Free-Space QKD with Modulating Retroreflectors Based on the B92 Protocol

Free-space quantum key distribution (QKD) has attracted considerable attention due to its lower channel loss and link flexibility. It allows two participants share theoretical unconditional secure keys, and can potentially be applied to air-to-ground quantum communication to establish a global quantum network. Free-space QKD using modulating retro-reflectors (MRR-QKD) significantly reduces the pointing requirement and simplifies the structure of the mobile terminal, therefore making it suitable for lightweight aircraft such as unmanned aerial vehicle and Cubesat, etc. Based on intensity modulation of two non-orthogonal states and the B92 protocol, we proposed a scheme to improve the previous work (Optics Express 2018, 26, 11331). Our scheme simplifies the optical structure and shows more robustness in equipment imperfection. The analysis and simulation show that the number of multiple quantum well modulators needed in our scheme decreases from eight to three with similar performance. Additionally, while the previous scheme cannot work due to low modulator extinction ratio or high optical misalignment, our scheme can still operate.


Introduction
Quantum key distribution (QKD) can help two distant parties to realize theoretical unconditional security communication [1]. QKD can be categorized into fiber-based QKD and free-space QKD according to different communication channels. The longest transmission distance that fiber-based QKD can achieve is only hundreds of kilometers because of the intrinsic loss of the fiber (approximately 0.2 dB/km@1550 nm) [2][3][4]. Conversely, free-space QKD can achieve a transmission distance of thousands of kilometers owing to its lower channel loss, and it is also suitable for mobile communication owing to its flexible link [5][6][7]. A worldwide quantum-secured communication network is foreseeable by integrating free-space and fiber-based QKD [8].
Despite encouraging advances in free-space QKD [9,10], many challenges remain, for example, the contradiction between the limited payload of satellites and the complex structure of free-space QKD system [6]. The miniaturization and light weight of QKD systems has become an important topic [11,12]. Cheaper microsatellites, such as standardized CubeSats, will play a greater role in future quantum networks [13][14][15]. Free-space QKD using modulating retro-reflectors (MRR-QKD) significantly reduces the pointing requirement and simplifies the structure of the mobile terminal, therefore decreasing the payload greatly, which may be a prospective scheme.
In the MRR-QKD system, two communication parties are defined as the interrogator and MRR terminal. Compared with the traditional QKD system, the structure of the MRR terminal in the MRR-QKD system is simpler, and the pointing requirement is reduced significantly(more than three orders of magnitude) [16]. The concept of MRR-QKD was first proposed by Rarity in 2002 [17]. Vallone demonstrated an imperfect experiment for satelliteto-ground MRR-QKD between low earth orbit (LEO) satellites and the Matera Laser Ranging Observatory (MLRO) [18]. Many studies have been conducted recently [16,19,20]. In 2017, Rabinovich designed a practical MRR-QKD system and achieved a quantum bit error rate (QBER) of approximately 5% with a modulation rate of 1 MHz in the laboratory [16].
The MRR-QKD system of Rabinovich [16], which we will call RM2018 in this paper, uses up to eight multiple quantum wells (MQW) [21,22] intensity modulators to realize polarization modulation. Owing to the finite extinction ratio [23] of MQW modulators, there is leakage noise in this system, which causes higher QBER. Based on the superposition of two mutually perpendicular waves [24], we proposed a MRR-QKD system based on the B92 protocol [25]. Our scheme reduced the complexity of the system structure and eliminated leakage noise. The remainder of this paper is organized as follows. In Section 2, we introduce the configuration of our MRR-QKD system and its mathematical model. In Section 3, the performance of the system under different extinction ratios and optical misalignment errors is studied and compared with previous works. In Section 4, we discuss our results. In Section 5, we present our conclusions.

MRR-QKD With B92
First, let us review the scheme proposed in RM2018. Four pairs of MQWs were used to realize polarization modulation, where each pair corresponded to one of the four BB84 states (0, 45, 90, and 135 • ). While the transmission loss of the MQW modulator is set to the lowest (highest), the MQW is in the "on" (off) state. The polarization modulation is realized by controlling the states of MQWs. For example, when the MRR terminal sends a horizontal state, the pair of MQWs corresponding to the horizontal state will be "on" and the others will be "off". More details are shown in Appendix C.
The extinction ratio of the MQW bewteen the "on" and "off" states is only approximately 7.5 dB, which is too small. Unwanted light will leak from the MQW, which are "off", resulting in extra QBER. To decrease the QBER, RM2018 uses a stack of two MQWs packaged together to achieve an extinction ratio r of 15 dB in every path. However, this will greatly increase the complexity and cost of the system, and the extinction ratio will remain unsatisfactory.
Our MRR-QKD system, based on the superposition principle of two mutually perpendicular waves, uses only three MQW modulators in total and eliminates unexpected noise leakage. The configuration of the MRR-QKD system is shown in Figure 1. The system works as follows. First, the interrogator generates an interrogation beam, which is a classical light pulse with right-hand circular polarization the same with RM2018, and sends it to the MRR terminal through a free-space channel. After arriving at the MRR terminal, the interrogation beam passes through MQW3, which is used to modulate decoy states. Then, it is split into two beams with the same intensity by a PBS, the horizontal state is transmitted, and the vertical state is reflected. These two beams will pass forward through an MQW and be reflected by a retroreflector, and then pass backward through the MQW again. Therefore, the intensity of these two beams are modulated by MQW1 (and MQW2) twice. Finally, they are combined by the PBS, and the output is a linearly polarized beam with polarization direction θ (see Appendix A).
where |β θ is the linearly polarized coherent state. β is the amplitude of the beam, and θ = arctan( √ M 2 /M 1 ) is its polarization direction. M 1 and M 2 are the modulation efficiencies of MQW1 and MQW2, respectively.
The B92 protocol is adopted in our system. Each retroreflected beam is in one of two linear polarizations with polarization directions of 22.5 • and 67.5 • by adjusting the ratio of the modulation efficiency of MQW1 and MQW2. This is slightly different from the general B92 protocol.
The beam is attenuated and modulated by MQW3 to generate signal or decoy states. After the beam is transmitted back and received by the interrogator, it is still linearly polarized because of the stability of the polarization in free space [26]. However, its polarization direction is changed because of the relative orientation of the interrogator and the MRR terminal. A half-wave plate is used for polarization compensation. The incident beam will be converted to 0 • (45 • ) linear polarization. The following procedures, such as measurement and post-processing, are the same as those of the general B92 protocol [25,27].

Results
We now analyze the performance of our MRR-QKD system proposed in Section 2 and compare it with RM2018. With two decoy state technology, the secure key rate (SKR) of the QKD system is [28].
where q is the protocol efficiency, f is the bi-directional error correction efficiency, Q µ is the gain of the signal state, E µ is the overall QBER, Q L,ν 1 ,ν 2 1 and e U,ν 1 ,ν 2 1 are the lower bound of the gain and upper bound of the error rate for single photon state, respectively. H 2 (·) is the binary Shannon information function.
In our system, the protocol efficiency of the B92 protocol is q = 1/4, whereas BB84 is used in RM2018, q = 1/2. The intensity of the signal state is µ. The maximum intensity range of the decoy state is ν ∈ [µ/r, µ). In the asymptotic case, the smaller the value of ν 1 + ν 2 , the higher the SKR [28]. Therefore, we chosen the signal state intensity µ = 0.48, decoy state intensity ν 1 = µ/r and vacuum state ν 2 = 0. Other simulation parameters are listed in Table 1. In Section 2, we showed that the extinction ratio of the MQW would cause leakage noise while the MQW is "off" in RM2018. This leakage noise would make the QBER increase. The smaller the extinction ratio, the higher the leakage noise. In our scheme, the extinction ratio does not generate leakage noise but only restricts the intensity of the decoy states. We demonstrated the extinction ratio effect in our system, the simulation results are shown in Figure 2. The three curves with extinction ratios of 7.5, 15, and 22.5 dB overlap almost completely. This indicates that the extinction ratio does not have a significant impact on the SKR of our scheme. This is because the SKR is not sensitive to the intensity of the decoy state. Additionally, in contrast to RM2018, which stacks two MQWs to increase the extinction ratio, our system requires only one MQW in each path.
Under different extinction ratios, we compare the SKR of our system and the RM2018. The results are shown in Figure 3. Considering the additional QBER resulting from noise leakage for the finite extinction ratio, the probability of a photon clicks the erroneous detector should be corrected to e detect = r − 1 r + 3 e detect + 2 r + 3 [23]. e detect is the probability that a photon clicks the erroneous detector due to the optical misalignment and r indicates the extinction ratio. As shown in Figure 3, the SKR of RM2018 is very sensitive to the extinction ratio. The SKR decreases as the extinction ratio reduces. When the extinction ratio was less than 15 dB, the SKR of RM2018 decreased below zero (vanishing blue dotted line). The performance of our system with only a 7.5 dB extinction ratio could reach at least 70% of RM2018 with a 22.5 dB extinction ratio, and even higher for the maximum transmission distance. This means that only one MQW is needed for each path in our system, whereas RM2018 requires three MQWs.
In RM2018, e detect is related not only to the extinction ratio, but also the optical misalignment error e detect . As shown in Figure 4, we studied the relationship between the SKR and transmission loss of both our system and RM2018 under different e detect values. The dotted line represents RM2018, and the solid line represents our system. When the extinction ratio is fixed, it is clear that the SKR of the two systems decreases as e detect increases. We found that the robustness of our scheme countering the increase in e detect was better than that of RM2018. When e detect = 1% and 3%, the SKR of RM2018 was slightly higher than that of our system in most cases, mainly because the efficiency of the BB84 protocol was twice that of the B92 protocol. However, when e detect = 5%, the performance of our system was much greater than that of RM2018. This result shows that the higher the e detect , the greater the advantage of our system is over the RM2018. This occurs because the SKR decreases faster as e detect increases. Moreover, the e detect of RM2018 is always larger than the e detect of our system.
We study the intrinsic maximal tolerance of misalignment error e U detect at which the SKR becomes zero. The relationship between the extinction ratio and e U detect of two systems is compared in the condition of transmission probability of 100%. The result is shown in Figure 5. We can see that e U detect in our system is not sensitive to the change of the extinction ratio. The change of it is mainly originated in the change of decoy state intensity. When the extinction ratio is lower than about 13.5 dB, RM2018 cannot operate. This is because the error rate caused by noise leakage has exceeded the threshold. In other cases, e U detect climbs up with the increase of the extinction ratio and the difference between our system and RM2018 gets smaller. When the extinction ratio is greater than 40 dB, they almost have similar performance e U detect ≈ 7.65%.

Discussion
In the previous sections, we analyzed our MRR-QKD scheme with the B92 protocol and compared it with RM2018. The results are listed in Table 2. Our scheme requires only three MQW modulators, which is significantly less than the eight in RM2018. Two of them are used for polarization modulation and the other is used for decoy state generation. Based on the superposition principle of perpendicular polarization states, we make full use of each beam to solve the problem of extra QBER on account of the finite extinction ratio. This could effectively improve the performance of the MRR-QKD system. Although the protocol efficiency was only half that of RM2018, our scheme could reach a much higher SKR, while having a high optical misalignment error or low extinction ratio. These two systems both modulate the polarization of the beam by means of intensity modulation. The modulation rate of the MQW intensity modulator can be up to 100 MHz [16]. The low extinction ratio of the MQW will cause higher QBER in RM2018. The protocol efficiency in our system is half that in RM2018 because of the principle of the modulation method. In the ideal circumstance of the infinite extinction ratio, the performance of RM2018 is better than ours. But if the MQW intensity modulator for polarization modulation are replaced by phase modulators, it is possible to apply the BB84 protocol in our system [30]. Thus, we can achieve the same performance as RM2018 with smaller cost. The decoding system of the B92 protocol in our system is the same as that of RM2018 and very close to the classical free-space QKD system based on the BB84 protocol [6,14,31]. This means that it is convenient to fit our system into the current free-space QKD network [31,32].
The imperfection of the device, such as misalignments and detection efficiency mismatch, will allow eavesdroppers to attack in side channels. These flaws have been proved not affecting the security of the system within several counter-measures(temporal, spatial and frequency filtering and so on) [33]. The signal in the MRR-QKD system makes a roundtrip through atmospheric channels. The transmission process is similar to the "plug-play" system in fiber channels [34]. The source of such two-way QKD systems is untrusted; its security has been proven [35,36]. Unlike the "plug-play" system, the MRR-QKD system based on free-space channels will be subject to the off-axis attack. This attack can be resisted by monitoring the incident angle of the interrogation beam and using modulators with pixel units to code beams with authentication. Therefore, those modulators incapable of pixelated modulation are not suitable to be used in MRR-QKD system, like AOMs modulators with comparable modulation rate and higher extinction ratio [37]. Other attacks, like photon number splitting, intercept-resend and on-axis attacks, are also explicated [16].

Conclusions
We propose an MRR-QKD scheme using the B92 protocol. Based on the superposition principle of perpendicular polarization states, this system realizes polarization modulation by means of intensity modulation. Compared with RM2018, our system not only simplifies the structure, but also improves the tolerance of the MRR-QKD system for extinction ratio and optical misalignment error. This novel, cheaper and smaller system can be expected to be widely applied in mobile platforms with limited payloads, such as cube satellites, unmanned aerial vehicles, automobiles, etc.

Conflicts of Interest:
The authors declare no conflict of interest.

Appendix A
For ease of analysis, we transformed the round-trip MRR terminal in Figure 1 into a unidirectional transmission model, as shown in Figure A1. MQW3 was omitted because it does not affect the result. The interrogation beam incident on the MRR terminal is a coherent state with righthanded circular polarization.
where α is the amplitude of the coherent state, and the subscript 0 indicates the transmission path shown in Figure A1. Any pure coherent state can be expressed as the direct product state of two coherent states, whose polarizations are orthogonal to each other.
The right-handed circular polarization coherent state can be expressed as the direct product of the horizontal and vertical polarization coherent states. Their intensity are equal, which is half of the interrogation beam, and the phase difference is π/2.
Because the PBS transmits only the horizontal |H and reflects the vertical |V polarizations, after passing through PBS1, the interrogation beam will evolve into The phase shift generated by PBS has been ignored because it does not influence the conclusion. The beam transmitted along Paths 1 and 2 will pass through a free-space path, which is equivalent to a phase shifter. Then the joint state before incident I M 1 and I M 2 is: whereP 1 is the phase shifter operator acting on Path 1,n 1 is the photon number operator acting on Path 1. Afterward, these two beams are modulated by intensity modulator I M 1 and I M 2 respectively. The output state is as follows(for details, see Appendix B).
Then the beam passes through the free-space path again, and we have Finally, these two beams are combined by the PBS If 2θ 1 = π/2 + 2θ 2 , |ψ out is converted to It is the direct product state of the horizontal and vertical polarization coherent states, which is linearly polarized. If √ M 1 = C cos θ, and √ M 2 = C sin θ, the state is where β = C α is the amplitude and θ is the polarization direction of the output beam. The polarization of the beam depends on the intensity of two combined beams, satisfying θ = arctan( √ M 2 /M 1 ). We can adjust the ratio of M 1 and M 2 to realize different linear polarizations. However, only a few polarizations can be achieved in this manner. While the phase difference is zero, only linear polarizations with axes θ ∈ (0, π/2) are possible. Therefore, we use the B92 protocol, which requires only two states with polarization direction θ and θ + 45 • instead of the BB84 protocol.
When the polarization direction of the output beam is θ, the corresponding modulation efficiency of MQW1 and MQW2 are √ M 1 = C cos θ and √ M 2 = C sin θ, respectively. While the polarization direction is θ + 45 • , √ M 1 = C cos(θ + 45 • ) and √ M 2 = C sin(θ + 45 • ). The contrast ratio (CR) of MQW1 and MQW2 while modulating the different polarizations are As shown in Figure A2, CR 1 and CR 2 exhibit opposite trends while θ increases. When θ = π/8, CR 1 = CR 2 ≈ 7.6 dB, which is approximately equal to the extinction ratio of a MQW [18]. These correspond to 22.5 • and 67.5 • linear polarization, respectively. Therefore, we used these two polarizations. According to the superposition principle of two perpendicular polarization states, we can see that the polarization state of the retroreflected beam is dependent on the intensity and phase difference of two beams inputting the PBS. We modulated the intensity of the beam by adjusting the modulation efficiency of the MQW to obtain the expected polarization while keeping the phase difference constant over a fixed optical path. Only one MQW modulator in every path and two MQW modulators in total for polarization modulation were required. However, it is worth noting that only a few polarizations can be achieved in this manner. Therefore, the B92 protocol which uses two nonorthogonal states was adopted in our system. Additionally, MQW3 was used for the decoy state, and there were only three MQW modulators in our system, which is less than the eight required by RM2018.

Appendix B
The signal passing through the intensity modulator is equivalent to the signal passing through the beam splitter. The transmittance t (or reflectivity r) of the beam splitter is equal to the modulation efficiency M of the intensity modulator, as shown in Figure A3. The beam splitter can be expressed as follows: The coherent state incidents the "in" port of the intensity modulator and exists from the "t" port. This model is equivalent to the vacuum state incidents the "u" port of the beam splitter, the coherent state incidents the "in" port and the combined beam exists from the "t" port.
The output at the "t" port is coherent state with √ 1 − rα amplitude. The reflectivity of the beam splitter satisfies r + t = 1. In this study, the modulation efficiency M of the intensity modulator was equal to the transmittance t of the beam splitter.

Appendix C
The MRR-QKD system is divided into the interrogator and MRR terminal, as shown in Figure A4. The interrogator generates an interrogation signal and sends it to the MRR terminal. This interrogation signal is a classical light pulse with fixed circular polarization state (does not carry any information), especially right-hand circular polarization in RM2018. The MRR terminal receives and modulates the interrogation signal and the output signal is in one of states in decoy state BB84 protocol. The modulated signal is retro-reflected back to the interrogator. The interrogator receives and measures the polarization state of the signal. Figure A4. Schematic of the MRR-QKD system in RM2018 [16].
The interrogation signal is prepared by means of the classical optical pulse with vertical polarization passes through a quarter wave plate oriented at 45 • . It is necessary to select appropriate signal intensity to ensure that each interrogation pulse contains multiple photons when it reaches the MRR terminal. The interrogation signal is modulated with four pairs of MQWs, which is composed of two stacked MQW. The number of MQWs is eight in total, achieving 15dB extinction ratio of each pair. Each polarization state in BB84 protocol is generated by a set of MQWs and retroreflector in a path respectively, corresponding to H/V(rectilinear basis) and +/−(diagonal basis). The signal in rectilinear basis is generated by the signal transmitted through the BS2; the signal in diagonal basis is generated by the signal reflected by the BS2. It is worth emphasizing that the interrogation signal with right-handed circular polarization is converted into left-handed circular polarization after passing through the half wave plate oriented at 22.5°. The modulated signal with H/V polarization is converted into +/− after passing through the half wave plate.
The transmission loss of each pair of MQWs is controlled independently to realize different states of MQWs. While the transmission loss of the MQWs modulator is set to the lowest (highest), the MQWs is in the "on" (off) state. Polarization modulation is achieved by changing the state of MQWs. For example, if the horizontal polarization(H) is selected, MQWs1 is set in low transmission loss allowing horizontal signal to pass. The other three MQWs are set in high transmission loss which blocks the transmission of signal with unwanted polarization(V/+/−). In this condition, only the horizontal polarization signal can transmit back to interrogator. The decoy state is realized by accurately controlling the transmission loss of MQWs1. Finally, interrogator receives retro-reflected signal and measures its polarization. The measurement process is the same as the traditional QKD based on BB84 [6].