1. Introduction

Compared with conventional cryptography based on computational assumptions, quantum cryptography based on the laws of quantum physics can in principle ensure unconditional security and thus exhibit outstanding advantages. As one of the best-known applications of quantum cryptography, the quantum key distribution (QKD) permits secure bipartite communication, usually called Alice and Bob, by distributing a string of secret keys even under existing an evil eavesdropper (Eve) [1, 2]. However, the security of practical QKD systems are undermined by some loopholes resulting from imperfect devices, then Eve can make use of these loopholes to launch specific attacks, such as photon-number-splitting (PNS) attack [3, 4], light blinding attack [5] and time-shift attack [6, 7]. Fortunately, hitherto various protocols have been put forward to counter against those attacks, such as the decoy-state method [8–10], the measurement-device-independent QKD (MDI-QKD) [11, 12] or the device-independent QKD [13–15], etc. Among them, the MDI-QKD seems to be the most promising candidate since it can be immune to all the attacks directed on the measurement devices, and hence attracted extensive attentions [16–31]. Moreover, the idea of measurement-device-independent has been extended to other research fields, such as quantum digital signature (QDS) [32–34], quantum random number generator (QRNG) [35, 36].

Although the MDI-QKD can possess a higher level of security among different practical protocols, it exhibits lower key generation rate compared with BB84 protocol [1], especially when taking the finite-size effect into account. In order to improve the practical performances, people have proposed different approaches and strategies [18–20]. Among them, they implement attenuated laser sources, i.e., the weak coherent sources (WCS). However, as we know, the WCS follows a possonian distribution in photon-number space and contains non-ignorable vacuum and multi-photon components. In contrast, another easily implemented practical source, i.e., the heralded single photon source (HSPS), inherently has lower probability of vacuum pulses and higher ratio of single-photon pulses, since its dark count rate can be reduced to a negligible level by using a triggered signal. Therefore, this source seems more suitable for further improving the performance of quantum key transmission.

Here we propose a practical scheme on using three intensities with biased basis choices and implementing heralded single-photon source (HSPS) to significantly reduce the quantum bit error rate in X basis. Moreover, we adopt the collective constraints and joint parameter estimation techniques. After carrying out full parameter optimization, the simulation results show that our proposed scheme can present distinct improved performances compared with other practical schemes.

This article is organized as follows: In Sec. 2, we introduce the theory of the biased scheme on the three-intensity decoy-state MDI-QKD with HSPS; In Sec. 3, we carry out corresponding numerical simulations; Finally, discussions and conclusions are given out in Sec. 4.

2. The biased three-intensity decoy-state MDI-QKD with HSPS

In our proposed biased three-intensity decoy-state MDI-QKD protocol, Alice and Bob randomly modulates phase-randomized pulses into three different intensities, i.e., µ_ξ, v_ξ and o_ξ, each with a probability of $P_{{\mu }_{\xi }}$, $P_{{\nu }_{\xi }}$ and $P_{0_{\xi }}$ respectively. Here µ_ξ, v_ξ and o_ξ each corresponds to the intensity of the signal state, the decoy states and the vacuum states, individually; $P_{{\mu }_{\xi }}+P_{{\nu }_{\xi }}+P_{0_{\xi }}=1$; ξ ∈ {A, B}; A (B) represents Alice (Bob). For the signal states, Alice and Bob randomly prepares them in X basis or Z basis with a proper conditional probability $p_{X|{\mu }_{\xi }}$ or $p_{Z|{\mu }_{\xi }}$, where $p_{X|{\mu }_{\xi }}+p_{Z|{\mu }_{\xi }}=1$. But for the decoy states, Alice (Bob) only prepares them in X basis. This is the main difference between the present proposal and former conventional three-intensity decoy-state schemes [18, 19, 21]. For vacuum states, Alice (Bob) does not choose any basis. After finish all the signal transmission, Alice and Bob use the triggered pulse pairs of signal states both prepared in Z basis to distill secure keys. Below in our article, for simplicity, the subscripts A and B shall be omitted, provided that the omission does not cause any confusion.

Usually, the HSPS can produced from parametric-down conversion (PDC) processes [37], in which the state of a two-mode field can be written as ${|\mathrm{\Psi }〉}_{\text{TS}}={\displaystyle \sum _{n=0}^{\infty }\sqrt{{\mathrm{P}}_n}}{|n〉}_{\mathrm{T}}{|n〉}_{\mathrm{S}}$. Here |n〉 represents an n-photon state; P_n corresponds to the photon-number distribution, which can exhibit different distributions by adjusting the experimental conditions, e.g., thermal or Poissonian [38–41]. Mode T (trigger) is locally detected by the transmitter, and mode S (signal) is sent out to the receiver. Below for simplicity, we assume a Poissonian distribution in the PDC process, and hence the photon-number distribution of HSPS can be expressed as

In our protocol, the vacuum, the decoy and the signal states of Alice and Bob can be supposed in the photon-number space as:

In the MDI-QKD, Alice and Bob simultaneously send photon pulses to the untrustworthy third party (UTP). When Alice send state with ${\rho }_{l_A}$ and and Bob with ${\rho }_{r_B}$, respectively, the gains (S_lr) and quantum bit errors (T_lr =: S_lr E_lr) can be expressed as:

In our protocol, only the signal states are prepared in Z basis. It seems that we do not have enough observed data to give precise estimation for the yield of two-single-photon pulses in Z basis $(Y_{11}^Z)$. Fortunately, we noticed that the Theorem 1 has been proven in [20].

Theorem 1: The yield of two-single-photon pulses in all bases (Z and X) can be tightly lower bounded by the quantity in X basis even when taking statistical fluctuations into account.

(See the original Theorem 2 and Appendix in [20] for more details). Therefore, we can obtain:

Moreover, the phase-flip error-rate of the two-single-photon pulses in Z basis can be upper bounded by its bit-flip error rates in X basis given by:

Below we will apply the mathematical technique of “collective constraints” during parameter estimations, when accounting for statistical fluctuations of the vacuum, the decoy and the signal states as listed in Eqs. (5)–(7). We claim that in order to apply the technique, we need to adopt the Theorem 2 which has been demonstrated in [19].

Theorem 2: For a K-variable linear function $f(x_k)={\displaystyle \sum _{k=1}^K{\alpha }_k{x}_k}$, (α_k, x_k ⩾ 0, K ⩽ 4), satisfying the following linear constraints: $\left|{\displaystyle {\sum }_{k\in \kappa }{\beta }_k{x}_k}\right|\le \gamma \sqrt{{\displaystyle {\sum }_{k\in \kappa }{\beta }_k}}$, where κ ⊆ {1, 2, …,K}, γ ⩾ 0, β_k ⩾ 0(k = 1, …, K), the maximum and the minimum values of the function can be expressed as:

Based on the above theorem and implementing the collective constraints technique, we can then reformulate $Y_{11}^{Z,L}$ and $e_{11}^{X,U}$ into:

Here

With the above formulae, we shall estimate the worst-case result of the key rate over all possible values for $\tilde{\mathscr{H}}$ given in (12), and get the final key generation rate as [18,20]:

3. Numerical simulations

In the following, we carry out numerical simulations for our proposed biased decoy-state MDI-QKD scheme. Moveover, we do comparisons between the present scheme and other existing methods, e.g., the conventional three-intensity decoy-state MDI-QKD with WCS [18] hereafter denoted as Xu et al’s method, the conventional three-intensity decoy-state MDI-QKD with HSPS [21] denoted as Zhou et al’s method, and the four-intensity decoy-state MDI-QKD [20] denoted as Wang et al’s method. Moreover, we should clarify that here in the conventional three-intensity decoy-state MDI-QKD [18, 21], the decoy and the signal states are both prepared in X and Z bases. For the conventional three-intensity decoy-state MDI-QKD with HSPS [21], only the triggered events are applied to estimate the parameters.

To make a fair comparison, we implement full parameter optimizations on all the schemes. It includes the intensities of the decoy and the signal states, the probabilities of choosing different intensities and the probabilities of choosing different bases (X or Z) with certain intensities. Furthermore, to simplify the numerical simulations, we consider the symmetrical case, i.e., the UTP is located in the middle between Alice and Bob, and meantime Alice and Bob possess the same local experimental devices. Here we reasonably set d_A = d_B = 10⁻⁶ and η_A = η_B = 75%. Besides, the confidence interval is reasonably set as γ = 5.3 when accounting for statistical fluctuations, which corresponds to the failure probability of ε = 10⁻⁷ [18, 42]. Moreover, in order to show a more general conclusion, we adopt two sets of experimental parameters in our numerical simulations and both can be realized with current technology, by using either InGaAs single-photon detectors [43] in Set I or superconducting nanowire single-photon detectors (SNSPD) in Set II [28], as listed out in Table 1. In addition, we should mention that, the repetition rates of MDI-QKD systems are usually among MHz and hundreds of MHz level limited by current technology. Therefore, here in our simulations we reasonably set the data size ranging from 10⁹ to 10¹⁰ as in [20]. Corresponding simulation results are depicted in Figs. 1–4.

 

Fig. 1 Comparisons for the four different methods. (a) The key generation rates VS. the transmission distance; (b) Optimal intensity of signal states for each curve in (a). Here the data size of the total number of pulses at either Alice’s or Bob’s side is reasonably set as N = 10¹⁰, and other experimental parameters are listed in Set I of Table 1.

Download Full Size | PPT Slide | PDF

 

Fig. 2 The variations of the key generation rates VS. the data size for the four different approaches. Here the transmission distance is fixed as 50 km, and the data size ranges from 10⁹ to 10¹⁰. The experimental parameters used in the simulations are listed in Set I of Table 1. Note that Xu et al’s method cannot generate keys in this case.

Download Full Size | PPT Slide | PDF

 

Fig. 3 Comparisons for the four different methods with the experimental parameters listed in Set II of Table 1. (a) The key generation rates VS. the transmission distance; (b) Optimal intensity of signal states for each curve in (a). The data size is reasonably set as N = 10⁹.

Download Full Size | PPT Slide | PDF

 

Fig. 4 Comparison of the quantum bit error rate of two single-photon pulses in the X basis $(e_{11}^X)$. (a) are the quantities of $e_{11}^X$ for calculating Fig. 1 while (b) for calculating Fig. 3.

Download Full Size | PPT Slide | PDF

Table 1. The experimental parameters used in our numerical simulations. α represents the channel loss coefficient of standard communication fiber; e₀ denotes the error probability of vacuum pulses; e_d refers to the misalignment probability of the whole optical system; η_d and Y₀ each corresponds to the detection efficiency and the dark count rate of detectors at the UTP’s side; f is the key reconciliation efficiency.

View Table | View all tables in this article

In Fig. 1, we compare our proposed three-intensity decoy-state MDI-QKD with other three existing methods, i.e., Xu et al’s method, Zhou et al’s method and Wang et al’s method, with the experimental parameters listed in Set I of Table 1. The data size is reasonably set as N = 10¹⁰. Fig. 1(a) shows the comparisons of key generation rate, and Fig. 1(b) shows the corresponding comparisons of optimal intensity of signal states. Clearly, in Fig. 1(a), our scheme exhibits dramatic improvements than the other three. For example, it presents more than 20 km longer secure transmission distance than Zhou et al’s method, and shows more than one magnitude of enhancement in the key generation rate than both Zhou et al and Wang et al’s methods. Besides, we can see from Fig. 1(b) that the optimal intensity of signal states in our scheme is higher than others. And note that, compared with the three-intensity method, the optimal intensity of signal states of four-intensity method decreases more quickly.

In order to illustrate the influence of the data size, we fix the transmission distance at 50 km and plot out the variations of the key generation rate with the total number of pulse pairs for the above four approaches in Fig. 2. Here we use the experimental parameters in the Set I of Table 1. We can see from Fig. 2 that, our scheme always presents superior performances than the other three methods with the data size ranging from 10⁹ to 10¹⁰, and the improvement is more distinct when the data size is decreasing. Moreover, there are even no keys that can be generated by Xu et al’s method in this case.

In Fig. 3(a), by adopting the experimental parameters in Set II, we do comparisons on the key generation rate between the above four schemes with the data size of N = 10⁹. Again, we find that our proposed scheme exhibits substantial increased key generation rate and secure transmission distance than the other three. For example, it shows more that 25 km longer transmission distance than Zhou et al’s work, and presents more than 5 times enhancement in the key generation rate than Wang et al’s method at 70 km transmission distance. The optimal intensity of signal states for each curve in Fig. 3(a) are presented in Fig. 3(b) as well.

From Figs. 1–3, we can see that our present work exhibits much better performance than other existing decoy-state MDI-QKD methods. Different from Xu et al’s and Zhou et al’s work, here we apply the biased decoy-state bases, i.e., the decoy pulses are only prepared in X basis and avoid the redundancy of decoy pulses in Z basis. Besides, we adopt the collective constraints and joint parameter estimation techniques. When compared with Wang et al’s work, here the advantages can be attributed to two aspects: First, we only modulate the total number of pulses into three different intensities, while the latter modulates into four intensities. The fact of reducing one intensity can help to reduce the intensity fluctuations and the costs of resources, e.g., the random number costs for choosing different intensity. Second, here the HSPS is implemented instead of WCS, and can thus show more distinct advantages from the light sources, which will be addressed in detail as below.

In order to illustrate it more clearly, we compare the value of $e_{11}^X$ between our present scheme and the other three methods in Fig. 4. Here Figs. 4(a) and 4(b) each corresponds to using Set I parameter and Set II parameter in Table 2 and with the data size of 10¹⁰ and 10⁹, respectively. Obviously, our new scheme exhibits the best performance and shows much lower value of $e_{11}^X$ than Wang et al’s work. This is on one hand due to the neglectable vacuum component in HSPS, and on the other hand it can be attributed to a significantly lower probability for events with two photons presenting on the same side of the beam-splitter in HSPS than in WCS. Consequently, the key generation rate of using HSPS does not drop that drastically as using WCS when reducing the data size.

Table 2. Comparison of simulation parameters at 70km for the different schemes. The value of $e_{11}^X$ comes from Figs. 4(a) and 4(b), and the value of R comes from Fig. 1 and Fig. 3. The − denotes that there are no values at this distance.

View Table | View all tables in this article

4. Conclusion

In conclusion, we have proposed an improved protocol on the biased three-intensity decoy-state MDI-QKD using HSPS. In this protocol, the decoy pulses are only prepared in X basis and the redundancy of decoy pulses in Z basis are reduced, resulting in less finite-data-size effect. Moreover, by implementing the HSPS instead of the WCS, the quantum bit error rate of two single-photon pulses in X basis of our scheme is distinctly reduced due to the neglectable vacuum component and a significantly lower probability for events with two photons presenting on the same side of the beam splitter. Besides, combining with the collective constraints and joint parameters estimation techniques, our protocol can achieve much higher key generation rates than other existing schemes at the same transmission distance under current experimental conditions. In addition, it can be easily realized with current technology, and thus looks more promising in the implementation of the quantum communication.