1. INTRODUCTION

Quantum key distribution (QKD) [1,2] networks can provide unconditional secure communication [3–6] for a large number of users. In recent years, QKD networks [7–10] have been obtaining a definitive popularization in which trusted node networks [11–20] have demonstrated efficiency, and the networks without trusted nodes have made their first appearance [21–27]. In the process, the evolutionary theme of QKD networks is anchored in realistic security, adaptability, and robustness.

The security of QKD has been proved in theory. However, it is threatened in reality due to the imperfections of real devices. For example, the decoy-state method [28–30] enables QKD systems to achieve high performance without using the single-photon source. However, the preparation of decoy states is imperfect due to the intensity fluctuation [31–34] and correlation [35–37]. Moreover, the imperfections of real devices enable QKD hacking based on, for example, the reflection [38] and wavelength dependence [39] of codecs, efficiency mismatch [40–42], abnormal working mode [43–45], and deadtime [46] of single-photon detectors (SPDs). Defending systems against main and residual loopholes with semi-device-independent protocols and specific security patches, respectively, is a practical method to ensure realistic security. In QKD systems, measurement devices suffer from prime attacks [39,43,47,48] because they must be opening to extraneous lights, which gives the eavesdropper a leg up on hacking the measurement side. Fortunately, measurement-device-independent (MDI) QKD protocol [49–51], following the time-reversed entanglement-based QKD protocol, is immune to the attacks on measurement devices.

The post-selection of entanglement states is the basis of MDI-QKD, which is realized by a Bell-state analyzer in the measurement unit (MU). In the protocol, two encoded photons sent by users are projected into Bell states, and the MU broadcasts the measurement result, success, or failure. A declaration of success indicates an entanglement state is projected, and the users can share a key based on their encoding information. The MU only determines if the key can be generated and cannot acquire what the key is. So it is independent of the protocol security and can be mastered by eavesdroppers, and the detector-side loopholes are closed.

MDI-QKD has advantages in the deployment of large-scale networks. Compared with the twin-field (TF) QKD protocol [52–55], it demands less in remote laser locking and phase compensation. Different from entanglement-based QKD networks [22,23], the users are low-cost transmitters in MDI-QKD networks, and it can help build a cost-effective [56] access solution. The star topology is suitable for MDI-QKD networks, and the measurement devices can be placed at the central relay, which is a competitive solution for metropolitan networks [20,21,24]. Recently, TF-QKD networks have been applied to other network topologies [25–27], and as the TF-QKD and MDI-QKD have a similar structure, it is feasible to diversify the network topology of MDI-QKD networks.

However, the large number of users can affect the adaptability and robustness of QKD networks, which are the problems that MDI-QKD networks need to deal with. Specifically, adaptability focuses on effectiveness, efficiency, and satisfaction for network application scenarios, and robustness reflects the network’s capacity to maintain functionality in the face of external perturbations. In network scenarios, the point-to-point communication is quite common. Many applications cannot be divorced from point-to-point communications, such as private messages, real-time chat, file transfer, remote control, and web browsing. With the increase in network size, concurrent requests occur frequently, including one-to-many and parallel key distributions. Therefore, multi-user support is necessary. Due to the two-user exclusivity of QKD, connecting different users is often achieved by a switch [21] or multiplexer [14,15], where the network is in essence a patchwork of two-user QKD instances, which may cause a queuing delay. Therefore, a multi-user key distribution is important to improve network adaptability. Meanwhile, the total efficiency of the MU is limited; thus, the multiple access of users might drag down the average key rate per user, which indicates a trade-off between multi-user support and the user’s key rate. However, networks are in a constant state of dynamic change. It is hard to find a fixed equilibrium of the trade-off. Therefore, a flexible networking scheme that can adjust the strategy of network performance is beneficial.

Moreover, in QKD networks, each user has a different encoding reference and channel environment, which is a challenge for network robustness. As the number of users grows, it can burden the network infrastructures with reference-frame alignment [21,57] and polarization-disturbance compensation [58–60]. First, users have their reference frame, and aligning the reference frames of an N-user MDI-QKD network needs N-1 times (${\sim}O(N)$) as many overheads as point-to-point MDI-QKD systems. Second, the exclusive channels connecting each user and MU may lead to various characteristics of polarization disturbance. To satisfy the MDI-QKD’s requirement for identical photons, the polarization disturbance of each channel should be compensated. Therefore, similar to the reference-frame alignment, the cost of polarization compensation also grows at the order of N. The time cost of them cannot be ignored [13], which, for example, can be as high as several milliseconds [20] or minutes [61] for each pair of users, and the extra calibration and compensation system [18,21] is a considerable burden of the device cost.

These problems restrict the practical use of QKD networks. In this paper, we successfully remove them and conduct an experimental demonstration of a multi-user MDI-QKD network. Specifically, we design a multi-user MU that can flexibly support two to N users in secure key distribution by a polarization-compensation-free (PCF) method. On the one hand, by combining the MUs in appropriate quantities using optical switches, the requirement of multi-user scenarios can be better addressed. On the other hand, based on the idea of polarization scrambling [62], pairing the polarization passively using polarizing beam splitters (PBSs) can guarantee the indistinguishably of polarization for users, eliminating the need for active polarization compensation. We also design a Sagnac–Mach–Zehnder (SMZ) encoder to employ the reference-frame-independent (RFI) protocol [62–67], which can estimate the upper bound of the information stolen by eavesdroppers without knowing and correcting the frame drifting between users. Finally, we experimentally demonstrate a multi-user MDI-QKD network regardless of reference-frame misalignment and polarization disturbance, which verifies the flexibility improvement of networking and the threshold reduction of network deployment.

2. PROTOCOL

The MDI-QKD networking scheme is schematically shown in Fig. 1 as an N-user star-type network. The network consists of three parts: the users, the optical switch, and the PCF MUs. Figure 1(a) shows the wiring layout among them. Each user accesses the MDI-QKD network as a transmitter, consisting of a phase-randomized pulsed laser, a decoy-state modulator, an encoder, and a polarization-scrambling unit as Fig. 1(b) shows. All users are connected to the optical switch via channels. The optical switch has an ${\rm{N}} \times {\rm{N}}$ structure, which groups an arbitrary number of users and routes their quantum signals to the same MU. Accordingly, a multi-user MU is shown in Fig. 1(c), which supports multiple pairs of users in key distribution. As an example, Fig. 1(a) shows two kinds of MUs with two and three inputs, respectively. MUs can be deployed flexibly when their number and user capacity are determined in terms of requirements.

 

Fig. 1. (a) Schematic of the star-type MDI-QKD network for N users. (b) Schematic of the user’s devices including a phase-randomized pulsed laser, a four-intensity decoy-state modulator, an encoder that can prepare quantum states in three bases for the RFI-QKD protocol, and a polarization-scrambling unit for the polarization-compensation-free method. (c) Schematic of the multi-user measurement unit including the same number of polarization units and Bell-state measurement units as the number of access ports for the polarization-compensation-free method and the MDI-QKD protocol, respectively. (d) The key generation of the multi-user measurement unit.

Download Full Size | PDF

In the MDI-QKD networking scheme, the first advantage of requiring no reference-frame alignment is realized by the RFI protocol. To conduct the RFI protocol, the encoder of users is able to prepare quantum states with three bases, X, Y, and Z, corresponding to the Pauli matrices $\{{\sigma _x},{\sigma _y},{\sigma _z}\}$, where the X basis consists of $| + \rangle = \frac{1}{{\sqrt 2}}(|0\rangle + |1\rangle)$ and $| - \rangle = \frac{1}{{\sqrt 2}}(|0\rangle - |1\rangle)$, the Y basis consists of $| + \!i\rangle = \frac{1}{{\sqrt 2}}(|0\rangle + i|1\rangle)$ and $| - \!i\rangle = \frac{1}{{\sqrt 2}}(|0\rangle - i|1\rangle)$, and the Z basis consists of $|0\rangle$ and $|1\rangle$. The Z basis is well defined to generate a secure key, which can be realized by, for example, the circular basis in polarization encoding and the time basis in phase encoding; while the X basis and Y basis can be misaligned with an unknown drift, Eve’s information can be estimated by constructing a rotation invariant.

The polarization-scrambling unit of users and the polarization beam splitters of PCF MUs together make up the PCF module. First, the polarization-scrambling unit randomly modulates the polarization of pulses to obtain a uniform distribution on the Poincaré sphere. In this way, the polarization state can still be considered random even though it could be disturbed by the channel. When received by PCF MUs, it is decomposed by the polarization beam splitter into two vertical states. As Fig. 1(c) shows, the two decomposed states of one user can be paired with the decomposed states of other users, respectively, and each pair of them is ready for Bell-state measurement (BSM).

The robustness against polarization disturbances is achieved by randomizing the polarization actively and matching the polarization passively. The former eliminates the effect of channel disturbances, and superimposing any polarization disturbance onto the polarization randomization does not change the random state of polarization. The latter differentiates two orthogonal polarization modes and transforms them into the same polarization modes aligned to the slow axis of the polarization-maintaining fiber, preparing for the BSM and networking.

The multi-user support is built by combining decomposed polarization states of different users. The combination contains many users, and each decomposed state of one user can be paired with the decomposed state of other users. Pairing users by passively matching the decomposed states, the combination exceeds the limit of two users in BSM units and expands the number of supported users to an arbitrary number. Passively matching the decomposed states enables a pulse-class slicing of quantum resources, which helps users in parallelizing and equalizing the sharing of key-generation bandwidth. Figure 1(c) shows a combination mode for $n$ users, which is called the $n$-user PCF MU; the examples of $n = 2$ and $n = 3$ are shown in Fig. 1(a) and are experimentally demonstrated in Section 3. For the users grouped with the $n$-user PCF MU, N pairs of them can generate keys synchronously as shown in Fig. 1(d). Changing the connection mode of the optical switch or extending the output number of each user’s PBS by cascading more PBSs, more pairs of users can generate keys.

The enrichment of BSM units indicates that the measurement resources become optimizable. Combining different BSM units with a multiple-input multiple-output optical switch can enable the flexibility of configuration. The optical switch separates the channel and MUs as a socket, where MUs can be plugged into the optical switch with a flexible type and quantity as long as $\sum\nolimits_2^n n{M_n} \le N$ is satisfied, where $N$ is the number of outputs of the optical switch and ${M_n}$ is the total number of $n$-user MUs. $N$ reflects the capacity of the MUs, and ${M_n}$ can be configured by the network size and allocated according to user requests. The interface design of the optical switch and the modularization of MUs create the possibility for flexible, on-demand, and optimal measurement-resource staffing.

 

Fig. 2. Experimental setup for the MDI-QKD network using two- and three-user measurement units. The optical switch is used to realize the two measurement modes corresponding to solid lines and dashed lines, respectively, where the dashed blue lines serve users 1 and 2 in two-user mode, and the solid orange lines serve users 1 and 2, users 1 and 3, and users 2 and 3 in three-user mode. Laser, frequency-locked lasers; IM1, intensity modulator as the pulse generator; PM1, phase modulator as the phase randomizer; IM2, intensity modulator as the decoy state generator; Circ, circulator; BS, beam splitter; PM2, phase modulator in the Sagnac loop; PM3, phase modulator in the asymmetric Mach–Zehnder loop; EPC, electronic polarization controller as the polarization scrambler; EVOA, electronic variable optical attenuator; PBS, polarizing beam splitter as the polarization matching unit; SPD, single-photon detector.

Download Full Size | PDF

Finally, a four-intensity decoy-state method with joint analysis, as shown in Appendix A, is adopted to ensure single-photon security using the phase-randomized weak coherent pulsed laser. The intensity of each laser pulse is modulated by the decoy-state modulator and randomly chosen from $\{\mu,\nu ,\omega ,o\}$, which satisfies $\nu \gt \omega \gt o = 0$. For the three bases of the RFI-QKD protocol, the $\mu$ state is prepared in Z basis, and $\nu$ and $\omega$ states are prepared in both X basis and Y basis. The vacuum state $o$ is prepared regardless of the basis choice. In the experiment, the quantities that meet the following conditions should be measured: $\{{{Q_{{lr}}^{{ab}},E_{{lr}}^{{ab}}} |l = r \vee l = {\rm{o}} \vee {\rm{r}} = {\rm{o}}} \}$, where $Q_{{lr}}^{{ab}}$ and $E_{{lr}}^{{ab}}$ are the yield and QBER when User A prepares quantum state with basis $a$ and intensity $l$ and User B prepares quantum state with basis $b$ and intensity $r$, respectively. The final secure key rate is given by

In the multi-user MU shown as Fig. 1(c), each pair of users only uses one BSM to generate keys, and each BSM only connects one pair of users. For one pair of users, their key generation only depends on the click of one BSM, no matter how other BSMs click. In terms of security, the measurement devices can be considered a black box, a feature of the MDI that ensures the configuration of measurement does not affect the security. In terms of key generation, the multi-user measurement is in essence a parallel of MDI-QKD instances, and every pair of users generates keys independently by using Eq. (1).

3. EXPERIMENTAL SYSTEM

In this section, a three-user MDI-QKD network using two types of MUs is experimentally demonstrated. The two-user and three-user MUs are selected for the demonstration. Because the three-user MU is the simplest form of the multi-user PCF MU, it is a cost-effective scheme to show the advantages. The users are connected to the MU with 25 km fiber. To further simplify the network system, we use an optical switch to pair users as well as recombine the BSM units, realizing the two types of measurement. So the two networking modes can be demonstrated successively without preparing two measurement outfits. Figure 2 shows the schematic diagram of the experimental setup.

A. User

The devices of each user are grouped into four modules corresponding to Fig. 1(b), a phase-randomized pulsed laser, a decoy-state modulator, an encoder, and a polarization-scrambling unit, as shown in Fig. 2. The phase-randomized pulsed laser prepares weak coherent pulses and sends them to the decoy-state modulator for the four-intensity modulation and to the encoder for the RFI protocol encoding, and the polarization-scrambling unit therewith randomizes the pulses in the polarization dimension and outputs them into the channel.

The phase-randomized pulses are prepared by chopping a continuous-wave laser source and randomizing the phase using a phase modulator, shown as the dodger blue patch in Fig. 2. The continuous-wave laser is generated via a molecular absorption whose central wavelength is locked at 1542.38 nm with a precision of 0.0001 nm. Then the intensity modulator (IM1) chops the continuous-wave laser to pulses with a repetition frequency of 50 MHz and a width of 500 ps. Finally, the phase modulator (PM1) randomizes the phase of each pulse.

The decoy-state modulator, shown as the orange patch in Fig. 2, is an intensity modulator (IM2) driven by a two-bit digital to analog converter (DAC) to generate four-intensity pulses. The bit rate is 50 Mbps for each digital channel, whose random digital signals are generated by a field programmable gate array (FPGA)-based driver board. The electronic variable optical attenuator (EVOA) enables single-photon attenuation of the modulated pulses, which is usually located at the end of the user’s devices. In Fig. 2, it is placed by the IM2 for readability.

 

Fig. 3. Schematic diagram of the Sagnac–Mach–Zehnder encoder.

Download Full Size | PDF

 

Fig. 4. Principle of the Sagnac–Mach–Zehnder encoder.

Download Full Size | PDF

The encoder, shown as the slate blue patch in Fig. 2, is a cascade of a Sagnac loop [36,66] and an asymmetric Mach–Zehnder structure to realize the three-basis modulation for RFI-QKD protocol. Specifically, the Sagnac loop is used to prepare quantum states in $Z$ basis, and the Mach–Zehnder structure is responsible for the modulation in $X$ basis and $Y$ basis. The SMZ encoder employs an all-polarization-maintaining fiber design for high stability. It does not require optical switches [62,65] and is designed for thrifty compactness [66]. Compared to the time-bin encoding using intensity modulation [62,65], the intensity consistency of encoded states can be satisfied naturally by the Sagnac interferometer.

Figure 3 shows the structure of the encoder. In Fig. 3, the Sagnac loop consists of a beam splitter (BS1) and a PM (PM2), and the Mach–Zehnder structure including the BS1, the PM3, and the BS2. All optical elements are connected by polarization-maintaining fiber cables. The fiber length depends on the delay between the adjacent pulses of coded quantum states. In our system, the clock rate is 50 MHz, corresponding to a period of 20 ns. To minimize the requirement for modulation bandwidth, the delay is set to half of the period, 10 ns. Therefore, in the Sagnac loop, the delay between the clockwise and counterclockwise fibers from BS1 to PM2 is 10 ns, and the delay between the short arm and long arm of the Mach–Zehnder structure is also 10 ns.

The principle of the SMZ encoder can be figured out by Fig. 4. A laser pulse is led to the BS1 of the Sagnac loop by a circulator (Circ), and then the BS1 splits the pulse into a clockwise pulse and a counterclockwise pulse. By introducing a phase difference between them, the Sagnac loop can modulate the splitting ratio of BS1 outputs, which are also the inputs of the Mach–Zehnder structure. Specifically, the counterclockwise pulse reaches the PM2 10 ns earlier than the clockwise pulse, as shown in the left part of Fig. 4, so the voltage loaded on the PM2 is changed in 10 ns, corresponding to a clock rate of 100 MHz, to add different phase to the clockwise and counterclockwise pulses. The phase differences of $0,\pi ,\pi /2$ lead to the interference maxima, minima, and medium, respectively. When reaching the interference maxima or minima, the eigenstates in Z basis, $|0\rangle$ and $|1\rangle$, can be prepared because only one pulse is output to the short arm or the long arm of the Mach–Zehnder structure, as illustrated in the middle part of Fig. 4. For X basis and Y basis, the interference medium produced by the phase difference of $\pi /2$ outputs two pulses with equal intensity to the two arms of the Mach–Zehnder structure, and then the PM3 modulates the phase of the short-arm pulse to introduce a phase difference of $0,\pi ,\pi /2$, or $3\pi /2$ according to the basis and key choices. Due to the period of 20 ns, the modulation rate of PM3 is 50 MHz. In this way, the RFI states can be prepared by driving the PM2 and the PM3, and the relations of the modulated phase to the RFI states are listed in Table 1.

Finally, the polarization-scrambling unit, shown as the blue patch in Fig. 2, is an electronic polarization controller, and a digital control signal coming from an FPGA-based board drives it to scramble the polarization.

 

Fig. 5. Pairing modes of the optical switch.

Download Full Size | PDF

Table 1. Code Table in RFI-QKD Protocol

View Table | View all tables in this article

B. Measurement Unit

The MU includes PBSs, optical switches, and BSM units, shown as the MU area of Fig. 2. The PBSs eliminate the need for polarization compensation, the optical switch pairs users, and the BSM units accomplish measurement.

The PBSs are responsible for erasing the polarization information of input pulses, which work with the polarization-scrambling unit to complete the PCF method. Each PBS has a single mode fiber leg as input and two polarization-maintaining fiber legs as outputs. The PBS decomposes the input pulse into two paths with equal probability; due to the axial propagation in polarization-maintaining fibers, the polarization of output pulses is aligned naturally, eliminating the need to compensate for distributed polarization.

The optical switch pairs users for BSM on one hand and combines BSM units for multi-user measurement on the other hand. The two outputs of PBS can be paired with up to two users for BSM; when all outputs are paired with the same user, a two-user connection is built, while three users are fully connected if the different output is paired with a different user. The two pairing modes are shown in Fig. 5, and each pair of pulses is measured by a BSM unit, as shown in the cyan patch of Fig. 2. Here all PBSs used have one single mode input and two polarization-maintaining outputs; note that the polarization of all outputs of PBSs are aligned to the slow axis naturally, so it is unnecessary to rotate the polarization for alignment.

Correspondingly, the two modes of the optical switch also construct two types of MUs by recombining the BSM units, where each BSM unit includes a BS and two SPDs. The first type of MU is the original two-user scheme [62], as shown in Fig. 1(c); two BSM units are combined, and both of them detect the paired pulses of the same two users. To network more users, three BSM units can be combined as Fig. 1(d), where every BSM unit is responsible for measuring the pulse pair of different users.

In the BSM unit, the SPDs (SPD-300, Qasky) are triggered by a clock signal of 50 MHz, whose gate width and dead time are 1 ns and 1 µs, respectively. For every two SPDs of the same BSM unit, the gate signals of them are aligned with the arrival times of $|0\rangle$ and $|1\rangle$, respectively. In the three-user mode, for User 1 and User 2, the detection efficiencies (dark-count rates per gate) of the two SPDs are 20.9% ($5.0 \times {10^{- 6}}$) and 25.9% ($7.6 \times {10^{- 6}}$), respectively. For User 1 and User 3, they are 23.9% ($4.2 \times {10^{- 6}}$) and 22.8% ($1.7 \times {10^{- 6}}$), and for User 2 and User 3, they are 19.1% ($7.4 \times {10^{- 6}}$) and 18.5% ($5.6 \times {10^{- 6}}$), respectively. In the two-user mode, the BSM units of Users 1-2 and Users 2-3 are employed for all pairs of users.

Table 2. Visibility and Error Rates of the Network System

View Table | View all tables in this article

C. Results and Discussion

The Hong–Ou–Mandel (HOM) interference is the basis of MDI-QKD. In the experiment, we first measure the visibility of HOM interference to estimate the performance of the system. Here we collect the coincidence count rate in Z basis and X basis to obtain the visibility of dip [68]. For Z basis, both users send $|0\rangle$ to a BSM unit, and two SPDs are triggered at the arrival time of $|0\rangle$. For X basis, both users send $| + \rangle$ to the BSM unit, and two SPDs are triggered at the arrival time of $|0\rangle$ and $|1\rangle$, respectively. The observed results of visibility are shown in Table 2, while the theoretical visibility is 50% using weak coherence sources. More detailed results of visibility are shown further below in Fig. 7.

To obtain a higher secure key rate, we optimize the operating parameters of the network system. Due to the similarity in system parameters, all users are set to the same operating parameters for simplicity. Specifically, the optimal decoy-state intensities are $\mu= 0.2259$, $\nu = 0.2321$, and $\omega = 0.0607$. Considering the finite-key effect, each pair of users accumulates total data of ${10^{12}}$ with a fixed failure probability of $\epsilon = {10^{- 7}}$. To reduce the impact of statistical fluctuation, we develop a joint analytical method to estimate a group of parameters together, as shown in Appendix A. The optimal selecting probabilities are $P_\mu ^Z = 0.221, P_\nu ^X = P_\nu ^Y = 0.076,P_\omega ^X = P_\omega ^Y = 0.225,{P_o} = 0.177$.

 

Fig. 6. Secure key rates in three- and two-user modes.

Download Full Size | PDF

 

Fig. 7. Visibility of dip in three minutes. The gray dots are the statistical results in 1 s, and the blue lines are the average values in 60 s.

Download Full Size | PDF

Based on the above parameters, the required observables are then collected to calculate the secure key rates. The error rates of $\mu$ in Z basis are listed in Table 2, where N and M represent the two-user mode and three-user mode, respectively. The detailed values of all observables are shown in Appendix B. The intermediate variable $C$ of user pairs 1-2, 1-3, and 2-3 are 0.9464, 0.6988, and 0.8614, respectively, in the three-user mode where each pair employs one set of BSM unit. In two-user scenarios, the intermediate variable $C$ of them are 1.0699, 0.8072, and 1.0666, respectively.

The experimental secure key rates at a transmission distance of 50 km are shown in Fig. 6, where the three- and two-user modes are depicted in red and blue, respectively. The shapes represent the secure key rate of different pairs of users. The solid lines are the simulation results calculated with different BSM configurations, where the red line is obtained in the three-user mode and the blue line represents the two-user mode.

Finally, the secure key rates for the user pairs, User 1-2, User 1-3, and User 2-3, are, respectively, obtained as $3.91 \times {10^{- 8}}$, $1.95 \times {10^{- 8}}$, $1.65 \times {10^{- 9}}$ in the three-user mode. For the two-user mode, they become $1.07 \times {10^{- 7}}$, $5.52 \times {10^{- 8}}$, $5.35 \times {10^{- 8}}$, respectively. The key rate of User 2-3 in the three-user mode is relatively low because the BSM unit with a low detection efficiency is used. In the two-user mode, it becomes higher because the better two BSM units of Users 1-2 and Users 2-3 are employed for all pairs of users.

The networking capability of our scheme is verified, and the three-user mode can generate exclusive keys for the three pairs of users simultaneously. The multi-user secure key rate is reduced compared with the two-user mode because more users means lower polarization-paring probability as Fig. 5 shows. Nevertheless, the overall performance of key distribution is decided by the number of BSM modules. On average, the BSM module earned per user is always one in the multi-user MU, so the performance is stable. Moreover, for every user who accessed an N-user MU, the QKD task only executes once to share an N pair of keys, saving a lot of non-key-distributing costs in initialization and termination.

With the increase in user number, it is difficult to reach and maintain the alignment of users, and the concurrent requests occur frequently; thus, the advantages of robustness and adaptability become increasingly prominent. Moreover, the multi-user scheme enriches the types of MUs, which provides the probability of configuring the different types of MUs flexibly and allows the network to schedule the MUs according to the scenario requirements.

4. CONCLUSION

In this paper, we propose a flexible networking solution that can address the realistic security, adaptability, and robustness of QKD networks. The MDI protocol improves the realistic security of measurement devices, which is commonly used as the central node of a network. By introducing the multi-user MU, the central node can realize multi-user support and further dynamically regulate the measurement configuration for the trade-off between the multi-user support and the user’s key rate. Moreover, thanks to the RFI-QKD protocol and the PCF method, both the frame and polarization alignments can be removed, thus ensuring robustness and unloading the overhead of alignment, which can be considerable with the increasing user number in networks.

The essence of our networking method is routing pulses by polarization and then flexibly grouping users by pairing routes, which is independent of protocols and topologies. It is promising to extend the method to recent MDI protocols such as the mode-pairing protocol [69] or TF protocols such as the phase-matching protocol [53]. In practice, our scheme is adaptable to other kinds of networks such as the ring topology. As long as the measurement relay can receive signals from multiple users, the multi-user PCF MU can be applied by routing each signal to a different port of the MU using a $2 \times {\rm{N}}$ optical switch and delays. Moreover, with the extension of the multi-user MU, our scheme not only improves the security, robustness, and adaptability of QKD networks but also enhances some application scenarios by functional richness. For example, the key agreement can share a common key for participants, which is a very important requirement in network applications [70–75] such as online conferences and group chats. Our scheme can enrich the applications by satisfying the common requirement of private communication for participants.

Real-life needs are always the direction the QKD networks are moving in. First, high realistic security reflects the core competence of QKD networks, which should be guaranteed preferentially. Second, a complicated deployment environment underlines robustness to pursue full-time service. Finally, limited hardware resources and large volumes of user requests feature prominently in network environments, which test networks’ ability for concurrent processing and resource allocation. Our work provides an integrated solution to answer these concerns at once, which may carve a place in future quantum networks.

APPENDIX A: FOUR-INTENSITY RFI-MDI-QKD USING JOINT ANALYSIS

User A (B) randomly selects $X$, $Y$, $Z$ basis or selects vacuum state $o$ with no basis. If $Z$ basis is selected, User A (B) only selects intensity ${\mu _A}$ (${\mu _B}$); if $X$ or $Y$ basis is selected, User A (B) randomly selects intensity ${\nu _A}$ or ${\omega _A}$ (${\nu _B}$ or ${\omega _B}$). The weak coherent pulses in $Z$ basis are mainly employed to generate key bits, while the $X$, $Y$ bases and the vacuum state $o$ are employed to estimated parameters. We define a pulse pair as in the signal mode $S$ when both users select $Z$ basis and in the decoy mode when both two users select $X$, $Y$ bases or vacuum state. The estimation of the secret key rate is introduced in the follows. Some important notations and definitions are listed in Table 3.

Table 3. Important Notations

View Table | View all tables in this article

To obtain the secure key rate, the users should estimate the yield of the single-photon pulse pair and their information leakage. We define the ${Y_{1,1}}$ as the yield of the single-photon pulse pair. Based on the relation that $Y_{1,1}^{{XX}} = Y_{1,1}^{{XY}} = Y_{1,1}^{{YX}} = Y_{1,1}^{{YY}} = Y_{1,1}^S$ [76,77], we can estimate the ${\underline Y _{1,1}}$ by the decoy mode $D$. Combining the joint-study method [78] and the improved Chernoff bound [79], a tight ${\underline Y _{1,1}}$ can be estimated by

(A1)$$\begin{split}&{{{\underline Y}_{1,1}} = \min :\;\{\;[p_1^\nu p _2^{\prime \nu} Q_{\omega \omega}^D + p_1^\omega p_2^{\prime \omega} p_0^\nu Q_{{o\nu}}^D + p_1^\omega p _2^{\prime \omega} p _0^{\prime\nu} Q_{\nu o}^D + p_1^\nu p _2^{\prime \nu} p_0^\omega p _0^{\prime \omega} {Q_{{oo}}}]}\\[-3pt]& - {\;[p_1^\omega p _2^{\prime\omega} Q_{\nu \nu}^D + p_1^\nu p _2^{\prime\nu} p_0^\omega Q_{{o\omega}}^D + p_1^\nu p _2^{\prime \nu} p _0^{\prime\omega} Q_{\omega o}^D + p_0^\nu p _0^{\prime \nu} p_1^\omega p _2^{\prime \omega} {Q_{{oo}}}]\} /[p_1^\nu p_2^\nu (p _1^{\prime \omega} p _2^{\prime \nu} - p _1^{\prime \nu} p _2^{\prime \omega})],}\\[-3pt]&{\rm s.t.:}\\[-3pt]&{\bar \Delta (N_{{lr}}^D\hat Q_{{lr}}^D) \ge N_{{lr}}^DQ_{{lr}}^D \ge \underline \Delta (N_{{lr}}^D\hat Q_{{lr}}^D);\;{\rm{for}}\,{\rm{any}}\,l{\rm{,}}r \in {\rm{\{}}\nu {\rm{,}}\omega {\rm{,}}o{\rm{\}}},}\\[-3pt]&{\bar \Delta (N_{\nu o + o\nu}^D\hat Q_{\nu o + o\nu}^D) \ge N_{\nu o + o\nu}^DQ_{\nu o + o\nu}^D \ge \underline \Delta (N_{\nu o + o\nu}^D\hat Q_{\nu o + o\nu}^D),}\\[-3pt]&{\bar \Delta (N_{\omega o + o\omega}^D\hat Q_{\omega o + o\omega}^D) \ge N_{\omega o + o\omega}^DQ_{\omega o + o\omega}^D \ge \underline \Delta (N_{\omega o + o\omega}^D\hat Q_{\omega o + o\omega}^D),}\\[-3pt]&{N_{\omega \omega}^DQ_{\omega \omega}^D + N_{\nu o + o\nu}^DQ_{\nu o + o\nu}^D + {N_{{oo}}}{Q_{{oo}}} \le \bar \Delta (N_{\omega \omega}^D\hat Q_{\omega \omega}^D + N_{\nu o + o\nu}^D\hat Q_{\nu o + o\nu}^D + {N_{{oo}}}{{\hat Q}_{{oo}}})}\\[-3pt]&{N_{\omega \omega}^DQ_{\omega \omega}^D + N_{\nu o + o\nu}^DQ_{\nu o + o\nu}^D + {N_{{oo}}}{Q_{{oo}}} \ge \underline \Delta (N_{\omega \omega}^D\hat Q_{\omega \omega}^D + N_{\nu o + o\nu}^D\hat Q_{\nu o + o\nu}^D + {N_{{oo}}}{{\hat Q}_{{oo}}}),}\\[-3pt]&{N_{\nu \nu}^DQ_{\nu \nu}^D + N_{\omega o + o\omega}^DQ_{\omega o + o\omega}^D + {N_{{oo}}}{Q_{{oo}}} \le \bar \Delta (N_{\nu \nu}^D\hat Q_{\nu \nu}^D + N_{\omega o + o\omega}^D\hat Q_{\omega o + o\omega}^D + {N_{{oo}}}{{\hat Q}_{{oo}}}),}\\[-3pt]&{N_{\nu \nu}^DQ_{\nu \nu}^D + N_{\omega o + o\omega}^DQ_{\omega o + o\omega}^D + {N_{{oo}}}{Q_{{oo}}} \ge \underline \Delta (N_{\nu \nu}^D\hat Q_{\nu \nu}^D + N_{\omega o + o\omega}^D\hat Q_{\omega o + o\omega}^D + {N_{{oo}}}{{\hat Q}_{{oo}}}),}\end{split}$$

where the ${Q_{o\lambda + \lambda o}} = \frac{{{Q_{{o\lambda}}}{N_{{o\lambda}}} + {Q_{\lambda o}}{N_{\lambda o}}}}{{{N_{{o\lambda}}} + {N_{\lambda o}}}}$, ${N_{o\lambda + \lambda o}} = {N_{{o\lambda}}} + {N_{\lambda o}}$ for $\lambda$ is the intensity selected by the user and the superscript $D$ is the joint basis of all bases in the decoy mode; in other words, it is in essence regarding bases $XX$, $XY$, $YX$, and $YY$ as a entirety. The $Q_{{lr}}^D = \frac{{\sum\nolimits_{d \in D} N_{{lr}}^dQ_{{lr}}^d}}{{\sum\nolimits_{d \in D} N_{{lr}}^d}}$, $T_{{lr}}^D = \frac{{\sum\nolimits_{d \in D} N_{{lr}}^dT_{{lr}}^d}}{{\sum\nolimits_{d \in D} N_{{lr}}^d}}$, and $N_{{lr}}^D = \sum\nolimits_{d \in D} N_{{lr}}^d$. The first constraint is obtained by applying the improved Chernoff bound $\bar \Delta$ and $\underline \Delta$ on the experimental observed values [79], and the other constraints are obtained by the joint-study method [78]. The upper and lower bound of an observable value $M$ is given by

(A2)$$\underline \Delta (M ) = \frac{M}{{1 + \underline \delta}},\;\bar \Delta (M ) = \frac{M}{{1 - \bar \delta}},$$

where $\underline \delta$ and $\bar \delta$ are obtained by solving the following equation set,

(A3)$${\left[{\frac{{{e^{\underline \delta}}}}{{{{(1 + \underline \delta)}^{1 + \underline \delta}}}}} \right]^{M/(1 + \underline \delta)}} = \frac{1}{2}\zeta ,\;{\left[{\frac{{{e^{- \bar \delta}}}}{{{{(1 - \bar \delta)}^{1 - \bar \delta}}}}} \right]^{M/(1 - \bar \delta)}} = \frac{1}{2}\zeta ,\;$$

where the $\zeta$ is the failure probability that is fixed to ${10^{- 7}}$ in our experiment.

To estimate the information leakage ${I_{{AE}}}$, the users should first estimate an intermediate variable $C$ that

(A4)$$C = (1 - 2e_{1,1}^{{XX}}{)^2} + {(1 - 2e_{1,1}^{{XY}})^2} + {(1 - 2e_{1,1}^{{YX}})^2} + {(1 - 2e_{1,1}^{{YY}})^2},$$

where the $e_{1,1}^d$ denotes the QBER of single-photon pulse pairs in basis pair $d$ for $d \in \{XX,XY,YX,YY\}$. In the scenario that the decoy states’ number and key size are both finite, we have to estimate a lower bound of the variable $C$, which requires upper bounds of these $e_{1,1}^d$. To employ a tighter estimation [76,77,80], we define $E_{1,1}^d = {Y_{1,1}}e_{1,1}^d$, $E_{1,1}^{{d_1} + {d_2}} = {Y_{1,1}}e_{1,1}^{{d_1} + {d_2}}$, and $E_{1,1}^D = {Y_{1,1}}e_{1,1}^D$, where $d,{d_1},{d_2} \in \{XX,XY,YX,YY\}$ and ${d_1} \ne {d_2}$. The superscript ${d_1} + {d_2}$ denotes a joint basis, which is defined as a combination of basis ${d_1}$ and ${d_2}$, in other words, regarding basis ${d_1}$ and ${d_2}$ as an entirety. Similar to the definition of the $Q_{{lr}}^D$, $T_{{lr}}^D$, and $N_{{lr}}^D$, we define the $Q_{{lr}}^{{d_1} + {d_2}} = \frac{{Q_{{lr}}^{{d_1}}N_{{lr}}^{{d_1}} + Q_{{lr}}^{{d_2}}N_{{lr}}^{{d_2}}}}{{N_{{lr}}^{{d_1}} + N_{{lr}}^{{d_2}}}}$, $T_{{lr}}^{{d_1} + {d_2}} = \frac{{T_{{lr}}^{{d_1}}N_{{lr}}^{{d_1}} + T_{{lr}}^{{d_2}}N_{{lr}}^{{d_2}}}}{{N_{{lr}}^{{d_1}} + N_{{lr}}^{{d_2}}}}$, $N_{{lr}}^{{d_1} + {d_2}} = N_{{lr}}^{{d_1}} + N_{{lr}}^{{d_2}}$. Noting that the estimation of the ${\bar E _{1,1}}$ only needs a vacuum state and a weak coherent state, we define the ${\bar E _{\lambda ,11}}$ as the ${\bar E _{1,1}}$ that is estimated by the vacuum state and a weak coherent state $\lambda$. By employing the linear programming and the joint-study method, we have

(A5)$$\begin{split}& \bar E _{\mu ,11}^S = \max :\frac{{[{T_{{\mu\mu}}} + p_0^\mu p _0^{\prime \mu} {Q_{{oo}}}/2] - [p_0^\mu {Q_{{o\mu}}} + p _0^{\prime \mu} {Q_{\mu o}}]/2}}{{p_1^\mu p _1^{\prime\mu}}};\\&{\rm s.t.:}\\&\bar \Delta ({N_{{\mu\mu}}}{{\hat T}_{{\mu\mu}}}) \ge {N_{{\mu\mu}}}{T_{{\mu\mu}}} \ge \underline \Delta ({N_{{\mu\mu}}}{{\hat T}_{{\mu\mu}}});\\&\bar \Delta ({N_{{lr}}}{{\hat Q}_{{lr}}}) \ge {N_{{lr}}}{Q_{{lr}}} \ge \underline \Delta ({N_{{lr}}}{{\hat Q}_{{lr}}});\;{\rm{for}}\,{\rm{any}}\,l{\rm{,}}r \in {\rm{\{}}\mu {\rm{,}}o{\rm{\}}};\\&\bar \Delta ({N_{\mu o + o\mu}}{{\hat Q}_{\mu o + o\mu}}) \ge {N_{\mu o + o\mu}}{Q_{\mu o + o\mu}} \ge \underline \Delta ({N_{\mu o + o\mu}}{{\hat Q}_{\mu o + o\mu}})\;,\\&\bar \Delta ({N_{{\mu\mu}}}{{\hat T}_{{\mu\mu}}} + {N_{{oo}}}{{\hat Q}_{{oo}}}/2) \ge {N_{{\mu\mu}}}{T_{{\mu\mu}}} \\&\;\;+ {N_{{oo}}}{Q_{{oo}}}/2 \ge \underline \Delta ({N_{{\mu\mu}}}{{\hat T}_{{\mu\mu}}} + {N_{{oo}}}{{\hat Q}_{{oo}}}/2),\end{split}$$

where we ignore the superscripts of the observed values since the $\mu$ always corresponds to the Z basis,

(A6)$$\begin{split}&{\bar E _{\lambda ,11}^d = \max :\frac{{[T_{\lambda \lambda}^d + p_0^\lambda p _0^{\prime\lambda} {Q_{{oo}}}/2] - [p_0^\lambda Q_{{o\lambda}}^d + p _0^{\prime\lambda} Q_{\lambda o}^d]/2}}{{p_1^\lambda p _1^{\prime\lambda}}}}\\&{\rm s.t.:}\\&{\bar \Delta (N_{{lr}}^d\hat T_{\lambda \lambda}^d) \ge N_{\lambda \lambda}^dT_{\lambda \lambda}^d \ge \underline \Delta (N_{\lambda \lambda}^d\hat T_{\lambda \lambda}^d);}\\&{\bar \Delta (N_{{lr}}^d\hat Q_{{lr}}^d) \ge N_{{lr}}^dQ_{{lr}}^d \ge \underline \Delta (N_{{lr}}^d\hat Q_{{lr}}^d);\;{\rm{for}}\,{\rm{any}}\,l{\rm{,}}r \in {\rm{\{}}\lambda {\rm{,}}o{\rm{\}}};}\\&{\bar \Delta (N_{\lambda o + o\lambda}^d\hat Q_{\lambda o + o\lambda}^d) \ge N_{\lambda o + o\lambda}^dQ_{\lambda o + o\lambda}^d \ge \underline \Delta (N_{\lambda o + o\lambda}^d\hat Q_{\lambda o + o\lambda}^d)\;,}\\&\bar \Delta (N_{\lambda \lambda}^d\hat T_{\lambda \lambda}^d + {N_{{oo}}}{{\hat Q}_{{oo}}}/2) \ge N_{\lambda \lambda}^dT_{\lambda \lambda}^d\\&\;\; + {N_{{oo}}}{Q_{{oo}}}/2 \ge \underline \Delta (N_{\lambda \lambda}^d\hat T_{\lambda \lambda}^d + {N_{{oo}}}{{\hat Q}_{{oo}}}/2),\end{split}$$

where $\lambda \in \{\nu ,\omega \}$;

(A7)$$\begin{split}&{\bar E _{\lambda ,11}^{{d_1} + {d_2}} = \max :\frac{{[T_{\lambda \lambda}^{{d_1} + {d_2}} + p_0^\lambda p _0^{\prime\lambda} {Q_{{oo}}}/2] - [p_0^\lambda Q_{{o\lambda}}^{{d_1} + {d_2}} + p _0^{\prime\lambda} Q_{\lambda o}^{{d_1} + {d_2}}]/2}}{{p_1^\lambda p _1^{\prime \lambda}}}}\\&{\rm s.t.:}\\&{\bar \Delta (N_{\lambda \lambda}^{{d_1} + {d_2}}\hat T_{\lambda \lambda}^{{d_1} + {d_2}}) \ge N_{\lambda \lambda}^{{d_1} + {d_2}}T_{\lambda \lambda}^{{d_1} + {d_2}} \ge \underline \Delta (N_{\lambda \lambda}^{{d_1} + {d_2}}\hat T_{\lambda \lambda}^{{d_1} + {d_2}});}\\&\bar \Delta (N_{{lr}}^{{d_1} + {d_2}}\hat Q_{{lr}}^{{d_1} + {d_2}}) \ge N_{{lr}}^{{d_1} + {d_2}}Q_{{lr}}^{{d_1} + {d_2}} \ge \underline \Delta (N_{{lr}}^{{d_1} + {d_2}}\hat Q_{{lr}}^{{d_1} + {d_2}});\\&\quad\;{\rm{for}}\,{\rm{any}}\,l{\rm{,}}r \in {\rm{\{}}\lambda {\rm{,}}o{\rm{\}}},\\&{\bar \Delta (N_{\lambda o + o\lambda}^{{d_1} + {d_2}}\hat Q_{\lambda o + o\lambda}^{{d_1} + {d_2}}) \ge N_{\lambda o + o\lambda}^{{d_1} + {d_2}}Q_{\lambda o + o\lambda}^{{d_1} + {d_2}} \ge \underline \Delta (N_{\lambda o + o\lambda}^{{d_1} + {d_2}}\hat Q_{\lambda o + o\lambda}^{{d_1} + {d_2}})\;,}\\&\bar \Delta (N_{\lambda \lambda}^{{d_1} + {d_2}}\hat T_{\lambda \lambda}^{{d_1} + {d_2}} + {N_{{oo}}}{{\hat Q}_{{oo}}}/2) \ge N_{\lambda \lambda}^DT_{\lambda \lambda}^{{d_1} + {d_2}} \\&\;\;+ {N_{{oo}}}{Q_{{oo}}}/2 \ge \underline \Delta (N_{\lambda \lambda}^{{d_1} + {d_2}}\hat T_{\lambda \lambda}^{{d_1} + {d_2}} + {N_{{oo}}}{{\hat Q}_{{oo}}})\;,\end{split}$$

where $\lambda \in \{\nu ,\omega \}$; and

(A8)$$\begin{split}&{\bar E _{\lambda ,11}^D = \max :\frac{{[T_{\lambda \lambda}^D + p_0^\lambda p _0^{\prime\lambda} {T_{{oo}}}] - [p_0^\lambda T_{{o\lambda}}^D + p _0^{\prime\lambda} T_{\lambda o}^{{d_1} + {d_2}}]}}{{p_1^\lambda p _1^{\prime \lambda}}};}\\&{\rm s.t.:}\\&{\bar \Delta (N_{\lambda \lambda}^D\hat T_{\lambda \lambda}^{{d_1} + {d_2}}) \ge N_{\lambda \lambda}^DT_{\lambda \lambda}^D \ge \underline \Delta (N_{\lambda \lambda}^D\hat T_{\lambda \lambda}^D);}\\&{\bar \Delta (N_{{lr}}^D\hat Q_{{lr}}^{{d_1} + {d_2}}) \ge N_{{lr}}^DQ_{{lr}}^D \ge \underline \Delta (N_{{lr}}^D\hat Q_{{lr}}^D);\;{\rm{for}}\,{\rm{any}}\,l{\rm{,}}r \in {\rm{\{}}\lambda {\rm{,}}o{\rm{\}}},}\\&{\bar \Delta (N_{\lambda o + o\lambda}^D\hat Q_{\lambda o + o\lambda}^D) \ge N_{\lambda o + o\lambda}^DQ_{\lambda o + o\lambda}^D \ge \underline \Delta (N_{\lambda o + o\lambda}^D\hat Q_{\lambda o + o\lambda}^D)\;,}\\&\bar \Delta (N_{\lambda \lambda}^D\hat T_{\lambda \lambda}^D + {N_{{oo}}}{{\hat Q}_{{oo}}}/2) \ge N_{\lambda \lambda}^DT_{\lambda \lambda}^D \\&\;\;+ {N_{{oo}}}{Q_{{oo}}}/2 \ge \underline \Delta (N_{\lambda \lambda}^D\hat T_{\lambda \lambda}^D + {N_{{oo}}}{{\hat Q}_{{oo}}}/2),\end{split}$$

where $\lambda \in \{\nu ,\omega \}$.

With the above variables, a tight $C$ can be estimated by

(A9)$$\begin{split}&{\underline C = \min :\sum\limits_{d \in D} {{(1 - 2e_{1,1}^d)}^2},}\\&{\rm s.t.:}\\&{e_{1,1}^d \ge 0,}\\&{e_{1,1}^d \le \min (\bar E _{\nu ,11}^d,\bar E _{\omega ,11}^d)/{{\underline Y}_{1,1}},}\\&{e_{1,1}^{{d_1}} + e_{1,1}^{{d_2}} \le 2\min (\bar E _{\nu ,11}^{{d_1} + {d_2}},\bar E _{\omega ,11}^{{d_1} + {d_2}})/{{\underline Y}_{1,1}},\;}\\&{\sum\limits_{d \in D} e_{1,1}^d \le 4\min (\bar E _{\nu ,11}^D,\bar E _{\omega ,11}^D)/{{\underline Y}_{1,1}};}\\&{{\rm{for}}\,d{\rm{,}}{d_{{1}}}{\rm{,}}{d_{{2}}} \in D\;{\rm{and}}\;{d_{{1}}} \ne {d_{{2}}}.}\end{split}$$

The information leakage ${I_{{AE}}}$ is

(A10)$${I_{{AE}}} = \left({1 - \bar e _{1,1}^S} \right){H_2}\left({\frac{{1 + u}}{2}} \right) + \bar e _{1,1}^S{H_2}\left({\frac{{1 + v}}{2}} \right),$$

where

Table 4. Data Size of Each Variable for the Decoy-State Method

View Table | View all tables in this article

Table 5. Observed Values of Each Variables for the Decoy-State Method

View Table | View all tables in this article

(A11)$$\begin{split}&{u = \min (\sqrt {\underline C /2} /(1 - \bar e _{1,1}^S),1),}\\&{v = \sqrt {\underline C /2 - {{(1 - \bar e _{1,1}^S)}^2}{u^2}} /\bar e _{1,1}^S.}\end{split}$$

The secret key rate can be estimated by the GLLP formula:

(A12)$$R \ge {P_\mu ^{Z2}}\left\{{{{p_1^{\mu 2}}}{{\underline Y}_{1,1}}[1 - {I_{{AE}}}] - Q_{{\mu\mu}}^Sf{H_2}(E_{{\mu\mu}}^S)} \right\},$$

where $P_\mu ^Z$ denotes the probability that User A (B) selects $Z$ basis and intensity $\mu$, $p_1^\mu =\mu{e^{-\mu}}$ is the Poisson probability of single photon for the coherent state with intensity $\mu$, $Q_{{\mu\mu}}^S$ and $E_{{\mu\mu}}^S$ denote the yield and QBER when both User A and User B prepare the quantum state with $Z$ and $\mu$, and the ${H_2}(x) = - x\,\mathop {\log}\nolimits_2 \,x - (1 - x)\,\mathop {\log}\nolimits_2 (1 - x)$ is the Shannon entropy.

APPENDIX B: EXPERIMENTAL RESULTS

The continually monitoring results of visibility are shown in Fig. 7. The visibility is obtained by [68]

(B1)$${{\rm visibility} = \frac{{{N_r} - {N_c}}}{{{N_r}}}},$$

where ${N_r}$ and ${N_c}$ are the counts of coincidence under full and no interference. The ${N_c}$ can be collected by recording the coinstantaneous outputs of two SPDs, while the ${N_r}$ are calculated by the count rates of SPDs,

(B2)$${{N_r} = \frac{{{N_{D1}} \times {N_{D2}}}}{{{N_d}}}},$$

where ${N_{D1}}$ and ${N_{D2}}$ are the counts of SPDs and ${N_d}$ represents the triggered times in the statistical period. The product represents no correlation between SPDs.

Table 4 lists the data size of each variable required by the decoy-state method. Here we take the same value in two- and three-user key generations. The observed values of each variables are listed in Table 5.

In Table 5, the remarks M and N represent the monopolize mode and network mode of the two-user and three-user scenarios, respectively.

Funding

National Key Research and Development Program of China (2016YFA0302600); National Natural Science Foundation of China (61475148, 61575183, 61622506, 61627820, 61675189, 62105318); China Postdoctoral Science Foundation (2021M693098); Anhui Initiative in Quantum Information Technologies.

Disclosures

The authors declare that there are no conflicts of interest related to this paper.

Data availability

Data underlying the results presented in this paper are not publicly available at this time but may be obtained from the authors upon reasonable request.

REFERENCES

1. C. H. Bennett and G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” in Conference on Computers, Systems & Signal Processing, Bangalore, India, 1984, p. 175.

2. A. K. Ekert, “Quantum cryptography based on Bell’s theorem,” Phys. Rev. Lett. 67, 661–663 (1991). [CrossRef]  

3. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002). [CrossRef]  

4. D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, “Security of quantum key distribution with imperfect devices,” Quantum Info. Comput. 4,  325–360 (2004). [CrossRef]  

5. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. 81, 1301–1350 (2009). [CrossRef]  

6. S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden, “Advances in quantum cryptography,” Adv. Opt. Photon. 12, 1012–1236 (2020). [CrossRef]  

7. P. D. Townsend, “Quantum cryptography on multiuser optical fibre networks,” Nature 385, 47–49 (1997). [CrossRef]  

8. M. Razavi, “Multiple-access quantum key distribution networks,” IEEE Trans. Commun. 60, 3071–3079 (2012). [CrossRef]  

9. B. Fröhlich, J. F. Dynes, M. Lucamarini, A. W. Sharpe, Z. Yuan, and A. J. Shields, “A quantum access network,” Nature 501, 69–72 (2013). [CrossRef]  

10. S. Wehner, D. Elkouss, and R. Hanson, “Quantum internet: a vision for the road ahead,” Science 362, eaam9288 (2018). [CrossRef]  

11. C. Elliott, “Building the quantum network,” New J. Phys. 4, 46 (2002). [CrossRef]  

12. C. Elliott, A. Colvin, D. Pearson, O. Pikalo, J. Schlafer, and H. Yeh, “Current status of the DARPA quantum network,” Proc. SPIE 5815, 138–149 (2005). [CrossRef]  

13. M. Peev, C. Pacher, R. Alléaume, et al., “The SECOQC quantum key distribution network in Vienna,” New J. Phys. 11, 075001 (2009). [CrossRef]  

14. W. Chen, Z.-F. Han, T. Zhang, H. Wen, Z.-Q. Yin, F.-X. Xu, Q.-L. Wu, Y. Liu, Y. Zhang, X.-F. Mo, Y.-Z. Gui, G. Wei, and G.-C. Guo, “Field experiment on a ‘star type’ metropolitan quantum key distribution network,” IEEE Photon. Technol. Lett. 21, 575–577 (2009). [CrossRef]  

15. S. Wang, W. Chen, Z.-Q. Yin, Y. Zhang, T. Zhang, H.-W. Li, F.-X. Xu, Z. Zhou, Y. Yang, D.-J. Huang, L.-J. Zhang, F.-Y. Li, D. Liu, Y.-G. Wang, G.-C. Guo, and Z.-F. Han, “Field test of wavelength-saving quantum key distribution network,” Opt. Lett. 35, 2454–2456 (2010). [CrossRef]  

16. T.-Y. Chen, J. Wang, H. Liang, W.-Y. Liu, Y. Liu, X. Jiang, Y. Wang, X. Wan, W.-Q. Cai, L. Ju, L.-K. Chen, L.-J. Wang, Y. Gao, K. Chen, C.-Z. Peng, Z.-B. Chen, and J.-W. Pan, “Metropolitan all-pass and inter-city quantum communication network,” Opt. Express 18, 27217–27225 (2010). [CrossRef]  

17. D. Stucki, M. Legré, F. Buntschu, et al., “Long-term performance of the SwissQuantum quantum key distribution network in a field environment,” New J. Phys. 13, 123001 (2011). [CrossRef]  

18. M. Sasaki, M. Fujiwara, H. Ishizuka, et al., “Field test of quantum key distribution in the Tokyo QKD network,” Opt. Express 19, 10387–10409 (2011). [CrossRef]  

19. S. Wang, W. Chen, Z.-Q. Yin, et al., “Field and long-term demonstration of a wide area quantum key distribution network,” Opt. Express 22, 21739–21756 (2014). [CrossRef]  

20. Y.-A. Chen, Q. Zhang, T.-Y. Chen, et al., “An integrated space-to-ground quantum communication network over 4,600 kilometres,” Nature 589, 214–219 (2021). [CrossRef]  

21. Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, T.-Y. Chen, and J.-W. Pan, “Measurement-device-independent quantum key distribution over untrustful metropolitan network,” Phys. Rev. X 6, 011024 (2016). [CrossRef]  

22. S. Wengerowsky, S. K. Joshi, F. Steinlechner, H. Hübel, and R. Ursin, “An entanglement-based wavelength-multiplexed quantum communication network,” Nature 564, 225–228 (2018). [CrossRef]  

23. S. K. Joshi, D. Aktas, S. Wengerowsky, M. Lončarić, S. P. Neumann, B. Liu, T. Scheidl, G. C. Lorenzo, Ž. Samec, L. Kling, A. Qiu, M. Razavi, M. Stipčević, J. G. Rarity, and R. Ursin, “A trusted node–free eight-user metropolitan quantum communication network,” Sci. Adv. 6, eaba0959 (2020). [CrossRef]  

24. G.-Z. Tang, S.-H. Sun, and C.-Y. Li, “Experimental point-to-multipoint plug-and-play measurement-device-independent quantum key distribution network,” Chin. Phys. Lett. 36, 070301 (2019). [CrossRef]  

25. X. Zhong, W. Wang, L. Qian, and H.-K. Lo, “Proof-of-principle experimental demonstration of twin-field quantum key distribution over optical channels with asymmetric losses,” npj Quantum Inf. 7, 8 (2021). [CrossRef]  

26. X. Zhong, W. Wang, R. Mandil, H.-K. Lo, and L. Qian, “Simple multiuser twin-field quantum key distribution network,” Phys. Rev. Appl. 17, 014025 (2022). [CrossRef]  

27. C. H. Park, M. K. Woo, B. K. Park, Y.-S. Kim, H. Baek, S.-W. Lee, H.-T. Lim, S.-W. Jeon, H. Jung, S. Kim, and S.-W. Han, “2×N twin-field quantum key distribution network configuration based on polarization, wavelength, and time division multiplexing,” npj Quantum Inf. 8, 48 (2022). [CrossRef]  

28. X. B. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005). [CrossRef]  

29. H. K. Lo, X. F. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005). [CrossRef]  

30. X. F. Ma, B. Qi, Y. Zhao, and H. K. Lo, “Practical decoy state for quantum key distribution,” Phys. Rev. A 72, 012326 (2005). [CrossRef]  

31. X.-B. Wang, C.-Z. Peng, and J.-W. Pan, “Simple protocol for secure decoy-state quantum key distribution with a loosely controlled source,” Appl. Phys. Lett. 90, 031110 (2007). [CrossRef]  

32. X.-B. Wang, “Decoy-state quantum key distribution with large random errors of light intensity,” Phys. Rev. A 75, 052301 (2007). [CrossRef]  

33. X.-B. Wang, C.-Z. Peng, J. Zhang, L. Yang, and J.-W. Pan, “General theory of decoy-state quantum cryptography with source errors,” Phys. Rev. A 77, 042311 (2008). [CrossRef]  

34. X.-B. Wang, L. Yang, C.-Z. Peng, and J.-W. Pan, “Decoy-state quantum key distribution with both source errors and statistical fluctuations,” New J. Phys. 11, 075006 (2009). [CrossRef]  

35. K.-I. Yoshino, M. Fujiwara, K. Nakata, T. Sumiya, T. Sasaki, M. Takeoka, M. Sasaki, A. Tajima, M. Koashi, and A. Tomita, “Quantum key distribution with an efficient countermeasure against correlated intensity fluctuations in optical pulses,” npj Quantum Inf. 4, 8 (2018). [CrossRef]  

36. G. L. Roberts, M. Pittaluga, M. Minder, M. Lucamarini, J. F. Dynes, Z. L. Yuan, and A. J. Shields, “Patterning-effect mitigating intensity modulator for secure decoy-state quantum key distribution,” Opt. Lett. 43, 5110–5113 (2018). [CrossRef]  

37. F.-Y. Lu, X. Lin, S. Wang, G.-J. Fan-Yuan, P. Ye, R. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, G.-C. Guo, and Z.-F. Han, “Intensity modulator for secure, stable, and high-performance decoy-state quantum key distribution,” npj Quantum Inf. 7, 75 (2021). [CrossRef]  

38. A. Vakhitov, V. Makarov, and D. R. Hjelme, “Large pulse attack as a method of conventional optical eavesdropping in quantum cryptography,” J. Mod. Opt. 48, 2023–2038 (2001). [CrossRef]  

39. H.-W. Li, S. Wang, J.-Z. Huang, W. Chen, Z.-Q. Yin, F.-Y. Li, Z. Zhou, D. Liu, Y. Zhang, G.-C. Guo, W.-S. Bao, and Z.-F. Han, “Attacking a practical quantum-key-distribution system with wavelength-dependent beam-splitter and multiwavelength sources,” Phys. Rev. A 84, 062308 (2011). [CrossRef]  

40. V. Makarov, A. Anisimov, and J. Skaar, “Effects of detector efficiency mismatch on security of quantum cryptosystems,” Phys. Rev. A 74, 022313 (2006). [CrossRef]  

41. V. Makarov and D. R. Hjelme, “Faked states attack on quantum cryptosystems,” J. Mod. Opt. 52, 691–705 (2005). [CrossRef]  

42. B. Qi, C.-H. F. Fung, H.-K. Lo, and X. Ma, “Time-shift attack in practical quantum cryptosystems,” Quantum Inf. Comput. 7, 73–82 (2007). [CrossRef]  

43. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]  

44. Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 800–801 (2010). [CrossRef]  

45. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Thermal blinding of gated detectors in quantum cryptography,” Opt. Express 18, 27938–27954 (2010). [CrossRef]  

46. H. Weier, H. Krauss, M. Rau, M. Fürst, S. Nauerth, and H. Weinfurter, “Quantum eavesdropping without interception: an attack exploiting the dead time of single-photon detectors,” New J. Phys. 13, 073024 (2011). [CrossRef]  

47. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum-key-distribution systems,” Phys. Rev. A 78, 042333 (2008). [CrossRef]  

48. I. Gerhardt, Q. Liu, A. Lamas-Linares, J. Skaar, C. Kurtsiefer, and V. Makarov, “Full-field implementation of a perfect eavesdropper on a quantum cryptography system,” Nat. Commun. 2, 349 (2011). [CrossRef]  

49. S. L. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012). [CrossRef]  

50. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef]  

51. M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo, “Finite-key analysis for measurement-device-independent quantum key distribution,” Nat. Commun. 5, 3732 (2014). [CrossRef]  

52. M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Overcoming the rate–distance limit of quantum key distribution without quantum repeaters,” Nature 557, 400–403 (2018). [CrossRef]  

53. X. Ma, P. Zeng, and H. Zhou, “Phase-matching quantum key distribution,” Phys. Rev. X 8, 031043 (2018). [CrossRef]  

54. X.-B. Wang, Z.-W. Yu, and X.-L. Hu, “Twin-field quantum key distribution with large misalignment error,” Phys. Rev. A 98, 062323 (2018). [CrossRef]  

55. C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, “Twin-field quantum key distribution without phase postselection,” Phys. Rev. Appl. 11, 034053 (2019). [CrossRef]  

56. R. Valivarthi, Q. Zhou, C. John, F. Marsili, V. B. Verma, M. D. Shaw, S. W. Nam, D. Oblak, and W. Tittel, “A cost-effective measurement-device-independent quantum key distribution system for quantum networks,” Quantum Sci. Technol. 2, 04LT01 (2017). [CrossRef]  

57. R. I. Woodward, Y. S. Lo, M. Pittaluga, M. Minder, T. K. Paraïso, M. Lucamarini, Z. L. Yuan, and A. J. Shields, “Gigahertz measurement-device-independent quantum key distribution using directly modulated lasers,” npj Quantum Inf. 7, 58 (2021). [CrossRef]  

58. H. Liu, W. Wang, K. Wei, X.-T. Fang, L. Li, N.-L. Liu, H. Liang, S.-J. Zhang, W. Zhang, H. Li, L. You, Z. Wang, H.-K. Lo, T.-Y. Chen, F. Xu, and J.-W. Pan, “Experimental demonstration of high-rate measurement-device-independent quantum key distribution over asymmetric channels,” Phys. Rev. Lett. 122, 160501 (2019). [CrossRef]  

59. L. Cao, W. Luo, Y. Wang, et al., “Chip-based measurement-device-independent quantum key distribution using integrated silicon photonic systems,” Phys. Rev. Appl. 14, 011001 (2020). [CrossRef]  

60. K. Wei, W. Li, H. Tan, Y. Li, H. Min, W.-J. Zhang, H. Li, L. You, Z. Wang, X. Jiang, T.-Y. Chen, S.-K. Liao, C.-Z. Peng, F. Xu, and J.-W. Pan, “High-speed measurement-device-independent quantum key distribution with integrated silicon photonics,” Phys. Rev. X 10, 031030 (2020). [CrossRef]  

61. C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, H.-P. Zeng, T. Yang, X.-B. Wang, and J.-W. Pan, “Experimental long-distance decoy-state quantum key distribution based on polarization encoding,” Phys. Rev. Lett. 98, 010505 (2007). [CrossRef]  

62. C. Wang, Z.-Q. Yin, S. Wang, W. Chen, G.-C. Guo, and Z.-F. Han, “Measurement-device-independent quantum key distribution robust against environmental disturbances,” Optica 4, 1016–1023 (2017). [CrossRef]  

63. A. Laing, V. Scarani, J. G. Rarity, and J. L. O’Brien, “Reference-frame-independent quantum key distribution,” Phys. Rev. A 82, 012304 (2010). [CrossRef]  

64. Z.-Q. Yin, S. Wang, W. Chen, H.-W. Li, G.-C. Guo, and Z.-F. Han, “Reference-free-independent quantum key distribution immune to detector side channel attacks,” Quantum Inf. Process. 13, 1237–1244 (2014). [CrossRef]  

65. C. Wang, X.-T. Song, Z.-Q. Yin, S. Wang, W. Chen, C.-M. Zhang, G.-C. Guo, and Z.-F. Han, “Phase-reference-free experiment of measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 115, 160502 (2015). [CrossRef]  

66. H. Liu, J. Wang, H. Ma, and S. Sun, “Polarization-multiplexing-based measurement-device-independent quantum key distribution without phase reference calibration,” Optica 5, 902–909 (2018). [CrossRef]  

67. B.-Y. Tang, H. Chen, J.-P. Wang, H.-C. Yu, L. Shi, S.-H. Sun, W. Peng, B. Liu, and W.-R. Yu, “Free-running long-distance reference-frame-independent quantum key distribution,” arXiv:2104.01155 (2021).

68. H. Chen, X.-B. An, J. Wu, Z.-Q. Yin, S. Wang, W. Chen, and Z.-F. Han, “Hong–Ou–Mandel interference with two independent weak coherent states,” Chin. Phys. B 25, 020305 (2016). [CrossRef]  

69. P. Zeng, H. Zhou, W. Wu, and X. Ma, “Quantum key distribution surpassing the repeaterless rate-transmittance bound without global phase locking,” arXiv:2201.04300 (2022).

70. K. Chen and H.-K. Lo, “Multi-partite quantum cryptographic protocols with noisy GHz states,” Quantum Inf. Comput. 7, 689–715 (2007). [CrossRef]  

71. Y. Fu, H.-L. Yin, T.-Y. Chen, and Z.-B. Chen, “Long-distance measurement-device-independent multiparty quantum communication,” Phys. Rev. Lett. 114, 090501 (2015). [CrossRef]  

72. M. Epping, H. Kampermann, C. Macchiavello, and D. Bruß, “Multi-partite entanglement can speed up quantum key distribution in networks,” New J. Phys. 19, 093012 (2017). [CrossRef]  

73. F. Grasselli, H. Kampermann, and D. Bruß, “Finite-key effects in multipartite quantum key distribution protocols,” New J. Phys. 20, 113014 (2018). [CrossRef]  

74. G. Murta, F. Grasselli, H. Kampermann, and D. Bruß, “Quantum conference key agreement: a review,” Adv. Quantum Technol. 3, 2000025 (2020). [CrossRef]  

75. M. Proietti, J. Ho, F. Grasselli, P. Barrow, M. Malik, and A. Fedrizzi, “Experimental quantum conference key agreement,” Sci. Adv. 7, eabe0395 (2021). [CrossRef]  

76. Y.-H. Zhou, Z.-W. Yu, and X.-B. Wang, “Making the decoy-state measurement-device-independent quantum key distribution practically useful,” Phys. Rev. A 93, 042324 (2016). [CrossRef]  

77. F.-Y. Lu, Z.-Q. Yin, G.-J. Fan-Yuan, R. Wang, H. Liu, S. Wang, W. Chen, D.-Y. He, W. Huang, B.-J. Xu, G.-C. Guo, and Z.-F. Han, “Efficient decoy states for the reference-frame-independent measurement-device-independent quantum key distribution,” Phys. Rev. A 101, 052318 (2020). [CrossRef]  

78. Z.-W. Yu, Y.-H. Zhou, and X.-B. Wang, “Statistical fluctuation analysis for measurement-device-independent quantum key distribution with three-intensity decoy-state method,” Phys. Rev. A 91, 032318 (2015). [CrossRef]  

79. Z. Zhang, Q. Zhao, M. Razavi, and X. Ma, “Improved key-rate bounds for practical decoy-state quantum-key-distribution systems,” Phys. Rev. A 95, 012333 (2017). [CrossRef]  

80. C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, “Higher key rate of measurement-device-independent quantum key distribution through joint data processing,” Phys. Rev. A 103, 012402 (2021). [CrossRef]