Asymmetric Measurement-Device-Independent Quantum Key Distribution through Advantage Distillation

Abstract

Measurement-device-independent quantum key distribution (MDI-QKD) completely closes the security loopholes caused by the imperfection of devices at the detection terminal. Commonly, a symmetric MDI-QKD model is widely used in simulations and experiments. This scenario is far from a real quantum network, where the losses of channels connecting each user are quite different. To adapt such a feature, an asymmetric MDI-QKD model is proposed. How to improve the performance of asymmetric MDI-QKD also becomes an important research direction. In this work, an advantage distillation (AD) method is applied to further improve the performance of asymmetric MDI-QKD without changing the original system structure. Simulation results show that the AD method can improve the secret key rate and transmission distance, especially in the highly asymmetric cases. Therefore, this scheme will greatly promote the development of future MDI-QKD networks.

1. Introduction

Quantum key distribution (QKD) can unconditionally ensure the theoretical security of information transmission between two or more distant users with quantum mechanics. In the process of development from theory to practice, there are many challenges to realizing remote and secure quantum key distribution in the practical applications. With various theoretical ideas and experimental schemes being put forward, many challenges have been overcome. The BB84 protocol [1] proposed by Bennett realizes two-point communication and the Ekert91 and BBM92 protocols have been proposed successively [2,3]. Although QKD has been proven to have unconditional security in theory, imperfect devices can lead to some security loopholes that hinder the development of QKD protocols in practical applications. In practical applications, we often use weak coherent sources (WCSs) with multi-photon components, and Eve can eavesdrop with photon-number splitting (PNS) attacks [4]. Fortunately, the decoy-state method proposed [5,6] can solve PNS attacks and obtain rapid development both theoretically and experimentally [7,8,9]. Considering the imperfection of the detector, Lo firstly proposed the MDI-QKD protocol [10] which thoroughly solves the security loopholes mainly at the detection terminal. With the advantages of the MDI-QKD protocol, the MDI-QKD protocol attracts extensive attention and has been greatly studied in theory and experiments [11,12,13,14,15,16,17,18].

In previous work, the MDI-QKD was mainly studied in symmetric scenarios for simplicity. With the development of theory and technology, researchers have paid more attention to the asymmetric MDI-QKD protocol in recent years. To achieve good interference at the detection terminal, Lo proposed an asymmetric seven-intensity MDI-QKD [19], which can improve the performance of MDI-QKD in practical asymmetric structures based on the four-intensity MDI-QKD [11]. Consequently, asymmetric MDI-QKD is more suitable for the common QKD networks. However, due to its asymmetric nature, its performance is inferior to that of the original symmetric scheme. Improving the performance of asymmetric MDI-QKDs has become an urgent problem that needs to be addressed.

Inspired by the advantage distillation (AD) method [20,21,22,23], we study the principle of the method and find that the AD method can be successfully applied to the asymmetric seven-intensity MDI-QKD protocol. Compared with the original protocol, the performance of the asymmetric protocol has been significantly improved, which provides another theoretical verification that the post-processing AD method can improve the performance of the QKD protocol. This method can divide the original key string into blocks of only a few bits to achieve a high key correlation and greatly improve the protocol’s performance. The paper is organized as follows: In Section 2, we review the asymmetric seven-intensity MDI-QKD protocol and introduce the protocol with AD. The results of numerical simulations are shown in Section 3. Finally, summaries are given in Section 4.

2. Methods

2.1. Asymmetric MDI-QKD

Here, we mainly describe the process of the asymmetric seven-intensity MDI-QKD protocol, which develops from the four-intensity symmetric protocol, as follows:

(1).

State preparation. Alice (Bob) randomly prepares the signal state only in Z basis with $s_A$ ($s_B$), and prepares the decoy states only in X basis with intensities of $w_A$,$v_A$ ($w_B$,$v_B$), satisfying the formula $w_A$ < $v_A$ ($w_B$ < $v_B$). When preparing the vacuum state of intensity o, Alice (Bob) does not choose any base. The prepared states will be sent to Charlie to perform measurement;

(2).

Measurement. Charlie performs the Bell state measurement (BSM) after receiving the quantum states sent from Alice and Bob;

(3).

Announcement. After Alice and Bob repeat the above steps and enough counting events are recorded, Charlie publicly announces the BSM results. Subsequently, they announce the selected bases and intensities;

(4).

Parameter estimation. After finishing the quantum transmission phase, Alice and Bob can estimate the lower bound of single-photon yield $Y_{11}^{Z,L}$ and the upper bound of single-photon error rate (QBER) $e_{11}^{X,U}$ using the decoy-state technology;

(5).

Post-processing. Alice and Bob perform key reconciliation and privacy amplification on the raw key data to obtain the final secret key.

The decoupled bases are used in the asymmetric seven-intensity MDI-QKD protocol, thus the protocol can perform decoy states in the X basis only to estimate $Y_{11}^{X,L}$ and can use $Y_{11}^{Z,L}$ = $Y_{11}^{X,L}$ to obtain the single-photon yield in Z basis [11]. Then, the secret key rate can be calculated by the following formula [10,11,19]:

$$R=P_{s_A}{P}_{s_B}\left\{\left(s_A{e}^{-s_A}\right)\left(s_B{e}^{-s_B}\right)Y_{11}^{Z,L}[1-h\left(e_{11}^{X,U}\right)]-f_e{Q}_{s_A{s}_B}^{Z}h\left(E_{s_A{s}_B}^Z\right)\right\},$$

(1)

where $P_{s_A}$ and $P_{s_B}$ each correspond to the probability that Alice or Bob emits the signal states of $s_A$ or $s_B$, respectively. $Q_{s_A{s}_B}^Z$ and $E_{s_A{s}_B}^Z$ are the gain and QBER in the Z basis, $Y_{11}^{X,L}\left(e_{11}^{X,U}\right)$ is the lower (upper) bound of single-photon yield (QBER), which can be estimated from the decoy-state technology, $h\left(x\right)$ is the binary entropy function, and $f_e$ is the error correction efficiency.

Based on the asymmetric seven-intensity MDI-QKD protocol above, the performance can be further improved by optimization techniques such as joint estimations and collective constraints [11]. Referring to the joint estimations method, the common part $\mathbb{H}$ is extracted from the following two parameters $Y_{11}^{X,L}$, $e_{11}^{X,U}$ to optimize the key rate. $e_{11}^{Z,U}$ is used in the following subsection. $Y_{11}^{X,L}$ is a piecewise function where $P_{v_A}^1{P}_{w_A}^2{P}_{w_B}^1{P}_{v_B}^2$ < $P_{w_A}^1{P}_{v_A}^2{P}_{v_B}^1{P}_{w_B}^2$[19,24]. These parameters $Y_{11}^{X,L}$, $e_{11}^{X,U}$ and $e_{11}^{Z,U}$ can be estimated accurately by the decoy-state technology in the original MDI-QKD protocol [10,11]. The following formulas can estimate these parameters which lead to a much higher rate in distilling the secure final key:

$$\begin{array}{cc}\hfill & Y_{11}^{X,L}=Y_{11}^{X,e}=\frac{P_{v_A}^1{P}_{v_B}^2{Q}_{w_A{w}_B}+P_{w_A}^1{P}_{w_B}^2{P}_{v_A}^0{Q}_{o{w}_B}+P_{w_A}^1{P}_{w_B}^2{P}_{v_B}^0{Q}_{v_{A}o}}{P_{w_A}^1{P}_{v_A}^1(P_{w_B}^1{P}_{v_B}^2-P_{w_B}^2{P}_{v_B}^1)}\hfill \\ \hfill & -\frac{P_{w_A}^1{P}_{w_B}^2{Q}_{v_A{v}_B}+P_{w_A}^1{P}_{w_B}^2{P}_{v_A}^0{P}_{v_B}^0{Q}_{oo}}{P_{w_A}^1{P}_{v_A}^1(P_{w_B}^1{P}_{v_B}^2-P_{w_B}^2{P}_{v_B}^1)}-\frac{P_{v_A}^1{P}_{v_B}^2\mathbb{H}}{P_{w_A}^1{P}_{v_A}^1(P_{w_B}^1{P}_{v_B}^2-P_{w_B}^2{P}_{v_B}^1)},\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill & Y_{11}^{X,L}=Y_{11}^{X,f}=\frac{P_{v_B}^1{P}_{v_A}^2{Q}_{w_A{w}_B}+P_{w_B}^1{P}_{w_A}^2{P}_{v_A}^0{Q}_{o{w}_B}+P_{w_B}^1{P}_{w_A}^2{P}_{v_B}^0{Q}_{v_{A}o}}{P_{w_B}^1{P}_{v_B}^1(P_{w_A}^1{P}_{v_A}^2-P_{w_A}^2{P}_{v_A}^1)}\hfill \\ \hfill & -\frac{P_{w_B}^1{P}_{w_A}^2{Q}_{v_A{v}_B}+P_{w_B}^1{P}_{w_A}^2{P}_{v_A}^0{P}_{v_B}^0{Q}_{oo}}{P_{w_B}^1{P}_{v_B}^1(P_{w_A}^1{P}_{v_A}^2-P_{w_A}^2{P}_{v_A}^1)}-\frac{P_{v_B}^1{P}_{v_A}^2\mathbb{H}}{P_{w_B}^1{P}_{v_B}^1(P_{w_A}^1{P}_{v_A}^2-P_{w_A}^2{P}_{v_A}^1)},\hfill \end{array}$$

(3)

$$e_{11}^{X,U}=\frac{T_{w_A{w}_B}(1+\gamma \sqrt{1/\left(N_{x{w}_A{w}_B}{T}_{w_A{w}_B}\right)})-\mathbb{H}/2}{P_{w_A}^1{P}_{w_B}^1{Y}_{11}^{X,L}},$$

(4)

$$\begin{array}{c}\hfill e_{11}^{Z,U}=\frac{T_{s_A{s}_B}+P_{s_A}^0{P}_{s_B}^0{T}_{oo}-\left[P_{s_A}^0{T}_{o{s}_B}+P_{s_B}^0{T}_{s_{A}o}\right]}{P_{s_A}^1{P}_{s_B}^1{Y}_{11}^{Z,L}},\end{array}$$

(5)

$$\mathbb{H}=P_{w_A}^0{Q}_{o{w}_B}+P_{w_B}^0{Q}_{w_{A}o}-P_{w_A}^0{P}_{w_B}^0{Q}_{oo},$$

(6)

where $P_{l_A}^n\left(P_{l_B}^m\right)$ denotes the photon-number distribution of the source at Alice’s (Bob’s) side, $Q_{l_A{l}_B}$ and $T_{l_A{l}_B}$ are the gain and the total quantum bit errors [25], and $\mathbb{H}$ is the combination of the gain of the decoy state and the vacuum state. $\gamma$ is the standard error, and its value is set to 5.3 here. The expression for $Y_{11}^{X,L}$ is equal to $Y_{11}^{X,e}$ when $P_{v_A}^1{P}_{w_A}^2{P}_{w_B}^1{P}_{v_B}^2$ < $P_{w_A}^1{P}_{v_A}^2{P}_{v_B}^1{P}_{w_B}^2$, otherwise the expression equals $Y_{11}^{X,f}$[19,24]. Considering the effect of statistical fluctuations on multiple observations, the method of collective constraints can provide tighter constraint conditions between different sources ($s_A,w_A,v_A,s_B,w_B,v_B,o$) than independent bounds. Thus, these parameters $Y_{11}^{X,L},e_{11}^{Z,U},\mathbb{H}$ can be further optimized to achieve a higher key rate by the joint constraints method [8].

By the above formulas, we can calculate the final secret key rate of the asymmetric seven-intensity MDI-QKD protocol.

2.2. Asymmetric MDI-QKD with AD

Many previous works have demonstrated that the AD method can further improve the performance of QKD [20,21,22,23]. In this section, we improve the secure key rate and transmission distance of the asymmetric seven-intensity MDI-QKD protocol with the AD method. An additional AD method is performed between parameter estimation and post-processing step, and highly correlated bit pairs are discriminated from weakly correlated information. The security of AD method will be analyzed in an entanglement-based scheme. Alice prepares the quantum state $\frac{1}{\sqrt{2}}\left(\left|00\left.〉+\right|11\right.〉\right)$ and sends the second particle to Bob through the quantum channel. Since Eve controls the quantum channel by certain value ${\lambda }_i$ (i = 0, 1, 2, 3), the quantum state shared between Alice and Bob after transmission can be expressed by the following formula:

$$\begin{array}{c}{\sigma }_{AB}={\lambda }_0\left|{\varphi }_0\rangle \langle {\varphi }_0\right|+{\lambda }_1\left|{\varphi }_1\rangle \langle {\varphi }_1\right|+{\lambda }_2\left|{\varphi }_2\rangle \langle {\varphi }_2\right|+{\lambda }_3\left|{\varphi }_3\rangle \langle {\varphi }_3\right|,\end{array}$$

(7)

$$\begin{array}{c}|{\varphi }_0\rangle =\frac{1}{\sqrt{2}}\left(\left|00\left.〉+\right|11\right.〉\right),\\ |{\varphi }_1\rangle =\frac{1}{\sqrt{2}}\left(\left|00\left.〉-\right|11\right.〉\right),\\ |{\varphi }_2\rangle =\frac{1}{\sqrt{2}}\left(\left|01\left.〉+\right|10\right.〉\right),\\ |{\varphi }_3\rangle =\frac{1}{\sqrt{2}}\left(\left|01\left.〉-\right|10\right.〉\right),\end{array}$$

(8)

and ${\lambda }_0+{\lambda }_1+{\lambda }_2+{\lambda }_3=1$. For the quantum state ${\sigma }_{AB}$, the bit error rate of Alice and Bob’s measurements on different bases can be expressed as ${\lambda }_1+{\lambda }_3=e_1^x$ (four-state or six-state protocol), ${\lambda }_2+{\lambda }_3=e_1^z$ (four-state or six-state protocol), and ${\lambda }_1+{\lambda }_2=e_1^y$ (six-state protocol). Eve can steal information and reduce the key rate by choosing the certain value ${\lambda }_i$ and the secret key rate can be given by [20]:

$$\begin{array}{cc}\hfill R& \ge mi{n}_{{\lambda }_0,{\lambda }_1,{\lambda }_2,{\lambda }_3}[H\left(X\right|E)-H\left(X\right|Y)]\hfill \\ & =mi{n}_{{\lambda }_0,{\lambda }_1,{\lambda }_2,{\lambda }_3}[1-({\lambda }_0+{\lambda }_1)h\left(\frac{{\lambda }_0}{{\lambda }_0+{\lambda }_1}\right)-({\lambda }_2+{\lambda }_3)h\left(\frac{{\lambda }_2}{{\lambda }_2+{\lambda }_3}\right)-h({\lambda }_0+{\lambda }_1)].\hfill \end{array}$$

(9)

In the AD method, Alice and Bob divide their own raw bits into blocks $(x_1,\dots ,x_b)$ and $(y_1,\dots ,y_b)$ of size b. Then, choosing a random binary value c, Alice sends $(x_1\oplus c,\dots ,x_1\oplus c)$ to Bob. Bob compares this bitstring with their bitstring $(y_1,\dots ,y_b)$ and accepts the security of information only if the results are either all zeros or all ones in the block. In the two cases accepted, Alice (Bob) saves the first bit $x_1$$\left(y_1\right)$ of the initial string as the raw key. Thus, AD can discern highly correlated bitstring from weakly correlated information as the final raw key. Obviously, the successful probability of the AD method on a certain block of size b can be calculated by:

$$\begin{array}{c}\hfill P_{succ}={({\lambda }_0+{\lambda }_1)}^b+{({\lambda }_2+{\lambda }_3)}^b.\end{array}$$

(10)

After performing the AD step, the practical QBER value ${\lambda }_2+{\lambda }_3$ in the Z basis can be replaced by $\frac{({\lambda }_2+{\lambda }_3)}{P_{succ}}$, and the practical QBER in the X basis also can be recalculated. The quantum state shared between Alice and Bob can be replaced by:

$$\begin{array}{cc}\hfill & {\sigma }_{AB}={\overline{\lambda }}_0\left|{\varphi }_0\rangle \langle {\varphi }_0\right|+{\overline{\lambda }}_1\left|{\varphi }_1\rangle \langle {\varphi }_1\right|+{\overline{\lambda }}_2\left|{\varphi }_2\rangle \langle {\varphi }_2\right|+{\overline{\lambda }}_3\left|{\varphi }_3\rangle \langle {\varphi }_3\right|,\hfill \end{array}$$

(11)

$$\begin{array}{c}\hfill {\overline{\lambda }}_0=\frac{{({\lambda }_0+{\lambda }_1)}^b+{({\lambda }_0-{\lambda }_1)}^b}{2P_{succ}},\\ \hfill {\overline{\lambda }}_1=\frac{{({\lambda }_0+{\lambda }_1)}^b-{({\lambda }_0-{\lambda }_1)}^b}{2P_{succ}},\\ \hfill {\overline{\lambda }}_2=\frac{{({\lambda }_2+{\lambda }_3)}^b+{({\lambda }_2-{\lambda }_3)}^b}{2P_{succ}},\\ \hfill {\overline{\lambda }}_3=\frac{{({\lambda }_2+{\lambda }_3)}^b-{({\lambda }_2-{\lambda }_3)}^b}{2P_{succ}}.\end{array}$$

(12)

The QKD protocol enhanced by the AD method can achieve the secret key at rate [20]:

$$\begin{array}{c}R\ge ma{x}_b\frac{1}{b}{P}_{succ}mi{n}_{{\overline{\lambda }}_0,{\overline{\lambda }}_1,{\overline{\lambda }}_2,{\overline{\lambda }}_3}[1-({\overline{\lambda }}_0+{\overline{\lambda }}_1)h\left(\frac{{\overline{\lambda }}_0}{{\overline{\lambda }}_0+{\overline{\lambda }}_1}\right)-({\overline{\lambda }}_2+{\overline{\lambda }}_3)h\left(\frac{{\overline{\lambda }}_2}{{\overline{\lambda }}_2+{\overline{\lambda }}_3}\right)\hfill \\ -h({\overline{\lambda }}_0+{\overline{\lambda }}_1)].\hfill \end{array}$$

(13)

Based on the previous analysis, the AD method can be combined with the QKD protocol. It has been widely used in other protocols in previous works. Similarly, the AD method can be applied to further optimize the properties of quantum channels in the asymmetric MDI-QKD. When the AD method is combined with the asymmetric seven-intensity MDI-QKD protocol, the secret key rate can be estimated by the following formula:

$$\begin{array}{c}R\ge P_{s_A}{P}_{s_B}\frac{1}{b}{q}_{succ}{Q}_{s_A{s}_B}^Z\{{\left(\frac{P_{11}{Y}_{11}^{Z,L}}{Q_{s_A{s}_B}^Z}\right)}^b[1-({\overline{\lambda }}_0+{\overline{\lambda }}_1)h\left(\frac{{\overline{\lambda }}_0}{{\overline{\lambda }}_0+{\overline{\lambda }}_1}\right)-({\overline{\lambda }}_2+{\overline{\lambda }}_3)h\left(\frac{{\overline{\lambda }}_2}{{\overline{\lambda }}_2+{\overline{\lambda }}_3}\right)]\hfill \\ -f_{e}h\left({\overline{E}}_{s_A{s}_B}^Z\right)\},\hfill \end{array}$$

(14)

$$P_{11}=s_A{e}^{-s_A}{s}_B{e}^{-s_B},$$

(15)

$$\begin{array}{c}{q}_{succ}={\left(E_{s_A{s}_B}^Z\right)}^b+{(1-E_{s_A{s}_B}^Z)}^b,\end{array}$$

(16)

$$\begin{array}{c}{\overline{E}}_{s_A{s}_B}^Z=\frac{{\left(E_{s_A{s}_B}^Z\right)}^b}{{\left(E_{s_A{s}_B}^Z\right)}^b+{(1-\left(E_{s_A{s}_B}^Z\right))}^b},\end{array}$$

(17)

where $P_{11}$ is the probability of both Alice and Bob’s signal states emitting single-photon events, $q_{succ}$ is the successful probability of the AD method, ${\overline{E}}_{s_A{s}_B}^Z$ is the error rate value after the AD method, and $e_{11}^x$ and $e_{11}^z$ are the single-photon error rate in the X and Z bases, respectively. Note that $Y_{11}^{X,L}$, $e_{11}^x$, and $e_{11}^z$ can be estimated with the decoy-state method.

3. Results

In this work, we explore the combination of a QKD and a post-processing method. We adopt the asymmetric seven-intensity MDI-QKD protocol and the AD method, which can improve the performance of asymmetric MDI-QKD protocol greatly. In this section, numerical simulations of the asymmetric seven-intensity MDI-QKD protocol with AD method are given and the simulation parameters are shown in

Table 1. The basic system parameters used in our numerical simulations. ${\eta }_D$ and $Y_0$ are the efficiency and dark count rate of detectors at Charlie’s side; $e_d$: the misalignment error of the QKD system; $f_e$: the error correction efficiency; N: the number of pulse pairs Alice and Bob send.

${\mathit{e}}_{\mathit{d}}$	${\mathit{\eta }}_{\mathit{D}}$	${\mathit{Y}}_0$	${\mathit{f}}_{\mathit{e}}$	N
$0.5\%$	$65\%$	$8\times {10}^{-7}$	$1.16$	${10}^{11}$

. After analyzing the simulation results, we obtained the following significant research results.

We analyze the secret key rate of the asymmetric MDI-QKD protocol with and without the AD method, and the corresponding comparison results are shown in Figure 1 under different conditions $L_{asy}$ = 0 dB, 12 dB, 24 dB. The figure shows that the key rate with and without AD are consistent within a short distance. However, for example, the red line with $L_{asy}$ = 12 dB, the AD method has a clear advantage at a transmission loss of about 33 dB, and a final transmission loss reaching 39 dB as well as the secret key rate showing a clear improvement. For a more obvious exploration of the reason, we present Figure 2 with respect to b. We can observe that, in the above example, the value of b at about 33 dB has changed from 1 to 2, indicating that the AD method begins to work. With the increase of transmission loss, the AD method requires a larger b value to obtain a tight correlation from weak correlation. Furthermore, the results of the above case are similar to the other two cases ($L_{asy}$ = 0 dB, $L_{asy}$ = 24 dB). Therefore, the AD method can improve the key generation rate of asymmetric MDI-QKD over a long distance.

Additionally, we also further investigate the specific effects of the AD method on an asymmetric MDI-QKD under various values $L_{asy}$, and the results are shown in Figure 3. We describe the meaning of Figure 3 and give a detailed definition of the improved percentage. Generally, when the degree of asymmetry is large, the deterioration of the key rate becomes more obvious. However, after the AD method is used, it can be clearly seen in Figure 3 that the improvement effect of the AD method becomes more obvious with the increase of the degree of asymmetry. For example, the improved percentage can reach about 35% when the value $L_{asy}$ = 35 dB, which means that AD method can better solve some transmission performance bottlenecks of the entire network.

By the above analysis, the AD method indeed can increase the propagation distance when the number of pulse pairs $N={10}^{11}$. In order to further analyze the finite size effects, we give the simulation results in Figure 4 under different values of N when the value $L_{asy}$ = 12 dB. As can be seen from Figure 4, the AD method improves the performance of the asymmetric MDI-QKD protocol under various finite-size effects. Even though there is a large statistical fluctuation when the number of pulse pairs $N={10}^{10}$, the AD method can still tolerate transmission losses of more than 5 dB, which means that AD method can also be more adaptable with finite-size cases.

4. Conclusions

The AD method, a classical algorithm based on information theory, can be combined with QKD without changing the existing system structure. Specifically, the AD method can be combined with an asymmetric seven-intensity MDI-QKD to improve the robustness effectively, so as to distinguish and extract highly correlated bit pairs from the weakly correlated information as the final secret key. The AD method has a better performance for the asymmetric MDI-QKD protocol. The greater the degree of asymmetry, the better the improvement of the AD method. The AD method can also improve the performance of the asymmetric MDI-QKD protocol under various finite-size effects, and can be more adaptable with finite-size cases. Our work may play a role in measurement-device-independent networks.