An improved control mode for the ping-pong protocol operation in imperfect quantum channels

An entanglement, a physical property unique to quantum systems, can bring a new dimension to communication schemes [4]. Security of such schemes results from the fundamental property that eavesdropper having an access to a part of the entangled state cannot draw deterministic conclusions about the whole system. That feature has been used as a foundation of the quantum direct communication (QDC) protocols in which, unlike the quantum key distribution (QKD) systems, sensitive information is sent directly in the quantum channel. In consequence, the confidentiality of that information results directly from the laws of physics and no classic encryption algorithm has to be applied.

The ping-pong protocol is a QDC scheme founded on the fragility of the entanglement of the EPR pairs [1]. It is composed of two, randomly interwoven, operation modes. The message mode used for sensitive information exchange is supported with the control mode in which legitimate parties using local measurements and classic communication verify whether they share components of the same EPR pair. Protocol offers the capacity of a single classic bit per message cycle and an asymptotic security in perfect quantum channels. Many enhancements of the seminal proposal or quite new schemes exploring entanglement of Bell states have been proposed since its publication [5]. The offered capacity per signal particle has been enhanced by various protocol modifications: introduction of a dense information coding [8], increase in the dimensionality of the signal particle [7, 11], and usage of a multi-particle entanglement [3]. However, serious deficiencies can be identified in the ping-pong protocol and its derivatives.We have identified an incomplete check of the coherence of the shared entangled system as the source of the above weaknesses. We propose a method to overcome the aforementioned deficiencies. It is based on the observation that coherence of the distant parts of the entangled system can be verified with a nonzero probability with a scheme founded on classic communication and local measurements. In the improved protocol, legitimate parties perform control measurements in mutually unbiased bases in subsequent protocol cycles. As a result, the asymptotic security of QDC is restored because attacks mentioned in points 1) and 3) are detected with a finite probability. Also the QBER can be reliably estimated as the new control mode is sensitive to both phase flip and bit flip errors.

The following text adheres to standard cryptographic personification rules: Alice, Bob, and Eve are the names of the message sender, recipient, and malevolent eavesdropper, respectively. It explains our improved control mode and consequences of its introduction on a basis of the seminal version of the protocol [1]. Such presentation form stems from the fact that main threats have been also formulated in the context of this protocol [6, 9, 13]. Section 2 presents the ping-pong protocol in its seminal version and fixes notation used further. The idea of our improvement and its relation to the mentioned threats is discussed in Sect. 3. Some general remarks and conclusions sum up the paper.

A message mode of the EPR-based QDC is composed of three phases: the entanglement distribution, a message encoding, and its decoding. Bob starts the communication process by a creation of an EPR pair \(|\psi ^+\rangle =\left( |0_B\rangle |1_A\rangle +|1_B\rangle |0_A\rangle \right) /\sqrt{2}\). Then, he sends one of the qubits, further referred as a signal one, to Alice. An unitary transformation applied to the qubit possessed by Alice is used to encode a one classic bit \(\mu \) The signal particle is sent back to Bob, who detects applied transformation by a collective measurement of both qubits (Fig. 1).

Unfortunately, such a communication scenario is vulnerable to the intercept-resend attack. As a result, legitimate parties have to implement countermeasures to make sure that the qubit processed by Alice is really the same qubit which was sent by Bob. In seminal version of the protocol, Alice measures the received qubit in a computational basis in some randomly selected protocol cycles and asks Bob over an authenticated classic channel to do the same with his qubit (Fig. 2). As the Alice’s measurement comes first, it fully determines the state accessible to Bob and the result of his measurement. The parties can verify the correlation of the outcomes by a public discussion over a classic channel and a probability \(p_C^{(Z)}\) of an error occurrence results from the projectionThe above scheme is asymptotically secure in a perfect quantum channel, i.e., an eavesdropper is detected with a probability close to certainty after a sufficiently large number of control cycles. However, this feature is valid in a lossy and/or noisy channel as long as legitimate parties know exactly the loss ratio and/or quantum bit error rate. Otherwise, some information may leak out in an undetectable manner [9, 13]. Moreover, Alice cannot rely on a  dense coding to encode two classic bits \(\nu \), \(\mu \) per protocol cyclebecause of attacks described in [6, 11].

Let us now summarize in more detail the security of the protocol in the presence of losses in a quantum channel. Capabilities of the eavesdropper can be then enhanced with quantum circuits which exploit properties of the vacuum state. Two attacks, which follow the scheme depicted on the Fig. 3, have been demonstrated so far [6, 9]. The signal qubit in its way to Alice is entangled via the transformation \({{ Q}}\) with Eve’s registers initialized to the state \(|v_x\rangle |0_y\rangle \), where \(|v\rangle \) denotes the vacuum state. That way, due to introduced coupling, Alice’s encoding operations affect the state of \(x\) and \(y\) registers. The ancilla is next decoupled from the signal qubit on its way back to Bob. The clever design of the circuit \({{ Q}}\) permits detection of phase flip operations at the price of an introduction of some losses [9] or bit flip operations with no additional losses [6]. In both cases, the expected correlation of outcomes of conclusive measurements in the seminal control mode (2) is preserved so the aforementioned attacks are considered to be undetectable. Controlled Polarization Beam Splitter (CPBS) depicted on the Fig. 4 is a central element of both devices. It is responsible for a signal qubit coupling with the Eve’s registers. The Eqs. (4) and (5) describe quantum circuits detecting phase flip or bit flip encoding operations, respectively where \({{ H}}_\alpha \) denotes the Hadamard gate applied to register \(\alpha \) and \({{ SWAP}}_{\alpha \beta }\) swaps the contents of registers \(\alpha \) and \(\beta \). In fact, these devices differ only the way in which the inputs for the \({{ CPBS}}\) are prepared and the output states are collected. One should keep in mind that attacks (4) and (5) were aimed at two different flavors of the ping-pong protocol. The device (4) targets the seminal formulation of the protocol and shows that losses can be used to mask the presence of the eavesdropper. On the other hand, the device (5) demonstrates that dense coding cannot be used to increase protocol’s capacity per cycle because all information encoded as bit flips of the signal particle can be eavesdropped without detection as long as the control mode is left intact.

Security problems of the communication scenario described in the previous section come from the fact that the control mode (2) does not check the coherence of the EPR components, but only classic correlation of local measurements in the computational basis. The coherence can be checked in a deterministic way only by the collective measurement, but within the protocol definition this is not feasible as the control mode is performed by remote parties. However, remote control measurements of an EPR pair components performed in mutually unbiased bases can be used to detect the coherence loss in a probabilistic manner. Based on this observation, we propose the following amendment of the seminal control mode:It follows from the Table 1 that operators (2) and (7) are sufficient to detect all types of errors. Quantities \(p^{(Z)}_{C}\) and \(p^{(X)}_{C}\) may be used for the QBER estimation depending on the nature of information encoding in the message mode. For instance, \(p^{(X)}_{C}\) determines the expected QBER in the seminal version of the protocol.

Let us investigate whether the improved control mode detects devices (4) and (5). The expression (8) describes the system state (legitimate qubits plus ancilla) when the signal qubit reaches Alice and Eve’s phase flip detection circuit is enabled (see [9], equation (4)])The first two terms are responsible for the induction of losses observed by Alice in the control mode. The last two ones preserve the correlation of outcomes of control measurements although home and signal qubits are coupled with the ancilla registers. Similarly, the system state takes the form (9) (see [6], equation(3)])when the signal qubit arrives at Alice’s site and the bit flip detection circuit is enabled. Also in this case, the nature of a quantum measurement guarantees that Alice’s and Bob’s outcomes are perfectly anticorrelated.

However, there is a big difference between the states (8) or (9) and the state of the system when Eve is decoupledwhere \(|\chi _{x,y}\rangle \) denotes a state of the ancilla. In the latter case, qubits \(A\) and \(B\) are in the coherent state, while in the former two cases they are not. The coherence loss can be detected with the control measurements in the dual basis. The states (8)–(10) in \({{ X}}\) basis take the form: In a dual basis, the (anti)correlation between Alice’s and Bob’s outcomes is preserved only when qubits \(A\) and \(B\) are in coherent state (13). Otherwise, i.e., when hostile circuits are enabled, the control measurement of a signal qubit resulting in value “+1” (projection \(|+_A\rangle \langle +_A|\)) will induce the home qubit collapse to states \(|\pm _B\rangle \) with an equal probability as follows from (11) and (12). In effect, Alice and Bob observe 50 % of the error rate in the control mode executed in a dual basis for travel qubits passing through the hostile circuit. In consequence, the net probability of the Eve’s presence detection is on average equal to 25 % when only successful measurements are taken into account. The above observation restores protocol’s asymptotic security.

For instance, let us reconsider an attack with the device (4) and compare the eavesdropper’s information gain and detection capabilities of the seminal and proposed control modes. Let the quantum channel be perfect, but legitimate users tolerate losses on the level QLOSS. This is the limiting case of the situation in which Eve replaces the original imperfect quantum channel with a better one, or Alice and Bob underestimate the quality of the channel they have already been using. The amount of leaked information depends on the message mode properties and the specific features of the hostile circuit. The improvement is limited to the control mode, and thus, new results related to this aspect of protocol operation do not occur. The eavesdropper may gain at most \(I_{AE}^{({\mathrm {max}})}=\frac{3}{4}\log _2\frac{4}{3}\) bits per a message cycle (see [9], equation (8)]) at the price of the induction of losses in the control mode at the level \(\textit{QLOSS}_{ind}=\) 50 % (see [9], equation (4)]). Thus, Eve can eavesdrop \(I_{AE}^{({\mathrm {max}})}\) bits without risking a detection as long as Alice and Bob tolerate \(\textit{QLOSS} \ge \textit{QLOSS}_\mathrm{ind}\). Otherwise, she has to resign from the eavesdropping of some protocol cycles to stay undetected. That way, the level of induced losses is kept below the value accepted by legitimate parties, but, at the same time, Eve’s information gain decreases linearly with the percentage of skipped cycles. It is worth noting that the eavesdropper can be detected only by  monitoring a level of losses as the projection (2) applied to the state (8) always gives \(p_C^{(Z)}=0\). Although our improvement does not influence the amount of leaked information, it qualitatively changes the detectability of the hostile circuit. Let us replace seminal control mode with the improved one. If Eve attacks all protocol cycles and her device is the sole cause of losses, then the presence of the hostile circuit is revealed with a probability \(p_C=1/8\) under the assumption that all control modes are taken into its calculation. Again, she can disable the eavesdropping on some cycles to limit the level of induced losses at the price of diminishing her information gain. But Eve cannot be revealed when the hostile circuit is idle so \(p_C\) also decreases linearly with the percentage of skipped cycles. In consequence, both Eve’s information gain and the probability of eavesdropping detection are given by the functions of the same shape (Fig. 5).

Similar considerations for the device (5) are more simple. The attack targets the ping-pong protocol with the dense coding (3) enabled. It has been shown (see [6], equation(5)]) that Eve can always distinguish the classic bit responsible for the bit flip operation on the signal particle. At the same time, the device does not induce losses in the control mode and it preserves the correlation expected in the seminal control mode (9). Thus, Eve’s information gain is equal to \(I_{AE}=1\) bit per the message cycle and \(p_C^{(Z)}=0\). However, the improved control mode reveals the presence of the circuit with probability \(p_C=1/4\) per the control cycle. As a result, Eve gains a half of sent bits at the price of being detected with a finite probability in a single control mode cycle, and, in consequence, she risks detection with a probability close to certainty after a sufficiently large number of control cycles.

The control mode is used to detect eavesdroppers in an entanglement-based QDC. Formerly, its purpose has been limited to the verification of the authenticity of the components of the shared entangled state. However, the control mode has to estimate the QBER observed in the message mode in noisy environments as well as it should provide a reliable authentication in lossy quantum channels. The seminal version of the control mode fails to fulfill these additional tasks as local measurements in a computational basis cannot reliably verify the coherence of the distant components of the EPR pair.

We propose a simple method to overcome the aforementioned deficiencies. The improved control mode detects with a nonzero probability the loss of coherence of the EPR pair components by the verification of bit or phase coincidence. In consequence, the presence of the hostile circuits can be revealed because they inevitably break the coherence of the legitimate Bell state. Communicating parties can also estimate the expected QBER with the help of the improved control mode. The proposed amendment closes security loopholes which have been revealed so far, and it restores an asymptotic security of the entanglement-based QDC.