Intensity modulator for secure, stable, and high-performance decoy-state quantum key distribution

The decoy-state method substantially improves the performance of quantum key distribution (QKD) and perfectly solves crucial issues caused by multiphoton pulses. In recent years, the decoy-state method has occupied a key position in practicality, and almost all the QKD systems have employed the decoy-state method. However, the imperfections of traditional intensity modulators limit the performance of the decoy-state method and bring side channels. In this work, a special intensity modulator and its accompanying modulation method are designed and experimentally verified for the secure, stable, and high-performance decoy-state QKDs. The experimental result indicates that its stable and adjustable intensities, convenient two-level modulation, inherently high speed, and compact structure is extremely fit for future trends and will help the decoy-state method to be perfectly applied to QKD systems.


INTRODUCTION
Quantum key distribution (QKD) 1 provides a way for two legitimate remote users, namely, Alice and Bob, to share secret keys with information-theoretic security [2][3][4][5][6] . However, this security relies on the single-photon state while the ideal single-photon sources are not yet practically useful. As an alternative, a revolutionary method named the decoy-state method [7][8][9] is employed in almost all practical QKD systems. This method allows a practical system based on weak coherent pulse sources to achieve the security performance of a single-photon QKD, which is a perfect combination of theory and practice.
The decoy-state method significantly improves the secret key rate and achievable distance of practical systems, but the legitimate users have to modulate several different intensities [10][11][12][13][14][15][16][17][18][19][20][21][22][23][24] precisely and independently. Usually, a decoy-state QKD requires weak coherent pulses with three or more different intensities. Some systems also require a special decoy state named vacuum state. Compared with classic optical communications, the intensity modulation in QKD systems is more difficult since the conflict between completely random modulation and finite modulation bandwidth.
A good intensity modulation for decoy-state QKD should be secure, stable, and flexible. The 'secure' is a basic requirement that the modulation should not violate the security assumptions of the QKD. The 'stable' means the output intensities should be insensitive to disturbances in an electric signal. The 'flexible' is that the manipulation should be as simple as possible. Meanwhile, it is important for a good intensity modulation that it should not be a short slab of the system performance. However, existing modulators cannot meet all the above requirements at the same time. The most widely used commercial LiNbO 3 -based Mach-Zehnder interferometer (MZI) is extremely sensitive to the electric signal disturbance, which violates the condition of 'stable', brings intensity fluctuation, and reduces the secret key rate 22,[25][26][27][28] . To make the matter worse, a special intensity fluctuation named patterning effect 29 introduces correlation of adjacent signals, which provides additional information and allows Eve to perform sophisticated attacks since current security analysis usually assumes independent and identically distributed (i. i. d) pulses. The imperfection of the MZI modulator has shaken the basis of the QKD.
To fill the loophole in the intensity modulation, two countermeasures are proposed. The first one is a post-processing method 29 . It works by discarding some pulses depending on the state of predecessor and successor. Another countermeasure is an intensity modulator based on Sagnac interferometer 30 . It is used as a secure two-level intensity modulator for QKD, not only can mitigate the patterning effect but also is immune to the DC drift. The two countermeasures are secure and convenient but not so friendly to high-performance QKDs. The post-processing method ineluctably reduces the secret key rate since it discards too many key bits while the higher key rate is what people pursue in the QKD field. The Sagnac modulator is also not so suitable for the decoy-state method since its two-level intensity modulation and fixed stable intensities cannot meet the requirement of more than two adjustable intensities. Besides, the worst of it is that its common-path mechanism brings an inherent speed limit. Considering that the high-speed system is a trend of the QKD field, the Sagnac modulator may become a short slab in QKD systems in the future.
An interesting question is whether we can design an intensity modulator that can generate three, four, or even more stable intensities, and these stable intensities should be tunable to optimize intensities for improving the secret key rate 21,[31][32][33] . Beyond that, it is lacing on the cake if its driving-voltages only switch between two different voltages, which would significantly reduce the modulation difficulty. Fortunately, the answer is yes. In this work, an intensity modulator named multipath Mach-Zehnder interferometer (MMZI) and its accompanying modulation method that meets all the above requirements are proposed. By working only at the 'half-wave points', the MMZI can generate a variety of different stable intensities to mitigate the intensity fluctuation and the patterning effect for secure and robust QKD systems. The MMZI is also inherently high-speed and facility for integration due to the traveling-wave modulation and its compact structure.

RESULTS
Most QKD systems generate the decoy states by commercial LiNbO 3 -based MZIs, in which an input pulse is first split into two parts by a 1 × 2 splitter and then recombined by a 2 × 1 coupler. The splitting ratios of the splitter and the coupler of commercial MZIs are both 1 2 . Thus, the output intensity I(α) is where the α is the phase difference of the two paths and the μ in is the input intensity. In many decoy-state QKD systems, commercial MZIs are applied to produce a signal state μ s , a decoy state μ d and a vacuum state μ v = 0 20,23,34 . As illustrated in Fig. 1, the signal state corresponds to the flat peak point S and the decoy state corresponds to the slope point D. We define the points with 0 derivative as stable points. Here the point S is a stable point. It is obvious that comparing with the stable points, the slope points are more sensitive to disturbances such as timing jitter and electric waveform distortion, which would cause unforeseeable fluctuation on μ d . Especially, in high-speed systems [35][36][37] , a finite modulation bandwidth leads to a correlation between adjacent signals, namely, the intensity of a pulse would be correlated with its previous one, which violates the important i.i.d. assumption.
To make QKD systems more secure and robust, we present a MMZI and an accompanying modulation method, which can be perfectly applied to decoy-state QKD systems. By working at the half-wave voltage, the interferometer can generate several stable intensities to mitigate the intensity fluctuation and the patterning effect for the security. As illustrated in Fig. 2, the interferometer consists of an 1 × N splitter, a N × 1 coupler and N parallel paths. One of the path (path-0) includes a variable optical attenuator (VOA) to tune its attenuation ratio η and others paths (path-1 to N − 1) each has a built-in phase modulator to shift the relative phases α k for k ∈ {1, 2....N − 1}. An input coherent pulse with intensity μ in is first split by the 1 × N splitter whose splitting ratio to the path-k is denoted by t 0 k and then modulated in each path.
After that, the pulses in each path couple and interfere in the N × 1 coupler whose splitting ratio to the path-k is denoted by t 00 k . To make the following formulas clearer, we define t k ¼ ffiffiffiffiffiffiffi ffi t 0 k t 00 k q . Note that since QKD systems have an attenuator to attenuate the intensity to single-photon level [34][35][36][38][39][40][41][42][43][44][45][46][47] , we ignore the insertion loss in the follows. The output pulse of the path-0 and path-k for k ∈ {1, 2, ...., N − 1} are, respectively, ffiffiffi η p t 0 ffiffiffiffiffi ffi μ in p and t k e iα k ffiffiffiffiffi ffi μ in p . After the interference, the MMZI outputs: ( The output intensity can be regarded as a function of relative phases: 2t k t l cosðα k À α l Þ # : (3) Since the condition of a stationary point is that all its partial derivatives should be 0, namely, the ∂Iðα1;α2;::::;αNÀ1Þ ∂α k 2t k t l sinðα k À α l Þ ! ¼ 0; for k 2 f1; 2; ::::; N À 1g; the ∀α k ∈ {0, π} are general solutions of Eq. (4). For simplicity, we define these general solutions as the 'half-wave points' in the follows. In another word, when the voltages on each path is V 0 or V π , the output intensity would be stable. Since each α k can be tuned to be 0 or π, there are 2 N−1 stable intensities, which can be denoted by I 1 ; I 2 ; ::::; For a specific decoy-state QKD system that requires optimized intensities μ 1 , μ 2 , ...., μ n , without loss of generality, we assume that the {I 1 , I 2 , ...., I n } and {μ 1 , μ 2 , ...., μ n } are sorted in descending order. A user should firstly find a set of t k and a η according to Eqs. (2) and (3) to make ; for i 2 f2::::ng: After that, the user adjusts the attenuator in the QKD system to make the maximum intensity I 1 , which always corresponds to the point ∀α k = 0, equals to the μ 1 . Naturally the other stable intensities equal to the other optimized decoy states. We take the optimized intensity sets [μ s ¼ 0:015; The voltage response curve of a commercial LiNbO 3 -based MZI with 50:50 splitting ratio. With the same voltage disturbance ΔV, the intensity difference ΔI on the slope point D is significantly larger than it on the stable point S. The V π denotes the half-wave voltage. Fig. 2 The structure of our multipath Mach-Zehnder interferometer. In this modulator, input pulses are split by an 1 × N splitter and enter into N different paths. The path-0 has a VOA to attenuate the pulse and the path-1 to N − 1 each has a phase modulator to modulate the relative phases. Finally, the split pulses interfere in a N × 1 coupler. P path; BS beam splitter; PM phase modulator; VOA variable optical attenuator.  45,46 as examples. We employ a three-path MMZI and denote its four stable intensities as I(0, 0), I(0, π), I(π, 0) and I(π, π), respectively. To generate the first optimized intensity set, an user should firstly set the splitting ratios and fine-tune the VOA to [ ffiffiffi η p t 0 ¼ 0:5, t 1 = 0.3170, t 2 = 0.1830] to make the I(0, π)/ I(0, 0) = 0.4019, I(π, 0)/I(0, 0) = 0.1122 and I(π, π) = 0. After that, he (she) adjust the attenuator in the QKD system to make I(0, 0) = μ s = 0.015, then naturally, the Ið0; πÞ ¼ μ d1 ¼ 0:006, Iðπ; 0Þ ¼ μ d2 ¼ 0:002, and I(π, π) = μ v = 0. Similarly, to generate the second optimized intensity set, an user can set the t k and η to [ ffiffiffi η p t 0 ¼ 0:5, t 1 = 0.3305, t 2 = 0.1695] and adjust the attenuator in the QKD system to make Ið0; πÞ ¼ μ d1 ¼ 0:43. Then the It is worth noting that, the stable intensities are adjusted by setting the splitting ratios and tuning the VOA. The MMZI would only has a limited tuning range when the splitting ratios are fixed. A more flexible structure with a larger tuning range can be achieved by adding VOA in each path. The details are introduced in the Discussion.

DISCUSSION
The stable intensities of the MMZI can be fine-tuned by the builtin VOA so that users can optimize the secret key rate. However, the tuning range is limited. In this section, another structure for improving the tuning range is proposed., As illustrated in Fig. 3, each path owns a VOA. The attenuation ratio of the path-k is denoted by η k for k ∈ {0, 1, 2, ...., N − 1}. By adjusting these η k , the ratio of the stable intensities can be modified flexibly to meet the need for intensity optimization.
With the development of high-speed QKD systems, the widely used commercial LiNbO 3 MZIs are increasingly difficult to meet the need for security, robustness, and flexibility. To improve the performance of the decoy-state QKD and make it more practical, a MMZI and its accompanying modulation method are proposed in this work. Our method can generate 2 N−1 different stable intensities to mitigate the intensity fluctuation and the patterning effect from imperfect modulation signals. The flexibility of its 'halfwave modulation' and tunable outputs makes it suitable for different protocols and systems. Its compact structure makes it easy to integrate. Besides, it is inherently high-speed due to the traveling-wave modulation. A user may generate stable decoy states by cascading several MZIs. However, in this scheme, the splitting ratio of each MZI must be specially designed. Considering that almost all commercial MZIs have a symmetric splitting ratio, each MZI in the series must be customized, which would increase difficulty and cost. Even if the customized MZIs are employed, the stable intensities of the cascade MZI design are fixed when connecting N MZIs in series, the user can generate at most 2 N stable intensities. By contrast, the user can build 2N-path MMZI by connecting N MZIs in parallel, in another word, he (she) can generate at most 2 2N−1 stable intensities, which is much more than connecting in series. Compared with cascading several customized MZIs, a 3-path MMZI (DPMZI or connecting two commercial MZI in parallel) can generate 4 stable intensities and the intensities are tunable, which is much more flexible and convenient in practical applications.
We have also experimentally demonstrated the modulation method by an commercial dual-parallel MZI (DPMZI) which could be regarded as a special case of the MMZI. We measured a random sequence consisting of signal, decoy, and vacuum state. The result suggests that our method can effectively mitigate the influence of the patterning effect. We have also demonstrated adjusting the ratio R to verify its convenience for intensity optimization. The details could be found in METHODS. The result indicates that our interferometer and modulation method are feasible in practice and will be secure, robust, and flexible for decoy-state QKD systems. Since its compact structure is easy to integrate, we believe that an integrated MMZI can be perfectly applied in high-speed decoy-state QKD systems and help the practical QKDs to achieve the optimized performance.

Experimental demonstration
In this section, we demonstrate the MMZI and its accompanying modulation method by a commonly used three-intensity decoy-state method 17,22,48,49 which consists of a signal state, a decoy state, and a vacuum state. An integrated commercial modulator named DPMZI [50][51][52] , which can be regarded as a special case of our MMZI is employed in the demonstration. As illustrated in Fig. 4, a DPMZI consists of two parallel sub-MZIs, one of which can be regarded as a VOA and the other one can be regarded as two independent paths. For simplicity, we use VOA to refer to the first sub-MZI. In other words, the DPMZI can be regarded as an equivalent of our modulator with three paths. Since all beam splitters in DPMZI have a 50:50 ratio, the splitting ratio t 0 , t 1 , and t 2 are fixed to, respectively, 0.5, 0.25 and 0.25. The output of DPMZI is written as: : Fig. 3 A MMZI structure for improving the tuning range. In this scheme, each path owns a VOA. Adjusting attenuation ratios of these VOAs is equivalent to adjusting splitting ratios of the splitter and the coupler.
The output intensity is a function of α 1 and α 2 , which is written as: As discussed above, the half-wave points are stable. The I(0, 0) is the maximum intensity, which is regarded as the signal state μ s . The other halfwave points can be employed as decoy states, here we select the I(0, π) as the decoy state μ d . Since the splitting ratios of the integrated commercial DPMZI have been fixed (namely, we cannot adjust splitting ratios to make the vacuum state on a half-wave point), we employ a particular solution, which is the solution of the equation set ∂Iðα1;α2Þ ∂α1 as the vacuum state. Experimentally, we can obtain the vacuum point by scanning the driving-voltage of path-1 and 2 alternately and taking the voltage which minimizes the output intensity in each turn. As illustrated in Fig. 5. The point S (α 1 = 0, α 2 = 0) is a peak point which corresponds to the signal state μ s ; The point D (α 1 = 0, α 2 = π) is a saddle point that is selected to generate the decoy state μ d . The point V is a trough point which corresponds to the vacuum state. Now that the t k are fixed, the stable intensities are Ið0; 0Þ ¼ μ in 4 ð1 þ ffiffiffi η p Þ 2 and Ið0; πÞ ¼ μ in 4 η, which are functions of the η. Defining that R ¼ μ d =μ s , the user can adjust the VOA to η ¼ ð to make Ið0; πÞ=Ið0; 0Þ ¼ R. In our experimental demonstration, a series of 50 ps light pulses generated from a 1 GHz high-speed picosecond laser were fed to a DPMZI (produced by FUJITSU OPTICAL COMPONENTS LIMITED and the model is FTM7960EX). A 5 GS/s-sampling-rate arbitrary waveform generator with two RF-amplifiers was applied to drive the interferometer. A pseudorandom number sequence was employed to the arbitrary waveform generator to generate random encoding signals. Complementary encoding signals similar to ref. 29 were employed to meet the need of the RFamplifiers. On the detection side, the modulated pulses were detected by a 20-GHz-bandwidth high-speed photodiode and recorded by a 12.5-GHzbandwidth oscilloscope. Since it is assumed that the average intensity reflects the mean photon number in the quantum pulses through heavy attenuation linearly 29 , we measured the intensities before they are attenuated to single-photon magnitude and calculated the intensity by the area of the pulse traced by the oscilloscope.
To demonstrate the ability to mitigate the patterning effect, a random sequence consisting of signal, decoy, and vacuum state was measured and 20,000 pulses were collected for statistical analysis. A short subset of the tracing result was shown in Fig. 6. To show the flexibility of tuning the ratio of signal and decoy state, we measured the average intensities of different patterns with different η. We adjusted the η to make the R ¼ μ d =μ s ¼ 0:24, 0.21, 0.18, and 0.12 as the interval of 0.1-0.25 is widely used in decoy-state QKDs 18,43,53 and recorded the average intensities of different patterns in Table 1. After that, we did a control experiment in which all the devices were the same as the previous one except for the modulator was replaced by a commercial LiNbO 3 MZI. In the control experiment, we also prepared random sequences consisting of the three states, and we adjusted the voltage to tune the R to do a comparison with the DPMZI. The comparison is listed in Table 2. The results indicate that under the same condition, the patterning effect in our method is two or three orders of magnitude smaller than the traditional intensity modulator.
Employing our modulator is the inevitable demand for higher performance since in practical systems.

Simulation
Except for the patterning effect, the random intensity fluctuation due to thermal noise or timing jitter of modulation signal also brings sidechannels to practical systems. As discussed in previous works 22,26,27,54 , considering the worst case in the parameter estimation is a countermeasure for the loophole, but the system performance would be unavoidably reduced and the performance depends on the magnitude of the fluctuation. The MMZI can mitigate the random intensity fluctuation from the modulation signal so that the system performance could be improved. Here we demonstrate the MMZI by extending the intensity fluctuation to ref. 13 , which is a three-intensity BB84 protocol with a finitekey analysis. (We emphasize that we only analyze the random intensity fluctuation in the simulation since the quantitative theoretical analysis against the correlated intensity fluctuation is still missing at present.).
The protocol definition is same with ref. 13 , except that the worst case of the mean photon number in the range of ½μ L a ; μ U a (a ∈ {s,d, v}) is considered in the parameter estimation. The secret key is extracted from the events whereby Alice and Bob both choose the X basis. The intensities are denoted by μ s , μ d and μ v , respectively, and they satisfy μ s > μ d + μ v and μ d > μ v ≥0. The intensities are selected with probabilties p μ s , p μ d and p μ v , respectively. In the scenario that the random intensity fluctuation and finite-key effect are considered, the parameters estimation of decoy state method should be modified. The lower-bound on the number of vacuum events s b,0 in basis b (b ∈ {X, Z}) is estimated by: s:t: μ L a μ a μ U a ; for a 2 fs; d; vg; (11) where n b,a denotes the event number when Alice select basis b and intensity μ a , the τ 0 ðμ s ; Fig. 4 The figure depicts the structure of the DPMZI, which contains two parallel sub-MZI. In our modulation method, one of the MZIs is regarded as a VOA.
is an intermediate variable corresponding to the Hoeffding's inequality.
In addition, the lower-bound on the number of single-photon events s b,1 in basis b (b ∈ {X, Z}) is estimated by: where the τ 1 ðμ s ; μ d ; μ v Þ ¼ e Àμ s μ s p μ s þ e Àμ d μ d p μ d þ e Àμ v μ v p μ v is the probability that Alice sends a single-photon state.
After that, the upper-bound of the number of bit errors associated with the single-photon events in Z-basis ν Z,1 is modified as: s:t: μ L a μ a μ U a ; for a 2 fs; d; vg; (14) where the m a Z denotes the number of bit errors when Alice selects Z-basis and intensity μ a .
With the modified formulas of the three-intensity decoy-state method, we can estimate a secret key rate when the random intensity fluctuation exists. Here simulate the BB84 protocol with random intensity fluctuation, and compare the system performance between employing commercial MZI and MMZI. The protocol definition and the formulas are same with ref. 13 except for the formulas of the decoy-state method are replaced by The average intensity of each pattern extracted from 20,000 random patterns. The 'Avg. int.' is the intensity uniformed according to the average intensity of the 2nd S pulse. The value after '±' is the standard deviation which reflects the random fluctuation of our measurement. The random fluctuation consists of the fluctuation of laser source, the random noise from modulation signal, the noise from the oscilloscope and the error from intensity calculation. The 'Patt. eff.' reflects the patterning effect, which is defined as the deviation from the average intensity.
The average intensity of each pattern extracted from 20,000 random patterns. The 'Patt. eff.' means the intensity deviation from the average μd, which reflects the patterning effect.  Eqs. (11), (13), and (14), in which the intensity fluctuation ½μ L a ; μ U a is considered. The difference between employing commercial MZI and the DPMZI is that the fluctuation is different. Since the electronic noise, when Alice wants to a voltage corresponding to the relative phase α, she actually loads a random voltage in a range which corresponds to the relative phase in the range of α L ; α U ½ . When a commercial MZI is employed, the intensity fluctuation is where a ∈ {s, d, v} and the α a denotes the corresponding relative phase for intensity μ 0 a . Similarly, when the MMZI (we take the DPMZI as an example) is employed, the intensity fluctuation is μ 0L a ¼ min : μ in 4 η þ ffiffiffi η p ðcos α 1;a þ cos α 2;a Þ Â þ where the α 1,a and α 2,a are corresponding relative phases for intensity μ a and the η should be tuned to be 0.6545 to make μ d = 0.2μ s . We further assume that the source has a fluctuation of δ I , the output μ a is in the range of μ L a ; μ U a Â Ã , where μ L a ¼ minðμ 0L a ð1 À δ I Þ; 10 À3 μ s Þ; μ U a ¼ μ 0U a ð1 þ δ I Þ; where the 10 −3 is the extinction ratio of the modulator. Here, we compare the difference of intensity fluctuation and secret key rate between employing commercial MZI and MMZI. In our simulation, the detection efficiency is 10%, the dark count rate is 6 × 10 −7 , the after-pulse probability is 4 × 10 −2 , the misalignment error rate is 5 × 10 −3 , and the fluctuation of the laser source δ I = 1%. The security parameters for finite-key effect are all same with ref. 13 and the block size n X is fixed to 10 7 . The probabilities p μ s ¼ 0:7, p μ d ¼ 0:2, and p μ v ¼ 0:1. The probability of selecting X basis is 0.61. We fix the intensities to μ s = 0.44, μ d = 0.2μ s = 0.088, μ v = 10 −3 μ s . The intensity fluctuations are listed in Table 3 and the secret key rates are showed in Fig. 7. The simulation results indicate that the MMZI mitigates the random intensity fluctuation and significantly improves the system performance. When the phase deviation is π/20, the system with DPMZI is nearly ideal while the system with MZI is nearly broken.

DATA AVAILABILITY
The data that support the findings of this study are available from the corresponding author upon reasonable request. The table lists the intensity range ½μ L a ; μ U a in different electronic noise. The δ α denotes the phase deviation due to the electronic noise, and we define α L ; α U ½ is α À δ α ; α þ δ α ½ . The ideal value of μ s , μ d , and μ v are 0.4444, 0.088, and 0.0004, respectively. Fig. 7 The secret key rate as the function of communication distance in the scenario that the random intensity fluctuation is considered. The black-dot line denotes the ideal key rate without any intensity fluctuation. The red, yellow, and blue lines denote the maximum phase deviation δ α is π/40, π/30, and π/20, respectively. The modulated phase is in the range of [α − δ α , α + δ α ]. The solid line and dash line denote employing MMZI and MZI, respectively.