Suppression of Fading Noise in Satellite-Mediated Continuous-Variable Quantum Key Distribution via Clusterization

: The satellite-mediated continuous-variable quantum key distribution (CV-QKD) protocol, which relies on off-the-shelf telecommunication components, has the potential for a global quantum communication network with all-day operation. However, the transmittance ﬂuctuation of satellite-mediated links leads to the arriving quantum state showing non-Gaussian property, introducing extra fading noise in security analysis and limiting the secret key rate of the protocol. Here, we consider the clusterization method for data post-processing to suppress the fading noise in both downlink and uplink scenarios, where the measurement data are divided into several clusters, and we perform security analysis separately. In particular, we set the optimal upper and lower bounds of each cluster in terms of the probability distribution of transmittance (PDT), while ﬁnding an optimal cluster number for the trade-off between fading noise and the composable ﬁnite-size effect. Numerical analysis shows that the proposed method can improve the composable ﬁnite-size rate when the fading noise is large enough, even with only two clusters. Moreover, a high-speed CV-QKD system with a higher frequency of signal preparation and detection can extend the proposed method to work in the case of lower fading noise.


Introduction
Over the past 40 years, considerable attention has been paid to quantum key distribution (QKD) for its ability to realize unconditional secure communication between two legal users over insecure channels [1]. To date, QKD has been well explored in both theory and experiments in fiber links, and the time is ripe to begin transitioning toward a global quantum communications network [2]. However, point-to-point QKD via optical fiber succeeds only within a limited distance due to huge fiber losses, and the no-cloning theorem [3] leads to the inability to perfectly clone a quantum state. One solution to this problem is the use of quantum repeaters for a global network [4]. These repeaters divide the transmission path into several segments, where errors and losses are corrected using entanglement swapping and entanglement purification. Unfortunately, the realization of mature quantum repeaters remains a challenge due to factors such as quantum memory technology, the limited brightness of entanglement sources, and technological restrictions associated with distillation protocols.
A promising solution with current technology is to build a satellite-mediated network, which connects widely separated ground stations using quantum satellites [5]. Although the quantum state suffers atmospheric attenuation, the feasibility of satellite-mediated QKD has been verified by several applications such as the Micius quantum satellite in

System Description
In this section, we describe the GMCS protocol over the satellite-mediated links based on its entanglement-based (EB) representation for the convenience of security analysis. Note that one usually uses the equivalent prepare-measure (PM) scheme instead of the EB scheme for the experimental setup because the PM scheme uses 'virtual' entanglement without requiring a real entangled state [29]. However, Eve is assumed to hold the purification of the system between Alice and Bob when one uses the EB scheme for security analysis. Therefore, the EB scheme is not convenient for security analysis with a trusted-loss or trusted-noise detector. In our manuscript, we assume an untrusted detector, where both the detector loss and setup noise are controlled by Eve. The security analysis with a trusted-loss or trusted-noise detector can be found in [30], which is based on the PM scheme. Moreover, the notation used for noise analysis is the equivalent number of thermal photons due to it being more appropriate for free-space channels compared to excess noise [30]. In addition, the wavelength of the protocol is set to λ = 800 nm. A higher frequency case, such as microwave frequency, exhibits higher loss and increased noise [30] and holds potential feasibility for short-range communication or inter-satellite communication, which are beyond the scope of this work. Figure 1a shows the EB scheme of the GMCS protocol. Alice first prepares an Einstein-Podolsky-Rosen (EPR) state as the entangled source, which can be characterized by its covariance matrix [31] where Z = diag(1, −1), I = diag(1, 1), and the signal variance µ = σ 2 x + 1, with a modulation variance of σ 2 x . Then, mode A of the EPR state is kept locally for heterodyne detection while another mode, B, is sent to Bob over the satellite-mediated (fading) link, which is characterized by the random transmittance η ch and the mean number of background thermal photonsn B . Note that Alice performing heterodyne detection on mode A will collapse mode B into a coherent state, which reveals the equivalence between the PM scheme and the EB scheme [29]. In terms of the Glauber-Sudarshan P function, the evolution of the quantum state in a fading link can be described by [32] where P (η ch ) is the PDT, and P in (α) and P out (α) are the P functions of the input state and output state, respectively. According to Equation (2), the evolution of the quantum state is characterized by the statistics P (η ch ). Therefore, we treat the fading link using the statistical mean as in [22], where the link is divided into K stable sub-links, with a constant transmittance {η j ch } j=1,...,K (0 ≤ η j ch ≤ 1) and corresponding probability {P j } j=1,...,K (note that Σ K j=1 P j = 1). Then, the arriving quantum state is a mixture of the results in each sub-link, weighted by corresponding probability, whose total covariance matrix is given by where τ = ∑ K j=1 P j τ j , andn is the total number of thermal photons due to the various sources of noise. Note that the above covariance matrix takes the detector efficiency η eff (considered constant) into account, i.e., τ j = η eff η j ch . Finally, Bob performs shot-noise limited homodyne detection (or heterodyne detection) on mode B 1 and shares secret keys with Alice through classical data post-processing (i.e., parameter estimation, error correction, and privacy amplification).
Next, we derive the asymptotic key rate of the protocol under Gaussian collective attacks. Here, we use reverse reconciliation (RR) in data post-processing, which is more robust against channel attenuation compared to direct reconciliation [26]. In terms of the Csiszar-Korner theorem, the asymptotic key rate under RR is given by [31,33] R asy τ , where β denotes the reconciliation efficiency, I AB is the Shannon mutual information between Alice and Bob, and χ BE represents the Holevo bound. The values of I AB and χ BE can be derived from the covariance matrix in Equation (3). Therefore, we first need to know the values of τ , √ τ , andn. In our manuscript, we use the model in [23] to describe the PDT of satellite-mediated links, which takes the diffraction, atmospheric extinction, turbulence, and pointing errors into account. Moreover,n is considered to originate from background light, i.e.,n = η effnB , while the setup noises on both Alice's and Bob's side are ignored (see [29] for a discussion of setup noise). Once we determine τ , √ τ , and n, the derivation of I AB and χ BE can be found (refer to [22]). Note that our manuscript considers Eve's active attack on the channel to establish a lower bound on the secret key rate. However, the satellite-mediated link can be treated as a line-of-sight (LOS) link, as Eve would find it hard to tamper with the middle channel between the ground station and the moving satellite, and would likely only conduct passive attacks. The LOS security is discussed in [30], where it is shown that LOS scenarios can achieve higher secret key rates than cases involving active attacks.  ...   Table 1. Here, we consider the nighttime situation with an atmospheric parameter of A 0 = 1.7 × 10 −14 m −2/3 and a windspeed of v = 21 m/s, which is commonly known as the H-V 5/7 model. Moreover,n B is set to 0.02 for both the downlink and uplink scenarios, as our focus is primarily on the effects caused by channel fading instead of background noise. In fact, the background noise shows a difference between the downlink and uplink scenarios due to variations in the source of background light [23]. We find that the downlink geometry is favorable for the CV-QKD task. This is because the optical beam in the downlink geometry starts to propagate in a vacuum until it enters the atmosphere, while the atmospheric influence appears in the early stages of beam transmission in the uplink geometry. Note that the layer around the Earth with a thickness of 20 km contains, on average, 95% of the total mass of the atmosphere [7]. Therefore, the downlink geometry is more favorable for optical signal transmission. However, the uplink geometry is important for a satellite-mediated network between ground stations because the ground station first generates the keys and needs to send them to a satellite via the uplink. In addition, the uplink geometry has the following advantages: the simple design of the satellite, variability of quantum light sources, and accessibility for maintenance or repair.

Improvement via Clusterization
In this section, we consider the clusterization method to improve the secret key rate of the satellite-mediated protocol by suppressing the fading noise. We first analyze the additional fading noise caused by transmittance fluctuation in both downlink and uplink scenarios. Then, a clusterization method is suggested to suppress the fading noise for improvement.

Fading Noise in Satellite-Mediated Protocol
From the form of Equation (3), γ AB 1 can be equivalently parameterized as originating from a stable link with fixed parameters, which can be rewritten as and effective noisen We find that the effect of transmittance fluctuation is the increase in thermal noise by the additional termn It is clear that the fading thermal noisen fad is related to the statistics Var Additionally, the fading noise will decrease if the signal variance µ is decreased. Figure 3 shows the distribution of fading noise,n fad , versus the satellite altitude h and the zenith angle θ. The simulation parameters are shown in Table 1. We find that the fading noise in the uplink is generally more significant than that in the downlink. A joint analysis of Figures 2 and 3 shows that the asymptotic key rate drops rapidly in the area wheren fad is on the rise. Therefore, we consider improving the secret key rate by suppressing the fading noise in the following. Note that the uplinkn fad in Figure 3b decreases in the area with higher satellite altitude and a larger zenith angle, where the atmospheric effects are more severe. This can be attributed to the further decrease in transmittance (near zero), leading to a more 'stable' channel.

Suppressing Fading Noise via Clusterization
As mentioned above, the fading noise,n fad , is related to the statistics Var √ τ . However, we cannot change the channel statistics but only the method of data post-processing. In a practical setting, the frequency of signal preparation and detection ν s (reached GHz in a recent study [34]) is much higher than the fluctuation frequency of the atmospheric channel ν f (usually ∼1 KHz [10]). In other words, for a small time window, each transmitted pulse can be considered as passing through a stable channel with constant transmittance. Therefore, we can divide the arrived N pulses into m individual packages based on time windows (i.e., each package has n = N/m pulses), and each package has no transmittance fluctuation. In detail, as shown in Figure 1b, by detecting the intensity of the multiplexing beacon, we can monitor the real-time transmittance and the total PDT as the reference for package division [10,35]. Then, we calculate the secret key rate of each package individually and the final result is their average. Since there is no transmittance fluctuation in each package, the fading noise is zero.
However, there is a negative impact of the individual package scheme when considering composable finite-size effects [36]. In a practical setting, users do not know all the parameters of the protocol, so they need to use part of the measurement data for parameter estimation. The asymptotic key rate in Figure 2 assumes that users can use the quantum communication channel an infinite number of times, thus having enough measurement data for perfect parameter estimation. This is impossible in a practical setting, where users can only use the quantum channel a finite number of times. Here, we assume that Alice knows the signal modulation µ, while Bob monitors the quantum efficiency η eff , thus only τ andn need to be estimated. In the composable finite-size regime, the secret key rate of an individual package can be expressed as [36] R i com = P ec r R asy τ i min ,n max − with the higher-order terms where i = 1, . . . , m is the label of an individual package, r is the proportion of measured data used for secret key generation, P ec is the success probability of error correction, d is digitalization, ε h is the hashing parameter, ε s is the smoothing parameter, and ε cor is the ε-correctness, which bounds the probability that Alice's and Bob's local strings are different after error correction and successful verification of their hashes. The estimated values τ i min andn i max are calculated using the maximum-likelihood estimators, which yield the results where w = √ 2erf −1 1 − 2ε pe with the failing probability of parameter estimation ε pe and inverse error function erf −1 , and the detector shot-noise v det = 1 (v det = 2) for homodyne (heterodyne) detectors. Finally, the total composable finite-size rate is the packages' average given by In our manuscript, we assume that ν s =1 GHz and ν f =1 KHz. During a run of 1 s, N = 10 9 pulses were transmitted between Alice and Bob, while the measurement data can be divided into m = 1/ν f = 1000 packages based on the time windows. Correspondingly, the size of each package is n = 10 6 . For the individual package scheme, the measurement data for parameter estimation in each package (r · n < 10 6 ) are significantly low, which introduces a composable finite-size effect.
Therefore, we consider the clusterization scheme to balance the trade-off between the fading noise and the composable finite-size effect. We divide all the individual packages into C groups (clusters), whereas the transmittance of the packages in the k-th cluster satisfies τ ∈ [τ k min , τ k max ]. Here, τ k min and τ k max are the upper and lower bounds of the k-th clusters, respectively. We determine the values of τ k min and τ k max according to the total PDT for an optimal division, where each group has an almost equal package number. Finally, we perform a security analysis for each cluster independently, and the final composable finite-size rate is their average, given by where P k denotes the probability of the package falling in the k-th cluster, and η k min and n k max are the estimators of effective parameters in the k-th cluster. In detail, the covariance matrix of the k-th cluster can be expressed as with the effective parameters Note that each cluster retains fading noise, as the packages within each cluster have relatively similar but not identical transmittance. Fortunately, the optimal clusterization based on the total PDT can control the composable finite-size effects within a suitable range while reducingn fad . Moreover, the cluster number cannot be too large, as the case of C = 1000 is equivalent to the individual package scheme with a heavy composable finite-size effect. The optimal cluster number is discussed in the following section.

Security Analysis in Composable Finite-Size Regime
In this section, we perform a security analysis in the composable finite-size regime. In the satellite-mediated scenario, we need to consider the effect of the instantaneous zenith angle between the moving satellite and the ground station. For a 1 GHz system, it takes 1 s to collect 10 9 data, whereas the satellite has moved a certain distance during this time. Therefore, the total 10 9 data are transferred through multiple links with different zenith angles. This leads to a problem in the theoretical analysis, as it is difficult to provide a formula describing the irregular PDT related to the instantaneous zenith angle, or equivalently, the flight time of the satellite. Note that the transmittance data in the theoretical analysis are generated using the Monte Carlo method in terms of the PDT formula. However, it is not a problem in a practical setting since we can obtain the irregular PDT using the measurement data of the beacon light. For the sake of simplicity, we divide the satellite orbit into several intervals based on the flight time of the satellite while using the PDT at the end time of each interval to investigate the whole interval. Moreover, we only consider the flight area where the zenith angle increases from zero to maximum, so the simulation results of the rate represent the lower bound of each interval. In our manuscript, we divide the orbit into steps of 60 s, and the relationship between the flight time and the instantaneous zenith angle is shown in Appendix A.

Without Clusterization
We first perform a security analysis without clusterization, i.e., C = 1. Figure 4 shows the composable finite-size rate R com with no clusterization versus the satellite altitude h and the zenith angle θ. The simulation parameters related to composable finite-size security are shown in Table 2. Here, we ignored the effect of the instantaneous zenith angle to show the gap between the composable finite-size rate and the asymptotic key rate through a joint analysis of Figures 2 and 4. The block size of each simulation point is set to N = 10 7 .

With Clusterization
In this subsection, we discuss the performance of the clusterization method. Figure 5 shows the composable finite-size rate R com with clusterization versus the cluster number, C, and the intervals. The satellite altitudes of the downlink and uplink scenarios are 300 km and 100 km, respectively. Figure 5a shows the rate of the downlink scenario versus the interval with various cluster numbers. Here, we also provide the corresponding asymptotic key rate for comparison, where C = 1 denotes the case without clusterization. We find that the clusterization method can improve the composable finite-size rate after the seventh interval, even with only two clusters. Moreover, the composable finite-size rates of C = 2 and C = 10 surpass the asymptotic key rate after the 12th and 11th intervals, respectively. This is because a bigger interval number means a larger zenith angle and thus a higher n fad (see Table 3), while the proposed clusterization method can suppress it. In other words, more cluster numbers lead to less fading noise. However, having more cluster numbers means a more serious composable finite-size effect. Take C = 10 as an example: the clusterization method damages the rate before the sixth interval, wheren fad is at a relatively low level. In these intervals, the added composable finite-size effect becomes the main effect, and the improvement caused by clusterization is overshadowed by this effect. When the fading noise is large enough, the rate of the clusterization method is consistently higher than that of no clusterization, as shown in Figure 5b and Table 3.  Table 3.  Figure 5c shows the downlink rate versus the cluster number at specific intervals. Here, we also provide the results of ν s = 10 GHz for comparison. In the 1 GHz case, we find that increasing the number of clusters reduces the rate in the fifth interval since its fading noise is relatively low. For the 10th interval, there is an optimal cluster number of C opt = 6. Beyond this number, the increase in clusters cannot further improve performance since the composable finite-size effect increases. However, the results show a difference when ν s increases from 1 GHz to 10 GHz. In the 10 GHz case, the composable finite-size effect is mitigated due to the total measurement data, or equivalently, the data for the parameter estimation of each interval, being increased. Correspondingly, increasing the cluster number improves the rate in the 10th interval, whereas the 5th interval has an optimal cluster number of C opt = 6. Figure 5d shows the uplink rate versus the cluster number. We find that the 10th interval cannot generate the secret key without the support of clusterization, even when ν s =10 GHz.

Conclusions
We have proposed a clusterization method to suppress fading noise in the satellitemediated GMCS protocol. In detail, the measurement data are divided into several clusters for separate security analysis, of which the data have relatively similar transmittance. The optimal upper and lower bounds of each cluster are based on the link's total PDT, whereas the optimal cluster number should balance the reduction in fading noise and increase the composable finite-size effect caused by the clusterization method. We found that the clusterization method can improve the composable finite-size rate when the fading noise is large enough, but may damage the performance by increasing the composable finite-size effect if the fading noise is at a relatively low level. Moreover, increasing the frequency of the signal preparation and detection of the system can suppress the composable finitesize effect, thereby allowing the proposed method to work effectively in a lower fading noise case.
Then, we can obtain the relationship between the flight time and the instantaneous zenith angle as Figure A1. Basic geometry for satellite-mediated quantum communications. R E : earth radius; G: ground station; S: quantum satellite; h: satellite altitude; O: Earth's center; θ: zenith angle.