Towards metropolitan free-space quantum networks

Quantum communication has seen rapid progress towards practical large-scale networks, with quantum key distribution (QKD) spearheading this development. While fibre based systems have been shown to be well suited for metropolitan scales, suitable fibre infrastructure may not always be in place. Here, we make the case for an entanglement-based free-space quantum network as a practical and efficient alternative for metropolitan applications. We developed a deployable free space QKD system and demonstrated its use in realistic scenarios. For a representative 1.7-km free-space link, we showcase its ad hoc deployability and achieve secure key rates of up to 5.7 kbps, with 2.5 kbps in direct noon sunlight. By extrapolating experimental data, we show that kbps key rates are achievable even for 10-km distances and multi-user scenarios. We anticipate that our work will establish free space networks as a viable solution for metropolitan applications and an indispensable complementary building block in the future global quantum internet.


Introduction
The core functionality of a quantum communication network is to distribute quantum information between two or more parties 1 .Many revolutionizing applications of quantum networks have already been identified and a roadmap towards full-blown quantum internet has been proposed 2 .While there are still many uncertainties as to the technological platforms that will ultimately make up the quantum internet, one thing is clear: it will be a heterogeneous network of various special purpose sub-networks that employ different types of links and interconnects.
Quantum key distribution (QKD) networks have so far been the driving force for this development 3 .Although certainly not the only networks of interest, they have been paving the way also for other distributed quantum information processing protocols.For this reason, achievable secure key rates have often been used to benchmark the level of technological maturity of quantum networks in general.Currently, connecting many users distributed over large distances requires trusted nodes 4 , which comes with the price of losing any possibility of end-to-end security.Unlocking the full quantum advantage in global-scale networks is therefore an ongoing challenge.A substantial proportion of current research is focused on extending the reach of individual quantum links, either through satellites [5][6][7][8] or fibre-based quantum repeaters [9][10][11] .
Over shorter, metropolitan-scale distances, where end-to-end quantum state transmission is more easily achieved, the research focus is on a different set of challenges.One of the primary concerns is the question of scalability, i.e. how to increase the number of users in a network [12][13][14][15] .Another line of research aims to make metropolitan quantum network technology more accessible, flexible, and deployable [16][17][18][19] .An important challenge is also to interconnect networks based on different physical platforms 20 .However, all this progress is made almost exclusively with optical fibre links.
In some metropolitan application scenarios, end-to-end fibre links are not feasible.A possible alternative are terrestrial free-space links.These are still far behind the technological maturity of fibre-based systems, particularly in terms of the availability of off-the-shelf and plug-and-play solutions that are required for their deployment.Free-space links face additional challenges, such as link alignment, atmospheric turbulence, and daylight noise 21 .
In the following, we argue that entanglement distribution is particularly well-suited to metropolitanscale networks.Among the plethora of prepare-and-measure implementations, however, only a handful of groups has performed entanglement-based QKD over terrestrial free-space links [22][23][24][25][26][27][28][29][30][31][32] , of which merely two were performed in daylight (see Supplementary Information for a detailed review).Note, that many of these experiments explicitly aimed at advancing technology towards satellite deployment, while the specific challenges of readily deployable terrestrial networks was rarely addressed.Secure key rates in the order of hundreds of bits per second (bps) have been achieved over kilometre distances at night 23,27 , while in daylight, similar rates have been demonstrated over a distance of only 350 m 26 .It has therefore been widely argued that the entanglement-based approach lacks the technological maturity and applicability of alternative approaches [33][34][35][36][37] .
Here, we make the case for a metropolitan free-space network architecture that can be deployed to secure communication at summits, conferences, and other events, or complement an existing network infrastructure whenever end-to-end fibre connections are not available.The architecture is built around a central entanglement server that streams entangled photons to users on the network.We developed the key building blocks of this architecture, including: a portable high-visibility entangled photon pair source, deployable and efficient free-space terminals that are specifically designed for metropolitan applications, and compact and passive quantum state analysis and detection with dedicated filtering for daytime operation.To demonstrate the competitiveness of this approach in terms of efficiency, we benchmark its key generation capacity in several link configurations.We performed QKD experiments in realistic metropolitan scenarios: over a 1.7-km link to a temporary container atop another building and between two government offices separated by 300 m, showcasing its capability of providing ad hoc quantum security.We demonstrated record kbps rates are achievable in nighttime as well as in broad daylight.Finally, we provide estimates of key rates for longer 10-km links and for scenarios with multiple free-space links.

Entanglement-based quantum network
We consider a network architecture, where an entangled photon source acts as a server that streams entanglement into a metropolitan-scale network consisting of free-space links (Fig. 1a).The natural choice for placing the entanglement server (ES) is a central high-rise building with a clear line of sight to the relevant urban areas.Each of the end users owns a quantum receiver subsystem (QRS), which typially incorporates quantum state analysis and detection, timing and synchronisation electronics, and post-processing software.Although the network has a star topology at the physical layer (Fig. 1b), recently proposed multiplexing strategies can leverage the nonlocal correlations of entangled pairs to provide a fully connected mesh network at the quantum communication layer 12,15,19 .
Employing quantum entanglement as the main network resource has several key advantages over the more established prepare-and-measure schemes.Entanglement offers additional layers of security via the prospect of device-independent protocols 38 .The ES can thus act as an untrusted relay node and lift the requirement for direct line of sight between the transceiver telescopes of any two users.Furthermore, the ES is all passive, meaning that the post-processing is delegated downstream to the user, which allows for standardization of ES, while the users can use an application-specific QRS.This gives a large degree of flexibility and even upgradeability, as more advanced schemes, protocols, and post-processing methods become available over time.Moreover, entanglement quite naturally supports many other promising applications beyond QKD 21 .Fig. 1: Metropolitan entanglement-based free-space network.a, A standardized centrally located entanglement server (ES, black box) is streaming entangled photons into the network.Free-space channels are used to connect distant buildings and parts of a metropolitan area, while fibre connections may still be used in a complementary way, for example, to connect to offices within the central building.Each end user owns an application-specific quantum receiver subsystem (green boxes).b, The corresponding physical layer network topology.At the quantum communication layer, the network is a pairwise connected mesh, so that every end user can communicate with any other (not shown).c, A near-term extension possibility using several ESs and a central trusted node.d, Eventually, by introducing entanglement swapping, the trusted node could again be turned into an untrusted one, while the overall network topology would remain unchanged.
The network size and reach can be readily extended by introducing several ESs, all interconnected through a central trusted node and each distributing entanglement to end users in their own local areas (Fig. 1c).In a more distant future, the requirement for trusting the central node could eventually be lifted by introducing entanglement swapping 39 , without changing the physical network topology (Fig. 1d).As indicated in Fig. 1a, the architecture is also not limited to free-space links -the ES can act as a convenient interface between a free-space and a fibre link segment, for example, to connect a metropolitan freespace network to the fibre backbone of a larger intercity network.

Experimental setup
We developed a quantum communication system specifically suited for metropolitan applications.It consists of all the key building blocks necessary to implement the present free-space quantum network and can be fully deployed at a new site in less than a day, without requiring prior infrastructure apart from access to electricity.The system is schematically shown in Fig. 2 and resembles the Alice-Bob segment of the network in Fig. 1a.Our ES generates pairs of polarization-entangled photons at 810 nm (Methods), of which one is sent to Alice via a single-mode fibre, while the other one is sent to Bob using a free-space link.For fine alignment of the free-space link and beam stabilization, we use a 1064 nm beacon laser beam, which co-propagates along the signal photons from Alice to Bob.Analysis of the beacon beam at Bob provides a feedback signal for two fast steering mirrors, which in turn counteract fluctuations and stabilize the free-space channel in the presence of atmospheric turbulence and mechanical system instabilities.The use of a closed-loop beam stabilization system enables long-term operation and also facilitates the use of a spatial filter with a small field of view at Bob, which is necessary for daylight operation of the system (Methods).Fig. 2: Experimental setup.An entangled photon source (EPS) acts as a server that generates pairs of polarization-entangled photons at 810 nm.One photon of each pair is sent to Alice via a single-mode fibre, while the other one is sent to Bob via a free-space link spanned by a transmitter and a receiver telescope (Tx and Rx).A 1064 nm beacon laser (BL) creates a reference beam that is combined with the quantum signal at a dichroic mirror (DM) and co-propagates with it over the free-space link.At Bob, the beacon beam is analysed in a dedicated module consisting of four position sensitive detectors (4xPSD), which generates feedback signal for two fast-steering mirrors (FSM) that in turn stabilize the beam.Both Alice and Bob own a quantum receiver subsystem (QRS-A and QRS-B) for generating the secret key.Optical elements that are irrelevant for the present experiment have been left out for clarity here.The free-space link shown here is the 1.7-km link in Jena, Germany, between Fraunhofer IOF and Stadtwerke Jena.
Both Alice and Bob own a quantum receiver subsystem (QRS), which we developed for performing QKD with the BBM92 protocol 40 (Methods).Bob's QRS further incorporates specially designed spectral and spatial filtering modules for daylight operation.Alice's QRS, on the other hand, does not require dedicated filtering of daylight noise, since it is not directly exposed to the free-space link.Bob's QRS is also equipped with a motorized polarization controller that allows for automated alignment of the polarization frame of reference with Alice.The classical channel between Alice and Bob's QRS is realized with commercial radio antennas.

Results
Using our system, we established a quantum link in Jena, Germany, between Fraunhofer IOF and a temporary container on top of a 1.7 km distant public service building.In Fig. 3, we benchmark the system performance in terms of quantum bit error rate (QBER) and achievable secure key rate (SKR) for two experiments that cover two extremes of link conditions: nighttime, when the background noise is negligible and the atmospheric turbulence weaker, and daytime, when solar radiation introduces considerable background noise and the turbulence is typically stronger 41 .For reference, we also show Bob's detected count rates, which are further split into signal and background noise contributions (Methods), as well as solar radiation measured by a weather station.
During the night experiment on 2 March 2022, we demonstrated a stable performance with QBER of less than 2%, resulting in an average SKR of 5.4 kbps over several hours.During the daytime experiment on 25 February 2022, however, the system performance varied to a much greater extent.At the beginning of this experiment, right before noon, the link was exposed to direct sunlight, i.e. no clouds were blocking the Sun as seen from the link (Supplementary Information).During these conditions that lasted roughly half an hour, the detected noise rates reached values larger than 400 kcps and were up to 3.8times higher than the detected signal rates, despite strong spectral and spatial filtering.Nevertheless, the resulting QBER was kept below 3.4% and the SKR above 2.5 kbps, thanks to the further strong temporal filtering allowed by the tight temporal correlations of entangled photons.Over the next few hours, small clouds sporadically blocked the Sun, in turn reducing the background noise and restoring the system performance.Furthermore, we can see a clear correlation between the background photon rates and the independently measured solar radiation, and that the system performance varies as a direct consequence of sunlight.The only exception is the last drop of performance that happened after 14:00, which was not due to daylight but due to a sudden drop of the ES output, which is indicated by the simultaneous sharp drop of detected signal rates at Bob (Fig. 3) and at Alice (Supplementary Information).
We note that unlike for spatial filtering, the full potentials of spectral and temporal filtering were not exploited in daytime experiments.Optimizing the spectral filter bandwidth and coincidence window could substantially increase system resilience to daylight noise and increase the achievable secure key rates.The reported secure key rates are -secure with  < 10 -10 (Methods), however, even security of  < 10 -20 could be achieved by sacrificing only about 0.1 kbps of SKR (Supplementary Information).We extrapolated our measurements to estimate achievable secure key rates for longer links and multiuser scenarios (Methods).By taking the experimental data from our night experiment and considering additional loss in Bob's channel as estimated for a 10-km link, we arrive at SKR of 3.3 kbps.For a similar extrapolation of the daytime experiment data, scaling of the background noise rates on the distance would need to be further considered, which is beyond the scope of this work.
To gauge the performance in other link configurations, we simulate a scenario, consisting of two independent 1.7-km free-space links from the ES to Alice and Bob (Methods).Extrapolation of experimental data obtained during the night experiment shows that a SKR of more than 1.1 kbps would be possible.However, for the case of direct exposure of both links to sunlight, optimization of filtering parameters in all degrees of freedom would be required.For example, a 3-fold decrease of the spectral filter bandwidth to 1 nm would result in a SKR of more than 200 bps and optimization of the coincidence window offers further space for improvement.These estimates apply also to a general multi-user scenario based on wavelength division multiplexing, where each of the users is separated by an identical 1.7-km free-space link from the ES, assuming a perfect and uniform partition of the ES emission spectrum into the multiplexed channels (Methods).
Finally, we note that in July 2021, we deployed the system to establish a free-space QKD link between two 300 m separated government offices in Bonn, Germany, where we achieved similar key rates in night and in full daylight.

Discussion and conclusion
We proposed an entanglement-based free-space quantum network architecture as a viable solution for metropolitan scales.With a fully deployable QKD system, which is particularly suitable for ad hoc implementation in scenarios where fibre connections are infeasible, we demonstrated all the main building blocks of such a network.We achieved up to 5.7 kbps secure key rates over two different links and under various link conditions, with over 2.5 kbps in full daylight, indicating that the system has a potential for 24/7 operation.To our knowledge, this is the first demonstration of kbps-rate free-space QKD over kilometre distances with an entanglement-based approach.Moreover, it is an improvement of entanglement-based QKD daylight capability by an order of magnitude in both secret key rate and link range 26 .The results are also competitive with prepare-and-measure systems.With our large-aperture free-space terminals, specifically designed for metropolitan applications, we estimate kbps key rates are possible even over 10-km links.A full coverage of a city is therefore within reach with the present technology.
By implementing the quantum channel at 810 nm, we break with ongoing trends of transferring the freespace segments to telecom C band wavelengths.Network architectures implemented in C band typically strive to minimize the number of detectors 4,42 , which is due to the fact that single-photon detection at 1550 nm is a cost driver.This does not apply in our case, where transmitter and receiver systems are of similar cost and complexity.However, 1550 nm will almost certainly remain the wavelength of choice for long fibre segments due to a substantially lower loss.A non-degenerate entangled photon source 43 , which emits photons at 1550 nm and 810 nm, could therefore act as an elegant interface between fibre and free-space segments of a heterogeneous network.
There are many possible improvements to the present system on the horizon.Extending the two-user scenario to a fully connected multi-user network is straightforward with the latest multiplexing techniques 12,15,19 .By combining such a multiplexing scheme together with our system, we estimate kbps nighttime and hundreds of bps daytime rates are possible for a multi-user scenario with multiple 1.7 km free-space links.Sources that are capable of providing a large spectral bandwidth for multiplexing have been recently demonstrated, for example by Lohrmann et al. 44 Recent developments towards ultra-bright GHz rate entangled pair sources 44,45 show that a single entanglement server could support many end users.
Adaptive optics (AO) could significantly improve daylight performance by reducing the effective focal spot size and thus giving the possibility for tighter spatial filtering 34,37 .Furthermore, with efficient AOenabled single-mode fibre coupling, hybrid free-space-to-fibre quantum links become possible.This would allow for physical separation of the end user from the receiver free-space terminal, introducing considerably more flexibility.Entanglement swapping 39 would not only increase the extent of the present network without the need for trusted nodes, but it would also enable integration into larger heterogeneous networks that employ fundamentally different forms of entanglement 20 .
Another way forward is to exploit high-dimensional entanglement, which promises higher information capacity per photon, better security, and enhanced robustness to noise 46,47 .Although the practicality of orbital angular momentum (OAM) modes remains questionable for long-distance free-space communication 48 , the OAM-entanglement might still be well suited for metropolitan distances 49 .AO would further improve key rates by protecting spatial mode entanglement from the influence of atmospheric turbulence 50 .An entangled photon source can also generate hyperentanglementsimultaneous entanglement in different degrees of freedom -quite naturally 51 , which could be used to make a single server compatible with a range of receiver types.A recent experiment demonstrates that extending entanglement into the time-bin degree of freedom could also significantly boost secure key rates 52 .
Finally, the distribution of entanglement lies at the heart of many applications beyond QKD.Practical and efficient metropolitan entanglement distribution networks would therefore facilitate the development of entirely new applications at the intersection of distributed sensing and quantum information processing, such as quantum clock synchronisation 53 , long baseline interferometry 54 , and multi-partite quantum cryptography 55,56 .

Entanglement server
Our entanglement server (ES) consists of an entangled photon source, which generates bipartite polarization entanglement.It is based on type-2 spontaneous parametric down conversion (SPDC) in a periodically poled potassium titanyl phosphate (ppKTP) crystal, employing an intrinsically phase-stable Sagnac configuration 57 .Pumping the crystal with a 405 nm laser generates an entangled pair state at 810 nm, which is of the form where H and V are horizontal and vertical polarization states, and subscripts s and i stand for signal and idler paths.Coefficients β and  are adjusted by manipulating the polarization of the pump to achieve a maximally entangled Bell state that we use for QKD.
During our experiments, the intrinsic photon pair generation rate (before any loss is considered) of the ES was estimated to be approximately 12 million pairs per second, over a spectral bandwidth of 0.45 nm (FWHM).Visibilities of up to 99.5% and 97.4% were measured in the low pump power limit for horizontal-vertical and diagonal-antidiagonal basis, respectively.The source was built on an optical breadboard and housed in a wheeled 19-inch rack.

Quantum receiver subsystem
We developed two complete quantum receiver subsystems (QRS), one for Alice and one for Bob, for performing QKD based on the BBM92 protocol 40 .Each QRS consists of a standard polarization analysis module (PAM), 4 single-photon avalanche diodes (SPADs), time-tagging electronics, a rubidium clock, and units for post-processing.In the PAMs, we realized the randomized basis selection with a 50:50 beam splitter.We note, that this splitting ratio is not optimal and that by using a biased basis randomization, the final secure key rate could be further improved, albeit only slightly 28 .We used commercial single-photon avalanche diodes (SPADs) with detection efficiency of > 60%, dark count rate of < 500 cps, and timing resolution of 350 ps.To ensure matching of polarization frames of reference at Alice and Bob, a QRS also incorporates a waveplate-based polarization controller.For the night experiment, polarization basis alignment was performed right before the experiment, while for the daytime experiment, it was performed the night before, since the absence of background noise allowed for better initial alignment.See Supplementary Information for more information about the QRS.
Alice's QRS is almost identical to the QRS of Bob -the only difference is in its PAM, which is a much more compact and simplified version of Bob's.This is because Alice detects photons that are coming from the server via a single-mode fibre and is therefore not exposed to the free-space link environment and related challenges.Bob's PAM, on the other hand, incorporates additional spatial and spectral filters for daylight operation, as discussed in the next section.The complete QRS of Alice was housed in a wheeled 19-inch rack, while Bob's PAM was mounted directly onto the receiver free-space terminal and the rest of his QRS was housed in a rack.

Daylight noise filtering
Noise suppression turns out to be of critical importance in a free-space channel, particularly during daytime, when atmospheric scattering of sunlight can cause the receiver telescope to collect noise photons at rates that are many orders of magnitude higher than the signal photon rates.To reduce the noise, we employ filtering in all three degrees of freedom: spectral, spatial, and temporal.Spectral filtering is realized with a stack of commercial interference filters, resulting in a 3 nm wide pass-band (FWHM) around the signal wavelength of 810 nm.The spatial filter consists of a Keplerian telescope with a tiny aperture in its focal plane, which has the effect of reducing the overal receiver system field of view (FOV) 58,59 .For our daylight experiments, we thus reduced the system FOV to 31 μrad, which was just large enough to transmit the majority of the signal, while blocking considerable amounts of noise.For comparison, this FOV is 2 orders of magnitude smaller than the FOV of our receiver telescope, resulting in a noise reduction by 4 orders of magnitude (noise rate scales with the square of the linear FOV), assuming a uniform distribution of noise over the FOV.For the nighttime experiment, the limiting field stop was the core of the multi-mode fibres in PAM, which resulted in the system FOV of about 52 μrad.Spectral and spatial filter modules were directly integrated into Bob's quantum receiver subsystem.Temporal filtering, on the other hand, comes with the coincidence-based detection.
For both experiments here, coincidence window of 1 ns was used.Note, that this was near-optimal for the night experiment, however, its optimization in daytime could improve the achievable secure key rates.Furthermore, comparing our signal and filter spectra shows that we could employ at least a 3times narrower spectral filter, reducing the noise by a factor of 3 while not considerably affecting the signal throughput.

Free-space terminals
We developed two portable and highly versatile optical free-space terminals 60 .For the experiments presented here, we used the 810 nm channel for the quantum signal and the 1064 nm channel for the beacon laser, and the beam stabilization subsystem at the receiver terminal.Both terminals incorporate identical transceiver telescopes, which are based on an afocal three-mirror anastigmat (TMA) design combined with an additional fourth mirror to reduce the size and improve the optical quality.The offaxis telescope layout renders the transceiver system with high signal throughput due to the absence of a central obscuration.The shape of the individual mirrors is designed to provide diffraction-limited performance over the full telescope aperture of 200 mm and the entire FOV of 3.5 mrad.Furthermore, such a large aperture prevents severe signal loss due to diffraction and atmospheric turbulence even over link distances of several kilometres.At 810 nm, for our transmitter beam waist of 40 mm and following the well-established approach to model beam propagation through Kolmogorov turbulence 61 , we estimate near-zero loss due to beam spreading (diffraction combined with turbulence induced spreading) over a 1.7 km link under medium turbulence with refractive index structure parameter Cn 2 = 10 -15 m -2/3 .For a 10 km link and the same Cn 2 , we estimate the average loss due to beam spreading to still be as low as 2.1 dB (see Fig. 4), making these terminals particularly suitable for low-loss free-space links over metropolitan distances.For more technical details about the terminals, we refer the reader to 60 .

Post-processing and secure key rate calculation
The first step of post-processing is to read data from the time-taggers.Alice and Bob exchange lists of time-tags and conduct time synchronization in two steps.First, a progressive cross-correlation-based pre-synchronisation algorithm with complexity ( log ) is used to establish an initial clock offset over a wide range of multiple seconds.Once a coarse offset is found, fine synchronization works on a smaller block size that depends on the number of detections (Supplementary Information).For a more detailed discussion of similar approaches, we refer the reader to 62 .
The sifting stage compares the measurement bases of the detections and keeps only events that share the same basis.The error estimation stage discloses a fraction of 10% of sifted key data in order to estimate the error rate in the quantum channel.Note, that the fraction of disclosed bits can be optimized to increase the amount of secure key, however, this was beyond the scope of experiments here.Information reconciliation (error correction) is then performed according to the cascade protocol 63 so that Alice and Bob agree on the same key with probability close to one.The subsequent confirmation stage tests whether information reconciliation was successful, i.e. it ensures the correctness of Alice's and Bob's key up to a minor error probability  (the probability that Alice's and Bob's key differ and the confirmation stage does not detect it).For each key, Alice and Bob choose at random a hash function from a family of universal polynomial hash functions and calculate, exchange, and compare a hash of  = 96 bits of their reconciled key data.This results in  = 2 , where  is the number of bits after sifting and  is the number of bits disclosed during error estimation.
For the experimental results reported here, all of the above was done online during the experiments.
Secure key rates, taking into account also finite key effects, were then calculated offline using the security proof from 64 .The length of the secure keys is given as with where  is the number of bits disclosed during information reconciliation,  is the error rate threshold for the parameter estimation test,  is the accepted failure probability due to privacy amplification, and  is the accepted probability that the actual error rate is larger than  + , given that the parameter estimation test has been passed.We also introduced , which corresponds to the length of the one-time pads used for encryption of authentication tags (the factor 2 represents one tag for each direction), since the original security proof assumes an authentic channel.We performed calculations on data blocks corresponding to 5-minute measurement times, with  = 0.034 and  = 96, and chose the total failure probability of the QKD protocol over an authentic channel  = 10 -11 .We further set  =  × 10 - 3 and  =  - - .The overall security of the calculated keys can be finally assessed by the parameter , which takes the authentication into account, and the fact that a part of the QKD keys is used for the authentication of the next round. grows with the number of processed data blocks  as 65 with  = 2 , where  is the length of the authenticated classical communication exchanged (in bits).
While these results were calculated offline, we note that the system is fully capable of live on-the-fly secure key generation.The system can implement the necessary steps, including delayed authentication according to 66 with polynomial universal hashing over GF(2 ) with a pre-shared secret key, and privacy amplification using a Toeplitz matrix approach.The estimated rates reported here closely match the rate of secure keys generated live.

System efficiencies
To calculate system efficiencies, we adapt the model from 67 .We first determine the coincidencewindow-dependent detection efficiency where  is the coincidence window and  is the full width at half maximum of the  ( ) function, i.e. the correlation between Alice and Bob's detector clicks.Since  primarily depends on the time jitter of the detectors, we regard it as a constant of our system.We measured its value to be  = 710 ± 8 ps.
Together with  = 1 ns, this results in  of about 83.8%.During the experiments, we were using 10% of the detection events for estimating Alice and Bob's single detection rate  and  , respectively, and the coincidence detection rate  (these events are excluded from the key calculation).We calculate the true coincidence rate as where the accidental coincidence rate is estimated as Furthermore, by subtracting the dark count rate  and the background noise rate  from the detected single rates, we arrive at the contribution of the true (signal) photons, where superscript i ∈ {a, b} stands for Alice or Bob.We may then determine the total system efficiencies for Alice and Bob (sometimes called heralding efficiencies) as These system efficiencies account for all the single channel losses from the moment a pair is created until it gets processed by the software, therefore it includes also detector efficiencies.The dark count rates are also regarded as system constants and we measured them to be  = (1,702 ± 21) cps and  = (761 ± 7) cps, on average.
For the night experiment, background count rate was negligible, therefore we can set  and  to zero.This allows us to use the model above to characterize  and  .They are found to be very stable throughout the experiment, with the mean and standard deviation of (8.90 ± 0.03)% for Alice, and (1.63 ± 0.08)% for Bob.For the daytime experiment, we can estimate  in the same way, since Alice's channel was fully fibre-based and thus experienced negligible background count rates.Doing so results in  = (1.25 ± 0.35)%.On the other hand, Bob's background was far from negligible during this experiment, therefore we cannot extract  in the same way.However, while  depends on the link conditions that may considerably change throughout the day,  is not expected to considerably change for days.We therefore characterized it the night before, arriving at  = (8.13± 0.09)%.
The lower mean and the higher standard deviation of  for the daytime experiment is not surprising, since narrowing down the spatial filter incurred additional loss and increased link efficiency fluctuations due to atmospheric turbulence.Note, that the source was realigned just before the night experiment, hence a slightly better  then.

Solar radiation and background count rate
To quantify sky brightness during our experiments, solar radiation data was extracted from the publically available database of the University of Applied Sciences Jena ‡ .The measurements were performed using a pyranometer, which measures total incident solar radiation over the whole hemisphere in the spectral band between 300 nm and 2.8 µm.The pyranometer was located approximately 1.2 km from Alice and approximately 2.6 km from Bob.Although not measured exactly where our experiments took place, and ‡ http://wetter.mb.eah-jena.de/station/index.htmldespite being measured over a much broader spectral range compared to our QKD spectral filter bandwidth, it still offers a reasonable metric for quantifying system-independent sky brightness at the link.This is evident from its corellation with the detected daylight noise (Fig. 3), which we estimate in the following way.As above, we determine the true coincidence rate  from the detected rates.This time, however,  also consists of a considerable contribution of  due to daylight.Using  that was determined the night before, we can estimate  from  and with it extract  from  , following the relations given above.

Performance estimation for a 10 km link
Extending the free-space link to longer distances would introduce an additional loss factor of η to Bob's signal channel.Using the secure key rate model from 67 , it is straightforward to show that in the limit of much larger received signal compared to noise rates, key rates would scale linearly with η.During our night experiment, we achieved a mean secure key rate of 5.4 kbps, while the estimated mean total count rate at Alice and Bob was 1.0 Mcps and 190 kcps, respectively.During this experiment, total noise count was less than 2 kcps for Alice and less than 1 kcps for Bob, consisting mostly of dark count.For a 10-km link, where we estimate η = 10 -2.1/10 ≈ 0.62, as discussed above, we can therefore assume linear scaling of the key rate with η and thus expect 3.3 kbps key rate to be achievable with our system in nighttime.

Extrapolation to multiple free-space link scenarios
To estimate achievable key rates in a dual free-space link scenario (two 1.7 km free-space links with ES in the middle), we take Bob's channel parameters and count rates extracted from our experiments and assume the same for Alice's channel.In particular, we first extract  and  for our system, as explained above.Together with the directly measured  , we may then estimate true and accidental coincidence rate in such a scenario as and Imperfections in the ES, PAMs, and alignment of the polarization frames of reference at Alice and Bob lead to occasional erroneous polarization measurements 67 .We extract the rate at which this happens from the experimental data as where  is the sum of measured coincidences in the wrong channels and  are the total measured coincidences after sifting.Finally, we assume a constant error correction efficiency of 1.1 (which is very close to the values achieved during our experiments) and estimate the key in the asymptotic limit according to the model in 67 .
We can also extend these results to a multiple free-space link scenario based on wavelength division multiplexing, which was already demonstrated to work well in optical fibres 12,15 .Here, each of the  users in the network establishes a secure key pairwise with every other user, resulting in  = ( − 1)/2 different secret keys generated in parallel.Since each pair of channels connecting any two users is independent from every other user pair, this means that a fraction / of the intrinsic ES pair generation rate  is used for generation of each key, assuming the ES emission spectrum can be uniformly distributed over the multiplexed wavelength channels for simplicity.Employing such wavelength division multiplexing and a -fold increase of the ES pump power, we would therefore arrive at the same key rate predictions for a multiple free-space link case as in the dual free-space link case, assuming all the free-space links are identical.Here, we provide a review of reported successful quantum key distribution (QKD) experiments with entangled photons that were performed using free-space (FS) links (Table 1).All were performed between two users, employing signal wavelengths around 800 nm.While some demonstrate a dual FS link scenario 1,4,7,9 , most were done over a single FS link.Achieved secure key rates heavily depend on the FS link distance.Over a 143 km terrestrial link, some 100 bps mean key rate was extracted for about a minute 10 .Note, that experiments over the particular 143-144 km link on Canary Islands 3,10 are quite obviously aimed at space applications.In fact, a large portion of all the experiments explicitly state satellite implementations as the aim and two actual satellite experiments have already been reported 8,9 .Experiments with more direct implications to metropolitan scenarios are a stable 10-h QKD with an average rate of 630 bps over a 1.5 km link in nighttime 2 and a daylight QKD with 250-400 bps over a 350 m link 5 .Quite recently, the first successful use of entangled quantum dots for FS QKD has been reported 11,13 , however, the demonstrated secure key rates are still 1-2 orders of magnitude lower than for those that are based on the process of spontaneous parametric down-conversion (SPDC).

Quantum receiver subsystem -details
Bob's quantum receiver subsystem (QRS) is schematically shown in Sup.Fig. 1.Signal photons that come from the server via a free-space link are analysed in a polarization analysis module (PAM).Here, polarization is projected into one of two mutually unbiased bases, chosen at random for each photon, which is realized with a 50:50 beam-splitter (BS).Photons that are transmitted by the BS are projected into the horizontal-vertical basis by the means of a polarization-beam-splitter (PBS) -we used high-extinction-ratio Wollaston prisms for that purpose.In the reflection arm of the BS, the additional half-wave plate rotates polarization of the photons by 45°, which in turn makes the subsequent PBS project them into the diagonal-antidiagonal basis.All the four outputs are finally coupled into multi-mode fibres and guided to the detectors.Each detector click is given a precise arrival time by a rubidium clock driven time-tagging Time-tags from both sides are synchronised and processed by a dedicated post-processing software in real-time.
Finally, we need to ensure matching of polarization frames of reference at Alice and Bob.While each optical component along the path can in principle introduce some polarization transformation, by far the largest is due to the optical fibres that guide the photons from the ES.For this reason, Bob's PAM incorporates a polarization controller that consists of a stack of half-and quarter-wave plates in motorized rotation mounts.By rotating the wave plates, we can realize a transformation that inverts the net transformation of the optical elements and fibres.To find the inverse transform in practice, we insert a polarizer into the entangled photon source to send a well-defined reference polarization to Bob's PAM and then use the polarization controller to maximize the signal in the corresponding detection channel.Sup.Fig. 1: Quantum receiver subsystem at Bob. a, The incoming free-space photons get sorted into 4 fibre channels according to their polarization state in the polarization analysis module (PAM-B) and detected with a single-photon avalanche detector (SPAD).Each SPAD click is given a precise arrival time by a rubidium clock (CLK) driven time-tagging (TT) unit.The postprocessing software (PPS) processes the raw time-tags and generates encryption keys, which are fed to a key management system (KMS).From there, keys are pulled upon request for encryption (EC) of the classical communication channel between Alice and Bob.b, In PAM-B, a polarization controller (PC), consisting of a stack of waveplates, aligns Bob's polarization frame of reference with that of Alice.Excess noise is removed with a spatial filter (SF) and a stack of interference filters (IF).A 50:50 beam-splitter (BS) realizes a random choice of the measurement basis.Transmitted photons are measured in the horizontal-vertical (HV) basis by the means of a polarization-beam-splitter (PBS), while reflected photons are measured in the diagonal-antidiagonal (DA) basis by the means of a half-wave plate and a PBS.All the four outputs are finally coupled into multi-mode fibres (MMFs) using commercial fibre couplers (FCs).

Fig. 3 :
Fig. 3: Demonstration of free-space quantum key distribution.Single photon count rates at Bob, quantum bit error rates, and the corresponding secure key rates are shown for different link conditions.The daytime experiment (left) started around noon, with the link fully exposed to direct sunlight.It then continued with a sporadic decrease and increase of sunlight due to the moving clouds.During the night experiment (right), the background noise was negligible, resulting in a much more stable performance.The plotted values are 5-minute averages and the horizontal axis shows the local time of day.The background colour corresponds to the solar radiation measured independently by a weather station (solar radiation data: University of Applied Sciences Jena).

Fig. 4 :
Fig. 4: Estimated link loss due to diffraction and turbulence induced beam spreading.The loss is shown for three different turbulence strengths, characterized by refractive index structure parameter Cn 2 .

Table 1 :
Literature review.Reported free-space (FS) quantum key distribution (QKD) experiments with entangled photons are shown, together with the relevant aspects and highlights.