Realization of quantum secure direct communication over 100 km fiber with time-bin and phase quantum states

Rapid progress has been made in quantum secure direct communication in recent years. For practical application, it is important to improve the performances, such as the secure information rate and the communication distance. In this paper, we report an elaborate physical system design and protocol with much enhanced performance. This design increased the secrecy capacity greatly by achieving an ultra-low quantum bit error rate of <0.1%, one order of magnitude smaller than that of existing systems. Compared to previous systems, the proposed scheme uses photonic time-bin and phase states, operating at 50 MHz of repetition rate, which can be easily upgraded to over 1 GHz using current on-the-shelf technology. The results of our experimentation demonstrate that the proposed system can tolerate more channel loss, from 5.1 dB, which is about 28.3 km in fiber in the previous scheme, to 18.4 dB, which corresponds to fiber length of 102.2 km. Thus, the experiment shows that intercity quantum secure direct communication through fiber is feasible with present-day technology.


Introduction
Confidentiality of message is essential in modern communication. Traditional secure communication is using encryption, based on the computational difficulty of certain mathematical problems such as factorization large integers 1 . The rapid progress of quantum computing [2][3][4] causes anxiety over the security of those traditional communication. Physical layer security based on information theory and coding is a unique way of achieving secure communications from a more fundamental level, using Wyner's wiretap channel model 5 . Quantum secure direct communication (QSDC) is capable of estimating the secrecy capacity of realistic quantum channels enabled by the principles of quantum physics. QSDC has attracted much attention, and has become one of the strongest candidates for secure communication in the future 6 .
QSDC is different from quantum key distribution (QKD) 7,8 , which negotiates a secure key using quantum technology. QSDC and QKD perform different tasks. QSDC securely and reliably transmits information through a quantum channel with both noise and eavesdropping. Compared to classical communication where reliable transmission of information over a noisy channel is concerned, QSDC has the additional capability to ensure its security using the properties of quantum information carriers 9 . Since QSDC is a kind of communication, it is flexible to construct networks using techniques such as packet switching and so on. It has great potential for 6 G wireless communication as well 6 .
The first QSDC protocol was proposed by Long and Liu in the new millennium 10 . Since its foundation, many QSDC protocols have been proposed and experimentally demonstrated [11][12][13][14][15][16][17][18][19][20] . Recently, remarkable progress has been made, and major obstacles in its practical application have been overcome. Quantitatively security analysis and coding scheme in high-loss quantum channel have been proposed and experimentally demonstrated 21 . In that work, Qi et al. conceived a coding scheme using concatenation of low-density parity-check (LDPC) codes, pseudorandom sequences, and universal hashing families (UHF) 22,23 . This QSDC system is based on the DL04 single photon protocol 12 with phase states. It achieved an average secure information rate of 50 bps through 1.5 km fiber. Its recent update achieves 4 kbps through fiber 24 . Meanwhile, Sun et al. proposed the idea of quantum-memory-free (QMF) protocol and designed the QMF-DL04 QSDC 12,25 . This QSDC system has dispensed of quantum memory, and significantly increased the secure information rate as well. Explicitly, it realized secure transmission at 3.2 bps through an 18 km fiber at a clock-rate of 1 MHz. The system has already transmitted message over a meaningful distance, but there are still badly need for improvement in tolerable communication loss, for support of a higher clock-rate and more effective coding scheme to approach the secrecy capacity.
Against this background, we proposed a QSDC system with a new physical system design and a new efficient coding scheme, and experimentally demonstrated the system. Specifically, the primary contributions of this work are: (1) We proposed a novel design of physical system with a new protocol. We use both photonic timebin and phase states, and choose the time-bin states for eavesdropping detection and use the phase states for communicating the message. The system is free from phase and polarization drift, does not use the complicated active compensation subsystem. This enables an ultra-low quantum bit error rate (QBER) and the long-term stability against environmental noises. The new optical design uses a two-way structure, and it allows the returned pulses to bypass the modulators, which supports high clock-rate modulation up to 1 GHz, hence giving a high transmission rate; (2) We designed a QMF QSDC scheme using low-density Bose-Chaudhuri-Hocquenghem (LDBCH) codes 26-28 ; (3) We implemented the system and tested it with a clock-rate of 50 MHz through fiber at different distance. The results show that the system can resist extremely great loss. In particular, the system can communicate at 22.4 kbps through about 30 km commercial fiber and 0.54 bps through 100 km ultra-low loss fiber.

The protocol
Similar to protocols in Refs. 12,21,25 , this protocol is based on non-orthogonal states. Specifically, the time-bin states in Z: fj0i; j1ig basis are used for eavesdropping detection and the phase states in X: fjþi; jÀig basis are used for message delivery. The protocol is illustrated in Fig. 1. The basic steps of the protocol are: (1) States Preparation: Bob prepares a sequence of time-bin and phase states, 0 j i, 1 j i, jþi, jÀi. States in Z basis, 0 j i and 1 j i, represent the states passing through the short and long path of an asymmetric Mach-Zehnder interferometer, respectively. States in X basis, jþi and jÀi, are superposition states of 0 j i and 1 j i. The 0 j i and 1 j i states are prepared with probability p z , and the jþi and jÀi states are prepared with probability p x , respectively. p x þ p z ¼ 1. Then Bob sends the sequence of states to Alice over the quantum channel. the states in Z basis. Then Bob estimates the parameters of forward channel, such as QBER and loss, and tells the results to Alice through the service channel.
(3) Encoding: According to the parameters of forward channel and the estimated parameters of the backwards channel from the previous frame, Alice encodes the message. We have conceived a variant of QMF scheme and corresponding encoding methods to dispense with quantum memory during the eavesdropping detection. Please refer to materials and methods section for more detail of encoding method. (4) Modulation: According to the encoded sequence, Alice operates those remain states with two unitary operations I ¼ 0 j ih0j þ 1 j ih1j and σ Z ¼ 0 j ih0j À 1 j ih1j corresponding to bits '0' and '1', respectively. Next, Alice sends the modulated states to Bob. (5) Demodulation: Bob measures the received states that he prepared in X basis. Bob can obtain the sequence of operations I and σ Z corresponding to bits '0' and '1' by comparing the initial states and measurement results. (6) Decoding: Bob can decode the message successfully if the codes used in step 3 can completely remove the impact from QBER and loss. Then, Alice and Bob can repeat these steps again to transmit more information in the next frame. If Bob fails to decode the message, they can adjust the coding parameters to the appropriate. But when the channel is too noisy to convey information securely, they terminate the process. Please refer to materials and methods section for more detail of decoding method.

Security analysis
According to wiretap channel theory [29][30][31] , the secrecy capacity C s of the proposed protocol is and the secure information rate R s is where IðA : BÞ and IðA : EÞ are the mutual information between Alice and Bob, and between Alice and Eve respectively, R represents the error correction rate. Normally, the channel between Alice and Bob can be assumed as a cascaded channel consisting of a binary symmetric channel (BSC) and a binary erasure channel (BEC) concatenated in series 21,25 . According to noisy-channel coding theorem, IðA : BÞ cannot break Shannon limit, where Q Bob is the total gain at Bob, e x is the QBER of received states in X basis, hðxÞ ¼ Àxlog 2 x À ð1 À xÞlog 2 ð1 À xÞ. represents the binary Shannon entropy.
We consider the case of collective attack 31,32 , where Eve attaches her ancillary state E j i to the state that Bob prepares and performs a unitary operation U. The initial state can be described as a density matrix ρ B , when Alice receives the states which has been disturbed by Eve, its density matrix becomes After Alice encodes the state, it becomes where 0 j i A and 1 j i A are classical bits '0' and '1' that Alice encodes, so that ρ BE represent the states carrying the bits '0' and '1', respectively. We assume the probability of encoding bits '0' and '1' is roughly equal. For a single photon, the mutual information between Eve and Alice' classical bit is where SðρÞ represent the von Neumann entropy. Using the Gram matrix method 21,33,34 , we obtain where e z is the QBER of states in Z basis. Thus, we get IðA : EÞ, where Q Eve is the is the maximum gain at which Eve can access the qubits. Similarly, we get, where g represents the gap between Q Eve and Q Bob .

System implementation
The experimental setup is shown in Fig. 2. Bob uses an asymmetric Mach-Zehnder interferometer to split one pulse into two sub-pulses. The relative phases and intensity of sub-pulses are modulated by a phase modulator and an intensity modulator respectively. For the information carrier states jþi and jÀi, the birefringence drift is auto-compensated by the two-way structure with a Faraday rotator. These sub-pulses are generated and demodulated accurately by the same asymmetric Mach-Zehnder interferometer at Bob's end. This plug-and-play design also allows the returned pulses to bypass the modulators, which can support much higher clock-rate over 1 GHz for modulation 34 . For the states j0i and j1i for eavesdropping detection, the time of arrival at Alice' end could be directly detected by a single-photon detector. Thus, the whole system is robust for both polarization and phase without active feedback, and without a pair of matching interferometers, which greatly increases the reliability of the system with an ultra-low QBER.
The experimental parameters and performances of the system are shown in Table 1 at typical distance of 30 km and 100 km. We adjusted the channel loss to 6 dB using 25.2 km fiber and attenuator, which represents 30 km commercial fiber. Then, we replaced them with a 100 km ultra-low loss fiber to estimate the longest communication distance. For simplification and optimization, we consider the case of infinite length code. The transmittance at Alice's end is η Alice , and the efficiency of demodulation at Bob's end is η Bob .

Comparisons of secrecy capacity and secure information rate
Here, we compare the secrecy capacity and secure information rate of the proposed QSDC system with previous works 21,25 , which is shown in Fig. 3. The red curve and blue curve are the evaluated secrecy capacity using the parameters at distance of 30 and 100 km, respectively. The red and blue dots are the secure information rate at distance of 30 and 100 km, respectively. The details of coding method will be described in materials and methods section.
Although this plug-and-play design without active feedback eliminates the mismatching and phase drift of interferometer 34 , the QBER, especially in X basis, becomes larger as the distance gets longer due to the Rayleigh backscattering. Since the system operates at a repetition rate of 50 MHz, the backscattering photons are evenly distributed over the entire time domain. Therefore, the use of dispersion compensating fiber at Bob' end can reduce the count of backscattering photons, which realized our system to transmit the secure information over 100 km. We assume that the QBER with different channel loss is approximately between the QBER in the above two situations, so the actual secrecy capacity curve will be between the red curve and blue curve. Some fiber manufacturing processes, lower repetition rate or time division method can further reduce the impact of Rayleigh backscattering 34 , which can make actual secrecy capacity approach the red line at long distance. From Fig. 3, it can be seen clearly that a huge improvement of performance of this work over the results in previous works 21, 25 is obtained. For a detailed comparison, some specific results are shown in Table 2. The secrecy capacity is much larger than the previous works under the same channel loss, especially in the high channel loss parts. Meanwhile, the maximum tolerable communication loss is improved from 5.1 to 18.4 dB, which is over 100 km when using low loss fiber of 0:18 dB=km.

Discussion
In this work, a QMF QSDC with photonic time-bin and phase quantum states is proposed. We designed a new physical system and constructed the QSDC protocol. The QBER and instability are improved to an ultra-low level due to the intrinsic properties of the system. Then, a variant of QMF QSDC was constructed using the secure coding, it dispenses the use of quantum memory. Finally, we implemented the scheme, conducted tests at distance of 30 km and 100 km, and compared the results with previous works. Consequently, this system has a much higher clock-rate and maximum tolerable channel loss. Meanwhile, a new coding method using masking can further improve the performance of the system 35 . We realized the highperformance QSDC system, which is promising for the use in future intercity communication.

Coding method for quantum-memory-free QSDC
In this section, we introduce the QMF QSDC protocol used in our system. It is a variant of the QMF-DL04 QSDC protocol, conforming to the general idea of QMF QSDC 25 . The main difference is that the joint encryption and errorcontrol (JEEC) coding is replaced by the secure coding based on UHF 21,22 . Meanwhile, the generalized LDPC code based on the Hadamard codes and repetition (GLHR) codes in QMF-DL04 QSDC is replaced by the LDBCH concatenated with repetition (LDBCHR) codes to enhance the reliability of the communication. All the vectors in the rest of this paper are row vectors, unless stated otherwise. Secure infomation rate in work [25] Secure infomation rate in work [21] Secure infomation rate in this work at 30 km Secure infomation rate in this work at 100 km The symbols' definitions are introduced in the ascending order of the numbers beside them: 1. k i is the selected information length of the ith frame. 2. M k i i is a k i -bit message, which will be encoded by the secure encoding module. K k i i taken from the key pool is the key to encrypt M k i i . 3. Y k i i , one input of the preprocessing module, represents the ciphertext given by Y k i i ¼ M k i i È K k i i . The other two inputs are a local random bit sequence R lÀk i i and a random bit sequence S lÀ1 i shared over the service channel. 4. X l i is the output of the preprocessing and an input of the LDBCHR (n i , l). 5. C n i i is the codeword to be modulated on qubits using the method in Section II. 6. Qubits are transmitted to Bob through the quantum channel. 7. C n i 0 i is the received codeword and an input of LDBCHR decoding module. 8. After the transmission of C n i i , Alice and Bob can obtain the I i ðA : BÞ, I i ðA : EÞ and C s i of the i-th frame. If the decoding of LDBCH code is correct, X l i can further be used as an input of the distillation module and the UHF module. 9. Alice and Bob can distill a same secret key P i from X l i according to the results of eavesdropping detection and secrecy capacity calculation, also making use of UHF 21,22 . P i is stored in a first-in first-out (FIFO) pool.

Work flow
The quantum processes of delivering C n i i through the quantum channel and estimating I i ðA : EÞ are the same as those of the proposed scheme in results section. Here we only concentrate on the classical data stream. The details of the preprocessing, LDBCH encoding/decoding and UHF modules will be clarified in the following.
Note that I i ðA : EÞ cannot be acquired until the i-th C n i i has been transmitted. In fact, this is exactly why the previous QSDC protocols relied on quantum memory. Hence, if Alice wants to communicate the i-th frame to Bob, she has to determine k i and n i first, which should satisfy following equations:

Service channel
Demodulation Photon source Bob preprocessing is X l ¼ R lÀk ; Y k À R lÀk T ðlÀkÞ k Â Ã .
• UHF, ðX l ; S lÀ1 Þ À! f Y k The UHF module of Bob also uses T ðlÀkÞ k to recover the Y k : • LDBCHR codes, LDBCHR is a kind of cascaded codes based on LDBCH 26,28 and repetition codes. The encoding and decoding procedures are as follows.
The input X l is first encoded by a ðn 1 ; lÞ LDBCH encoder 25,27 . Denote the output as C n 1 L ¼ ðc L;1 ; c L;2 ; Á Á Á ; c L;n 1 Þ. Then, map c L;i ði ¼ 1; 2; Á Á Á ; n 1 Þ to a codeword of the ðn=n 1 ; 1Þ repetition code, C As for decoding, Bob first calculates the log-likelihood ratio (LLR) sequence U n 1 ¼ðu 1 ; u 2 ; Á Á Á ; u n 1 Þ of the received c C n 1 L . Then, input U n 1 to the decoding algorithm of LDBCH codes 25 and Bob can recover X l if the decoding is correct.

Error rate performance
This evaluation compares the error rate performances of the LDBCHR codes and the GLHR codes over the cascaded BSC-BEC channel whose error rate of BSC is set to e x ¼ 0:01 (the same as ref. 25 ). All the code parameters of the GLHR codes are also consistent with that in ref. 39 . A (4000, 2000) random Mackay LDPC code with column weight 3 and row weight 6 and the Hadamard code of order 4 are used for constructing the GLHR codes. We designed the LDBCHR codes with similar parameters. Specifically, the original LDPC for LDBCHR is a (4000, 2000) code generated by the mixed progressive edge growth -approximate cycle extrinsic message degree (PEG-ACE) algorithm 40 , whose node perspective degree distributions of variable nodes (VNs) and variable nodes (CNs) are where the maximal degrees of VNs and CNs are 6 and 7, respectively. Moreover, the (15,5) and (31,6) BCH code constraints are used to replace the single parity check constraints of the degree 6 CNs and degree 7 CNs, respectively 28 . The repeating times of LDBCHR and GLHR codes in Fig. 6a both are 61 while those in Fig. 6b both are 131. The overall coding rates are R ¼ 0:00135 and R ¼ 0:00063. We set the maximum number of iterations I max ¼ 30 for both the GLHR decoder and the LDBCHR decoder. As demonstrated in Fig. 6a, b, the LDBCHR designed in this work outperform GLHR codes in work 24 on the aspects of error rate performances. Specifically, the required receiving rates of LDBCHR are about 8% lower than that of GLHR for the bit error rate after decoding around 10 −5 . This work was supported in part by the National Natural Science  Author contributions H.Z. and Z.S. performed the experiment and coding, and analyzed the data. H.Z. and R.Q. developed ideas for both implementing methods and which physics to study. L.Y., G.L.L. and J.L. supervised all work, as well as contributed to deciding the experiment scheme and processing the data, and setting up the physical models. All authors discussed the results and contributed to the manuscript.