1. Introduction

Quantum key distribution (QKD) could in principle provide unconditional security, compared with any of existing classical private communication methods. Since proposal of the first QKD protocol: the so-called BB84 protocol presented by the pioneer work of Bennett and Brasard [1], this area has spurred a number of activities both theoretically and experimentally [1–13]. For recent nice reviews, please refer to Refs. [14, 15]. In a real-life situation, however, any system can actually be different in many aspects from the assumed ideal case for validation of unconditional security enjoyed by QKD. Particularly, the security is compromised by using an imperfect single-photon source in a lossy channel, which is vulnerable to the photon-number-splitting attack [2, 3, 6–8, 16]. Fortunately, this issue could be overcome by introducing the idea of decoy state [17] and by turning the idea into systematical and rigorous theory and scheme independently in [18–20], and in [21, 22]. The important ILM-GLLP proof [4, 9] has presented a method to distill the secure final key, provided one can derive an upper bound for the fraction of the multi-photon counts (or equivalently, the lower bound of single-photon counts) among all raw bits. Practically verifying such a bound is strongly non-trivial task. There are significant progresses for faithfully estimating such bounds with the decoy-state method in [17–29] under various practical cases.

So far the decoy-state method has successfully performed in many experiments [30–39]. The most updated record of the QKD distance with decoy state in fiber is 140.6 km in [38] by using superconducting single-photon detector (SSPD). There remain significant challenges for longdistance QKD in hundreds kilometers’ level. For the phase encoding method, both polarization control and high-resolution synchronization are needed to achieve precise phase modulation during narrow arriving time slot of signal and decoy pulses, which imposes big limitation for high speed and long distance system in field environment applications [35, 36, 38]. Also even with wavelength division multiplexing (WDM) technique, the nonlinear crosstalk present a serious problem for remote synchronization at distance beyond 100 km fiber [35]. It requires much loose conditions with low complexity if one utilizes polarization encoding method. With robust polarization transmission in optical fiber through active compensation techniques [31], long distance and high speed QKD would be within reach of current techniques.

We report here an implementation of decoy state QKD system over 200 km with photon polarization transmitted by optical fiber cable. Our result here not only keeps the advantages of polarization encoding, but also we have developed a novel and economic way of synchronization techniques. The synchronization signal is transmitted in the fiber cable and is operating at 40kHz, which removes the use of highly precise and expensive clock. The system we have achieved performs stable operation for long time running. Within 3089 seconds, an average final key rate of 15 Hz is obtained, with the help of super-conducting single photon detectors. The experimentally measured quantum bit error rate (QBER) are 1.96% and 4.04% for signal states and decoy states, respectively. To our knowledge, this is the longest decoy-state QKD system yet demonstrated through a 200 km optical fiber cable. Since the environment is simulating the field situation, and all of the signal and decoy transmitting, acquisition, control electronics and synchronization are developed completely, this brings an important step towards high speed secure communication in long distance level.

2. Polarization encoding, superconducting detector, and synchronization

Synchronization is crucial for a practical QKD system, so that the receiver can know the position of each of detected results. In principle, the synchronization pulses do not have to be run in the same frequency with the weak encoding pulses. In most of real-life setups, the high frequency synchronization is generally necessary. Particularly they are required for measurements if we use phase encoding, or if we use the gated mode for the single photon detectors. With phase encoding, the signal detection at Bob’s side is done actively in a system. Immediately before detecting each individual signals, an active phase shift is taken to the signal pulse. In such a system, each individual signal pulse must be accompanied by a synchronization pulse as a clock so that the phase shift can be done at the right time-slot. The single-photon detectors are normally run in a frequency of a few MHz and have to be run in a gated mode. Otherwise there will be many dark counts and no final key can be distilled out in an extreme case.

In our situation, we employ polarization encoding. The allowed repetition rate for the superconducting single-photon detectors is so high that it can be run in an always-on mode rather than the gated mode. Moreover unlike the case of phase encoding, photon polarization detection can be done passively for polarization encoding. That is to say, the measurement in random basis is done passively by using beam splitter for our case. There is no active operation on each signal. Therefore, in principle, the synchronization pulses are not necessary if one has a very precise local clock. A very precise local clock is however technically difficult and expensive. We have designed to implement synchronization block by block, given a simple local clock at Bob’s side. Namely, one needs only one synchronization pulse for a block of (many) signals.

3. Our set-up

Our set-up is shown schematically in Fig. 1. Two sides, Alice and Bob, are linked by 200 km optical fiber cable. Both signal and decoy pulses are sent to Bob through the optical fiber cable. They are detected at Bob’s side by superconducting single-photon detectors.

3.1. Source

We use the weak coherent light as our source. Following with decoy-state method, we have set the intensity of each pulses be among 3 different values: 0, 0.2, 0.6, which are called vacuum pulse, decoy-pulse, and signal pulse, respectively, with a probabilities of 1:1:2. The experiment data accumulates for 3089 seconds.

As shown in Fig. 1, the coherent light pulses in our experiment are produced by 8 diodes which are controlled by a 4-bit pseudo-random number. The first two bits of a 4-bit number determines to produce a vacuum pulse, a decoy pulse, or a signal pulse. In particular, if they are 00, none of the diode sends out any pulse, i.e., a vacuum pulse is produced; if they are 01, one of the 4 decoy diodes in the figure produces a decoy pulse; if they are 10 or 11, one of the 4 signal diodes in the figure produces a signal pulse. The last 2 bits decides which of the 4 diodes is chosen to produce the pulse (If the first two bits are not 00). The light intensities are controlled by an attenuator after each diodes, 0.2 for the decoy pulse and 0.6 for the signal pulse. Each diodes will produce only one of the four BB84 states, i.e., the horizontal, vertical, +45° and -45° polarization states. Polarization maintaining beam splitters (PMBS) are used to guide pulses from the decoy diode and the signal diode in the same polarization block into one PMBS. Two polarization maintaining polarization beam splitters are used to guide pulses from all diodes to one optical fiber. The fidelity of our polarization states is larger than 99.9%. The pulses produced by the laser diodes first passes through a polarization maintaining beam-splitter (BS), then a polarization beam splitter (PBS) and then combined by a single mode BS.

Because each signal is generated by one laser diode, we have maintained the spectrum of the 8 diodes to be in a narrow overlapped range by precise control of temperature for diodes. The intensity, pulse shape and spectrum have no direct correlation with polarization degree of freedom from the first sight. It would be valuable to verify if such insights are valid in future experiments. Presently the affects for some of these parameters are not within the reach of current technology, because even the jitters of the detectors would make the pulse shape measurements imprecise. A 0.2 nm band-pass filter is further used to eliminate possible distinguishable information for the pulses from different diodes, before these pulses are sent to Bob through the optical fiber cable of 200 km inside the lab.

3.2. Long distance fiber transmission

To keep stability and robustness of polarization states during 200 km fiber transmission, we have developed an active compensation techniques to remove possible affects caused by environment fluctuations or experimental imperfections. Whenever the QBER is more than 2% for signal states, the system will perform feedback control of horizontal and vertical polarization in Bob’s side when Alice sends states of horizontal polarization periodically. Then the system performs feedback control of +45° and -45° polarization in Bob’s side when Alice sends +45° polarized states periodically. As for affect from polarization mode dispersion, the maximal temporal delay between the fast and slow axis is less than 4 ps after 200 km transmission according to the manufacturer’s specifications of the fiber we used. This is much smaller than the coherence time for our source of about 1 ns, and thus polarization mode dispersion is almost neglectable in our case. In addition, the use of 0.2 nm filter after the source enables to achieve an extinction rate to be more than 100:1 for orthogonal polarizations measurements in Bob’s side, which dramatically improve the quality of our system.

3.3. Detection

The circuit at Bob’s side is a standard design of BB84 detection. Four superconducting single-photon detectors are used to detect signals. These detectors are made by Scontel company in Russia, with the maximal counting rate of more than 70 MHz. We have set detector’s working temperature lower than 2.4 K. The dark counts rate of each detector is smaller than 1 Hz. The detection efficiency is larger than 4% for 3 of them, with the last one larger than 3%. The detectors we used are in free-running modes, and thus their efficiencies do not depend on time shift and keeps almost the same for the whole time. Even consider possible detector efficiency mismatch attack [40, 41], our system locates in secure range for experimental parameters: QBER 1.96% and mismatch parameter η ≐ 3%/4% = 0.75 for detection efficiency, as shown in [40].

3.4. Synchronization

The 40 kHz synchronization pulses are originated from the 320 MHz clock which drives a laser diode to produce synchronization pulses. In order to detect the synchronization pulses at Bob’s side which is linked to Alice by 200 km optical fiber cable, a semiconductor optical amplifier is inserted at the point of 100 km, amplifying the intensity of optical pulses by 100 before transmission over the second half of the optical fiber. At Bob’s side, a photon-electrical detector is used to recover the synchronization pulses. Both the synchronization pulses and the electrical signal from the superconductor detector are sent to a time-to-digit convertor (TDC) which works as an “economic local clock”. Also we have set detection window be 1.5 ns, which reduces dark counts almost by one half, and therefore improves the key generation rate.

 

Fig. 1. Schematic diagram of our set-up. BS: polarization maintaining beam splitter, PBS: polarization maintaining polarization beam splitter, SBS: single mode beam splitter, SPBS: single mode polarization beam splitter, FF: 0.2 nm band-pass filter, Att: attenuator, SOA: Semiconductor Optical Amplifier, PD: photo detector, TDC: Time to Digital Converter. PC: polarization controller.

Download Full Size | PDF

4. Calculation of the final key

The secure final keys can be distilled with an imperfect source given the separate theoretical results from Ref. [4, 9]. We regard the upper bound of the fraction of tagged bits as those raw bits generated by multi-photon pulses from Alice, or equivalently, the lower bound of the fraction of untagged bits as those raw bits generated by single-photon pulses from Alice. With Wang’s 3-intensity decoy-state protocol [21], Alice can randomly use 3 different intensities (average photon numbers) of each pulses (0, μ, μ′) as the vacuum pulses, decoy pulses and signal pulses. Alice produces the states by different intensities:

Here c = 1 -e ^−μ - μe ^−μ, ${\rho }_c=\frac{e^{-\mu }}{c}{\sum }_{n=2}^{\infty }\frac{{\mu }^n}{n!}\mid n〉〈n\mid$, ρ_d is a density operator, and d > 0 (here we use the same notation as in Ref. [21]. In the protocol, Bob records all the states which he observed his detector click. After Alice sent out all the pulses, Bob announced his record. Then Alice knows the number of the counts C ₀, C_μ, C_μ′ which came from different intensities 0, μ, μ′.N ₀,N _μ, N _μ′ are the pulse numbers of intensity 0, μ, μ′ which Alice sent out. The counting rates (the counting probability of Bob’s detector whenever Alice sends out a state) of pulses of each intensities can be calculated as S ₀ = C ₀/N ₀, S_μ = C_μ/N_μ and S _μ′ = C _μ′;/N _′′, respectively. When all of these data are collected for different photon number altogether, Alice and Bob can derive the lower bound for gain of single photon, upper bound of QBER for single photon by using decoy state methods [17–22]. We denote here specifically s ₀ (s′₀), s ₁ (s′₁) and s_c (s′_c) for the counting rates of those vacuum pulses, single-photon pulses, and multi-photon pulses from decoy states (signal states). Asymptotically, the values of primed symbols here should be equal to those values of unprimed symbols. However, in an experiment the number of samples is finite; therefore they could be a bit different. The bound values of s ₁, s′₁ can be determined by the following joint constraints equations [21]:

To consider the worst-case results and statistical fluctuations, we set ${s\text{'}}_1=\left(1-\frac{10e^{\mu /2}}{\sqrt{\mu s_1{N}_{\mu }}}\right)s_1$, ${s\text{'}}_c=\left(1-\frac{10}{\sqrt{s_c{N}_{\mu }}}\right)s_c$, s′₀ = (1 -r ₀)S ₀,s ₀ = (1 + r ₀)S ₀, and $r_0=\frac{10}{\sqrt{S_0{N}_0}}$. Following this procedure one can calculate physical and secure bounds of s ₁, s′₁, s′_c numerically.

In the experiment, Alice totally transmits about N pulses to Bob. After the transmission, Bob announces the pulse sequence numbers and basis information of received states. Then Alice broadcasts to Bob the actual state class information and basis information of the corresponding pulses. Alice and Bob can calculate the experimentally observed quantum bit error rate (QBER) values E_μ, E _μ′ of decoy states and signal states according to a small fraction (10% in our case) for both the decoy bits and the signal bits, respectively. Since we exploit E_μ and E _μ′ from finite test bits, the statistical fluctuation should be considered to evaluate the error rate of the remaining bit [28]:

L _μ′(μ) is the fraction of the count bits in signal states (decoy state) which are used for quantum bit error rate tests. Then we can numerically calculate a tight lower bound of the counting rate of single-photon s′₁ using Eq. (2). The next step is to estimate the fraction of single-photon ∆₁ and the QBER upper bound of single-photon E ₁. We use

to conservatively calculate ∆₁ of signal states and decoy states, respectively [21]. And E ₁ of signal states and decoy states can be estimated by the following formula:

Here we consider the statistical fluctuations of the vacuum states to obtain the worst-case results.

Lastly, we can calculate the final key rates of signal states using the following formula [9, 19–21]:

Here H(x) = −xlog₂(x) − (1 − x)log₂(1 − x).

We consider the final key rate of the decoy states independently. During the above calculation, we have used the worst case results in every step to ensure the security. Obviously, there are more economic methods for the calculation of final key rate of the decoy states. Here we have not considered the consumption of raw keys for the QBER test. Now we reconsider the key rate calculation of decoy states above. We assumed the worst case of s ₀ = (1 + r ₀)S ₀ and s ₀ = (1 - r ₀)S ₀ for calculating ∆₁ ^μ and E ₁ ^μ, respectively. Although we do not exactly know the true value of s ₀, there must be one fixed value for both calculations. Therefore we can choose every possible value in the range of (1 - r ₀)S ₀ ≤ s ₀ ≤ (1 + r ₀)S ₀ and use it to calculate ∆₁ ^μ , E ₁ ^μ and the final key rate, and then pick out the smallest value as the lower bound of decoy states key rate. As shown in Fig. 3 in [31] , we set s ₀ = (1 - r ₀)S ₀ to calculate the lower bound of decoy states key rate. This economic calculation method can obtain a more tightened value of the lower bound, which is larger than the result using the simple calculation method above with the two-step worst-case assumption for s ₀ values. We can calculate the final key rates of decoy states using the following formula:

Half of the experimental data should be discarded due to the measurement basis mismatch in the BB84 protocol. Among the remaining half, the ratio L _μ′(μ) are consumed for the quantum bit error rate test. Then we can calculate the final rate which exploit from signal states and decoy states:

In the experiment, the pulse-number ratio of the 3 intensities 0, μ and μ′ is 1:1:2 and the intensities of signal states and decoy states are fixed at μ′ = 0.6 and μ = 0.2, respectively. The numbers of the counts from 0, μ and μ′ are 3263, 77157 and 449467. We calculate the experimentally observed QBER values E _μ, E _μ′ of decoy states and signal states, which are 4.0426%, 1.964%. The experiment lasts for T = 3089 seconds. We use L _μ′(μ) = 10% for QBER test. The experimental parameters and their corresponding values are listed in Table 1. After calculation, we obtain a final key rate of 12.6 bits/s for the signal states (intensity μ′ = 0.6) and a final key rate of 2.4 bits/s for the decoy states (intensity μ = 0.2).

Table 1. Experimental parameters (P) and their corresponding value of 200 km (Value) decoy-state QKD. E _μ′(μ) is the quantum bit error rate of the signal states (decoy states). The S _μ𢀲(μ,0) is the count rate that comes from signal states (decoy states, vacuum states). s′₁,s ₁ are the single-photon count rate which comes from signal states (decoy states). The E _μ′(μ) ^U denotes QBER upper bound while the E ₁ ^μ′(μ) is QBER upper bound for single-photon.

View Table

5. Concluding remarks

In summary, we have demonstrated a decoy-state QKD system operating at 200 km distance with polarization encoding through optical fiber cable. Secure keys are generated with a rate of 15 Hz. We have established an economic synchronization technique which allows to act at a much lower frequency compared with the working repetition rate of the system. The present experiment are achieved through developing a series of novel controlling optics, electronics and synchronization techniques etc. Superconducting single-photon detector are used for suppressing dark counts and operating in high repetition rate. Our demonstration confirms the feasibility of a high speed and long distance QKD system, in the field environment with state-of-the-art techniques. A complete system with practical authentication, error correction, and privacy amplification algorithms is developing under near-future experimental plan.