Introduction

Secure communications and data protection are the quintessential resources in an information-based society, with a wide range of applications such as financial transactions, ensuring personal privacy, and maintaining the integrity of critical infrastructure in the Internet of things. Quantum key distribution (QKD) allows to generate symmetric keys between distant parties, with a level of privacy that can be lower bounded from the very laws of physics. Flying qubits encoded in photons can be distributed up to distances of a few hundred kilometers in fibers1,2,3, while longer distances can be achieved by employing quantum repeaters4,5. Alternatively, optical satellite links have been proposed to overcome the distance limitations of ground-based transmission of photons6,7. The installation of quantum hardware on space platforms would also provide a platform for fundamental physics experiments8,9 and radically new technologies such as quantum clock synchronization10,11,12 and quantum metrology13. While this is a technologically immensely challenging task, a number of experimental14,15,16,17,18,19,20,21 and theoretical6,22 studies have established the feasibility of this vision with state-of-the-art technology available on ground and certified for operation in space. Consequently, in what has been called the quantum space race23, a number of international research groups in Canada, China, Europe, Japan, and Singapore are pursuing first missions involving space links24,25, with first dedicated satellite transmitter payloads successfully launched into space26,27,28,29,30.

The quantum space race has also served as a driver for the development of robust quantum technology31,32,33, with the recent years seeing tremendous advancements in quantum nonlinear optics, entangled photon generation methodology, and single-photon detection. In light of these technological advances, a re-evaluation of the improved performance characteristics of QKD via representative free-space links is critical, especially concerning the increase in secure key rate compared to earlier field trials14,34,35,36,37, illustrated in Fig. 1. Field tests based on prepare-and-measure schemes have not been included in this comparison, though we would like to mention that both terrestrial38 and satellite-based27,39 studies have demonstrated decoy-state key exchange over free-space links at high rates. Entanglement-based QKD protocols remove the need to trust the source on the satellite in a dual downlink scenario.

Fig. 1: Comparison of secure key rates.
figure 1

Only published QKD field trials over a free-space link employing polarization-entangled photon pairs are compared. The horizontal axis corresponds to the attenuation caused by the free-space link and the receiver optics. Each blue data point represents a published experiment: Peng 2005 (ref. 36), Marcikic 2006 (ref. 34), Ursin 2007 (ref. 14), Erven 2008 (ref. 35), Scheidl 2009 (ref. 37); the red data points represent the two highest key rates achieved in this work. Apart from ref. 35 and ref. 36, all experiments employ a single free-space link.

Full size image

In this article, we report on a state-of-the-art experimental feasibility study for entanglement-based satellite QKD between the islands of La Palma and Tenerife. In order to be forearmed for future satellite down-link experiments, we have developed a quantum ground receiver for polarization-based QKD protocols, which is compatible with most existing optical ground stations (OGSs) with satellite tracking capabilities. We distributed entangled photons from an ultra-bright source over a 143-km-long atmospheric free-space link with >0 dB total channel loss, which is comparable to the average down-link loss for a low earth orbit (LEO) satellite pass40. Additionally, we measured the background sky noise for a typical pass of a LEO satellite. Under these conditions, we implemented the BBM92 protocol41, supplemented by error correction and privacy amplification, which yielded secure key rates up to 300 bits per second (bps) including finite-size-effects42, which ranks amongst the highest key rates over a free-space channel with >40 dB total channel loss. This was achieved by adapting the pair production rate to the current channel attenuation. The same model-based optimization which has proven successful for our terrestrial free-space link was subsequently used to estimate achievable secure key rates in a LEO dual downlink scenario26. Our results provide updated estimates for entanglement-based satellite-ground QKD and provide a valuable guideline for the design of future space missions.

Results

Setup of field trial

The goal of QKD is the distribution of a secure key between Alice and Bob, which is subsequently used for the symmetric encryption of private messages. In our field trial, these communicating parties were located on the Canary islands of La Palma (Alice) and Tenerife (Bob). A source of polarization-entangled photon pairs (photon A and B) was placed near the Jacobus Kapteyn Telescope of the Roque de los Muchachos Observatory on La Palma at an altitude of 2360 m. Photon A was sent to Alice’s detection module via a few meters of single-mode fiber, while photon B was transmitted through a 143-km-long free-space link, after which it was collected by a reflector telescope in the OGS of the Observatorio del Teide at an altitude of 2400 m (see Fig. 2). In order to compensate for slow beam drifts caused by the atmosphere, the transmitter and receiver telescopes were actively guided toward each other based on bidirectionally overlapped green beacon lasers. Both Alice’s and Bob’s detection modules are comprised of a random polarization basis choice, realized by a beam splitter, followed by a projection on one of two conjugate polarization bases. The different parts of the experimental setup are described in more detail in the ‘Methods’ section. In the following, we will elaborate on the performance of the free-space link and on the distillation of a secure key from priorly distributed entangled photon pairs.

Fig. 2: Sketch of the experimental setup.
figure 2

Alice and Bob were located on the Canary islands of La Palma and Tenerife, respectively, amounting to a free-space link distance of 143 km. Polarization-entangled photon-pairs were produced in SPDC by bidirectionally pumping a ppKTP crystal placed in the center of a Sagnac interferometer. Both Alice’s and Bob’s measurements were preceded by a random polarization basis choice realized by non-polarizing beamsplitters (BS). The measurement in one of two mutually unbiased polarization bases was achieved by polarizing beamsplitters (PBS), followed by detection with single-photon avalanche diodes (SPAD). All detection events were recorded with time-to-digital converters (TDC) disciplined by pulse-per-second signals from GPS clocks. Storage and post-processing of the timestamps was done with PCs, which were both connected to the Internet, constituting the classical communication channel. For the purpose of pointing, acquisition, and tracking, the quantum channel was bidirectionally overlapped with two green 532-nm beacon lasers. Map data © 2017 Google.

Full size image

QKD over the free-space link

A well-characterized communication channel is pivotal for long-distance quantum communication. Different from optical links over glass fibers, free-space links experience time-varying loss due to atmospheric turbulence. This results in a single-photon count rate at Bob which is fluctuating in time (Fig. 3a), while Alice detects her partner photon with a constant single-photon rate of 13.3 Mcps. After identifying the coincidences between these vastly different single-photon count rates, Alice and Bob share a raw key. In basis reconciliation, they classically communicate their random basis choice and discard all events with unmachted measurement bases, resulting in a sifted key (Fig. 3b). From this sifted key, a quantum bit error rate (QBER) can be estimated (Fig. 3c). The QBER is higher at times of low channel transmission, since the constant background count rate leads to a lower signal-to-noise ratio. QKD at high rates requires a precise time-synchronization between the communication parties. We harness the strong intensity correlations of the photon pairs in order to compensate for relative clock drifts (Fig. 3d). The retrieved two-photon correlation peak (see inset) exhibits a width which corresponds to the timing-jitter of the detection and electronic systems. Photon pair detections are subsequently identified using a coincidence window of 1 ns. For these post-processing steps, we use a custom software which is capable of coincidence retrieval on a sub-second timescale. This enables us to align free-space links based on coincidence detections.

Fig. 3: Performance of the free-space link over time.
figure 3

One of the photons is detected in Alice’s laboratory at a rate of 13.3 Mcps, while the polarization-entangled partner photon is sent over the free-space link. a Due to atmospheric turbulence, the rate of single photons Bob receives is varying over time. Each data point corresponds to an integration time of 1 s. b Sifted key rate and c Quantum bit error rate (QBER) of the BBM92 protocol41. d Relative clock drift between Alice and Bob around the time-of-flight offset of 478.12 μs. The inset depicts the normalized correlation peak of two-photon detections after time synchronization with a resolution of 156 ps.

Full size image

In order to estimate the length of the secure key Nf, we use the bound

$$\begin{array}{l}{N}_{\text{f}}\ge {N}_{\,\text{s}}^{\text{z}\,}\left[1-{H}_{2}\left({E}_{\tilde{\mu }}^{\,\text{ph},\text{z}\,}\right)-f\left({E}_{\tilde{\mu }}^{\,\text{z}\,}\right){H}_{2}\left({E}_{\tilde{\mu }}^{\,\text{z}\,}\right)\right]\\ \quad\quad\quad+{N}_{\,\text{s}}^{\text{x}\,}\left[1-{H}_{2}\left({E}_{\tilde{\mu }}^{\,\text{ph},\text{x}\,}\right)-f\left({E}_{\tilde{\mu }}^{\,\text{x}\,}\right){H}_{2}\left({E}_{\tilde{\mu }}^{\,\text{x}\,}\right)\right],\end{array}$$
(1)

which is derived in refs 42,43,44. Here, \({N}_{\,\text{s}}^{\text{z}\,}\) (\({N}_{\,\text{s}}^{\text{x}\,}\)) is the sifted key length in the Z(X)-basis. The QBER in the two bases are \({E}_{\tilde{\mu }}^{\,\text{z}\,}=6.6 \%\) and \({E}_{\tilde{\mu }}^{\,\text{x}\,}=7.07 \%\), while \({E}_{\tilde{\mu }}^{\,\text{ph},\text{z}\,}\) (\({E}_{\tilde{\mu }}^{\,\text{ph},\text{z}\,}\)) denotes the estimated phase error rate in the z(x)-basis. All error rates are evaluated as arguments of the binary entropy function H2(x), with an error correction efficiency for the low-density parity-check (LDPC) code of f(x) = 1.2. Allowing for a failure probability of εph = 10−5 and disregarding finite-size effects, the average key rate is 71.8 bps over the whole measurement time of 68 s (see Supplementary Table 1). Within a 15-s measurement interval (gray region in Fig. 3), the average secure key rate is 300 bps with an average attenuation of 38.72 dB (from the source to Bob’s detectors).

In a next step, we investigate the relationship between the secure key rate and the link loss. To this end, the measurement data are sliced in 100-ms time-bins and the attenuation of Bob’s channel within each time-bin is obtained by

$${\alpha }_{{\rm{ch}}}[\,\text{dB}\,]=-10{\mathrm{log}\,}_{10}\left(\frac{{R}_{\text{CC}}-{R}_{\text{A}}{R}_{\text{B}}{\tau }_{\text{cw}}}{{R}_{\text{A}}}\right),$$
(2)

where RCC is the coincidence count rate, RA and RB are the single count rates of Alice and Bob, and τcw is the coincidence window. The total channel attenuation is given by adding another 4.8 dB for Alice’s channel loss. After grouping the losses in 1-dB intervals, we calculate the average loss and the corresponding secure key rate within this interval as shown in Fig. 4. The secure key rates obtained from the measurement data coincide with the model in Eq. (1) without any free parameters.

Fig. 4: Variation of the secure key rate as a result of atmospheric turbulence.
figure 4

Beam wander and beam spreading across the free-space link lead to a fluctuating channel attenuation. This is quantified by binning a 148-s-long measurement in 100-ms intervals, in each of which the loss is computed via Eq. (2). The starlike data points correspond to the frequency of these bins, while the circular data points correspond to the average secure key rate within 1-dB loss-bins, where the horizontal error bars indicate the standard deviation of the corresponding average loss. The link is modeled according to Eq. (1) and the resulting rate is plotted (solid line). See Supplementary Table 2 for further details.

Full size image

Optimization of the key rate

While the loss across the channel is not under our control, both the source and the receiver offer adjustable parameters, the most important of which are the emitted pair rate and the coincidence window. For our setup, the maximal key rate is achieved with a coincidence window of 1 ns, which does not necessarily coincide with the minimal QBER. In general, the optimal coincidence window depends on the timing jitter of the detection and electronic systems and the clock synchronization accuracy. Adjusting the emitted photon pair rate μ is easily achieved by tuning the power of the pump laser (see ‘Methods’ section for experimental details). Interestingly, the secure key rate is not proportional to the pair rate of the source due to limitations in photon detection. These limitations include accidental coincidence counts and nonlinear detector responses such as afterpulsing45 and dead-time effects, which we include in our model. As a consequence, higher pair rates result in higher QBERs, which lead to a decline in secure key rate after a loss-specific optimal pair rate μopt (see Fig. 5)46. Operating the link at μopt leads to the highest achievable secure key rate SKR\({\,}_{\max }\). While the plateau around SKR\({\,}_{\max }\) is very broad for low average losses, adjusting the source to μopt for high average link losses is more delicate (see inset). The highest key rate we could have achieved is close to 500 bps, which is ~60% higher than the key rate we observed. Unfortunately, most of our measurements were not operated at μopt due to a lack of a detailed model at the time of the measurements. However, the measurements we performed (see Supplementary Table 3) coincide with our model predictions, again indicating the validity of our model.

Fig. 5: Achievable secure key rates over a single free-space link.
figure 5

The solid lines are model calculations for four different average total link attenuations corresponding to five of our measurements (stars). While the maximal achievable secure key rate SKR\({\,}_{\max }\) decreases for increasing attenuation, the optimal photon pair rate μopt to achieve SKR\({\,}_{\max }\) shifts to lower pair rates. The inset illustrates this tendency and highlights the tolerance (⩾90% of SKR\({\,}_{\max }\)) to pair rate fluctuations around μopt.

Full size image

With a valid model of our free-space channel at hand, we can now predict secure key rates achievable in a LEO dual downlink scenario. From the measurement data of the Micius dual downlink experiment26,30, we know which losses and background count rates to expect. Based on specifications of the Micius satellite and the Chinese ground stations, the dual downlink is modeled (see Supplementary Information) and yields the secure key rates plotted in Fig. 6. The link loss is influenced by the elevation angle of the satellite and ranges from 60 dB to 80 dB. For two symmetrical high-loss channels, the optimal pair rate μopt is almost independent of the total channel attenuation and with a coincidence window of 2.5 ns and 5.9 million photon pairs per second, the Micius dual downlink is operated close to the optimal pair rate μopt (see Fig. 6).

Fig. 6: Achievable secure key rates in a symmetric dual downlink scenario.
figure 6

The model parameters are taken from the Micius dual downlink experiment26. Each channel attenuation has a specific optimal pair rate μopt which yields the maximal achievable secure key rate. Additionally, the photon pair rate μMicius emitted by Micius’ entangled source is marked. The colored region corresponds to the link attenuation range of the Micius dual downlink.

Full size image

Discussion

We presented a QKD field trial over a free-space channel with a link distance of 143 km. This constitutes a worst-case scenario for satellite-based QKD with a LEO downlink in terms of channel attenuation26, astronomical seeing14, and sky noise. One of the main challenges of a satellite downlink, namely pointing and tracking in orbit, could not be simulated on our terrestrial free-space link. We used the polarization degree of freedom to distribute entangled photon pairs between the communicating parties and extracted a secure key with the BBM92 protocol. By employing state-of-the-art single-photon detectors and an ultra-bright source of entangled photon pairs, we obtained a secure key rate of 154 bps over 85 s with an average total channel loss of 46.9 dB and a record secure key rate of 300 bps over 15 s with an average total channel loss of 43.5 dB, including finite-size-effects. Continuous key generation over longer timescales is irrelevant for a LEO scenario, since typical satellite passes are limited by a few minutes of link time and as opposed to our terrestrial link, the downlink-attenuation is not heavily fluctuating on a second timescale26,40. The obtained secure key rates agree with our models, which factor in all relevant source, detector, and channel characteristics. Our results are also comparable to the predicted average key rate of ~350 bps in the case of higher triggering efficiencies in a Micius satellite downlink40.

Although the attenuation in a satellite down-link is set by the orbit of the satellite, both the transmitter as well as the receiver can be optimized according to current link conditions. An important parameter in this regard is the photon pair rate emitted by the source, which can be optimized depending on the channel loss and the detector characteristics. The elevation angle of a LEO satellite leads to channel attenuations ranging from 29 dB to 45 dB40, which makes an adjustment of the photon pair rate on the satellite indispensable in order to maximize the number of secure bits exchanged within a short LEO satellite pass. Monitoring this time-varying attenuation could be accomplished by measuring the power of the beacon or synchronization laser at the satellite. This information can be used to adjust the pump power of the spaceborne photon pair source on the timescale of several milliseconds in order to adapt to current atmospheric conditions. However, small deviations from the optimal pair rate do not lead to a significant change in secure key rate, which relaxes the requirements on the output power stabilization of diode lasers launched into space substantially.

Additionally to the experimental investigation of a single free-space link, we modeled the dual downlink from Micius, which yielded optimal photon pair rates close to the actual pair rates achieved by Micius. In the case of two nearly symmetrical high-loss channels, the optimal photon pair rate is not changing significantly as a function of the channel loss. However, since Micius and follow-up satellites will connect to an increasing number of ground stations around the globe, it is important to note that each receiver will have different frequency standards and detector characteristics, which yields different optimal coincidence windows and photon pair rates. As opposed to static fiber-based networks, a future satellite-based QKD network will therefore heavily rely on models dynamically predicting optimal parameters based on current link and receiver conditions.

In our study, we intended to showcase obtainable secure key rates with state-of-the-art sources and receivers. A number of technological advancements must be accomplished in order to significantly increase these key rates. While the brightness of photon-pair sources based on quasi-phase matching in spontaneous parametric down-conversion (SPDC) is sufficient to operate both single and dual down-links at the maximal key rate, as shown in this study, this is only true for detection with semiconductor single-photon detectors. The advancements in superconducting nanowire single-photon detectors (SNSPDs)47 are promising for high-loss quantum communication, since they are characterized by short dead-times, negligible dark counts, very high detection efficiencies, and low timing-jitter48. However, these detectors cannot be straightforwardly employed for free-space applications, since they currently only exist in single-mode coupling. In order to make SNSPDs free-space compatible, the multi-mode beam could be either coupled in single-mode fibers with adaptive optics or directly impinge on the nanowire through a vacuum viewport. Due to their better timing resolution and higher maximal count rates, these detectors will increase the optimal pair rate significantly. For typical SNSPD specifications (see Supplementary Table 4), the optimal pair rate in a dual downlink is 814 Mcps. Recent developments on ultra-bright photon pair sources, however, show that such values are well within reach49,50.

In order to decrease the rate of detected background photons, tight filtering in the spatial and spectral domain of the photons is inevitable, which has already been demonstrated for terrestrial free-space links51,52. Further measures to mitigate noise include adaptive optics53 and ultra-narrowband photon pair sources54. Frequency multiplexing of polarization-entangled photon pairs55 is an efficient way to increase the secure key rate over free-space links, since each frequency channel can be operated at the optimal pair rate, while the added complexity is shifted to the receivers on ground. Another possible avenue for high-rate QKD is the distribution of high-dimensional entanglement over free-space links56, which increases the per-photon information capacity57,58 and enhances the resilience against noise59. We hope that this work will prove beneficial in the design of future LEO missions. The employment of state-of-the-art quantum sources and receivers together with the dynamical prediction of optimal parameters in orbit enable high key rates and pave the way toward QKD on a global scale.

Methods

Ultra-bright entangled photon-pair source

The source of photon pairs was based on type-0 SPDC. In order to achieve polarization entanglement, a periodically poled KTiOPO4 (ppKTP) crystal was placed within a polarization Sagnac interferometer60,61,62. The 20-mm-long ppKTP crystal was bi-directionally pumped with a continuous-wave diode laser tuned to 405 nm, tightly focused on the crystal for increased brightness. By tuning the temperature of the crystal, photons with non-degenerate central wavelengths λA = 774 nm and λB = 840 nm were produced. Using dichroic filters, the photon pair was separated in two distinct spatial modes and coupled into single-mode fibers.

After longpass and 3-nm-bandpass filtering, the source produced a local two-fold detection rate of ~280 kcps per mW of pump power with a symmetric heralding efficiency of ~33%. Polarization entanglement was verified by measuring the second-order interference Visibilities V in the rectilinear (H/V) and diagonal (D/A) polarization basis. Typical experimental values yielded VH/V = 99% and VD/A = 98.5% measured locally, which corresponds to a Fidelity F = (VH/V + VD/A)/2 ≃ 0.987 with the maximally entangled Bell state \(\left|{\Phi }^{-}\right\rangle =1/\sqrt{2}\left(\left|{H}_{\text{A}}{V}_{\text{B}}\right\rangle -\left|{V}_{\text{A}}{H}_{\text{B}}\right\rangle \right)\).

Detection modules

Both Alice’s and Bob’s measurements were preceded by a random polarization basis choice implemented by non-polarizing 50/50 beamsplitters (BS). In the output ports of the BS, polarizing beamsplitters (PBS) projected the photons in one of two mutually unbiased polarization bases (H/V- or z-basis and D/A- or x-basis). Single photon counting was accomplished by means of four single-photon avalanche diodes (SPAD) for each detection module. They were fiber-coupled in Alice’s detection module (Excelitas Technologies SPCM-800-11), and free-space-coupled in Bob’s detection module (ID Quantique ID120, diameter of active detector area = 500 μm). The timestamps of the single-photon detection events were locally recorded with time-to-digital converters (AIT TTM8000) and stored on hard drives. Due to the relative drift between the local clocks, the time tagging units were disciplined by pulse-per-second signals from GPS clocks, which were utilized for coincidence retrieval in post-processing. Key extraction from the raw timestamps was accomplished with PCs, which were both connected to the Internet, constituting the classical communication channel.

Free-space channel

The free-space channel consisted of a transmitter telescope, which shaped the beam for long-distance transmission, followed by a 143-km-long free-space link and a receiver telescope, which collected the photons for subsequent measurement. In order to minimize diffraction at the transmitter telescope aperture, the sending lens (diameter = 70 mm, focal length = 280 mm) was only partially illuminated by the photons emanating from the single-mode fiber. In a diffraction-limited case, this would lead to a spotsize at the receiver telescope of 1.3 m in diameter. However, beam wandering and beam spreading caused a widening of the beam due to propagation through turbulent air. Apart from these geometrical losses, the photons experienced absorption and scattering across the free-space link. These effects summed up to a total average link loss from the fiber to the receiver telescope of 33 dB. The receiver optics was estimated to add another 6 dB of optical loss. After the free-space link, the photons were collected by a 1-m Ritchey-Chrétien reflector telescope. Additionally to signal photons from Alice, Bob collected background photons with an average rate of 450 cps per detector channel. We also measured the sky noise rate of a typical LEO satellite pass with the same quantum receiver (see Supplementary Fig. 1), which turned out to be slightly lower than the terrestrial link background rate.

For the purpose of pointing, acquisition, and tracking, the free-space quantum channel was bidirectionally overlapped with green 532-nm beacon lasers, which were imaged by charge-coupled devices (CCDs) on both the transmitter and receiver side. The green light impinging on Alice’s CCD was used for a closed-loop tracking system, compensating beam drifts on the timescale of several seconds caused by varying temperature and humidity gradients across the free-space link.

Since the OGS and the mounted detection module was designed for satellite tracking, the CCD on Bob’s side was in a closed loop with a fast steering mirror (FSM), compensating for angle-of-arrival fluctuations due to atmospheric turbulence and dynamical pointing errors in the kilohertz regime caused by mechanical vibrations of the telescope.