulator111, and a variable attenuator (VOA)112. In actuality, the IQ modulator111may be a dual-polarization IQ modulator which includes an IQ modulator for X polarization and an IQ modulator for Y polarization. The respective IQ-modulated optical signals are polarization-multiplexed and transmitted as very weak light. Each IQ modulator may be composed of two Mach-Zehnder modulators connected in parallel. A dual-polarization IQ modulator may be composed of two IQ modulators each composed of two Mach-Zehnder modulators for each polarization.

The data processor101controls the IQ modulator111according to key source K0and basis A. The IQ modulator111modulates laser light emitted from the laser source110as shown inFIG.5. The variable attenuator112attenuates the IQ-modulated laser light to a very weak level with an optical power of less than 1 photon/bit. The very weak light LQthus obtained is transmitted to the receiver20through the quantum channel31.

The receiver20according to the present example includes a quantum unit200, a data processor201, a received quantization data storage section202, a sifted key quantization data storage section203, a corrected key storage section204and a final key storage section205, as in the above example embodiment. However, inFIG.8, some blocks are omitted for simplification.

The quantum unit200of the receiver20includes a local laser source210, a 90° hybrid211, balanced receivers (BDs), analog-to-digital converters (ADCs), and a digital signal processor (DSP)212. In the case of dual-polarization IQ modulation system as described above, a detection module is provided, which polarization-demultiplexes the very weak light LQRCVarriving through the quantum channel31. The detection module includes the 90° hybrid211, BDs and ADCs for each of X and Y polarizations.

The 90° hybrid211inputs the weak light LQRCVand local laser light LO and interferes with them to extract the I and Q components of the electric field of the weak light LQRCV(coherent detection). These I and Q components are converted into electrical signals by BDs and sampled by ADCs, respectively. The DSP212performs wavelength dispersion compensation, polarization demultiplexing and equalization, etc. on the sampled I and Q components to output the received quantization data SQ-RCV.

As described above, the reception method using interference of the very weak light LQRCVand the local laser light LO is referred to as coherent detection. In coherent detection, the optical amplification effect of signal light can be obtained by interfering the signal light with the local light of a strong optical power. Accordingly, even if the power of the signal light is very weak, less than 1 photon/bit, it can be detected using a general photodetector.

Particularly, in the field of digital coherent optical receivers, an intradyne method is in the mainstream. The intradyne method does not require frequency agreement between the very weak light LQRCVand the local laser light LO, but allows some frequency offset. Since effects of beat frequency due to the frequency offset can be compensated for in the DSP212, the intradyne method has advantages such that the need for high-precision wavelength control of the local laser source210can be eliminated.

When the received quantization data SQ-RCVis obtained as described above, a final key is generated by the key generation process as illustrated inFIG.9. The key generation process can be performed by executing computer programs on the data processor101of the transmitter10and the data processor201of the receiver20. Such computer programs are stored in a program memory120of the transmitter10and a program memory220of the receiver20, respectively.

2.2) Key Generation Process

Referring toFIG.9, the data processor101of the transmitter10drives the IQ modulator111with random numbers as key source K0and basis A (+basis, x basis), and transmits very weak IQ-modulated light LQthrough the quantum channel31(operation S401). The quantum unit200of the receiver20performs coherent detection of the arriving weak light LQRCV. The data processor101assigns a serial bit number as reference bit position to each bit of received data and stores the received quantization data SQ-RCVtogether with the reference bit positions in the received quantization data storage section202.

When the very weak light transmission with the key source K0and basis A has been completed, the data processor101of the transmitter10notifies the random numbers (+, ×) of basis A used for the very weak light transmission to the receiver20through the classical channel32(operation S402).

Based on the reference bit positions, the data processor201of the receiver20performs basis reconciliation of the received quantization data SQ-RCVaccording to the basis A received from the transmitter10as illustrated inFIG.6(operation S403). The basis reconciliation generates sifted key quantization data SQ-SK, which is stored in the sifted key quantization data storage section203. Meanwhile, the data processor101of the transmitter10has notified all basis A to the receiver20, and then stores the corresponding key source K0as sifted key data SSKin the sifted key data storage section104.

Subsequently, the data processor201of the receiver20reads a predetermined frame portion FHDof the sifted key quantization data SQ-SK, and performs hard decision on the predetermined frame portion FHDof the sifted key quantization data to generate hard-decision data (operation S404). The data processor201transmits the hard-decision data to the transmitter10through the classical channel32(operation S405).

The data processor101of the transmitter10compares the received hard-decision data with the corresponding sifted key data SSKto calculate an error rate (operation S406). The data processor101performs synchronization decision (synchronization NG or OK) depending on whether the error rate is greater than a predetermined threshold (operation S407). If the error rate is less than or equal to the predetermined threshold, the decision is made that synchronization is OK, and if the error rate exceeds the predetermined threshold, the decision is made that synchronization is NG. The predetermined threshold may be set at a value within the range 15 to 50% so that the amount of information leaked to eavesdroppers does not exceed that shared by the sender and receiver.

The data processor101notifies the result of synchronization decision (NG or OK) to the receiver20through the classical channel32(operation S408). If the synchronization decision is synchronization NG, the data processor201of the receiver20shifts the reference bit positions (bit numbers) by one bit (operation S410). Shifting the reference bit positions generates new bit numbers, by which basis reconciliation (S403), generation of hard decision data (S404), and synchronization decision (S405-S409) are executed with bases corresponding respectively to the new bit numbers.

If the result of synchronization decision is OK, the data processor201of the receiver20discards the data used for error rate calculation and performs soft-decision error correction (encoding) on the remaining sifted key quantization data to calculate error correction information, that is, syndrome (operation S412). The syndrome is calculated from the remaining sifted key quantization data SQ-SKand the predetermined check matrix, and is transmitted to the transmitter10through the classical channel32(operation S413).

The data processor101of the transmitter10discards the data used for error rate calculation from the sifted key data SSKand stores the remaining sifted key data. The data processor101then corrects the remaining sifted key data using the syndrome received from the receiver20and the predetermined check matrix to generate the corrected key K1A(operation S411).

The data processor201of the receiver20also generates the corrected key K1Bby performing hard decision of the remaining sifted key quantization data. The final keys QKAand QKBare generated, as described inFIG.3, by executing the privacy amplification processing on the corrected keys K1Aand K1B.

If the number of synchronization NGs exceeds a predetermined number, the data processor201discards the current frame and terminates the process, thereby allowing basis reconciliation for the next frame to be performed with reference bit positions shifted by one bit.

As described above, according to the first example, it is possible to establish the synchronization of bit positions in basis reconciliation by performing hard decision of a part of the quantization data in the receiver before soft-decision error correction. This can suppress error correction failures caused by synchronization error of bit positions, thereby improving error correction performance and key generation rate in CV-QKD.

Further, according to the first example, the transmitter10notifies all of the basis A to the receiver20, allowing the receiver20to perform basis reconciliation using the basis A. Accordingly, the advantage is that the sifted key generation efficiency is greatly increased since the key is not reduced in the basis reconciliation.

3. Second Example

3.1) System Configuration

As illustrated inFIG.10, it is assumed that a CV-QKD system according to a second example of the present invention includes a transmitter10and a receiver20which are connected through a quantum channel31and a classical channel32, as in the case of the first example shown inFIG.8. Hereinafter, the functions that differ from those in the first example will be mainly described, and blocks similar to those previously described with reference toFIG.8are denoted by the same reference numerals to simplify their explanations.

The transmitter10according to the present example includes a quantum unit100, a data processor101, a sifted key data storage section104, a random number generator102and a random number memory103, a corrected key storage section105and a final key storage section106, as in the above example embodiment. Note that inFIG.10some blocks are omitted for simplification.

The quantum unit100of the transmitter10includes a laser light source130, a phase modulator (PM)131, an non-polarizing beam splitter BSa, a variable attenuator (VOA)132, and a polarizing beam splitter PBSa. The beam splitter BSa splits a light pulse input from the laser light source130into a reference light pulse LO on a reference path and a signal light pulse on a signal path at a predetermined split ratio. The split ratio is a value at which the reference pulse has a sufficiently greater intensity than the signal pulse, e.g., reference light intensity:signal light intensity=99:1.

The reference light pulse LO on the reference path enters the polarizing beam splitter PBSa as it is (or through a phase modulator not shown). The reference light pulse LO is reflected by the polarizing beam splitter PBSa to become a reference light pulse of the specified linear polarization and is transmitted to the receiver20through the quantum channel31. The signal light pulse on the signal path enters the polarizing beam splitter PBSa as a very weak signal light pulse LQthrough the phase modulator131and variable attenuator132. The very weak signal light pulse LQpasses through the polarizing beam splitter PBSa and becomes a signal light pulse of linearly polarized light orthogonal to the reference light pulse. Such a signal light pulse is transmitted through the quantum channel31to the receiver20.

In the present example, the data processor101controls the phase modulator131such that signal light pulses are phase-modulated according to four depths 0, π/2, π, and 3π/2 corresponding to a random sequence of key source K0and basis A as shown inFIG.5. The signal light pulses thus phase-modulated becomes a very weak light pulse LQof less than one photon/bit by the variable attenuator132. Such very weak signal light pulses pass through the polarizing beam splitter PBSa and are transmitted to the receiver20through the quantum channel31.

As in the first example, the phase modulator131may be a dual-polarization QPSK modulator. In the dual-polarization QPSK modulator, QPSK modulators are provided for X and Y polarizations, respectively. The QPSK-modulated optical signals are multiplexed and transmitted as very weak light.

The receiver20according to the present example includes a quantum unit200, a data processor201, a received quantization data storage section202, a sifted key quantization data storage section203, a corrected key storage section204and a final key storage section205. Note that inFIG.10some blocks are omitted for simplification.

The quantum unit200of the receiver20includes a polarizing beam splitter PBSb, a phase modulator (PM)231, a non-polarizing beam splitter BSb, photodetectors PD1and PD2, a subtraction calculator SUB, and an analog-to-digital converter ADC. Light pulses arriving from transmitter10through quantum channel31are split by the polarizing beam splitter PBSb into received signal light pulse LQRCVand received reference light pulse LORCV.

The received signal light pulse LQRCVenters one input port of the beam splitter BSb as it is (or through a phase modulator not shown). The received reference light pulse LORCVis modulated by the phase modulator231and enters the other input port of the beam splitter BSb. The phase modulator231is driven by the data processor201according to a random number, the basis B (+, x). In this example, the basis B (+, ×) corresponds to the depths of phase modulation (0, π/2), respectively. The received signal light pulse LQRCVand the phase-modulated received reference light pulse LORCVenter the beam splitter BSb.

The beam splitter BSb has transmittance and reflectance in equal proportions, which superimposes the received signal light pulse LQRCVand the received reference light pulse LORCVto output two outgoing beams to the photodetectors PD1and PD2, respectively. Accordingly, the beam splitter BSa of the transmitter10and the beam splitter BSb of the receiver20constitute one interferometer.

The subtraction calculator SUB inputs detection signals of the photodetectors PD1and PD2to calculate a difference between the detection signals and outputs a difference signal SRCVto the ADC. The ADC quantizes the difference signal SRCVto output the received quantization data SQ-RCV, which is stored in the received quantization data storage section202.

The receiving method that configures the interferometer as described above to interfere the received signal light pulse LQRCVwith the received reference light pulse LORCVis referred to as self-homodyne detection, which has the advantage that compensation for a wavelength difference between signal light and local light is not required. Self-homodyne detection also uses reference light with high optical power to obtain the optical amplification effect of the signal light. Accordingly, even when the power of the signal light is very weak, less than one photon/bit, it can be detected using a general photodetector.

When the received quantization data SQ-RCVis obtained as described above, the final key is generated by the key generation process as illustrated inFIG.11. The following key generation process can be implemented by executing a computer program stored in the program memory140on the data processor101of the transmitter10and a computer program stored in the program memory240of the receiver20on the data processor201.

3.2) Key Generation Process

Referring toFIG.11, the data processor101of the transmitter10drives the phase modulator131with random numbers as key source K0and basis A (+basis, x basis), and transmits a very weak and phase-modulated signal light pulse LQand a reference light pulse LO through the quantum channel31(operation S501). The data processor101of transmitter10also transmits the bit numbers of the key source K0and basis A to the receiver20through classical channel32.

The data processor201of the receiver20drives the phase modulator231of the quantum unit200according to basis B on receiving side to phase-modulate the received reference light pulse LORCV. The quantum unit200outputs the received quantization data SQ-RCVby coherent detection of interfering the received reference light pulse LORCVphase-modulated by the phase modulator231with the received signal light pulse LQRCV. The data processor201assigns a sequential bit number as reference bit position and stores the receive quantization data SQ-RCVtogether with the reference bit positions in the receive quantization data storage section202.

Subsequently, the data processor201of the receiver20informs the transmitter10of the receiver's basis B through the classical channel32(operation S502).

The data processor101of the transmitter10performs basis reconciliation by matching the basis B received from the receiver20with the basis A of the key source K0to store the sifted key data SSKin the sifted key data storage section104(operation S503). In addition, the data processor101notifies the receiver20through the classical channel32of the bit number whose bases A and B match with each other (operation S504).

When receiving bit numbers with matched bases, the data processor201of the receiver20performs basis reconciliation of the received quantization data SQ-RCVstored in the received quantization data storage section202according to the reference bit positions (operation S505). The sifted key quantization data SQ-SKthus generated from the received quantization data SQ-RCVis stored in the sifted key quantization data storage section203.

Hereinafter, the same data processing as in the first example is performed. That is, the data processor201of the receiver20performs hard-decision of the predetermined frame portion FHDof the sifted key quantization data SQ-RCVto generate hard-decision data (operation S404) and transmits the hard-decision data to the transmitter10through the classical channel32(operation S405).

The data processor101of the transmitter10calculates the error rate by comparing the received hard-decision data to the corresponding sifted key data SSK(operation S406), and performs synchronization decision of synchronization NG or OK (operation S407). The synchronization decision result (NG or OK) is notified to the receiver20through the classical channel32(operation S408).

If the synchronization decision is synchronization NG, the data processor201of the receiver20shifts the reference bit positions (bit numbers) by one bit (operation S410). Shifting the reference bit positions generates new bit numbers, by which basis reconciliation (S403), generation of hard decision data (S404), and synchronization decision (S405-S409) are executed with bases corresponding respectively to the new bit numbers. If synchronization NG exceeds a predetermined number of times, the data processor201discards the current frame and terminates the process, thereby allowing basis reconciliation for the next frame to be performed with reference bit positions shifted by one bit.

If the result of synchronization decision is OK, the data processor201of the receiver20discards the data used for error rate calculation and performs soft-decision error correction (encoding) on the remaining sifted key quantization data to calculate error correction information, that is, syndrome (operation S412). The syndrome is calculated from the remaining sifted key quantization data SQ-SKand the predetermined check matrix, and is transmitted to the transmitter10through the classical channel32(operation S413).

The data processor101of the transmitter10discards the data used for error rate calculation from the sifted key data SSKand stores the remaining sifted key data. The data processor101then corrects the remaining sifted key data using the syndrome received from the receiver20and the predetermined check matrix to generate the corrected key K1A(operation S411).

The data processor201of the receiver20also generates the corrected key K1Bby performing hard decision of the remaining sifted key quantization data. The final keys QKAand QKBare generated, as described inFIG.3, by executing the privacy amplification processing on the corrected keys K1Aand K1B.

As described above, according to the second example, it is possible to establish the synchronization of bit positions in basis reconciliation by performing hard decision of a part of the quantization data in the receiver before soft-decision error correction. This can suppress error correction failures caused by synchronization error of bit positions, thereby improving error correction performance and key generation rate in CV-QKD.

Further, according to the second example, both the transmitter10and the receiver20generate random numbers and then generate sifted keys only with data whose bases match, allowing efficient generation of sifted keys and improved security.

4. Additional Notes

The present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The above-described illustrative embodiment and examples are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Part or all of the above-described illustrative embodiments can also be described as, but are not limited to, the following additional notes.

A method for generating shared information by continuous-variable quantum key distribution (CV-QKD) between a first communication device and a second communication device connected through a first channel and a second channel, the method comprising:a) at the first communication device, transmitting very weak light to the second communication device through the first channel, wherein the very weak light is quadrature-modulated according to a first random number sequence and a second random number sequence, each of which has bit positions relatively determined;b) at the second communication device, generating received quantization data by performing coherent detection of very weak light received through the first channel;c) at the second communication device, setting reference bit positions for shared information generation; and generating sifted key quantization data from the received quantization data based on at least first part of the first random number sequence; at the first communication device, generating sifted key data from second part of the second random number sequence corresponding to the at least first part;d) at the second communication device, generating hard-decision data for bit position synchronization decision by performing hard decision of a part of the sifted key quantization data;e) if bit position synchronization is established between the hard-decision data and the sifted key data, at the first communication device, discarding a part of the sifted key data used for the bit position synchronization decision to generate remaining sifted key data; at the second communication data, discarding the part of the sifted key quantization data used for the hard decision to generate remaining sifted key quantization data; andf) at the first communication device and the second communication device, generating shared information by performing soft-decision error correction processing on the remaining sifted key data and the remaining sifted key quantization data.

The method according to additional note 1, wherein the e) further comprises, if the bit position synchronization is not established, returning to the c) to change setting of the reference bit positions.

The method according to additional note 2, wherein the c) further comprises shifting the reference bit positions by one bit.

The method according to any one of additional notes 1-3, wherein in the e), one of the first communication device and the second communication device determines whether the bit position synchronization is established or not, based on an error rate calculated from the hard-decision data and a corresponding part of the sifted key data.

The method according to any one of additional notes 1-3, wherein in the f),the second communication device calculates error correction information by performing the soft-decision error correction processing on the remaining sifted key quantization data and transmits the error correction information to the first communication device through the second channel;the first communication device generates first shared information from the remaining sifted key data by decoding the error correction information, and the second communication device generates second shared information from the remaining sifted key quantization data by soft decision.

The method according to any one of additional notes 1-3, wherein in the c), the first communication device transmits the first random number sequence to the second communication device through the second channel, the second communication device generates the sifted key quantization data from the received quantization data based on the first random number sequence, and the first communication device processes the second random number sequence as the sifted key data.

The method according to any one of additional notes 1-3, wherein in the c), the second communication device generates a third random number sequence to transmit it to the first communication device through the second channel, the first communication device compares the first random number sequence with the third random number sequence and transmits, to the second communication device, the at least first part of the first random number sequence at bit positions matching the first random number sequence with the third random number sequence.

The method according to any one of additional notes 1-3, wherein the first communication device and the second communication device perform privacy amplification processing based on the shared information to generate a final key.

The method according to any one of additional notes 1-3, wherein the very weak light has an optical power of one photon or less per pulse.

A receiver connected to a transmitter through a first channel and a second channel in a continuous-variable quantum key distribution (CV-QKD) system, the receiver comprising:a quantum unit configured to receive very weak light from the transmitter through the first channel to output received quantization data by coherent detection, wherein the very weak light is quadrature-modulated according to a first random number sequence and a second random number sequence, each of which has bit positions relatively determined; anda data processor configured to generate shared information from the received quantization data by communicating with the transmitter through the second channel,wherein the data processor is further configured to:a) set reference bit positions for shared information generation and generating sifted key quantization data from the received quantization data based on at least first part of the first random number sequence;b) generate hard-decision data for bit position synchronization decision by performing hard decision on part of the sifted key quantization data;c) if bit position synchronization is established between the hard-decision data and the sifted key data of the transmitter, discard the part of the sifted key quantization data used for the hard decision to generate remaining sifted key quantization data; andd) perform soft-decision error correction processing on the remaining sifted key quantization data to generate the shared information.

The receiver according to additional note 10, wherein the data processor is further configured to, if the bit position synchronization is not established in the c), return to the a) to change setting of the reference bit positions.

The receiver according to additional note 11, wherein the data processor is further configured to, in the a), shift the reference bit positions by one bit.

The receiver according to any one of additional notes 10-12, wherein the data processor is further configured to, in the c), determine whether the bit position synchronization is established or not, based on an error rate calculated from the hard-decision data and a corresponding part of the sifted key data.

The receiver according to any one of additional notes 10-12, wherein the data processor is further configured to, in the c), receive a synchronization decision result from the transmitter, wherein the synchronization decision result indicates whether the bit position synchronization is established or not based on an error rate calculated from the hard-decision data and a corresponding part of the sifted key data.

The receiver according to any one of additional notes 10-12, wherein the data processor is further configured to: in the d), calculate error correction information by performing the soft-decision error correction processing on the remaining sifted key quantization data; transmit the error correction information to the transmitter through the second channel; and generate the shared information by performing soft decision on the remaining sifted key quantization data.

The receiver according to any one of additional notes 10-12, wherein the data processor is further configured to: in the a),receive the first random number sequence from the transmitter through the second channel; andgenerate the sifted key quantization data from the received quantization data based on the first random number sequence.

The receiver according to any one of additional notes 10-12, wherein the data processor is further configured to: in the a),transmit a third random number sequence through the second channel; andreceive the at least first part of the first random number sequence at bit positions matching the first random number sequence with the third random number sequence.

The receiver according to any one of additional notes 10-12, wherein the data processor is further configured to perform privacy amplification processing based on the shared information to generate a final key.

The receiver according to any one of additional notes 10-12, wherein the very weak light has an optical power of one photon or less per pulse.

A transmitter connected to the receiver according to additional note 15, the transmitter comprising:a transmitting-side quantum unit configured to transmit the very weak light to the receiver through the first channel; anda transmitting-side data processor configured to generate shared information based on the second random number sequence by communicating with the receiver through the second channel,the transmitting-side data processor further configured to:generate the sifted key data from the second random number sequence corresponding to the at least first part of the first random number sequence;transmit, to the receiver, a synchronization decision result obtained based on an error rate calculated from hard-decision data received from the receiver and a corresponding part of the sifted key data; andgenerate shared information from the remaining sifted key data according to the error correction information received from the receiver.

A communication control method at a receiver connected to a transmitter through a first channel and a second channel in a continuous-variable quantum key distribution (CV-QKD) system, the method comprising:by a quantum unit, receiving very weak light from the transmitter through the first channel to output received quantization data by coherent detection, wherein the very weak light is quadrature-modulated according to a first random number sequence and a second random number sequence, each of which has bit positions relatively determined; andby a data processor,a) setting reference bit positions for shared information generation and generating sifted key quantization data from the received quantization data based on at least first part of the first random number sequence;b) generating hard-decision data for bit position synchronization decision by performing hard decision on part of the sifted key quantization data;c) if bit position synchronization is established between the hard-decision data and the sifted key data of the transmitter, discarding the part of the sifted key quantization data used for the hard decision to generate remaining sifted key quantization data; andd) performing soft-decision error correction processing on the remaining sifted key quantization data to generate the shared information.

The communication control method according to additional note 21, wherein the c) further comprises, if the bit position synchronization is not established, returning to the a) to change setting of the reference bit positions.

The communication control method according to additional note 22, wherein the a) further comprises shifting the reference bit positions by one bit.

The communication control method according to any one of additional notes 21-23, wherein the c) further comprises determining whether the bit position synchronization is established or not, based on an error rate calculated from the hard-decision data and a corresponding part of the sifted key data.

The communication control method according to any one of additional notes 21-23, wherein the c) further comprises receiving a synchronization decision result from the transmitter, wherein the synchronization decision result indicates whether the bit position synchronization is established or not based on an error rate calculated from the hard-decision data and a corresponding part of the sifted key data.

The communication control method according to any one of additional notes 21-23, wherein the d) further comprises: calculating error correction information by performing the soft-decision error correction processing on the remaining sifted key quantization data; transmitting the error correction information to the transmitter through the second channel; and generating the shared information by performing soft decision on the remaining sifted key quantization data.

The communication control method according to any one of additional notes 21-23, wherein the a) further comprises:receiving the first random number sequence from the transmitter through the second channel; andgenerating the sifted key quantization data from the received quantization data based on the first random number sequence.

The communication control method according to any one of additional notes 21-23, wherein the a) further comprises:transmitting a third random number sequence through the second channel; andreceiving the at least first part of the first random number sequence at bit positions matching the first random number sequence with the third random number sequence.

A program for functioning a computer as a receiver connected to a transmitter through a first channel and a second channel in a continuous-variable quantum key distribution (CV-QKD) system, the program comprising a set of instructions to:by a quantum unit, receive very weak light from the transmitter through the first channel to generate received quantization data by coherent detection, wherein the very weak light is quadrature-modulated according to a first random number sequence and a second random number sequence, each of which has bit positions relatively determined; andby a data processor,a) set reference bit positions for shared information generation and generating sifted key quantization data from the received quantization data based on at least first part of the first random number sequence;b) generate hard-decision data for bit position synchronization decision by performing hard decision on part of the sifted key quantization data;c) if bit position synchronization is established between the hard-decision data and the sifted key data of the transmitter, discard the part of the sifted key quantization data used for the hard decision to generate remaining sifted key quantization data; andd) perform soft-decision error correction processing on the remaining sifted key quantization data to generate the shared information.

A method for deciding synchronization of shared information generated by continuous-variable quantum key distribution (CV-QKD) between a first communication device and a second communication device connected through a first channel and a second channel, the method comprising:a) at the first communication device, transmitting very weak light to the second communication device through the first channel, wherein the very weak light is quadrature-modulated according to a first random number sequence and a second random number sequence, each of which has bit positions relatively determined;b) at the second communication device, generating received quantization data by performing coherent detection of very weak light received through the first channel;c) at the second communication device, setting reference bit positions for shared information generation; and generating sifted key quantization data from the received quantization data based on at least first part of the first random number sequence; at the first communication device, generating sifted key data from second part of the second random number sequence corresponding to the at least first part;d) at the second communication device, generating hard-decision data for bit position synchronization decision by performing hard decision of a part of the sifted key quantization data; ande) at one of the first communication device and the second communication device, deciding whether bit position synchronization is established or not, based on an error rate calculated from the hard-decision data and a corresponding part of the sifted key data.

The method according to additional note 30, wherein the e) further comprises:if the error rate is not greater than a predetermined threshold, discarding data used for bit position synchronization decision from the sifted key quantization data and the sifted key data, respectively, to generate the shared information by performing error correction processing on remaining sifted key quantization data and remaining sifted key data; andif the error rate is greater than a predetermined threshold, returning to the c) to change setting of the reference bit positions.

The method according to additional note 31, wherein the error correction processing comprises:at the second communication device, calculating error correction information by performing the soft-decision error correction processing on the remaining sifted key quantization data and transmitting the error correction information to the first communication device through the second channel; andat the first communication device, generating first shared information from the remaining sifted key data by decoding the error correction information, and the second communication device generates second shared information from the remaining sifted key quantization data by soft decision.

The method according to additional note 31 or 32, wherein the e) further comprises: if the error rate is greater than a predetermined threshold, returning to the c) to shift the reference bit positions by one bit.

The method according to any one of additional notes 28-30, wherein in the c), the first communication device transmits the first random number sequence to the second communication device through the second channel, the second communication device generates the sifted key quantization data from the received quantization data based on the first random number sequence, and the first communication device processes the second random number sequence as the sifted key data.

The method according to any one of additional notes 28-30, wherein in the c), the second communication device generates a third random number sequence to transmit it to the first communication device through the second channel, the first communication device compares the first random number sequence with the third random number sequence and transmits, to the second communication device, the at least first part of the first random number sequence at bit positions matching the first random number sequence with the third random number sequence.

A continuous-variable quantum key distribution (CV-QKD) system comprising a transmitter and a receiver connected through a first channel and a second channel,the transmitter configured to transmit very weak light through the first channel, wherein the very weak light is quadrature-modulated according to a first random number sequence and a second random number sequence, each of which has bit positions relatively determined;the receiver configured to:receive very weak light from the transmitter through the first channel to generate received quantization data by coherent detection;set reference bit positions for shared information generation;generate sifted key quantization data from the received quantization data based on at least first part of the first random number sequence; andgenerate hard-decision data for bit position synchronization decision by performing hard decision on part of the sifted key quantization data;if bit position synchronization is established between the hard-decision data and sifted key data of the transmitter, discard the part of the sifted key quantization data used for the hard decision to generate remaining sifted key quantization data,wherein the transmitter is further configured to:generate the sifted key data from the second random number sequence corresponding to the at least first part of the first random number sequence; andif the bit position synchronization is established between the hard-decision data and the sifted key data, discard a part of the sifted key data used for the bit position synchronization decision to generate remaining sifted key data,wherein the transmitter and the receiver generate shared information by performing soft-decision error correction processing on the remaining sifted key data and the remaining sifted key quantization data, respectively.

An illustrative example embodiment or example is applicable to CV-QKD systems.

DESCRIPTION OF SIGNS