1. Introduction

Quantum key distribution (QKD) systems [1–3] establish shared secret keys between two legitimate users (Alice and Bob). An eavesdropper (Eve) who makes optimal physical measurements on the channel, can know, on average, none of the bits of the secret key without inducing statistical noise that reveals her presence. After Alice and Bob obtain samples of a correlated random variable by means of quantum measurements, a reconciliation phase assures agreement of Alice and Bob’s data. Finally, a privacy amplification phase uses universal hash functions to eliminate Eve’s potential partial information at the cost of shrinking the length of Alice and Bob’s shared data. Continuous variable quantum key distribution (CVQKD) makes use of coherent quantum measurements such as balanced homodyne or balanced heterodyne detection. The result is a continuous spectrum of outcomes, as opposed to the discrete spectrum resulting from the photon counting measurements used in discrete variable quantum key distribution. Unlike photon counters, homodyne and heterodyne detectors do not require dead times and thus CVQKD systems [4–11], reviewed in [12], are in principle scalable to standard telecom rates, such as 10 GHz. Though there are no theoretical limits to CVQKD distance, reconciliation efficiency requirements at low signal-to-noise ratios (SNRs) and long distances limit CVQKD in practice. Experiments report CVQKD at distances of not more than 25 km in optical fiber [7].

The security of CVQKD has been studied both for Gaussian-distributed modulation [13–17] of Alice’s signals and for discrete modulation [18–22]. For a CVQKD protocol, the net secret information per channel use can be expressed as ΔI=β I_AB-max(χBE), where β is the efficiency of the error correcting code used in the reconciliation process. For an ideal code that achieves channel capacity, β=1. The quantity I_AB is the classical mutual information for the channel and the signaling scheme between Alice and Bob, and χ_BE is the Holevo information between Bob and Eve, which bounds the upper limit of Eve’s accessible information regarding Bob’s measurements. Our recent work [22] proved the security of a CVQKD protocol designed to relax the primary bottleneck in current implementations: the time required to accomplish reconciliation. This time is strongly influenced by the value β ₀, the minimum reconciliation efficiency, which if exceeded, achieves a net positive secret key rate in terms of bits per channel use. In order to lower the efficiency requirement and increase the speed (in bits per second) of the error correcting code that achieves reconciliation, our protocol makes use of discrete signal modulation, reverse reconciliation, post-selection, and quantum state tomography of Bob’s received density matrix to bound Eve’s obtainable information.

 

Fig. 1. Conceptual schematic for (a) quadrature phase-shift keyed (QPSK) signaling, with |αi〉 chosen equiprobably and (b) effect of channel, where ρ_B|(|α ₁〉) denotes Bob’s received quantum state conditioned on Alice sending |α ₁〉. Channel loss causes an attenuation of signal amplitude. The increase in diameter indicates schematically noise that is potentially added by Eve or the channel. (c-top) Final LO spectrum before homodyne detection. (c-bottom) Final signal spectrum before homodyne detection.

Download Full Size | PDF

In this paper we describe an experimental implementation of this protocol. There are currently reported CVQKD experiments implemented in optical fiber [7–9] and others that simulate a lossy channel with a beamsplitter [5, 6, 10, 11]. Compared to the previous work, this is the first experiment to use discrete signaling over optical fiber. This paper is also the first CVQKD system that uses a continuous-wave local oscillator over fiber, which we believe to be better suited for higher speed systems. To achieve this we implement a frequency translation scheme that avoids guided acoustic wave Brillouin scattering (GAWBS) [23], an effect which otherwise contaminates the signal by scattering light from the orthogonally polarized LO. We believe this work is significant as well for potential pulsed CVQKD systems where GAWBS noise could be present at pulse rates as low as tens of MHZ. This paper is also the first QKD experiment to use optical amplification in the receiver for amplification of the LO.

The paper is organized as follows: Section 2 contains a brief description of the new CVQKD protocol, a discussion of its security can be found in [22]. Section 3 describes the experimental setup and system calibration. The experimental results are in Section 4, and Section 5 contains a summary.

2. The quantized input-quantized output CVQKD protocol

We briefly describe the protocol [22] in this section. It is similar to those proposed in [18–21] but is distinguished by its use of tomographic measurement of Bob’s quantum state which allows calculation of security when post-selection is used. It produces a relatively tight bound and allows for large secrecy capacity.

Step 1: In each time slot, Alice sends randomly and equiprobably one of four weak coherent states, as represented in Fig. 1(a), where the radius of the circle indicates somewhat arbitrarily the effective radius of quantum fluctuations.

Step 2: Each timeslot is randomly assigned by Bob to “data” or “tomography” subsets. For each data time slot, the measurement axis X or Y is randomly chosen by setting local oscillator phase to 0 or to π/2 radians. For each tomography time slot, a random local oscillator phase of 0, π/4, or π/2 is chosen. Bob also chooses a post-selection threshold. Data having absolute value less than this threshold are discarded. Positive valued data is assigned “1”, Negative data is assigned “-1”.

 

Fig. 2. Schematic of experiment, with abbreviations defined in text.

Download Full Size | PDF

Step 3: Bob now reveals which time slots contain tomography and those that contain post-selected data. Alice then reveals which state was sent during those tomography time slots. Using this information, Bob performs conditional quantum tomography for the four conditional density matrices, which permits calculation of an upper bound on the Holevo information for collective attacks. The protocol is aborted if the the Holevo information is too large.

Step 4: Bob then reveals the local oscillator phase associated with each post-selected data sample. For each of these samples, Alice projects the transmitted state onto that axis.

Step 5: Bob sends checkbits to Alice over a public channel, i.e. reverse reconcilation. Alice corrects her data to agree with Bob.

Step 6: Alice and Bob perform privacy amplification to distill the final secure key.

3. Experimental setup and calibration process

The idea of the frequency translation scheme is schematically represented in Fig. 1(c), where the LO and signal are ready to be combined on 50/50 fiber coupler BS in Fig. 2 before detection. We first describe the preparation of the frequency translated signal Fig 1(c-bottom) by Alice by devices shown in the box labeled “Alice” in Fig. 2. After separation of the LO from the signal by a 99/1 coupler, phase modulator PM2 sets the QPSK modulation, the phase shift between the LO and quantum signal. The signal, after the separation from the LO by the 99/1 coupler and attenuation by attenuator A, is placed in 50 MHz sidebands by amplitude modulator AM to avoid baseband noise of the LO in final detection. By biasing AM near the extinction point the signal light is placed entirely in two sidebands. Next, the signal is frequency translated by phase modulator PM1. The drive voltage for PM1 is chosen so that the phase shift amplitude ϕ corresponds to the first root of the Bessel function J ₀(ϕ). The result is that the signal light is ideally entirely frequency shifted away from the optical LO freqency, creating sidebands spaced 2 GHz apart. PM1 and PM2 are separate in order to safely limit the RF power per modulator. The LO and signal are combined on a polarization beam splitter (PBS1) then sent down the transmission channel fiber having linear loss of 5.18 dB.

In the fiber, guided acoustic wave Brillouin scattering (GAWBS) causes a portion of the LO to scatter into frequencies up to 1.8 GHz. These frequencies correspond to thermally populated acoustical phonon modes in the fiber that modulate the index of the fiber core. The scattering is composed of co-polarized and de-polarized components.

At the receiver, after 24.2 km of fiber, the LO power is about -6 dBm. Bob separates the LO and signal by means of PBS2, where the lengths of the LO and signal paths before recombining are matched to less than 1 mm. Due to imperfections in the PBS, about 0.07% of the LO leaks into the signal path. The small amount of leaked LO contains detectable GAWBS noise having frequency components up to 1.8 GHz, but the frequency shifted signal remains uncontaminated as it lies beyond the GAWBS spectrum of the continuous wave LO. The signal spectrum now corresponds to Fig. 1(c-bottom). We now describe how the LO is made to match the signal spectrum. At PBS2, 99.93% of the LO enters the LO path, passing through PM3 which is modulated in the same way as PM1, ideally shifting all of the LO to sidebands, as in Fig. 1(c-top). Subsequently PM4 performs Bob’s random selection of phase. An EDFA increases the power of the LO to 15.0 dBm, a 0.8 nm optical bandpass filter (OBPF) removes out-of-band ASE and the LO passes through a polarizer POL. The signal and LO are mixed on a 50/50 fiber beam splitter (49.8/50.2 in practice) and guided to two photodiodes (Epitaxx ETX75), D1 and D2, having a 1.1 GHz 3-dB bandwidth. Because the diodes have no frequency response beyond 1.4 Ghz, the different optical sidebands do not beat with each other. Because of the phase coherence of the multi-frequency LO, a single optical mode is measured. A filter follows each photodiode, separating frequencies less than 5 MHz from those greater than 5 MHz. Each photocurrent then enters a 180 degree hybrid bridge (Anzac H-9) producing an RF difference photocurrent. The difference photocurrent passes through a 25 MHz highpass filter HPF, a 50 dB-gain electrical amplifier with noise figure 0.9 dB, then a mixer that brings the 50 MHz RF frequencies to the base band. The downconverted photocurrent is finally filtered by a 1.9 MHz filter LPF for A/D sampling. The system is controlled by a computer which uses a training frame to perform real-time adjustment of the phase drift between the signal and LO by addition of a constant to Bob’s phase input to PM4. The computer also performs data post-selection and classical data correction.

The detection setup realizes between 64 and 65 dB of common mode noise suppression during experimental runs. This balancing, reached by inducing small loss on one optical fiber and electrical path matching, is sufficient to suppress excess noise due to laser RIN noise (7 dB excess noise), GAWBS noise on the LO (15 dB excess noise), and the EDFA (10 dB excess noise). The overall quantum efficiency is 0.56, with PBS efficiency 0.795, fiber beamsplitter efficiency of 0.98, photodiode efficiency 0.74, and effective transmission losses of 0.02 due to imperfect fiber beamsplitter ratio. During experiments, 7 mW of LO power impinges on each detector. At this power level the electric noise is 0.069 shot noise units. Even when no quantum signal is present, there remains residual excess noise present only when Bob’s signal path is connected. This noise is believed to be residual GAWBS noise and results in 0.002 to 0.005 shot noise units of excess noise remaining at the receiver. We hypothesize that the frequency translation scheme is imperfect due to uncertainty in polarization, modulation voltage, and possibly due to modulator waveguide imperfections. By comparing this to the excess noise present when the 2 GHz RF signal is turned off and 1.0 extra shot noise unit of GAWBS noise is measured, we estimate 27 dB of GAWBS noise suppression. When the length of the channel is 0 km, no excess noise is present whether the 2 GHz RF signal is turned off or left on.

4. Results and discussion

For a 24.2 km channel, a received signal-to-noise ratio of 0.272 (ratio of signal power to standard deviation of the shot noise) and post-selection threshold T=1.059 shot noise units meet the requirements of the error correction code used in reconciliation. Because in principle Eve could replace the communications channel with a GAWBS-free channel, adding a controlled noise-like source, the excess noise is assumed to be under the control of Eve. According to the protocol, conditional tomography for all four states has been performed. The results show that the average excess noise of the quantum channel at the detector is 0.0024 shot noise units, of which 0.0024 is due to GAWBS noise and any remaining imperfections due to the phase estimation, amplitude modulation, and phase modulation are small and difficult to measure. In Fig.3 the raw homodyne tomography histograms are shown for 10⁵ samples per phase, which show excellent agreement with the expected Gaussian distribution for coherent light with very small excess noise. For each of the four signal states transmitted by Alice, three angles are used for Bob’s tomography.

 

Fig. 3. Tomography data with Gaussian fit

Download Full Size | PDF

Given the channel transmission, detection quantum efficiency, excess noise, the post-selection threshold, and the efficiency of the error correction code (efficiency 80%, error rate 7%), we operate in a secure region [22], obtaining a final key rate of 3.45 kilobits/s. A necessary approximation in our security calculation truncates the Fock space to photon number 3, i.e., EMAX in [22] is set to 3. The error in this approximation is negligible, as setting EMAX=2 gives a secrecy capacity that differs from EMAX=3 by only 10^-7 bits/channel use. We note that unlike previous experiments, this experiment is not constrained by the time required for the error correction code, but by the data rate, which is limited by the 2 MS/s data acquisition and control card (National Instruments PCI-6115). We have not implemented automatic polarization control at the input of Bob’s PBS2, so the system operates well for 7 minutes before the polarization needs to be readjusted. The same experiment operating at a 20 MHz clock rate would leave us with a final key rate of approximately 60 kilobits/s, which compares to the best current rate of 2 kilobits/s for 25 km of fiber [7].

5. Conclusion

We have experimentally implemented a QKD system based on based on discretely signaled continuous variables using a continuous wave LO that is polarization multiplexed with the signal. GAWBS noise scattering from LO to signal was avoided by a frequency conversion technique. A final key rate of 3.45 kilobits/s at 24.2 km was achieved, which to the best of our knowledge, is currently the best performing CVQKD system over optical fiber. It is anticipated that future work will include new modulation schemes to achieve higher rates and the study of finite data size effects on the security of the system.