1. Introduction

Secure communications are currently an issue that concerns numerous scientists and engineers over the world because the demand for confidential information transmission between distantly separated communicating parties spawns every day [1,2]. Secret keys shared by the communicating parties are necessary when symmetric encryption is adopted to protect the confidential information transmission against malicious eavesdropping. Hence, secret-key sharing is important for secure communications based on symmetric encryption. Secret-key agreement has been initially suggested in [3,4] to share common keys between two communicating parties with information-theoretic security. To date, different methods for implementing the secret-key agreement have been reported in the literature [5–25], e.g., the quantum key distribution (QKD) [5–7], classical optical key distribution (OKD) [8–13] and channel-based key extraction (CKE) [14–25]. These methods have been actively studied in recent years. Generally speaking, the QKD is currently still technically demanding and costly, especially when it operates in an atmospheric wireless environment. In the classical OKD, initial random bit sequences are first transmitted from the sender to the receiver by using classical optical signals; subsequently, the sender and receiver agree on the final keys based on the transmitted random bit sequences. The CKE, which is another distinctive paradigm of secret-key agreement, treats a reciprocal random channel as a common randomness source and generates shared keys from it. If we take into account different application scenarios, the QKD, OKD and CKE should be regarded as three complementary technologies for secret-key sharing with information-theoretic security.

Until now, much research work [19–25] on the CKE has utilized the common randomness source provided by reciprocal radio-frequency (RF) wireless channels. Besides, generation of secret keys from optical wireless channels through atmospheric turbulence also attracts much attention in recent years [14–18]. The turbulence-induced perturbation can cause randomness in optical wireless channels. It has been proved both theoretically and experimentally [26,27] that single-mode atmospheric optical channels can maintain fading reciprocity. Indeed, extracting secret keys from atmospheric optical channels is a promising solution to long-distance secret-key agreement between two terminals operating in the earth’s atmosphere in certain cases, such as those in which other form of secret-key agreement is unavailable. It provides us with a paradigm of utilizing turbulence-induced optical perturbation to benefit confidential information transmission.

The majority of reported investigation concerning the CKE [15,16,19,20,23] has utilized scalar quantization to change channel measurements to discrete key bits because implementing it is relatively straightforward. Statistical correlation between consecutive channel measurements generally results in statistical correlation between bits in a key generated by using a scalar quantization scheme to quantize each channel measurement separately [24,25]. Although a key bit sequence can be randomized by performing privacy amplification [1], making the randomness of the key bit sequence as high as possible before carrying out privacy amplification is still paramount. From this point of view, statistical uncorrelation between consecutive channel measurements is really preferred [24,25]. Generally, the measurement rate of the channel state is required to be decreased to a proper value depending on the channel’s correlation time for ensuring the uncorrelation between consecutive channel measurements; this requirement imposes a restriction on the number of extracted key bits per second. To break this restriction, researchers [24,25] first performed a preprocessing operation to decorrelate the channel measurements and then carried out scalar quantization on every decorrelated entry separately; although such method is effective in decorrelating the channel measurements, the covariance matrix of channel estimation vectors and its singular value decomposition (SVD) are needed to be evaluated and the obtained eigenvectors are required to be transmitted from one legitimate party to the other legitimate party over a public channel, thus leading to additional computational complexity and transmission cost.

Physically, correlation between consecutive channel measurements can be attributed to the lack of random variations in these measurements. Note that, atmospheric optical channel fading seldom changes within the correlation time of turbulence-induced optical fluctuations [28]. If the sampling interval employed in the measurement of the channel fading is smaller than such correlation time, consecutive channel measurements are inevitably statistically correlated. Intuitively, if we can make the optical signal intensity output from the transmitter of an optical channel fluctuate randomly beforehand, with a correlation time much smaller than the correlation time of turbulence-induced optical fluctuations, consecutive channel measurements obtained with a sampling interval much smaller than the correlation time of turbulence-induced optical fluctuations are possible to be statistically uncorrelated. Random fluctuations can be introduced into the initial transmitted optical-signal intensity by use of random modulation. With these observations in mind, we become aware of the possibility of decorrelating consecutive channel measurements and hence increasing the number of extracted uncorrelated key bits per second by utilizing random modulation. Here it should be pointed out that use of random modulation at the two legitimate communicating terminals gives rise to the problem that the cross-correlation between the optical-signal fluctuations observed by the two legitimate communicating parties may decrease significantly, which will become apparent later, hence making the secret-key extraction unavailable. To address this problem, we will propose, in Sec. 2, a novel randomness sharing scheme for enhanced secret-key extraction and thereby construct a new type of common randomness source, which is compatible with the random modulation.

To comprehend how random modulation impacts enhanced secret-key extraction from our new common randomness source that can break the aforesaid restriction on the number of extracted uncorrelated key bits per second, it is necessary to develop theoretical models for both the temporal autocorrelation of our randomness source’s fluctuations observed by the legitimate parties and the cross-correlation between our randomness source’s fluctuations observed by the two legitimate parties and between our randomness source’s fluctuations observed by the legitimate party and eavesdropper. Furthermore, it is worthwhile to examine the effects of random modulation on the enhanced secret-key extraction from an information-theoretic perspective; thereby one can clarify how random modulation affects the fundamental limits on the secret-key capacity. The above consideration motivates the work presented here. The remainder of this paper is organized as follows. First, in Sec. 2, we elaborate our novel key-extraction oriented randomness sharing scheme and construct the relevant new type of common randomness source theoretically. Second, we develop, in Sec. 3, the correlation models for the legitimate parties’ observations of such common randomness source. Subsequently, we deal with the eavesdropping risk and secret-key capacity in consideration of using our randomness sharing scheme in Secs. 4 and 5, respectively. Finally, conclusions are drawn in Sec. 6.

2. Key-extraction oriented randomness sharing using an atmospheric optical channel with random modulation

The objective of the CKE is to let two legitimate communicating parties agree on a key by exploiting the channel’s inherent randomness shared by them, while concealing the key from an eavesdropper. Randomness sharing is the first step in an actual implementation of secret-key agreement. After carrying out the randomness sharing step, the legitimate parties obtain a given number of their own observations of the shared common randomness. In this section, we propose a novel randomness sharing scheme that uses atmospheric optical channels equipped with random modulation to produce a common randomness source whose temporal autocorrelation can be decreased by the legitimate parties via performing random modulation; later we refer to the source of common randomness generated by our randomness sharing scheme as controllable common randomness source with memory (CCRSM).

To proceed further, let us consider a reciprocal single-mode bidirectional optical channel through the atmosphere illustrated by Fig. 1, where the two legitimate terminals, referred to as Alice and Bob, respectively, can transmit and receive optical signals simultaneously, and a passive eavesdropper, called Eve, can also collect the optical signal waves, coming from Alice and Bob, outside the receiving pupils of the legitimate terminals. In Fig. 1, Eve is located in proximity to Bob. Apparently, Eve can also be located close to Alice. However, in our subsequent theoretical development, we assume that Eve is situated close to the right terminal (i.e., Bob). We emphasize here that this assumption does not impose any restrictions on the generality of our theoretical formulations, because the formation of the left and right terminals is identical and they are designated arbitrarily; i.e., we can also refer to the left terminal as Bob and the right terminal as Alice. With respect to Eve’s eavesdropping action, we comment that, from a practical standpoint, it is extremely difficult for Eve to intercept the main lobe of a propagated laser beam without revelation of her malicious action because of the line-of-sight nature of free-space optical propagation [9]. Hence, in this work, we take into account the practically feasible eavesdropping case shown by Fig. 1, where Eve is situated at a position of the divergence region of propagated optical beams, and collects the optical signal waves outside the legitimate terminals’ receiving pupils.

 

Fig. 1. Schematic diagram of a reciprocal single-mode bidirectional atmospheric optical channel equipped with random modulation.

Download Full Size | PDF

The optical signal received by Alice at time t can be expressed by

With Eqs. (1) and (2) in hand, we can further formulate the photocurrent output by the legitimate party’s photodetector as

We note that Eve in Fig. 1 can simultaneously collect optical signals coming from Alice and Bob, respectively, at her own position. Such eavesdropping action of Eve may compromise the secrecy of the legitimate parties’ key extraction. Theoretical development and analysis from the eavesdropper’s perspective will be presented in Sec. 4.

3. Correlation models for legitimate parties’ observations of CCRSM

To clarify the distinctive nature of the CCRSM, in this section, we theoretically characterize the autocorrelation and cross-correlation behaviors of ${\phi _A}(t)$ and ${\phi _B}(t)$. By theoretically formulating the normalized temporal autocovariance function of ${\phi _A}(t)$ and ${\phi _B}(t)$, we can examine how random modulation impacts the correlation between Alice’s (and Bob’s) consecutive observations of the CCRSM quantitatively. The expression for the normalized temporal autocovariance function of ${\phi _A}(t)$ can be developed to give

If both b_x,A(τ)$\sigma _{x,A}^2$ and b_x,B(τ)$\sigma _{x,B}^2$ become much smaller than 1 when τ increases beyond a value τ_th, Eqs. (5) and (13) can be reduced to

We point out that ζ(⋅,⋅,⋅) in Eqs. (15) and (16) indeed functions as a scaling factor of b_h(τ). It is evident that ζ(γ, $\sigma _1^2,\sigma _2^2$) ≥ 1 with γ > 0, $\sigma _1^2$ ≥ 0, $\sigma _2^2$ ≥ 0 and $\sigma _h^2$ > 0. It can be found that, with other parameters fixed, ζ(γ, $\sigma _1^2,\sigma _2^2$) enlarges with increasing $\sigma _1^2$ or $\sigma _2^2$. Hence, we can make the temporal autocorrelation of both ${\phi _A}(t)$ and ${\phi _B}(t)$ much smaller than the temporal autocorrelation of h_M(t) by using modulation signals whose normalized variance is relatively large and meanwhile whose correlation time is small enough that b_x,A(τ)$\sigma _{x,A}^2$≪ 1 and b_x,B(τ)$\sigma _{x,B}^2$≪ 1 hold true at a value of τ, viz., the said τ_th, which is much smaller than the correlation time of h_M(t). With the above finding in mind, a conclusion can be made that consecutive observations of both ${\phi _A}(t)$ and ${\phi _B}(t)$ obtained by Alice and Bob, respectively, with a given sampling rate may be decorrelated by increasing the normalized variances of modulation signals x_A(t) and x_B(t) under the condition that the correlation time of both x_A(t) and x_B(t) is short enough. Moreover, in practice, the time interval between two consecutive observations of ${\phi _A}(t)$ or ${\phi _B}(t)$ is equal to the temporal sampling interval τ_s associated with the sampling operation of ${\phi _A}(t)$ or ${\phi _B}(t)$. Hence, decorrelating consecutive observations of ${\phi _X}(t)$ is equivalent to making ${b_{\phi ,X}}({\tau _s})$ tend to a negligible value, with the subscript X = “A” or “B”. From a practical perspective, in the case that the correlation time of both x_A(t) and x_B(t) is small enough that b_x,A(τ)$\sigma _{x,A}^2$≪ 1 and b_x,B(τ)$\sigma _{x,B}^2$≪ 1 hold true at a value of τ smaller than τ_s, the statistical correlation between two consecutive observations of ${\phi _X}(t)$ can be dropped to a negligible level by properly increasing ζ(⋅,⋅,⋅), even though the correlation time of h_M(t) is actually a good deal longer than τ_s. This opens a promising pathway for decorrelating consecutive observations of the CCRSM. Here, we emphasize the following three points: 1) the CCRSM is compatible with off-the-shelf wireless optical communication systems using the intensity modulation and direct detection, and hence is easy to construct; 2) x_A(t) and x_B(t) are two independent random modulation signals and thus there is no need for synchronization between them; 3) even though the correlation time of h_M(t) is larger than τ_s, the statistical correlation between two consecutive observations of the CCRSM can be reduced to being negligible by using appropriate random modulation, which does not suffer from the additional computational complexity and transmission cost as in the SVD-based decorrelation operation [24,25].

Below we give a concrete example for demonstration of decorrelating two consecutive observations of ${\phi _A}(t)$ by increasing the normalized variance of the modulation signal. To evaluate the correlation coefficient of two consecutive observations, the normalized temporal autocovariance function b_h(τ) needs to be specified explicitly. For the example given here, we assume that b_h(τ) takes a form of Gaussian-type function, i.e., b_h(τ) = exp(−τ²/τ_h,0²), where τ_h,0 is the correlation time of h_M(t), which is defined as the time delay τ required for b_h(τ) to reach e⁻¹ [29]. Figure 2 illustrates how the growth in $\sigma _{x,A}^2$ affects the correlation coefficient of two consecutive observations of ${\phi _A}(t)$ under the condition that the correlation time of the random modulation signal is rather smaller than the temporal sampling interval τ_s; Fig. 2(a) corresponds to the single-modulation case in which x_A(t) changes randomly with time whereas x_B(t) remains constant; Fig. 2(b) corresponds to the double-modulation case in which both x_A(t) and x_B(t) change randomly with time. It is seen from Fig. 2 that the correlation coefficient of two consecutive observations of ${\phi _A}(t)$ diminishes considerably with increasing $\sigma _{x,A}^2$ for both the single- and double-modulation cases. Comparison of Fig. 2(a) with Fig. 2(b) shows that use of double modulation makes the correlation coefficient decrease more rapidly with increasing $\sigma _{x,A}^2$ than use of single modulation. This phenomenon can be readily justified by examination of Eqs. (15) and (17); because of ζ(γ_A, $\sigma _{x,A}^2,\sigma _{x,B}^2$≡0) < ζ(γ_A, $\sigma _{x,A}^2,\sigma _{x,B}^2 \equiv \sigma _{x,A}^2$), ${b_{\phi ,A}}({\tau _s})$ with $\sigma _{x,B}^2$≡ 0 is greater than that with $\sigma _{x,B}^2$≡$\sigma _{x,A}^2$. Moreover, one can find from Fig. 2 that the decrease in ${b_{\phi ,A}}({\tau _s})$ with $\sigma _h^2$ = 0.3 is less substantial than that with $\sigma _h^2$ = 0.1; specifically, for the single-modulation case, ${b_{\phi ,A}}({\tau _s})$ with $\sigma _h^2$ = 0.3 becomes smaller than 0.2 when $\sigma _{x,A}^2$ increases to 1, whereas ${b_{\phi ,A}}({\tau _s})$ with $\sigma _h^2$ = 0.1 decreases below 0.1 only when $\sigma _{x,A}^2$ grows beyond 0.81; for the double-modulation case, ${b_{\phi ,A}}({\tau _s})$ with $\sigma _h^2$ = 0.3 begins to be smaller than 0.2 when $\sigma _{x,A}^2$ grows beyond 0.39, whereas ${b_{\phi ,A}}({\tau _s})$ with $\sigma _h^2$ = 0.1 is below 0.1 only when $\sigma _{x,A}^2$ grows beyond 0.35. This finding reveals that the normalized variance $\sigma _h^2$ of h_M(t) has an important effect on the reduction in the correlation coefficient caused by increasing $\sigma _{x,A}^2$; smaller $\sigma _h^2$ results in greater reduction in the correlation coefficient with other parameters fixed. The underlying physical reason for this fact is elucidated as follows. Smaller $\sigma _h^2$ implies weaker random fluctuations in h_M(t) and hence h_M(t) plays a less important role in determining the temporal autocorrelation of ${\phi _A}(t)$; in this case, the temporal autocorrelation behavior of x_A(t) becomes more prominent in determining the temporal autocorrelation behavior of ${\phi _A}(t)$.

 

Fig. 2. Correlation coefficient of two consecutive observations of ${\phi _A}(t)$, i.e., ${b_{\phi ,A}}({\tau _s})$, in terms of $\sigma _{x,A}^2$ with γ_A ≡ ∞ and different $\sigma _h^2$; (a) the single-modulation case with $\sigma _{x,A}^2$ > 0 and $\sigma _{x,B}^2$ ≡ 0; (b) the double-modulation case with $\sigma _{x,A}^2$≡$\sigma _{x,B}^2$> 0. The correlation time τ_h,0 and the temporal sampling interval τ_s are specified as 1 ms and 2.5×10⁻⁵ ms, respectively; the correlation time of the random modulation signal is small enough that b_x,A(τ)$\sigma _{x,A}^2$≪ 1 and b_x,B(τ)$\sigma _{x,B}^2$≪ 1 hold true at a value of τ smaller than τ_s.

Download Full Size | PDF

Now we turn our attention to the role of random modulation in determining the cross-correlation between the observations of ${\phi _A}(t)$ and ${\phi _B}(t)$ obtained by Alice and Bob, respectively. The cross-correlation coefficient of ${\phi _A}(t)$ and ${\phi _B}(t)$ can be expressed by

The time argument t is omitted for ρ_AB because of the aforementioned assumption of stationary processes. Introducing Eq. (4) into Eq. (18) and evaluating the ensemble averages therein lead us to

It is apparent that ρ_AB depends on γ_A and γ_B. If both γ_A and γ_B tend to infinity, it follows that ρ_AB → 1. In fact, the normalized variances $\sigma _{x,A}^2$, $\sigma _{x,B}^2$ and $\sigma _h^2$ are combined together in Eq. (19) to act as a scaling factor of γ_A and γ_B. For fixed γ_A and γ_B, enlarging either $\sigma _{x,A}^2$ or $\sigma _{x,B}^2$ causes an increase in ρ_AB, i.e., random modulation increases the cross-correlation coefficient ρ_AB.

4. Analysis of eavesdropping risk in CCRSM-based secret-key extraction

As shown by Fig. 1, besides Alice and Bob, Eve can also obtain measurements of her collected optical signals. Similar to the mathematical development of Eq. (3), we can formulate the photocurrent produced by Eve’s terminal due to her collected optical signal as follows:

The secrecy of keys extracted from observations of the CCRSM counts on the lack of cross-correlation between the legitimate parties’ and eavesdropper’s observations. To assess the eavesdropping risk in secret-key extraction from observations of the CCRSM, below we inspect whether the random modulation makes ${\tilde{y}_{AE}}(t)$ and ${\tilde{y}_{BE}}(t)$ become partially correlated with ${\phi _A}(t)$ and ${\phi _B}(t)$. For this purpose, we first formulate the statistical cross-correlation between ${\tilde{y}_{XE}}(t)$ and ${\phi _A}(t)$ and between ${\tilde{y}_{XE}}(t)$ and ${\phi _B}(t)$, with the subscript X = “A” or “B”. The cross-correlation coefficient of ${\tilde{y}_{XE}}(t)$ and ${\phi _A}(t)$ can be formulated by

It can be found from Eqs. (21) and (25) that both ρ_XE,A and ρ_XE,B are equal to zero if the modulation signal x_X(t) does not vary with time, and are larger than 0 otherwise. This fact reveals that, if x_A(t) does not remain constant with time, Eve can acquire some information about both ${\phi _A}(t)$ and ${\phi _B}(t)$ by observing, at her own position, the fluctuations in the optical signal coming from Alice; if x_B(t) varies with time, Eve can gain some information about both ${\phi _A}(t)$ and ${\phi _B}(t)$ by observing, at her own position, the fluctuations in the optical signal coming from Bob. The underlying reason for this is that the changes in ${\phi _A}(t)$, ${\phi _B}(t)$ and ${\tilde{y}_{XE}}(t)$ are dependent on the variation of the modulation signal x_X(t); in other words, the variation of x_X(t) is shared by ${\phi _A}(t)$, ${\phi _B}(t)$ and ${\tilde{y}_{XE}}(t)$. On the other hand, if x_X(t) is a constant signal, i.e., $\sigma _{x,X}^2$ ≡ 0, it follows that ρ_XE,A = ρ_XE,B ≡ 0. Hence, a conclusion can be made that the random modulation with use of a time-varying signal does result in some information leakage of the CCRSM to the eavesdropper. Incidentally, the detrimental effects of such information leakage on the secrecy of extracted keys can be eliminated by carrying out privacy amplification after the information reconciliation phase.

The preceding analysis reveals that it is Eve’s acquisition of information about the modulation signal that renders ${\tilde{y}_{AE}}(t)$ and (or) ${\tilde{y}_{BE}}(t)$ partially correlated with ${\phi _A}(t)$ and ${\phi _B}(t)$. Intuitively, if Eve knows the modulation signal exactly, she is able to gain the largest amount of information about ${\phi _A}(t)$ and ${\phi _B}(t)$. In recognition of this, we can conceive the worst eavesdropping scenario in which Eve, located in the vicinity of Bob, simultaneously collects the optical signals coming from Alice and Bob, respectively, and, however, the propagation distance from Bob to Eve is not large enough to produce turbulence-induced optical fluctuations, implying that fluctuations in the optical signal observed by Eve coming from Bob can be completely attributed to x_B(t), i.e., fluctuations in the modulation signal x_B(t) are exactly known by Eve. We think that Eve has perfect photodetectors without noises in the worst eavesdropping scenario. In what follows, we concentrate our attention only on the said worst eavesdropping scenario. Notice that, as mentioned earlier, the requirement of keeping legitimate parties unaware of Eve’s existence makes it reasonable to assume that both h_AE(t) and h_BE(t) are statistically independent of h_M(t). In the worst eavesdropping scenario, the legitimate parties can adopt either the single modulation scheme or the double modulation scheme. In the single modulation scheme, only one of the two legitimate parties performs the random modulation, whereas, in the double modulation scheme, both legitimate parties perform the random modulation. Below, we deal with the two schemes separately.

For the single modulation scheme with x_A(t) ≡ 1 and randomly time-varying x_B(t), it follows that ρ_AE,A = ρ_AE,B ≡ 0, ρ_BE,A > 0 and ρ_BE,B > 0. In the worst eavesdropping scenario with x_A(t) ≡ 1 and randomly time-varying x_B(t), the random modulation is actually adopted only by Bob, so one can find that ${\tilde{y}_{AE}}(t)$ is independent of both ${\phi _A}(t)$ and ${\phi _B}(t)$, whereas ${\tilde{y}_{BE}}(t)$, equal to ${R_E}{s_T}{\tilde{h}_{BE}}{x_B}(t)$, is partially correlated with both ${\phi _A}(t)$ and ${\phi _B}(t)$ even though h_M(t), x_B(t), n_A(t) and n_B(t) are independent random quantities, where ${\tilde{h}_{BE}}$ is the deterministic transmission coefficient of the optical channel from Bob to Eve. Later we refer to the worst eavesdropping scenario with x_A(t) ≡ 1 and randomly time-varying x_B(t) as “fully-disclosed-single-modulation worst eavesdropping (FDSM-WE) scenario” for the reason that Eve knows the variation of x_B(t) exactly. On the other hand, for the worst eavesdropping scenario with x_B(t) ≡ 1 and randomly time-varying x_A(t), it can be found that the random modulation is carried out only by Alice, and ${\tilde{y}_{AE}}(t)$ is partially correlated with both ${\phi _A}(t)$ and ${\phi _B}(t)$, whereas ${\tilde{y}_{BE}}(t)$ remains constant and is independent of both ${\phi _A}(t)$ and ${\phi _B}(t)$, implying that ρ_BE,A = ρ_BE,B ≡ 0, ρ_AE,A > 0 and ρ_AE,B > 0. Thereinafter, the worst eavesdropping scenario with x_B(t) ≡ 1 and randomly time-varying x_A(t) is called “partially-disclosed-single-modulation worst eavesdropping (PDSM-WE) scenario” for the reason that ${\tilde{y}_{AE}}(t)$ is only partially correlated with x_A(t).

Figure 3 illustrates the cross-correlation coefficients of ${\tilde{y}_{BE}}(t)$ and ${\phi _X}(t)$ and of ${\tilde{y}_{AE}}(t)$ and ${\phi _X}(t)$ as a function of $\sigma _{x,B}^2$ and $\sigma _{x,A}^2$ in the FDSM-WE and PDSM-WE scenarios, respectively, where the subscript X = “A” or “B”. It can be seen from Fig. 3 that the cross-correlation coefficients enlarge with increasing $\sigma _{x,B}^2$ or $\sigma _{x,A}^2$, implying that enlarging the normalized variance of the randomly time-varying modulation signal, with other parameters fixed, leads to an increase in the said cross-correlation coefficients. This fact demonstrates that Eve can gain a larger proportion of information about both ${\phi _A}(t)$ and ${\phi _B}(t)$ when $\sigma _{x,B}^2$ (or $\sigma _{x,A}^2$) becomes greater in the FDSM-WE (or PDSM-WE) scenario. The physical reason for this phenomenon is that the role of the modulation signal’s variation, which can be perceived somewhat by Eve, becomes more prominent in determining the aforementioned cross-correlation coefficients when $\sigma _{x,B}^2$ (or $\sigma _{x,A}^2$) turns greater. One can see from Fig. 3 that each curve therein, with increasing $\sigma _{x,B}^2$ or $\sigma _{x,A}^2$, saturates to a certain level depending on the relevant specific parameter combinations. In fact, it is easy to find from Eqs. (21) and (25) that ρ_BE,A and ρ_BE,B tend to ($\sigma _h^2$+1)^−1/2 and ($\sigma _h^2$+1+$\gamma _B^{ - 1}$)^−1/2, respectively, when $\sigma _{x,B}^2$ → ∞ in the FDSM-WE scenario, and ρ_AE,A and ρ_AE,B tend to [($\sigma _{h,AE}^2$+1)($\sigma _h^2$+1+$\gamma _A^{ - 1}$)]^−1/2 and [($\sigma _{h,AE}^2$+1)($\sigma _h^2$+1)]^−1/2, respectively, when $\sigma _{x,A}^2$ → ∞ in the PDSM-WE scenario. Hence, the saturated level of the curves in Figs. 3(a) and 3(b) depends only on $\sigma _h^2$ and γ_B; the saturated level of the curves in Figs. 3(c) and 3(d) is determined only by $\sigma _h^2$, $\sigma _{h,AE}^2$ and γ_A. For instance, if $\sigma _{h,AE}^2$=$\sigma _h^2$=0.3, ρ_AE,B in the PDSM-WE scenario is always not larger than 1.3⁻¹ no matter what value $\sigma _{x,A}^2$ takes on. It is straightforward to infer that greater $\sigma _h^2$ leads to smaller cross-correlation coefficients with other parameters fixed. From this observation, one can roughly predict that greater $\sigma _h^2$ results in a smaller leakage proportion of information about ${\phi _A}(t)$ and ${\phi _B}(t)$. Moreover, comparison of Figs. 3(a) and 3(b) with Figs. 3(c) and 3(d) reveals that, with the same normalized variance of the fluctuating channel transmission coefficient and normalized variance of the randomly time-varying modulation signal, ρ_BE,X in the FDSM-WE scenario is larger than ρ_AE,X in the PDSM-WE scenario. This roughly means that, with identical normalized variance of the random modulation signals and fixed $\sigma _h^2$, the information leakage to Eve in the PDSM-WE scenario is smaller than that in the FDSM-WE scenario.

 

Fig. 3. Cross-correlation coefficients of ${\tilde{y}_{BE}}(t)$ and ${\phi _X}(t)$ and of ${\tilde{y}_{AE}}(t)$ and ${\phi _X}(t)$ as a function of $\sigma _{x,B}^2$ and $\sigma _{x,A}^2$ in the FDSM-WE and PDSM-WE scenarios, respectively, where the subscript X = “A” or “B”; ${\gamma _A}$=${\gamma _B}$=20, ${\gamma _{AE}}$= ∞, and ${\gamma _{BE}}$= ∞; (a) and (b) correspond to the FDSM-WE scenario where ${\tilde{y}_{BE}}(t)$=${R_E}{s_T}{\tilde{h}_{BE}}{x_B}(t)$ and ${\tilde{y}_{AE}}(t)$ is independent of ${\phi _X}(t)$; (c) and (d) correspond to the PDSM-WE scenario where ${\tilde{y}_{AE}}(t)$ is partially correlated with ${\phi _X}(t)$ and ${\tilde{y}_{BE}}(t)$ is independent of ${\phi _X}(t)$. (a) $\sigma _h^2 = 0.3$, $\sigma _{h,BE}^2$=0, and $\sigma _{x,A}^2$=0; (b) $\sigma _h^2 = 0.1$, $\sigma _{h,BE}^2$= 0, and $\sigma _{x,A}^2$= 0; (c) $\sigma _h^2 = 0.3$, $\sigma _{h,AE}^2$=$\sigma _h^2$, and $\sigma _{x,B}^2$=0; (d) $\sigma _h^2 = 0.1$, $\sigma _{h,AE}^2$=$\sigma _h^2$, and $\sigma _{x,B}^2$= 0.

Download Full Size | PDF

Now we turn to dealing with the double modulation scheme. For the worst eavesdropping scenario with both x_A(t) and x_B(t) being randomly time-varying, it is evident that ρ_AE,A > 0, ρ_AE,B > 0, ρ_BE,A > 0 and ρ_BE,B > 0. Hereinafter, we refer to the worst eavesdropping scenario in which both Alice and Bob perform random modulation independently as “double-modulation worst eavesdropping (DM-WE) scenario”. For the DM-WE scenario, besides ${\tilde{y}_{AE}}(t)$ and ${\tilde{y}_{BE}}(t)$, Eve can construct a combined version of her observations of the CCRSM by multiplying ${\tilde{y}_{AE}}(t)$ and ${\tilde{y}_{BE}}(t)$ together, and thereby obtaining ${\phi _E}(t)$=$R_E^2s_T^2{\tilde{h}_{BE}}$x_A(t)x_B(t)h_AE(t). It should be emphasized here that the output of Eve’s photodetectors is assumed to be noiseless in the worst eavesdropping scenario. In analogy with the derivation of Eqs. (21) and (25), we can formulate the cross-correlation coefficient of ${\phi _E}(t)$ and ${\phi _X}(t)$ as follows:

Figure 4 illustrates the cross-correlation coefficients of ${\tilde{y}_{XE}}(t)$ and ${\phi _A}(t)$, of ${\tilde{y}_{XE}}(t)$ and ${\phi _B}(t)$, and of ${\phi _E}(t)$ and ${\phi _X}(t)$ as a function of $\sigma _{x,A}^2$ ($\sigma _{x,B}^2$), with the subscript X = “A” or “B”, where the said DM-WE scenario is considered; for comparison purposes, the curves related to the FDSM-WE and PDSM-WE scenarios are reproduced in Fig. 4. One finds from Fig. 4 that, in the DM-WE scenario with $\sigma _{x,A}^2$=$\sigma _{x,B}^2$, ρ_BE,A and ρ_BE,B are identical, and the same relationship holds both for ρ_AE,A and ρ_AE,B and for ρ_CE,A and ρ_CE,B. This fact can be readily verified by examination of Eqs. (21)–(26), with the use of γ_A = γ_B in mind. It can be seen from Fig. 4 that the cross-correlation coefficients ${\rho _{BE,A}}$, ${\rho _{BE,B}}$, ${\rho _{AE,A}}$ and ${\rho _{AE,B}}$ in the DM-WE scenario first enlarge with increasing $\sigma _{x,A}^2$ and $\sigma _{x,B}^2$ until they reach their peak values and after that they begin to decrease when $\sigma _{x,A}^2$ and $\sigma _{x,B}^2$ increase further; interestingly, these cross-correlation coefficients actually approach zero when $\sigma _{x,A}^2$ and $\sigma _{x,B}^2$ tend to infinity, which can be readily justified by examination of Eqs. (21), (22), (25) and (26). One can see from Fig. 4 that the cross-correlation coefficients ρ_CE,A and ρ_CE,B in the DM-WE scenario behave in terms of $\sigma _{x,A}^2$ (or $\sigma _{x,B}^2$) in a way similar to ρ_BE,A in the FDSM-WE scenario and ρ_AE,B in the PDSM-WE scenario. Indeed, we can infer that ρ_CE,A = ρ_CE,B → [($\sigma _{h,AE}^2$+1)($\sigma _h^2$+1)]^−1/2 when both $\sigma _{x,A}^2$ and $\sigma _{x,B}^2$ tend to infinity. Because of $\sigma _{h,BE}^2$= 0 and $\sigma _{h,AE}^2$ > 0 in the DM-WE scenario, it can be observed from Fig. 4 that ρ_AE,A and ρ_AE,B are smaller than ρ_BE,A and ρ_BE,B. Comparison of the curves associated with the DM-WE scenario and those related to the FDSM-WE and PDSM-WE scenarios reveals that, with the same normalized variance $\sigma _h^2$ of the fluctuating channel transmission coefficient and normalized variance of the randomly time-varying modulation signals, the cross-correlation coefficients related to the DM-WE scenario are all smaller than ρ_BE,A in the FDSM-WE scenario. By comparing the curves in Fig. 4, one finds that, among the various scenarios involved therein, Eve in the FDSM-WE scenario may acquire observations of the CCRSM that have highest cross-correlation with those obtained by the legitimate parties. From this point of view, we can regard the FDSM-WE scenario as the one in which the degree of eavesdropping risk is highest.

 

Fig. 4. Cross-correlation coefficients of ${\tilde{y}_{XE}}(t)$ and ${\phi _A}(t)$, of ${\tilde{y}_{XE}}(t)$ and ${\phi _B}(t)$, and of ${\phi _E}(t)$ and ${\phi _X}(t)$ as a function of $\sigma _{x,B}^2$ ($\sigma _{x,A}^2$), with the subscript X = “A” or “B”. γ_A = γ_B = 20, γ_AE = γ_BE = ∞, $\sigma _{h,BE}^2$= 0, and $\sigma _{h,AE}^2$ = $\sigma _h^2$. (a) $\sigma _h^2$ = 0.3; (b) $\sigma _h^2$ = 0.1. The worst eavesdropping scenario is considered in producing the curves. Both Alice and Bob perform the random modulation independently with $\sigma _{x,B}^2$ = $\sigma _{x,A}^2$.

Download Full Size | PDF

5. Information-theoretic analysis

By examination of Eqs. (1)–(4), one finds that the terms h_M(t), x_A(t) and x_B(t) are three common components of ${\phi _A}(t)$ and ${\phi _B}(t)$. Obviously, it is these three common components that enable high level of cross-correlation between the two legitimate parties’ observations of the CCRSM. Note that, h_M(t) is indeed an uncontrollable external source of randomness due to turbulence-induced optical fluctuations, and, on the other hand, x_A(t) and x_B(t) are two controllable internal sources of randomness due to random modulation performed by the legitimate parties. Although the previous analysis of the eavesdropping risk in Sec. 4 does give us an intuitive understanding of the problem as to what role the random modulation plays in information leakage of the CCRSM to Eve, it is still unclear how the random modulation impacts the common-randomness component of the CCRSM stemming from the turbulence-induced optical fluctuations and what effects the random modulation has on the secret-key capacity. To address these issues, in this section, we examine the secret-key capacity of shared key extraction from the CCRSM.

When x_A(t) = x_B(t) ≡ 1, there is actually no random modulation at both Alice’s and Bob’s terminals. Below we call this case “no-modulation-with-independent-eavesdropping (NMIE) scenario”. For convenience of later comparison, here we first derive expressions for the secret-key capacity in the NMIE scenario; because both ${\tilde{y}_{AE}}(t)$ and ${\tilde{y}_{BE}}(t)$ are independent of ${\phi _A}(t)$ and ${\phi _B}(t)$ in the NMIE scenario, the corresponding secret-key capacity can be written by [1]

For the aforementioned FDSM-WE scenario, the mutual information of ${\phi _A}(t)$ and ${\phi _B}(t)$ can be formulated by (see Appendix B)

Below we proceed by developing the mathematical expressions for ${I_{RM}}({\phi _A};{\tilde{y}_{AE}},{\tilde{y}_{BE}})$ and ${I_{RM}}({\phi _B};{\tilde{y}_{AE}},{\tilde{y}_{BE}})$ in the FDSM-WE scenario. Note that, ${\tilde{y}_{AE}}(t)$ is indeed independent of both ${\phi _A}(t)$ and ${\phi _B}(t)$ in the FDSM-WE scenario. Therefore, there exist the identities ${I_{RM}}({\phi _A};{\tilde{y}_{AE}},{\tilde{y}_{BE}})$=${I_{RM}}({\phi _A};{\tilde{y}_{BE}})$ and ${I_{RM}}({\phi _B};{\tilde{y}_{AE}},{\tilde{y}_{BE}})$=${I_{RM}}({\phi _B};{\tilde{y}_{BE}})$ for the FDSM-WE scenario. By recalling that ${\tilde{y}_{BE}}(t)$ is equal to ${R_E}{s_T}{\tilde{h}_{BE}}{x_B}(t)$ in the FDSM-WE scenario with ${\tilde{h}_{BE}}$ being the deterministic transmission coefficient of the optical channel from Bob to Eve, one can further deduce that ${I_{RM}}({\phi _A};{\tilde{y}_{AE}},{\tilde{y}_{BE}})$=${I_{RM}}({\phi _A};{x_B})$ and ${I_{RM}}({\phi _B};{\tilde{y}_{AE}},{\tilde{y}_{BE}})$=${I_{RM}}({\phi _B};{x_B})$. Following an approach similar to that used to derive Eqs. (34)–(37), one finds

Similarly, one finds

With use of an analysis approach similar to that applied to Eqs. (31), (32) and (35)–(37), one can deduce that ${I_{RM}}({\phi _A};{x_B})$ ≈ 0 and ${I_{RM}}({\phi _B};{x_B})$ ≈ 0 in the FDSM-WE scenario under the conditions of both $\sigma _s^2/\sigma _{n,0}^2\ll1$ and R²$s_T^2\bar{h}_M^2\sigma _{x,B}^2/\sigma _{n,0}^2\ll1$, if both ${p_{\hat{x}}}(\hat{x})$ and ${p_{\hat{h}}}(\hat{h})$ take on a single-peak shape.

To numerically evaluate Eqs. (29) and (33), we need to give the specific mathematical forms of ${p_{\hat{h}}}(\hat{h})$ and ${p_{\hat{x}}}(\hat{x})$. In [30], the inverse Gaussian gamma (IGG) distribution has been proposed to model the statistical behavior of fluctuations in the received optical signal of free-space optical communications through atmospheric turbulence. For exemplifying a quantitative information-theoretic analysis of secret-key extraction from the CCRSM, below we let ${p_{\hat{h}}}(\hat{h})$ be the IGG distribution given by [30]

Figure 5 exemplifies how the lower bound C_RM,LB in the FDSM-WE scenario behaves in terms of $\sigma _{x,B}^2$ with different PDFs of the normalized channel transmission coefficient. In producing the curves of Fig. 5, we let γ₁ ≡ 20 and used Eqs. (44) and (45) to model ${p_{\hat{h}}}(\hat{h})$ and ${p_{\hat{x}}}(\hat{x})$, respectively. We point out here that C_RM,LB with $\sigma _{x,B}^2$ = 0 in the FDSM-WE scenario is actually equal to C_NMIE, i.e., the secret-key capacity without random modulation. Moreover, in Fig. 5, $\sigma _{x,B}^2$= 0.24, 0.48 and 0.72 correspond to n = 0.63, 1.85 and 5.14, respectively. With examination of Eqs. (34), (38), (41), (44) and (45), we emphasize that the curves in Fig. 5 are completely determined by the parameters γ₁, α, β and n. For given parameter n of the standard two-sided power distribution, both $\sigma _{x,B}^2$ and ${\bar{x}_B}$ are determinate, and there exist numerous possible parameter combinations of the average channel transmission coefficient ${\bar{h}_M}$, photodetector’s noise variance $\sigma _{n,0}^2$, photodetector’s responsibility R, and transmitted optical power s_T that can result in the fixed γ₁ of 20 used in producing Fig. 5. Notice that, the average channel transmission coefficient ${\bar{h}_M}$ depends on both the channel propagation distance and the divergence angle of the transmitted beam. When designing practical CCRSM-based secret-key extraction systems, to obtain fixed γ₁, one has several degrees of freedom for making trade-offs between the channel propagation distance, divergence angle of the transmitted beam, photodetector’s noise variance, photodetector’s responsibility, and transmitted optical power. It is seen from Fig. 5 that, with the same average SNR γ₁, the lower bound C_RM,LB in the FDSM-WE scenario grows slightly with increasing $\sigma _{x,B}^2$. Notice that, when $\sigma _{x,B}^2$ = 0, C_RM,LB can be fully attributed to turbulence-induced optical fluctuations. With the above observations in mind, one can infer that the random modulation does not harm the usefulness of the common-randomness component of the CCRSM due to turbulence-induced optical fluctuations; in other words, although the random modulation causes a proportion of information of the CCRSM to be leaked to Eve, we can consider that the leaked information only stems from the randomly time-varying modulation signal, and the proportion of information arising from the said common-randomness component due to turbulence-induced optical fluctuations is still secure against Eve’s eavesdropping. We emphasize once again that the random modulation is employed in this work only for decorrelating the legitimate parties’ consecutive observations of the CCRSM. From this point of view, by recalling the analysis in Sec. 3, we find that the random modulation can enable us to obtain nearly uncorrelated consecutive observations of both ${\phi _A}(t)$ and ${\phi _B}(t)$ with use of a sampling interval rather smaller than the correlation time of turbulence-induced optical fluctuations, while ensure that the potential of extracting secret keys from the randomness stemming from turbulence-induced optical fluctuations is not weakened. Thus, the random modulation can be utilized to increase the number of extracted uncorrelated secret key bits per second. Moreover, it is found from Fig. 5 that, with other parameters fixed, C_RM,LB associated with α = 8.54 and β = 6.11 is different from that related to α = 22.1 and β = 19.1. The underlying physical reason for this is that there is much difference in the shape of ${p_{\hat{h}}}(\hat{h})$ between the two groups of α and β.

 

Fig. 5. C_RM,LB in terms of $\sigma _{x,B}^2$ in the FDSM-WE scenario with γ₁ ≡ 20 and different PDFs of the normalized channel transmission coefficient. The modulation signal x_B(t) obeys a standard two-sided power distribution [31] with parameters θ = 0 and n > 0.

Download Full Size | PDF

At this point, we make a simple comparison of our approach with the free-space optical secret key agreement (FSO-SKA) reported in [9]. First, a fundamental difference between the FSO-SKA and our approach lies in the physical randomness source used to generate the initial key bits. Specifically, in the FSO-SKA, a physical random number generator at the sender terminal is used to generate the initial key bits, whereas, in our approach, the channel’s inherent randomness is utilized to generate the initial key bits. Second, compared with the FSO-SKA, our approach does not require the use of a probing station to act as a virtual eavesdropper. Indeed, in our approach, the decorrelation of the legitimate parties’ and eavesdropper’s observations of the fluctuating channel transmission coefficient is easily guaranteed by the fact that the eavesdropper has to stay at a position separated from the legitimate parties by a distance much larger than the spatial coherence length of the atmosphere, which is on the order of several centimeters, for keeping the legitimate parties unaware of the eavesdropping action. Similar to the FSO-SKA, our approach needs employing privacy amplification to eliminate the leaked information to Eve; however, we can estimate the leaked information in the possible worst case by using Eqs. (38) and (41), where both ${p_{\hat{x}}}(\hat{x})$ and ${p_{\hat{h}}}(\hat{h})$ can be obtained by the legitimate parties without the help of a virtual eavesdropper; although Eqs. (38) and (41) may overestimate the actual leaked information, the potential of extracting secret keys from the CCRSM’s constituent randomness component due to turbulence-induced optical fluctuations is indeed not harmed and use of such overestimated leaked information in privacy amplification to compress and hence shorten the reconciled bit sequence does ensure that the finial key bits are unknown to Eve. Below, we illustrate what key generation rate can be achieved under the condition of given γ₁ when a fixed temporal sampling interval τ_s of 2.5 × 10⁻⁵ ms is used by legitimate parties to produce measurement samples of the CCRSM. Notice that, τ_s = 2.5 × 10⁻⁵ ms means that there are 4 × 10⁷ measurement samples produced per second. According to Fig. 5, one finds that C_RM,LB = 0.677 bits / channel measurement when $\sigma _{x,B}^2$ = 0.72 (equivalently, n = 5.14), α = 22.1 and β = 19.1. Hence, theoretically, we can attain a key generation rate of at least 27.08 Mbps when τ_s = 2.5 × 10⁻⁵ ms, γ₁ = 20, n = 5.14, α = 22.1 and β = 19.1. This key generation rate is indeed comparable to that of the FSO-SKA.

We note that secret-key generation with artificial randomness has been suggested for RF wireless channels [20,21]. Our work differs from [20] in that random modulation in the CCRSM is carried out by the two communicating parties instead of a helper, and artificial interference produced by the helper in [20] causes an additive distortion rather than the multiplicative distortion induced by the random modulation. The artificial randomness in [21] is produced by use of random unitary precoding matrix, which does not alter the statistical behavior of the MIMO RF wireless channel therein and hence the relevant secret-key capacity; on the other hand, the modulation signal in the CCRSM is only required to vary randomly within the range of [0, 1] and its normalized variance does play a role in determining the lower bound of the secret-key capacity, which can be easily verified by examining Fig. 5. As a final comment, it is easy to find that C_RM depends on ${p_{\hat{x}}}(\hat{x})$, i.e., the PDF of the normalized modulation signal. In the exemplary calculations related to Fig. 5, we have considered that the modulation signal obeys a standard two-sided power distribution. Evidently, other distributions with a support ranging from 0 to 1 can also be chosen in practice. An interesting question arises as to how to find the optimum ${p_{\hat{x}}}(\hat{x})$ that can maximize the secret-key capacity. Nevertheless, treatment of this question is beyond the scope of this work. It is a theoretical issue that deserves future attention.

6. Conclusions

By targeting at extracting shared secret keys from single-mode atmospheric optical channels equipped with random modulation, we have first proposed a novel randomness sharing scheme and developed the mathematical models for the relevant common randomness source, which is called CCRSM; Our randomness sharing scheme can be used to implement enhanced secret-key extraction, which can break the restriction imposed by the correlation time of turbulence-induced optical fluctuations on the number of extracted uncorrelated key bits per second. Subsequently, theoretical expressions for both the autocorrelation of the legitimate parties’ observations of the CCRSM and the cross-correlation between the two legitimate parties’ observations of the CCRSM have been further derived, and thereby the random-modulation-caused decorrelation of the legitimate parties’ consecutive observations of the CCRSM has been examined with use of numerical calculations. The cross-correlation coefficient of the eavesdropper’s and legitimate parties’ observations of the CCRSM is theoretically formulated for facilitating the analysis of possible eavesdropping risk, and the dependence of such cross-correlation coefficient on the normalized variance of the time-varying modulation signal is numerically analyzed for the FDSM-WE, PDSM-WE and DM-WE scenarios. Finally, the lower bound of the secret-key capacity in consideration of our randomness sharing scheme is dealt with for revealing how random modulation impacts the key extraction from an information-theoretic perspective. It has been shown that random modulation can be used to effectively decorrelate the legitimate parties’ consecutive observations of the CCRSM and simultaneously does not harm the potential of extracting secret keys from the CCRSM’s randomness component due to turbulence-induced optical fluctuations. From our theoretical and numerical results, it is found that, with use of the CCRSM, random modulation is a viable approach to breaking the restriction imposed by the correlation time of turbulence-induced optical fluctuations on the number of extracted uncorrelated key bits per second.