Measurement-Device-Independent Quantum Random-Number Generator With Source Flaws

The measurement-device-independent quantum random number generator (MDI-QRNG) can resist all security loopholes on measurement devices, and it thus seems very promising in practical implementations. In the MDI-QRNG, sources are often assumed to be perfectly prepared, however, there inevitably exist errors in the quantum state preparation process due to imperfections in realistic equipments and devices. In this paper, we do investigations on the MDI-QRNG with source flaws, showing its performance at different state errors. Besides, we also consider the influence of the finite-size effect, and compare the performance of different sources in MDI-QRNGs. This work provides valuable references for practical implementation of MDI-QRNGs.

collapse and vacuum fluctuations.The most typical QRNG scheme [11], [12]is consisting of one 50-50 beam-splitter and two single-photon detectors.Besides, methods on high-speed random bit generation based on other mechanism such as chaotic lasers had also been reported [13], [14].
According to whether the device is trusted or not, we can divide QRNGs into three categories, device-trusted QRNGs [12], device-independent QRNGs (DI-QRNGs) [15] and semidevice-independent QRNGs (SDI-QRNGs) [16], [17], [18], [19], [20], [21], [24].Among them, the device-trusted QRNG assumes that the devices are entirely credible, in which quantum random numbers can be generated at high speed by designing a suitable circuit.The technology of this type QRNG is relatively mature and has gradually moved towards commercialization.However, this perfect assumption on devices may not be satisfied in practical applications, leading to security risks in the generated random numbers.The DI-QRNG assumes that the devices are completely untrustworthy, and mainly based on the violation of Bell's inequality in quantum mechanics [25], [26].From the perspective of security, the random numbers generated by the DI-QRNG protocol possess the highest security, however, its random number generation rate is relatively lower due to the limitations on entangled source generations with current technologies.As a result, some researchers proposed the SDI-QRNG protocol by referring the idea in MDI-QKD protocols [27], [28], [29].As a compromised solution, the SDI-QRNG only makes some simple assumptions on devices, but it can significantly increase the generation rate of quantum random numbers, and possess higher security than the device-trusted one.
Usually, there are three types of SDI-QRNGs, the source-independent QRNG (SI-QRNG) [18], [19], [20], the measurement-device-independent QRNG (MDI-QRNG) [21], [24], and the SDI-QRNG based on dimension witness [16], [17].The main differences among the protocols are that they make different assumptions about the source or the measurement.In the SI-QRNG, the source is assumed to be untrusted while the measurement is trusted.On the contrast, in the MDI-QRNG, the source is assumed to be trusted while the measurement is untrusted.Furthermore, the SDI-QRNG based on dimension witness only assumes that the source and measurement are independent and a fixed dimension.However, there always exist errors in the state-preparation process due to imperfect devices.Therefore, we should take the state-preparation error into account in practical applications of MDI-QRNGs.Otherwise, it may cause loopholes and make the random numbers insecure.In the following, we investigate the MDI-QRNG with source flaws and different light sources.Moreover, the finite-size effects are also taken into account.

II. MDI-QRNG WITH SOURCES FLAWS
The schematic of MDI-QRNG protocol is illustrated in Fig. 1.It includes the state preparation and the measurement parts, where Alice plays the role of state preparations, and Bob carries out positive operator-valued measurements (POVM).Moreover, a three-intensity decoy-state method is applied.Next, we introduce the decoy-state MDI-QRNG.
Step 1: The light source with certain photon-number distribution (PND) is modulated into three different light intensities through an intensity modulator (IM) with random number seeds: S ∅ , S d and S s , and S ∅ + S d + S s = {1, 2, 3, . .., N}.Accordingly, the photon possesses three different average photon numbers, denoted as the vacuum u ∅ , the decoy u d and the signal u s , individually.
Step Step 3: All the pulses are transmitted to Bob and are performed with positive operator-valued measures (POVMs) by Bob.All the outputs are recorded as a sequence with bit b ∈ {0, 1}.The value of b is decided by which detector clicking in two detectors.Other click events are discarded.
Step 4: With the measurement results of the decoy pulses and the vacuum pulses, we can tightly estimate the POVM parameters in randomness extraction rate R.After performing randomness extraction on the signal outputs, the random numbers can be generated with a length NR.
Here, we should specify that there are some differences between the QKD and the QRNG.First, the goal of QKD and QRNG are different.The former is to share identical secret keys between two remote users, Alice and Bob, while for the latter, the goal is to generate random bits at the measurement part.Second, there are differences in the post-processing process.In a QKD, Alice and Bob need to carry out error corrections and privacy amplifications to obtain identical keys, while in a QRNG, Bob only needs to perform privacy amplifications to achieve random bits, and does not need to proceed the error correction process.Besides, the decoy method in QRNG is introduced not only to detect attacks of eavesdroppers when generating random numbers in different locations, but also to help us tightly estimate the POVM parameters in calculating the randomness extraction rate.According to the analysis model in [21], we can derive the POVM operation on a k-photon pulse with output b as F b|k , where b ∈ {0, 1}, k ≥ 1.If a pulse is vacuum, the virtual POVM operation is F b|0 = a b|0 I.All the parameters satisfy Based on the POVM results, the rate of random bits extracted from the output signal is given by where p k|γ is the photon-number distribution, denoting the probability of a k-photon state in source γ, n 0 y |1 and n 0 z |1 are the second and third elements in − → n 0|1 , and is the min-entropy function.The random bits are extracted from the single-photon components of signal pulses, and the extraction rate is related to the randomness in the signal outputs and evaluated by the min-entropy function Due to the imperfection of the device, we take the statepreparation error [22], [23] into account.
{δ 1 , δ 2 , δ 3 , δ 4 } represent the error caused by the preparation time bit of the intensity modulator, {θ 1 , θ 2 } show the error generated by the phase modulator's modulation relative to the phase, β means the deflection angle of the reference frame.After transmitted to Bob, the m-photon state is performed with POVMs.The gain of source γ ∈ {s, d} is calculated as where m ∈ {φ 0 , φ 1 , φ + , φ +i }, F b|γ is the combination of all POVMs on pulses from the source γ: F b|γ = +∞ k=0 p k|γ F b|k .For example, if the source is weak coherent state (WCS), it given by p k|γ = (u γ η) k k! e −u γ η , where η is the overall transmission efficiency and u γ η is the mean photon number, with η = tη B , where t is the channel transmittance and η B is the detection efficiency of Bob's detector.
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
In realistic implementations, the number of pulses is always finite, denoted as N .We define N ∅ , N d and N s as the number of elements corresponding to the subset S ∅ , S d and S s individually, then N = N ∅ + N d + N s .The values of Q b|∅ and Q b|(γ,m) are recorded directly from the experiment, where Q b|∅ is the clicking rate with output b ∈ {0, 1} for vacuum pulses, and Q b|(γ,m) is the clicking rate with output b ∈ {0, 1} for state |m from source γ.However, some parameters in (3) cannot be measured by experiment directly such as a 0|1 , n 2 0 y |1 , n 2 0 z |1 , we need to estimate them with statistical fluctuations.
In the following, we denote the upper bound and the lower bound of the estimated probability quantity χ as except with a failure probability ε.N γ is the number of pulses with the intensity γ (γ ∈ {s, d}), Δ(p, q) is the error function, given by Lemma 1 [30] as follows.
Lemma 1: If the statistics λ p are obtained by measuring p samples of observation ς according to a POVM with q outcomes, then for any ε > 0, ς is contained in the set except with a failure probability ε at most, where λ ∞ (ς) denotes the probability distribution defined by the POVM applied to ς.The deviation Δ(p, q) is introduced to evaluate the fluctuation between the frequency λ p and the probability λ ∞ .And λ p is contained on the interval [λ ∞ − Δ(p, q), λ ∞ + Δ(p, q)] with a successful probability 1 − ε at least.If the pulse is sent from the vacuum source, no matter what the encoded information and the measurement operation are, the rate of output b is the background counting rate d B , thus Based on the parameters with known statistical fluctuations, we obtain the lower bound for a 0|1 , as where , and l is the largest number of k satisfying χ L k|d > 0. And then (n 2 0 z |1 ) L and (n 2 0 y |1 ) L are obtained as Considering the statistical fluctuation of the parameters and the concavity of the min-entropy H min in (3), the lower bound of the randomness extraction rate is where L(U ) denotes the lower (upper) bound.When a 0|1 , n 2 0 y |1 , n 2 0 z |1 are estimated, R L is obtained, and the tightness of a 0|1 , n 2 0 y |1 , n 2 0 z |1 determines the generation rate of random bits.

III. NUMERICAL SIMULATIONS AND ANALYSIS
We display the performance of our MDI-QRNG scheme under the condition of using inefficient and noisy threshold detectors.In the simulations, we choose reasonable values of system parameters [21], [24], [30], [31]: detection efficiency and background counting rate of Bob's detector are η B = 14.5% and d B = 10 −6 , and the failure probability of statistical fluctuation is set as ε = 10 −5 .Besides, to simplify the calculation, we assume the same value of state preparation error for four states, i.e. δ 1 = δ 2 = δ 3 = δ 4 = δ, and fix the intensity of the decoy source as u d = 0.2, then optimize all parameters to maximize the ultimate randomness extraction rate for a given number N and transmission loss.Simulation results are shown in Figs.2-5.
To show the influence of state preparation error on performance of MDI-QRNG, we plot the randomness extraction rate with different preparation errors (δ = 0, π/16, π/8, π/4) in the asymptotic case and finite-size case (N = 10 12 ).It shows consistency between the asymptotic case and the finite-size cases that the randomness extraction rate will get worse when the preparation error gets larger.As is shown in Fig. 2, where different state-preparation errors are considered, the asymptotic case is characterized by a higher randomness extraction rate and a greater loss-tolerant ability than the finite-size case.This feature becomes particularly evident when the state preparation error reaches π/4.Besides we investigate the influence of the finite-size effect under different preparation errors in Fig. 3, showing the randomness extraction rate of MDI-QRNG versus the number of total pulses at 10 dB loss.First, with the increase of the error, the rate is decreasing faster under the same number of pulses; Second, the rate is more sensitive to the finite size effect  when with less number of pulses.Fig. 3 shows how finite-size effects affect the randomness extraction rate.In particular it shows that, given a certain state-preparation error, we should choose the appropriate number of pulses to meet the demand of random extraction rate experiment.For example, we must generate the number of pulses over N = 10 12 in order to achieve a high extraction rate.Fig. 4. Randomness extraction rates of MDI-QRNG with HSPS, WCS [30], TS and BDS [33] when the state preparation error δ = π/8 and the number of pulses is N = 10 12 .Fig. 5. Randomness extraction rates of MDI-QRNG with HSPS, WCS [30], TS and BDS [33] versus different state preparation errors when the loss is 10 dB and the number of pulses is N = 10 12 .
We further extend MDI-QRNG with WCS to other light sources, i.e. heralded single-photon sources (HSPS), thermal sources (TS), binomial distribution sources (BDS), and make comparisons among them on tolerant ability of the channel loss and the preparation error.Next, we introduce their photonnumber distribution (PND).The HSPS is characterized as [32] p where d A and η A represent the background counting rate and the detection efficiency of Alice's detectors respectively and are reasonably set with the value as η A = 60% and d A = 10 −6 .The PND of TS [33] is characterized as And the PND of BDS is given by [33] p where C k n corresponds to the binomial (n, k), and n is the maximum photon number in BDS.Here we set n = 25 for simulation.
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
In Fig. 4, we plot the extraction rate versus the channel loss of MDI-QRNGs with four different light sources when δ = π/8 and N = 10 12 .From Fig. 4, we can see that the channel losstolerant ability of HSPS is superior to the other three sources, which can reach up to 28 dB, much higher than the others.It may be attributed to the low ratio of the vacuum pulse in HSPS, making the parameter estimation more tight.In BDS, the maximum photon number n could be an arbitrary value larger than 1, and an interesting fact is that when n = 25, BDS is already close to the poisson distribution.
Fig. 5 shows the extraction rate versus the preparation error of MDI-QRNG with four light sources at 10 dB loss when N = 10 12 .Here, it reveals periodic changes of the randomness extraction rate of MDI-QRNGs, caused by the periodic change of states due to preparation errors.Besides, the HSPS can tolerate the highest state-preparation error, showing its robustness on source flaws.Such a periodic change of the randomness extraction rate is very interesting.When we investige the reason of this phenomenon, we find that as the state preparation error equals to π/2, the different states mentioned in (4) become the same state, a situation which corresponds to the worst scenario for randomness extraction rates.

IV. CONCLUSION
In summary, we present a three-intensity decoy-state MDI-QRNG scheme by taken both the source flaw and the finite-size effect into account, and carry out corresponding numerical simulations.Simulation results show that both source preparation errors and statistical fluctuations give significant influences on the performances of MDI-QRNGs.Besides, we make comparisons among MDI-QRNG with different practical light sources, which shows HSPS can tolerate the highest loss and preparation errors.Therefore, the present work can pave the way towards practical implementations of MDI-QRNGs.

Fig. 2 .
Fig. 2. Comparisons of randomness extraction rates versus loss of MDI-QRNG with different preparation errors in asymptotic case and finite-size case (N = 10 12 ).

Fig. 3 .
Fig. 3. Influence of finite size on randomness extraction rate with different state preparation errors when the loss is 10 dB.