Self-balanced real-time photonic scheme for ultrafast random number generation

,

We propose a real-time self-balanced photonic method for extracting ultrafast random numbers from broadband randomness sources.In place of electronic analogto-digital converters (ADCs), the balanced photo-detection technology is used to directly quantize optically sampled chaotic pulses into a continuous random number stream.Benefitting from ultrafast photo-detection, our method can efficiently eliminate the generation rate bottleneck from electronic ADCs which are required in nearly all the available fast physical random number generators.A proof-of-principle experiment demonstrates that using our approach 10 Gb/s real-time and statistically unbiased random numbers are successfully extracted from a bandwidth-enhanced chaotic source.The generation rate achieved experimentally here is being limited by the bandwidth of the chaotic source.The method described has the potential to attain a real-time rate of 100 Gb/s.© 2018 Author(s).All article content, except where otherwise noted, is licensed under a Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).https://doi.org/10.1063/1.5029498Random numbers provide the foundation of secure communication, where they are used as the cryptographic keys to encrypt messages for transmission.The "one-time pad" offers unconditional security of communication, 1 but a critical obstacle hindering the adoption of this approach is the need for real-time and ultrafast generation of reliable random numbers. 2 As known, the current communication rate has reached 40 Gb/s and is developing rapidly toward 100 Gb/s.
The quest for true randomness has led to the study of physical random number generators (RNGs).In 2008, Uchida et al. made a significant advance in respect of physical RNGs by achieving generation rates of 1.7 Gb/s by exploiting chaotic lasers as the sources of randomness. 3][6][7][8][9][10][11][12][13][14][15][16][17][18] However, to date, most of them use off-line random number extraction from stored chaotic time-series and thus do not operate in real time.
Available fast randomness extraction methods share a technical feature: one must first convert the optical chaotic signal to the electrical domain and then enable the random number extraction using electronic 1-bit or multi-bit analog-to-digital converters (ADCs) and also undertake time-consuming post-processing.][21] However, a clocked comparator is actually also a 1-bit ADC in practice, 22 just like that in Ref. 3. Due to the bandwidth bottleneck of electronic ADCs, the currently achieved real-time generation rate of RNGs with verified statistical randomness has been commonly limited at several Gb/s. 6hree factors are responsible for this limited response speed. 23They are (i) electronic comparator ambiguity caused by the limited gain bandwidth of the transistors, (ii) sampling error in sample-andhold (S/H) circuits due to the RF clock jitter (known as aperture jitter), and (iii) the thermal (Johnson) noise and bandwidth of the post-processing electronic components.
The introduction of parallel processing technology is helpful in reducing the pressures induced by the necessity of electronic ADCs, [24][25][26] but this cannot solve the rate limitation by the roots.Using optical sampling can overcome the electronic sampling error as done by us in Ref.21, but the comparator problem and the post-processing procedure still remains.
In our prior work, 27 we eliminated the need for post-processing by using a differential comparison method in the quantization procedure.However, the cardinal comparator problem still remains unresolved.Specifically, in the quantization process, two identical photo-detectors are utilized to first convert two self-delayed optically sampled chaotic signals into the associated electrical signals.
Then, an electronic comparator (a 1-bit ADC without the embedded S/H circuit) is required to differentially quantize the two chaotic signals into a raw random number stream.However, due to the fatal electronic comparator ambiguity, the state of the art electronic comparator used has a severely limited analog bandwidth of not more than 10 GHz.That causes the obtained raw random number waveform to suffer from serious distortion.Finally, the raw random numbers have to be further modulated into the mode-locked optical pulse to observe the final random number output.
In contrast to all the aforementioned RNG schemes using ADCs, the work reported here eliminates the requirement of the speed-limiting electronic ADC and directly utilizes a balanced photo-detector to extract random number streams in real time.This new method simultaneously brings several advantages: (i) Using an optical sampler driven by mode-locked optical pulses to sample the chaotic signal in the optical domain can overcome the electronic jitter bottleneck confronted by electrical ADCs 28 because the timing jitter of the current mode-locked lasers is now of the order of femtosecond (fs). 29,30(ii) Using photo-detection to quantize the chaotic signal solves the bandwidth bottleneck of the electrical ADCs because the response bandwidth of off-the-shelf photo-detectors has reached 100 GHz. 31 That means that, when a chaotic source with a sufficient bandwidth is used, our new method has the ability to reach a level of 100 Gb/s in real time.It should be noted that the demonstrated RNG rate of 10 Gb/s in our proof-of-principle experiment is limited by the bandwidth of the chaos source.(iii) The entire randomness extraction procedure is greatly simplified.For instance, in our prior work, 27 the RNG scheme contained an all-optical sampling gate, two photo-detectors, an electronic comparator, and an electro-optic modulator.By contrast, the RNG scheme in this work is composed only of an all-optical sampling gate and a balanced photo-detector.Moreover, the approach is self-balanced, i.e., the generation of statistically unbiased random numbers is accomplished with no need of threshold setting or post-processing, despite the chaotic source usually having an asymmetric amplitude distribution.Finally, we want to point that to our knowledge, this paper reports for the first time the use of a balanced photo-detector to play the role of directly quantizing stochastic signals into random numbers (although it has been widely used to measure quantum noise such as vacuum states 32,33 and amplified spontaneous emission 19 ).The significant innovation using a balanced photo-detector as the direct quantizing device in the RNG opens new opportunities for further development of techniques for ultrafast real-time random number generation.
Figure 1(a) illustrates the principle of the proposed RNG scheme based on balanced photodetection.The system consists of an optical chaos source, a mode-locked laser (MLL), an optical sampler, and a balanced photo-detector (BPD).Ultralow jitter optical pulses from the MLL are used as the control clock to periodically open the optical sampler so that the incident laser chaos can be sampled in the optical domain with high fidelity.The optically sampled chaotic pulses are then equally split into two branches and detected by the "+" and "−" inputs of the BPD, respectively.By adjusting the relative time delay τ between the two chaotic pulse trains [named I(t) and I(t − τ)] via an optical delay line (ODL), we can obtain statistically unbiased random number streams [i.e., the difference I(t) and I(t − τ)] at the output of the BPD with no need of threshold setting and post-processing: when the chaotic pulse I(t) is larger than I(t − τ), the BPD output is a positive pulse and coded as "1"; otherwise the BPD output is a negative pulse and coded as logic "0." To validate our scheme, an external cavity laser diode (referred to as M-LD) cascaded by another solitary laser diode (referred to as S-LD) is used to generate broadband laser chaos.Both the M-LD Figure 2 is the RF spectrum of the bandwidth-enhanced laser chaos measured by a 26.5 GHz spectrum analyzer (Agilent Technologies, N9020A) via a 45 GHz photo-detector (U 2 T, XPDV2120RA).Here, the injection strength from the M-LD to the S-LD is set at 20.7% using a VOA, and their optical frequency detuning is adjusted to 8.45 GHz using individual temperature controllers (TCs).The final broadband chaotic laser output is at a center wavelength of 1554.08 nm.Comparing with the noise floor, one can clearly observe that the generated chaotic signal exhibits a large intensity fluctuation in a wide frequency domain from 0 to 20 GHz.The chaos bandwidth is calculated to be about 11.89 GHz.It should also be noted from Fig. 2 that the chaotic signal possesses a relatively flat spectrum in the range from 3 to 11 GHz.This flatness feature is very different to that of the pure optical injection or feedback chaotic system, 21 where typically a main peak around the relaxation frequency is seen in their RF spectra.Both the large bandwidth and flatness of the RF spectrum found here assist the fast generation of real-time random numbers from the source.
Figures 3(a The TOAD mainly contains a nonlinear semiconductor optical amplifier (SOA) placed asymmetrically from the loop center and an intra-loop wavelength division multiplexer (WDM) coupler for injecting the optical clock pulses from the MLL.With the trigger of the control clock, a sampling window determined by the SOA offset (about 34 ps) will be periodically opened so that the incident chaotic optical signal is sampled at the repetition frequency of the MLL.A band-pass filter (BPF) finally separates the sampled chaotic pulses at the output of the TOAD.In the experiment, the SOA with a gain recovery time of 25 ps (Kamelian, SOA-NL-L1-C-FA) is biased at 300 mA and operates at a peak gain wavelength of 1550 nm with a 3 dB bandwidth of 64 nm.The MLL with a timing jitter less than 50 fs (Pritel, UOC-05-14G-E) operates at 10 GHz and its wavelength is tuned to be 1551.26nm.From Figs. 3(a) and 3(b), it can be seen that the envelope of the analog chaotic signal [Fig.3(a)] matches well the peaks of the sampled chaotic pulses [Fig.3(b)].This confirms the expected high-fidelity of the sampling.However, from Fig. 3(c), it is apparent that the sampled chaotic pulses also inherit the non-uniform amplitude distribution of the laser chaos.
Such an asymmetry of the distribution introduces a severe bias in the generation of random numbers.][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21] However, both methods will greatly enhance the difficulty of practical implementation, especially when an operating rate beyond GHz is needed.By contrast, as depicted in Fig. 1(a), we exploit a balanced photo-detection technology to quantize the sampled chaotic pulses into a statistically unbiased random number stream.Benefitting from the ultrafast response bandwidth (typically many tens or 100 GHz) of current photo-detectors, this technology can maintain a very high real-time rate.
To effect the balanced photo-detection approach, the relative delay τ is set as 200 ns, which is a high-order integer multiple of the repetition period of the MLL, to ensure that the correlation coefficient between I(t) and I(t − τ) is essentially zero.The autocorrelation function of the sampled chaotic pulses is the indicator to instruct this delay.Figure 4 shows results obtained using this photodetection technique, where a BPD (u 2 t, BPDV2120R) with a bandwidth of 45 GHz is used.Figure 4(a) is the generated random number waveform from the BPD, where the positive pulse is coded as logic "1" and the negative pulse as logic "0."There are 10 pulses in a time-slot of 1 ns, which corresponds to a generation rate of 10 Gb/s determined by the clocking rate of the MLL.Note, to guarantee the balancing in the BPD, a variable attenuator is used in the down branch of the spliced fiber in the experiment, and the power ratio between the two channels is controlled in the range 50% ± 0.1%.The different amplitudes in final 0 or 1 bit can be further reshaped to be uniform through a limiting amplifier.Figure 4 To verify the quality of the random numbers, we first examine the normalized correlation as a function of the time delay for the 1 × 10 6 random bit streams, as shown in Fig. 5

(a). The normalized correlation C
, where • represents the statistically evaluated proportion of "1" in the random number sequence a[n] with a sample size of N 2 1 × 10 6 bits and k represents the delay bits.Note, every delay bit corresponds to one delay time interval 100 ps in the horizontal axis of Fig. 5(a).For a finite length of an ideal independent random number sequence, the estimate of C[k] should follow the Gaussian distribution N(0, σ c 2 ), where Because the estimates of C[k] keep below the three-standard-deviation line 3σ c [Fig.5(a)], the obtained random number sequences can be viewed to be statistically independent.More stringent evaluation is made by the use of the state-of-the-art statistical test suite of the National Institute of Standards and Technology (i.e., NIST SP800-22-rev1a 35 ), which is proposed to determine whether a RNG is suitable for cryptographic applications.This suite contains 15 test items, named "Frequency," "Frequency within a Block," "Runs," "Longest Run of Ones in a Block," "Binary Matrix Rank," "Discrete Fourier Transform," "Non-overlapping Template Matching," "Overlapping Template Matching," "Maurer's Universal Statistical," "Linear Complexity," "Serial," "Approximate Entropy," "Cumulative Sums," "Random Excusions," and "Random Excursions Variant," respectively.As advised by the NIST, all 15 test items are executed using 1000 samples of 1 × 10 6 data with a significance level α = 0.01.There are two requirements for passing each test item: (i) the proportion of the tested random numbers satisfying the condition for the p-value larger than α should be larger than 0.980 560 8; (ii) the uniformity of the p-values (denoted as P-value) should be larger than 0.0001.Figure 5(b) is a typical NIST test result, where the numbers from 1 to 15 on the x axis correspond to the 15 test items, respectively.As can be seen, all the test items are successfully passed.This indicates that the generated bit stream can be statistically regarded to be random.
The reason why the balanced photo-detection can remove the inherent bias in the random number output is established theoretically here.Considering the chaotic amplitude distribution is relatively stationary on a large time scale, we can suppose the amplitude probability density functions (PDF) of I(t) and I(t − τ) to be f (x) and f (y), respectively.Furthermore, their joint PDF can be expressed as f (x, y).Thus, the amplitude distribution function F(z) for the difference signal, I(t) − I(t − τ), can be written as (1) Taking the derivative of Eq. (1), we can obtain its PDF, If I(t) and I(t − τ) are statistically independent, f (x, y) can be equivalent with f (x) f (y).Thus, Eq. ( 2) will be transferred into Defining r = −z + y, we have Comparing Eq. ( 3) with Eq. ( 4), we can get In our experiment, the correlation coefficient between I(t) and I(t − τ) is about 10 −4 when τ = 200 ns, a high-order integer multiple of the MLL repetition frequency.That guarantees that I(t) and I(t − τ) are independent, so a statistically unbiased random sequence is obtained.This point can also be further confirmed by monitoring the frequency of "1" bits in a long time, which is a good real-time indicator of the quality of the generated random number sequence. 36In the experiment, we recorded a random number sequence with a size of 1 Mbits every 6 min to calculate the "1" frequency.According to the NIST tests, only a deviation value of 0.13% in the frequency is allowed.Figure 6 is a typical "1" frequency variation with time increasing, where the red lines show the range 50.00% ± 0.13%.This result also demonstrates that statistically unbiased random number streams can be robustly generated for at least 24 h without deteriorating the performance of our RNG.
Noting that the RNG rate in our proof-of-principle experiment is 10 Gb/s (limited by the 11 GHz bandwidth of the chaos), we discuss the ultimately achievable real-time rate of the proposed method.The physical RNG scheme can be divided into two parts: a randomness source and its extraction.We notice that the recovery time of the commercial SOA has reached a level of less than 10 ps 37 and the response bandwidth of the commercial product of photo-detection has reached a level of 100 GHz. 31 This means that, with a randomness source of a sufficient bandwidth, the RNG rate has the potential to reach 100 Gb/s in real time, without any parallelization being used.In addition, considering that the chaotic laser in our experiment is an intensity variable, we believe that this method can also apply for the other similar entropy sources such as superluminescent diodes 19,20 or improved external cavity laser diodes. 38G. 6. Measured frequency of "1" bits (the blue dots) for the 10 Gb/s RNG.Note that the red lines show the range 50.00% ± 0.13%.
In conclusion, we have proposed a real-time and self-balanced photonic RNG method.The ultralow temporal jitter of the mode-locked laser, together with ultrafast photo-detection, makes this photonic approach an efficient way to overcome the electronic bottlenecks present in existing fast physical RNGs.Meanwhile, the introduction of balanced photo-detection technique gives our method a self-adaptive ability to generate statistically unbiased random numbers, with no need of dynamical threshold tuning or off-line post-processing.In the proof-of-principle experiment, 10 Gb/s real-time random number extraction is successfully demonstrated using a chaotic source consisting of two cascaded laser diodes.With a sufficient chaos bandwidth, the random number generation rate of our method can be improved to the level of 100 Gb/s.
FIG.2.Measured RF spectrum of the bandwidth-enhanced chaotic laser.
(b) depicts the calculated biases |B[N]| of the coded random number sequences a[n] with different sample sizes N = 0.1, 0.2, . .., 1.0 Mbits, respectively.Herein, |B[N]| is defined as |B[N]| = | a[n] − 0.5|, where • represents the statistically evaluated proportion of "1" in the random number sequences a[n].For a finite length of an ideal independent random number sequence, the estimate of |B[N]| should follow the Gaussian distribution N(0, σ b 2 ) where σ b = (N −1/2 )/2.From Fig. 4(b), it can be seen clearly that the estimates of |B[N]| keep below the three-standarddeviation line 3σ b .That indicates our generated random numbers can be considered to be statistically unbiased.

FIG. 5 .
FIG. 5. (a) Normalized correlation function (blue line) of the coded 10 Gb/s random number sequence with a finite length of N = 1 × 10 6 bits, where the red line is the three-standard-deviation for an ideal independent random number sequence, 3σ c = 3N −1/2 ; note, every delay time interval in the horizontal axis is 100 ps, which corresponds to one delay bit.(b) NIST test results use 1000 samples of N = 1 × 10 6 bits with a significance level α = 0.01, where red circles and blue squares represent the P-value and passed proportion of 15 test items, respectively.