Photon Subtraction-Induced Plug-and-Play Scheme for Enhancing Continuous-Variable Quantum Key Distribution with Discrete Modulation

Establishing high-rate secure communications is a potential application of continuous-variable quantum key distribution (CVQKD) but still challenging for the long-distance transmission technology compatible with modern optical communication systems. Here, we propose a photon subtraction-induced plug-and-play scheme for enhancing CVQKD with discrete-modulation (DM), avoiding the traditional loopholes opened by the transmission of local oscillator. A photon subtraction operation is involved in the plug-and-play scheme for detection while resisting the extra untrusted source noise of the DM-CVQKD system. We analyze the relationship between secret key rate, channel losses, and untrusted source noise. The simulation result shows that the photon-subtracted scheme enhances the performance in terms of the maximal transmission distance and make up for the deficiency of the original system effectively. Furthermore, we demonstrate the influence of finite-size effect on the secret key rate which is close to the practical implementation.

In recent decades, CVQKD has become a hot issue due to its simplicity of implementation [19,20], compatibility with modern fiber networks [21] and high detection efficiency that can realize higher secret key rate in short distances [22]. Unfortunately, the reconciliation efficiency of Gaussian modulated CVQKD (GM-CVQKD), whose secret keys are modulated following Gaussian distribution, is sensitive to channel losses [23], so that this scheme is unsuitable in long distance situations. To solve this problem, CVQKD with discrete modulation (DM-CVQKD) has been proposed by A. Leverrier and P. Grangier [24]. In DM-CVQKD, such as four-state and eight-state modulation protocol, quantum states are nonorthogonal and information is represented by the sign of quadrature [25][26][27][28], which is

Plug-and-Play DM-CVQKD Protocol
In the prepare-and-measure (PM) version of DM-CVQKD, Bob randomly chooses one of the coherent states {|α k 4 = |αe i(2k+1)π/4 , k ∈ {0, 1, 2, 3}} [24] for four-state modulation or {|α k 8 = |αe ikπ/4 , k ∈ {0, 1, · · · , 7}} [52] for eight-state modulation, as shown in Figure 1, with the modulation variance V M = 2α 2 and sends it to Alice through an untrusted channel. To simplify the security proof, we choose the entanglement-based (EB) scheme which is equivalent to the PM scheme in security [53], and the detailed description of the PM version of PP CVQKD is shown in [39,40]. In the EB scheme of original DM-CVQKD, Bob prepares an entanglement state, namely Einstein-Podolsky-Rosen (EPR) state, ρ A 0 B and sends one mode A 0 to Alice where another mode B is kept by Bob for measurement. The EB scheme of PP DM-CVQKD is shown in Figure 2a and its steps are as follows.
(a) (b) Figure 2. (a) the EB scheme of PP DM-CVQKD protocol. Here, Fred is assumed to controlled by Eve, and he will introduce an untrusted source noise; (b) the corresponding PS-based PP DM-CVQKD scheme. PNRD, photon number resolving detector.

1.
Fred prepares a EPR state ρ A 0 BF . Fred can be a neutral party; however, to derive the tight security bound, Fred is assumed to be controlled by Eve, that is to say, Fred would introduce the untrusted source noise. Notice that the state ρ A 0 BF is utilized to simulate the coherent state with extra untrusted noise ζ, which characterized by a phase insensitive amplifier (PIA) with a gain g in the PM scheme. Namely, the state ρ A 0 BF is virtually a two-mode state [43] and the calculation method of two-mode entanglement state is still suitable. The quadratures (X B , P B ) and (X A 0 , P A 0 ) of Bob and Alice respectively can be expressed as where V = V M + 1 ( with the shot noise variance 1) and ζ = g − 1 + (g − 1)V I . Here, V I is the variance of vacuum noise.

2.
Alice sends the mode A 0 to Bob through an untrusted channel. We assume that Eve performs the collective Gaussian attack strategy, which is proved to be an optimal attack on reverse reconciliation protocols. The transmittance of the channel represented by T and the channel-added noise is χ line .

3.
Alice randomly measures one quadrature of the mode A 1 using homodyne detection or two quadratures with heterodyne detection, while Bob measures mode B with heterodyne detection. After that, Alice and Bob share two strings of correlated data as raw keys.

4.
Alice and Bob apply post-processing procedure, e.g., reverse reconciliation and privacy amplification to acquire secure secret key sequences.

Photon-Subtracted Plug-and-Play DM-CVQKD
In what follows, we suggest a PS-based PP DM-CVQKD scheme. As shown in Figure 2b, different from the above scheme, after the Step 1 in PP DM-CVQKD scheme, the mode A 0 would intersect with a vacuum state C 0 at beamsplitter with transmittance µ. Afterwards, the state is split into two modes C and A 1 . The yielded triparite state ρ A 1 BCF can be expressed as The positive operator-valued measurement (POVM) {Π 0 ,Π 1 } is applied to the photon number resolving detector (PNRD) so that the PNRD can be used to measure mode C [49]. The subtracted photon number m depends onΠ 1 = |m m| and the operation succeeds only when the POVM element Π 1 clicks. After the PS the state ρΠ 1 A 1 BCF reads where tr X (·) represents the partial trace of the multi-mode state and PΠ 1 (m) is the success probability of subtracting m photons, as shown in Appendix A. By applying the photon subtraction operation, the covariance matrix of state ρ A 1 BF reads where X , Y , and Z d are calculated in Appendix A. The subsequent quantum state transfer, detection, and post-processing procedure is the same as the PP DM-CVQKD scheme. After passing through the unsafe channel, the covariance matrix of state ρ A 2 BF can be represented as where χ line = 1/T − 1 + ε, and ε represents the excess noise of channel. We can derive from [54] that, after photon subtraction operation with a given V M , the Z d of the two-mode squeezed vacuum (TMSV) state is the same for four-state and eight-state modulation. Namely, the four-state and eight-state modulation protocols demonstrate the similar performance after photon subtraction, so that we take the four-state modulation protocol into account without loss of generality while performing the PS-based PP scheme in the DM-CVQKD. Notice that, after the PS operation, the entanglement degree of the coherent state is strengthened [13].
Finally, the asymptotic secret key rate of reverse reconciliation against collective attacks can be calculated as where β is the reconciliation efficiency, S(E : A) is the Holevo bound of the mutual information between Eve and Alice, and I(A : B) is the Shannon mutual information between Alice and Bob following the photon subtraction.

Security Analysis
The transmittance µ of the photon subtraction beamsplitter may have an influence on the success probability of subtracting m photons which plays a significant role in the security analysis. As shown in Figure 3, the success probability is reduced as the increasing photon-subtracted number m. Note that, although PΠ 1 (m) is highest when µ = 0, all the signals received by PNRD are reflected from quantum state A 0 through a beamsplitter and state A 0 cannot be sent to Alice, which means that the scheme cannot work. Figure 4 shows the secret key rate as a function of channel losses. We find that the PS-based PP scheme demonstrates better performance in the case of high channel losses but worse in low channel losses range because of the low success rate of photon subtraction operation. The 1-photon subtraction (1-PS) scenario is best-performing; in other words, more channel losses can be tolerated for m = 1 compared with that of number m > 1. Moreover, we can also perceive that the source noise evaluated by g (dash line in Figure 4 where g = 1.005) will reduce the secret key rate as well as have an influence on the tolerance of channel losses.     Figure 5 shows the secret key rate of the plug-and-play DM-CVQKD as a function of channel losses for the tunable g. Figure 5a,b are the four-state and eight-state PP DM-CVQKD protocols, respectively. Figure 5c,d are the protocols with 1-PS and 2-PS operations, respectively. The insecure area shown in the chart signifies that the secret key rate is zero or negative, which means that Alice and Bob cannot acquire the secret key sequence. Compared with the four-state PP DM-CVQKD, the eight-state PP DM-CVQKD could tolerate more untrusted source noise for the same channel losses. Furthermore, after applying 1-PS operation, the four-state PP DM-CVQKD could demonstrate the longer transmission distance for the same value of g, whereas it tolerates more untrusted source noise at the same channel losses owing to the enhancement of entanglement degree.
In the asymptotic case, the number of communication signals is deemed to be infinite [55]; in other words, the channel is totally known. In practice, it is impossible for the number of exchanged signals to be infinite so we have to take the finite-size effect into account. Figure 6 shows the secret key rate as a function of channel losses in the finite-size scenario. Figure 6a,b are the four-state and eight-state DM-CVQKD, respectively, while Figure 6c,d correspond to the schemes involved the 1-PS and 2-PS operations, respectively. We find that the secret key rate of DM-CVQKD in a finite-size scenario is lower than that of the asymptotic case whether it performs the PS operation or not. The finite-size secret key rate is closer to the asymptotic case with the increasing block size N of transmitted photons due to the fact that more signals could be utilized for parameter estimation and the quantum channel would be closer to being entirely known. Generally, the channel characters will not be estimated perfectly because of the finitude of signals so we need to consider the worst case. The analysis of finite-size effect and the calculation of the secret key rate of the PS-based PP DM-CVQKD system for the finite-size scenario is shown in Appendix B.

Conclusions
We have proposed a PS-based PP scheme for performance improvement of the DM-CVKQD system by using PS operation on Bob's side. The proposed scheme can tolerate more channel losses compared with the original scheme so that it extends the maximal transmission distances. The secret key rate of the eight-state PP DM-CVQKD system is slightly higher than that of the four-state system for the same parameters in numerical simulation. We demonstrate the relation between secret key rate, channel losses and untrusted source noise (characterized by g), and find that the PS-based scheme can tolerate more untrusted source noise. In addition, we take the finite-size effect into account and show its influence on the secret key rate with the tunable numbers of subtracted photons and exchanged signals. This research provides a feasible method to improve the performance of PP CVQKD, which has a certain reference value for experiment and application.

Conflicts of Interest:
The authors declare no conflict of interest.

Abbreviations
The following abbreviations are used in this manuscript:

Appendix A. Derivation of the Asymptotic Secret Key Rate
In this section, we consider the characteristics of the transmitted states in the PS-based PP DM-CVQKD scheme and derive the asymptotic secret key rate of it. Here, we take the asymptotic secret key rate of the four-state PP DM-CVQKD protocol into account without loss of generality. We assume that Bob and Alice perform heterodyne detection and homodyne detection, respectively.
In the EB scheme of original DM-CVQKD, Bob prepares a two-mode entangled state |ψ A 0 B given by where d = 4 for four-state protocol and d = 8 for eight-state protocol with and In four-state protocol, λ r can be calculated as whereas, in eight-state protocol, it can be expressed as The covariance matrix Γ A 0 B of state |ψ A 0 B can be expressed as where I = diag(1, 1), σ z = diag(1, −1) and Here, a, a † , and b, b † are the annihilation and creation operators, respectively, on Alice's and Bob's mode. The success probability of subtracting m photons PΠ 1 (m) can be calculated as where C m n is a combination number (n ≥ m) and ξ = V−1 V+1 . After the m-photon subtraction operation, the covariance matrix Γ A 1 BF is given in Equation (4), and the parameters are given by (A9) The mutual information I(A : B) can be expreseed as with V B = (a + 1)/2, V A = b and V B|A = V B − TZ 2 d /2V A . Meanwhile, the Holevo bound S(E : A) can be calculated as where G(x) is the Von Neumann entropy that is given by and γ 1,2,3 are the symplectic eigenvalues derived from covariance matrices calculated by with and Combining with Equation (6), we can obtain the asymptotic secret key rate.

Appendix B. Derivation of Finite-Size Secret Key Rate
We assume that the detection methods of Alice and Bob are the same as the asymptotic case and the photon subtraction operation is performed on Bob's side. In this scenario, N is the number of entire transmitted signals and n is the number of signals used for secret key extraction. The rest of the signals s ≡ N − n are utilized for estimating the parameters of insecure channels that can be implemented by sampling of s couples of correlated variables (x i , y i ) i=1,2,··· ,s . The finite-size secret key rate can be expressed as where β, I(A : B) and PΠ 1 (m) are defined the same as above, and PE is the failure probability of parameter estimation and ∆(n) is in connection with privacy amplification that is given by ∆(n) = (2 dim H B + 3) log 2 (2/ ) n + 2 n log 2 (1/ PB ).
Here, the parameter PB denotes the failure probability of privacy amplification and demonstrates the smoothing parameter. The symbol H B represents the Hilbert space corresponding to Alice's raw key which usually employs binary encoding so we set H B = 2. Because of the unknown channel, we have to estimate some arguments to derive S PE which would minimize the secret key rate. The s couples of samples can be related as where t = √ T ∈ R and z follow a centered normal distribution with variance σ 2 = 1 + T(ε − 3). Moreover, we can find the covariance matrix Γ PE that minimizes the secret key rate with a probability of at least 1-PE that is given by where t min and σ 2 max are the minimized t and maximized σ 2 of the samples, respectively. For this normal linear model, the maximum-likelihood estimatorst andσ 2 can be expressed aŝ Futhermore,t andθ 2 follow the distribution that where t and σ 2 are the authentic values of the parameters. Therefore, t min and σ max can be calculated as where z PE /2 satisfies 1 − erf(z PE /2 / √ 2) = PE /2 and erf is the error function given by The value of the above-mentioned error probabilities can be assigned as