Open Access
Add to BibSonomy
Abstract
Information reconciliation is an essential step of continuous-variable quantum key distribution (CV-QKD) because its efficiency affects both the maximum transmission distance and the final secret key rate of the whole system. Slice reconciliation can achieve high secret key rates for the CV-QKD systems under high signal-to-noise ratios (SNRs). However, it suffers from the high designing cost of the error-correcting codes in the multi-level coding and multi-stage decoding step. To reconcile one set of data with fixed SNR, multiple error-correcting codes with different code rates need to be designed. If the channel environment changed, the code rates need to change along to maintain high reconciliation efficiency, making it complicated and costly. In this paper, we introduce polar codes into slice reconciliation and proposed a scheme that is simply constructed, effectively performed, and well adapted to the systems with wide-range and variational SNRs. Simulation results show that the proposed scheme offers reconciliation efficiency over 95% for the systems with SNRs range from 1 to 10, which can support the systems with high secret key rates. The decrease of complexity and the increase of secret key rate have great significance for a practical CV-QKD system.
© 2022 Optica Publishing Group under the terms of the Optica Open Access Publishing Agreement
1. Introduction
Quantum key distribution (QKD) [1,2] is the most studied quantum information technique by which two remote parties (Alice and Bob) can share secure secret keys even if there exists an eavesdropper (Eve). Combining one-time-pad encryption with the secret keys distributed by QKD, unconditional secure communications can be achieved. QKD protocols can be classified into discrete variable (DV) protocols and continuous variable (CV) protocols [3–5]. For CV-QKD, quantum information is encoded on the continuous variables, such as the quadratures of the coherent states [6,7]. It offers the advantages of higher secret key rates in metropolitan areas as well as the use of standard telecom components that can operate at room temperature [8]. CV-QKD consists of the quantum part and the classical part. In the quantum part, the quantum states are prepared by Alice, transmitted through an unreliable quantum channel and detected by Bob. The imperfections of the devices and the disturbances made by eavesdroppers cause the differences between the raw keys of Alice and Bob. Thus, the classical part is performed to correct the differences, eliminate the information acquired by Eve and distill the final secret keys [8]. The classical part contains base sifting, parameter estimation, information reconciliation and privacy amplification steps, which are collectively called the post-processing. Among them, information reconciliation is the most complicated and crucial step because its efficiency affects both the transmission distance and the final secret key rate of the whole system.
There are mainly two kinds of information reconciliation method for CV-QKD. For long-distance CV-QKD with signal-to-noise ratio (SNR) less than 0.5, multidimensional reconciliation is very efficient because the rotation doesn’t cause the information loss [8–11]. For low-loss short-distance CV-QKD with SNR greater than 0.5, slice reconciliation [12] can achieve higher reconciliation efficiency because it has the capability of extracting more than 1 bit of information per pulse. In slice reconciliation, one set of continuous variables is quantified into multiple sets of binary data, thus multiple error-correcting codes are multiple error-correcting codes with different code rates are applied to one set of data with fixed SNR to distill the secret keys. Most of the published studies and the reference works choose low-density parity-check (LDPC) codes because of their excellent error-correcting capability. For example, Bloch et al. implement a CV-QKD system over $25\,km$ of optical fiber using slice reconciliation based on LDPC codes, and a secret key rate of more than $2\,kbps$ is achieved with reconciliation efficiency of $88.7\%$ [13,14]. However, if the quantum channel environment changed, the code rates need to change along to maintain high reconciliation efficiency, and it is complicated to construct the degree distributions for the high-performance LDPC codes with fixed code rates. Thus, it is uneconomic for a practical system to design all the degree distributions of LDPC codes with different code rates for different SNRs in advance.
To solve this problem, we introduce polar codes into slice reconciliation and get the scheme which is simple but efficient. Polar codes are currently the only class of codes that have been proved to achieve the Shannon limit, which guarantees the error-correcting performance. Besides, the generator matrix of polar code is unique once the code length is confirmed whatever the code rate is, which means that the explicit construction method will lower the design cost. What’s more, the encoding and decoding algorithms of polar codes can be realized recursively other than iteratively. Thus the implementation of error correction could be easy and fast. All these properties make polar codes suitable for slice reconciliation, and the simulation results prove that the simply structured scheme obtains high reconciliation efficiency over $95\%$ for the SNRs from $1$ to $10$, which can support the high secret-key-rate continuous-variable quantum key distribution systems.
The rest of the paper is organized as follows. First, a slice reconciliation scheme based on polar-coded error correction with low computational complexity is proposed in Sec. 2. Then, the important parameters and the simulation results of the proposed scheme are given by Sec. 3. Finally, Sec. 4. draws the conclusion.
2. Slice reconciliation with low-complexity error correction
Slice reconciliation is composed of two parts, the quantification part and the error correction part. In our scheme, polar codes are introduced into the error correction part to reduce its designing cost and its decoding complexity. In this section, we first present the framework of the proposed scheme, then introduce the polar-coded error correction in detail.
2.1 Framework of the scheme
For the CV-QKD protocols based on the Gaussian-modulated coherent states, the quantum channel can be modeled as an additive white Gaussian noise (AWGN) channel. After the preparation, transmission and detection of the quantum states, Alice and Bob hold the raw keys that are different from each other. A post-processing procedure is applied to distill the final secret keys, and it includes four steps. The first step is base sifting, where the bases that Bob randomly chooses when he measures the quantum states are disclosed so that Alice can keep the data with corresponding bases, and those with different bases are discarded. Then there are parameter estimation step, information reconciliation step and privacy amplification step. Usually, the data they keep after the base sifting are randomly divided into two parts, one is revealed to estimate the parameters of the quantum channel and calculate the secret key rate, another takes the information reconciliation and the privacy amplification steps to extract final secret keys. Information reconciliation converts the continuous variables into binary data and eliminates the differences, which guarantees the consistency of the secret keys [15]. Privacy amplification removes the information acquired by Eve, which ensures the security of the secret keys [16]. The index to evaluate the performance of information reconciliation is the reconciliation efficiency $\beta$, and it has a significant impact on the final secret key rate $K$ which is defined as
where $I(X;Y)$ is the mutual information of Alice and Bob, $S(X;E)$ is the Von Neumann entropy of Eve’s knowledge acquired from $X$.The framework of the proposed scheme is shown in Fig. 1, $X$ and $Y$ denote the correlated continuous variables that Alice and Bob hold before the key extraction. In direct reconciliation, $X$ is quantified into $n$ sets of binary data, whereas $Y$ is quantified in reverse reconciliation. The regulation of the quantification is shown in Fig. 2 take $n=5$ as an example. In the quantification step, $X$ is converted into $\hat {X}_{1}\dots \hat {X}_{n}$, and the information that $\hat {X}_{i}$ contains grows with $i$. The first several sets of binary data contain insufficient information to distill the keys, so they could be revealed as side information to assist in decoding, with a little sacrifice of the final secret key rate. Then, as shown in Fig. 1, MLC/MSD error correction is performed to convert $\hat {X}_{i}\dots \hat {X}_{n}$ into $K_{i}\dots K_{n}$ and $Y$ into $K_{i}'\dots K_{n}'$. In the MLC part, $\hat {X}_{i}\dots \hat {X}_{n}$ are encoded respectively and the frozen bits that assists in decoding are sent to Bob. In the MSD part, $Y$ is decoded several times and the decoding results of the former are used to assist in the decoding of the later [17,18]. If $K_{i}\dots K_{n}$ equals $K_{i}'\dots K_{n}'$, error correction succeeds and the privacy amplification is applied to distill the final secret keys. Otherwise, error correction fails, and the data should be discarded. Considering the information loss caused by the quantification and the error correction, the final efficiency of slice reconciliation is given by
where $Q(X)=\{\hat {X}_{1}\dots \hat {X}_{n}\}$, and $R_i$ is the code rate of the error correction.
Fig. 1. The framework of the proposed scheme in the direct reconciliation. $X$ and $Y$ denote the continuous variables of Alice and Bob before key extraction, $\hat{\textrm{X}}_{i}$ denotes the $i^{th}$ set of binary data converted from $X$, $K_{i}$ and $K_{i}'$ denote the keys that Alice and Bob obtained after the polar-coded error correction$(1\leq i\leq n)$.
Fig. 2. The quantification regulation of slice reconciliation take $n=5$ as an example. $\Delta t$ denotes the interval length and $\hat {x}_{1}\dots \hat {x}_{n}$ denote the binary data quantified from $x$. $x$ obeys a Gaussian distribution and $f(x)$ is its probability density distribution.
2.2 Error correction with polar codes
Polar codes are constructed based on the phenomenon called channel polarization [19,20], by which the subset of $N$ independent copies of a given binary-input discrete memoryless channel (B-DMC) $W$ turns to be noiseless, while the others become completely noisy, as the code length N goes to infinity through the powers of two. The channels with higher capacities are used to transmit the information bits, while the channels with lower capacities are used to transmit the redundant bits called frozen bits. Let $\mathcal {X}$ and $\mathcal {Y}$ be the input and output alphabets of $W$, then the input and output of the $N$ uses of $W$ that transmit the polar codes with code length $N$ can be written as $x^{N}=\left (x_{1}, x_{2}, \ldots, x_{N}\right ) \in \mathcal {X}^{N}$ and $y^{N}=\left (y_{1}, y_{2}, \dots, y_{N}\right ) \in \mathcal {Y}^{N}$. The codeword $x^{N}$ is generated by
where $u^{N}$ is the concatenation of information bits and frozen bits and $G_N$ is the generator matrix. Let $\mathcal {A}$ denotes the information bits set of $u^{N}$ and $\mathcal {A}^{c}$ be the frozen bits that are known by the encoder and decoder, then (3) can be rewritten as,The selection of $\mathcal {A}$ and $\mathcal {A}^{c}$ is the key factor that affects the error correction performance. Let $W^{N}$ denotes the $N$ combination of $W$, $\{W_{N}^{(i)}:1\leq i\leq N\}$ denotes the $i^{th}$ subchannel of $W^{N}$. For binary erasure channel (BEC), the reliability of the subchannel $W_{N}^{(i)}$ can be reflected precisely by Bhattacharyya parameter which upper bounds the probability of maximum-likelihood decision error and is defined as
3. Simulation results
In this section, we first give out the calculation method and values of the essential parameters, include the optimal interval length and the optimal code rate. Then, show the performance of the proposed scheme, which consists of the reconciliation efficiency and the secret key rate.
3.1 Essential parameters
In the quantification part, the design of the interval points determines the quantification efficiency, and they are designed to maximize the mutual information $I(Q(X);Y)$, which is calculated as
The terms of Eq. (14) are defined as follows, where $\tau _{a-1}$ and $\tau _{a}$ denote the left and right endpoints of the interval $a$ [12].Fig. 3. (a) The optimal equal-width interval length of the quantification step for SNRs from 1 to 10, while $\Sigma ^{2}=1$. The blue dashed line, green dotted line and red solid line represent $n=3,4,5$ respectively. (b) The quantification efficiency corresponding to the interval length in Fig. 3(a). The blue dashed line, green dotted line and red solid line represent $n=3,4,5$ respectively.
In the error correction part, the optimal code rates of $\hat {X}_{i}\dots \hat {X}_{n}$ affects both the reconciliation efficiency and the block error rate, and can be calculated by [13],
where $I_i(s)$ follows the chain ruleFig. 4. The optimal code rates for SNRs from 1 to 10. The blue dashed line, green dotted line and red solid line represent $n=3,4,5$ respectively.
3.2 Performance
In order to fully demonstrate the performance of the proposed scheme in short distance CV-QKD system, we give the simulation results and analysis under direct and reverse reconciliation with $\Sigma ^{2}=1$ and $n=5$ on a CPU platform. $X$ or $Y$ is quantified by the interval length given by Fig. 3(a) and the code rate of each level is upper bounded by the results given by Fig. 4. The SCL decoding algorithm with list length $=8$ is applied with code length $N=2^{10}$. The parameters and the simulation results of direct reconciliation and reverse reconciliation are given by Table 1 and Table 2 respectively, where both of the direct and reverse reconciliation efficiency over 95% is achieved while FER below 20% for the SNRs from 1 to 10. The code rate of the $i^{th}$ equivalent channel is given, $i=3,4,5$. The mutual information of the 1st and 2nd slices are too small, thus the binary bits of these two slices are directly sent to the decoding party as side information assistant decoding to decrease FER. In other words, the code rate of the first two slices are zero. As shown in Table 1 and Table 2, the code rate of the 3rd slice is zero when the SNR is low. For this situaton, the binary bits of the 3rd slices are directly sents to the decoding party as side information assistant decoding too. In Ref. [11], we have achieved reconciliation efficiency over 95% within the SNR range from -20dB to 0dB. And in this paper, we obtain reconciliation efficiency over 95% when the SNR from 1 to 10. This shows that effective error correction can be obtained in all currently available distance of CV-QKD systems.
Table 1. The parameters and the simulation results of the proposed scheme in the direct reconciliation while $\Sigma ^{2}=1$, $n=5$. $I(X;Y)$ and $I(Q(X);Y)$ are the mutual information of Alice and Bob before and after the quantification. $H(Q(X))$ is the entropy of $Q(X)$, $R_i$ is the code rate of the $i^{th}$ equivalent channel, $i=3,4,5$, and $\beta _{DR}$ is the reconciliation efficiency of the direct reconciliation.
Table 2. The parameters and the simulation results of the proposed scheme in the reverse reconciliation while $\Sigma ^{2}=1$, $n=5$. $I(X;Y)$ and $I(X;Q(Y))$ are the mutual information of Alice and Bob before and after the quantification. $H(Q(Y))$ is the entropy of $Q(Y)$, $R_i$ is the code rate of the $i^{th}$ equivalent channel, $i=3,4,5$, and $\beta _{RR}$ is the reconciliation efficiency of the reverse reconciliation.
Based on the reconciliation efficiency achieved by polar codes designed in this work, we simulate the secret key rate of a CV-QKD system with one-way direct reconciliation and reverse reconciliation, and finite-size effects are taken into consideration [26], the results are given by Fig. 5(a) and 5(b) respectively. In direct reconciliation, the secret key rate of the system is high. However, the transmission loss is limted to 3dB. It can be applied to short distance applications, such as access networks. The reverse reconciliation can beat the 3dB limit, thus most of the systems use this method. As shown in Fig 5(b), the results of the secret key rate against transmission distance are shown under finite-size with the block length of $10^{9}$. The blue line represents the theoretical results when the reconciliation efficiency is 95.12%, and the ten red triangles from right to left represent secret key rates when the SNR is from 1 to 10 and their efficiencies are shown in Table 2. The field test results and the experiment results in laboratory of other works are shown in Fig. 5(b), too.
Fig. 5. (a) The finite-size secret key rate against distance with $5MHz$ repetition rate in the direct reconciliation. The three triangles correspond to SNR of 6, 7 and 8 respectively. The blue line is the theoretical key rate when the efficiency is 95.22% and the block length is $10^{9}$. (b) The finite-size secret key rate against distance with $5MHz$ repetition rate in the reverse reconciliation. The ten red triangles from right to left represent secret key rates when the SNR is from 1 to 10. The blue line is the theoretical key rate when the reconciliation efficiency is 95.12% with the block length of $N = 10^{9}$. The field test results of Ref. [8,27–29]and the experiment esults of Ref. [30–32] are given out as comparisons. Other parameters of direct reconciliation and reverse reconciliation in our results are as follows: $V_{A}=14.37$, $\xi =0.001$, $\eta =0.6$, $\alpha =0.2dB/km$, and $\nu _{el}=0.01$.
4. Conclusion
In this paper, we proposed a slice reconciliation scheme based on polar-coded error correction, by which high performance is achieved and the computational complexity is low. No codebooks or degree distributions need to be designed in advance. Only several parameters need adjustment when the environment of the quantum channel changes, which highly reduces the design cost and makes the proposed scheme well adapted to different SNRs. The optimal equal-width interval length of the quantification with different slices is given, the corresponding quantification efficiencies are over 98.75% when the slices is 5 for all the SNRs from 1 to 10. The optimal code rates of different slices are given for different SNRs. Simulation results show that the proposed scheme offers reconciliation efficiency over $95\%$ for the SNRs from $1$ to $10$ whether in direct reconciliation or reverse reconciliation. Combined with our previous work [11], high efficiency error correction can be obtained at all available SNR range. A high secret-key-rate CV-QKD system is achieved based on the low-computational-complexity error correction in a short distance system. The decrease of complexity and the increase of secret key rate have great significance for continuous-variable quantum key distribution systems. This work can be further implemented on GPU platform to improve the processing speed, and can be further studied at low SNRs.
Funding
National Natural Science Foundation of China (No. 61531003, No. 62001041); China Postdoctoral Science Foundation (No. 2020TQ0016); Fundamental Research Funds of Beijing University of Posts and Telecommunications (2022RC08); State Key Laboratory of Information Photonics and Optical Communications (IPOC2022ZT09).
Disclosures
The authors declare no conflicts of interest.
Data availability
Data underlying the results presented in this paper are not publicly available at this time but may be obtained from the authors upon reasonable request.
References
1. C. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in Proc. of IEEE Int. Conf. on Computers, Systems, and Signal Processing (Bangalore, India, 1984), (1984), pp. 175–179.
2. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. 81(3), 1301–1350 (2009). [CrossRef]
3. S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, and P. Wallden, “Advances in quantum cryptography,” Adv. Opt. Photonics 12(4), 1012 (2020). [CrossRef]
4. C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, “Gaussian quantum information,” Rev. Mod. Phys. 84(2), 621–669 (2012). [CrossRef]
5. H. Guo, Z. Li, S. Yu, and Y. Zhang, “Toward practical quantum key distribution using telecom components,” Fundamental Res. 1(1), 96–98 (2021). [CrossRef]
6. F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using gaussian-modulated coherent states,” Nature 421(6920), 238–241 (2003). [CrossRef]
7. F. Grosshans and P. Grangier, “Continuous variable quantum cryptography using coherent states,” Phys. Rev. Lett. 88(5), 057902 (2002). [CrossRef]
8. Y. Zhang, Z. Li, Z. Chen, C. Weedbrook, Y. Zhao, X. Wang, Y. Huang, C. Xu, X. Zhang, Z. Wang, M. Li, X. Zhang, Z. Zheng, B. Chu, X. Gao, N. Meng, W. Cai, Z. Wang, G. Wang, S. Yu, and H. Guo, “Continuous-variable QKD over 50 km commercial fiber,” Quantum Sci. Technol. 4(3), 035006 (2019). [CrossRef]
9. A. Leverrier, R. Alléaume, J. Boutros, G. Zémor, and P. Grangier, “Multidimensional reconciliation for a continuous-variable quantum key distribution,” Phys. Rev. A 77(4), 042325 (2008). [CrossRef]
10. X. Wang, Y. Zhang, S. Yu, B. Xu, Z. Li, and H. Guo, “Efficient rate-adaptive reconciliation for continuous-variable quantum key distribution,” Quantum Inf. Comput. 17(13&14), 1123–1134 (2017). [CrossRef]
11. C. Zhou, X. Wang, Y. Zhang, Z. Zhang, S. Yu, and H. Guo, “Continuous-variable quantum key distribution with rateless reconciliation protocol,” Phys. Rev. Appl. 12(5), 054013 (2019). [CrossRef]
12. G. Van Assche, J. Cardinal, and N. J. Cerf, “Reconciliation of a quantum-distributed gaussian key,” IEEE Trans. Inf. Theory 50(2), 394–400 (2004). [CrossRef]
13. M. Bloch, A. Thangaraj, S. Mc Laughlin, and J. Merolla, “LDPC-based Gaussian key reconciliation,” in 2006 IEEE Information Theory Workshop, (Punta del Este, Uruguay, 2006), 1633793, pp. 116–120.
14. J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R. Tualle-Brouri, S. W. McLaughlin, and P. Grangier, “Quantum key distribution over 25 km with an all-fiber continuous-variable system,” Phys. Rev. A 76(4), 042305 (2007). [CrossRef]
15. X. Wang, Y. Zhang, S. Yu, and H. Guo, “High speed error correction for continuous-variable quantum key distribution with multi-edge type ldpc code,” Sci. Rep. 8(1), 10543 (2018). [CrossRef]
16. X. Wang, Y. Zhang, S. Yu, and H. Guo, “High-speed implementation of length-compatible privacy amplification in continuous-variable quantum key distribution,” IEEE Photonics J. 10, 1–9 (2018). [CrossRef]
17. G. Ungerboeck, “Channel coding with multilevel/phase signals,” IEEE Trans. Inf. Theory 28(1), 55–67 (1982). [CrossRef]
18. U. Wachsmann, R. F. H. Fischer, and J. B. Huber, “Multilevel codes: theoretical concepts and practical design rules,” IEEE Trans. Inf. Theory 45(5), 1361–1391 (1999). [CrossRef]
19. E. Arikan, “Channel polarization: A method for constructing capacity-achieving codes for symmetric binary-input memoryless channels,” IEEE Trans. Inf. Theory 55(7), 3051–3073 (2009). [CrossRef]
20. E. Arikan, “On the origin of polar coding,” IEEE J. Select. Areas Commun. 34(2), 209–223 (2016). [CrossRef]
21. R. Mori and T. Tanaka, “Performance and construction of polar codes on symmetric binary-input memoryless channels,” in 2009 IEEE International Symposium on Information Theory, (2009), pp. 1496–1500.
22. P. Trifonov, “Efficient design and decoding of polar codes,” IEEE Trans. Commun. 60(11), 3221–3227 (2012). [CrossRef]
23. I. Tal and A. Vardy, “List decoding of polar codes,” IEEE Trans. Inf. Theory 61(5), 2213–2226 (2015). [CrossRef]
24. A. Balatsoukas-Stimming, M. B. Parizi, and A. Burg, “Llr-based successive cancellation list decoding of polar codes,” IEEE Trans. Signal Process. 63(19), 5165–5179 (2015). [CrossRef]
25. P. Jouguet, D. Elkouss, and S. Kunz-Jacques, “High-bit-rate continuous-variable quantum key distribution,” Phys. Rev. A 90(4), 042329 (2014). [CrossRef]
26. A. Leverrier, F. Grosshans, and P. Grangier, “Finite-size analysis of continuous-variable quantum key distribution,” Phys. Rev. A 81(6), 062343 (2010). [CrossRef]
27. D. Huang, P. Huang, H. Li, T. Wang, Y. Zhou, and G. Zeng, “Field demonstration of a continuous-variable quantum key distribution network,” Opt. Lett. 41(15), 3511–3514 (2016). [CrossRef]
28. P. Jouguet, S. Kunz-Jacques, T. Debuisschert, S. Fossier, E. Diamanti, R. Alléaume, R. Tualle-Brouri, P. Grangier, A. Leverrier, P. Pache, and P. Painchault, “Field test of classical symmetric encryption with continuous variables quantum key distribution,” Opt. Express 20(13), 14030–14041 (2012). [CrossRef]
29. S. Fossier, E. Diamanti, T. Debuisschert, A. Villing, R. Tualle-Brouri, and P. Grangier, “Field test of a continuous-variable quantum key distribution prototype,” New J. Phys. 11(4), 045023 (2009). [CrossRef]
30. C. Wang, D. Huang, P. Huang, D. Lin, J. Peng, and G. Zeng, “25 MHz clock continuous-variable quantum key distribution system over 50 km fiber channel,” Sci. Rep. 5(1), 14607 (2015). [CrossRef]
31. D. Huang, D. Lin, C. Wang, W. Liu, S. Fang, J. Peng, P. Huang, and G. Zeng, “Continuous-variable quantum key distribution with 1 Mbps secure key rate,” Opt. Express 23(13), 17511 (2015). [CrossRef]
32. P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, “Experimental demonstration of long-distance continuous-variable quantum key distribution,” Nat. Photonics 7(5), 378–381 (2013). [CrossRef]
