2×N twin-field quantum key distribution network configuration based on polarization, wavelength, and time division multiplexing

Developing quantum key distribution (QKD) has been recently directed toward distance extension and network expansion for real-world secure communications. Considering a recent report on a quantum communication network over 4,600 km, it seems that QKD networks using conventional protocols have been sufficiently studied. However, although the twin-field QKD (TF-QKD) proposed for long-distance QKD has been studied deeply enough to succeed the demonstrations over 428- and 511-km deployed fibers, TF-QKD networks have been verified only for a ring network. In this work, we propose a star topological 2 × N TF-QKD network scheme, where the coherence maintenance issue, being the primary obstacle to implementing TF-QKD, can be minimized by the automatic mode-matching feature of the Sagnac-based plug-and-play architecture. A lower number of active controllers is required for our scheme in comparison with one-way TF-QKD networks. Moreover, our scheme adopts a cost-effective configuration that requires only a single pair of single-photon detectors for the entire network system. We conducted a proof-of-concept experiment over a 50-km fiber successfully, achieving an average secret key rate of 1.31 × 10−4 bit per pulse (1.52 bit per second) with the finite-size effect.

Since conventional QKD systems generally employ extremely weak laser pulses, there are fundamental limitations on the communication distance and secret key rate (SKR) due to the inevitable fiber optic and system induced losses. The Takeoka-Guha-Wilde and Pirandola-Laurenza-Ottaviani-Banchi bounds are repeater-less upper bounds of the SKR 19,20 that scale linearly with the channel transmittance η. Significant efforts have been made for resolving the aforementioned issue, including the quantum repeater and measurement-device-independent QKD together with either quantum memories 21,22 or quantum nondemolition measurement 23 . However, since these methods are not currently practical, their experimental feasibility in surpassing the repeater-less bounds has not been verified despite recent remarkable reports 24,25 .
In this regard, twin-field QKD (TF-QKD) 26 is an innovative protocol that can overcome the repeater-less bound with current technologies by employing an intermediate node, Charlie, which measures the first-order interference of two optical fields (twin fields) from Alice and Bob. Since only single-photon detection events are valid in TF-QKD, i.e., photons from both Alice and Bob do not have to arrive at Charlie simultaneously, only half of the attenuation applies to the SKR. Therefore, the SKR of TF-QKD scales with ffiffiffi η p , equivalent to the scale of the single-repeater QKD.
However, QKD network expansion remains a major challenge as following points. QKD networks do not guarantee perfect conversion between electrical and quantum signals, thereby limiting network structure configurability. Moreover, most QKD networks connected via deployed fibers comprise simple relays of point-to-point systems [43][44][45][46][47][48] , and it was only after the remarkable quantum access network architecture proposed in 2013 49 that a true 1 × N QKD network system was implemented [50][51][52][53][54] . Finally, an integrated space-to-ground quantum communication network spanning over 4600 km was demonstrated in 2021 52 , comprising various QKD architectures and network topologies, such as pointto-point, one-to-many, ring, tree, and star. However, TF-QKD networks have been proposed and verified only for the ring topology 11,42 .
In this paper, we propose a 2 × N plug-and-play (PnP) TF-QKD network scheme, where coherence maintenance can be efficiently achieved using a Sagnac-based PnP architecture. Moreover, we present a proof-of-principle experimental demonstration. Although our scheme adopts the Sagnac configuration, such as that in the established TF-QKD networks 11,42 , the scheme forms a 2 × N star network rather than an N × N ring network, implying a difference in applicability. For our applications, the structure can be used for networks where server-client communication is more significant than communications between clients, such as networks for banks, data centers, electronic voting, and the military. In particular, it is suitable for secure electronic voting systems requiring only server-client communications. Moreover, it can be employed in secure military communications between upper and lower units for confidential tactical strategies and in data centers requiring secure communications between a server and multiple clients. Although our setup cannot be extended to an N × N structure, it is useful at least for the applications described above. Furthermore, there are other features similar to those in the established PnP TF-QKD networks 11,42 as follows. Our scheme requires only a single pair of single-photon detectors (SPDs) for the entire system due to the common feature of QKD networks adopting SPDs based on time division multiplexing (TDM) 42,[49][50][51][52][53][54] . In addition, our scheme can reduce the efforts for realizing active control systems in TF-QKD systems, because the PnP architecture has advantages for optical mode-matchings 11,33,50,51,[55][56][57][58][59] . Since conventional TF-QKD systems require many active control systems 9,10,[35][36][37][38][39][40][41] , this feature provides a practical method for TF-QKD implementation. Moreover, most of the expensive and difficult-to-control devices such as lasers and SPDs are installed in Charlie (measurement setup), whereas Alice (server) and Bob (client) comprise simple optical components only for timing synchronization and quantum state preparation 11,33,[49][50][51][52][55][56][57][58][59] . Thus, it is relatively easy to add and remove a new client, because key exchange can start immediately by plugging the client device to the end of the fiber and synchronizing the signal without wavelength and polarization controls, which are required in oneway TF-QKD.
To show the feasibility of our architecture, we experimentally implemented our network scheme and performed a proof-ofprinciple demonstration using the SNS TF-QKD protocol 29,35,60,61 ; then, we obtained reasonable SKRs for 16 network connections with the complete finite-size effect 35,60,61 . Furthermore, we applied efficient control systems to achieve long-term stability and reduce performance degradation from environmental changes.

Architecture
The proposed 2 × N PnP TF-QKD network scheme is shown in Fig. 1. We use three multiplexing methods, namely, polarization, wavelength, and time division multiplexing (PDM-WDM-TDM), to realize a 2 × N network. PDM doubles the channel capacity of the server and client compared with using only WDM. Connections between two servers (Alice H and Alice V , where H and V denote the horizontal and vertical polarization states, respectively) and client groups (Bob H i and Bob V i with i={1,…,N}, where i indicates the wavelength channel in the arrayed waveguide grating (AWG) device) are switched by the modulation of two electrical polarization controllers (EPCs) in Charlie. As shown in Fig. 2, Alice H connects to Bob H i (Bob V i ) and Alice V connects to Bob V i (Bob H i ) when EPCs are modulated to 0°(90°). The red and blue lines represent the optical paths for the Alice H and Alice V connections, respectively. Optical pulses with wavelength and polarization corresponding to each connection are provided by a polarization beam splitter (PBS) and wavelength-tunable lasers (TLDs), which generate optical pulses with N different wavelengths. Then, the pulses are sent to each device via the AWG devices. TLD H and TLD V are allocated to the Alice H and Alice V connections, respectively. To apply TDM, TLDs are driven independently in the time slots for each connection. According to network connections, Charlie should consider the appropriate pulse generation timings to prevent overlaps of pulses from different connections, because the round trip time of the twin fields changes based on the network connections. Moreover, Charlie needs to compensate for a timing mismatch between photon arrivals and detection gates caused by environmental changes. As all the TLDs and SPDs are installed in Charlie, the Fig. 1 2 × N plug-and-play (PnP) twin-field quantum key distribution (TF-QKD) network scheme. Three multiplexing methods of polarization, wavelength, and time division multiplexing (PDM-WDM-TDM) are used to configure a 2 × N network. Alice and Bob identically consist of simple devices for synchronization and state preparation, while expensive and complicated devices such as lasers and SPDs are placed in Charlie. The abbreviation definitions are as follows. TLD wavelength-tunable laser driver, PBS polarization beamsplitter, CIR circulator, BS beamsplitter, SNSPD superconducting nano-wire single-photon detector, EPC electrical polarization controller, AWG arrayed waveguide grating, PD photodiode, VOA variable optical attenuator, IM intensity modulator, PM phase modulator, FM Faraday rotator mirror.
timing alignments can be efficiently performed 50,51 . For Alice's and Bob's synchronizations with Charlie, a method frequently used in PnP QKD systems 34,50,51,57,59,62,63 is adopted. In this method, Alice and Bob use a beam splitter (BS) and a photodiode (PD) to split and measure the incoming optical pulse train from Charlie. Then, they can generate trigger signals and synchronize their clocks with the signals.
Owing to the PnP (two-way) architecture 55 , our network scheme has three advantages in experimental implementation, compared to one-way TF-QKD. Firstly, polarization drift due to the birefringence effect in the optical fiber can be naturally compensated by the round trip of the optical signals using a Faraday rotator mirror (FM). Hence, a polarization control system is not required for the proposed architecture. Secondly, since the server and client share a common laser in Charlie, the twin fields have fundamentally the same wavelength. Such a structure using an untrusted source may open a potential backdoor for Eve to launch source attacks, such as Trojan-horse and phase remapping attacks [64][65][66] . However, these vulnerabilities can be circumvented by applying countermeasures developed for a general PnP QKD 62,[67][68][69] . Moreover, the countermeasures can be applied to our architecture without additional optical devices because both Alice and Bob have a BS and a PD each, which are the key devices for the countermeasures. Note that the main goal of this work is to show the feasibility of the proposed TF-QKD network configuration (See Discussion for further details of security). Thirdly, arrival times of the twin fields are naturally identical because the twin fields pass through the same route in opposite directions, clockwise or counterclockwise. This is significant for networks where users are placed at arbitrary distances from the central relay. Due to the second and third advantages, matching the photon arrival times is not required, and we can eliminate the wavelength control system, which is the primary obstacle in implementing TF-QKD. Thus, only a phase controller is required to maintain coherence between the twin fields. Note that timing controls for other active devices such as the laser, modulators, detectors, and switches are still necessary for system operation. In fact, it has been reported previously 11,33 that the common path nature of the Sagnac interferometer guarantees automatic phase stability until an overall path length of~300 km. However, the phase stability was not observed in our experiment despite using a much shorter optical path of 160 km (overall path). As shown in Fig. 3a and b, the relative phase between clockwise and counterclockwise trains of the Alice V -Bob H 33 connection is arbitrarily changed with 1.43 rad per train and has uniformly distributed probabilities in the histogram. The averaged phase drift rate for all connections is 1.36 rad per train. Since the optical pulse train had a period of approximately 8 ms, the phase drift rates were indicated in units of rad per train rather than rad per millisecond, unlike in Refs. 9,10,35,38,39,41 . These results may be attributed to thermal and vibration noises, and thus, we expect that the stability can be achieved by employing shorter fiber spools or by sealing the setup carefully.
As shown in Fig. 4, the signal flow, for example, in the Alice H -Bob H 3 connection, is described in six steps. Each connection has slightly different steps based on the polarization and wavelength, but it is straightforward to infer appropriate steps from the ones below. While Step 1 is indicated by black arrows with a black number, the clockwise and counterclockwise signal flows are represented by red solid lines with red numbers and violet dashed lines with violet numbers, respectively.
Step 1: To connect Alice H with Bob H , both EPCs are modulated to 0°.
Step 2: TLD H generates a horizontally polarized strong pulse with λ 3 . The pulse passes through a PBS and a circulator (CIR). Then, it is divided into clockwise and counterclockwise pulses by a  Step 3: Alice H and Bob H 3 generate trigger signals for active devices by measuring the approaching pulses using a BS and a PD. Then, they reflect the approaching pulses as vertically polarized pulses using the FMs, allowing the pulses to just pass through the phase modulators (PMs) and intensity modulators (IMs) without encoding. As they do not encode information at this time, the information leakage due to the bright pulse can be ignored (See Discussion for further details of security).
Step 4: The vertically polarized pulse returned from Alice H (Bob H ) is sent to its counterpart, Bob H (Alice H ), by two PBSs. The polarization state does not change because the EPCs are transparent, as mentioned in Step 1. Moreover, the transmitted pulse to Bob H is sent to Bob H 3 by the AWG device.
Step 5: Alice H and Bob H 3 apply the TF-QKD protocol to the approaching pulses using the IMs and PMs, and reflect the pulses as horizontally polarized pulses using the FMs. At this time, the pulses are attenuated to the single-photon level by IMs and variable optical attenuators (VOAs) set to a constant attenuation. Synchronization can be achieved using the same method as in Step 3.
Step 6: The attenuated pulses, namely, the weak coherent pulses (WCPs) of Alice H and Bob H 3 return to Charlie and interfere with each other at the BS. Then, Charlie measures the interference result using two superconducting nano-wire SPDs (SNSPDs). Since WCPs are generated by a common laser and pass through the same route, the wavelength, and arrival time are naturally identical. Moreover, polarization drift from the quantum channel (QC) is automatically compensated by the round trip of the pulses 55,59 . The automatic phase stability verified previously 11,33,42 is expected to be achieved if quantum channels are sufficiently short.
These six steps occur in every time slot allocated to the Alice H -Bob H 3 connection and are repeated until Charlie  Relative phase between clockwise and counterclockwise trains. a Relative phase drift between clockwise and counterclockwise trains of Alice V and Bob H 33 . The relative phase between clockwise and counterclockwise trains of the Alice V -Bob H 33 connection is arbitrarily changed with 1.43 rad per train. Since the optical pulse train had a period time of~8 ms, it was indicated in units of rad per train rather than rad per millisecond. b Probability distribution of the relative phase between the clockwise and counterclockwise trains of Alice V and Bob H 33 . The randomly distributed probabilities indicate that the phase stability from the common path nature is not sufficient in our experimental setup. The bin width of the relative phase is 2°. accumulates sufficient detection events. After accumulation, Charlie announces the interference results. Then, Alice H and Bob H 3 perform post-processing to distribute secure keys.

Protocol
The protocol implemented in this study is the four-intensity decoy-state SNS protocol 29,35,60,61 . It is described as follows. Alice and Bob randomly choose either X or Z bases with probabilities p X and 1-p X , respectively. On the X basis, they randomly select and send one of three sources ρ αi with a probability p xi for i=0,1,2, where ρ α0 ¼ 0ih0 j jis the vacuum source, and ρ α1 and ρ α2 are two phase-randomized coherent sources with intensities μ 1 and μ 2 (μ 1 <μ 2 ), respectively. On the Z basis, they send the phaserandomized coherent state ρ αz and the vacuum state with probabilities p z1 and 1 À p z1 , respectively. Meanwhile, random phase values are applied to the pulses, regardless of the selected bases. The random phase values, θ A and θ B , where A and B denote Alice and Bob, respectively, are selected in the semi-open interval [0,2π), which is split into M equal slices Δ m =2πm/M, with m={0,…, M-1}, and M set to 16 in this work. Then, Charlie measures the incoming pulses and records which detector clicks. After measurement, he publicly announces all the information about the effective events caused by single clicks, and discards coincidence clicks. Alice and Bob reveal their bases for the effective events. In addition, they disclose the intensities and phase values corresponding to the effective events when Alice or Bob choose the X basis, whereas the phase information of the Z basis should not be revealed. With this information, Alice and Bob obtain the observable N jk (j,k=0,1,2,z), which are the number of instances when Alice and Bob send ρ αj and ρ α k , respectively. Accordingly, the yields can be defined as S jk ¼ n jk =N jk , where n jk are the number of effective events caused by N jk . Furthermore, to improve the results, we consider the instances for the effective events with unmatched bases as below. Even though the effective events of these instances cannot be used for the key distillation, they can be used in the decoy-state analysis.
where p x0 ¼ 1 À p x1 À p x2 is the probability of sending a vacuum state in the X basis, N X ¼ p 2 X N total is the number of instances when both Alice and Bob choose the X basis, and N XZ ¼ p X 1 À p X ð Þ N total is the number of instances when Alice (Bob) chooses the X basis and Bob (Alice) chooses the Z basis.
Subsequently, we define two sets C Δ þ and C Δ À containing the instances when both Alice and Bob send ρ α1 with the phase information θ A and θ B satisfying the phase slice condition of Eq.
(2) or Eq. (3). The number of the instances in C Δ ± are N Δ ± 11 ¼ Δ 2π N 11 . Correspondingly, n Δ ± 0 11 and n Δ ± 1 11 are used to denote the number of the effective events for detector 0 and detector 1, respectively.
where Δ is the phase slice size, θ A (θ B ) is the random phase value of Alice (Bob), and θ D is the phase difference between the optical paths of Alice and Bob. Conventionally 35,60,61 , |x| means the degree of the minor angle enclosed by the two rays that enclose the rotational angle of degree x, e.g., À15π=8j j ¼ 15π=8j j ¼π=8 and Àπ=10j j ¼ π=10. In the protocol, phase-and bit-flip errors can be classified as follows. In the X window, i.e., when both Alice and Bob choose the X basis, effective events inconsistent with the expected results from the first-order interference of Alice and Bob are defined as phase-flip errors. For example, a phase-flip error occurs if detector 0 (detector 1) clicks even though detector 1 (detector 0) has to click according to the phase combination. Furthermore, in the Z window, effective events when Alice (Bob) has decided to send and Bob (Alice) has decided not to send are distilled as raw key bits, 1 (0), while effective events when Alice and Bob decide to send the same states cause bit-flip errors.
With these observables, Alice and Bob can estimate the lower bound of s 1 and upper bound of e ph 1 , to calculate the SKR with a finite-size effect by using the following formula 35,60,61 (See Methods for further details of the decoy-state method and finite-size effect analyses).
where R is the secret key rate, s 1 is the yield of the single-photon state in the Z basis, e ph 1 is the phase-flip error rate for the instances of s 1 , S Z and E Z are the yield and bit-flip error rate in the Z basis, respectively, a 1 ¼ μ z e Àμ z is the probability when the emitted state collapses to the single-photon state, p X is the probability of the X basis, p z1 (p z0 ¼ 1 À p z1 ) is the probability of sending μ z (vacuum) in the Z basis, and H x ð Þ ¼ Àx log 2 x À 1 À x ð Þlog 2 1 À x ð Þ represents the binary Shannon entropy function. N total is the total number of signal pulses, ϵ ¼ 10 À10 is a failure probability of the Chernoff bound, and the error correction efficiency of f is assumed as 1.1.

Experimental setup
Our full experimental setup is shown in Fig. 5a. Despite drawing all pairs of Alice and Bob, only one pair was realized, and manually swapped according to the network connection. A distributed feedback (DFB) laser and polarization controller (PC) were used as substitutes for TLD H and TLD V . The temperature of the DFB laser and the PC were modulated appropriately to provide each connection with optical pulses of the corresponding wavelength and polarization. The quantum efficiencies (QEs) of SNSPDs for the BS and CIR sides were 46.5% and 51.3%, respectively. They include the PC and optical switch (OSW) efficiencies. A higher QE is applied to the CIR-side SNSPD to compensate for the CIR insertion loss. The overall detection efficiencies of Charlie are 12.8% (BS side) and 12.6% (CIR side). Two default-off OSWs, which are triggered only when optical pulse trains return after the round trip time, are used to avoid the latching effect of the detectors caused by strong light leaked from the BS and CIR. The pulse width of the OSW trigger signals is sufficiently set to 0.2 ms by considering the train's activated duration, and the round trip time can be estimated based on the path lengths of the devices. In our setup, the round trip time is approximately 0.8 ms, since pulses make a round trip of two 25-km QCs and two 15-km storage lines (SLs). Note that any OSW with a moderate on/off rate corresponding to the train period can be used for this purpose. Alice and Bob are connected to Charlie using 25-km QCs. In addition, 15-km SLs are used to reduce the backscattering noise count by dividing forward signal pulses and backward scattering noises in the time domain 70 . For the same purpose, SLs have been frequently used in PnP QKD systems 50,51,58,59,63,71 . 100-GHz AWG devices with four channels ranging from ITU DWDM-31 (1552.52 nm) to 34 (1550.12 nm) are placed in the Bob sides. The channel isolations of the AWG devices are greater than 30 dB. We use two IMs to improve the overall extinction ratio (ER), which mainly affects the quantum bit error rate on the Z basis (QBER Z ).
Moreover, a field-programmable gate array (FPGA) board equipped with multiple digital-to-analog converters was used for synchronizing active devices and random encoding. In this study, as a proof-of-concept experiment, we realized timing synchronization of Alice, Bob, and Charlie by connecting the FPGA C.H. Park et al. board and active devices using electrical cables. The timing diagram of active devices is shown in Fig. 6. However, in a practical system, the synchronization method using the BS and PD described in the architecture needs to be considered 50,51 . It is noteworthy that such a method can be applied easily to our current setup.
As described in the architecture, the phase stability by the common path nature 11,33,42 was not observed in our experiment, so we employed a phase post-compensation method 35,38 to compensate for the phase drift. We selected this method because it can be implemented more practically than a real-time compensation system. In this method, Alice and Bob compensate for the phase difference (θ D ) during post-processing, as shown in Eqs. (2), (3). To estimate θ D , the optical pulse train is composed of 924 reference and 100 signal pulses, as shown in the inset of Fig. 6. Since our FPGA does not have enough memory to store the data for a number of trains, the vacuum time is set to more than 7 ms to perform data communication with a PC immediately after each train ends, despite the round trip time of 0.8 ms. We remark that it can be easily reduced using larger storage in a practical system. The reference pulses are divided into four equal parts. Moreover, Alice modulates the phase of each part to 0, π/2, π, and 3π/2 while Bob modulates all to 0. Then, θ D can be estimated from the interference results of the reference pulses using the least square method 35,38 . We use more reference pulses than the signal pulses to improve the accuracy of the phase difference estimation. In this work, the intensity contrast between the signal and reference pulses is negligible, as summarized in Table 1. However, if a much longer quantum channel is used, the intensity of the reference pulse has to increase for precise phase estimation. Then, mitigating the backscattering noise induced by the strong reference becomes challenging, since the reference and signal wavelengths are equal. Furthermore, if the phase drift rate is too high, there may be a significant phase drift between the signal and reference parts, making it difficult to estimate the phase difference accurately. Thus, the space between the first reference pulse and the last signal pulse needs to be shorter with increasing phase drift rate. This should be considered in any TF-QKD using the post-compensation method.
Moreover, we added three features to achieve long-term stable system performance. Firstly, we implemented an interferometer in Alice and Bob to reduce the performance degradation due to the polarization dependency of the lithium niobate-based IM 50,51,58 . Particularly, as the degradation of the insertion loss and ER directly affects the SKR in the QKD system, it needs to be resolved. Although using an active polarization controller is feasible, it is not practical, owing to the requirement of an additional EPC, PBS, and detector. Thus, we solved this issue passively by placing the IMs       between two PBSs with connector keys aligned to slow axes. Owing to the FM and PBSs, the pulses passing through the IMs are always vertically polarized, even if the polarization state of the input pulses into the PBS is not exactly defined. Two pulses divided and combined by PBSs are always orthogonally polarized, so there is no interference between them. Consequently, the IMs can always work properly, regardless of the input polarization state. To apply our method to the IMs working with horizontally polarized input states, the connector keys of the PBSs need to be aligned to fast axes. Besides, we adopted the double phase modulation (DPM) method 72 enabling phase modulation of an arbitrary polarized input. In the DPM method, the different phase modulations due to polarization dependency are automatically compensated since the phase modulation is performed twice, before and after reflection by the FM. Thus, the input polarization state into the PM is not considered. These methods can be implemented without any active components, thus reducing system complexity.
Secondly, we implemented an IM bias control system to maintain the ER. Since the operating bias point of the IM easily drifts away from the optimal point owing to the ambient temperature change as well as the inherent photorefractive effect, the initially optimized ER is not ensured for a long time. Our bias control system compensates for the voltage drift from the null point (bias point for minimal transmission) whenever the estimated QBER Z is higher than a threshold value.
Thirdly, we applied a timing calibration system. Since the effective channel length of any fiber-based QKD varies with the temperature change, it is necessary to compensate for the variation. Although the arrival times of the twin fields are naturally identical in our scheme, there exists a timing mismatch between the photon arrivals and detection gates. Our calibration system adjusts each detection gate timing until the count rate is the highest when the single-photon count rate is lower than the threshold value.
To check the long-term stability of our system, we recorded the sifted key rate and QBERs of the Alice H -Bob H 33 connection for a week. The experimental results are presented in Fig. 7a. The stabilities of the sifted key rate (average 1.41 × 10 −3 bit per pulse) and QBERs (average 3.52% and 3.73% on the Z and X bases, respectively) indicate that our system can compensate for environmental changes for a long time. In addition, we measured the single-photon count rate and optimal gate timing while heating and cooling the QC and SL of Bob H 33 between 22°C and 60°C. As shown in Fig. 7b, the single-photon count rate is maintained above the threshold value (blue dashed line) by optimizing the detection gate timing according to heating and cooling. From this result, we can conclude that our timing calibration system can cope with rapid temperature changes.

Experimental results
We implemented our experimental setup over a 50-km fiber and demonstrated the feasibility using the SNS protocol 29,35,60,61 . We sequentially measured the QKD performances for 16 network connections determined by two different modulations of PCs and four different wavelengths. Alice V and Alice H can be connected to eight Bobs each. In the experiment, only one pair of Alice and Bob was implemented and swapped manually according to the network connection, which requires an hour. The experiment on each network connection was performed for a day to accumulate sufficient data for calculating the SKR. The number of signal pulses sent to each connection, N total is 10 9 on average. Figure 8a-c, and d show the sifted key rate and QBERs for channels ITU DWDM-31, 32, 33, and 34, respectively. Each subfigure consists of the results for Alice V -Bob V , Alice V -Bob H , Alice H -Bob V , and Alice H -Bob H connections. As an overall average, we obtained the sifted key rate of 2.03 × 10 −3 bit per pulse and QBERs of 3.24% (Z basis) and 4.31% (X basis). Since we performed this experiment with higher QEs, the sifted key rates increased compared to those in Fig. 7a. Finally, we achieved an average SKR of 1.31 × 10 −4 bit per pulse (1.52 bit per second) for all connections using Eq. (4) with the finite-size effect. This result is comparable to that of Ref. 35 . Detailed experimental conditions and results are presented in Table 1.

DISCUSSION
In summary, we proposed a 2 × N Sagnac-based PnP TF-QKD network scheme. Although there exist reports 11,42 on the Sagnacbased TF-QKD network, our scheme is evidently different from it. Firstly, our architecture forms a star network rather than a ring network, and it is possible to add and remove a Bob without changing the channel losses and distances of the existing users. Moreover, channels between Charlie and Bobs are independent of each other. For example, operation failure of Bob V 3 channel does not affect operation of Bob H 1 . On the contrary, there are some features similar to those in the established TF-QKD networks 11,42 as follows. Given that SPDs are the most expensive devices for realizing QKD, our network scheme is cost-effective because it requires only a single pair of SPDs regardless of the number of network users, similar to other QKD networks 42,49-54 adopting TDM-based SPDs. Moreover, the optical modes of polarization, wavelength, and arrival time are naturally identical by the common path and laser properties of the Sagnac-based PnP architecture, and therefore, our setup can be implemented using fewer active controllers than in one-way TF-QKD networks, where the users have their own light sources. Lastly, as Alice and Bob comprise components only for timing synchronization and quantum state preparation, it would be relatively easy to add or remove them in comparison with the one-way TF-QKD networks. Fig. 7 Long-term stability of our experimental setup. a Sifted key rate and quantum bit error rates (QBERs) for a week. The stable sifted key rate and QBERs verify our system's ability to compensate for the environmental change. b Single-photon count rate (count per second) and optimal gate delay when heating and cooling the quantum channel (QC) and storage line (SL) between 22°C and 60°C. It shows that the timing calibration system can cope with the rapid temperature change. We performed a proof-of-principle experimental demonstration over a 50-km fiber successfully, measuring the QKD performances for 16 network connections using the SNS protocol 35,60,61 . Although our experiment uses the SNS protocol, our architecture is also suitable for other variants of the TF-QKD protocol 27,28,30 , including asymmetric TF-QKD protocols [73][74][75][76] . From the experimental observables, we finally estimated the SKRs with a complete finite-size effect and obtained 1.31 × 10 −4 bit per pulse (1.52 bit per second) as an average SKR of 16 network connections. Considering different conditions such as the QE, overall loss, and system specifications, our results are comparable with those of Ref. 35 using the same protocol. This shows the feasibility of our TF-QKD network configuration.
We focused on establishing the feasibility of our proposal in this work; however, several points should be considered for future practical systems. Firstly, as a proof-of-concept demonstration, we implemented our setup without careful packaging, such as using insulation and dedicated hardware cases for each user. However, when implementing a practical system, it should be sealed more carefully and located in an operating room to reduce errors induced by environmental factors such as thermal and vibration noises. Secondly, although we allocated more than 7 ms for the vacuum time due to our FPGA with insufficient memory, this should be reduced to increase the train repetition rate and lead to the SKR improvement. For example, with half the current train period time, the SKR in bit per second is expected to double. Using an FPGA with larger memory or external memory can be considered as a simple solution. Thirdly, we did not take account of reducing the round trip time between IM and FM, even though this primarily determines the pulse repetition rate. Thus, we set the repetition rate as 10 MHz considering a 60-ns round trip time. However, in a practical system, the round trip time should be reduced for increasing the pulse repetition rate. This also leads to improvement of the SKR due to the same principle as the second point. It is expected that this can be solved naturally to some extent by using chip-based devices. Fourthly, since the overall loss increases significantly owing to the length extension (twice that of original length) for the round trip, either a higher-power laser or an optical amplifier is required to overcome such a significant loss. For instance, with a quantum channel extended by 5 km (10-km round trip), the overall loss increases by 2 dB (10 km × 0.2 dB). Thus, the initial optical power should become higher to compensate for the increased loss. Furthermore, for using either a higher-power laser or an optical amplifier, careful management for the backscattering noise proportional to the laser power should be employed. Using longer SLs can mitigate the issue since they divide the signals and noises more strictly in the time domain. However, it should be taken into account that this can increase the round trip time. Other available methods are presented in Refs. 11,42 . Fifthly, there is no theoretical limit on the number of users. However, since the SKR for each user scales linearly with the number of network users, an efficient time arrangement is required. As a solution, dividing the users into several groups and allocating time to each group in sequence can be implemented. Using more detectors is another simple solution, but not an efficient method. Sixthly, Alice must distinguish wavelengths because she is connected to several Bobs with different wavelengths. There are two manners for this condition to be realized. The first is for Alice to measure the different wavelengths using N PDs and an AWG with N channels. This is the simplest method, but additional optical devices are required. Another method is for Alice to acquire timing information of different Bobs through classical communication with Charlie. Since Alice also knows the channel lengths between Charlie and Bobs, she can estimate Bob's timing easily. In fact, by assuming Alice's seamless communication with Charlie, the latter method is equivalent to that of Refs. 50,51 . Seventhly, an error rejection method 38,77,78 and optimization of operation parameters, such as the mean photon number, phase slice size, and signal proportion should be performed to improve the SKR. Finally, since the initial proposal of the PnP architecture, there have been concerns that using an untrusted light source may weaken the security against source attacks [64][65][66] . However, since deep verifications of security have been realized 34,62,[67][68][69] , and most attacks using light injection can be prevented by power and timing monitoring 11,33,42 , it has been widely used as a secure and practical structure in many studies 11,33,34,42,48,50,51,[56][57][58]62,63,79 to date. Nevertheless, at least the following attacks and countermeasures 34 should be considered.
(1) Trojan-horse attack 34,64 In the PnP architecture, as the worst case, Eve could substitute a stronger pulse and check the reflected signal to estimate the phase value sent by Alice and Bob. However, like usual PnP QKDs, our scheme can detect this attack by monitoring the pulse power. Furthermore, since the reflected signal involving phase information is strongly attenuated, Eve has to prepare significantly higher energy pulses in order to eavesdrop on sufficient information from the reflected weak signals. However, an alarm is triggered by power monitoring when the pulse energy exceeds the threshold. Besides, phase randomization can separate Alice and Bob from any possible reference system that Eve prepares in advance.
(2) Phase remapping attack 34,65,66 If Eve can change the arrival time of the pulses, the pulses pass through the phase modulator at different times, resulting in different phase modulations. This phase remapping process allows Eve to launch an intercept-and-resend attack. However, users can detect this attack by monitoring the time-shifted pulses. Moreover, this attack commonly induces a large QBER, such as 15.5% in the theoretical limit. However, as shown in our experimental result, QBERs were maintained at <5%, enabling easy detection.
(3) Photon number splitting (PNS) attack 34 In our scheme, Alice (Bob) reflects the pulses with or without modulations twice. For the reflection case without modulations, Eve cannot eavesdrop on any information since no information is encoded on the pulses. Furthermore, the case with modulations does not allow Eve's PNS attack as the attack is detected easily by using the decoy-state method.
Although several improvements and considerations need to be accounted for, we believe that our current results provide a foundation for QKD commercialization.

Decoy-state method analysis
The same method as in Ref. 61 is used to calculate s Z 1 and e ph 1 in this work. In the protocol, Alice and Bob prepare and send the phase-randomized coherent pulses, regarded as a mixture of photon number states where μ j ¼ α j 2 is the intensity of the coherent state α j i . Then, the state when Alice decides to send the vacuum state and Bob decides to send ρ αk is ρ α0αk ¼ e Àμ k P 1 n¼0 μ n k =n! 0nih0n j j . With these convex forms, the lower bounds of the yields of the state ρ αz 01 ¼ 01ih01 j jand ρ αz 10 ¼ 10ih10 j jcan be written as the following formulas 80 .
s z01 ! s L z01 ¼ μ 2 2 e μ 1 S 01 À μ 2 1 e μ 2 S 02 À μ 2 2 À μ 2 1 À Á S 00 μ 1 μ 2 μ 2 À μ 1 ð Þ s z10 ! s L z10 ¼ μ 2 2 e μ 1 S 10 À μ 2 1 e μ 2 S 20 À μ 2 2 À μ 2 1 À Á S 00 μ 1 μ 2 μ 2 À μ 1 ð Þ where S 0k are the yields of the sources ρ α0αk for k = 1,2, S j0 are the yields of the sources ρ αj α0 for j = 1,2, and S 00 is the yield when both Alice and Bob send the vacuum state. With these formulas, the lower bound of the yield of single-photon state in the Z basis, i.e., the state ρ Z 1 ¼ 1 2 ðρ αz 01 þ ρ αz 10 Þ, can be described as From Ref. 61 , we know that the phase-flip error rate e ph 1 is asymptotically equal to the bit-flip error rate of the single-photon state in set C Δ . The bitflip error yield for all instances in set C Δ is where T k (k ¼ Δ; Δ þ ; Δ À ) is the proportion of wrong effective events in C k . Then, attributing all the errors to the single-photon state and vacuum state, the upper bound of the phase-flip error rate e ph 1 can be estimated by e ph 1 e ph 1 ¼ T Δ À 1=2e À2μ 1 S 00 2μ 1 e À2μ 1 s Z 1 (10) where s Z 1 is the lower bound of s Z 1 .

Finite-size effect analysis
The analysis used in this work is the same as that in Refs. 35,60,61 . To extract the secure final key from finite-size data, we have to consider the effectiveness of statistical fluctuations and the security coefficient of the protocol. To obtain the lower bound of s 1 and the upper bound of e ph 1 in the real protocol with finite N total , one can employ the average yield. Thus, we define 〈S〉 as the mean value of yield S. Although S jk (j,k = 0,1,2,z) can be directly observed in the experiment, the mean value 〈S jk 〉 cannot be observed. However, given S jk and N jk , the confidence lower and upper limits of 〈S jk 〉 can be calculated. For strict estimation of the lower bound of hs Z 1 i, we introduce the following two yields.
Replacing the observed yields with their mean values in Eqs. (8) and (10), we can derive the mean values of the lower bound of hs Z 1 i and the upper bound of he ph 1 i as follows.
hs Z 1 i ! hs Z 1 i ¼ μ 2 2 e μ 1 S 1 À μ 2 1 e μ 2 S 2 À μ 2 2 À μ 2 1 À Á S 00 μ 1 μ 2 μ 2 À μ 1 ð Þ and he ph 1 i he ph 1 i ¼ T Δ À 1=2e À2μ 1 S 00 2μ 1 e À2μ 1 hs Z 1 i with for B ¼ S; T and k ¼ 00; 1; 2; Δ. By using the multiplicative form of the Chernoff bound with a fixed failure probability ϵ and the observable S k , we can obtain an interval of 〈S k 〉, i.e., S k ; S k Â Ã , which can bound the value of 〈S k 〉 with a probability of at least 1-ϵ. Explicitly, with a function With hs Z 1 i and he ph 1 i defined in Eqs. (12) and (13), respectively, the lower bound of the yield s 1 and the upper bound of the phase-flip error rate e ph 1 corresponding to Eq. (4) can be estimated by and e ph 1 ¼ he ph 1 i 1 þ δ 0c where δ c 1 ¼ f δ a 1 N c zz hs Z 1 i; ϵ À Á and δ 0c 1 ¼ f δ a 1 N c zz s 1 he ph 1 i; ϵ with N c zz ¼ 2p z1 1 À p z1 ð Þ N zz and a 1 ¼ μ z e Àμ z being the probabilities of emitting a single-photon state from source ρ αz .