Quantum random number generator using a cloud superconducting quantum computer based on source-independent protocol.

Quantum random number generator (QRNG) relies on the intrinsic randomness of quantum mechanics to produce true random numbers which are important in information processing tasks. Due to the presence of the superposition state, a quantum computer can be used as a true random number generator. However, in practice, the implementation of the quantum computer is subject to various noise sources, which affects the randomness of the generated random numbers. To solve this problem, we propose a scheme based on the quantum computer which is motivated by the source-independent QRNG scheme in optics. By using a method to estimate the upper bound of the superposition state preparation error, the scheme can provide certified randomness in the presence of readout errors. To increase the generation rate of random bits, we also provide a parameter optimization method with a finite data size. In addition, we experimentally demonstrate our scheme on the cloud superconducting quantum computers of IBM.

Introduction

Random number generators play an important role in many fields, such as cryptography[1] and scientific simulations[2]. Different applications require different levels of randomness. For the applications which require the random numbers to be statistically unbiased, pseudo random number generators (PRNGs) or classical random number generators relying on deterministic algorithms or physical processes have been widely used[3,4]. Although their output sequences may appear random and usually have a perfect balance between 0 and 1, the predictability and strong long-range correlation may result in security loopholes when employed in some applications, particularly in cryptography and quantum key distribution[5,6].

To solve this problem, based on the intrinsic uncertainty of quantum mechanics, quantum random number generators (QRNGs) can produce unpredictable random numbers and have attracted great attention in the past few years. Nowadays, many QRNG protocols implemented in optics have been proposed by using different randomness sources, including single photon detection[7-9], vacuum state fluctuation[10-12], laser phase fluctuation[13,14] and amplified spontaneous emission noise[15,16]. There are already some commercial QRNG products implementing these protocols. In general, a QRNG system consists of two parts, a randomness source and a measurement unit. The randomness source emits the superposition state in the measurement basis whose measurement outcome is unpredictable to produce random numbers. For example, for the superposition state , the results of projection measurements onto the basis of the state are purely random and ideally form the random numbers.

On the other hand, quantum computers based on different physical implementations have been rapidly developed[17], including superconducting quantum circuits[18,19], nuclear magnetic resonance[20,21] and optical systems[22]. Some companies have launched cloud quantum computers which enable users to send quantum programs to use quantum computer[23,24]. Furthermore, due to the presence of superposition state, a quantum computer can be considered as an unbiased QRNG to generate random numbers[25]. Generally, a quantum bit (qubit) can be prepared in the superposition state by applying the Hadamard gate on the initial state . Thus, repeating measurements on the qubit in the basis, the numbers 0 and 1 can be obtained with equal probabilities. Compared with the PRNG based on conventional digital computers, the QRNG based on quantum computers does not require random seeds, in which the risk of the predictability of output sequence can be avoided.

However, the imperfections of realistic devices and the presence of hardware noise may leave security loopholes that influence the randomness of generated random numbers in practice. To enhance the security of QRNG, self-testing or device-independent (DI) QRNGs are proposed which do not need to trust the generated quantum state and the measurement devices[26-28]. By observing the violation of the Bell inequality, the randomness of source can be guaranteed and true random numbers can be obtained. Unfortunately, realizing the practical implementation is difficult due to the requirement of a loophole-free Bell test, and the random number generation rate is very low, which cannot satisfy the demands of practical applications. To increase the generation rate and make the protocols more practical, a semi-self-testing or semi-device-independent (SDI) QRNG scheme with trusted part of the physical devices is proposed which presents a trade-off between the generation rate and the security of certified randomness[29-31].

Among SDI-QRNG schemes, source-independent (SI) QRNG has gathered lots of attention[32-34]. With reasonable assumptions that measurement devices are well-calibrated and the source is untrusted, the SI-QRNG can generate secure random numbers and achieve considerable random number generation rates. Most of the SI-QRNG protocols are realized by the quantum optics devices. Utilizing a laser as a randomness source, Zhu et al. proposed a SI-QRNG scheme and realized a randomness generation rate of over 5000 bps[34], and Marco et al. proposed a continuous-variable version of SI-QRNG protocol and realized a generation rate of 17 Gbps[35].

In addition to the optics based SI-QRNG, the method of SI-QRNG protocol can also be performed on the quantum computer. The existing quantum computers are noisy and vulnerable to various types of errors, which causes errors in the preparation of superposition state and affects the randomness of random numbers. For the conventional QRNG implementations, which output random numbers by directly measuring the quantum superposition state , the randomness of the output data cannot be well estimated due to the difficulty to model devices precisely. Although the random numbers generated by quantum computers can pass statistical testing after the combination of the von Neumann[36] and Samuelson extractors[37], the final random number extraction rate cannot be given and the randomness of the random numbers cannot be certified[38].

SI-QRNG protocol does not require accurate characterization of the equipment to estimate the randomness of generated random numbers under the situation that the measurement error is known. Although the measurement error is timely varied, one’s own quantum computer can monitor the measurement error on time. The final extraction rate of random numbers can be given by estimating the error in the preparation of superposition state . Motivated by the original SI-QRNG protocol[34], we propose a scheme that can guarantee the randomness of random numbers generated by noisy quantum computers. Rather than focusing on the influence of the source controlled by the adversary on the random numbers, we explore how many random bits can be extracted from raw data in the case of imperfect quantum gates. Using the cloud superconducting quantum computer of IBM, we experimentally examine the effectiveness of the proposed protocol based on the SI-QRNG protocol.

The rest of this article is organized as follows. In second section, the protocol based on SI-QRNG using cloud superconducting quantum computer is briefly introduced. In third section, we analyze the protocol, where the final extracted number of random bits is further given in the presence of readout errors, and the estimation method and optimization of the parameter are provided. In fourth section, an experimental demonstration of the scheme is performed with the cloud superconducting quantum computer of IBM. Finally, we conclude this paper in fifth section.

QRNG based on source-independent protocol

In the quantum computer, the initial state of a qubit is generally prepared in and can be represented with state vector as (T = Transpose). By applying gate, the superposition state can be acquired, in which gate performs rotation around Y-axis in the Bloch sphere and can be expressed with . If the quantum computer is noiseless and the quantum operations are perfect, the measurement results in the computational basis and should be uniformly random based on the mathematical axiom of quantum mechanics. However, the initial state, quantum gate and readout of each qubit may be impacted by hardware noise, which causes the temporal correlation between the output bits[39]. Thus, in the QRNG based on quantum computer, it is important to calculate how many random bits can be extracted from the raw data.

Motivated by the optics based SI-QRNG protocol proposed in Ref.[34], we implement the protocol based on SI-QRNG using the quantum computer, as shown in Fig. 1. The detailed steps of the protocol are as follows: Note that there is also another method to estimate the number of final random bits. Vallone et al.[42] performed a complete finite key analysis of the protocol where the conditional min-entropy of the measurement results of Z-basis can be bounded by using the Rényi entropy of order 1/2 of the measurement results of X-basis . Thus, by estimating the max-entropy , the number of final random bits can be determined. In principle, both the methods in Ref.[34] and[42] can be used to estimate the number of final random bits. We choose the method in Ref.[34] in our protocol.

Figure 1

Quantum circuits for the QRNG based on SI protocol. The qubit state is randomly measured in the X-basis or Z-basis.

Source: By applying gate on the initial state , a qubit is prepared in superposition state .

Random sampling: By utilizing a short random seed, we randomly choose the X basis quantum circuit or Z-basis quantum circuit to measure the quantum superposition state . By adding a gate to the circuits, the Z-basis measurement can be converted into X-basis measurement, where and . In this process, the quantum circuit is executed n times, including times in the X-basis quantum circuit and times in the Z-basis quantum circuit, where .

Parameter estimation: The quantum state emitted by the source should be state when the quantum computer system is noiseless. The measurement result of is and the result of is in the X-basis, respectively. Therefore, a result of means an error. We estimate the bit error rate in the X-basis measurement and the statistical deviation is denoted by o, the preparation error of state in the Z-basis can be estimated by o is the deviation due to statistical fluctuations which is bounded by[34] where , is the rate of X-basis choice and represents the Shannon entropy function. If the value of exceeds 0.5, we abort the protocol.

Randomness generation: The measurement results of the Z-basis are used to generate random numbers. We perform Z-basis quantum circuit times to generate random bits.

Randomness extraction: To extract true random numbers, the Topelitz-matrix hashing method is used. The number of final random bits is[34] where is the failure probability of the randomness extraction[40]. In practice, to construct a Toeplitz matrix of size for randomness extraction, the length of random bits is required. According to the leftover hash lemma[41], the final output random bits are not affected by the random bits used in the construction of the Topelitz matrix.

Analysis

In this section, we analyze the randomness of QRNG based on the quantum computer. Due to the presence of noise in the quantum computer, the readout, initial state and quantum gate are imperfect and thus impact the number of extracted random bits. The number of final random bits K, which is given by Eq. (3), does not consider the effect of readout errors. We first calculate the number of final random bits with different readout errors in “The number of extracted random bits in the presence of readout error” section. Then, to calculate the number of final random bits, a method for estimating the upper bound of , i.e., the error in the preparation of quantum superposition state, is given out in “The estimation of upper bound of ” section. Finally, considering the influence of the finite data size on the parameter estimation, the ratio of X-basis measurements is optimized in “Optimization of parameter ” section.

The number of extracted random bits in the presence of readout error

In practice, the readout operation of a quantum state is imperfect. Generally, the readout errors of and are different, which leads to the asymmetry in the 1/0 ratio of measurement outcomes. Thus, the influence of readout error on the number of extracted random numbers cannot be ignored. In the SI-QRNG based on optics, the influence of detector imperfection on the generated random numbers is analyzed in detail[43]. Motivated by this method, we analyze the scenario that the readout errors of and are different in the quantum computer and recalculate the number of final extracted random bits.

The readout error of , , means the probability to output while the actual state should be . Similarly, the readout error of , , means the probability to output while the actual state should be . When and are equal, the numbers of 1 and 0 in the measurement outcomes of superposition state are equal and the randomness of the output bits cannot be affected by the readout error. Thus, the readout process of a qubit can be equivalent to the superposition of two parts, as shown in Fig. 2. One is the case that the readout errors of and are equal, and the probability of occurrence of Part A is . The other one is the case that the readout errors of and are completely different and the probability of occurrence of Part B is , in which the readout error of one quantum state is 1 and the readout error of another quantum state is 0. Therefore, no genuine randomness can be extracted from Part B. The relationship between and is . Moreover, the readout error should fulfillwhere denotes the readout error of quantum state for Part j with and . Without loss of generality, we assume that the readout error is no larger than . Due to the relationships , and , Eq. (4) can be simplified asFurthermore, we can obtain that and . Because random numbers cannot be extracted from the output bits in Part B, the mutual information between legitimate user (Q) and any third party user (E) isTherefore, we can rewrite the number of extracted random bits asBy observing Eqs. (3) and (7), we can find that the two formulas are the same when (i.e., the readout error is the same for and ).

Figure 2

Equivalence of SI-QRNG under the different readout errors of a quantum state. The readout of a quantum state is equivalent to the superposition of two extreme parts: Part A and Part B. The readout errors of and are equal in Part A and are completely different in Part B, where the probabilities of occurrence of Part A and Part B are and , respectively.

The estimation of upper bound of

In practice, the preparation of superposition state is affected by various noises, which results in errors and affects the random number generation rate. To determine how many random bits can be extracted from the raw data, we need to estimate the upper bound of parameter , i.e., the errors in the preparation of state. As shown in Fig. 1, can be mainly divided into two parts, one is the errors in the preparation of initial state , and the other is the errors in the operation of single-qubit gate. Through experimental measurements, the errors in the preparation of the initial state can be determined. And one’s own quantum computer can obtain the initialization error on time. According to Eq. (1), the upper bound of can be determined with the estimation of . Thus, to estimate the upper bound of , the value of should be firstly estimated. In this subsection, we consider two cases, one is to consider the errors in quantum gate and readout, and the other is to consider the errors in the initial state, quantum gate and readout.

In our protocol, only the single-qubit gate is used. Due to the presence of various noise and the imperfection of control mechanism, gate exits deviations of the rotation angle around the Y-axis and the axis of rotation. In this case, the actual gate can be equivalent to the superposition of gate and gate. Denoting that the deviation of the rotation angle around the Y-axis is and the rotation angle around the Z-axis is . Therefore, the actual rotation angle around the Y-axis is and the gate can be represented by square matrices, i.e., . The gate is expressed with .

Case 1: The errors in quantum gate and readout are considered.

To prepare the superposition state , the first gate is performed on the initial state , which is equivalent to the superposition of gate and gate, resulting in the quantum stateTherefore, the prepared quantum state is in the superposition of state and state, where the probability of state is and the probability of state is , respectively. Applying the same gate and gate on the quantum state , the resulting quantum state isFinally, we can obtain or to measure the quantum state , where the probability of is and the probability of is in theory.

Furthermore, considering the readout error in the quantum computer, we can obtainwhere and are the numbers of 0 and 1 in the results of X-basis measurement with readout error which satisfies , and represent the numbers of 0 and 1 in the results of X-basis measurement without readout error, respectively. and can be expressed asIn our protocol, the result of state in the randomness source is defined as the preparation error of superposition state, so the error is equal to the probability of state, i.e., .

By solving Eq. (10), the value of and can be obtained. In a real quantum computer, the deviation of rotation angle around the Y-axis and around the Z-axis are both in , so . According to Eq. (11), we can obtain . Based on the expression for and the range value of , the range of can be determined which satisfies . Given a value of , the value of can also be determined with Eq. (11). Therefore, the preparation error of in the X-basis measurement can be calculated with .

Case 2: The errors in the initial state, quantum gate and readout are considered.

Due to the presence of errors in preparation of initial state, the initial state can be represented with , where , and the value of and can be obtained by measuring the initial state directly. In the computational basis, the state can be written as vector . The first gate is applied on the initial state to prepare the state , resulting in quantum stateThus, the probability of state and state are and , respectively. To measure the quantum state on the X-basis, the same gate and gate are performed on the quantum state , and the quantum state is obtained withBy measuring the quantum state , we can obtain that the probability of state is and the probability of state is in theory. The error is equal to the probability of state, i.e., .

Based on Eq. (10), the numbers of 0 and 1 in the results of X-basis measurement without readout errors, i.e., and , can be determined. According to the probabilities of 0 and 1 by measuring the quantum state , and can be expressed asSimilar with the analysis of Case 1, the deviations of rotation angle around the Y-axis and around the Z-axis are both in and . With Eq. (14) and the range value of , the range of can be determined which satisfies . Given a value of , the value of can also be determined with Eq. (14). Therefore, the preparation error of in the X-basis measurement can be calculated with .

For example, suppose , , , , and , we can obtain and with Eq. (10). Based on the expression of , the range value of can be calculated and the corresponding results are and in Case 1 and Case 2, respectively. With (11) and Eq. (14), the deviation of rotation angle around the Z-axis is determined in the two Cases. Moreover, the relationship between and is shown in Fig. 4b and d. Utilizing the determined value of and , the error can be calculated in Case 1 and Case 2, and the relationship between , and is shown in Fig. 3. Figure 4a and c shows the relationship between and in Case 1 and Case 2, respectively. In Case 1, we can discover that the parameter has a maximum value when , i.e., . In Case 2, the parameter also has a maximum value, i.e., . The value of calculated in Case 2 is larger than that in Case 1, which means that the errors in preparation of initial state have effects on . Then, according to Eq. (1), the bound of error can be determined.

Figure 4

(a, c) Projection of the xz plane of Fig. 3a and b. Relationship between rotation angle error and preparation error of state . (b, d) Projection of the xy plane of Fig. 3a and b. Relationship between errors in the rotation angle around Y-axis and Z-axis .

Figure 3

Relationships between , and . Simulated results with varying and . (a) Case 1; (b) Case 2.

Optimization of parameter

In the cloud superconducting quantum computer of IBM, the quantum circuit is repeatedly sent to the real devices. The running time directly affects the final data and parameter estimation. To increase the final generation rate of the QRNG and improve the security of the QRNG protocol, parameters should be optimized. Based on the parameter optimization method in Ref.[34], we consider the influence of the finite data size on the parameter estimation and optimize the ratio of X-basis measurements .

In our protocol, the measurements results of superposition state in the Z basis are used to generate random numbers, and the errors in the preparation of superposition state can be estimated by the measurement results of X-basis. Based on the method introduced in “Optimization of parameter ” section, can be well approximated by with an infinite data size. However, due to the statistical fluctuations, the parameter cannot be estimated accurately and the method of approximating is crucial. The parameter is estimated by Eq. (1) and the statistical fluctuation o is bounded by Eq. (2). According to Eq. (2), there is a trade-off between and o for the ratio of the final random bit length over the raw data size given that is fixed. Generally, the failure probability is picked to be a small value. Hence, the value of should be optimized for the randomness extraction rate and follows the condition:With the method of the numerical solution, the optimized can be obtained. In the cloud superconducting quantum computer of IBM, the maximum executing number of a quantum circuit is 8192 times. Repeating the quantum circuit, the final number of executions n can be up to times. The value of is in our later data processing. Supposing that the preparation error of superposition sate in the X-basis is 0.05, the readout error of is and the readout error of is , we can compute the optimal for the final extracted random bits , as shown in Fig. 5. The value of has a maximum value which means that the generation rate of random numbers can achieve a maximum value for a given condition.

Figure 5

Relationship between basis choice rate and final extracted random bits . Here, we set , , and .

Experiment on the cloud superconducting quantum computer of IBM

In this section, we perform our proposed protocol on the cloud superconducting quantum computers of IBM to show its practicality. Since the error in the preparation of the initial sates is almost zero in the quantum computers of IBM, the error can be estimated with the method in Case 1. In the quantum computer system, 8192 is the maximum number of uninterrupted shots available. For demonstration purposes, the basis choice is achieved by running the Z-basis measurement of the quantum circuit with 8192 times and the X-basis measurement of the quantum circuit with 251 times.

and are used in the experiment where the device topologies are shown in Fig. 6[44]. and both have five qubits and the readout error for each qubit is provided by Qiskit[45]. Without loss of generality, we select the qubit 0 () of the two devices to execute the quantum circuit and the readout errors of for these two devices are shown in Table 1.

Figure 6

Device topology of and .

Table 1

The readout errors of for and .

Device	Readout error
	r_0	r_1
IBMQ_5_yorktown	0.072	0.0394
IBMQ_lima	0.0964	0.0122

By running the quantum circuits of SI-QRNG repeatedly, we obtain two sequences under each quantum computer device which are the results of the Z-basis measurement and X-basis measurement. The sequence of Z-basis measurement is used to extract random bits and its length is 819200. The other sequence is used to estimate the preparation error of superposition state in the Z-basis and its length is 25100.

In the sequence of , the number of 0 is and the number of 1 is . According to Eq. (10) and the readout error of , we can obtain and . With Eq. (11), the value of is calculated which is between and 0.1095186. Exploiting the expression for , we can obtain the maximum value of is 0.011943. Based on Eqs. (1) and (2), the bound of is determined and equals to 0.0122442. Thus, the number of random bits that can be extracted from the Z-basis measurement is 741006 which is calculated by using Eq. (7), and the corresponding random bits’ generation rate is 0.9045. Utilizing the same method, the parameter and the final extracted random bits in the device can be calculated. The numbers of 0 and 1 in the X-basis of are and . By calculating, we can obtain , , and the corresponding random bits’ generation rate is 0.7589.

After obtaining the raw data and the estimated , we apply the Toeplitz matrix hashing on the raw data to obtain the final random numbers[46]. To evaluate the randomness of the final data, we perform the NIST Statistical Test on the final random numbers[47]. Since the length of the final data cannot satisfy some test items of the NIST Statistical Test, the final data is only subjected to the nine test items from the NIST Statistical Test which are the frequency test, frequency within a block test, runs test, longest runs within a block test, FFT test, approximate entropy test, Matrix Rank Test and the cumulative sums test (forward, backward). Each test item produces a corresponding P-value and the significance level is set as 0.01 in our test. If the P-value , the final data is considered as true random numbers with of confidence level. The results of the NIST Statistical Test on the two final sequences with a length of 600,000 bits are shown in Table 2. From Table 2, one can see that all the P-values are larger than 0.01, which indicates the final data of and pass all test items.

Table 2

The NIST Statistical Test results and corresponding P-value of final data.

Test	IBMQ_5_yorktown	IBMQ_lima
Frequence	0.706196	0.434013
Block frequency	0.444177	0.754105
Runs	0.760474	0.120287
Longest run	0.668568	0.653644
FFT	0.981097	0.915088
Approximate entropy	0.325238	0.162457
Rank	0.891846	0.653728
Cumulative sums (forward)	0.916711	0.782753
Cumulative sums (backward)	0.834860	0.628746
Result	Success	Success

Furthermore, we calculate the autocorrelation coefficients of the final data to test the independence between neighboring bits of final data. The autocorrelation coefficient is defined as , where stands for expectation, denotes the value of the bit in the sequence, and are the average and the variance of the sequence[16]. The final data with length of is considered as true random numbers when all autocorrelation coefficients are greater than the three-standard-deviation value with . We choose a sequence with a length of 600,000 bits to perform the autocorrelation test and the corresponding is approximately 0.003873. The results of the autocorrelation test of the two final sequences are shown in Fig. 7. The red dashed line stands for the corresponding three-standard-deviation value . It can be seen that all the absolute values of autocorrelation coefficients are below . From the results of the NIST Statistical Test and autocorrelation test, we can know the randomness of the final data generated by and can be guaranteed.

Figure 7

The absolute value of the autocorrelation function of the final data generated by and . The red dashed line is the three-standard-deviation line.

Conclusion

Due to the presence of noise and the imperfection of the control mechanism, there exit errors in the initialization, quantum gate and readout in the quantum computer, which leads to the bias of the output data. Motivated by the SI-QRNG based on optics[34], we propose and implement a QRNG scheme using a cloud superconducting quantum computer. Our proposed protocol can estimate the preparation error of superposition state and give the final number of extracted random bits, which guarantees the security of generated random numbers. The readout errors of and are generally different in the quantum computer, which impacts the randomness of generated random numbers. Utilizing the method for solving the imperfection of detector in origin SI-QRNG protocol, we firstly give the final extracted number of random bits with readout error. Then, by further considering the errors in the preparation of initial state and quantum gate, the estimation methods for parameter are given, where the quantum gate error includes the deviation of the rotation angle around the Y-axis and the rotation angle around the Z-axis . Moreover, we optimize the ratio of X-basis measurements to increase the final random number generation rate.

To prove the practicability of our protocol, we perform our proposed protocol on the cloud superconducting quantum computer of IBM. The random numbers generated by and are post-processed by Toeplitz matrix hashing to obtain the final random numbers. The results of the NIST Statistical Test and autocorrelation test show that the final random numbers could be considered as true random numbers. Utilizing the SI-QRNG scheme, the error in the preparation of quantum superposition state can be monitored, and we realize the generation of true random numbers in quantum computers with noise.