Measurement-Device-Independent Quantum Key Distribution over asymmetric channel and unstable channel

Abstract

We show that a high key rate of Measurement-Device-Independent Quantum Key Distribution (MDIQKD) over asymmetric and unstable quantum channel can be obtained by full optimization and compensation. Employing a gradient optimization method, we make the full optimization taking both the global optimization for the 12 independent parameters and the joint constraints for statistical fluctuations. We present a loss-compensation method by monitoring the channel loss for an unstable channel. The numerical simulation shows that the method can produce high key rate for both the asymmetric channel and the unstable channel. Compared with the existing results of independent constraints, our result here improves the key rate by 1 to tens of times in typical experimental conditions.

Introduction

Quantum key distribution (QKD) provides the communication users with secure keys to encrypt their information. Bennett and Brassard proposed BB84 protocol¹ to realize QKD, but the lack of practical single-photon sources limited the use of origin BB84 protocol. BB84 protocol with imperfect single-photon sources would suffer from the photon-number-splitting (PNS) attack^2,3,4. This loophole can be fixed by the decoy-state method^5,6,7,8. With the decoy-state method, QKD can be used in the practical system between users with longer distace^9,10,11. After that, measurement-device-independent QKD (MDIQKD) was proposed to avoid any loophole from the imperfect detection devices^12,13,14,15. Combined with decoy-state method, MDIQKD can also avoid the loophole from the imperfect single-photon sources^15,16. Nowadays, the decoy-state MDIQKD has become the mainstream of the studies of quantum key distribution both theoretically^{16,17,18,19,20,21,22,23,24,25,26,27,28,29} and experimentally^{30,31,32,33,34,35,36,37,38,39,40,41,42,43}. Various numerical models and optimization methods^21,22,23,24 have improved the key rate and secure distance a lot. The numerical model by Xu et al.²¹ can apply to the case of asymmetrical channel rather precisely. The maximum distance of MDIQKD has been experimentally increased to 404 kilometers³⁸ using the 4-intensity protocol²⁴ with joint constraints for statistical fluctuations²³. Another experiment exceeding 400-kilometer distance applying the decoy-state method but not using MDIQKD scheme was reported recently⁴³.

In the scheme of decoy-state MDIQKD, at each time the user Alice (Bob) randomly chooses her (his) basis, bit value and intensity to send a pulse in a corresponding state, e.g. BB84 state in a polarization-coding MDIQKD, to an untrusted third party (UTP) Charlie. Charlie performs a collective measurement on each pulse pair and announces the measurement result in the public channel. After Charlie announces the measurement results, Alice and Bob announce the bases and intensities they use. Based on all announcement, Alice and Bob can calculate the yield and the error rate of single-photon pulse pairs, and then distill the secure key.

For the practical applications, the asymmetric and unstable channels are common cases both in fiber and free space. For example, when we consider the quantum network, due to the different geographical locations of users, the channel losses can be largely different. And if we want implement MDIQKD in free space, the channels are always asymmetric and unstable too, due to the atmospheric turbulence or moving sites (such as the satellite). Although the security of MDIQKD doesn’t make any assumption to the channel, the unstable and/or asymmetric quantum channel decreases the key rate quite a lot. Therefore, directly applying the optimized parameters for symmetric channel does not give a good performance in an asymmetric channel or an unstable channel. Here, we propose full optimization of four-intensity decoy-state MDIQKD protocol to largely increase the key rate in asymmetric channels than existing results of partial optimization. For full optimization, we mean: (1) Using 12 independent parameters, (2) Applying joint constraints^23,24 for statistical fluctuations. If one only use one of the above two operations, that is partial optimization. Moreover, a loss-compensation method is presented with optimization to increase the performance of MDIQKD in unstable channels.

Results

Four-intensity decoy-state MDIQKD

Among all existing protocols of decoy-state MDIQKD, the 4-intensity protocol seems to be the most efficient one²⁴ which has been extensively verified experimentally^37,38,39,40. As was stated in the four-intensity decoy-state method in Ref.²⁴, Alice and Bob each uses 4 different intensities, including one vacuum. This means in general, there are 7 different intensities for both sides with 6 independent parameters for non-vacuum intensities. Together with the frequencies of using each intensities, there are 12 independent parameters in general in the protocol. Also, the four-intensity protocol suggests using the joint constraints in statistical fluctuation of different observable^23,24. A full implementation of the four-intensity protocol means doing optimization among all those 12 parameters with joint constraints fully.

Explicitly, in the four-intensity decoy-state method in ref.²⁴, Alice (Bob) uses a source z_A (z_B) with intensity μ_az (μ_bz) that only emits photons in the Z basis, two sources x_A and y_A (x_B and y_B) with intensities μ_ax and μ_ay (μ_bx and μ_by) that only emit photons in the X basis and a vacuum source o_A (o_B) that only emits vacuum pulses. At each time, Alice (Bob) randomly chooses a source in the four sources above to send a pulse, with probability ${p}_{a{l}_{A}},l=z,x,y,o\,({p}_{b{r}_{B}},r=z,x,y,o)$. So we call it “four-intensity protocol”.

The key rate of the decoy-state MDIQKD is given by:

$$R={p}_{az}{p}_{bz}\{{a}_{z1}{b}_{z1}\underline{\langle {s}_{11}\rangle }\,\mathrm{[1}-H\,(\overline{\langle {e}_{11}^{ph}\rangle })]-f{S}_{zz}H({E}_{zz})\}$$

(1)

where a_z1 and b_z1 are the fraction of single photons of sources z_A and z_B, $\underline{\langle {s}_{11}\rangle }$ and $\overline{\langle {e}_{11}^{ph}\rangle }$ are the bound of yield and phase-flip error rate of single-photon pulse pairs which can be obtained by the decoy-state method, S_zz and E_zz are yield and bit-flip error rate when Alice and Bob both send pulses with source z_A/z_B, $H(p)=-\,p{\mathrm{log}}_{2}p-\mathrm{(1}-p){\mathrm{log}}_{2}\mathrm{(1}-p)$ is the binary entropy function and f is the correction efficiency.

Details for calculation of the key rate can be found in the appendix.

Optimization of source parameters

In the numerical simulation, we will estimate what values we would observe for the yields and error rates in a certain model and use these values to calculate the key rate. Given the properties of the channel and the detection devices, we can regard the key rate as a function of source parameters:

$$\begin{array}{r}\tilde{R}=\tilde{R}({\mu }_{ax},{\mu }_{ay},{\mu }_{az},{p}_{ax},{p}_{ay},{p}_{az},{\mu }_{bx},{\mu }_{by},{\mu }_{bz},{p}_{bx},{p}_{by},{p}_{bz})=\tilde{R}(\overrightarrow{x}\mathrm{).}\end{array}$$

(2)

If we use weak coherent state sources, the relation between the intensity μ and the photon number distribution $\rho ={\sum }_{k}\,{a}_{k}|k\rangle \langle k|$ is ${a}_{k}={e}^{-\mu }\frac{{\mu }^{k}}{k!}$.

In the calculation of the key rate, we need to take the joint fluctuation and the scan of ${\mathcal H}$ (the definition of ${\mathcal H}$ is in the appendix) into consideration. In addition, the number of parameters we need to optimize is large, which means the parameter space is very huge. Therefore, normal optimization method costs a lot of time. We should improve the optimization method to get the optimal parameters quickly. Firstly, we consider the “gradient” of the key rate function²⁹:

$$\frac{{\rm{\Delta }}\tilde{R}}{{\rm{\Delta }}{x}_{k}}=\frac{\tilde{R}({x}_{k}+{\rm{\Delta }}{x}_{k},{x}_{i})-\tilde{R}({x}_{k}-{\rm{\Delta }}{x}_{k},{x}_{i})}{2{\rm{\Delta }}{x}_{k}}.$$

(3)

In the case that both $\tilde{R}$(x_k + Δx_k, x_i) and $\tilde{R}$(x_k − Δx_k, x_i) are less than $\tilde{R}$(x_k, x_i), we set $\frac{{\rm{\Delta }}\tilde{R}}{{\rm{\Delta }}{x}_{k}}=0$. With

$$\frac{{\rm{\Delta }}\tilde{R}}{{\rm{\Delta }}\overrightarrow{x}}=(\frac{{\rm{\Delta }}\tilde{R}}{{\rm{\Delta }}{x}_{1}},\ldots ,\frac{{\rm{\Delta }}\tilde{R}}{{\rm{\Delta }}{x}_{12}})$$

(4)

we can find the direction that key rate increases the fastest and get close to the optimal parameters quickly.

To avoid the case that the optimal parameters are the local optimal point, which satisfies $\tilde{R}$(x_k + Δx_k, x_i) ≤ $\tilde{R}$(x_k, x_i) for any k but is not the maximum point in the whole area, we search the points in the nearby area to see whether there is higher key rate. Accurately, we calculate the key rate $\tilde{R}$(x_k + δ_kΔl); δ_k = −1, 0, 1; k = 1, …, 12 with a certain Δl. If there are some points with higher key rate, we jump to the point with highest key rate in the nearby area and execute the above procedure again.

In our simulation, we found that in most cases, the gradient method brings us to the optimal point. But in some cases, it brings us to the local optimal point.

Loss-compensation method

For the case of unstable channel, according to our MDIQKD protocol, all source parameters should be determined before the QKD process and fixed during the QKD process. Even though we can detect the channel transmittance η at any time, we cannot change the source parameters to optimize the key rate at real time. The decoy state method requests that the intensities of pulses must be fixed. Say, switching among 3 fixed intensities. If one change the intensities beyond these 3 intensities, or change the intensities non-randomly, the result of the decoy-state method will be invalid. With the fixed source parameters μ_A and μ_B and unstable channel transmittance η_A(t) and η_B(t), which means the transmittance changes dependently on time, there are always some cases that the intensities at the two sides of Charlie’s beam splitter deviate a lot, saying that at some time t_i, μ_Aη_A(t_i) and μ_Bη_B(t_i) deviate a lot. These cases will give a quite high error rate that decreases the key rate a lot.

First we consider the case with stable channel that satisfies μ_Aη_A > μ_Bη_B. In an asymmetric channel, if one attenuates one path, the channel will become symmetric and the detected error rate will be small. However, in such a case, the amount of detected bits is also decreased and the final key rate is not necessarily improved. If we add extra loss $\frac{{\mu }_{B}{\eta }_{B}}{{\mu }_{A}{\eta }_{A}}\le {\tilde{\eta }}_{A}\le 1$ to the channel between Alice and Charlie, we can get a better key rate. Given the transmittance and the intensities of sources, the specific value of ${\tilde{\eta }}_{A}$ can be determined by numerical simulation.

Then we come to the case with unstable channel. Technically, the channel loss cannot be changed too fast. Otherwise the physical compensation cannot be made instantaneously. We assume that the transmittance remains unchanged during each time window, which means the transmittance doesn’t fluctuate too rapidly. Suppose that we are given the transmittance distribution $\{{\eta }_{A}^{\mathrm{(1)}},\cdots ,{\eta }_{A}^{(i)},\cdots \}$ and $\{{\eta }_{B}^{\mathrm{(1)}},\cdots ,{\eta }_{B}^{(i)},\cdots \}$ and fixed μ_A, μ_B. A general loss-compensation method is to add different extra loss ${\tilde{\eta }}^{(ij)}$ < 1 to Alice’s or Bob’s channel for different transmittance pair ${\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}$ and we can determine the optimal value of each ${\tilde{\eta }}^{(ij)}$ for each ${\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}$ pair. But in practice, the optimization of so many variables is out of any computer’s ability. So we keep only one extra loss $\tilde{\eta }$ and raise a variable δ. When the transmittance pair ${\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}$ satisfies ${\eta }_{A}^{(i)}/{\eta }_{B}^{(j)} > \delta$, Charlie should add the extra loss $\tilde{\eta }$ to the channel between Alice and Charlie. When the transmittance pair ${\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}$ satisfies ${\eta }_{B}^{(j)}/{\eta }_{A}^{(i)} > \delta$, Charlie should add the extra loss $\tilde{\eta }$ to the channel between Bob and Charlie. In other cases, Charlie doesn’t have to add any extra loss to the channel. We can use numerical simulation, combined with optimization of source parameters, to determine the values of $\tilde{\eta }$ and δ to get the best key rate when given a specific transmittance distribution.

In the simulation of the unstable channel, suppose that we have the transmittance distribution $\{{\eta }_{A}^{\mathrm{(1)}},\cdots ,{\eta }_{A}^{(i)},\cdots \}$, $\{{\eta }_{B}^{\mathrm{(1)}},\cdots ,{\eta }_{B}^{(j)},\cdots \}$ and the corresponding probability $\{{p}_{A}^{\mathrm{(1)}},\cdots ,{p}_{A}^{(i)},\cdots \}$, $\{{p}_{B}^{\mathrm{(1)}},\cdots ,{p}_{B}^{(j)},\cdots \}$. We can calculate the “transmittance pair distribution” $\{{\eta }_{A}^{\mathrm{(1)}}\otimes {\eta }_{B}^{\mathrm{(1)}},\cdots ,{\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)},\cdots \}$ and the corresponding probability $\{{p}_{A}^{\mathrm{(1)}}\ast {p}_{B}^{\mathrm{(1)}},\cdots ,{p}_{A}^{(i)}\ast {p}_{B}^{(j)},\cdots \}$. With a certain source pair lr and a certain transmittance pair ${\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}$, the observed yield ${S}_{lr}({\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)})$ and the observed error rate ${E}_{lr}({\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)})$ can be calculated as in ref.⁴⁴ theoretically. Then the yield and the error rate in the whole process can be calculated by

$${S}_{lr}=\sum _{i,j}\,{p}_{A}^{(i)}{p}_{B}^{(j)}{S}_{lr}({\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)})$$

(5)

and

$${E}_{lr}=\sum _{i,j}\,{p}_{A}^{(i)}{p}_{B}^{(j)}{E}_{lr}({\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}\mathrm{).}$$

(6)

When the loss-compensation is performed, we can calculate the S_lr, E_lr in the same way except the (ij)-th transmittance pair is changed into ${\eta }_{A}^{(i)}\tilde{\eta }\otimes {\eta }_{B}^{(j)}$ if $\frac{{\eta }_{A}^{(i)}}{{\eta }_{B}^{(j)}} > \delta$, or ${\eta }_{A}^{(i)}\otimes {\eta }_{B}^{(j)}\tilde{\eta }$ if $\frac{{\eta }_{B}^{(j)}}{{\eta }_{A}^{(i)}} > \delta$.

Numerical simulation

First we consider the case that the channel is stable but asymmetric. We shall estimate what values would be probably observed for the yields in the normal cases by the linear models^15,21,22 and the errors in X basis by the useful model for misalignment error under asymmetric channel in ref.²¹. We show the optimized key rate in some asymmetric cases in Fig. 1 and some results in certain distances in Table 1, in comparison with the results of independent bounds in ref.⁴⁵, with device parameters in Table 2. From Fig. 1, we can find that with full implementation of the four-intensity MDIQKD and full optimization of the source parameters, quite good key rate can be achieved. In particular, we have taken the joint constraints^23,24 for statistical fluctuations, this affects the key rate significantly. Taking joint constraints will consume some more computational time. The computation can be done very fast if we apply formulas of refs^23,24 rather than the linear programming. In our numerical simulation, we have already overcome the problem of unpredictable behavior such as jitters⁴⁵. Actually, the computational time seems not to be a major issue for the practical application. In the application for the unstable channel, one can choose to test the channels and do the optimization for the major loss values of the changing channel before running the protocol.

Figure 1

Optimized key rate versus the total distance between Alice and Bob in asymmetric channel with the device parameters in Table 2.

Table 1 Optimized key rate at different distances in asymmetric channel with the parameters in Table 2.

Table 2 Device parameters for Table 1.

Then for the unstable channel, we consider a simple case that ${\eta }_{A}^{(i)}=\mathrm{(3}+2i)$ dB, ${\eta }_{B}^{(j)}=\mathrm{(13}+2j)$ dB with probability ${p}_{A}^{(i)}={p}_{B}^{(j)}=0.2$ for i, j = 1, …, 5 (Here the detector’s efficiency is contained in the total loss). We show the key rate with different δ and $\tilde{\eta }$ with source parameters optimized in Table 3.

Table 3 Optimized key rate with different δ and $\tilde{\eta }^{\prime}$ in unstable channel with the parameters in Table 2.

The case that δ = $\tilde{\eta }^{\prime}$ = 0 dB is equal to that we don’t perform the loss-compensation method. In the second line of Table 3, we can see that an improper loss-compensation (δ = −7 dB and $\tilde{\eta }^{\prime}$ = 5 dB) will decrease the key rate. We can find that in this transmittance distribution, setting δ = −8.75 dB and $\tilde{\eta }^{\prime}$ = 4.5 dB can maximize the key rate in our loss-compensation method.

Discussion

We propose a full implementation of four-intensity decoy-state MDIQKD. Even if the channels between the users and UTP are asymmetric, our four-intensity protocol still has a good performance. We also propose a loss-compensation method. This method can improve the key rate a lot in unstable channel.

Method: calculation of the key rate

Asymptotic case

We define the yield, the error yield and the error rate as follow. Consider a pulse pair set ${\mathscr{C}}$, which contains ${N}_{{\mathscr{C}}}$ pulse pairs totally. These pairs cause ${M}_{{\mathscr{C}}}$ effective counts and ${W}_{{\mathscr{C}}}$ error counts. In this case, the yield ${S}_{{\mathscr{C}}}={M}_{{\mathscr{C}}}/{N}_{{\mathscr{C}}}$, the error yield ${T}_{{\mathscr{C}}}={W}_{{\mathscr{C}}}/{N}_{{\mathscr{C}}}$ and the error rate ${E}_{{\mathscr{C}}}={W}_{{\mathscr{C}}}/{M}_{{\mathscr{C}}}$.

In photon number space, the density matrices of the pulses from the sources can be written as

$${\rho }_{{l}_{A}}=\sum _{k=0}^{\infty }\,{a}_{lk}|k\rangle \langle k|,\,l=x,y,z$$

(7)

and

$${\rho }_{{r}_{B}}=\sum _{k=0}^{\infty }\,{b}_{rk}|k\rangle \langle k|,\,r=x,y,z.$$

(8)

We assume that the states above satisfy these conditions:

$$\frac{{a}_{yk}}{{a}_{xk}}\ge \frac{{a}_{y2}}{{a}_{x2}}\ge \frac{{a}_{y1}}{{a}_{x1}},\,\frac{{b}_{yk}}{{b}_{xk}}\ge \frac{{b}_{y2}}{{b}_{x2}}\ge \frac{{b}_{y1}}{{b}_{x1}}$$

(9)

for k > 2, so that the decoy-state results can apply. Familiar sources used in practice, such as weak-coherent-state sources and heralded single-photon sources out of the parametric-down conversion, satisfy the conditions above.

In the following, we will omit the subscript A and B in l_A and r_B if it doesn’t cause confusion. A pulse pair of lr is a pair where Alice’s pulse is from l and Bob’s pulse if from r. The two-mode source lr emits all lr pairs.

The main idea of decoy state is that the yield of |m〉|n〉 photon pairs from different source pairs should be the same in the asymptotic case, which means

$$\langle {s}_{mn}^{lr}\rangle =\langle {s}_{mn}\rangle ,\,l,r=x,y,z.$$

(10)

Using Eq. (10) and the convex form of yield of lr source pairs

$$\langle {S}_{lr}\rangle =\sum _{m,n=0}^{\infty }\,{a}_{lm}{b}_{rn}\langle {s}_{mn}\rangle ,$$

(11)

we can calculate the lower bound of the yield of single-photon pairs:

$$\langle {s}_{11}\rangle \ge \underline{\langle {s}_{11}\rangle }=\frac{{S}_{+}-{S}_{-}-{a}_{y1}{b}_{y2} {\mathcal H} }{{a}_{x1}{a}_{y1}({b}_{x1}{b}_{y2}-{b}_{x2}{b}_{y1})}$$

(12)

where

$${S}_{+}={a}_{y1}{b}_{y2}\langle {S}_{xx}\rangle +{a}_{x1}{b}_{x2}{a}_{y0}\langle {S}_{oy}\rangle +{a}_{x1}{b}_{x2}{b}_{y0}\langle {S}_{yo}\rangle ,$$

(13)

$${S}_{-}={a}_{x1}{b}_{x2}\langle {S}_{yy}\rangle +{a}_{x1}{b}_{x2}{a}_{y0}{b}_{y0}\langle {S}_{oo}\rangle $$

(14)

and

$$ {\mathcal H} ={a}_{x0}\langle {S}_{ox}\rangle +{b}_{x0}\langle {S}_{xo}\rangle -{a}_{x0}{b}_{x0}\langle {S}_{oo}\rangle \mathrm{.}$$

(15)

Eq. (12) holds when

$${K}_{a}=\frac{{a}_{y1}{a}_{x2}}{{a}_{x1}{a}_{y2}}\le \frac{{b}_{y1}{b}_{x2}}{{b}_{x1}{b}_{y2}}={K}_{b}.$$

(16)

In the case of K_a > K_b, the lower bound of s₁₁ can be calculated with Eqs (12–15) by making exchange between a_xk and b_xk, and exchange between a_yk and b_yk, for k = 1, 2.

Similarly, we can calculate the upper bound of phase-flip error rate of single-photon pairs:

$$\langle {e}_{11}^{ph}\rangle \le \overline{\langle {e}_{11}^{ph}\rangle }=\frac{\langle {T}_{xx}\rangle - {\mathcal H} \mathrm{/2}}{{a}_{x1}{b}_{x1}\underline{\langle {s}_{11}\rangle }}.$$

(17)

With $\underline{\langle {s}_{11}\rangle }$ and $\overline{\langle {e}_{11}^{ph}\rangle }$, we can calculate the key rate with Eq. (1).

Nonasymptotic case

In the nonasymptotic regime, we should consider the statistical fluctuation of the observable, e.g. the difference between observed values and mean values. Given a failure probability ε, the observed value ${S}_{{\mathscr{C}}}$ of an observable of a set ${\mathscr{C}}$ and its mean value $\langle {S}_{{\mathscr{C}}}\rangle$ satisfy:

$$-{{\rm{\Delta }}}_{-}\le {S}_{{\mathscr{C}}}-\langle {S}_{{\mathscr{C}}}\rangle \le {{\rm{\Delta }}}_{+}.$$

(18)

If we perform a standard error analysis, Δ can be given by

$${{\rm{\Delta }}}_{-}={{\rm{\Delta }}}_{+}=\gamma \sqrt{\frac{{S}_{{\mathscr{C}}}}{{N}_{{\mathscr{C}}}}}$$

(19)

where ${N}_{{\mathscr{C}}}$ is the number of elements in set ${\mathscr{C}}$ and γ = 5.3 given the failure probability ε = 10⁻⁷.

According to the idea of joint constraints of statistical fluctuation²³, the set ${\mathscr{C}}$ can be either all pulse pairs from a source pair, or the combination of all pulse pairs from different source pairs. Taking all these joint constraints into consideration, the bound of 〈s₁₁〉 and $\langle {e}_{11}^{ph}\rangle$ can be calculated tighter.

As a joint term in $\underline{\langle {s}_{11}\rangle }$ and $\overline{\langle {e}_{11}^{ph}\rangle }$, ${\mathcal H}$ should fluctuate jointly in Eq. (12) and Eq. (17), instead of taking the worst case independently²⁴. We regard R as a function of ${\mathcal H}$, scan ${\mathcal H}$ in its possible range and take the minimum R as the final key rate:

$$\tilde{R}=\mathop{min}\limits_{ {\mathcal H} \in [\underline{ {\mathcal H} },\overline{ {\mathcal H} }]}R( {\mathcal H} )$$

(20)

Method: verifying the global optimization

When we search the points in the nearby area in our optimization algorithm, we can change the parameter Δl in our programme. In the cases with different Δl, e.g. Δl = 0.1, 0.001, 0.0001…, we obtain almost the same optimized results.

We make another test that to each point, we start from many sets of different initial values of parameters. We then obtain almost the same results for the optimized parameters.

These strongly indicate that our result is indeed the globally optimized result.