Quantum key distribution using deterministic single-photon sources over a field-installed fibre link

Quantum-dot-based single-photon sources are key assets for quantum information technology, supplying on-demand scalable quantum resources for computing and communication. However, long-lasting issues such as limited long-term stability and source brightness have traditionally impeded their adoption in real-world applications. Here, we realize a quantum key distribution ﬁ eld trial using true single photons across an 18-km-long dark ﬁ bre, located in the Copenhagen metropolitan area, using an optimized, state-of-the-art, quantum-dot single-photon source frequency-converted to the telecom wavelength. A secret key generation rate of > 2 kbits/s realized over a 9.6 dB channel loss is achieved with a polarization-encoded BB84 scheme, showing remarkable stability for more than 24 hours of continuous operation. Our results highlight the maturity of deterministic single-photon source technology while paving the way for advanced single-photon-based communication protocols, including fully device-independent quantum key distribution, towards the goal of a quantum internet.


I. INTRODUCTION
With the fast-growing developments of photonic-based quantum information technology, the demand for a reliable and deployable deterministic source of single photons has risen to new heights.In recent years, semiconductor quantum dots (QDs) embedded in photonic nanostructures have drawn significant attention by providing a robust and near-deterministic source of single photons [1].The ability to generate indistinguishable photons on demand and couple them into optical fibers with high efficiency opens new avenues for the realization of a quantum internet [2,3], where photons will allow the secure exchange of secret cryptographic keys via quantum key distribution (QKD) or more advanced functionalities enabled by distributing quantum information via teleportation or entanglement swapping.To achieve this goal, it is essential that single-photon sources achieve sufficient quality and technological readiness to be operated in the field where virtually no control is available over sources of noise or loss of network infrastructure.Examples of quantum communication field trials using quantum emitters such as color centers in diamond [4] or semiconductor QDs [5] are to date limited to short distances within university campuses over dedicated fibres or in free space.
In contrast, field trials of QKD links based on weak coherent pulses (i.e., attenuated laser) are regularly car-FIG.1. Map showing the quantum channel connecting the Niels Bohr Institute (NBI) and the Technical University of Denmark (DTU), with a length of 18.1 km ( 9.6 dB of channel loss).Bottom panel displays a simplistic schematic of the experiment from the quantum dot (QD) source through nonlinear down conversion to the telecom C-band (χ (2) ), QKD encoder, quantum channel (QC) (the physical link), QKD decoder, and post-processing (PP).
ried out at the urban-area network level, over dedicated testbeds [6][7][8], or even via satellite [9].While laser sources, combined with decoy state protocols [10] enable remarkably higher communication rates than singlephoton sources, the latter offer exciting perspectives in the development of more advanced quantum communication tasks involving entanglement and, eventually, a fully device-independent QKD scheme.Therefore, a field demonstration of a single-photon based QKD link is an important stepping stone in proving the maturity of QDs in a real-world use-case.In fact, single-photon QKD has been so far hindered by the quality of solid-state emitters: low or fluctuating photon count rates, emission wavelengths far from the telecommunication bands, and collection setup instability.
In this work, we employ an advanced single-photon source based on QDs in photonic crystal waveguides [11] and a frequency conversion scheme based on differencefrequency generation (DFG) [12] to perform QKD between two districts in the Copenhagen metropolitan area.We use an 18-km-long link made of multiple segments of deployed dark fibre pairs, indicatively shown in Fig. 1.The fibres connect the sending station (Alice), located at the Niels Bohr Institute in Copenhagen, to the receiving station (Bob) at the Technical University of Denmark in Lyngby.We perform a complete QKD field-trial using single photons with the setup shown schematically in the lower panel of Fig. 1 and analyze the performance of the QD source in terms of security bounds, stability, and actual secret key generation rate.

A. Field trial apparatus
Fig. 2 a shows the schematic layout of the setup employed in the field trial experiment.The single-photon emitter used in this work is an Indium Arsenide (InAs) QD embedded in a suspended Gallium Arsenide (GaAs) membrane.A photonic crystal waveguide (PCW) is fabricated around the QD allowing near-unity coupling of the QD emission into the waveguide (see Methods for details).The sample is placed in a 1.6 K closed-cycle cryostat and single photons are collected via a high-efficiency focusing grating coupler using a microscope objective.A single QD transition at 942 nm is excited resonantly with a Ti:Sa mode-locked laser at a repetition rate of 72.6 MHz, resulting in 12 MHz count rate in the fibre (i.e. a source efficiency of η S = 16.5%).A scanning electron microscope (SEM) image of the device is shown in Fig. 2 b.
To achieve low-loss transmission in fibres, the single photons are down-converted to the telecommunication C-band via difference-frequency generation (DFG) [12] in a periodically poled lithium niobate (PPLN) waveguide, as depicted in Fig. 2 c.Using a pump laser at 2414 nm wavelength, the single photons are converted from 942 nm to 1545 nm with a 50% end-to-end conversion efficiency.Transport of photons from the singlephoton source (located in a different lab) to the frequency conversion setup introduces an additional 29% loss.The down-converted source exhibits a low multiphoton contribution (g (2) (0) = (0.47 ± 0.14)%), as verified by auto-correlation measurements performed on the down-converted photons and shown in Fig. 2 d.A low multi-photon contribution is paramount in order to overcome the threat of PNS-type attacks, and hence a significant parameter in the key distillation process.
The implemented QKD protocol is the 4-state polarization-based BB84 [13], where photons are randomly modulated to one of the four polarizations forming the bases X = {|D , |A } and Z = {|H , |V } in the encoder.This is carried out with a phase modulator actively controlled by an arbitrary waveform generator (AWG).A beamsplitter at the receiver redirects the incoming photons onto either of the two bases (X or Z), passively at random, upon detection.A master clock phase-locked to the excitation laser by a field programmable gate array (FPGA) is synchronizing the modulation and detection to the photon emission, the latter via an optical service channel parallel to the quantum channel (QC).Residual background noise in both the QC and the service channel is observed in the wavelength range 1550-1555 nm, which has been filtered out by tuning the single photon down-conversion process to channel 40 of the International Telecommunication Union-Telecommunication Standardization Sector (ITU-T) and by placing a dense wavelength division multiplexer (DWDM) filter before the state decoder.An overview of the setup is depicted in Fig. 2 a while the performance is summarized in Table I  (2) ), encoder efficiency (ηE), quantum channel transmission(ηQC), and receiver efficiency (ηR) including the detection efficiency.

B. Field trial data acquisition
Data was acquired over two different days, referred to as Day 1 and Day 2, over a period of 17 and 30 consecutive hours, respectively.The quantum bit error rate (QBER) measured throughout the whole duration of the field trial is shown in Fig. 3 a, for the X and Z basis, respectively (see Methods).The QBER remains stable throughout the duration of the experiment, especially on Day 2. Short temporary fluctuations in the QBER are observed for the Z bases on Day 1, which we attribute to the thermal instability of phase modulators in the state encoder in the early hours of the experiment and not to Experimental layout of the QKD field-trial demonstrator.FIG. 2. Upper panel: a) Schematic overview of the employed QKD setup with Transmitter, Channel and Receiver.Yellow lines mark optical connections (fibres), while black lines are electronic connection (wires).Additionally, the QKD setup consists of a field programmable gate array (FPGA), an arbitrary waveform generator (AWG), a phase modulator (φ-mod), a beam-splitter (BS), two polarising beam-splitters (PBS), three polarisation controllers (PC), four superconducting nanowire single-photon detectors (SNSPD) and a time-to-digital converter (TDC).Lower panel: b) SEM picture of the nanophotonic structure featuring the QD (yellow annotation), annotated to visualize the single photon source operation with pulsed resonant excitation.c) Frequency conversion setup including polarisation control (half/quarter-waveplates (HWP/QWP)) and source and pump mode matching lenses.The periodically poled Lithium Niobate (PPLN) waveguide mediates the conversion.A low pass filter (LP) transmitting > 1400 nm wavelengths is followed by a grating that filters out residual 940 nm photons and the pump laser.d) Auto-correlation measurement of the down-converted single photons, shown in orange, fitted with a double-sided exponential decay convoluted by the instrument response function modeled as a Gaussian distribution in blue yielding g (2) (0) = (0.47 ± 0.14)% and a QD lifetime of (867 ± 5) ps.Inset shows a zoom-in of the central peak.
the QD source itself.Additionally, sporadic jumps in the value of QBERs are observed over short time intervals for both bases due to overshooting in the active compensation of polarization drifts (see Methods).In the analysis, we discard all data chunks with very high QBER caused by the polarization drift compensation.
The secret key is extracted according to a strict finitesize bound [19], with the secret key length given by where n is the number of sifted bits per block used for extracting the secret key bits.We use n = 2 • 10 5 to reduce the impact of finite-size effects while maintaining reasonable computational costs and speed.H is the binary Shannon entropy.The factor A = 1 − p m /p det corresponds to the leaked information by possible multiphoton emissions [14].p m = g (2) (0) • (η S η E ) 2 /2 is the multi-photon probability where η S is the combined QD source, transport, and frequency conversion efficiency, and η E is the encoder efficiency, while p det is the detection probability.The upper-bound of the qubit error rate q is used to account for finite sampling effects together with the finite size correction term ∆ [19].The terms leak EC and leak EV correspond to the information leakage during the information reconciliation and error verification, respectively.ν auth represents the key portion used for authenticating the classical communication during post-processing.An adequate description of the key-extraction process is given in the Supplementary Information.
Fig. 3 b shows the QBER and SKR over the whole duration of data acquisition.On Day 1, we achieve the highest average SKR of 2.95 kbit/s.Notably, the bound used here allows for the empirical extraction of a usable secret key, accounting for finite-size effects that occur during the implementation of the post-processing.It is therefore significantly tighter compared to the estimates based on the asymptotic GLLP bound [14] for single photon sources, which is commonly used to report the SKR.While the QBER is higher during Day 1, the final secret key rate is higher compared to Day 2 due to an increased input rate of the unsifted key, see Table II [14]; commonly used for prepare and measure QKD bench marking.The secret key rate is evaluated for the best performance frame with 47.9 kbit/s raw key and 3.25% QBER and marked with a yellow star.Based on this performance the finite secret key rate is simulated in the asymptotic limit and shown with a black line.Triangles mark previous QKD lab-trials with single photon sources at telecom wavelength ( [15], [16], [17], [18]), all estimated with GLLP-bound.

III. DISCUSSION
The ≈ 4% QBER measured during the two-day-long data acquisition of the experiment is attributed to two main factors, state preparation of the encoder and channel background noise observed in the C-band.To reduce the background noise, besides placing a DWDM filter, we temporally filtered the incoming photons in a 1 ns temporal filter.Nevertheless, we attribute ∼ 1% induced QBER to the signal-to-noise ratio.A comparison of the QBER measured in a back-to-back test with weak coherent pulses (WCP) suggests a possible improvement of the QBER by 2 − 2.5%, by improved stabilization of the encoder and the photon transmission line from frequency conversion to the state encoder.The secret key extraction is performed under the assumption that no coherence exists between consecutively emitted photons, which is a good approximation when exciting the QD with short resonant π-pulses [26].The state generation rate can be effectively increased by pumping the QDs at a higher rate.The measured 0.867 ns lifetime of the QD employed in this work would allow to pump the QD at ∼ 0.4 GHz rate, which would readily correspond to a nearly five-fold increase of the secret key generation rate.Moreover, Purcell enhancement of spontaneous emission, would open the door to even higher single-photon rates.QD lifetimes below 50 ps have been reported previously [27], which allow pumping the QD in the GHz regime.In combination with an optimized low-loss encoder and receiver, a key generation rate approaching the Mbit/s might be achievable on the field-trial channel, showing the great potential of current QD technology for applications that demand a high generation rate.
In Fig. 3 c, we compare our results to previously reported QKD experiments (all performed in laboratory environment) using deterministic single-photon sources in the C-or O-band.In those experiments, a full QKD protocol has been implemented, which allows for a fair comparison of the asymptotic key rates achievable.Sev-  eral other single-photon QKD experiments (at different wavelengths or without encoding) have been reported [20][21][22][23][24] which cannot be directly compared to ours.A list of reported single-photon QKD experiments is given in the Supplementary information Tab.III.We achieve the highest asymptotic secret key rate reported so far for single-photon QKD, of up to 13.2 kbit/s at a channel loss of 9.6 dB, which for a 0.2 dB/km bare fibre loss would correspond to a distance of 48 km (yellow star in Fig. 3 c).Notably, we still achieve kbit/s key rates, which would allow for real-time one time pad encryption of voice recordings [28], to about 100 km equivalent reach with the commonly used GLLP-bound [14].
We have presented the first QKD field trial with a near-deterministic single-photon source.We extract actual usable secret key frames and we set the new stateof-the-art of secret key rates in the C-band for singlephoton sources to more than 2 kbit/s at ≈ 10 dB of loss.By demonstrating a stable and usable single-photon connection in a metropolitan environment, we pave the way towards realistic implementations of single-photon based communication infrastrcuture, where deterministic and coherent QD-based single-photon sources constitute a mature resource for advanced applications, including device-independent QKD [29,30], one-way quantum repeaters [31] and, ultimately, the quantum internet [2].

A. Single-photon source
The single-photon sources are fabricated on a GaAs membrane grown by molecular beam epitaxy on a (100) GaAs substrate.The 180-nm-thick membrane consists of a layer of self-assembled InAs QDs (density <10 µm −1 ) grown in the middle of an ultra-thin p-i-n diode junction, to reduce charge noise and control the charge state while also enabling Stark tuning of the QD emission wavelength.The diode bias is controlled by a stable and low-noise voltage source.Additionally, a distributed Bragg reflector (AlAs/GaAs, 79/66 nm) is grown below the membrane to enhance the vertical collection of photons out of the chip.The photonic crystal waveguides are fabricated via electron-beam lithography and dry etching following the methods presented in [32], while electrical contacts to the diode are deposited via electron-beam evaporation and lift-off.

B. Setup
The state encoder is formed by an in-line one-pass polarization modulation [33,34] in which birefringence of a Titanium-diffused LiNbO 3 crystal induces a relative phase(φ) between the two rectilinear components of the input diagonal polarization.The scheme features low loss compared to other modulation techniques [35,36] as photons encounter only one insertion loss.
A 4-level RF signal generated by an AWG with levels {0, V π/2 , V π , V 3π/2 }, corresponding to an induced φ = {0, π, π 2 , 3π 2 } relative phase shift, enables the preparation of states in the two bases {X} and {Z}.The X/Z ratio is decided according to the protocol.
The state encoder and the mode-lock laser are synchronized by first down-sampling the mode-lock laser clock and then triggering the AWG.An FPGA provides a down-sampled clock at 120 kHz which is also transmitted through the service channel for synchronization.Upon triggering, the AWG bursts out a waveform to modulate 605 consecutive photons to one of the four polarization states chosen at random.It should be noted that to guarantee the security of the implementation, the pseudo-random sequence of the states should be replaced with a truly random sequence generated with a quantum random number generator [37].
The receiver, see Fig. 2, is comprised of a 50:50 beamsplitter (BS) followed by two sets of polarization controllers and polarizing beam-splitters (PBS).The output port of the PBSs is connected to a superconducting nano-wire single photon detector (SNSPD).Each PBS is aligned to measure one of the bases {X} and {Z} through initial alignment with manual polarization controllers.Two automatic polarization controllers -not depicted in the figure -in line with the manual ones are executing an optimization algorithm based on coordinate-descent search which compensates for any polarization drift that has occurred in the quantum channel.This maintains the QBER below a certain threshold.The SNSPDs feature 33 ns of deadtime, 50 Hz dark count, and ≈83% detection efficiency.The detection events and their accurate timing is registered with a time-to-digital converter (TDC) with 1 ps resolution for post-processing.
The transmitter and the receiver are connected with a pair of fiber channels of ≈18.1 km length, formed by 6 patches, and exhibit 9.6 dB of loss.The fibers transmit the quantum and clock signal.While running the protocol the basis sequence is also transmitted to the receiver for sifting and error estimation.For comparison with the state-of-the-art, we have only listed the experiments where a prepare and measure QKD protocol has been reported, e.g.BB84.More advanced protocols, such as the entanglement based E91 protocol [5,38] or (measurement) device independent QKD protocols [39,40] are not included, as these currently do not compete in terms of key rate, and the structure of the protocol is fundamentally different.When comparing to other experimental achievements we define the concept of a "field trial" as those experiment involving the transmission of the quantum signal over a signif-icant distance exceeding the premises of a single campus area (or the like), on a network infrastructure/channel over which the experimentalists have no control.
In comparison to the state of the art, we pioneer the art of single-photon QKD over a field-deployed fibre.Moreover, we outperform previously-reported QKD implementations in terms of achieved key rate evaluated with the GLLP bound, with exception of two recent works [20,21], which, however, did not implement an active QKD encoding and thus do not account for the losses in the encoding apparatus nor the intrinsic QBER induced by active modulation, which must be anticipated to be higher than that of single state preparation.

B. Post-processing
After the signals have been distributed during the physical phase of the QKD protocol, extensive postprocessing is required to extract secret key bits.Alice and Bob communicate over a classical public channel and share information about the choice of basis for each bit.Only those cases in which they both chose the same basis by chance will be considered for the following steps, all other measurements are discarded.The remaining, sifted bits are then buffered to fit the required frame size n = 200000 of the post-processing, while another m ≈ 0.1n bits are disclosed to estimate the QBER of each specific frame.Due to bit-flip errors occurring in the quantum channel, there is a mismatch between the sifted keys of Alice and Bob.Low-density parity-check (LDPC) codes [41] are used to reconcile the key frames, whereby a single syndrome message is sent from Alice to Bob for each reconciled frame.The correctness of the reconciled keys is verified by exchanging short hashes.
FIG. 4. Relative contribution on information leakage of different effects.The leaked information is represented in the number of bits that the secret key has to be shorter than the sifted key due to the respective effects, where the shortening is executed during privacy amplification.The full circle represents all sifted bits of a single frame (n), the grey segment shows the size of the final secret key (l key ).PE, PM, and MP can all be related to nA(1 − H(q/A)).Data taken of a single extracted secret key frame.
Privacy amplification [42] via the use of Toeplitz matrix hashing [43] is then used to extract a shorter, secret key out of the reconciled sifted key.This removes any information leakage.The extracted key is of length l key , given by Eq. ( 1).Finally, an authentication scheme [44] is deployed to ensure the authenticity of the classical channel for each frame.This consumes a small amount of secret key for each frame and requires an initial shared secret key.
Six different LDPC codes with block-size 200000 of code rate 0.65 to 0.9 have been constructed using the PEG algorithm [45] based on optimized degree distributions [46], where the code rate R relates to the ratio of leaked information (≈ syndrome length m) to frame size n, R = 1 − m n .We use a rate-adaptive scheme [47].The security parameters for authentication and error verification correspond to using hashes/tags of 86 and 34 bits, respectively.The measured efficiency of the information reconciliation is 1.17.The impact of the different terms in Eq.
(1) during the experiment is visualized in Fig. 4.
The security of any extracted key is based on the underlying mathematical security proof of the QKD protocol.Any extracted key is only secure if it adheres to the used proof and if the proof and its assumptions accurately represent the experimental setting.It is common practice to use the asymptotic GLLP [14] bound to estimate the secret key rate.However, we directly extract useable and finite size secret key frames.This requires the usage of a tighter security bound [19] that respects the finite-size effects that occur during implementation, yielding a key length of: where n is the number of sifted bits used for extracting the secret key bits.H is the binary Shannon entropy.The factor A = 1 − p m /p det corresponds to the leaked infor-mation by possible multi-photon emissions [48], where p m and p det are the multi-photon emission probability and the detection probability of the detector, respectively.p m can be calculated as p m = (η S η E ) 2 g (2) (0)/2.The upperbounded qubit error rate q is used to account for finite sampling effects, q = q + 1 2 2 ln(1/ pe ) + 2 ln(m + 1) m , where q is the maximum likelihood estimate of the QBER, m is the number of bits used for estimation, and pe is the probability that the parameter estimation fails [19].A parameter estimation is considered as failed if q ∞ − q > q, where q ∞ is the estimated value in the limit of infinitely many samples.The finite size correction term ∆ is expressed as [19] ∆ = 7 log 2 (2/¯ )n + log 2 (1/ 2 pa ), where ¯ is a parameter that can be optimized together with pa to minimize this contribution.The terms leak EC and leak EV correspond to the information leakage during the information reconciliation and error verification, respectively.Their value is determined by the length of the syndrome and exchanged hash.The overall security parameter can then be written as where auth is the security parameter of the authentication.cor is the probability that a frame passes the information reconciliation phase without being corrected, it can be bounded by the collision probability of the used hash function.An overview of the security parameters used as well as measured efficiencies can be seen in Tab.
IV.A number of bits ν auth of previous secret keys is consumed for authentication each frame, effectively setting the final extracted secret key to l key in Eq. ( 1), in compliance with the security parameter .A visualized breakdown of how different effects contribute to information leakage is given in Fig. 4.
FIG. 3. Performance of the QKD field trial.a) QBER for the X and Z basis measurement results during the field trial.Each data point in the figure/inset is the mean of 200/50 seconds, respectively.b) The secret key rate (SKR) and QBER taken during the field trial.The upper and lower figures show the different days of data acquisition, respectively.Each data point represents the mean of 20 post-processing frames.c) Comparison of the finite secret key rate of the experimental performance presented in this work based on the asymptotic GLLP bound[14]; commonly used for prepare and measure QKD bench marking.The secret key rate is evaluated for the best performance frame with 47.9 kbit/s raw key and 3.25% QBER and marked with a yellow star.Based on this performance the finite secret key rate is simulated in the asymptotic limit and shown with a black line.Triangles mark previous QKD lab-trials with single photon sources at telecom wavelength ([15],[16],[17],[18]), all estimated with GLLP-bound.
to state of the art Table III lists the recent QKD experiments which employ single-photon sources based on quantum emitters. .
. Overall, 361 Mbit of usable secret key has been extracted during the field trial.
Based 50 km fibre spool and 0.2dB/km † Attenuation not given, while the free space distance is given here.

TABLE III .
Comparison to other QKD experiments with single photon sources.QD↓ indicates a frequency down-converted QD source.λ is source wavelength, ν is the operation rate of the source, ηs the source efficiency and SPR is the single photon rate.Pol. is short for polarisation and att.for attenuator.In order to do a fair comparison to reference experimental achievements the QKD performance parameters, i.e.QBER and SKR, are here compared at ∼ 10dB channel attenuation where possible, the actual attenuation at comparison is given in the transmission for comparison (TC) column.All references are bound against collective attacks using the GLLP bound, except the last three which are only abound against individual attacks.

TABLE IV .
Overview of the experimental performance and the used parameters for post-processing in the experiment.