Introduction

Quantum key distribution (QKD)1 is an important technique for future quantum information applications. It allows two legitimate users, Alice and Bob, to establish a shared secret key over a priori insecure communication channel. Although the eavesdropper Eve is assumed to be able to do anything but unphysical in the channel, the total privacy can still be guaranteed by laws of quantum mechanics2. When the channel loss and excess noise are not too big so that the mutual information between Alice and Bob is still larger than that between Eve and Alice or Bob, Alice and Bob can use reconciliation to correct errors and then perform privacy amplification to eliminate the information that Eve eavesdrops. The first QKD protocol is based on discrete variables3, where the information is encoded on the polarization or phase of single photons. This protocol has been well theoretically studied and experimentally demonstrated. However, the practicality of it still remains a problem, due to the requirements on the source and detectors. As an alternative to the discrete-variable QKD, continuous-variable QKD4,5,6,7 appears more promising from a practical point of view, since it only requires coherent states and homodyne detectors. This protocol has led to several successful demonstrations8,9,10,11,12,13.

To perform homodyne detection, a local oscillator (LO), which is a strong laser field coherent with the signal, is required as a phase reference. In common communication fiber systems, in order to keep the coherence of the signal and LO, they must be transmitted through the same fiber8,9,10,13. However, in practical CVQKD system the signal is so weak that a little cross talk from the LO will overwhelm the signal and result in no secret key rate. To reduce the cross talk, polarization multiplexing9 and frequency multiplexing9,11 can be applied. Nevertheless, the guided acoustic wave Brillouin scattering (GAWBS) in the fiber causes a portion of the LO to scatter into quite a broad sideband14,15. Even if the signal is separated with the LO in frequency domain, there will still be some residual excess noise, especially when the channel is long. The best suppression scheme so far is the polarization and time multiplexing8,10,13. In this scheme the signal and LO are amplitude modulated to be pulses and separated in both polarization and time domain, so that the excess noise can be maximally suppressed. However, in previous experimental demonstrations, there is still room to improve the secret key rate. For example, more than one code can be encoded in a pulse to fully exploit the bandwidth of homodyne detectors. Also, no-switching scheme can be adopted instead of random basis switching, so that the repetition rate of the system is not limited by the performance of phase switching in homodyne detection.

In this paper we describe an experimental implementation of a quasi-continuous-wave CVQKD system with no-switching scheme16,17. In this system we use an acousto-optic modulator (AOM) to generate pulsed signal and LO so that they can be both polarization and time multiplexed in the telecommunication fiber. The information is encoded on the sideband of the signal thus we can fully exploit the continuous wave nature of laser field. We split the signal into two, so as the LO, then use identical sets of homodyne detectors to measure the ±π/4 quadratures, performing the no-switching scheme. To achieve long time stable phase lock in homodyne detection, we use two sets of PID circuits to control a piezo-based phase modulator and a Peltier component attached to the fiber, respectively. Thus both fast and slow phase fluctuation can be suppressed. When the multidimensional reconciliation protocol18,19 is used, secret keys can be established against collective attacks, which are asymptotically optimal20,21,22,23. Also, we have fixed newly studied loopholes in previous CVQKD systems, so that our system is immune with wavelength attacks24,25, local oscillator power attacks26,27 and calibration attacks28.

Results

Experimental setups

As shown in the upper part of Fig. 1, at the sender, Alice uses an acousto-optic modulator AOM to truncate a 1550 nm continuous wave laser field into pulses, whose repetition rate is 1 MHz and the width is 200 ns. These pulses are splitted into the signal and LO by a polarization controller and a polarization beamsplitter PBS1. The signal has a large bias, so that when Alice modulates the amplitude and the phase, she actually modulates the X and P quadratures12, respectively. 50 MHz Gaussian noise is generated by a function generator and frequency shifted by multiplexing a 80 MHz sinusoidal wave carrier. Two independent frequency shifted Gaussian noise sources are then sent to an amplitude modulator AM and a phase modulator PM1 on the signal path to perform a weak modulation. Here the Gaussian noise is frequency shifted to avoid low frequency noise in the laser and the detector. Alice uses a beamsplitter BS1 to split a part of the signal and measure the power with a photo detector PD1, then uses it as a feedback to control a variable attenuator to adjust the intensity of the signal. The LO is delayed by 80 m delay fiber and thus separated with the signal in the time domain by 400 ns. At last, the attenuated signal and the LO are combined by PBS2 and sent to the channel.

Figure 1
figure 1

The schematic of the quasi-cw CVQKD experiment.

AOM, acousto-optic modulator; PBS, polarization beamsplitter; WGN, white Gaussian noise; AM, amplitude modulator; PM, phase modulator; BS, beamsplitter; PD, photo detector; VATT, variable attenuator; DWDM, wavelength devision multiplex component; HED, heterodyne detector; HD, homodyne detector; LPF, low-pass filter. The inset is the layout of the heterodyne detection system.

Full size image

At the receiver, after 50 km of fiber, the LO power and signal power are about 10 dBm and -40 dBm, respectively. The reason why we need such strong LO is that our detectors are designed to achieve large bandwidth at the cost of low gain, thus we need high LO power to obtain high signal-to-noise ratio. As shown in the lower part of Fig. 1, Bob separates the LO and signal with PBS3. The LO is band pass filtered by a dense wavelength devision multiplex (DWDM) component to prevent wavelength attacks24,25. The bandwidth of DWDM is 0.22 nm and its insertion loss is 0.6 dB. A small portion of the LO is splitted by BS2 and detected by PD2 to monitor the LO intensity fluctuations, so that local oscillator power attacks on the LO intensity fluctuation26,27 can be defended. The signal is then aligned to the signal in the time domain by another 80 m delay fiber. They are then combined at a heterodyne detection system, which splits the signal and LO into two and uses two homodyne detectors to measure ±π/4 quadratures Y1 and Y2, as shown in the inset of Fig. 1. The phases of detected quadratures are locked using two piezo-based phase modulators PM2 and PM3. In order to compensate slow large range drifts, a Peltier component is adopted, which is attached to the delay fiber with thermally conductive silica gel.

Since there is notable low frequency noise in the laser and the detector, as shown in Fig. 2, we choose to shift the sideband, which is used to generate secret keys, to avoid this noise. To do so Alice mixes her data s(t), which is a 50 MHz Gaussian noise, with a carrier , where fc = 80 MHz is the frequency of the carrier. At Bob's side, he can demodulate the signal by mixing his detected data with the same carrier. To improve the statistical correlations with Alice, Bob needs to apply a previously characterized transfer function to the data to correct for the frequency response of Alice and Bob's electronics, such as filters and amplifiers16. Since this transfer function is totally classical and it acts on both the signal and the noise at the same time, the SNR is still a constant over the sideband we used and Eve cannot benefit from this transfer function. Therefore Bob can use it without compromising the security. After applying the transfer function, they can establish a covariance matrix of the correlated variables and estimate parameters such as channel loss and excess noise.

Figure 2
figure 2

Power spectrum of the spectrum analyzer (black), the detector (blue) and the shot noise (red).

Full size image

During the experiment, 4.6 dBm of LO power impinges on each detector. At this power level the signal to noise ratio (SNR) is 10 dB with the bandwidth of about 200 MHz, as shown in Fig. 2. Thus the electronic noise is 0.1 shot noise units. When Bob gets the detected signal, he multiplexes it with the same 80 MHz sinusoidal wave carrier and filters it using a low-pass filter of 50 MHz. The demodulated signal is then sampled by the acquisition card NI PXIe-5122 at 100 MHz sampling rate.

In our scheme, the key is encoded on the sideband of the optical field, which is corresponding to the sideband of the photo current. Therefore, in our detectors we use a resistor rather than a capacitor to convert the photo current into voltage. In this configuration Eve cannot make Alice and Bob underestimate the excess noise by manipulating the profile of optical pulses28. Thus the loophole for calibration attacks on the profile of the LO28 does not exist in our experiment.

Noise analysis

When Alice records her data, in order to eliminate system errors, she needs to multiply the signal added on Y1 and Y2 with a window function and demodulate it. The window function w(t) exerted on AOM is defined as

where n is an arbitrary integer and T = 1 µs is the period of the window function. After demodulation, the data she records is

where s(t) is the white Gaussian noise within f0 = 50 MHz, * stands for convolution and h(t) is the transfer function of the low-pass filter. The term in the square brackets can be separated into two parts. One is the high frequency part s(t)w(t) cos(4πfct), which can be eliminated by the low-pass filter. The other is the low frequency part s(t)w(t). Since s(t) is white Gaussian noise within f0, its self-correlation function is Rs(t) = sinc(2πf0t). Thus the self-correlation function of s(t)w(t) is

and it is quite complicated to calculate the corresponding power spectrum. However, here we can use a very simple and reasonable approximation. We assume that the coherent length of s(t) is much shorter than the window length of w(t), which means , then the self-correlation function of s(t)w(t) is approximately the same as that of s(t), except for a factor induced by the duty cycle of w(t). This is justified experimentally. s(t) is shown in Fig. 3 (a) and s(t)w(t) is shown in Fig. 3 (b). From Fig. 3 (c) we can see that when s(t) is mixed with w(t), its power spectrum (blue trace) keeps the same shape as before (black trace), only decreasing by a constant factor. Change of the spectrum shape exhibits only when the frequency of the window function is comparable with the bandwidth of the Gaussian noise (red trace). According to the Wiener-Khintchine theorem, the window function changes little on the shape of the power spectrum of s(t). Since the bandwidth of the low-pass filter is identical with the bandwidth of the Gaussian noise, the filtered signal is still s(t)w(t). Thus in the end the data Alice records is A(t) ≈ s(t)w(t).

Figure 3
figure 3

(a) Gaussian noise. (b) Gaussian noise truncated by the window function. (c) Power spectrum of the Gaussian noise. The black is s(t), the blue is s(t)w(t), the red is the product of s(t) and a 20 MHz square wave.

Full size image

When Bob performs heterodyne detection, the data he gets is d(t) = [ηs(t)c(t) + n(t)]w(t) + e(t), where η is the total efficiency, n(t) is the optical noise and e(t) is the electronic noise. In our experiment, we find that n(t) is mainly the shot noise. After demodulation, the data Bob records is

Similar to Alice, Bob can also get the signal ηs(t)w(t). Here we assume the bandwidth of n(t) and e(t) is infinite, that is, their self-correlation functions are Rn(τ) = δ(τ) and Re(τ) = δ(τ), respectively. To derive the power spectrum of n(t) and e(t) when they are mixed with w(t), we need to calculate the self-correlation functions. For the electronic noise e(t), when it is mixed with the carrier, its self-correlation function is still

which means its bandwidth is still infinite. Thus after low-pass filter electronic noise e′(t) = [e(t)c(t)]*h(t) is a white Gaussian noise within 50 MHz.

For the modulated shot noise n(t)c(t), it can be separated into two parts as n(t)c(t) = n1(t) + n2(t), where n1(t) is sideband within 50 MHz and n2(t) is the rest. After mixed with the window function and low-pass filtered, n1(t) becomes n1(t)w(t), just like s(t), while n2(t) is filtered out.

Thus the data Bob records can be written as B(t) = [(ηs(t) + n1(t)]w(t) + e′(t). Among all the data, the truly useful one is that when the window is open. In this region, as we derived above, the signal-to-noise ratio is identical with the continuous case.

We adopt the realistic assumption5, according to which Eve cannot manipulate the loss and electronic noise of Bob's detectors. Under this assumption Bob can calibrate the efficiency and electronic noise of his detectors before the key generation. Considering the PBS efficiency 0.90, fiber beamsplitter efficiency of 0.98, photodiode efficiency 0.80, the effective transmission losses of 2 × 10−5 due to the actual fiber beamsplitter ratio 49.7:50.3 and other insertion loss of about 1 dB, the overall quantum efficiency is η = 0.55. The detection setup realizes 50 dB of common mode noise suppression and the electronic noise in the detector is measured to be vel = 0.10.

In our experiment, we use broadband modulation on the sideband of optical pulses, which means that there are many coherent states in one pulse, so we can hardly randomly mix modulated states used for key generation and vacuum states used for shot noise calibration. Thus we have to calibrate the shot noise before QKD runs, as in Ref. 29. Since we have adopted LO power monitoring during QKD, the beforehand shot noise calibration will not leave Eve loopholes. To estimate the channel loss and the excess noise, we need to take the finite-size effect29,30 into account. For a block of N = 109 pairs of correlated variables, the channel loss and the excess noise in 50 km telecommunication fiber are measured to be T = 0.096 and ξ = 0.002, respectively. The uncertainty of the channel loss and excess noise are29,30

where satisfies is the probability that the estimated parameters do not belong to the confidence region computed from the parameter estimation procedure). For the 50 MHz Gaussian noise, we can sample at 100 MHz. Since the duty cycle of the window function w(t) is 1/5, the effective repetition rate is 20 MHz. We can use half of the data for parameter estimation and the other half for key generation. Then it takes t = 100 s to get a block of N = 109 pairs of correlated variables.

When the multidimensional reconciliation protocol is adopted, the reconciliation efficiency can reach 0.95 for an arbitrarily low SNR19. With parameters we discussed above and the optimal modulation variance 4.28, we can establish a final key rate of 187 kb/s against collective attacks.

Discussion

Time multiplexing is the most common method used to suppress excess noise in fiber-based CVQKD systems. In previous experiments8,13, the signal is generated by pulsed lasers and treated as a single coherent state per pulse. Due to control techniques, the repetition rate is usually limited to the order of mega Hertz, which is much smaller than the realizable bandwidth of detectors. Thus there is still room to improve the secret key rate. We employ broadband modulation on coherent light pluses to construct a quasi-cw CVQKD system, where the bandwidth of the signal is compatible with that of detectors. When the signal is mixed with the window function of pulses, its self-correlation function changes, thus its power spectrum will also change. However, as long as the signal bandwidth is much larger than the frequency of the window function of pulses, the power spectrum of the pulsed signal is almost the same as that of the cw signal, which means the system is truly quasi-cw.

A quasi-continuous wave continuous variable quantum key distribution system is experimentally demonstrated. Time multiplexing is adopted so that the excess noise can be maximally suppressed. Pulsed coherent light is generated by a 1550 nm cw laser and an acousto-optic modulator. To fully exploit the continuous nature of coherent light, we employ a true broadband encoding scheme, using a white Gaussian noise within 50 MHz generated by a function generator as the signal. The modulation signal is shifted by 80 MHz to avoid low frequency noise in the system and added to the sideband of the laser field. A double servo phase locking system, which contains a piezo-based phase modulator and a Peltier component, is used to suppress both fast and slow fluctuations, so that the system can achieve long term phase locking stability. Narrow band filter and intensity monitor are performed in our system to prevent wavelength attacks and local oscillator power attacks. Since there is no integral circuit in our detectors, our system is immune with calibration attacks. In 50 km fiber, we can establish a secret key rate of 187 kb/s against collective attacks when the multidimensional reconciliation protocol is implemented.

Methods

Long term stable phase locking

Common phase modulators provide large bandwidth, but the tuning range is relatively small, which although can suppress high frequency fluctuations, can hardly compensate slow but large range drifts. In our experiment, in order to achieve long term stable locking, we adopt two sets of servo system for one homodyne detector. The DC signal of the homodyne detection is used as an error signal to control a piezo-based phase modulator to suppress the fast fluctuations, as shown in the inset of Fig. 1. As for slow drifts, we use the deviation of the phase modulator from the middle point of its dynamic range as an error signal to control a Peltier component. The Peltier component is attached to the delay fiber on the LO path using thermally conductive silica gel.

To test how the temperature compensation works, we get the DC signal of homodyne detection without and with the temperature compensation, as shown in Fig. 4 (a) and (b). We can see that when the temperature compensation is adopted, the locking time is longer. We also get the driving signal on the phase modulator without and with the temperature compensation, as shown in Fig. 4 (c) and (d). We can see that when the temperature compensation is adopted, the phase modulator works within a much smaller region, thus it is more unlikely for it to lose lock.

Figure 4
figure 4

(a) The DC signal of homodyne detection without temperature compensation. (b) The DC signal of homodyne detection with temperature compensation. (c) The driving voltage of the phase modulator without temperature compensation. (d) The driving voltage of the phase modulator with temperature compensation.

Full size image

Measured quadratures in heterodyne detection

In this experiment, we use the DC signal of the homodyne detection as an error signal to lock the phase of the signal relative to that of the LO. To perform no-switching scheme, Bob needs to measure two perpendicular quadratures. Usually Bob choose to measure X and P quadratures, which correspond to the phase of 0 and π/2, respectively. In free space experiments, since the relative phase drift between the two homodyne detectors is small, we can lock one phase to π/2 and simply insert a quarter-wave plate in the other to add a −π/2 phase shift. However, in fiber systems, there is no quarter-wave plate and the relative phase drift can usually not be neglected. Thus we need to lock both of the two phases. Although the P quadrature can be locked to measure with only the DC signal, the X quadrature cannot be locked with the same method, since the error signal is symmetric around this point. Thus here alternatively we choose ±π/4 to lock. In this case, what Bob measures are no longer X and P, but two quadratures defined as

Alice should perform the same transform on her data added to the amplitude and phase modulators. Once the two quadratures are locked at correct position, there is no observable correlation between the data Bob records.