Enhancing of Self-Referenced Continuous-Variable Quantum Key Distribution with Virtual Photon Subtraction

The scheme of the self-referenced continuous-variable quantum key distribution (SR CV-QKD) has been experimentally demonstrated. However, because of the finite dynamics of Alice’s amplitude modulator, there will be an extra excess noise that is proportional to the amplitude of the reference pulse, while the maximal transmission distance of this scheme is positively correlated with the amplitude of the reference pulse. Therefore, there is a trade-off between the maximal transmission distance and the amplitude of the reference pulse. In this paper, we propose the scheme of SR CV-QKD with virtual photon subtraction, which not only has no need for the use of a high intensity reference pulse to improve the maximal transmission distance, but also has no demand of adding complex physical operations to the original self-referenced scheme. Compared to the original scheme, our simulation results show that a considerable extension of the maximal transmission distance can be obtained when using a weak reference pulse, especially for one-photon subtraction. We also find that our scheme is sensible with the detector’s electronic noise at reception. A longer maximal transmission distance can be achieved for lower electronic noise. Moreover, our scheme has a better toleration of excess noise compared to the original self-referenced scheme, which implies the advantage of using virtual photon subtraction to increase the maximal tolerable excess noise for distant users. These results suggest that our scheme can make the SR CV-QKD from the laboratory possible for practical metropolitan area application.


Introduction
Quantum key distribution (QKD), which is the best-known application of quantum cryptography, is able to distribute a secret key between two distant legitimate parties, called Alice and Bob, over an a priori unsecure communication channel [1][2][3][4]. There are two branches in performing quantum key distribution: the discrete-variable (DV) QKD based on modulating a single photon state and the continuous-variable (CV) QKD based on coherent detection [5][6][7][8]. CV-QKD has demonstrated the advantages of high detection efficiency and low experiment cost. More significantly, most standard telecommunication technologies could be compatible with CV-QKD, which makes CV-QKD more attractive and hence fruitful [9][10][11][12][13][14].
The major research protocol of CV-QKD is the Gaussian modulated coherent state (GMCS) CV-QKD protocol, the unconditional security of which has been demonstrated in theory [15][16][17]. In order to provide a phase reference for Bob's coherent detection on the received quantum signals, the conventional GMCS protocol needs to co-transmit a local oscillator (LO), a high bright classical

The Conventional Gaussian and the SR CV-QKD Scheme
The conventional Gaussian CV-QKD scheme is illustrated in Figure 1a. Through the techniques of multiplexing in time and polarization, the quantum signals and the LO are co-transmitted from Alice to Bob in the quantum channel. Moreover, one can utilize the wavelength-division multiplexing technique to generate multiply-parallel quantum channels simultaneously, which are multiplexed and demultiplexed by the wavelength multiplexer and demultiplexer. At the receiver, Bob splits the quantum signals and the LO by the polarization controller and polarizing beam splitter. However, an eavesdropper can utilize the possible security loopholes of the intensity LO to perform side-channel attacks. Meanwhile, multiplexing and demultiplexing are knotty, as these are two kinds of signals that differ greatly in amplitude. The scheme of self-referenced (SR) CV-QKD. The quantum signals and reference pulses are co-transmitted through the same channel. At reception, the received pulses are measured in Bob's own phase reference frame defined by the locally-generated LO. PM, phase modulator; AM, amplitude modulator; CD, coherent detection; QM, quantum memory; AOM, acousto-optical modulator; PBS, polarizing beam splitter; χ line , channel-added noise; T, channel transmission; E, Eve's ancillae. Different from the conventional Gaussian CV-QKD scheme, the SR CV-QKD scheme in [23] waives the transmission of the LO between legitimate users and operates essentially by employing a locally-generated LO, which effectively resists the possible side-channel attacks. The SR CV-QKD scheme could be generalized as shown in Figure 1b, and it contains two main steps: Step 1: Alice prepares the Gaussian modulated coherent state |q A + ip A as the quantum signal pulse and the other coherent state |q A R + ip A R as the reference pulse. Then, she sends these coherent states to Bob without sending the LO. The two independent Gaussian random variables (q A , p A ) are both distributed as N (0, V A ), while the mean quadrature values of the reference pulse are fixed to (q A R , p A R ) in Alice's phase reference frame and are publicly known. The amplitude of the reference pulse ) may be several orders of amplitude larger than √ V A and is much weaker than the amplitude of the LO.
Step 2: Bob performs a homodyne detection on the received signal pulse and a heterodyne detection on the reference pulse in his own reference frame defined by the locally-generated LO. He obtains q B or p B as one of the quadratures of the signal pulse and q B R and p B R as both of the quadratures of the reference pulse.
The reference pulse is used to estimate the phase deviation angleθ between Alice's and Bob's reference frames. Theθ can be estimated byθ = θ + φ, where θ is the actual deviation angle and φ is the measurement error contributed by the quantum uncertainty. The covariance matrix between Alice and Bob can be written as [23]:γ output state, χ is the channel noise, T is the channel transmission, η is the detector efficiency, cos φ = π −π dφP (φ)cosφ and P (φ) is the probability distribution of the random variable φ and is symmetric around φ = 0.
According to the results in [23], the maximal transmission distance is positively correlated with the amplitude of the reference pulse. However, an extra excess noise proportional to the amplitude of the reference pulse will be generated due to the finite dynamics of Alice's amplitude modulator [26]. Therefore, an arbitrary large amplitude of the reference pulse is not proper, and a more realistic value, such as E 2 R = 20V A , will be rational. Unfortunately, this realistic value will restrict the maximal transmission distance of the SR CV-QKD protocol to a fairly low level, as illustrated in Section 4 later on. This issue will hinder the practical application of the SR CV-QKD scheme.

SR CV-QKD with Virtual Photon Subtraction
Photon subtraction can improve the entanglement of the two-mode squeezed vacuum (TMSV) state and hence enhance the performance of the system. In order to make the description of our scheme self-contained, we first start with the basics of photon subtraction on a TMSV state. Figure 2 describes the entire steps of the EB CV-QKD scheme with photon subtraction. An entanglement source |λ is used to produce the TMSV state and |λ = √ 1 − λ 2 ∑ ∞ n=0 λ n |n, n . Then, Alice performs heterodyne detection on mode A and sends mode B to a beam splitter (BS) with transmittance τ. The mode B is split into modes: B and B 1 . The modes A, B , B 1 form a tripartite state ρ AB B 1 , The photon number resolving detector (PNRD) is used to perform the positive operator-valued measure (POVM) {Π 0 ,Π 1 } on mode B [37]. Only when the POVM elementsΠ 1 click, the mode A and B 1 can be kept. The kept state is given by: where tr x (·) is the partial trace of the multimode quantum state and PΠ 1 = tr AB B 1 (Π 1 ρ AB B 1 ) denotes the success probability of subtracting k photons. However, the straightforward application of the above photon subtraction to the SR CV-QKD is not a desirable method, in which the reference pulse will also pass through the BS and the hardware requirement will be enhanced. Fortunately, the EB CV-QKD scheme with photon subtraction can be equivalent to the PM CV-QKD scheme with virtual photon subtraction via non-Gaussian post-selection [33]. In the post-selection step, Alice uses a post-selection filter function Q(·), or acceptance probability, to decide which data will be accepted. The post-selection step is carried out after Bob has performed coherent detection, which means it will not change the Gaussian state ρ G AB 2 and the Gaussian process G. The mode B 2 is the received mode at Bob's side. Therefore, we propose the scheme of SR CV-QKD with virtual photon subtraction, which can be realized via non-Gaussian post-selection. The schematic diagram of our scheme is described in Figure 3, where α = √ 2τλγ/2, and γ is the measurement result of mode A in the EB scheme, i.e., is the variance of the TMVS state in the EB scheme. Hence, according to the derived results in [33], the covariance matrixγ G AB 2 of the Gaussian state ρ G AB 2 for subtracting k photons can rewrite Equation (1) as: with: where ε el is the electronic noise of the Bob's detector, ε c is the channel excess noise and T e = Tη.

Performance Analysis
Usually, the secret key rate of the TMSV state is no less than the secret key rate of the equivalent Gaussian state, which shares an identical covariance matrix due to the extremality of Gaussian state [38][39][40]. Hence, we will useγ G AB 2 to derive the lower bound of the secret key rate. Besides, the acceptance probability for each of the data in the post-selection step should also be taken into account. This probability is equivalent to the success probability of Alice's POVM measurement PΠ 1 and can be treated as a scaling factor.

Individual Attacks
The lower bound of the secret key rate of our scheme against individual attack for reverse reconciliation is: where , I G AB is the mutual information between Alice's and Bob's measurements, I EB is mutual information between Eve's and Bob's measurements and β is the reconciliation efficiency.
From the covariance matrix in Equation (4) and the derived results in [23], the mutual information between Alice's and Bob's measurements I G AB can be written as: with V = (V A + 1)/2 and V A|B = V − C 2 /2V B . Through the relationship: we can get: where V R = E 2 R , δ R = 1 for single-reference-pulse mode and Vθ is the variance of the estimated deviation angleθ. The upper bound of mutual information between Eve's and Bob's measurements can be given by: with

Collective Attacks
The asymptotic secret key rate against collective attacks for reverse reconciliation can be given by: where I G AB is given by Equation (11) and χ G BE is the maximal stolen information. The maximal stolen information χ G BE can be written as: where G(x) = (x + 1) log 2 (x + 1) − x log 2 (x) is the von Neumann entropy of a thermal state. The eigenvalues λ 1 and λ 2 are obtained from: with The square of symplectic eigenvalue λ 3 reads: In what follows, we will assume that V A = 40, β = 0.95, ε c = 0.01, η = 0.719 and α = 0.2 dB/km [23]. All the variances in this paper are in shot-noise units. Figure 4 shows our simulation results against individual and collective attacks. Figure 4a-d gives the maximum secure key rate at each transmission distance for all possible τ of Alice's BS. Note, due to the excess noise contributed by the leakage of reference pulses, here, V R is set to a more realistic value of 20V A , and thus, we neglect this excess noise (about 8 × 10 −4 when the dynamics of Alice's amplitude modulator is 60 dB) [26]. The figures show a considerable maximal transmission distance improvement when the photon subtraction operation is applied in the SR CV-QKD scheme, especially in the case of subtracting one photon. Furthermore, we find that our scheme of SR CV-QKD with virtual photon subtraction is sensible with the detector electronic noise. A lower electronic noise can result in a larger maximal transmission distance, as shown in Figure 4b,d. We note that the electronic noise of 0.001 is achievable, which is demonstrated in [41]. However, the secure key rate is worse than the original protocol in the short distance region. The main reason for this phenomenon is that the limited acceptance probability degrades the final key rate. τ is a key parameter, which should be determined in advance. Figure 4e shows the optimal τ at each distance for the maximum secure key rate in Figure 4d. The optimal τ decreases along with the increasing of the transmission distance, which implies a accurate estimation of τ is required for each distance. Figure 4f represents the success probability of subtracting k (k = 1, 2, 3) photons at each distance for the maximum secure key rate in Figure 4d. Although the success probability will be larger in the region of large τ, a large success probability does not mean a large secure key rate, especially when the transmission distance becomes longer. This is because τ not only impacts the success probability, but also the entire key generation. We did not draw the optimal τ and the success probability of subtracting k photons at each distance for the maximum secure key rate in Figure 4c, as their results are similar to the case when the electronic noise is 0.001.
From a practical point of view, if the secure key rate varies rapidly with τ around its optimal value, the accurate estimation of the optimal τ will need complicated implementations. Fortunately, around the optimal value of τ, the secure key rate varies slowly with the change of τ at each distance, as shown in Figure 5. Particularly, between the upper bound (black dashed line) and lower bound (red dashed line) of τ at a specific distance, the secure key rate can maintain more than 90% of its optimal value (K opt ).
Another aspect of our scheme is the tolerable excess noise. As shown in Figure 6a,b, we depict the relationship between the maximal tolerable excess noise and the transmission distance for different electronic noise and all possible τ. The original scheme is outperformed by the protocol of using photon subtraction at all transmission distance ranges, which implies the advantage of using photon subtraction, which increases the maximal tolerable excess noise for distant users. Moreover, if the channel is less noisy, for example, ε c ≈ 0.005, the one photon subtraction can expand the maximal transmission distance to 20 km for ε el = 0.01 and 33 km for ε el = 0.001. As the tolerable excess noise is not affected by the acceptance probability, the optimal τ for the maximal tolerable excess noise at each distance is different from that of the one for the maximum secure key rate, as shown in Figure 6c,d.   Actually, many protocols have investigated the CV-QKD with virtual photon subtraction. All of them can significantly improve the maximal transmission distance of the CV-QKD protocols. In [33], the method of virtual photon subtraction was firstly used in the conventional one-way GMCS CV-QKD scheme, the LO of which is co-transmitted with the quantum signal. The maximal transmission distance can be extended from 90-220 km (144% improvement). The protocol of two-way GMCS CV-QKD with virtual photon subtraction was investigated in [35]. The maximal transmission distance can be extended from 85-310 km (266% improvement). In [34], the four-state CV-QKD protocol combined with virtual photon subtraction can extend the maximal transmission distance from 140-330 km (136% improvement). For the protocol of measurement-device-independent CV-QKD with virtual photon subtraction, the maximal transmission distance can be extended from 42-68 km (62% improvement) [36]. In our scheme of SR CV-QKD with virtual photon subtraction, we also obtained a considerable extension of the maximum transmission distance when the detector electronic noise was 0.001. The maximum transmission distance increased from 18-58 km (222% improvement) under individual attack and from 5-30 km (500% improvement) under collective attacks, which makes possible the application of the SR CV-QKD from the laboratory to an actual metropolitan area. If we increase the amplitude of the reference pulse appropriately and control the reference pulse's leakage noise in a certain range, the maximum transmission distance can be extended further. For example, if V R = 50V A and the detector electronic noise is equal to 0.001, the maximal transmission distance can be extended from 15-40 km. In practice, the imperfection of the detector will constrain the performance of the CV-QKD protocol. Therefore, any imperfection of the detector should be taken into account, while this was not considered in [34,36,37].

Conclusions
In this paper, we proposed the scheme of SR CV-QKD with virtual photon subtraction. It not only has no need to increase the physical complexity of the original SR CV-QKD system, but also can extend the maximal transmission distance without increasing the intensity of the reference pulse. Performance analysis results show that a considerable extension of maximal transmission distance can be obtained, especially for one-photon subtraction. Meanwhile, the scheme of SR CV-QKD with virtual photon subtraction is sensible with the detector's electronic noise. A longer maximal transmission distance can be obtained when the electronic noise is lower. Furthermore, it is more tolerable against excess noise for our scheme compared to the original protocol, which implies the advantage of using virtual photon subtraction to increase the maximal tolerable excess noise for distant users. These results suggest that under existing technology, our modified scheme of the SR CV-QKD can make possible the SR CV-QKD from the laboratory to practical metropolitan area application. However, we note that the gap between practical implementations and the theoretical analysis here should be taken into account. Any imperfection factors in the practical experiment should introduce corresponding parameters. This issue is not included in the scope of the present analysis, and deserves further study.