Photon Subtraction-Induced Plug-and-Play Scheme for Enhancing Continuous-Variable Quantum Key Distribution with Discrete Modulation

Abstract

Establishing high-rate secure communications is a potential application of continuous-variable quantum key distribution (CVQKD) but still challenging for the long-distance transmission technology compatible with modern optical communication systems. Here, we propose a photon subtraction-induced plug-and-play scheme for enhancing CVQKD with discrete-modulation (DM), avoiding the traditional loopholes opened by the transmission of local oscillator. A photon subtraction operation is involved in the plug-and-play scheme for detection while resisting the extra untrusted source noise of the DM-CVQKD system. We analyze the relationship between secret key rate, channel losses, and untrusted source noise. The simulation result shows that the photon-subtracted scheme enhances the performance in terms of the maximal transmission distance and make up for the deficiency of the original system effectively. Furthermore, we demonstrate the influence of finite-size effect on the secret key rate which is close to the practical implementation.

1. Introduction

Quantum key distribution (QKD) [1,2,3] is a primary application of quantum cryptography, which enables two remote legitimate communication parties, Alice and Bob, to share random secret key sequences [4,5,6] in public channel preventing the eavesdropper Eve by physical laws [7,8,9,10]. There are two research fields for QKD, i.e., discrete-variable QKD(DVQKD) and continuous-variable QKD (CVQKD) [11,12,13,14]. In DVQKD, information is encoded on properties of single photon, and it uses single-photon detector at the receiver side. In CVQKD, information is encoded in two quadratures of the optical field [15,16], and relies on coherent detection including homodyne and heterodyne detectors [16,17,18].

In recent decades, CVQKD has become a hot issue due to its simplicity of implementation [19,20], compatibility with modern fiber networks [21] and high detection efficiency that can realize higher secret key rate in short distances [22]. Unfortunately, the reconciliation efficiency of Gaussian modulated CVQKD (GM-CVQKD), whose secret keys are modulated following Gaussian distribution, is sensitive to channel losses [23], so that this scheme is unsuitable in long distance situations. To solve this problem, CVQKD with discrete modulation (DM-CVQKD) has been proposed by A. Leverrier and P. Grangier [24]. In DM-CVQKD, such as four-state and eight-state modulation protocol, quantum states are nonorthogonal and information is represented by the sign of quadrature [25,26,27,28], which is Gaussian random value in GM-CVQKD [29]. The maximum transmission distance of DM-CVQKD is greater than that of GM-CVQKD, and its unconditional security against collective attack have been proved [25] under the condition of low modulation variance. Actually, most studies of DM-CVQKD focus on one-way schemes that a local oscillator (LO) will be sent together with signal pulses to simplify the detection [30,31]. However, the transfer of LO will open some loopholes for eavesdroppers. The loopholes can be exploited to conduct some attacks such as wavelength attacks, saturation attacks, and LO fluctuation attack [32,33,34].

An improved scheme called real local oscillator in which the LO is generated on the receiver’s side without transmitting through the quantum channel has been proposed [35,36,37,38]. In this scheme, the loopholes resulted by the transmission of LO are closed, but its performance would be poor because of the incidental frequency out-sync between two independent laser sources. Subsequently, plug-and-play (PP) dual-phase-modulated coherent-states (DPMCS) CVQKD have been proposed to solve the above-mentioned problems in experiments by Huang et al. [39] and Valivarthi et al. [40]. In the PP DPMCS scheme, LO is generated by Alice without transmitting through the quantum channel, whereas quantum state is modulated by Bob based on the classical light sent from the source of Alice [39]. Therefore, the loophole resulting from transmitting LO is closed, and the polarization drift of the fiber channel would be compensated automatically [41,42]. However, the transmission of the classical light from Alice to Bob still results in extra excess noise [43] that would reduce the maximum transmission distance. Moreover, the PP protocol suffers Trojan-horse attack [44,45] and the secure distance is limited by the Rayleigh scattering [46].

Fortunately, some non-Gaussian operations can be used for performance improvement of the CVQKD system because of the fact that this operation will strengthen the entanglement degree of the yielded system [47,48,49,50]. Motivated by the characteristics of photon subtraction (PS) operation, which is a mature technology in implementation, in this paper, we propose an approach for enhancing the PP DM-CVQKD protocol with photon subtraction implemented at Bob’s side. Compared with the original protocol, our scheme significantly improved system performance, and the deficiency of the original scheme is made up to a certain extent, which provides a greater reference value for the experiment and practical application. Moreover, in order to get closer to the practical case [51], we consider the finite-size effect on the secret key rate and the simulation result shows that the PS-based scheme has better performance in a finite-size scenario.

This paper is structured as follows. In Section 2, we suggest a PS-induced plug-and-play scheme for CVQKD with discrete modulation. In Section 3, numerical simulations demonstrate the performance improvement of the PS-induced CVQKD with with discrete modulation. Finally, we conclude this paper in Section 4.

2. Photon-Subtracted Plug-and-Play DM-CVQKD

2.1. Plug-and-Play DM-CVQKD Protocol

In the prepare-and-measure (PM) version of DM-CVQKD, Bob randomly chooses one of the coherent states ${\left\{\right|{\alpha }_k\rangle }_4=|\alpha e^{i(2k+1)\pi /4}\rangle ,k\in \{0,1,2,3\}\}$ [24] for four-state modulation or ${\left\{\right|{\alpha }_k\rangle }_8=|\alpha e^{ik\pi /4}\rangle ,k\in \{0,1,\cdots ,7\}\}$ [52] for eight-state modulation, as shown in Figure 1, with the modulation variance $V_M=2{\alpha }^2$ and sends it to Alice through an untrusted channel. To simplify the security proof, we choose the entanglement-based (EB) scheme which is equivalent to the PM scheme in security [53], and the detailed description of the PM version of PP CVQKD is shown in [39,40]. In the EB scheme of original DM-CVQKD, Bob prepares an entanglement state, namely Einstein–Podolsky–Rosen (EPR) state, ${\rho }_{A_{0}B}$ and sends one mode $A_0$ to Alice where another mode B is kept by Bob for measurement.

The EB scheme of PP DM-CVQKD is shown in Figure 2a and its steps are as follows.

• Fred prepares a EPR state ${\rho }_{A_{0}BF}$. Fred can be a neutral party; however, to derive the tight security bound, Fred is assumed to be controlled by Eve, that is to say, Fred would introduce the untrusted source noise. Notice that the state ${\rho }_{A_{0}BF}$ is utilized to simulate the coherent state with extra untrusted noise $\zeta$, which characterized by a phase insensitive amplifier (PIA) with a gain g in the PM scheme. Namely, the state ${\rho }_{A_{0}BF}$ is virtually a two-mode state [43] and the calculation method of two-mode entanglement state is still suitable. The quadratures $(X_B,P_B)$ and $(X_{A_0},P_{A_0})$ of Bob and Alice respectively can be expressed as

  $$\begin{array}{cc}\hfill \langle X_{A_0}^2\rangle & =\langle P_{A_0}^2\rangle =V+\zeta \hfill \\ \hfill \langle X_B^2\rangle & =\langle P_B^2\rangle =V,\hfill \end{array}$$

  (1)

  where $V=V_M+1$ ( with the shot noise variance 1) and $\zeta =g-1+(g-1)V_I$. Here, $V_I$ is the variance of vacuum noise.
• Alice sends the mode $A_0$ to Bob through an untrusted channel. We assume that Eve performs the collective Gaussian attack strategy, which is proved to be an optimal attack on reverse reconciliation protocols. The transmittance of the channel represented by T and the channel-added noise is ${\chi }_{line}$.
• Alice randomly measures one quadrature of the mode $A_1$ using homodyne detection or two quadratures with heterodyne detection, while Bob measures mode B with heterodyne detection. After that, Alice and Bob share two strings of correlated data as raw keys.
• Alice and Bob apply post-processing procedure, e.g., reverse reconciliation and privacy amplification to acquire secure secret key sequences.

2.2. Photon-Subtracted Plug-and-Play DM-CVQKD

In what follows, we suggest a PS-based PP DM-CVQKD scheme. As shown in Figure 2b, different from the above scheme, after the Step 1 in PP DM-CVQKD scheme, the mode $A_0$ would intersect with a vacuum state $C_0$ at beamsplitter with transmittance $\mu$. Afterwards, the state is split into two modes C and $A_1$. The yielded triparite state ${\rho }_{A_{1}BCF}$ can be expressed as

$$\begin{array}{c}\hfill {\rho }_{A_{1}BCF}=U_{BS}{\left[\right|\psi \rangle }_{FB{A}_0}{\langle \psi |}_{FB{A}_0}\otimes |0\rangle \langle 0\left|\right]U_{BS}^{†}.\end{array}$$

(2)

The positive operator-valued measurement (POVM) $\{{\widehat{\Pi }}_0,{\widehat{\Pi }}_1\}$ is applied to the photon number resolving detector (PNRD) so that the PNRD can be used to measure mode C [49]. The subtracted photon number m depends on ${\widehat{\Pi }}_1=|m\rangle \langle m|$ and the operation succeeds only when the POVM element ${\widehat{\Pi }}_1$ clicks. After the PS the state ${\rho }_{A_{1}BCF}^{{\widehat{\Pi }}_1}$ reads

$$\begin{array}{c}\hfill {\rho }_{A_{1}BCF}^{{\widehat{\Pi }}_1}=\frac{{\mathrm{tr}}_C\left({\widehat{\Pi }}_1{\rho }_{A_{1}BCF}\right)}{P_{\left(m\right)}^{{\widehat{\Pi }}_1}},\end{array}$$

(3)

where ${\mathrm{tr}}_X(·)$ represents the partial trace of the multi-mode state and $P_{\left(m\right)}^{{\widehat{\Pi }}_1}$ is the success probability of subtracting m photons, as shown in Appendix A. By applying the photon subtraction operation, the covariance matrix of state ${\rho }_{A_{1}BF}$ reads

$$\begin{array}{c}\hfill {\Gamma }_{A_{1}BF}=\left(\begin{array}{cc}{X}^{\prime }\mathbb{I}& Z_d^{\prime }{\sigma }_z\\ Z_d^{\prime }{\sigma }_z& Y^{\prime }\mathbb{I}\end{array}\right)\end{array}$$

(4)

where $X^{\prime }$, $Y^{\prime }$, and $Z_d^{\prime }$ are calculated in Appendix A. The subsequent quantum state transfer, detection, and post-processing procedure is the same as the PP DM-CVQKD scheme. After passing through the unsafe channel, the covariance matrix of state ${\rho }_{A_{2}BF}$ can be represented as

$$\begin{array}{cc}\hfill {\Gamma }_{A_{2}BF}& =\left(\begin{array}{cc}a\mathbb{I}& c{\sigma }_z\\ c{\sigma }_z& b\mathbb{I}\end{array}\right)\hfill \\ \hfill & =\left(\begin{array}{cc}{X}^{\prime }\mathbb{I}& \sqrt{T}{Z}_d^{\prime }{\sigma }_z\\ \sqrt{T}{Z}_d^{\prime }{\sigma }_z& T(Y^{\prime }+{\chi }_{line}+\zeta )\mathbb{I}\end{array}\right),\hfill \end{array}$$

(5)

where ${\chi }_{line}=1/T-1+\epsilon$, and $\epsilon$ represents the excess noise of channel.

We can derive from [54] that, after photon subtraction operation with a given $V_M$, the $Z_d^{\prime }$ of the two-mode squeezed vacuum (TMSV) state is the same for four-state and eight-state modulation. Namely, the four-state and eight-state modulation protocols demonstrate the similar performance after photon subtraction, so that we take the four-state modulation protocol into account without loss of generality while performing the PS-based PP scheme in the DM-CVQKD. Notice that, after the PS operation, the entanglement degree of the coherent state is strengthened [13].

Finally, the asymptotic secret key rate of reverse reconciliation against collective attacks can be calculated as

$$\begin{array}{c}\hfill K_{asym}=P_{\left(m\right)}^{{\widehat{\Pi }}_1}[\beta (I(A:B)-S(E:A)],\end{array}$$

(6)

where $\beta$ is the reconciliation efficiency, $S(E:A)$ is the Holevo bound of the mutual information between Eve and Alice, and $I(A:B)$ is the Shannon mutual information between Alice and Bob following the photon subtraction.

3. Security Analysis

The transmittance $\mu$ of the photon subtraction beamsplitter may have an influence on the success probability of subtracting m photons which plays a significant role in the security analysis. As shown in Figure 3, the success probability is reduced as the increasing photon-subtracted number m. Note that, although $P_{\left(m\right)}^{{\widehat{\Pi }}_1}$ is highest when $\mu =0$, all the signals received by PNRD are reflected from quantum state $A_0$ through a beamsplitter and state $A_0$ cannot be sent to Alice, which means that the scheme cannot work. Figure 4 shows the secret key rate as a function of channel losses. We find that the PS-based PP scheme demonstrates better performance in the case of high channel losses but worse in low channel losses range because of the low success rate of photon subtraction operation. The 1-photon subtraction (1-PS) scenario is best-performing; in other words, more channel losses can be tolerated for $m=1$ compared with that of number $m>1$. Moreover, we can also perceive that the source noise evaluated by g (dash line in Figure 4 where $g=1.005$) will reduce the secret key rate as well as have an influence on the tolerance of channel losses.

Figure 5 shows the secret key rate of the plug-and-play DM-CVQKD as a function of channel losses for the tunable g. Figure 5a,b are the four-state and eight-state PP DM-CVQKD protocols, respectively. Figure 5c,d are the protocols with 1-PS and 2-PS operations, respectively. The insecure area shown in the chart signifies that the secret key rate is zero or negative, which means that Alice and Bob cannot acquire the secret key sequence. Compared with the four-state PP DM-CVQKD, the eight-state PP DM-CVQKD could tolerate more untrusted source noise for the same channel losses. Furthermore, after applying 1-PS operation, the four-state PP DM-CVQKD could demonstrate the longer transmission distance for the same value of g, whereas it tolerates more untrusted source noise at the same channel losses owing to the enhancement of entanglement degree.

In the asymptotic case, the number of communication signals is deemed to be infinite [55]; in other words, the channel is totally known. In practice, it is impossible for the number of exchanged signals to be infinite so we have to take the finite-size effect into account. Figure 6 shows the secret key rate as a function of channel losses in the finite-size scenario. Figure 6a,b are the four-state and eight-state DM-CVQKD, respectively, while Figure 6c,d correspond to the schemes involved the 1-PS and 2-PS operations, respectively. We find that the secret key rate of DM-CVQKD in a finite-size scenario is lower than that of the asymptotic case whether it performs the PS operation or not. The finite-size secret key rate is closer to the asymptotic case with the increasing block size N of transmitted photons due to the fact that more signals could be utilized for parameter estimation and the quantum channel would be closer to being entirely known. Generally, the channel characters will not be estimated perfectly because of the finitude of signals so we need to consider the worst case. The analysis of finite-size effect and the calculation of the secret key rate of the PS-based PP DM-CVQKD system for the finite-size scenario is shown in Appendix B.

4. Conclusions

We have proposed a PS-based PP scheme for performance improvement of the DM-CVKQD system by using PS operation on Bob’s side. The proposed scheme can tolerate more channel losses compared with the original scheme so that it extends the maximal transmission distances. The secret key rate of the eight-state PP DM-CVQKD system is slightly higher than that of the four-state system for the same parameters in numerical simulation. We demonstrate the relation between secret key rate, channel losses and untrusted source noise (characterized by g), and find that the PS-based scheme can tolerate more untrusted source noise. In addition, we take the finite-size effect into account and show its influence on the secret key rate with the tunable numbers of subtracted photons and exchanged signals. This research provides a feasible method to improve the performance of PP CVQKD, which has a certain reference value for experiment and application.