A CAP for Healthy LivingMainstreaming Health into the EU Common Agricultural Policy
European Public Health Alliance (EPHA), 2015

1.   Introduction

Compared with classical information hiding, quantum information hiding has unparalleled advantages based on the non-cloning theorem, uncertainty principle, quantum non-locality, such as good security and high information transmission efficiency. Since Bennett and Brassard proposed the first quantum cryptography communication protocol in 1984 ^[1], many quantum cryptographic communication protocols such as quantum key distribution (QKD) ^[2,3,4], quantum identity authentication (QIA) ^[5], quantum secrets sharing (QSS) ^[6,7,8] and quantum security direct communications (QSDC) ^[9,10] have emerged. In recent years, the theoretical research and application of quantum communication has been developed in a variety of ways, including quantum computation ^[11], quantum remote state preparation ^[12,13,14], quantum network coding ^[15,16], quantum auction ^[17] and quantum machine learning ^[18,19].

Among them, quantum steganography, as a research branch of quantum information hiding, aims at covertly transmitting secret information in public quantum channel. Usually, it can be mainly divided into two categories. The first one is to use quantum communication characteristics to perform covert communication through single-particle or multi-particle as quantum carriers ^[20,21,22]. In 2018, Zhu et al. proposed a novel quantum steganography protocol based on Brown entangled states, which proved its good security resisting on quantum noise ^[23]. The second is to embed secret information into various multimedia carriers for covert communication ^[24,25]. In 2018, Qu et al. proposed a novel quantum image steganography algorithm based on exploiting modification direction ^[26].

So far, most of the previous quantum steganography protocols are mainly based on discrete variables. Recently, the continuous variable quantum communication technique is beginning to emerge ^[27]. It uses a classical light source as a signal source, and can encode information on a continuously changing observable physical quantity with low cost due to easy implementation. The encoded information is a symbol, which can be restored to binary bits only after some specific data processing. Therefore, the capacity of this technique can be large and the key generation rate is also high, which has quickly attracted widespread attention. As an example, the continuous-variable quantum key distribution (CVQKD) has absolute advantages over the discrete-variable quantum key distribution (DVQKD). The detection of DVQKD is based on single photons. The single photon signal is not only difficult to manufacture, but also difficult to be detected and costly. The CVQKD is using homodyne/heterodyne decoding to obtain quadrature encoding, which greatly improves the technical efficiency. In addition, non-Gaussian operations have many applications in improving the quantum entanglement and teleportation. In 2003, Olivares et al. proposed the Inconclusive photon subtraction (IPS) to improve teleportation ^[28]. In 2015, Wu et al. applied local coherent superposition of photon subtraction and addition to each mode of even entangled coherent state to introduce a new entangled quantum state ^[29]. In 2018, the CVQKD with non-Gaussian quantum catalysis was proposed ^[30].

In this paper, a continuous variable quantum steganography protocol is proposed based on the continuous variable GHZ entangled state ^[31] and the continuous variable quamtum identity authentication protocol ^[32]. The protocol can realize the transmission of deterministic secret information in public quantum channel of identity authentication. It can convert segmented secret information into the whole secret information by adopting the specific encoding rule, randomly selecting quantum channel and replacing time slot. Through effectively verifying the identity of users, in the new protocol, the secret information can be implicitly transmitted to the recipient Bob, while the eavesdropper Eve disables to detect the existence of covert communication. Compared with the previous quantum steganography protocols, by introducing continuous variables into quantum steganography and making full use its characteristics of continuous variable, the proposed protocol can obtain the advantages of good imperceptibility, security and easy implementation for good applicability.

The paper is organized as follows. Section 2 introduces some basic knowledge about optics, the preparation of continuous variable GHZ states, and the principle of continuous variable quantum telecommuting required for the identity authentication process. Section 3 describes the concrete steps of the new continuous variable quantum steganography protocol in detail. Section 4 mainly analyzes the new protocol's imperceptibility, security and efficiency of information transmission, even in quantum noise environment. The conclusions are given in Section 5.

2.   Preliminary

2.1.   Quantum continuous variable and its encoding rules

We first review some of the knowledge of quantum optics. By using the creation operator $ {a^\dagger }$ and the annihilation operator $ a $, the two regular components including the amplitude x and the phase p of a beam can be expressed as

where $ {a^\dagger } $ and $ a $ satisfy boson reciprocity $ \left[{a, a} \right] = \left[{{a^\dagger }, {a^\dagger }} \right]{\rm{ = 0}} $, $ \left[{a, {a^\dagger }} \right] = 1 $. Therefore $ \left[{x, p} \right] = \frac{i}{2} $, two typical components x and p satisfy the Heisenberg uncertainty principle: $ \Delta x \cdot \Delta p \ge \frac{1}{4} $.

A squeezed beam can be defined as

where $ r $ is the compression factor. If $ r < 0 $, it indicates that the beam amplitude is compressed; if $ r > 0 $, it indicates that the beam phase is compressed. $ x\left(0 \right) $ and $ p\left(0 \right) $ indicate the amplitude and the phase of the vacuum state respectively, and $ \; x\left(0 \right), p\left(0 \right) \sim N\left({0, \frac{1}{4}} \right) $.

In the proposed protocol, the legal communication parties share the encoding rule in advance. They can encode the discrete information into different intervals(Turbo codes ^[33] or LDPC code ^[34]).

2.2.   Preparation of continuous variable GHZ state

The continuous variable GHZ state is very important for quantum information processing and quantum communication in the new protocol. As shown in Figure 1, the continuous variable GHZ state is produced by making two squeezed vacuum states $ {a_{in1}} $ and $ {a_{in2}} $ pass through a beam splitter $ B{S_1} $ (transmission coefficient is 0.5) to generate $ {a_{out1}} $ and $ a_{in3}^ * $ firstly. And then, it makes $ a_{in3}^ * $ and another squeezed vacuum state $ {a_{in3}} $ pass through a beam splitter $ B{S_2} $ (transmission coefficient is 1) to generate $ {a_{out2}} $ and $ {a_{out3}} $. Obviously, $ {a_{out1}} $, $ {a_{out2}} $ and $ {a_{out3}} $ is a set of the continuous variable GHZ entangled state that be defined as

Let suppose that $ {r_1} = {r_2} = {r_3} = r $, it can calculate the correlation of amplitude and phase between $ {a_{out1}} $, $ {a_{out2}} $ and $ {a_{out3}} $

If the compression parameter $ r \to + \infty $, the correlation between the output optical modes $ {a_{out1}} $, $ {a_{out2}} $ and $ {a_{out3}} $ will become stronger and stronger

It is obvious that the amplitude between any two of the continuous variable GHZ state output modes is positively correlated, and the phase between them also has the entanglement characteristic.

2.3.   The principle of continuous variable quantum telecommuting

The principle of continuous variable quantum telecommuting can be described as shown in Figure 2. Alice prepares a coherent state $ {a_A} = \left| {{x_A} + i{p_A}} \right\rangle $ to be transmitted. Simultaneously, Alice and Bob share two entangled optical modes $ {a_{out1}} $ and $ {a_{out2}} $. After everything is ready, Alice sends the coherent state and $ {a_{out1}} $ through a 50/50 beam splitter for Bell state measurement to obtain $ {x_o} $ and $ {p_o} $

After Alice announces the measurement results through the classic channel, Bob takes the corresponding unitary operation $ D\left({\beta {\rm{ = }}\sqrt {\rm{2}} \left({{x_o} + i{p_o}} \right)} \right) $ on $ {a_{out2}} $ to obtain

According to Eqs. (2.13) and (2.14), if the compressing parameter $ r \to + \infty $, we can obtain $ {x_B} = {x_A} $, $ {p_B} = {p_A} - {p_{out3}} $. It means that Alice and Bob obtain a highly correlated sequence on the amplitude component. Therefore, in the proposed protocol, we only modulate the effective information on the amplitude component and the uncorrelated random information $ n $ on the phase component.

3.   Continuous variable quantum steganography protocol

We propose a novel continuous variable quantum steganography protocol based on quantum identity authentication protocol and continuous variable GHZ state. It can effectively transmit deterministic secret information in the public quantum channel. When Bob attempts to communicate with Alice, they need to share an initial identity key $ {K_1} $ and a series of time slot keys $ \; T $ which are binary sequences known only to Alice and Bob in advance. Here, $ D\left(\alpha \right) $, $ D\left({{\alpha _1}} \right) $ and $ D\left({{\alpha _1}^\prime } \right) $ are the displacement operation; $ D\left(o \right) $ is the unitary operation, and $ H $ is the fidelity parameter. The yellow area represents the normal information transmission mode. The red area represents the secret information transmission mode.

The details of the protocol are shown in Figure 3. We assume that the quantum channel is lossless, the proposed protocol is as follows.

Alice prepares the continuous variable GHZ entangled states $ {a_{out1}} $, $ {a_{out2}} $ and $ {a_{out3}} $. Alice keeps $ {a_{out1}} $ by herself, then transmits $ {a_{out2}} $ and $ {a_{out3}} $ to Bob through two quantum channels R1 and R2 respectively. Alice randomly selects a quantum channel for normal information transmission mode (identity authentication). The other is the channel of the secret information transmission mode (steganographic information).

The normal information transmission mode:

(A1) Alice chooses $ {a_{out2}} $ (R1 channel) or $ {a_{out3}} $ (R2 channel) to send to Bob. For convenience, we assume that the channel selected by the normal information transmission mode is the R1 channel.

(A2) After Alice confirms that Bob has received $ {a_{out2}} $, she converts $ {K_1} $ to decimal sequence $ {k_1} $. And then, Alice selects two decimal numbers $ {k_2} $ and $ v $, satisfying the normal distribution $ N\left({0, {\sigma ^2}} \right) $. Alice prepares a vacuum state $ \left| 0 \right\rangle $ with displacement operation $ D\left({{\alpha _1}{\rm{ = }}\left({{k_1} + {k_2}} \right) + in} \right) $. The coherent state optical mode $ {a_1} $ which is used to update the identity key, is obtained. Simultaneously, Alice also prepares a vacuum state with displacement operation $ D\left({{\alpha _1}^\prime = ({k_1} + v) + in} \right) $. The coherent state optical mode $ {a_1}^\prime $, which is used as a decoy state for identity authentication, is obtained. After that, Alice randomly selects $ {a_1} $ or $ {a_1}^\prime $ to make Bell state measurement with $ {a_{out1}} $ on each time slot and obtains, $ {x_o} = \frac{1}{{\sqrt 2 }}\left({{x_1} - {x_{out1}}} \right) $ and $ {p_o} = \frac{1}{{\sqrt 2 }}\left({{p_1} + {p_{out1}}} \right) $, or $ {x_o} = \frac{1}{{\sqrt 2 }}\left({{x_1}^\prime - {x_{out1}}} \right) $ and $ {p_o} = \frac{1}{{\sqrt 2 }}\left({{p_1}^\prime + {p_{out1}}} \right) $. Then, Alice announces $ {x_o} $ and $ {p_o} $ to Bob through the public classic channel.

(A3) According to the received $ {x_o} $ and $ {p_o} $, Bob performs the unitary operation $ D\left({o = \sqrt 2 \left({{x_o} + i{p_o}} \right)} \right) $ on the received $ {a_{out2}} $, and then selects the amplitude component to measure and get the sequence $ \delta $. Alice publishes the time slots $ t $ which used $ {a_1}^\prime $, and Bob measures the amplitude components on these time slots to obtain a sequence $ {\delta _1}^\prime $. The value of sequence $ \delta $ minus sequence $ {\delta _1}^\prime $ is defined as $ {\delta _1} $.

(A4) Bob converts $ {K_1} $ to a decimal sequence $ {k_1}^\prime $, then calculates $ v' = {\delta _{\rm{1}}}^\prime - {k_1}^\prime $. After Bob announces $ v' $, Alice calculates a fidelity parameter $ H = {\left\langle {{{\left[{v'- \varphi v} \right]}^2}} \right\rangle _{\min }} $. In the lossless channel, we get $ \varphi {\rm{ = }}1 $. If the calculation $ H $ is equal to 0, it means $ {k_1} = {k_1}^\prime $. The user identity is verified to be legal. Bob then updates the identity key sequence $ {\delta _1} - {k_1}^\prime $ to obtain $ {k_2} $. If $ H $ is greater than 0, it means that the eavesdropper Eve exists or the user is illegal. As a result, the communication will be abandoned.

The secret information transmission mode:

(B1) Alice divides her steganographic information into p-blocks for block transmission. Let assume that the steganographic information of the q-th block $ \left({q \le p} \right) $ is 010. According to the previously shared encoding rule, steganographic information 010 corresponds to the interval $ \left({ - 2, - 1} \right] $. After that, Alice takes the first time slot $ {T_a} $ from the binary time slot key $ T $ and converts it to a decimal number $ {t_a} $. And then, she chooses the random variable $ m \in \left({ - 2, - 1} \right] $, and does the translation operation $ D\left({\alpha = \; m + in} \right) $ on $ {a_{out3}} $ in the time slot $ {t_a} $ to get $ {a_{out3}}^\prime $, where $ m $ is the secret information that needs to be transmitted. Alice sends $ {a_{out3}}^\prime $ to Bob via quantum channel R2.

(B2) Bob also obtains $ {t_a} $ based on the shared time slot key, and measures the amplitude component of the received beam mode $ {a_{out3}}^\prime $ in the time slot $ {t_a} $ to obtain the sequence $ {\xi _1} $. After that, Bob then selects the time slot $ {t_u}\left({u \ne a} \right) $ to measure the amplitude component for obtaining the sequence $ {\xi _2} $. Bob calculates $ {\xi _1}{\rm{ - }}{\xi _2} $ to obtain the secret information $ m $.

(B3) According to the previously shared encoding rule, the information of the q-th block is obtained by Bob. The identity keys of both parties are also updated, and the transmission of the secret information of this block is completed. In the next round, Alice randomly selects one quantum channel for normal information transmission mode, and another quantum channel for secret information transmission mode. Then Alice repeats the above steps until all the steganographic information are transmitted.

As shown in Figure 3, when Alice wants to transmit private information to Bob, she randomly selects a quantum channel for identity authentication by using the modulated vacuum states and the continuous variable quantum telecommuting. At the same time, after the encoded secret information is modulated in the shared time slot, the transmission of the secret information is also carried out in another quantum channel. Under the cover of determining whether the Bob's identity is legal, it is difficult for an eavesdropper to discover that another channel is transmitting information. Even if the eavesdropper knows the existence of the secret information, it is impossible to obtain useful information without knowing the modulated time slot and the encoding rule.

In the field of experiment, the protocol is also feasible. The secure transmission using entangled squeezed states has been exemplified ^[35]. The experimental demonstration of the continuous variable quantum telecommuting has also been proposed ^[36]. Our protocol is mainly based on these two techniques. Therefore, this protocol is capable of having good performance in experiments.

4.   Security analysis

The security of the scheme is mainly based on the entanglement properties of the GHZ state, the specific encoding rule, the shared time slot key and the block transmission. Among them, quantum entanglement guarantees the correlation of quantum transmission. The encoding rule ensures that the information in the quantum channel is not completely equal to the identity key information. The shared time slot key decides the writing and reading of the secret information.

The normal message transmission mode is to avoid Eve's active attack through identity authentication. In order to conduct an active attack, Eve needs to be authenticated. The most effective method is to obtain an updated authentication key and implement an active attack in the next authentication flow. In order to obtain the updated authentication key, Eve's good optional method is to intercept all the quantum signals sent by Alice and measure their components. Combined with the information sent by the classic channel, Eve can recover the updated authentication key and prepare a quantum state to send to Bob during an authentication process. However, due to the quantum uncertainty principle, Eve will inevitably introduce excessive noise, which will be detected by the legal user through the calculation of the fidelity parameter. As shown in Figure 3, there are two quantum channels and two classical channels in the proposed protocol. We have always assumed that the information transmitted in the classical channel is public, and the security of the normal information transmission mode has been proved above ^[32]. Therefore, we focus on the security of the secret information transmission mode.

It's noteworthy that this protocol may suffer from physical attacks, such as the wavelength attack. This kind of attack makes full of use of the potential imperfections in the protocol's implementation to enable the eavesdropper to control the light intensity transmission of the receiver's splitter. The attack method is to intercept the beam and measure the signal using the local oscillator by heterodyne measurement to obtain the quadrature values, and then switch the wavelength of the input light. It can make the eavesdropper completely control the receiver's beam splitter without being discovered. In this case, the new protocol is also capable of resisting the attack by randomly adding or not adding a wavelength filter before the monitoring detector and observing the difference value ^[37].

Because only two quantum channels (R1 and R2) are used to transmit quantum information and the information is modulated on the amplitude and phase of the beam, the attacker Eve can take an attack by using a spectroscope to intercept the signal for measurement and attempting to obtain the key. As shown in Figure 4, Let assume that the spectroscopic coefficient used by Eve is $ \gamma \left({0 \le \gamma \le 1} \right) $. The two beams $ {a_{A1}} $ and $ {a_{A2}} $ sent by Alice pass through the beam splitter and become

Eve can obtain $ {a_{E1}} $ and $ {a_{E2}} $

According to the difference of the spectroscopic coefficients, the safety analysis can be carried out in three cases:

1. If $ \gamma = 0 $, Eve intercepts all signals. In this case, Eve may combine $ {a_{E1}} $ and $ {a_{E2}} $ with the Bell state measurement to obtain

Due to the correlation between the amplitudes of $ {a_{A1}} $ and $ {a_{A2}} $, Eve measures the amplitude component, as $ {x_u} \to 0 $. Even if the time slot containing the secret information has been stolen, Eve disables to get any information. The phase of $ {a_{A1}} $ and $ {a_{A2}} $ does not modulate the secret information, and only the uncorrelated random information $ n $ exists. Therefore, Eve will only think that it is the ordinary noise in the quantum channel, so that the transmission of the secret information can be undetected.

Eve may also measure $ {a_{A1}} $ and $ {a_{A2}} $ separately. According to the principle of key modulation, let assume that Eve measures the amplitude of $ {a_{A1}} $ and the phase of $ {a_{A2}} $ respectively. Because the correlation of amplitude, Eve can recover $ {a_{A2}} $ after measurement. However, due to the quantum uncertainty principle, Eve cannot recover the phase of $ {a_{A1}} $ and this operation will reduce the phase entanglement of the GHZ state. It will inevitably be detected by performing eavesdropping detection from legitimate parties.

It can be seen that Eve's eavesdropping will be detected by legitimate parties, and this protocol can safely transmit secret information when $ \gamma = 0 $.

2. If $ \gamma {\rm{ = 1}} $, Eve does not take any action, obviously cannot get any information.

3. When $ 0 \le \gamma \le 1 $, Eve only intercepts part of the signal, and another part of the signal is still transmitted to the receiver.

In this case, due to the entanglement properties of the GHZ state, Eve cannot obtain effective information with the Bell state measurement, so Eve can only operate on $ {a_{E1}} $ and $ {a_{E2}} $ separately. Because the secret information is modulated on one of the quantum channels, let choose $ {a_{E1}} $ to analyze it as an example. Let Assume that the quantum channel transmission efficiency is $ \lambda $, the signal received by Bob will be

Eve needs to amplify $ {a_{E1}} $ to avoid being detected and sends it to Bob with $ {a_{B1}} $. The effective signal received by Bob is

Here, $ g $ is the gain compensation. According to Eqs. (4.1), (4.3) and (4.8), in order to receive the signal $ \sqrt \lambda {a_{A1}} $ for Bob, it needs to be satisfied with

Eve obtain $ g = \frac{{\sqrt \gamma - \sqrt \lambda }}{{\sqrt {1 - \gamma } }} $. Due to the information is modulated on the amplitude component, the noise signal received by Bob will be

If $ \gamma \ne \lambda $ and $ {a_N} \ne \sqrt {1 - \lambda } {x_{N1}} $, the signal-to-noise ratio received by Bob will change. The legitimate parties will find Eve in the eavesdropping detection. If $ \gamma {\rm{ = }}\lambda $, $ g{\rm{ = }}0 $, it does not require the gain compensation. Eve will be undetected by the legitimate parties.

Therefore, if $ 0 \le \gamma \le 1 $, Eve can adopt the best attack method is intercepting by a beam splitter with the same spectroscopic coefficient and channel transmission efficiency. The signal received by Eve will be

The signal received by Bob is

According to Eq. (2.6), the amplitude components of Eve and Bob are obtained as follows

Here, $ {x_{N1}} \sim N\left({0, {V_{N1}}} \right) $. If we measure the amplitude of $ {a_{B1}} $, only $ \sqrt {\frac{\lambda }{3}} {e^r}{x_1}\left(0 \right) $ will be the effective signal, while the rest are noise. The signal-to-noise ratio of Bob can be calculated as

The amount of information between Alice and Bob is

Similarly, the signal-to-noise ratio of Eve is

The amount of information between Alice and Eve is

Therefore, according to the Shannon information theory, the quantum channel transmission rate is

If $ {V_{N1}}{\rm{ = }}\frac{1}{4} $, the secret information transmission rate obtained by Eq. (4.19) is as shown in Figure 5. The secret information transmission rate $ \Delta I $ is proportional to the quantum channel transmission efficiency $ \lambda $. If the channel transmission efficiency $ \lambda < 0.5 $, the information transmission rate $ \Delta I < 0 $, the amount of information acquired by Eve is greater than the amount of information obtained by Bob, so that the channel is unsafe. If the channel transmission efficiency $ \lambda > 0.5 $, the information transmission rate $ \Delta I > 0 $, the secret information transmission can be carried out safely. The security of the proposed protocol is also dependent on the entanglement properties of the continuous variable GHZ state. If the compression parameter $ r = 0 $, the information transmission rate will reach 0. It is almost impossible to transmit information. If the compression parameter $ r $ increases, the information transmission rate also increases. Compared with discrete variable communication, it can also greatly reduce the quantum states that need to be prepared and shorten the time required for information transmission. For example, the discrete variables communication can only transmit 1 bit of classical information per qubit. If a deterministic key of 1000 bits is needed, at least 1000 qubits are required. In the proposed protocol, if $ r = 3 $ and the channel transmission efficiency is equal to 0.9, the information transmission rate will be 4 qubits/s. At this point, only 250 qubits is required to complete the same work. So it's obviously that the efficiency of information transmission can be greatly improved.

5.   Conclusion

This paper proposes a novel continuous variable quantum steganography protocol based on quantum identity authentication. For covert communication, the protocol implements the transmission of secret information in public channel of quantum identity authentication. Compared with the existing quantum steganography results, by taking full advantage of entanglement properties of continuous variable GHZ state, this protocol not only has the advantages of good imperceptibility and easy implementation in physics, but also good security and information transmission efficiency, even under eavesdropping attacks especially to the spectroscopic noise attack. In addition, the capacity of secret information is potential to be enlarged by introducing better information coding method.

Acknowledgments

This work was supported by the National Natural Science Foundation of China (No. 61373131, 61601358, 61501247, 61672290, 61303039, 61232016), the Six Talent Peaks Project of Jiangsu Province (Grant No. 2015-XXRJ-013), Natural Science Foundation of Jiangsu Province (Grant No. BK20171458), the Natural Science Foundation of the Higher Education Institutions of Jiangsu Province (China under Grant No.16KJB520030), Sichuan Youth Science and Technique Foundation (No.2017JQ0048), NUIST Research Foundation for Talented Scholars (2015r014), PAPD and CICAEET funds.

Conflict of interest

The authors declare no conflict of interest.