\documentclass{optica-article}
\journal{opticajournal}

\articletype{Research Article}
% \usepackage{lineno}
% \linenumbers



\begin{document}
\title{Countering detector manipulation attacks in quantum communication through detector self-testing }

\author{Lijiong~Shen,\authormark{1,2} and Christian~Kurtsiefer,\authormark{2,3,*} }

% 
\address{
\authormark{1}School of Physics, Hangzhou Normal University, Hangzhou, Zhejiang 311121, China\\
\authormark{2}Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543\\
\authormark{3}Department of Physics, National University of Singapore, 2 Science Drive 3, Singapore 117551}
\medskip

\email{\authormark{*}christian.kurtsiefer@gmail.com} 



\begin{abstract}
In practical quantum key distribution systems, imperfect physical devices open
security loopholes that challenge the core promise of this technology. Apart
from various side channels, a vulnerability of single-photon detectors to
blinding attacks has been one of the biggest concerns, and has been addressed
both by technical means as well as advanced protocols. In this work, we
present a countermeasure against such attacks based on self-testing of
detectors to confirm their intended operation without relying on specific
aspects of their inner working, and to reveal any manipulation attempts.  We
experimentally demonstrate this countermeasure with a typical InGaAs
avalanche photodetector,
but the scheme can be easily implemented with any single photon detector.
\end{abstract}





\textit{Introduction --} 
Quantum key distribution (QKD) is a communication method that uses quantum
states of light as a trusted courier such that any eavesdropping attempt in this
information transmission is revealed as part of the underlying quantum physics
of the measurement process on the states~\cite{BB84,ekert:91,Gisin}. While the
basic protocols are secure within their set of assumptions, practical QKD
systems can exhibit vulnerabilities through imperfect implementation
of the original protocol scenarios, through imperfect preparation and detection
devices, or through side channels that leak information out of the supposedly
safe perimeter of the two communication
partners~\cite{Scarani2009,Scarani2014,Xu2020}. Families of such vulnerabilities have been
identified and addressed through technical measures and advanced
protocols. Examples are the photon number splitting attacks where single
photons were approximated by faint coherent
pulses~\cite{Brassard2000,Lutkenhaus2000}, Trojan horse
attacks~\cite{Vakhitov2001,Gisin}, various timing
attacks~\cite{Qi2007,Lamas-Linares2007,Zhao2008} and classes of information
leakage into parasitic degrees of freedom.

Perhaps the most critical vulnerability of QKD systems is the detector blinding / fake state attack fam-
ily on single-photon detectors~\cite{Makarov2009}. This attack has been experimentally demonstrated
to work for detectors based on avalanche photodiodes and superconducting
nanowires~\cite{Lydersen2010,Lydersen2011,Goltsman2019}, and allowed to
completely recover a key generated by QKD without being noticed by the error
detection step in a QKD implementation~\cite{Gerhardt2011}.
%
The attack is based on the fact that these single photon detectors can be
blinded by a macroscopic light level into not giving any response, while an
even stronger light pulse or a recovery event from a blinded state could
create an output signal from the blinded detector that emulates a
photon detection event~\cite{Makarov2009} (see Fig.~\ref{fig:powers}).
This vulnerability can be
exploited by carrying out an undetected man-in-the-middle attack, where
an eavesdropper intercepts photon states carrying the information, measures
the quantum state in a basis of his/her choice,  and copies the measurement
results into the photon detector of the legitimate receiver with macroscopic
powers of light. 

\begin{figure}
%  \includegraphics[width=\linewidth]{figure/powers.pdf}
  \includegraphics[width=\linewidth]{figure1.pdf}
  \caption{\label{fig:powers}Single photon avalanche photodiode properties
    underlying a blinding/fake state attack. At light levels below
    $10^{-12}$\,W, these 
    devices respond with detection events that can be used to identify single
    photons. At higher power levels, they saturate and can eventually brought
    into a blinded mode where they are not susceptible anymore to additional
    single photons. Very bright short pulses of light (``fake states'') can
    lead to a detector response that is indistinguishable  from the single
  photon response at low light levels. Photon rate/power level
  scaling is shown for a wavelength of 1300\,nm.} 
\end{figure}


Various countermeasures against the detector control attack have been
suggested and implemented. One class of countermeasures addresses technical
aspects of the detectors. Examples are using more than one
detector or a multi-pixel detector for one measurement
basis~\cite{Honjo2013,FerreiraDaSilva2015,Wang2016,Gras2021}, including a
watchdog detector for the blinding light~\cite{Lydersen2010,Dixon2017}, 
effectively varying the detector
efficiency at random timings~\cite{Lim2015,Qian2019}, and
carefully monitoring the  photocurrent or breakdown status of the
detector~\cite{Yuan2010,Yuan2011} to identify a detector manipulation.
However, most of these countermeasures have operational drawbacks. For
example, additional single photon detectors significantly increase the overall
cost and complexity, and beam splitters in the receiver for watchdog detectors
introduce additional optical losses. 
Varying the efficiency frequently to get enough statistics to identify 
the blinding attack could significantly affect
the QKD bit rate, and changing the detector operation condition or
monitoring its state increases the complexity of the electronic circuitry
around the single photon detectors. Such countermeasures may also introduce
additional vulnerabilities that may be exploited in an arms race style~\cite{Cnt-cnt-Makarov}.

An elegant countermeasure on the protocol level is provided by the so-called
measurement-device independent quantum key distribution
(MDI-QKD)~\cite{MDIQKD:2012}, which further developed the idea of
device-independent QKD where a photon pair source
can be made public or even controlled by an eavesdropper~\cite{DIQKD:2009} to
a scenario where the detectors receiving single photons (or approximations thereof) can be public, or controlled by an eavesdropper.
The scheme has been
demonstrated experimentally several times by
now~\cite{MDIexp1,MDI200km,MDI400km,MDIasym}. It requires a pair of single
photons (or weak coherent pulses) from two communication partners without a
phase correlation to arrive within a coherence time
on a Bell state analyzer, where single
photon detection is carried out, and the result is published. This requires a
matching of emission times and wavelengths of two spatially separated
light sources with both communication partners.

The MDI-QKD approach counteracts any active or passive attack on single
photon detectors, as their result need not to be private anymore. The
communication partners can simply test if the detectors were performing single
photon detection through a error detection process similar to the original QKD
protocols. 


In this work, we present a method of testing the proper operation of single
photon detectors in a QKD scenario that does not require the synchronization
of light sources like in the MDI-QKD approach, while also not touching the
specific detector mechanism. It brings the idea of self-testing of quantum
systems~\cite{Mayers1998QuantumCW,vanDam:2000,Supic2020selftestingof} to
single photon detectors that can remain black boxes. We use a
light emitter (LE) under control of a legitimate communication partner that
is weakly coupled to its single photon detector
for this self-testing.
When the single photon detector is under a blinding attack, it is insensitive to
low-intensity light fields
used for quantum
key distribution. Thus, by turning on the LE at times not predictable by an
eavesdropper, ``salt'' optical detection events are generated in the
detector when it operates normal, while it does not react to the test light when
blinded. Complementary, the test light intensity can be raised to blinding
levels of the photodetector, which thereby is desensitized to legitimate
single photons. Registration of any detector events under self-blinding then
suggests the presence of fake state events.


\textit{Self-testing strategy --}
In a generic QKD system, a transmitter generates photons containing
quantum information in either polarization or time encoding, and sends them
through an optical path (``quantum channel'') to a receiver. Therein, a
measurement basis choice is made either through passive or active optical
components, and the light arriving from the quantum channel is directed to
single photon detectors.
In a blinding/fake state attack, an eavesdropper measures a photon in the
quantum channel, and copies the result into the corresponding photon detector
of the legitimate receiver using blinding and fake state light levels. For
detector testing, a light emitter (LE) in the receiver is controlled by a
random number generator and weakly coupled to the single photon detectors.


\begin{figure}
%  \includegraphics[width=0.9\linewidth]{figure/illustration/combined_b.pdf}
  \includegraphics[width=0.9\linewidth]{figure2.pdf}
  \caption{\label{fig:st-protocol}
    Detector self testing. Top trace: light level
    of the light emitter LE, middle trace: normal detector response (no
    manipulation), lower trace: detector response under manipulation.
    Detector events are classified as normal (N),  salt (S), ``fake'' (F), and
    flag (FL) signals. Segment (a) shows responses without
    self-testing, (b) with low LE power generating salt events, (c)
    with occasional test pulses at medium power, (d) with high LE power to
    self-blind the detector.
    }
\end{figure}

An unblinded single-photon detector generates events due to photons from the
legitimate source or the background (labeled ``N'' in
Fig.~\ref{fig:st-protocol}(a)).  The brightness of the legitimate source, the
transmission of the quantum channel, the efficiency of the single photon
detectors, and the detector dark count rate determine the average number
$\bar{n}$ of the photon-detection events registered in a time interval $T$. An
eavesdropper would choose a rate of ``fake'' detection events (labeled ``F''
in Fig.~\ref{fig:st-protocol}(a)) similar to normal QKD
operation to prevent detecting the attack by monitoring photon detection
statistics. 

We illustrate three different examples of detector self-testing to detect
detector manipulation attacks.

In the first one, the legitimate receiver switches occasionally the light
emitter LE to a low light level for a test time interval $T$ at a random timing
unpredictable by an eavesdropper, while it is off for the rest of the time.
In the test interval, an unblinded detector would see an increase of detector
events above $\bar{n}$ due to additional salt events (``S'' in
Fig.~\ref{fig:st-protocol}(b)).  The legitimate receiver has complete control
of the light emitter to make excess photon detection events statistically
detectable in the probe interval $T$. A single photon detector under blinding
attack would be insensitive to the low light levels of LE, so only
detector events generated by positive detector manipulations like fake states
would be registered (labeled ``F'' in Fig.~\ref{fig:st-protocol}(b)). A
statistically significant presence of salt events in a time interval $T$ would
therefore allow to sense a negative detector manipulation e.g. through
blinding. Note that the test interval $T$ does not need to be
distributed contiguously in time.

This leads to a second self-testing example, which turns on the light emitter
for a short pulse time interval $\delta t$  at a random timing and with a high
enough energy (a few photons) to cause a detection event with almost
unit probability in an unblinded single-photon detector.
A blinded detector is again insensitive to such a short optical pulse as
long as the light level is way below the fake state threshold. In this
situation, detecting a single flag event can witness a non-blinded detector
(see Fig.~\ref{fig:st-protocol}(c)).


The third self-testing example uses the light emitter in the receiver to
locally blind the detector. The typical power necessary to blind an APD is on
the order of a few nW, which can easily be accomplished by weakly coupling
even faint light sources like LEDs.  Detection events caused by single photons from the legitimate source
will be suppressed by the local blinding light. In absence of a negative
detector manipulation (e.g. detector blinding),  the intense light at the
onset of the self-blinding period will almost deterministically create a flag
event in the detector, which then remains silent during the rest of
the self-blinding interval (see Fig.~\ref{fig:st-protocol}(d)).
However, any positive detector manipulation 
will overrule the local blinding, and cause a false detection event. 
Both the initial flag event and any possible later event can be easily
checked.
This method only requires a small number of
registered events in a time interval $T$ to discover both a
negative and positive detector manipulation attack.

A detector event could also be triggered when the detector
recovers from a (remote) blinding exposure~\cite{Tanner2014}. Local blinding
will suppress such ``fake'' detector events, so they may not get noticed by
looking for signals under local blinding. However, in such a case, the
flag event will also be suppressed. Therefore, a combination of checking
for detection events during self-blinding and looking for a flag event is necessary to identify such an attack.

\begin{figure}
% \includegraphics[width=0.7\linewidth]{figure/setup/demosetup2.pdf}
% \includegraphics[width=\linewidth]{figure/measured/insert/normal_200us_b.eps}
  \includegraphics[width=0.9\linewidth]{figure3a.pdf}
  \includegraphics[width=0.95\linewidth]{figure3b.pdf}
   \caption{\label{fig:demosetup}
    (a) Setup to demonstrate detector self-testing. Light from a cw
    laser diode (LD1) and pulsed laser diode (LD2), both around 1310\,nm, is
    combined in a fiber beamsplitter (BS) to simulate different
    illumination scenarios. Besides the single photon InGaAs detector
    APD2, the receiver contains an LED (940\,nm) as a light emitter (LE)
    for local testing of APD2. An interference (IF) filter prevents leakage of
    LE light out of the receiver. (b) Distribution of photodetection events in
  a time window of $T=200\,\mu$s under ``normal'' operation under
  illumination of the detector with a low power level from LD1.}
 \end{figure}

 
\textit{Experimental results --}
We demonstrate our countermeasure with a single-photon detector
commonly used in quantum key distribution
which is susceptible to detector manipulation
attacks (see Fig.~\ref{fig:demosetup}(a)). Light that simulates legitimate
quantum signals and provides the larger power levels required for
detector manipulation is generated by combining the output of a continuous wave
(cw) laser diode (LD1) with light from a pulsed laser diode (LD2) on a fiber
beam splitter (BS). The 2\,ns long bright fake states from LD2 can be
emitted upon detection events from an auxiliary avalanche photodetector
(APD1) to emulate a credible (Poissonian) event distribution.
On the receiver side, the light from the quantum channel passes through an
interference filter (IF) before it is focused onto the main photodetector
(APD2), a passively quenched InGaAs device (S-Fifteen Instruments IRSPD1) with a
maximal count rate of $5\times10^5\,\text{s}^{-1}$ and a dark count rate of
$7\times10^3\,\text{s}^{-1}$. The light emitter (LE) for detector self-testing
is a light emitting diode with a center wavelength of 940\,nm (Vishay
VSLY5940), which is reflected off the IF (acting as a
dichroic beam splitter) onto APD2.

For the demonstration, we consider an event rate of
$\approx5\times10^4\,\text{s}^{-1}$ at APD2, which is about an order of magnitude
below the maximal detection rate to not reduce the detector efficiency
significantly. Figure~\ref{fig:demosetup}(b) shows a histogram of detection
events in a time interval of $T=200\,\mu\text{s}$ generated by choosing
an appropriate light level of LD1. The result with a mean photodetection number
$\bar{n}\approx10$ differs slightly from a  Poisson distribution since the
detector has an after-pulse possibility of about 40\,\%.
%
To implement a detector manipulation with the same event characteristic, we
elevate the optical output power of LD1 to 500\,pW, the minimal power to
completely blind detector APD2. Fake states that emulate photodetection events
in APD2 are generated with optical pulses through LD2 with a peak power of 3\,$\mu$W.


\begin{figure}
  %\includegraphics[width=\linewidth]{figure/measured/insert/200us_just_blinding_b.eps}
  \includegraphics[width=\linewidth]{figure4.pdf}
  \caption{\label{fig:selfseed}
    Distribution of detector events in the presence of self-seeding light in a
    test interval of $T=200\,\mu$s for a normally operating, and
    a manipulated detector. The manipulated detector shows a similar
    distribution as the one in Fig.~\ref{fig:demosetup}(b), while the normally
    operating detector  shows a distinctly higher event number. Error bars
    indicate Poissonian standard deviations resulting from 7432 and 7686 test
    runs for a normal detector and a manipulated detector, respectively. 
    }
 \end{figure}

To demonstrate the first example of detector self-testing, we turn on the
light emitter LE in the test interval $T$ both for a normally operating and a
manipulated detector. The resulting detection event distributions are shown in
Fig.~\ref{fig:selfseed}. For a normally operating detector, the observed APD2
events in the test interval increase significantly to a mean of about
$\bar{n}_{T1}\approx100$, while for a manipulated detector, the distribution is
similar to the ``normal'' distribution with $\bar{n}_{N}\approx10$ in
Fig.~\ref{fig:demosetup}(b). With a threshold at $n=50$, the two distributions
can be easily distinguished, and a detector manipulation attempt
(specifically: the presence of a blinding light level) easily identified
in a single measurement interval $T$; in the experiment, the unmanipulated
detector never showed less than 78 events, while the manipulated showed never
more than 30 events.


\begin{figure}
  %\includegraphics[width=\linewidth]{figure/measured/shortpulse/200us_pulse_combined_b.eps}
   \includegraphics[width=\linewidth]{figure5.pdf}
  \caption{\label{fig:selfseed2}Detector event probability for a 25\,ns long
    bright pulse of the self-testing light emitter LE for a manipulated
    and normal detector vs the time difference $\Delta t$
    between detector event and a self testing pulse edge. A non-manipulated
    detector reacts with an event with high probability within less than
    60\,ns. Optical and 
    electrical delays shift the detector response away from $\Delta t=0$, and
    error bars indicate Poissonian standard deviations resulting from 12542 and 12380 test
    runs for normal detector and manipulated detector, respectively.
  }
\end{figure}

The necessary time to detect a manipulated detector can be shortened even
further with the second example of self-testing. We demonstrate this by
driving the light emitter LE to emit $\delta t=25$\,ns long pulses, and increasing the
coupling to 
the detector APD2 compared to the previous example. Figure~\ref{fig:selfseed2}
shows the probability of registering a signal from APD2 as a function of the
time $\Delta t$ after the start of the self-testing pulse. A non-manipulated
detector shows an overall detector response probability $p_s=93.4\%$ within 60\,ns (11720 photon detection events out of 12542 optical pulse), which is the probability for successfully identifying the detector status in a single-shot test. This number does not reach 100\%, as the detector may have been in a recovery state
from a previous detection event.  For a manipulated detector, i.e., in presence
of both detector blinding and fake states, we find an integral detector event
probability $p_f=0.3\%$ (36 out of 12380 test pulses), which is the false-positive probability. These
events were caused by fake states, not by light from the LE. A detector
manipulation attack (specifically, the detector blinding) can therefore be identified
with a few short test pulses to a very high statistical significance.
For $n$ test pulses, we classify the detector as ``not manipulated'' if at
least $n_{th}$ detection events are registered. The probability of a correct
identification (of the non-manipulated state) is given by
\begin{equation}{\label{eq:eq1}}
 P_s=\sum_{k=n_{th}}^n\frac{n!}{k!(n-k)!}p_s^k(1-p_s)^{n-k}\,.
\end{equation}
Similarly, the overall false-positive probability after $n$ test pulses is
given by 
\begin{equation}{\label{eq:eq2}}
 P_f=\sum_{k=n_{th}}^n\frac{n!}{k!(n-k)!}p_f^k(1-p_f)^{n-k}\,.
\end{equation}
For example, for the probability values $p_s$ and $p_f$ from the
experiment above, $n=10$, and $n_{th}=4$, the probability of correctly
identifying a non-manipulated detector is $P_s= 99.99995\%$,
%according to Eq.~\ref{eq:eq1}, 
while the false positive probability $P_f$ is only on the order of $10^{-8}$.
%according to Eq.~\ref{eq:eq2}.
The choice $n_{th}$ for a given $n$ can be optimized to either increase the
identification probability of a non-manipulated detector, or to reduce number
of false positives.


\begin{figure}
  % \includegraphics[width=\linewidth]{figure/measured/selfb/selfb_200us_combined_b.eps}
  \includegraphics[width=\linewidth]{figure6.pdf}
  \caption{\label{fig:selfblind}Detector event distribution in a test interval
    $T=200\,\mu\text{s}$ in the presence of self-blinding light for a normal
    and manipulated detector, registered 60\,ns {\it after} the onset of
    the self-blinding light. A manipulated detector still reports events due
    to fake states. Inset: probability of a detector
    event in the first 60\,ns after switching on the self-blinding light. This
    scheme allows to detect the presence of both a blinding and fake state
    detector manipulation.
  }
\end{figure}


To demonstrate the third example of detector self-testing, we increased the
optical power of LE on detector APD2 to a level that it could reliably blind
the detector. The minimal power to blind the used InGaAs detector is only 500\,pW, while the reverse bias voltage is almost unchanged under this blinding power or even two times the power with the self-blinding. Thus the amplitude of the fake state signals caused by the intense light pulse also does not vary significantly.
Figure~\ref{fig:selfblind} shows both
a distribution of detection events in a test interval $T=200\,\mu\text{s}$,
taken 60\,ns after the onset of light emission by LE. The
un-manipulated detector is insensitive to single photons in this interval;
we observed only 8 events in 7608 test runs (likely due to electrical noise), while a manipulated detector still reported events due to fake
states present at the input; we observed 7655 out of 7658 events (with the
missing events compatible with statistics).
The onset of the test light emission triggered a
detector reaction within the first 60\,ns with a
probability $p_s=97.6\%$ (7426 detector events out of 7608 test runs, see
inset of Fig.~\ref{fig:selfblind}) for a non-manipulated detector, while the
probability of an onset event was $p_f=0.2\%$ (17 out of 7658 runs) for a
manipulated detector caused by fake states. A local
light emitter that is able to self-blind the detector is thus able to reveal
the presence of both blinding and the fake state in a detector
manipulation attempt.

This countermeasure could be implemented in a QKD system based on multiple
single photon detectors simply by equipping each detector with
an independent light emitter. In a system based on a passive measurement base
choice with a beam splitter, it can be simplified by using only one light
emitter in the dark input port of the base choice beam splitter, ensuring all
detectors receive roughly the same self-testing intensity.

\textit{Conclusion --}
We demonstrated self-testing of single photon detectors that can reliably
reveal detector manipulation attacks. The self-testing strategy relies on a light
source near the detector under possible external manipulation, and is
able to detect both negative manipulations (i.e. suppression of
single photon detections) and positive manipulations (i.e., generating
detector events that are not caused by single photon detections) in a
relatively short time with a high statistical significance.
The detector self-testing  makes no assumptions on the nature of the
manipulation attack of the detector, and thus also covers manipulations
that are not of the known nature like detector blinding and fake states.
As the self-testing can be
accomplished by a relatively simple light source (as long as this is outside
the control and knowledge of an adversary), this scheme can address one of the
most significant hardware vulnerabilities of QKD systems in a significantly
simpler way as compared to device-independent or measurement-device independent
approaches, and may even be a suitable to retrofit existing QKD systems
to make them resilient against detector manipulation attacks.


\section*{Acknowledgements}
This work was supported by by the National Research Foundation (NRF) Singapore
(Grant: QEP-P1), and through the Research Centres of Excellence programme
supported by NRF Singapore and the Ministry of Education, Singapore.
\section*{Disclosures}
LJS: S-Fifteen Instruments Pte. Ltd. (C,P), CK: S-Fifteen Instruments Pte. Ltd. (I,S,P).
\bibliographystyle{osajnl}
\bibliography{ref_optica}






\end{document}
