mitchell s success in using the proton - motive force to explain energy conversion in mitochondria ( mitchell , 1961 ) led to a considerable effort over the next three decades to explore the usefulness of nonequilibrium thermodynamics in biology ( caplan and essig , 1983 ; westerhoff and van dam , 1987 ; walz , 1990 ) .even if substantial progress was made , it was eventually concluded that the theory had major drawbacks .the flux - force relations that were established , were linear , and could only describe the dynamics in a rather narrow range near total equilibrium . since many biological reactions have an activation energy barrier and therefore have an intrinsically nonlinear dynamic behavior , such an overall thermodynamic analysis could not provide a full description of those processes .existing kinetic descriptions , on the other hand , are not able to account for the coupling between transport and chemical reaction . that coupling has so far only rigorously been established within the framework of onsager s theory .these difficulties , which already were pointed out by prigogine ( prigogine , 1955 ) and eyring ( eyring and eyring , 1965 ) in the context of activated processes , have hampered a wider application of nonequilibrium thermodynamics to biological systems , leaving the complete description of active transport processes to kinetic approaches .kinetic descriptions take the tight coupling of transport and chemical reaction as a starting point and can therefore not address a varying degree of coupling or slippage .  over the last few years , amazing new detailshave been revealed about the molecular mechanism of active transport by some atpases ( berman , 2001 ) .experimental evidence has been found that atp hydrolysis leads to a rotation of the central parts of the enzyme , followed by an electric signal in the channel that spans the membrane , attributed to the ion that is being transported , see e.g. ( peinelt and apell , 2004 ; burzik et al . , 2003 ; sun et al . , 2004 ) .active transport is accomplished by various types of molecular motors .a theory that relates these fluxes with driving forces in the system , however , is still lacking ( berman , 2001 ) .the purpose of this paper is to show that when irreversible processes are analyzed at a mesoscopic level , application of the method of nonequilibrium thermodynamics leads to a complete description of the process even in the nonlinear domain .the mesoscopic level has shorter time and length scales than we encounter on the macroscopic level .it is the level of description where fluctuations matter .rate laws on this level are stochastic of nature. we shall use mesoscopic nonequilibrium thermodynamics ( reguera and rubi , 2001 ; vilar and rubi , 2001 ) and go beyond the linear overall or black box description offered by classical nonequilibrium thermodynamics .this gives a new perspective to the problem of biological transport phenomena .the paper is organized as follows . in section 2, we introduce the main features of active transport of ions and discuss the limitations of a nonequilibrium thermodynamic description of the process . in section 3 , we present a kinetic description based on thermodynamic grounds which enables us to analyze active transport processes beyond the linear domain .finally , in section 4 we summarize our main results .we shall focus on the problem of active transport of an ion , the meaning of nonlinear flux - force relations and the coupling of vectorial and scalar forces in this context .as example we take ca transport in sarcoplasmic reticulum by means of the ca-atpase .we limit ourselves to the conversion between chemical energy and transport of the ion , neglecting a possible intervention of rotational energy .this does not exclude a torsional mechanism , however ( jain et al . , 2004 ) .the membrane is highly asymmetric , about 5 nm thick , and consists of a phospholipid bilayer with proteins embedded .figure 1 gives a schematic picture of the ca-atpase embedded in the phospholipid bilayer .the reaction takes place at the headgroup of the ca-atpase .the ion , to be actively transported along the protein channel , binds to a separate site and triggers the chemical reaction , the atp hydrolysis .each channel transports only a few molecules or ions per second , and there are not many channels of the same type in one membrane .experiments are done in a solution with many vesicles or organelles , so the observation refers to the average over the channels ( burzik et al . , 2003 ) .thus , we have a chemical reaction on a time scale similar to that of diffusion ( peinelt and apell , 2004 ; burzik et al . , 2003 ) .can we legitimately consider this dynamic situation with thermodynamic tools ?we shall see that the answer is yes .the spontaneous chemical reaction taking place at the membrane surface in fig.1 is , schematically : where s stands for surface .the reaction gibbs energy which arises is where is the chemical potential at the surface of component .calcium ions are transported across the membrane from side i to side o. the transport takes place against the chemical potential gradient as a consequence of its coupling to the above reaction : there is probably also a countertransport of protons to keep the system s local electroneutrality ( peinelt and apell , 2004 ) .non - equilibrium thermodynamics provides a description of the irreversible processes occurring at the surface ( albano and bedeaux , 1987 ) .it has been shown that the surface behaves as an autonomous thermodynamic system in local thermodynamic equilibrium , even in the presence of strong driving forces ( r et al . , 2000 ) .this fact enables one to formulate the gibbs equation for the surface element indicated in fig.1 ( albano and bedeaux , 1987 ) : here is the surface concentration of component in mol / mg , referring to the total unknown area of transfer per mg of material , and is the internal energy density of the surface .if the membrane potential contributes to transport of the calcium ions , one has to use electrochemical potentials .the conservation laws for the reacting species in eq.([1 ] ) are where are fluxes of species , is the reaction rate ( all in mol / s mg ) , and is the time .the minus sign refers to atp and the plus to the other species .the concentration of ca in mol / mg on the surface satisfies where are the inwards and outwards ion fluxes in mol / s mg .we omit the charge number in subscripts .for the time being , we consider an isothermal surface .the entropy production ( in w / mg k ) then follows by using eqs.([5 ] ) and ( [ 6 ] ) in combination with gibbs equation , taking the temperature constant and : the countertransport of protons to maintain the system s electroneutrality ( peinelt and apell , 2004 ) can be accounted for by modifying the driven force for , see eq .( 20 ) below . from this onenormally has inferred linear laws between fluxes and driving forces ( caplan and essig , 1983 ) , with an expression for the flux of ca describing linear active transport for small values of and constant onsager coefficients .equation ( [ 7 ] ) is normally taken for a black box description of active transport fromside i to o ( caplan and essig , 1983 ) . when the second term is negative , the coupling of to the reaction ( via )can compensate that negative contribution thus making transport against the concentration gradient possible .this is the coupling phenomenon that is referred to as active transport in the literature .no explanation has yet been given for the nature of the coupling ( berman , 2001 ) , leaving the problem unsolved as how to characterize the total process far from equilibrium .the lack of equilibrium for the chemical reaction on a time scale similar to that for ion transport is the reason for energy transduction between reaction and transport .this energy transduction process shall now be described for shorter time scales at which the system evolves from the initial to the final states .the local states of the system correspond to successive molecular configurations and are parametrized by an internal reaction coordinate running from 0 , at which there are reactants , to 1 , at which there are products .the coordinate is dimensionless .one may then extend the assumption of local thermodynamic equilibrium to the mesoscopic level and formulate the corresponding gibbs equation in -space : where is the concentration of enzymes with a reaction mixture characterized by coordinate , and is the average concentration of ca over the state given by , both concentrations in mol / mg . before the reaction , the gibbs energy becomes ; after the reaction it is .the relation between and is shown to the left in fig .mass conservation can be expressed at any position in -space through the conservation laws here is the local reaction flux along the reaction coordinate .the fluxes and contributions to the diffusion fluxes on sides i and o respectively , averaged over enzymes in state .the integrals of the fluxes over give the corresponding global fluxes .this choice for the conservation equation for ca may capture the essence of the delivery of ca to the other side in a pump that allows slippage .the local entropy production , defined through the entropy change per unit of time in the isothermal surface is then : then follows from eqs.([9 ] ) and ( [ 10 ] ) as has been assumed already , there is equilibrium for the ca-ion between the surface and the bulk solution .the local entropy production then simplifies to due to the activation barrier , the reaction rate almost immediately reaches a quasi - stationary state in which it only depends on time . using this property , the entropy production ( 4 )is recovered upon integration of eq .( [ 11a ] ) with a varying calcium flux .we shall assume that ca is not transported across an activation energy barrier .this means that the ion can escape from any surface state given by with to side o with , an explanation for why the flux depends on .the local flux - force relations that follow from eq.([11a ] ) , are : which are valid along the path going from the initial to the final state and have been formulated under the equilibriation assumption discussed previously . at each point of the path ,the onsager relation is fulfilled and the coefficient do not depend on the driving forces. the last relation will give a non - linear equation for the flux of ca across the membrane .the chemical reaction is an activated process . along the internal coordinate ,we can write the gibbs energy as a combination of the ideal contribution and an activation energy per mole , ; the boundary values of were defined above .the standard gibbs energy is chosen to be .for the potential profile , correct boundary conditions are obtained with and . the activation energy barrier with the transition state , ,is illustrated in fig.2 .we do not know the coefficients in eqs.([12 ] ) .but , under the condition of constant stoichiometry , or tight coupling , we can make certain assumptions that allow us to integrate the expression for the calcium flux .a constant stoichiometry means that the number of ca transported for every reacted atp is fixed .when the stoichiometry is fixed , and are dependent , and the matrix of coefficients has a zero determinant .the number of ca transported for every reacted atp can also be defined in -space .we obtain : in order to show how the linear , local eqs.([12 ] ) transform into nonlinear global laws , we choose as thermodynamic force the gradient of the local fugacity , =c(\gamma)\exp [ \phi ( \gamma ) /rt ]  \label{18}\ ] ] the fugacity divided by the fugacity at equilibrium , can be understood as the probability distribution function in -space divided by the equilibrium distribution , .the use of probabilities is characteristic to a mesoscopic description . the local diffusion flux ( [ 12 ] )can then be rewritten in terms of the new thermodynamic force }  \frac{\partial z(\gamma)}{\partial \gamma } -  \frac{l_{dd}(\gamma)}{t }  \left[\mu_{\text{ca}}^{\text{o}}-\mu_{\text{ca}}^{\text{i}}\right ]  \label{19}\ ] ] where we have used eqs.([15 ] ) and ( [ 18 ] ) and defined in accordance with kramers .we find the macroscopic flux in terms of the driving forces by integrating over . using the quasi - stationary condition for the reaction flux , and constant n, it follows that is constant . usingfurthermore that is in good approximation constant , we obtain : \label{21}\ ] ] where we have also used .this overall diffusion flux ( [ 21 ] ) describes active transport of ca for arbitrary values of , and accounts thus for the transduction process also in the nonlinear regime , which could not previously be described through nonequilibrium thermodynamics .nonlinearities inherent to the kinetics of the chemical reaction emerge in the broad description if one proceeds with a thermodynamic analysis at the mesoscopic level and subsequently coarsens the description by retaining only the initial and final states . at small values of the driving force , eq.([21 ] ) reduces to expression ( 5 ) valid only in the linear regime .it is interesting to note that the prefactor of the nonlinear term contains an arrhenius factor characteristic for activated processes . the first term in eq.([21 ] )is also present in the equation for active transport , derived by the king - altmann - hill method ( westerhoff and van dam , 1987 ) .this equation does not have a second term .the derivation and the understanding of eq.([21 ] ) compared to equations that have been used earlier to describe ca transport , however , are very different .  equation ( [ 21 ] ) can be used to plot experimental data and find the product and . the value of obtained by imposing the static head condition to eq .( 17 ) , may be different from the one given through the relation depending on experimental conditions .the chemical potentials for ca for state i or o : where the ideal mixture approximation and the same standard state has been used for both sides .the approximate difference in chemical potentials for ca is : this driving force can be modified to also account for the countertransport of protons . the effective driving force for exchange of ca and h only a zero difference in ph between the sides has no influence on this force .  in the derivation of the flux equations ( [ 12 ] ), we have made the assumption that the surface is isothermal .otherwise the model is general in the way that it allows slippage .we have further assumed that ca transport across the membrane is not an activated process , but rather that its contribution to the total flux is simply linear in its corresponding driving force , with a transport coefficient independent from the activation energy .therefore , the only nonlinearity comes from the kinetics of the chemical reaction .this assumption may be valid for the concentrations of calcium that are physiologically relevant .  in order to integrate the flux on the mesoscopic level , we introduced one more assumption , namely that of a tight pump .this assumption is thus a requirement for eq.([21 ] ) .the assumption may hold for an isothermal surface , but there are many conditions for which this is not true ( berman , 2001 ) .the theory we have presented could be useful in describing other types of active transport in biological systems , as the ones taking place in molecular motors for which translational ( bedeaux et al . , 2004 ) or rotational motionmay be induced at the expense of the energy provided by the chemical reaction ( sun et al . , 2004 ) .it can also be used for a more detailed look at pump slippage , believed to occur for high driving forces , and indicated by a variable stoichiometry ( zoratti et al ., 1986 ; walz , 1990 ) .one advantage of the present formulation , not contained in kinetic approaches , is that the energy dissipated as heat ( berman ; 2001 ) can be directly calculated from .a large value of suggests that the surface may be nonisothermal , and has a meaning also for nonlinear flux - force relations .the main aim of this paper has been to show that active transport processes can be described by means of mesoscopic nonequilibrium thermodynamics ( reguera and rubi , 2001 ; vilar and rubi , 2001 ) .we have been able to describe the coupling between the chemical reaction and transport , which is mandatory in a complete thermodynamic description of this type of system , and which was previously not obtained outside the range of linear flux - force - relations ( berman , 2001 ) .we have shown that when local equilibrium is formulated at shorter time scales , the overall diffusion flux is nonlinear in the macroscopic driving force . a new way to plot experimental datahas thus been given , applicable for large values of .the formulation we propose is of a mesoscopic nature and may incorporate the presence of fluctuations in the dynamics consistent with a fokker - planck description ( vilar and rubi , 2001 ) .we have somewhat arbitrarily taken active transport of ca as an example , but the scheme proposed could be transferable to many kinds of transport processes that obtain their energy from chemical reactions such as molecular motors .this shows that nonequilibrium thermodynamic methods are not restricted to the linear response domain ( j et al . ,1997 ) but can be used in a broader context to perform a description of the dyamics also in the nonlinear domain .we hope in this way to provide a general scenario in which nonlinear transport processes occurring in biological system can be dealt with .s.k . is grateful to mecd grant number sab 2002 - 0191 that made possible her sabbatical stay in university of barcelona .d.b . is grateful to mecd grant number sab 2003 - 0051 .this work was partially supported by dgicyt of the spanish government under grant no .pb2002 - 01267 .albano , a.m. & bedeaux , d. ( 1987 ) .non - equilibrium electro - thermodynamics of polarizable multicomponent fluids with an interface . _physica a _ * 147 * , 407 - 435 .+ bedeaux , d. , kjelstrup , s. & rubi , j.m .nonequilibrium translational effects in evaporation and condensation. _ j. chem .phys . _ * 119 * , 9163 - 9170 .+ berman , m.c .slippage and uncoupling in p - type cation pumps ; implications for energy transduction mechanisms and regulation of metabolism ._ biochim .. acta _ * 1513 * , 95 - 121 .+ burzik , c. , kaim , g. , dimroth , p. , bamberg , e. & fendler , k. ( 2003 ) .charge displacements during atp - hydrolysis and synthesis of the na-transporting -atpase of llyobacter tartaricus . _ biophysical journal _ , * 85 * , 2044 - 2054. + caplan , s.r .& essig , a. ( 1983 ) _ bioenergetics and linear nonequilibrium thermodynamics .the steady state_. ( harvard university press , cambridge , massachusetts ) .+ eyring , h. & eyring , e. ( 1965 ) _ modern chemical kinetics . _( chapman and hall , london ) . + jain , s. , murugavel , r. & hansen , l.d .atp synthase and the torsional mechanism : resolving a 50-year - old mystery .* 87 * , 16 - 19 .+ j , f. , adjari , a. & prost , j. ( 1997 ) .modeling molecular motors .mod . phys _ * 69 * , 1269 - 1281 .+ kramers , h.a .brownian motion in a field of force and the diffusion model of chemical reactions _ physica _ * 7 * , 284 - 304 .+ mitchell , p. ( 1961 ) .coupling of phosphorylation to electron and hydrogen transfer by a chemi - osmotic type mechanism ._ nature ( london ) _ , * 191 * , 144 - 148 .+ peinelt , c. & apell , h.j .time - resolved charge movements in the sarcoplasmatic reticulum ca - atpase ._ biophysical j. _ * 86 * , 815 - 824 .+ prigogine , i. ( 1965 ) _ thermodynamics of irreversible processes . _( charles c. thomas , springfield ) .+ reguera , d. & rubi , j.m .kinetic equations for diffusion in the presence of entropic barriers .e _ * 64 * , 061106 ( 1 - 8 ) .+ rsjorde , a. , fossmo , d.w ., bedeaux , d. , kjelstrup , s. & hafskjold , b. ( 2000 ) .nonequilibrium molecular dynamics simulations of steady - state heat and mass transport in condensation : i. local equilibrium ._ j. colloid interf .sci . _ * 232 * , 178 - 185 .+ sun , s.x . ,wang , h. & oster , g. ( 2004 ) .asymmetry in the and its implications for the rotational cycle ._ biophysical j. _ * 86 * , 1373 - 1384 .+ vilar , j.m . & rubi , j.m .thermodynamics beyond local equilibrium . _usa _ * 98 * , 11081 - 11084 .+ walz , d. ( 1990 ) .biothermokinetics of processes and energy conversion ._ biochim .acta _ * 1019 * 171 - 224 .+ westerhoff , h.v . & van dam , k. ( 1987 ) _ thermodynamics and control of biological free - energy transduction _( elsevier , amsterdam ) .+ zoratti , m. , favaron , m. , pietrobon , d. & azzone , g.f .intrinsic uncoupling of mitochondrial proton pumps ._ biochemistry _ * 25 * , 760 - 767 .

Abstract: we show that active transport processes in biological systems can be understood through a local equilibrium description formulated at the mesoscale , the scale to describe stochastic processes . this new approach uses the method established by nonequilibrium thermodynamics to account for the irreversible processes occurring at this scale and provides nonlinear kinetic equations for the rates in terms of the driving forces . the results show that the application domain of nonequilibrium thermodynamics method to biological systems goes beyond the linear domain . a model for transport of ca by the ca-atpase , coupled to the hydrolysis of adenosine - triphosphate is analyzed in detail showing that it depends on the reaction gibbs energy in a non - linear way . our results unify thermodynamic and kinetic descriptions , thereby opening new perspectives in the study of different transport phenomena in biological systems .   : active transport , nonequilibrium thermodynamics , kinetics , ion channels , molecular motors


the physics of quantum systems opens a door to tremendously intriguing possibilities for cryptography , the art and science of communicating in the presence of adversaries .one major goal of classical cryptography is to certify the origin of a message .much like a handwritten signature on a paper document , a _ digital signature_ authenticates an electronic document and ensures that it has not been tampered with .the importance of digital signatures to modern electronic commerce has become such that rivest has written `` [ they ] may prove to be one of the most fundamental and useful inventions of modern cryptography.'' this is especially true of schemes where the signature can be recognized using a widely available reference .the security of all such public key digital signature schemes presently depends on the inability of a forger to solve certain difficult mathematical problems , such as factoring large numbers .unfortunately , with a quantum computer factoring becomes tractable , thus allowing signatures to be forged .we present a _ quantum _ digital signature scheme which is absolutely secure , even against powerful quantum cheating strategies .it allows a sender ( alice ) to sign a message so that the signature can be validated by one or more different people , and all will agree either that the message came from alice or that it has been tampered with .the scheme described here is somewhat cumbersome , but the underlying principles suggest novel research directions for the field of quantum cryptography . while quantum public keys are more limited than classical public keys , they remain more powerful than private keys , and the existence of an unconditionally secure quantum digital signature scheme suggests an as - yet unrealized potential for quantum public key cryptography .classical digital signature schemes can be created out of any one - way function . is a one - way function if it is easy to compute given , but computing given is very difficult .this allows the following digital signature scheme : alice chooses and , and publicly announces , and .later , to sign a single bit , alice presents .the recipient can easily compute and check that it agrees with alice s earlier announcement , and since and were known only to alice , this certifies that she must have sent the message .the public keys can only be used once , unlike more sophisticated digital signature schemes , but this simple protocol serves as a good model for a quantum scheme . while there are many candidate one - way functions , none have been proven to be secure , and some , such as multiplying together two primes ( the inverse being factoring the product ) , become insecure on a quantum computer .this deficiency leaves a substantial gap in the cryptographic landscape .we describe a digital signature scheme based on a quantum analogue of a one - way function which , unlike any classical function , is provably secure from an information - theoretic standpoint , no matter how advanced the enemy s computers .our goal is to reproduce the primary advantages of classical public key cryptography in a quantum setting .these are twofold : first , a public key can be safely given to an opponent without endangering the security of the protocol .this reduces the security requirements involved in key distribution .second , every recipient has the same public key , which simplifies key distribution further ; someone who is unsure whether he has received a correct public key can compare with one from a different source or with a friend s copy of the key .our protocol should not be regarded as the culmination of this line of research , but as proof of the principle that quantum protocols can have these properties .the key idea we introduce is a one - way function whose input is a classical bit - string , and whose output is a _ quantum _state ( versus , for instance , a function which maps quantum states to quantum states ) .like the above classical scheme , we will require quantum bits ( qubits ) to sign a -bit message .it is not sufficient , however , to simply plug in in place of .first , due to the no - cloning theorem , there can be no perfect equality test for quantum states .also , as we show below , the nature of quantum states provides alice with non - classical cheating strategies . and unlike classical schemes, only a limited number of copies of the public key can be issued , or the scheme becomes insecure . despite these difficulties , the protocol we present , when used correctly , allows the probability of any security failure to be made exponentially small with only polynomial expenditure of resources .we begin by defining quantum one - way functions and discussing their properties .we then present our signature protocol and prove its security ; this proof appears in two parts , separated by a discussion of key distribution .we conclude with some generalizations of and limitations to our protocol .ever since the invention of secure quantum key distribution , many attempts have been made to exploit the unique properties of quantum systems to provide new cryptographic primitives .a great surprise was the failure of quantum bit commitment ; subsequently , less powerful but still interesting primitives such as quantum bit escrow were introduced .looking beyond cryptography , many more new quantum protocols have been discovered , such as quantum random access codes and quantum fingerprints .  here , we introduce a limited - utility quantum one - way function , based on two properties of quantum systems which are also essential for quantum fingerprinting .first , quantum bits , unlike their classical counterparts , can exist in a superposition of and .the general state of a single qubit is written as a two - component vector , where and form an orthonormal basis for the vector space , and , are complex numbers satisfying . because of this continuous degree of freedom , distances between two qubit states and naturally take on non - integer values ( less than the maximum , ) , defined as , where is the inner product between the two vectors .this becomes particularly interesting when considering the general state of qubits , , where the number of coefficients is exponentially larger than the number of qubits .it follows from simple volumetric arguments that sets of states exist satisfying for where the set may have many more than states if , meaning the states are not maximally distant from each other .in fact , as buhrman , cleve , watrous , and de wolf showed , for , one may have a set of size .we shall make use of this property by taking all classical bit strings of length , and assigning to each one a quantum state of qubits .these states are nearly orthogonal : for , allowing to be much larger than .as mentioned above , for the quantum fingerprint states , with .another family is provided by the set of stabilizer states , with , and .both these sets are easy to create with any standard set of universal quantum gates .a third family of interest uses just qubit per state , and consists of the states , for , and integer .this family works for any value of , and gives .the second property we exploit is that although the mapping latexmath:[(|0\ > +  the ancilla qubit as control and and as targets . then perform a hadamard gate on the ancilla qubit and measure it .if the result is , then the swap test is passed ; this always happens if . otherwise , if , the result occurs with probability at most .if the result is , then the test fails ; this happens only when and occurs with probability .clearly the swap test works equally well even if the states are not outputs of the function  if the states are the same , they always pass the swap test , while if they are different , they sometimes fail .the point is that an equality test exists , but fails with nonzero probability .another important property is the ability to verify the output of the function : given , how do we check that a state ?this is straightforward : since the function is easy to compute ( here , denotes an qubit state ) , simply perform the inverse operation , and measure the second register . if .thus , verification is also possible , but again it is probabilistic .* a naive quantum signature protocol .* what happens if we simply drop in our quantum one - way function in place of the classical one in lamport s signature scheme ( described above ) ?the protocol parameters and are fixed , and a map is chosen by all parties .alice generates and as her private keys , and publicly announces and as her public keys . as in lamport s scheme , she then signs a bit by presenting .ideally , the recipient , bob , would then want to test alice s quantum public key for validity . he can do this using the verification test , to see if maps back to .furthermore , once bob is satisfied with the validity of alice s message , he would like to be able to pass it on to judge charlie , knowing that charlie will also find the message valid .unfortunately , bob s test sometimes fails ; furthermore , it irreversibly consumes one of alice s public keys !  other potential problems arise as well . for instance , unlike the output of a perfect classical one - way function , from which someone with limited computational ability can learn _ nothing _ at all about the input , always leaks a limited amount of information about , the input to the quantum one - way function .furthermore , quantum cheating strategies become available ; for example alice may want to make bob and charlie disagree on the validity of her message .how can we be sure that all of the copies of the public keys she hands out are identical ?along the same lines , alice is free to prepare an entangled initial state , with which she can delay choosing until after she has given away .her ability to do this spells the doom of any attempt to use quantum one - way functions to perform bit commitment , which is one application of classical one - way functions .but _ only _ alice has the ability to change the state , and it will not help her in this instance .this saving grace enables us to use quantum one - way functions to perform digital signatures .most of the new difficulties introduced by quantum states can be dealt with by using many public keys per message bit instead of just one . in the remainder of the paper , we discuss the details of this modification , and more importantly address the issue of alice s quantum cheating strategies .we now present the signature protocol , beginning first with a definition of what such a protocol should accomplish and how its security is evaluated ; following this we present the quantum protocol in detail .* definition .* we adopt essentially the usual definition of a one - use digital signature ; that is , alice has a set of private keys and all recipients have copies of the corresponding public keys . given a message , alice can then produce a single signed message .conversely , given any message , signature pair any recipient can process the pair to reach one of three possible conclusions :  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * message is valid , can be transferred * message is valid , might not be transferable * message is invalid _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _  the first two results imply that alice sent the message .they differ in that result * 1-acc * means the recipient is sure any other recipient will also conclude the message is valid ( thus the message is `` transferable '' ) , whereas result * 0-acc * allows the possibility that a second recipient might conclude the message is invalid ( the number `` 1 '' or `` 0 '' refers to the minimum number of people who agree with the conclusion that the message is valid ) .result * rej * implies the recipient can not safely reach any conclusion about the authenticity of the message .we require that any recipient who receives a correct message , signature pair always reaches conclusion * 1-acc*.  * security criteria .* the protocol should satisfy two security criteria .first , it should be secure against forging , which means that , even given access to a valid signed message and all available copies of the public keys , no forger has an appreciable chance of creating a message , signature pair ( with ) such that an honest recipient will accept it ( conclusions * 1-acc * or * 0-acc * ) except with exponentially small probability .second , the scheme should be secure against alice s attempts to repudiate the message .that is , for any pair of recipients , with high probability , if the first recipient reaches conclusion * 1-acc * ( the message is valid and transferable ) , then the second recipient also reaches conclusion * 1-acc * or * 0-acc * ( the message is valid ) .our definition differs from the most common classical definitions in only three respects : first , the possibility of result * 0-acc * is not available in most classical signature schemes ( although some allow it ) .second , we only require that the security criteria hold with high probability ( again true of some classical schemes ) . third , and most notably ,the public keys in our scheme are quantum states rather than classical strings .this protocol is applicable to a variety of cryptographic problems .for instance , alice may wish to sign a contract with bob such that bob can prove to judge charlie that the contract is valid . in this case , bob should accept the contract whenever he gets result * 1-acc * for a message , and charlie should accept unless he gets result * rej*. this problem can also be solved by a variety of classical protocols , of course .however , most only offer security against computationally - bounded attacks .others offer information - theoretic security , but require additional resources during the key distribution phase ( see section [ sec : distribution ] ) , such as a secure anonymous broadcast channel or a noisy channel , which are difficult to justify as physical resources .in addition , the classical information - theoretic protocols use distinct private keys and require substantial interaction among the participants during the key distribution phase , whereas the quantum protocol we present below requires only a physically plausible quantum channel and modest interactivity quite similar to that required by classical public key distribution .  * quantum signature protocol specification .* as the private keys for our protocol , alice chooses a number of pairs of -bit strings ,the s will later be used to sign a message , and the s will be used to sign . note and are chosen independently and randomly for each , and keys are used to sign each bit . is the security parameter ; the protocol is exponentially secure in when the other parameters are fixed .the states ( for each ) will then be alice s public keys for an appropriate quantum one - way function .the public keys are `` public , '' in the sense that no particular security measures are necessary in distributing them : if a number of copies fall into the hands of potential forgers , the protocol remains secure .note that the creation of these keys is up to alice ( or someone she trusts ) , because unknown quantum states can not be perfectly copied , according to the no - cloning theorem .we begin by making the simplifying assumption that all recipients have received correct and identical copies of alice s public keys ; we will revisit this assumption later in the paper .all participants in the protocol will know how to implement the map .all participants will also know two numbers , and , thresholds for acceptance and rejection used in the protocol .a bound on the allowed value of will be given as part of the proof of security , below . can be zero in the absence of noise ; the gap limits alice s chance of cheating .we assume perfect devices and channels throughout this paper , but our protocol still works in the presence of weak noise by letting be greater than zero , and with other minor adjustments .we further require that alice limits distribution of the public keys so that copies of each key are available ( recall that is an qubit state ) .alice can now send a single - bit message using the following procedure :  1 .alice sends the signed message over an insecure classical channel .thus , alice reveals the identity of half of her public keyseach recipient of the signed message checks each of the revealed public keys to verify that .recipient counts the number of incorrect keys ; let this be .recipient accepts the message as valid and transferable ( result * 1-acc * ) if , and rejects it as invalid ( result * rej * ) if .if , recipient concludes the message is valid but not necessarily transferable to other recipients ( result * 0-acc * ) .4 .  discard all used and unused keys .when is large , the message has been heavily tampered with , and may be invalid . when it is small, the message can not have been changed very much from what alice sent . is similar for all recipients , but need not be identical . as we shall see below , the thresholds and separate values of into different domains of securityforgery is prevented by , and cheating by alice is prevented by a gap between and .we need to prove the security of this scheme against two scenarios of cheaters . in the first scenario ,only alice is dishonest ; her goal is to get recipients to disagree about whether a message is valid or not ( i.e. , she wishes to `` repudiate '' it ) .we will show that if one recipient unconditionally accepts ( ) , then it is very unlikely that another will unconditionally reject ( ) .however , we delay this proof until after discussing distribution of the public keys .the second scenario is the standard forging scenario . in this case ,alice and at least one recipient bob are honest .other recipients or some third party are dishonest , and they wish to convince bob that a message is valid .naturally , the forgers can always prevent any message from being received , or cause bob to reject a valid message , but we do not consider this to be a success for the cheaters .the security proof for this scenario is straightforward . in the worst case ,the forger eve has access to all copies of each public key . by holevos theorem , eve can acquire at most bits of information about each bit string .when alice sends the signed message , eve may attempt to substitute a different and ( possibly ) different values of the to go with it .however , since she lacks at least bits of information about any public key which alice hasnt revealed , she will only guess correctly on about keys . furthermore , if she wishes to change a key whose identity she did not guess correctly , she has only probability of successfully revealing the key .each recipient measures keys , so when , each recipient will find ( with high probability ) that at least public keys fail .we will pick so that , which means each recipient either receives the correct message , or rejects the message with high probability .for the first scenario , where alice is dishonest , we will simplify to the case where there are only two recipients , bob and charlie .however , before tackling the proof , we must return to the issue of key distribution . here, alice wishes bob ( for instance ) to accept the message and charlie to reject it .certainly , if alice can give completely different public keys to bob and charlie , she can easily repudiate her messages ; therefore , any signature scheme , classical or quantum , must be accompanied by a key distribution scheme to eliminate this possibility .classically , a straightforward assumption is that public keys are broadcast to all recipients ; however , in practice this is seldom the case ( the internet , for instance , is normally used as a point - to - point network ) , and creating a cryptographically secure broadcast channel is a highly nontrivial task . in the quantum case , we do not even have the possibility of a broadcast channel , so we must resort to other means .one straightforward solution is to assume the existence of a trusted key distribution center , which has authenticated links to all three participants .alice sends her public keys to the key distribution center , which performs swap tests between corresponding pairs of public keys .if any pair of public keys fails the swap test , the center concludes alice is cheating ; otherwise it forwards a copy of each public key to each recipient .alice can prepare any state she wishes for the public keys , including entangled states and states outside the family .for instance , she can prepare a symmetric state , such as . because this state is invariant under swaps, it always passes all tests , so that the key distribution center concludes that bob and charlie will have the same key .but that is an illusion clever trickery by alice who can nevertheless arrange that bob and charlie disagree on the validity of the corresponding private key .however , alice can not control which of them receives the valid key ; it goes randomly to bob or charlie .thus , since is large , the difference is with high probability , which makes it very unlikely that bob and charlie will get definitive but differing results . that is , when one of them ( say , bob ) accepts a message ( * 1-acc * ) , that is , charlie almost never rejects it ( * rej * ) , which would happen if . the gap between and protects them against alice s machinations .  of course ,assuming a universally trusted third ( or in this case , fourth ) party always simplifies cryptographic protocols , so for the full proof , we wish to consider a more sophisticated scenario . in this case, we assume that bob and charlie have each received their public keys directly from alice , perhaps in person , perhaps via a private key authenticated channel . then to test their keys classically, bob and charlie would announce and compare them . for our quantum protocol, they can instead perform the following distributed swap test : each of bob and charlie receives from alice _ two _ copies of each public key ( so there are a total of copies of each public key in circulation ) . for each value of and , the recipients verify that they all received the same public key .to do so , each recipient first performs a swap test between their two keys , then passes one copy to a single recipient ( bob , for instance ) .bob then checks that these two test keys pass the swap test as well .if any keys fail either test , the protocol is aborted .otherwise , discard the test keys .the remaining `` kept '' keys are used to verify messages in the main protocol .a dishonest recipient can always cause the key distribution phase to abort , but nothing more .he could also allow a dishonest alice to incorrectly pass the test , but the notion of a digital signature is only meaningful when at least two participants are honest .when alice is honest , no cheater has an opportunity to alter someone else s public key , so the scheme remains secure against forgery .we wish to emphasize that the above suggestions for key distribution are by no means the only possibilities .the distributed swap test can easily be generalized to the case of multiple recipients ( see section [ sec : generalizations ] ) , for instance , and many classical methods of key distribution can be adapted for the quantum case to allow a variety of security assumptions . ideally , it would be possible to state a simple security criterion that would evaluate whether a given method of key distribution is successful or not without reference to the particular quantum public key protocol for which the keys are intended , but we do not attempt to formulate such a definition .we now return to the security of our digital signature protocol , and show that it prevents alice from cheating ( repudiating a message she has signed ) .whatever the method of key distribution , some form of swap test is likely to be present , so we assume the use of a distributed swap test . our goal is to compute the probability that alice can pass all the swap tests but achieve , meaning that bob and charlie disagree about the validity of the message .we do this by studying a global pure state , which describes all of the public keys as well as any state that alice may have which is entangled with the keys .any state which passes the initial swap tests will be symmetric between the test keys and the kept keys ; in fact , it is symmetric between any individual test key and the corresponding kept key .therefore , we can safely assume alice prepares with this property .from now on , when we speak of the swap test , we only refer to the second swap test between the two test keys .now , for each set of four keys ( two test and two kept ) , the most general state is a superposition of two types of terms .a type-1 term may pass the swap test , but leaves bob and charlie in agreement , on average , about the validity of the keys , while a type-2 term frequently fails the swap test . to perform the decomposition , we expand the kept keys and the test keys each in the basis , , , and , where the first ket is bob s , the second is charlie s , for the current value of and , the states form an orthonormal basis with , and .thus , a dishonest alice might , for instance , prepare the state indicates kept keys and indicates test keys .a type-1 term is any term for which both the kept and test keys are in a state , , or .note that a sum of type-1 terms ( such as , above ) may always pass the swap test , but also has equal amplitudes for bob and charlie to pass key verification .a type-2 term is any term including a state for the kept keys , the test keys , or both . for the type-2 terms, we explicitly note the symmetry between the kept and test keys , meaning the superposition chance of failing the swap test . on the other hand ,some superpositions of type-2 terms can give different chances for bob and charlie to pass key verification .also note that the subspace of type-1 terms is orthogonal to the subspace of type-2 terms .expanding every set of keys in in this way gives a global state which we can again divide up into two terms : type-2 tensor factors , where for some constant ; the rest are type-1 terms . consists of terms with more than type-2 tensor factors .we wish to show first that for the state , will be small .if there were only a single summand in , this would clearly be true , since each type-1 factor has an equal probability of contributing to and to , and there are only a few type-2 terms .however , different summands of with different patterns of type-1 and type-2 states might interfere quantum - mechanically .to show is small even in this case , it will be sufficient to look just at the kept keys , and furthermore only at the states and  the states and always produce exactly the same contribution to and to , and can not interfere with each other .in fact , and can not interfere when , so we can restrict attention to just two states and . on the other hand ,the combination gives the opposite result .this allows us to simplify the problem .we can invoke the lemma from appendix [ sec : lemma ] to show that , for large and sufficiently small , the probability that for is exponentially small in ; less than }$ ] , in fact , although this is not at all a tight bound .  for , we wish to show that the probability of passing the swap test is very small . to see this, it will suffice to consider a modified swap test which passes any state of the test keys except ; certainly the probability of passing this test can be no smaller than the probability of passing the original swap test .since each type-2 term by itself has at least a chance of failing the modified swap test , a tensor product of or more of them passes with probability no larger than .there can be no interference between different positions for the type-2 terms , since the modified swap test is compatible with the projection onto type-1 and type-2 terms .therefore , the probability of passing the swap test ( original or modified ) is at most . since ,this is exponentially small in .now we can put this together to obtain a bound on , which is the probability that the state both passes the swap test and produces .the term might have a good chance of passing all swap tests , but yields an exponentially small chance of giving the required separation between and .the term might have probability of having , but only has an chance of passing all swap tests . the best case for constructive interference between the two termsgives a total probability at most twice the sum of the two probabilities for and , which is still exponentially small in .therefore , alice has probability of successfully cheating for some .one straightforward generalization is to use the distributed swap test with many recipients . to do this, we can replace the swap test with a test for complete symmetry of states  . instead of preparing an ancilla in the state , we prepare a superposition over states indexed by all permutations of elements .then perform the permutation conditioned on the ancilla being in the state , and finally measure the ancilla to see if it remains in the original superposition .if the state of keys being tested is completely symmetric , it always will pass , otherwise it has some chance to fail .furthermore , note that , for any state of the keys , the probability that any particular pair of keys out of the keys being tested will fail a regular swap test is no larger than the chance that the full set of keys fails the symmetry test , so for any pair of keys , the symmetry test is at least as sensitive as the swap test .the distributed symmetry test then allows public key distribution for recipients .each person receives copies of each public key ( so there are copies in circulation ) and tests them for complete symmetry .assuming they pass , each recipient keeps one copy of each key to verify a signature , sends one copy to each of the other recipients to perform a second symmetry test , and keeps the last copy for his own symmetry test .each recipient now has test keys , and performs a symmetry test on those keys .he rejects the set of keys if it fails either of the symmetry tests he performed .if we restrict attention to any particular pair of recipients , this procedure essentially reduces to the distributed swap test again , so the proof of the previous section tells us that for any two recipients and , the probability that the keys pass the symmetry test but is exponentially small in .this shows the signature protocol remains secure with the distributed symmetry test and many recipients .we can also create additional thresholds to allow more than one transfer .that is , , and if , for , then recipient will _ -accept _ the message .when a recipient -accepts the message ( result * -acc * ) , he is convinced the message is valid ( it originated with alice ) , and that any other recipient will at least -accept the same message . a recipient who -accepts a message is convinced it is valid , but is not sure someone else will agree with him ( result * 0-acc * ) .in other words , -acceptance means the recipient is sure he can convince other people of the message s validity sequentially , even if each wants to be sure later people accept it as well .the security of -acceptance follows immediately from the proof of security in the last section , simply substituting for .another useful extension is the ability to expand the original symmetry test to additional groups of keys .assume we have a single recipient bob who communicates with two separate sets of recipients ; we will assume bob is not allied with the sender alice .suppose bob receives keys originally , and performs a test on them for complete symmetry .then he keeps one key for verifying a signature , and uses some ( but not all ) of the test keys to perform a distributed symmetry test with a group of recipients .the extra test keys certainly do not affect the security of the distributed symmetry test .suppose bob uses the remaining test keys to perform a distributed symmetry test with a second group of recipients , possibly at a much later time .then if charlie is in and diane is in , we know that ( with high probability ) either the keys fail a test , or that and that for some , in which case it is also true that . in other words , even though charlie and diane have not interacted directly , the gap between and is still bounded , but by twice the margin between two recipients in the same group .while we have described a procedure for signing single - bit messages , multi - bit messages can be sent by repeating the process , using pairs of public keys for each message bit . however, a much more efficient procedure is to first encode the message in a classical error - correcting code with distance , and to use a single pair of public keys for each encoded bit .the single - bit protocol can be viewed as a special case of this using a repetition code .valid messages are codewords of the error - correcting code ; to change from one valid message to another requires altering bits .therefore , the above security proofs hold with only two changes : , the number of keys successfully guessed by eve , is now , where is the length of the full encoded message .in addition , if alice attempts to cheat , she can produce a difference proportional to , not , using type-1 terms .we should thus have scale linearly with when the latter is very large .the digital signature scheme provided here has many potential applications .it combines unconditional security with the flexibility of a public key system .an exchange of digital signature public keys is sufficient to provide authentication information for a quantum key distribution session .quantum digital signatures could be used to sign contracts or other legal documents .in addition , digital signatures are useful components of other more complex cryptographic procedures .one particularly interesting application is to create a kind of quantum public key cryptography .if bob has alice s public key , but alice has nothing from bob , then bob can initiate a quantum key distribution session with alice .bob will be sure that he is really talking to alice , even though alice has no way to be sure that bob is who he says he is .therefore , the key generated this way can be safely used to send messages from bob to alice , but not vice - versa .  however , quantum public keys have a number of disadvantages .it is not possible to sign a general unknown quantum state , even with computational security  ; this is unfortunate , since a common classical method for distributing public keys is to have a trusted `` certificate authority '' ( whose public key is already well - known ) sign them for later transmissions .however , perhaps this can be circumvented : the quantum public keys of our protocol are _ known _ quantum states , so perhaps there is some way to securely sign them for distribution at a later time .note that in a purely classical scheme , the public key can be given out indiscriminately .this can not be true of a quantum scheme : when there are very many copies of a public key , sufficiently careful measurements can completely determine its state , and therefore one may as well treat the public key as classical . in that case , security must be dependent on computational or similar assumptions .thus , any quantum digital signature scheme will necessarily require limited circulation of the public key .this is primarily a question of efficiency , since sufficiently large allows many keys to be issued .so how do the required resources scale with the number of recipients ?there are three resources that one might consider : the size of each public key , the size of a single signed message , and size of the private key . in our case ,a single public key need only scale as the logarithm of the number of receivers .this is good , since the public keys are made of qubits , which may be the most expensive component .however , the length of the private key must be at least equal to , the total number of public keys in circulation , which must be linear or quadratic in the number of recipients .it remains possible that an improved proof or protocol could reduce the required substantially , although we are not optimistic on this point .however , this is not too serious , since the classical memory used to store the private key is already quite cheap .a more serious flaw in our current protocol is the requirement that the length of a signed message also scale linearly with .there does not seem to be a fundamental requirement for this , luckily , so it seems plausible that an improved protocol is possible for which the length of messages scales at most logarithmically with .scaling of resources with other variables can probably be improved as well .earlier , we showed how to reduce the amount of key required to send long messages ; perhaps further improvement is possible .classical private - key authentication allows the expenditure of only a logarithmic amount of key in the length of the message ; it is reasonable to speculate that similar efficiency could be achieved here .efficiently signing known quantum states would allow this , for instance , since then we could sign a quantum fingerprint  of the message .since our scheme requires a new set of keys for each message , the total amount of key consumed also scales linearly with the number of messages sent .it would be preferable to reduce this to the levels allowed by classical protocols : the log of the number of messages , or even constant ( although it seems unlikely that is possible ) .either would imply substantial reuse of public keys .designing such a protocol will be a difficult task , however , since usual classical techniques for reusing signature keys can not be applied to quantum public keys .  in summary , we have demonstrated the existence of an unconditionally secure public key digital signature scheme , something which is not possible classically .many potential improvements remain , however .the possibilities and ultimate limitations of quantum public key cryptography remain largely unexplored .* acknowledgements : * we thank c. bennett , c. crepeau , d. divincenzo , d. leung , h. k. lo , d. mayers , m. mosca , j. smolin , b. terhal , and w. van dam for helpful comments .dg was supported by a clay long - term cmi prize fellowship .ilc was supported in part by the things that think consortium and the quarc project under a darpa quantum information science and technology grant .  10  quantum bit escrow . in _ proceedings of the 32nd annual acm symposium on theory of computing _( new york , 2000 ) , acm press , pp . 705714 .quant - ph/0004017 .  quantum dense coding and a lower bound for 1-way quantum finite automata . in _ proceedings of the 31st annual acm symposium on theory of computing _( new york , 1999 ) , acm press , pp . 376383 .quant - ph/9804043 .authentication of quantum messages .( 2001 ) .  quantum public key distribution reinvented .( 1987 ) , 5153 .  quantum cryptography . ,4 ( oct . 1992 ) , 50 .  quantum information and computation . ( 2000 ) , 24755 .quantum information theory ., 6 ( 1998 ) , 272442 .  the dawn of a new era for quantum cryptography : the experimental prototype is working ! ( 1989 ) , 7882.  cryptology column 25 years of quantum cryptography .( 1996 ) , 1324 .quantum fingerprinting .( 2001 ) , 167902 .unconditionally secure digital signatures .( 1991 ) , 206214 .efficient cryptographic protocols based on noisy channels . in _ advances in cryptology : proceedings of eurocrypt 97 _ ( berlin , 1997 ) , springer - verlag , pp . 306317 .  weakening security assumptions and oblivious transfer . in _lecture notes in computer science : advances in cryptology : proceedings of crypto 88 _ ( berlin , 1990 ) , s. goldwasser , ed .403 , springer - verlag , pp .27 .  from quantum cheating to quantum security . , 11 ( nov .2000 ) , 22 .problems in the mathematical theory of quantum communication channels .( 1977 ) , 273278 .  constructing digital signatures from a one - way function .( october 1979 ) .  .world scientific , 1998 .is quantum bit commitment really possible ?, 17 ( 1997 ) , 34103413 .unconditionally secure quantum bit commitment is impossible .( 1997 ) , 3414 .  .cambridge university press , cambridge , uk , 2000 .sorting out signature schemes ., 2 ( 1995 ) , 147172 .  , vol . 1elsevier , amsterdam , the netherlands , 1990 , pp . 717755 .  a method of obtaining digital signatures and public - key cryptosystems .( 1978 ) , 120126 .  one - way functions are necessary and sufficient for secure signatures .( 1990 ) , 387394 .polynomial - time algorithms for prime factorization and discrete logarithms on a quantum computer . , 5 ( 1997 ) , 14841509 .for any , there exists a such that , for large , the following holds : given a state of qubits which is a sum of tensor products of and with at most  factors in any term , then measurement in the , basis will with high probability produce a result with weight between and .   *proof * : this is easy to show .there can be at most about terms in the sum .note that , where is the hamming entropy .thus , the probability to get a particular string in the , basis is at most .since there are about strings outside the allowed range , the total probability of being outside the allowed range is at most about m}.\ ] ] this is small for large whenever since for any , and as , the lemma follows .

Abstract: we present a quantum digital signature scheme whose security is based on fundamental principles of quantum physics . it allows a sender ( alice ) to sign a message in such a way that the signature can be validated by a number of different people , and all will agree either that the message came from alice or that it has been tampered with . to accomplish this task , each recipient of the message must have a copy of alice s `` public key , '' which is a set of quantum states whose exact identity is known only to alice . quantum public keys are more difficult to deal with than classical public keys : for instance , only a limited number of copies can be in circulation , or the scheme becomes insecure . however , in exchange for this price , we achieve unconditionally secure digital signatures . sending an -bit message uses up quantum bits for each recipient of the public key . we briefly discuss how to securely distribute quantum public keys , and show the signature scheme is absolutely secure using one method of key distribution . the protocol provides a model for importing the ideas of classical public key cryptography into the quantum world .


the scale invariant feature transform ( sift ) has been the topic of many computer vision projects due to its ability to detect feature points which are invariant to image rotation , translation , and scaling .this is obviously evident from figure 1 which presents the journal and conference papers related to the sift algorithm which have been published in elsevier from 2009 to 2014 .while several scientists have entered the development of sift based algorithm , , , , providing a service - based sift algorithm over the internet protocols has not yet been developed .having a software as a service ( saas ) based , sift algorithm can be fulfilled the following objectives :    * to facilitate rapid application development ( rad ) and fast prototyping for computer vision students and scientists by a tiny service available on the internet . * to provide application - to - application interaction for a highly demanded computer vision algorithm . * to make the sift algorithm available through both human - oriented and application - oriented interfaces .  in this contribution, we novel design and develop a saas based architecture to implement a platform independent and reusable software component for the sift algorithm .the service makes a new way to produce and exchange of sift information over the standard internet protocols . based on its flexibility and availability, it brings an opportunity for computer vision researchers who want to apply the sift algorithm on their own images without the need of any programming and installing any software applications .an internet connection is all we need !  this work initiates a study of saas based architecture for an essential computer vision technique .we expect the work can bridge the gap between computer vision applications and world wide web services , stimulating more interests from the computer vision community to the saas architecture and the internet of things ( iot ) areas .our contribution could be considered as a preliminary step towards the * computer vision as a service*.  the rest of the paper is arranged as follows .we first give a brief explanation of the system and service design in section 2 .the experimental results along with an application of the sift algorithm and the impact of the service are shown in section 3 .conclusion is presented in section 4 .sift algorithm has basically four main stages , namely : 1 ) scale - space construction using difference - of - gaussian ( dog ) , 2 ) stable features localization , 3 ) gradient orientation computation and magnitude assignment , and 4 ) feature descriptors extraction .the first stage is to construct a dog image pyramid to determine the potential feature points in an image . as it is shown in equation ( 1 ) , to create gaussian filtered image , we should convolve the input image with a gaussian kernel ( equation ( 2 ) ) , where is the scale of the gaussian kernel , and is 2d convolution operation .various gaussian blurred images in different scales are produced and dogs are computed from neighbors in the scale space . then candidate feature points would be detected by discovering exterma in the dog images which are locally minima or maxima in scale and space .    the next step is to compute the image gradient magnitude and principal orientation to extract associate sift descriptor for the a detected feature point .gradient magnitude as and principal orientation as are calculated using the following two equations :      finally , for each feature point , a set of orientation histograms will be created on pixel neighborhoods with eight bins each .the size of the descriptor vector can be varied .the high level service architecture of the siftservice.com is shown in figure 2.    the service compromises two disparate machines : a service consumer ( client ) and the service provider ( application server ) .main components of each section are presented within the subsystem blocks ( figure 2 ) .wsdl stands for web service description language , and it is an xml - based language for describing sift web service and how to access it over the internet protocols .discovery services permit the discovery of the sift service .bpelws stands for business process execution language for web service , and it aims to support the major behaviors of both executable and abstract implementation of the service .soap stands for simple object access protocol , .soap is an xml - based internet protocol which supports exchanging structured information between computers and applications .uddi which stands for universal description , discovery and integration is a specification for a distributed registry of the sift service , , , .an snapshot of siftservice.com is shown in figure 3 .in order to examine the general performance of the system , two experiments were carried out on real digital images .section 3.1 shows the experimental setup . in section 3.2, we compare the feature points detection accuracy of the system with the original executable sift software implemented by david lowe . in section 3.3 ,we analyze and compare matching accuracy between sift keypoints in two images using the sift as a service and the original executable sift software .we then introduce an application of the sift algorithm in section 3.4 .the impact of the siftservice.com is presented in section 3.5 .all modules , classes , components , and communication packages of siftservice.com were implemented by java se 7 . in the server side ( application server ), we used a 64-bit linux centos operating system on a virtual server with 2v cores processor , 100 mbits / s bandwidth , and 2 gb of ram . in the client side ( client ) , we employed 64-bit ms windows 8 operating system with 3.00 ghz intel dual core cpu , 2 mb cache , and 4 gb of ram .     in this sectionwe bring up a validation summary on the accuracy and reliability of the proposed system for feature points detection .figure 4 shows the accuracy in feature points detection .the service produces feature points which are very similar to the original one implemented by lowe . the error threshold of the sift as a service is less than 1% in feature points detection .figure 5 shows the points matching accuracy for images `` hall01 '' and `` hall02 '' form the `` hall '' images set .we can see that the error threshold for point matching is less than 2% comparing with the david lowe s implementation .as we mentioned in the abstract , the sift algorithm has made in big advance in many areas of computer vision application .an example is 3d surface reconstruction , and in particular 3d microscopy vision .the general pipeline of 3d microscopy vision is presented in figure 6 .the sift algorithm is used in step 2 of the pipeline . for further details and information on the proposed method ,please refer to .we just recall that in that work , we employed surf instead of sift , but other parts would be same .siftservice.com has been introduced and it is going to be popular for computer vision research community .figure 7 present the impact of siftservice.com from december 2014 to march 2015 .the sift algorithm has been widely used in many computer vision applications . having sift as a service would provide application - to - application interaction and makes sift easier for computer vision researchers and students to rapid application development ( rad ) , communicating each other applications by a tiny service available in the internet . in this project , we have designed and implemented the entire components of the system and addressed some experimental results which show that the service offers promising results . the present work is expected to stimulate more interest and draw attentions from the computer vision community to the fast - growing software as a service and the internet of things ( iot ) area . our contribution could be considered as a preliminary step towards the * computer vision as a service*. the service is freely available at * http://siftservice.com * for any academic , educational and research purposes .leyva , p. , domenech - asensi , g. , garrigos , j. , illade - quinteiro , j. : simplification and hardware implementation of the feature descriptor vector calculation in the sift algorithm .ieee international conference on field programmable logic and applications ( fpl24th ) .( 2014 )     pahlavan tafti , a. , kirkpatrick , a. b. , owen , h. a. , yu , z. : 3d microscopy vision using multiple view geometry and differential evolutionary approaches .the 10th international symposium on visual computing ( isvc ) , lncs 8888 .141152 ( 2014 )    hatch , r. : saas architecture , adoption and monetization of saas projects using best practice service strategy , service design , service transition , service operation and continual service improvement processes. emereo pty ltd .

Abstract: image features detection and description is a longstanding topic in computer vision and pattern recognition areas . the scale invariant feature transform ( sift ) is probably the most popular and widely demanded feature descriptor which facilitates a variety of computer vision applications such as image registration , object tracking , image forgery detection , and 3d surface reconstruction . this work introduces a software as a service ( saas ) based implementation of the sift algorithm which is freely available at * http://siftservice.com * for any academic , educational and research purposes . the service provides application - to - application interaction and aims rapid application development ( rad ) and also fast prototyping for computer vision students and researchers all around the world . an internet connection is all they need !


one approach for probing light curves which has received attention  is to express them as a series of displaced pulses , each with a parametric form .there is an appeal to this approach because fitting routines are well - understood and interpretations of rise time , decay time , full width at half max , etc , are possible . on the other hand, one must make certain assumptions when using the pulse - fitting procedure such as the choice of the functional form to use for an individual pulse and the number of parameters to be included in the fitting function .moreover , light with high variability at low power may show variations which are not statistically significant .a complementary approach using a wavelet - based analysis of a set of both long and short grb light curves is discussed by  in which a time scale , , is identified that marks the transition from white noise to a power law in the power density spectrum ( a behavior ) .it is argued that over time scales smaller than the light curves appear stochastic and signal power is distributed uniformly . at time scales larger than , identifiable structures ( such as pulses ) with signal power are no longer distributed uniformly over the periods of light variation . for this reason referred to as the _ minimum variability time scale_.  the analysis presented in  is a non - parametric approach to probing light curves for time scales .it makes no assumptions about the nature of the structures in a given light curve that give rise to the character .the technique , however , offers no firm connection between and the constituent structures although it seems reasonable to associate with the scale of the smallest emitting structures present .results from an application of a log - normal pulse - fitting procedure to grb light curves have been published by  . in this paperwe make a meta - analysis of the timing results presented by  compared with the techniques of  for a set of 34 grbs used in both studies .we begin by considering the relation between and the pulse parameters given in table 3 of  .the parameters with temporal units in table 3 are : _ time - since - trigger _ , _ rise time _ , _ decay time _ , and _ fwhm_. in all , 34 grbs comprising 379 pulses are considered here .we note that rise time , decay time , and fwhm as presented in table 3 of  are tightly correlated and for the argument that follows are interchangeable without affecting the conclusions .however , we use rise time to make our argument because , as  noted , rise times are observed to be shorter than decay time and fwhm ( see table 3 in  ) .we considered only those light curves from nai detectors and summed over the energy acceptance as in table 3 of  and in  .  in fig .[ fig : mts_rise_errsnocuts ] we plot the rise time for all 379 pulses ( 34 grbs ) along the vertical axis and along the horizontal .note that for each grb for which one is computed , there is a possibility for multiple pulses and therefore multiple rise times , hence the vertical columns of rise times for a single value of .for a given column of pulse times the shortest pulse rise times are at the bottom and one finds larger rise times by moving up the column .an equality line is also shown which is the locus where equals rise time .arguing as we do that represents the minimum variability time scale the space in the -rise time plane below the equality line should be interpreted as a structureless white noise region .if some method were capable of discerning light curve structure in the region we define as white noise , then our assertion of having found a minimum variability time scale will have been disproven . indeed , in fig .[ fig : mts_rise_errsnocuts ] there are 27 pulses with rise times below the equality line .the uncertainties accompanying these 27 rise times are small , making their intrusion into the white noise region significant .  [cols="^,^,^,^,^,^,^,^,^,^,^",options="header " , ]   [ table : goodshortrisetimes ]  however , a closer inspection of table 3 of  reveals that there are 20 light pulses in fig .[ fig : mts_rise_errsnocuts ] with rise times that are _ smaller _ than the smallest bin widths , in some cases smaller by factors of ten or a hundred .moreover , of those 20 pulses there are 16 pulses in fig .[ fig : mts_rise_errsnocuts ] with full widths at half max that are _ smaller _ than the smallest bin widths and indeed those 16 all fall below the equality line .while it seems that inclusion of these pulses in table 3 is important for the sake of completeness , we question the physical reality of these pulses .note that in  all light curves are binned at 200 microseconds .[ fig : mts_rise_errs ] shows the effect of removing the 20 non - physical pulses .= rise time .we identify the area below the line with white noise .the data are expected to press up against the line from above but not to cross it ., width=317 ]    note that in fig .[ fig : mts_rise_errs ] the white noise region has been vacated by all but seven points and none of the pulse rise times above the equality line have been disturbed by the bin width cut . for the seven points that remain beneath the equality line ,we show in table [ table : goodshortrisetimes ] that six are within one sigma of the equality line .we make one other point regarding the pulse rise times in fig .[ fig : mts_rise_errsnocuts ] and fig .[ fig : mts_rise_errs ] , in particular regarding the size of the uncertainties . of the 379 pulse rise times reported by  andused for this meta - analysis , 301 have uncertainties smaller than the binning of the light curve , in some cases hundreds or thousands of times smaller .we argue that a conservative estimate of the uncertainties for the pulse rise times should be no smaller than a bin width .thus , we add in quadrature a bin width ( as reported in table 3 of  ) to the rise time uncertainties ( also reported in table 3 of  ) and plot the result in fig .[ fig : mts_rise_combquaderrs ] .  in fig .[ fig : mts_rise_combquaderrsmin ] we plot only the smallest rise times for each grb against .we argue that by rejecting pulse rise times smaller than light curve bin widths and by folding rise time uncertainties with a bin width we get strong evidence that and have tracked the same physical observables over approximately three orders of magnitude using independent methods .  .we have folded a single bin width into the rise time uncertainties.,width=317 ]   but with only smallest rise times included .note that the equality line between and rise time marks a boundary between scaling processes and white noise and gives substance to the interpretation of the minimum variability time scale.,width=317 ]for a large sample of short and long fermi gbm bursts , used a technique based on wavelets to determine the minimum variability time scale , .the authors associate this time scale with a transition from red - noise processes to parts of the power spectrum dominated by white noise or random noise components .accordingly , the authors note that this time scale is the shortest resolvable variability time for physical processes intrinsic to the grb .in addition , histograms of the values of for long and short grbs were shown to exhibit a clear temporal offset in the mean values for long and short grbs .  in a separate analysis , using a particular functional form for pulse shapes , have extracted an extensive set of key pulse parameters such as rise times , decay times , widths ( fwhm ) , and times since trigger for a host of bright grbs detected by fermi / gbm . using the fwhm values, these authors also reported a significant temporal offset between the mean values for long and short grbs .although neither group offers a concrete explanation for the temporal difference between the distributions of long and short grbs , it is noteworthy that they arrive at a result which is quantitatively in good agreement with one another , especially having used independent approaches . both sets of analyses also suggest scaling trends between characteristic timescales . in the case of minimum variability timescales the trend is between and the duration of the burst , typically denoted by . for the pulse - shape analysis , the trend is more readily evident and is demonstrated through a number of positive correlations involving key parameters such as rise times , decay times and fwhm times .it is relatively straightforward to interpret the scaling trends in terms of the internal shock model in which the basic units of emission are assumed to be pulses that are produced via the collision of relativistic shells emitted by the central engine . in the case of the pulse - fitting methodthis is essentially the default assumption .indeed , in their study of the brightest batse bursts with sec were the first to demonstrate this explicitly by identifying and fitting distinct pulses and showing a strong positive correlation between the number of pulses and the duration of the burst .more recent studies ,  have provided further evidence for the pulse paradigm view of the prompt emission in grbs .the wavelet analysis does not , however , rely on identifying distinct pulses but instead uses the multiresolution capacity of the wavelet technique to resolve the smallest temporal scale present in the prompt emission .nonetheless , as  have demonstrated , if the smallest temporal scale is due to pulse emissions , then we can still get a measure of the upper bound on the number of pulses in a given burst through the ratio . in the simple model in which a pulse is produced every time two shells collide , the ratio , should show a correlation with the duration of the burst .indeed , this correlation was reported by .the similar trends of scaling demonstrated by these two methods , not only suggest the robustness of both methods , but also point , perhaps more importantly , to an underlying interconnection between key parameters extracted by the two techniques .in other words , the minimum variability time scale extracted by the wavelet technique is directly related to key pulse time parameters such as rise times ( as depicted in fig .[ fig : mts_rise_combquaderrsmin ] ) , under suitably controlled pulse - fitting methods .through a meta - analysis of results presented by and by , we have studied the relationship between key parameters that describe the temporal properties of a sample of prompt - emission light curves for long and short - duration grbs detected by the fermi / gbm mission .we compare the minimum variability timescale extracted through a technique based on wavelets , with the pulse - time parameters extracted through a pulse - fitting procedure .our main results are summarized as follows :  \a ) both methods indicate a temporal offset between short and long - duration bursts .the quantitative agreement between the two methods is quite good .\b ) both methods point to scaling trends between characteristic timescales . in the case of the pulse - fitting methodthe scaling appears to involve parameters such as rise times , fwhm , and pulse intervals . for the wavelet technique ,the scaling involves a correlation between the minimum variability time scale and the duration of the bursts .\c ) by demonstrating a strong positive correlation between and the rise time of the shortest fitted pulses , we provide for the first time , a direct link between the shortest resolvable temporal structure in a grb light curve with that of a key pulse profile parameter .\d ) by combining the two techniques , we have shown that one can arrive at a much tighter demarcation of the boundary between the power spectrum domains that separate red noise and white noise processes .the nasa grant nnx11ae36 g provided partial support for this work and is gratefully acknowledged .the authors , in particular gam and ksd , acknowledge very useful discussions with jon hakkila and narayan bhat .

Abstract: we present a direct link between the minimum variability time scales extracted through a wavelet decomposition and the rise times of the shortest pulses extracted via fits of 34 fermi gbm grb light curves comprised of 379 pulses . pulses used in this study were fitted with log - normal functions whereas the wavelet technique used employs a multiresolution analysis that does not rely on identifying distinct pulses . by applying a corrective filter to published data fitted with pulses we demonstrate agreement between these two independent techniques and offer a method for distinguishing signal from noise .   [ firstpage ]  gamma - ray bursts