Strategies for achieving high key rates in satellite-based QKD

Quantum key distribution (QKD) is a pioneering quantum technology on the brink of widespread deployment. Nevertheless, the distribution of secret keys beyond a few 100 km at practical rates remains a major challenge. One approach to circumvent lossy terrestrial transmission of entangled photon pairs is the deployment of optical satellite links. Optimizing these non-static quantum links to yield the highest possible key rate is essential for their successful operation. We therefore developed a high-brightness polarization-entangled photon pair source and a receiver module with a fast steering mirror capable of satellite tracking. We employed this state-of-the-art hardware to distribute photons over a terrestrial free-space link with a distance of 143 km, and extracted secure key rates up to 300 bits per second. Contrary to fiber-based links, the channel loss in satellite downlinks is time-varying and the link time is limited to a few minutes. We therefore propose a model-based optimization of link parameters based on current channel and receiver conditions. This model and our field test will prove helpful in the design and operation of future satellite missions and advance the distribution of secret keys at high rates on a global scale.


INTRODUCTION
Secure communications and data protection are the quintessential resources in an information-based society, with a wide range of applications such as financial transactions, ensuring personal privacy, and maintaining the integrity of critical infrastructure in the Internet of things. Quantum key distribution (QKD) allows to generate symmetric keys between distant parties, with a level of privacy that can be lower bounded from the very laws of physics. Flying qubits encoded in photons can be distributed up to distances of a few hundred kilometers in fibers 1-3 , while longer distances can be achieved by employing quantum repeaters 4,5 . Alternatively, optical satellite links have been proposed to overcome the distance limitations of groundbased transmission of photons 6,7 . The installation of quantum hardware on space platforms would also provide a platform for fundamental physics experiments 8,9 and radically new technologies such as quantum clock synchronization [10][11][12] and quantum metrology 13 . While this is a technologically immensely challenging task, a number of experimental [14][15][16][17][18][19][20][21] and theoretical 6,22 studies have established the feasibility of this vision with stateof-the-art technology available on ground and certified for operation in space. Consequently, in what has been called the quantum space race 23 , a number of international research groups in Canada, China, Europe, Japan, and Singapore are pursuing first missions involving space links 24,25 , with first dedicated satellite transmitter payloads successfully launched into space [26][27][28][29][30] .
The quantum space race has also served as a driver for the development of robust quantum technology [31][32][33] , with the recent years seeing tremendous advancements in quantum nonlinear optics, entangled photon generation methodology, and singlephoton detection. In light of these technological advances, a reevaluation of the improved performance characteristics of QKD via representative free-space links is critical, especially concerning the increase in secure key rate compared to earlier field trials 14,34-37 , illustrated in Fig. 1. Field tests based on prepare-and-measure schemes have not been included in this comparison, though we would like to mention that both terrestrial 38 and satellitebased 27,39 studies have demonstrated decoy-state key exchange over free-space links at high rates. Entanglement-based QKD protocols remove the need to trust the source on the satellite in a dual downlink scenario.
In this article, we report on a state-of-the-art experimental feasibility study for entanglement-based satellite QKD between the islands of La Palma and Tenerife. In order to be forearmed for future satellite down-link experiments, we have developed a quantum ground receiver for polarization-based QKD protocols, which is compatible with most existing optical ground stations (OGSs) with satellite tracking capabilities. We distributed entangled photons from an ultra-bright source over a 143-kmlong atmospheric free-space link with >0 dB total channel loss, which is comparable to the average down-link loss for a low earth orbit (LEO) satellite pass 40 . Additionally, we measured the background sky noise for a typical pass of a LEO satellite. Under these conditions, we implemented the BBM92 protocol 41 , supplemented by error correction and privacy amplification, which yielded secure key rates up to 300 bits per second (bps) including finite-size-effects 42 , which ranks amongst the highest key rates over a free-space channel with >40 dB total channel loss. This was achieved by adapting the pair production rate to the current channel attenuation. The same model-based optimization which has proven successful for our terrestrial free-space link was subsequently used to estimate achievable secure key rates in a LEO dual downlink scenario 26 . Our results provide updated estimates for entanglement-based satelliteground QKD and provide a valuable guideline for the design of future space missions.

Setup of field trial
The goal of QKD is the distribution of a secure key between Alice and Bob, which is subsequently used for the symmetric encryption of private messages. In our field trial, these communicating parties were located on the Canary islands of La Palma (Alice) and Tenerife (Bob). A source of polarization-entangled photon pairs (photon A and B) was placed near the Jacobus Kapteyn Telescope of the Roque de los Muchachos Observatory on La Palma at an altitude of 2360 m. Photon A was sent to Alice's detection module via a few meters of single-mode fiber, while photon B was transmitted through a 143-km-long free-space link, after which it was collected by a reflector telescope in the OGS of the Observatorio del Teide at an altitude of 2400 m (see Fig. 2). In order to compensate for slow beam drifts caused by the atmosphere, the transmitter and receiver telescopes were actively guided toward each other based on bidirectionally overlapped green beacon lasers. Both Alice's and Bob's detection modules are comprised of a random polarization basis choice, realized by a beam splitter, followed by a projection on one of two conjugate polarization bases. The different parts of the experimental setup are described in more detail in the 'Methods' section. In the following, we will elaborate on the performance of the free-space link and on the distillation of a secure key from priorly distributed entangled photon pairs. QKD over the free-space link A well-characterized communication channel is pivotal for longdistance quantum communication. Different from optical links over glass fibers, free-space links experience time-varying loss due to atmospheric turbulence. This results in a single-photon count rate at Bob which is fluctuating in time (Fig. 3a), while Alice detects her partner photon with a constant single-photon rate of 13.3 Mcps. After identifying the coincidences between these vastly different single-photon count rates, Alice and Bob share a raw key. In basis reconciliation, they classically communicate their random basis choice and discard all events with unmachted measurement bases, resulting in a sifted key (Fig. 3b). From this sifted key, a quantum bit error rate (QBER) can be estimated (Fig. 3c). The QBER is higher at times of low channel transmission, since the constant background count rate leads to a lower signal-to-noise ratio. QKD at high rates requires a precise time-synchronization between the communication parties. We harness the strong intensity correlations of the photon pairs in order to compensate for relative clock drifts (Fig. 3d). The retrieved two-photon correlation peak (see inset) exhibits a width which corresponds to the timing-jitter of the detection and electronic systems. Photon pair detections are subsequently identified using a coincidence window of 1 ns. For these post-processing steps, we use a custom software which is capable of coincidence retrieval on a sub-second timescale. This enables us to align free-space links based on coincidence detections.
In order to estimate the length of the secure key N f , we use the bound which is derived in refs [42][43][44] . Here, N z s (N x s ) is the sifted key length in the Z(X)-basis. The QBER in the two bases are E z μ ¼ 6:6% and ) denotes the estimated phase error rate in the z(x)-basis. All error rates are evaluated as arguments of the binary entropy function H 2 (x), with an error correction efficiency for the low-density parity-check (LDPC) code of f(x) = 1.2. Allowing for a failure probability of ε ph = 10 −5 and disregarding finite-size effects, the average key rate is 71.8 bps over the whole measurement time of 68 s (see Supplementary Table 1). Within a 15-s measurement interval (gray region in Fig. 3), the average secure key rate is 300 bps with an average attenuation of 38.72 dB (from the source to Bob's detectors).
In a next step, we investigate the relationship between the secure key rate and the link loss. To this end, the measurement data are sliced in 100-ms time-bins and the attenuation of Bob's channel within each time-bin is obtained by where R CC is the coincidence count rate, R A and R B are the single count rates of Alice and Bob, and τ cw is the coincidence window. The total channel attenuation is given by adding another 4.8 dB for Alice's channel loss. After grouping the losses in 1-dB intervals, we calculate the average loss and the corresponding secure key rate within this interval as shown in Fig. 4. The secure key rates obtained from the measurement data coincide with the model in Eq. (1) without any free parameters.
Optimization of the key rate While the loss across the channel is not under our control, both the source and the receiver offer adjustable parameters, the most important of which are the emitted pair rate and the coincidence window. For our setup, the maximal key rate is achieved with a coincidence window of 1 ns, which does not necessarily coincide with the minimal QBER. In general, the optimal coincidence window depends on the timing jitter of the detection and electronic systems and the clock synchronization accuracy. Adjusting the emitted photon pair rate μ is easily achieved by tuning the power of the pump laser (see 'Methods' section for experimental details). Interestingly, the secure key rate is not proportional to the pair rate of the source due to limitations in photon detection. These limitations include accidental coincidence counts and nonlinear detector responses such as afterpulsing 45 and dead-time effects, which we include in our model. As a consequence, higher pair rates result in higher QBERs, which lead to a decline in secure key rate after a loss-specific optimal pair rate μ opt (see Fig. 5) 46 . Operating the link at μ opt leads to the ; the red data points represent the two highest key rates achieved in this work. Apart from ref. 35 and ref. 36 , all experiments employ a single free-space link.
highest achievable secure key rate SKR max . While the plateau around SKR max is very broad for low average losses, adjusting the source to μ opt for high average link losses is more delicate (see inset). The highest key rate we could have achieved is close to 500 bps, which is~60% higher than the key rate we observed. Unfortunately, most of our measurements were not operated at μ opt due to a lack of a detailed model at the time of the measurements. However, the measurements we performed (see Supplementary Table 3) coincide with our model predictions, again indicating the validity of our model. With a valid model of our free-space channel at hand, we can now predict secure key rates achievable in a LEO dual downlink scenario. From the measurement data of the Micius dual downlink experiment 26,30 , we know which losses and background count rates to expect. Based on specifications of the Micius satellite and the Chinese ground stations, the dual downlink is modeled (see Supplementary Information) and yields the secure key rates plotted in Fig. 6. The link loss is influenced by the elevation angle of the satellite and ranges from 60 dB to 80 dB. For two Fig. 2 Sketch of the experimental setup. Alice and Bob were located on the Canary islands of La Palma and Tenerife, respectively, amounting to a free-space link distance of 143 km. Polarization-entangled photon-pairs were produced in SPDC by bidirectionally pumping a ppKTP crystal placed in the center of a Sagnac interferometer. Both Alice's and Bob's measurements were preceded by a random polarization basis choice realized by non-polarizing beamsplitters (BS). The measurement in one of two mutually unbiased polarization bases was achieved by polarizing beamsplitters (PBS), followed by detection with single-photon avalanche diodes (SPAD). All detection events were recorded with time-to-digital converters (TDC) disciplined by pulse-per-second signals from GPS clocks. Storage and post-processing of the timestamps was done with PCs, which were both connected to the Internet, constituting the classical communication channel. For the purpose of pointing, acquisition, and tracking, the quantum channel was bidirectionally overlapped with two green 532-nm beacon lasers. Map data © 2017 Google.  symmetrical high-loss channels, the optimal pair rate μ opt is almost independent of the total channel attenuation and with a coincidence window of 2.5 ns and 5.9 million photon pairs per second, the Micius dual downlink is operated close to the optimal pair rate μ opt (see Fig. 6).

DISCUSSION
We presented a QKD field trial over a free-space channel with a link distance of 143 km. This constitutes a worst-case scenario for satellite-based QKD with a LEO downlink in terms of channel attenuation 26 , astronomical seeing 14 , and sky noise. One of the main challenges of a satellite downlink, namely pointing and tracking in orbit, could not be simulated on our terrestrial freespace link. We used the polarization degree of freedom to distribute entangled photon pairs between the communicating parties and extracted a secure key with the BBM92 protocol. By employing state-of-the-art single-photon detectors and an ultrabright source of entangled photon pairs, we obtained a secure key rate of 154 bps over 85 s with an average total channel loss of 46.9 dB and a record secure key rate of 300 bps over 15 s with an average total channel loss of 43.5 dB, including finite-size-effects.
Continuous key generation over longer timescales is irrelevant for a LEO scenario, since typical satellite passes are limited by a few minutes of link time and as opposed to our terrestrial link, the downlink-attenuation is not heavily fluctuating on a second timescale 26,40 . The obtained secure key rates agree with our models, which factor in all relevant source, detector, and channel characteristics. Our results are also comparable to the predicted average key rate of~350 bps in the case of higher triggering efficiencies in a Micius satellite downlink 40 .
Although the attenuation in a satellite down-link is set by the orbit of the satellite, both the transmitter as well as the receiver can be optimized according to current link conditions. An important parameter in this regard is the photon pair rate emitted by the source, which can be optimized depending on the channel loss and the detector characteristics. The elevation angle of a LEO satellite leads to channel attenuations ranging from 29 dB to 45 dB 40 , which makes an adjustment of the photon pair rate on the satellite indispensable in order to maximize the number of secure bits exchanged within a short LEO satellite pass. Monitoring this time-varying attenuation could be accomplished by measuring the power of the beacon or synchronization laser at the satellite. This information can be used to adjust the pump power of the spaceborne photon pair source on the timescale of several milliseconds in order to adapt to current atmospheric conditions. However, small deviations from the optimal pair rate do not lead to a significant change in secure key rate, which relaxes the requirements on the output power stabilization of diode lasers launched into space substantially.
Additionally to the experimental investigation of a single freespace link, we modeled the dual downlink from Micius, which yielded optimal photon pair rates close to the actual pair rates achieved by Micius. In the case of two nearly symmetrical highloss channels, the optimal photon pair rate is not changing significantly as a function of the channel loss. However, since Micius and follow-up satellites will connect to an increasing number of ground stations around the globe, it is important to note that each receiver will have different frequency standards and detector characteristics, which yields different optimal coincidence windows and photon pair rates. As opposed to static fiber-based networks, a future satellite-based QKD network will therefore heavily rely on models dynamically predicting optimal parameters based on current link and receiver conditions.
In our study, we intended to showcase obtainable secure key rates with state-of-the-art sources and receivers. A number of technological advancements must be accomplished in order to significantly increase these key rates. While the brightness of photon-pair sources based on quasi-phase matching in spontaneous parametric down-conversion (SPDC) is sufficient to operate both single and dual down-links at the maximal key rate, as shown in this study, this is only true for detection with semiconductor single-photon detectors. The advancements in superconducting nanowire single-photon detectors (SNSPDs) 47 are promising for high-loss quantum communication, since they are characterized by short dead-times, negligible dark counts, very high detection efficiencies, and low timing-jitter 48 . However, these detectors cannot be straightforwardly employed for free-space applications, since they currently only exist in single-mode coupling. In order to make SNSPDs free-space compatible, the multi-mode beam could be either coupled in single-mode fibers with adaptive optics or directly impinge on the nanowire through a vacuum viewport. Due to their better timing resolution and higher maximal count rates, these detectors will increase the optimal pair rate significantly. For typical SNSPD specifications (see Supplementary  Table 4), the optimal pair rate in a dual downlink is 814 Mcps. The solid lines are model calculations for four different average total link attenuations corresponding to five of our measurements (stars). While the maximal achievable secure key rate SKR max decreases for increasing attenuation, the optimal photon pair rate μ opt to achieve SKR max shifts to lower pair rates. The inset illustrates this tendency and highlights the tolerance (⩾90% of SKR max ) to pair rate fluctuations around μ opt . Fig. 6 Achievable secure key rates in a symmetric dual downlink scenario. The model parameters are taken from the Micius dual downlink experiment 26 . Each channel attenuation has a specific optimal pair rate μ opt which yields the maximal achievable secure key rate. Additionally, the photon pair rate μ Micius emitted by Micius' entangled source is marked. The colored region corresponds to the link attenuation range of the Micius dual downlink.
Recent developments on ultra-bright photon pair sources, however, show that such values are well within reach 49,50 .
In order to decrease the rate of detected background photons, tight filtering in the spatial and spectral domain of the photons is inevitable, which has already been demonstrated for terrestrial free-space links 51,52 . Further measures to mitigate noise include adaptive optics 53 and ultra-narrowband photon pair sources 54 . Frequency multiplexing of polarizationentangled photon pairs 55 is an efficient way to increase the secure key rate over free-space links, since each frequency channel can be operated at the optimal pair rate, while the added complexity is shifted to the receivers on ground. Another possible avenue for high-rate QKD is the distribution of highdimensional entanglement over free-space links 56 , which increases the per-photon information capacity 57,58 and enhances the resilience against noise 59 . We hope that this work will prove beneficial in the design of future LEO missions. The employment of state-of-the-art quantum sources and receivers together with the dynamical prediction of optimal parameters in orbit enable high key rates and pave the way toward QKD on a global scale.

Ultra-bright entangled photon-pair source
The source of photon pairs was based on type-0 SPDC. In order to achieve polarization entanglement, a periodically poled KTiOPO 4 (ppKTP) crystal was placed within a polarization Sagnac interferometer [60][61][62] . The 20-mmlong ppKTP crystal was bi-directionally pumped with a continuous-wave diode laser tuned to 405 nm, tightly focused on the crystal for increased brightness. By tuning the temperature of the crystal, photons with nondegenerate central wavelengths λ A = 774 nm and λ B = 840 nm were produced. Using dichroic filters, the photon pair was separated in two distinct spatial modes and coupled into single-mode fibers.
After longpass and 3-nm-bandpass filtering, the source produced a local two-fold detection rate of~280 kcps per mW of pump power with a symmetric heralding efficiency of~33%. Polarization entanglement was verified by measuring the second-order interference Visibilities V in the rectilinear (H/V) and diagonal (D/A) polarization basis. Typical experimental values yielded V H/V = 99% and V D/A = 98.5% measured locally, which corresponds to a Fidelity F = (V H/V + V D/A )/2 ≃ 0.987 with the maximally entangled Bell state Φ À j i ¼ 1=

Detection modules
Both Alice's and Bob's measurements were preceded by a random polarization basis choice implemented by non-polarizing 50/50 beamsplitters (BS). In the output ports of the BS, polarizing beamsplitters (PBS) projected the photons in one of two mutually unbiased polarization bases (H/V-or z-basis and D/A-or x-basis). Single photon counting was accomplished by means of four single-photon avalanche diodes (SPAD) for each detection module. They were fiber-coupled in Alice's detection module (Excelitas Technologies SPCM-800-11), and free-space-coupled in Bob's detection module (ID Quantique ID120, diameter of active detector area = 500 μm). The timestamps of the single-photon detection events were locally recorded with time-to-digital converters (AIT TTM8000) and stored on hard drives. Due to the relative drift between the local clocks, the time tagging units were disciplined by pulse-per-second signals from GPS clocks, which were utilized for coincidence retrieval in post-processing. Key extraction from the raw timestamps was accomplished with PCs, which were both connected to the Internet, constituting the classical communication channel.

Free-space channel
The free-space channel consisted of a transmitter telescope, which shaped the beam for long-distance transmission, followed by a 143-km-long freespace link and a receiver telescope, which collected the photons for subsequent measurement. In order to minimize diffraction at the transmitter telescope aperture, the sending lens (diameter = 70 mm, focal length = 280 mm) was only partially illuminated by the photons emanating from the single-mode fiber. In a diffraction-limited case, this would lead to a spotsize at the receiver telescope of 1.3 m in diameter. However, beam wandering and beam spreading caused a widening of the beam due to propagation through turbulent air. Apart from these geometrical losses, the photons experienced absorption and scattering across the free-space link. These effects summed up to a total average link loss from the fiber to the receiver telescope of 33 dB. The receiver optics was estimated to add another 6 dB of optical loss. After the free-space link, the photons were collected by a 1-m Ritchey-Chrétien reflector telescope. Additionally to signal photons from Alice, Bob collected background photons with an average rate of 450 cps per detector channel. We also measured the sky noise rate of a typical LEO satellite pass with the same quantum receiver (see Supplementary Fig. 1), which turned out to be slightly lower than the terrestrial link background rate. For the purpose of pointing, acquisition, and tracking, the free-space quantum channel was bidirectionally overlapped with green 532-nm beacon lasers, which were imaged by charge-coupled devices (CCDs) on both the transmitter and receiver side. The green light impinging on Alice's CCD was used for a closed-loop tracking system, compensating beam drifts on the timescale of several seconds caused by varying temperature and humidity gradients across the free-space link.
Since the OGS and the mounted detection module was designed for satellite tracking, the CCD on Bob's side was in a closed loop with a fast steering mirror (FSM), compensating for angle-of-arrival fluctuations due to atmospheric turbulence and dynamical pointing errors in the kilohertz regime caused by mechanical vibrations of the telescope.

DATA AVAILABILITY
The datasets analyzed during the current study are available from the corresponding authors on reasonable request.