Method and system for quantum key distribution

Abstract

The invention relates to a method and system for quantum key distribution. An encoding method for quantum key distribution, the method being performed in a transmitter device (11) having a classical processor (11a) and means for preparing and transmitting quantum signals, the method comprising: generating an encoder initial bit sequence; according to the encoder initial bit sequence, generating a quantum signal comprising a plurality of optical pulses, generating each of the plurality of optical pulses includes at least one of: modulating an intensity profile of the optical pulse according to an intensity function of a first encoder value dependent on time and dependent on at least one first bit of the encoder initial bit sequence; and modulating a phase curve of the optical pulse according to a phase function dependent on time and a second encoder value of at least one second bit of the encoder initial bit sequence; transmitting a plurality of optical pulses to the receiver device (12) via the quantum channel (10a); and determining a shared key shared between the transmitter device (11) and the receiver device (12) according to the encoder initial bit sequence by at least one of classic post-processing and transmitting classic information to the receiver device (12) and receiving another classic information from the receiver device (12). Further, a decoding method, a method, a transmitting device (11), a receiver device (12) and a system are disclosed.

Description

Technical Field

[0001] The present disclosure relates to methods and systems for quantum key distribution, particularly techniques for encoding classical information into quantum signals and decoding classical information from quantum signals. Background Art

[0002] Typical quantum key distribution (QKD) protocols include two main phases: quantum communication and classical post-processing. In principle, a random bit sequence is generated in a transmitter device ("Alice"), the random bit sequence is encoded into a quantum state and sent via a quantum channel to a receiver device ("Bob"). Encoding typically includes generating coherent states (e.g., by lasers) and applying optical elements such as phase shifters, attenuators, or beam splitters. The emitted state is measured in the receiver device, and then classical post-processing is performed to establish a shared key.

[0003] In a practical optical QKD setup, the following methods can be used to encode classical information into a physical system:

[0004] - Polarization encoding (e.g., BB84 protocol): Different logical bits are converted into different polarizations of single-photon or multi-photon signals / optical pulses,

[0005] - Phase encoding (e.g., DPS QKD): Different logical bits are converted into different phases of single-photon or multi-photon signals,

[0006] - Intensity encoding (e.g., B92 using coherent states): Different logical bits are converted into different intensities of optical pulses, or

[0007] - Time encoding (e.g., COW protocol): Information is encoded in the time positions of optical pulses.

[0008] UK Patent Application GB 2 529 228 A relates to an interference method for a quantum communication system. Reference is made to time-varying gain modulation consisting of arbitrary pulse shapes. However, the encoding of classical information is performed by setting the phase for the entire carrier bit signal using the conventional BB84 method.

[0009] US Patent US10 153 848 B2 relates to a transmitter for a continuous-variable quantum communication system. A sequence of optical pulses is created such that subsequent optical pulses have different phases or intensities from each other.

[0010] Chinese Patent Application CN 110 620 655 A discloses intensity modulation of optical pulses and subsequent phase modulation in the context of quantum key distribution. Intensity modulation (of the entire pulse) is performed to create decoy states. An optical intensity modulator is described in CN 205 961 140 U, which acts on an optical signal either before encoding or after phase encoding. The intensity is independent of the encoding but related to the decoy state. SUMMARY OF THE INVENTION

[0011] The object of the present disclosure is to provide improved techniques for encoding classical information into quantum signals and decoding classical information from quantum signals in quantum key distribution.

[0012] To solve this problem, an encoding method, a decoding method, a method for quantum key distribution, a transmitter device, a receiver device, and a system for quantum key distribution are provided according to the independent claims. Further embodiments are disclosed in the dependent claims.

[0013] According to one aspect of the present invention, there is provided an encoding method for quantum key distribution, which is executed in a transmitter device having a classical processor and a device for preparing and transmitting quantum signals. The method includes:

[0014] - Generating an encoder initial bit sequence;

[0015] - Generating a quantum signal including a plurality of optical pulses according to the encoder initial bit sequence, wherein generating each of the plurality of optical pulses includes at least one of the following:

[0016] - Modulating the intensity profile of the optical pulse according to an intensity function of at least one first bit that depends on time and on the encoder initial bit sequence; and

[0017] - Modulating the phase profile of the optical pulse according to a phase function of at least one second bit that depends on time and on the encoder initial bit sequence;

[0018] - Transmitting the plurality of optical pulses via a quantum channel to a receiver device; and

[0019] - Determining a shared key shared between the transmitter device and the receiver device (12) according to the encoder initial bit sequence by at least one of classical post-processing, transmitting classical information to the receiver device, and receiving another classical information from the receiver device.

[0020] According to another aspect, there is provided a decoding method for quantum key distribution, which is executed in a receiver device having a classical processor and a device for receiving and measuring quantum signals, and the method includes:

[0021] - Receiving, via a quantum channel, a quantum signal including a plurality of optical pulses from a transmitter device;

[0022] - Determining a decoder initial bit sequence from the plurality of optical pulses, and the determination includes performing at least one of the following for each optical pulse:

[0023] - Determining an approximate intensity curve of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining a first decoder value of at least one first bit of the decoder initial bit sequence according to the approximate intensity curve, and

[0024] - Determining an approximate phase curve of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determining a second decoder value of at least one second bit of the decoder initial bit sequence according to the approximate phase curve; and

[0025] - Determining a shared key shared between the transmitter device and the receiver device according to the decoder initial bit sequence by at least one of classical post-processing, receiving classical information from the transmitter device, and transmitting another classical information to the transmitter device.

[0026] According to another aspect, there is provided a method for quantum key distribution, which is implemented in a system including a transmitter device having a classical processor and a device for preparing and transmitting quantum signals and a receiver device having another classical processor and a device for receiving and measuring quantum signals. The method includes:

[0027] - Generating an encoder initial bit sequence in the transmitter device;

[0028] - In the transmitter device, generating a quantum signal including a plurality of optical pulses according to the encoder initial bit sequence, wherein generating each optical pulse of the plurality of optical pulses includes at least one of the following:

[0029] - Modulating an intensity curve of the optical pulse according to an intensity function depending on time and a first encoder value of at least one first bit depending on the encoder initial bit sequence, and

[0030] - Modulating a phase curve of the optical pulse according to a phase function depending on time and a second encoder value of at least one second bit depending on the encoder initial bit sequence;

[0031] - Transmitting the plurality of optical pulses from the transmitter device to the receiver device via a quantum channel and receiving the plurality of optical pulses at the receiver device;

[0032] - Determining a decoder initial bit sequence from the plurality of optical pulses, the determining including performing at least one of the following for each optical pulse:

[0033] - Determining an approximate intensity curve of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins and determining a first decoder value of at least one first bit of the decoder initial bit sequence according to the approximate intensity curve; and

[0034] - Determining an approximate phase curve of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins and determining a second decoder value of at least one second bit of the decoder initial bit sequence according to the approximate phase curve; and

[0035] - Determining a shared secret key shared between the transmitter device and the receiver device in the transmitter device according to the encoder initial bit sequence and in the receiver device according to the decoder initial bit sequence by at least one of classical post-processing, transmitting classical information from the transmitter device to the receiver device, and transmitting another classical information from the receiver device to the transmitter device.

[0036] According to another aspect, there is provided a transmitter device for quantum key distribution, the transmitter device including a classical processor and means for preparing and transmitting a quantum signal, and being configured to perform the following steps:

[0037] - Generating an encoder initial bit sequence;

[0038] - Generating a quantum signal including a plurality of optical pulses according to the encoder initial bit sequence, wherein generating each optical pulse of the plurality of optical pulses includes at least one of the following:

[0039] - Modulating an intensity curve of the optical pulse according to an intensity function depending on time and a first encoder value of at least one first bit depending on the encoder initial bit sequence, and

[0040] - Modulating a phase curve of the optical pulse according to a phase function depending on time and a second encoder value of at least one second bit depending on the encoder initial bit sequence,

[0041] - Transmitting the plurality of optical pulses to a receiver device via a quantum channel; and

[0042] - Determine a shared key shared between the transmitter device and the receiver device according to the initial bit sequence of the encoder by means of classical post-processing and at least one of transmitting classical information to the receiver device and receiving another classical information from the receiver device.

[0043] According to another aspect, there is provided a receiver device for quantum key distribution, the receiver device including a classical processor and means for receiving and measuring quantum signals, and being configured to perform the following steps:

[0044] - Receive a quantum signal including a plurality of optical pulses from a transmitter device via a quantum channel,

[0045] - Determine a decoder initial bit sequence from the plurality of optical pulses, the determination including performing at least one of the following for each optical pulse:

[0046] - Determine an approximate intensity curve of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determine a first decoder value of at least one first bit of the decoder initial bit sequence according to the approximate intensity curve, and

[0047] - Determine an approximate phase curve of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determine a second decoder value of at least one second bit of the decoder initial bit sequence according to the approximate phase curve; and

[0048] - Determine a shared key shared between the transmitter device and the receiver device according to the decoder initial bit sequence by means of classical post-processing and at least one of receiving classical information from the transmitter device and transmitting another classical information to the transmitter device.

[0049] According to another aspect, there is provided a system for quantum key distribution, the system including a transmitter device having a classical processor and means for preparing and transmitting quantum signals and a receiver device having another classical processor and means for receiving and measuring quantum signals. The system is configured to perform the following steps:

[0050] - Generate an encoder initial bit sequence in the transmitter device;

[0051] - In the transmitter device, generate a quantum signal including a plurality of optical pulses according to a first initial bit sequence, wherein generating each optical pulse of the plurality of optical pulses includes at least one of the following:

[0052] - Modulate the intensity curve of the optical pulse according to an intensity function depending on time and on a first encoder value of at least one first bit depending on the encoder initial bit sequence; and

[0053] - Modulate the phase curve of the optical pulse according to a phase function of a second encoder value that depends on time and at least one second bit of the initial encoder bit sequence.

[0054] - Transmit the plurality of optical pulses from the transmitter device to the receiver device via a quantum channel and receive the plurality of optical pulses at the receiver device;

[0055] - Determine an initial decoder bit sequence from the plurality of optical pulses, the determination including performing at least one of the following for each optical pulse:

[0056] - Determine an approximate intensity curve of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determine a first decoder value of at least one first bit of the initial decoder bit sequence according to the approximate intensity curve, and

[0057] - Determine an approximate phase curve of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determine a second decoder value of at least one second bit of the initial decoder bit sequence according to the approximate phase curve; and

[0058] - Determine a shared secret key shared between the transmitter device and the receiver device in the transmitter device according to the initial encoder bit sequence and in the receiver device according to the initial decoder bit sequence by at least one of classical post - processing, transmitting classical information from the transmitter device to the receiver device, and transmitting another classical information from the receiver device to the transmitter device.

[0059] Thus, modulating the intensity curve of each optical pulse depends particularly on a first encoder value of at least one first bit of the initial encoder bit sequence. Further, modulating the phase curve of each optical pulse depends on a second encoder value of at least one second bit of the initial encoder bit sequence.

[0060] As a result, the shared secret key can be determined in a more robust manner, especially for cases where the value of information that may be leaked to an eavesdropper increases. High - intensity quantum states with relatively weak distinguishability can be employed. In contrast, traditional quantum cryptography assumes that a potential eavesdropper can obtain all the losses that occur in the quantum channel between legitimate parties. Therefore, weak coherent states with only a few photons per signal are usually used.

[0061] Due to their (important) time-dependence, the intensity function and the phase function can be considered non-constant in time. In other words, the intensity function and the phase function can be considered to vary with time. Similarly, the intensity function and the phase function can be considered to vary with the first encoder value and the second encoder value, respectively. Further, the modulation of the intensity curve and the modulation of the phase curve can be considered to depend on time as well as the first encoder value and the second encoder value, respectively.

[0062] The time-dependent intensity curve and / or phase curve can vary rapidly with time, making it difficult for an eavesdropper to obtain information about the encoded logical bits contained in the scattered radiation. Therefore, the security is greatly improved compared to traditional coding procedures.

[0063] The quantum signal can include multiple quantum states. For example, each quantum state can correspond to one of these optical pulses. Each optical pulse can include multiple photons.

[0064] Each optical pulse can correspond to an optical wave packet that starts and ends on a time scale on which its (instantaneous) intensity drops to zero and / or below the noise level, which can be, for example, between 0.01% and 1.0% of the average peak of multiple optical pulses. The pulse length of the optical pulse can correspond to the difference between its start and end on the time scale.

[0065] The intensity (time) curve (shape) of the optical pulse can correspond to the time-dependent intensity and / or photon number and / or optical power of the optical pulse. The phase (time) curve of the optical pulse can correspond to its time-dependent phase.

[0066] The encoder initial bit sequence can be randomly generated, preferably using a quantum random number generator (QRNG). Alternatively, a classical pseudo-random number generator can also be employed.

[0067] At least one first bit of the encoder initial bit sequence can be different from at least one second bit of the encoder initial bit sequence. Therefore, more information can be encoded in the optical pulse.

[0068] Alternatively, at least one first bit and at least one second bit of the encoder initial bit sequence can be the same. In this case, the intensity function can depend on time and the (first encoder) value of at least one (first) bit of the encoder initial bit sequence, and the phase function can depend on time and the (first encoder) value of at least one (first) bit of the encoder initial bit sequence. Therefore, the same one or more first bits can be encoded in both intensity and phase simultaneously, thereby increasing redundancy and robustness (e.g., against noise).

[0069] At least one first bit of the decoder initial bit sequence may be different from at least one second bit of the decoder initial bit sequence. Alternatively, at least one first bit and at least one second bit of the decoder initial bit sequence may be the same.

[0070] At least one of the first encoder value, the second encoder value, the first decoder value, and the second decoder value may be a binary value. For example, if the intensity function depends on a single first bit of the decoder initial bit sequence, the first encoder value may be a bit value, i.e., the first encoder value may be "0" or "1". If the intensity function depends on two first bits of the decoder initial bit sequence, the first encoder value may be one of "00", "01", "10", and "11".

[0071] Classical post-processing, transmitting classical information to a receiver device, and receiving another classical information from the receiver device may include classical post-processing, transmitting, and receiving during at least one of bit reconciliation, post-selection, error estimation, error correction, and privacy amplification. Classical post-processing, receiving classical information from a transmitter device, and transmitting another classical information to the transmitter device may include classical post-processing, transmitting, and receiving during at least one of bit reconciliation, post-selection, error estimation, error correction, and privacy amplification.

[0072] The total number of photons of each optical pulse among the plurality of optical pulses and of each first encoder value may be constant.

[0073] (Each) optical pulse may be generated according to a (pulse) laser beam and / or using a Mach-Zehnder interferometer (of the encoder device). The Mach-Zehnder interferometer may include a first phase modulator, a second phase modulator, a first beam splitter, and a second beam splitter. The laser beam may pass through the first beam splitter, the first phase modulator, the second beam splitter, and the second phase modulator.

[0074] Before modulation, each optical pulse may include, for example, a rectangular intensity profile. In particular, before modulation, each optical pulse may include a constant optical power (during the duration of the optical pulse).

[0075] The first beam splitter and / or the second beam splitter may be a 50:50 beam splitter. The laser beam may be split (into a first part and a second part) at the first beam splitter and recombined at the second beam splitter. The laser beam may further (again) be split (into a third part and a fourth part) at the second beam splitter. The first part may pass through the first phase modulator. The second part may be directly transmitted to the second beam splitter. The third part may be emitted to a control detector. The fourth part may pass through the second phase modulator and subsequently be emitted to the quantum channel (as an optical pulse).

[0076] The input optical power of the laser generating the optical pulses can be from 0.15 nW to 100.00 nW, preferably from 1 nW to 20 nW. The number of photons per optical pulse can be from 100 to 80000, preferably from 800 to 15000. The laser can include, for example, a DFB PM laser diode. The center wavelength of the optical pulses can be between 1510 nm and 1550 nm, preferably between 1529 nm and 1531 nm, more preferably 1530 nm. The linewidth can be 2 MHz or less.

[0077] Each optical pulse (after modulation) can include (time - dependent) optical power from 0.1 nW to 50.0 nW (between its start and end on the time scale), preferably from 1 nW to 20 nW, more preferably from 5 nW to 15 nW.

[0078] The intensity curve can be modulated by at least one of a first phase modulator and the laser source intensity (input intensity). The phase curve can be modulated by a second phase modulator.

[0079] The intensity function can include an oscillating component that depends on a first encoder value and preferably has a time - dependent (instantaneous) frequency. Further, the phase function can include another oscillating component that depends on a second encoder value and has a time - dependent frequency.

[0080] Generally, the intensity function and / or the phase function can include at least two (local) maxima.

[0081] Modulating the intensity curve of the optical pulse according to (using) the intensity function can include at least one of the following: multiplying the intensity curve (point - by - point) by the intensity function, convolving the intensity curve with the intensity function, and adding the intensity function (point - by - point) to the intensity curve. Further, modulating the phase curve of the optical pulse according to (using) the phase function can include at least one of the following: multiplying the phase curve (point - by - point) by the phase function, convolving the phase curve with the phase function, and adding the phase function (point - by - point) to the phase curve.

[0082] The intensity function for each first encoder value can be unique. In other words, the intensity function for each first encoder value can be different from the intensity function of another first encoder value. In particular, the intensity function for each first encoder value can have a unique time evolution. For example, the intensity function for each first encoder value can be different from a constant multiple of the intensity function of another first encoder value. Correspondingly, the phase function for each second encoder value can be unique. In other words, the phase function for each second encoder value can be different from the phase function of another second encoder value. In particular, the phase function for each second encoder value can have a unique time evolution. For example, the phase function for each second encoder value can be different from a constant multiple of the phase function of another second encoder value.

[0083] To make the first encoder value consistent with the second encoder value, the intensity function and the phase function can be the same. Alternatively, to make the first encoder value consistent with the second encoder value, particularly for any (pair of) first encoder value and second encoder value, the intensity function and the phase function can be different.

[0084] The intensity function and / or the phase function can be quasi-periodic.

[0085] For the first encoder value a, the oscillatory component can have the form of, where the factor c a , the angle η a and the angle function depend on the first encoder value. The factor c a and the angle η a can also be constant with respect to the first encoder value. In other words, the oscillatory component can have the form of. For the second encoder value a, another oscillatory component can have the form of, where another factor another angle and another angle function depend on the second encoder value. Another factor and another angle can also be constant with respect to the second encoder value. In other words, the oscillatory component can have the form of.

[0086] The oscillatory component and / or another oscillatory component may include oscillations with an instantaneous period (local period) of 1 ns to 50 ns, preferably 1 ns to 20 ns, more preferably 1 ns to 10 ns. The instantaneous period may change over time. The oscillatory component may also include oscillations with an instantaneous frequency (local frequency) of 10 MHz to 500 MHz, preferably 45 MHz to 300 MHz, more preferably 70 MHz to 130 MHz. The instantaneous frequency may change over time.

[0087] The intensity function may also include a constant (bias) component (a component that is constant over time). The phase function may also include another constant (bias) component. The intensity function may include the sum of an oscillatory component and a constant component. The phase function may include the sum of another oscillatory component and another constant component.

[0088] The intensity function may include a frequency chirp component that depends on a first encoder value, preferably including at least one of a linear frequency chirp component, a quadratic frequency chirp component, a cubic frequency chirp component, and an exponential frequency chirp component. The phase function may include another (another) frequency chirp component that depends on a second encoder value, preferably including at least one of a linear frequency chirp component, a quadratic frequency chirp component, a cubic frequency chirp component, and an exponential frequency chirp component. The (another) oscillatory component may be or may include a (another) frequency chirp component.

[0089] The frequency chirp component may include a chirp rate that depends on a first encoder value. The another frequency chirp component may include another chirp rate that depends on a second encoder value. The (another) chirp rate for each first (second) value may be unique.

[0090] The intensity function may depend on a first encoder value of at least two first bits of an encoder initial bit sequence and / or the phase function may depend on a second encoder value of at least two second bits of an encoder initial bit sequence.

[0091] In other words, generating each of the plurality of optical pulses may include at least one of the following: modulating the intensity profile of the optical pulse according to an intensity function that depends on a first encoder value of at least two first bits of an encoder initial bit sequence and time, and modulating the phase profile of the optical pulse according to a phase function that depends on a second encoder value of at least two second bits of an encoder initial bit sequence and time.

[0092] The intensity function can also depend on a first encoder value of at least three first bits of the initial encoder bit sequence and / or the phase function can depend on a second encoder value of at least three second bits of the initial encoder bit sequence. The intensity function can depend on a first encoder value of at least four first bits of the initial encoder bit sequence and / or the phase function can depend on a second encoder value of at least four second bits of the initial encoder bit sequence.

[0093] Generally, the intensity function can depend on a first encoder value of at least one first bit and at most 100 first bits (in particular at most 20 first bits, especially at most 4 first bits) of the initial encoder bit sequence. The phase function can depend on a second encoder value of at least one second bit and at most 100 second bits (in particular at most 20 second bits, especially at most 4 second bits) of the initial encoder bit sequence.

[0094] If the intensity (phase) function depends on one first (second) bit, the intensity (phase) curve can be modulated according to two different shapes (the intensity (phase) function according to bit value 0 and the intensity (phase) function according to bit value 1). If the intensity (phase) function depends on two first (second) bits, the intensity (phase) curve can be modulated according to four different shapes (the intensity (phase) functions according to bit values 00, 01, 10, and 11). Generally, if the intensity (phase) function depends on n first (second) bits, the intensity (phase) curve can be modulated according to 2 n different shapes.

[0095] The first bit of the initial encoder bit sequence can be different from the second bit of the first bit sequence. Alternatively, the first bit and the second bit can be the same or partially overlapping.

[0096] The pulse length of each optical pulse can be from 1 ns to 1000 ns, preferably from 50 ns to 200 ns, more preferably from 80 ns to 120 ns. Each optical pulse can have (substantially) the same pulse length. The difference between the pulse length of each optical pulse and the average pulse length of the plurality of optical pulses is at most 0.1%.

[0097] Modulation can be performed on the intensity curve and / or the phase curve such that the pulse length of each optical pulse changes by at most 10%, preferably by at most 5%.

[0098] Determining the first decoder value can include comparing an approximate intensity curve with an ideal approximate intensity curve (for different possible first encoder values). Determining the second decoder value can include comparing an approximate phase curve with an ideal approximate phase curve (for different possible second encoder values).

[0099] The approximate intensity curve may include a plurality of intensity values. The approximate phase curve may include a plurality of phase values. For each time bin, the approximate intensity curve may include a corresponding intensity value and / or the approximate phase curve may include a corresponding phase value.

[0100] Measuring the intensity value and / or phase value (for a plurality of time bins) may include performing a heterodyne measurement for each time bin. Performing a heterodyne measurement may include splitting the (received) optical pulse into two beams (which interfere with two additional beams of a local oscillator (LO)), and measuring the interference event using a (photodiode) detector.

[0101] The time bin length for each time bin may be from 1 ns to 50 ns, preferably from 1 ns to 5 ns, more preferably from 1 ns to 2 ns.

[0102] The first decoder value of at least two first bits of the decoder initial bit sequence and / or the second decoder value of at least two second bits of the decoder initial bit sequence may be determined. Further, the first decoder value of at least three first bits of the decoder initial bit sequence and / or the second decoder value of at least three second bits of the decoder initial bit sequence may be determined. In addition, the first decoder value of at least four first bits of the decoder initial bit sequence and / or the second decoder value of at least four second bits of the decoder initial bit sequence may be determined. Generally, the first decoder value of at least one first bit and at most 100 first bits (especially at most 20 first bits, particularly at most 4 first bits) of the decoder initial bit sequence and / or the second decoder value of at least one second bit and at most 100 second bits (especially at most 20 second bits, particularly at most 4 second bits) of the decoder initial bit sequence may be determined.

[0103] Each possible first encoder value may correspond to an ideal approximate intensity curve. Each possible second encoder value may correspond to an ideal approximate phase curve. For example, in the case of determining the first decoder value of a single first bit of the decoder initial bit sequence, the first decoder value may be 0 or 1. In the case of determining the first decoder value of two first bits of the decoder initial bit sequence, the first decoder value may be one of 00, 01, 10, and 11. Generally, in the case of determining the first (second) decoder value of n first (second) bits of the decoder initial bit sequence, there are 2 n possibilities for the first (second) decoder value. Thus, in the case of determining the first (second) decoder value of n first (second) bits of the decoder initial bit sequence, there are 2 n possibilities for the ideal approximate intensity (phase) curve.

[0104] Comparing the approximate intensity curve with the ideal approximate intensity curve may include determining a first characteristic indicative of the approximate intensity curve relative to the ideal approximate intensity curve. Comparing the approximate phase curve with the ideal approximate phase curve may include determining a second characteristic indicative of the approximate phase curve relative to the ideal approximate phase curve.

[0105] The first characteristic may include, for example, a first measured correlation factor difference determined based on the approximate intensity curve and the ideal approximate intensity curve. Then, determining the first decoder value may include comparing the first measured correlation factor difference with a first threshold. The second characteristic may include a second measured correlation factor difference determined based on the approximate phase curve and the ideal approximate phase curve. Determining the second decoder value may include comparing the second measured correlation factor difference with a second threshold.

[0106] In other words, and in the case including variable symbols, the method may include at least one of the following:

[0107] - Based on the approximate intensity curve and the ideal approximate intensity curve {N a (t)} t (including the ideal intensity value N a (t)) determine a first measured correlation factor difference ΔQ, and determine the first decoder value by comparing the first measured correlation factor difference ΔQ with a first threshold and,

[0108] - Based on the approximate phase curve and the ideal approximate phase curve {Π a (t)} t (including the ideal phase value ∏ a (t)) determine a second measured correlation factor difference ΔR, and determine the second decoder value by comparing the second measured correlation factor difference ΔR with a second threshold .

[0109] Determining the first measured correlation factor difference ΔQ may include, for each of a plurality of time bins, determining the sum (preferably normalized) of differences of the ideal intensity value N a (t) depending on the first encoder value a, where each difference is weighted by the (measured) intensity value of the corresponding time bin. Determining the second measured correlation factor difference ΔR may include, for each of a plurality of time bins, determining the sum (preferably normalized) of differences of the ideal phase value Π a (t) depending on the second encoder value a, where each difference is weighted by the (measured) phase value of the corresponding time bin.

[0110] The first threshold may be based on the mean difference e of the correlation factors of at least one first-order first decoder value 0, e 1 to determine, in particular, the mean difference e of the correlation factors according to at least one first decoder value of the first order 0 , e 1 is determined according to the arithmetic mean. The second threshold can be determined according to the mean difference q of the correlation factors of at least one second decoder value of the second order 0 , q 1 to determine, in particular, according to the arithmetic mean of the mean differences of the correlation factors of at least one second decoder value of the second order. Specifically, the first threshold can be determined as (e 0 + e 1 ) / 2, where, for the correlation factors of the first encoder value a and The second threshold can be determined as (q 0 + q 1 ) / 2, where, for the correlation factors of the second encoder value a and

[0111] The first decoder value can be determined based on whether the first measured correlation factor difference ΔQ is greater than or less than the first threshold . The second decoder value can be determined based on whether the second measured correlation factor difference ΔR is greater than or less than the second threshold .

[0112] In particular, the first decoder value can be determined based on whether the first measured correlation factor difference ΔQ is greater or less than the first post-selection parameter than the first threshold . Based on the fact that the first measured correlation factor difference ΔQ is not greater or less than the first post-selection parameter than the first threshold , the intensity measurement value of the corresponding optical pulse can be determined to be uncertain (and discarded). The second decoder value can be determined based on whether the second measured correlation factor difference ΔR is greater or less than the second post-selection parameter than the second threshold . Based on the fact that the second measured correlation factor difference ΔR is not greater or less than the second post-selection parameter than the second threshold , the phase measurement value of the corresponding optical pulse can be determined to be uncertain (and discarded).

[0113] The first post-selection parameter and / or the second post-selection parameter can be determined such that the key generation rate for determining the shared key is maximized. In particular, the first post-selection parameter and / or the second post-selection parameter can be determined by numerically optimizing a set of candidate post-selection parameters and preferably by changing the test input bit sequence of the initial bit sequence of the encoder and / or the assumed signal leakage value.

[0114] The first post-selection parameter and / or the second post-selection parameter can be from 0.01 to 0.30, preferably from 0.05 to 0.20, and more preferably from 0.08 to 0.10.

[0115] The method can include determining (and / or monitoring) the optical signal loss along a quantum channel (and / or a transmission line), in particular along an optical fiber. Preferably, the optical signal loss depends on the position along the quantum channel. In other words, the optical signal loss can be determined as a function of the position along the quantum channel. In particular, for each position along the quantum channel, the corresponding optical signal loss can be determined. Thus, the optical signal loss can correspond to a signal loss curve. The optical signal loss can be determined via an optical test pulse (different from the plurality of optical pulses). The optical test pulse can include an optical power that is greater (preferably at least 10 times greater, more preferably at least 100 times greater) than the optical pulse.

[0116] The optical signal loss can be determined by optical time domain reflectometry. The optical signal loss can be determined during and / or before and / or after determining the shared key. The optical signal loss can be determined repeatedly. For example, the optical signal loss can be determined repeatedly at time intervals selected from: 10 ns to 50 s, preferably from 10 ns to 10 s, in particular from 100 ns to 100 ms, 500 ns to 500 ms, 100 ms to 1000 ms, 0.5 s to 5 s, and 5 s to 10 s.

[0117] The method can include determining an intrusion event based on the optical signal loss and / or aborting (terminating) the determination of the shared key based on the optical signal loss. The method can include discarding the shared key based on the optical signal loss.

[0118] In the context of the present disclosure, intervals and value ranges (e.g., "from... to...", "between... and...") include their boundary points.

[0119] The above-described embodiments related to the method for quantum key distribution can be correspondingly provided to a transmitter device, a receiver device, and a system for quantum key distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0120] Hereinafter, embodiments are described by way of example with reference to the drawings, in which:

[0121] Figure 1 A graphical representation of the arrangement of a system for quantum key distribution and an eavesdropper device is shown,

[0122] Figure 2 A graphical representation of the steps for determining a shared key by quantum key distribution is shown,

[0123] Figure 3 shows a reflection map obtained by an optical time domain reflectometry corresponding to a signal loss curve

[0124] Figure 4 shows a graphical representation of a device for preparing optical pulses

[0125] Figure 5 shows a plot of the intensity curve versus time in terms of optical power

[0126] Figure 6 shows a plot of the key generation rate varying with a portion of the intercepted signal

[0127] Figure 7 shows a plot of the key generation rate of phase encoding and the proposed method, and

[0128] Figure 8 shows a plot of the key generation rate of intensity encoding and the proposed method Detailed Description

[0129] In Figure 1 is shown a graphical representation of an arrangement including a system for quantum key distribution and an eavesdropper device 13 (“Eve”). The system includes a communication channel (transmission line) 10 for transmitting classical signals and / or quantum signals, in particular optical pulses, between a transmitter device 11 (“Alice”) and a receiver device 12 (“Bob”). The communication channel 10 may include or may be a classical channel and / or a quantum channel 10a. Further, the communication channel 10 may include at least one optical fiber for transmitting optical pulses. At least one (optical) amplifier (not shown) may be provided along the communication channel 10 for amplifying the optical pulses. The optical amplifier may compensate for losses occurring in a previous portion of the communication channel 10

[0130] The transmitter device 11 may include a (classical) processor 11a and a (classical) memory 11b, and the receiver device 12 may include another (classical) processor 12a and another memory 12b. The transmitter device 11 and the receiver device 12 may be part of the system. The transmitter device 11 and the receiver device 12 are connected to the quantum channel

[0131] The eavesdropper device 13 having an eavesdropping processor 13a and an eavesdropping memory 13b represents a device outside the system that may have access to the quantum channel 10. The eavesdropper device 13 may be arranged on the transmission line 10 such that optical signals transmitted via the transmission line 10 are at least partially received and / or forwarded by the eavesdropper device 13. The eavesdropper device 13 may also have access to additional communication channels

[0132] At least one (preferably each) of the transmitter device 11, the receiver device 12, and the eavesdropper device 13 may include means for preparing, transmitting, receiving, and measuring at least one of quantum states (in particular, optical quantum states). In particular, the transmitter device 11 may include means for preparing and transmitting quantum signals and / or quantum states, such as a (quantum state) preparation device 11c. Further, the receiver device 12 may include means for receiving and measuring quantum signals and / or quantum states, such as a (quantum state) measurement device 12c. The eavesdropper device 13 may likewise include preparation and / or measurement devices 13c. The transmitter device 11 and the receiver device 12 may each include means for receiving and transmitting (another) classical information (e.g., via a classical channel).

[0133] The first memory 11b, the second memory 12b, and the eavesdropping memory 13b may each include a quantum memory configured to store quantum signals and a classical memory configured to store classical signals. An optical delay line, controlled reversible inhomogeneous broadening (CRIB), Duan-Lukin-Cirac-Zoller (DLCZ) scheme, silenced echo recovery (ROSE), and / or hybrid photon echo reprogramming (HYPER) may be used to provide the quantum memory.

[0134] (a) Quantum key distribution

[0135] The steps for determining a shared key through quantum key distribution will be briefly described below. In Figure 2 a graphical representation of the corresponding steps is shown.

[0136] Certain steps will be explained in more detail in the subsequent sections, particularly the loss control of the transmission line (transmission line control) (step 21, section b), encoding (step 23, section c), decoding (step 25, section d), and post-processing (steps 26 to 28, section e).

[0137] The transmitter device 11 and the receiver device 12 are connected via an authenticated (public) classical channel, and the (multiple) optical fibers of the transmission line 10 are used as the quantum channel 10a.

[0138] In the initial step 20, an initial inner loss curve of the transmission line 10 (particularly its fiber segment) is determined, which basically represents the natural signal loss in the transmission line 10. At this preliminary step, it should be ensured that no eavesdropper has access to the transmission line 10. The initial loss curve may be shared between the transmitter device 11 and the receiver device 12 via an authenticated classical communication channel.

[0139] In a first step 21, the transmitter device 11 and the receiver device 12 perform physical loss control of the transmission line 10 by transmitting optical test pulses. In particular, the loss curve is determined and preferably shared between the transmitter device 11 and the receiver device 12 via a classical channel.

[0140] By comparing the thus updated inner loss curve with the initial inner loss curve, the fraction r of the signal that may be in the possession of an eavesdropper can be determined. E . For example, if in a section of the transmission line 10, the natural signal loss in this section is represented by r 0 and the interception fraction of the signal intercepted by the eavesdropper is r E , then the interception fraction r t can be obtained from the total loss r E via the relation (1 - r 0 )=(1 - r t )(1 - r E ).

[0141] If the interception fraction r E becomes too large such that the legitimate user loses its information advantage compared to the eavesdropper, the protocol is terminated. The termination of the protocol depends on the length of the transmission line 10. In particular, the protocol can be terminated if the effective key rate is below the target key rate value.

[0142] Based on the loss curve, protocol settings such as signal shape, post - selection parameters, error - correcting codes, etc. can be determined. The physical loss control including the optical test pulse transmission can be carried out in parallel with the transmission of the optical (signal) pulses used to determine the shared key. If a change in r E is detected, the protocol settings can be adjusted.

[0143] In a second step 22, a bit sequence is determined in the transmitter device 11 using a random number generator.

[0144] In a third step 23, the encoder initial bit sequence is encoded into the corresponding intensity curve and / or phase curve of a plurality of optical (signal) pulses.

[0145] In a fourth step 24, the optical pulses are emitted via the quantum channel 10a to the receiver device 12.

[0146] In a fifth step 25, the optical pulses are received and measured by the receiver device 12. The corresponding decoder initial bit sequence is determined in the receiver device 12. Due to quantum noise and classical noise, the quantum states corresponding to different bit values for some optical pulses cannot be accurately determined. Therefore, the second initial bit string may contain additional errors.

[0147] In the sixth step 26, the uncertain bits (post-selection) are discarded from the initial bit sequence of the encoder in the transmitter device 11 and the initial bit sequence of the decoder in the receiver device 12, and the uncertain bits correspond to the quantum measurement values determined to be uncertain in the receiver device 12. This generates a first raw key in the transmitter device and a second raw key in the receiver device. To discard the uncertain bits, the bit positions of the uncertain signal bits (as part of another classical information) can be transmitted from the receiver device 12 to the transmitter device 11 via the classical channel.

[0148] In the seventh step 27, by publicly disclosing a part of the initial bit sequence of the encoder (specifically, the first / encoder raw key) and / or a part of the initial bit sequence of the decoder (specifically, the second / decoder raw key) (as part of the classical information and / or another classical information) via the classical channel, the error rate can be determined, and error correction can be performed on the first raw key and the second raw key by the transmitter device 11 and the receiver device 12 respectively. Error correction codes (e.g., low-density parity-check (LDPC) codes, Hamming codes, or concatenated protocols) can be used to perform error correction. As a result, the error-corrected bit sequence is determined according to the first raw key in the transmitter device 11, and the error-corrected bit sequence is determined according to the second raw key in the receiver device 12.

[0149] In the eighth step 28, the amplified key sequence is determined from the error-corrected bit sequence using privacy amplification. Known privacy amplification methods can be employed, during which (another) classical information is exchanged. The amplified key sequence is shorter than the error-corrected bit sequence and any possible eavesdropper has no information or only negligibly small information about the amplified key sequence. As a result of quantum key distribution, the amplified key sequence represents the shared key sequence between the transmitter device 11 and the receiver device 12. Privacy amplification can be based on the determined value r E .

[0150] These steps from the first step 21 to the eighth step 28 can be repeated (arrow 29) and the amplified key sequences are concatenated to the (total) shared key until the total length of the shared key is as large as required for the current application.

[0151] During all steps 21 to 28, the transmission line 10 can be continuously controlled (arrow 20a). Thus, the signal loss curve is determined and preferably shared between the transmitter device 11 and the receiver device 12 via the classical channel. If the integrity of the transmission line 10 is compromised such that there is a significant risk that an eavesdropper can break the scattering loss, the protocol can be terminated.

[0152] (b) Transmission line control / loss control

[0153] The first step 21 of the physical loss control of the transmission line 10 will be explained in more detail below.

[0154] Figure 3 An exemplary reflection map obtained by optical time domain reflectometry corresponding to the signal loss curve is shown. The basic measurement is performed with a 2 μs, 1550 nm pulsed laser with a power of less than 100 mW. The experimental data has been averaged over 16,000 measurements.

[0155] The reflection map shows the logarithmic power of the backscattered optical test pulse as a function of the distance between the reflectometer and the corresponding discontinuity. The reflectometer can be arranged within the transmitter device 11 and / or the receiver device 12 or close to the transmitter device and / or the receiver device.

[0156] The natural signal loss along the quantum channel 10a / transmission line 10 is attributed to uniform scattering and causes an exponential decay of the power corresponding to the linear region 30. Reflection map features 31 to 34, including deviations from the exponential decay of the reflection map curve, in particular spikes and / or dips in the reflection map curve, allow for the classification of the signal loss at the corresponding location of the transmission line 10. This is particularly useful at the initial step 20, where identifying and mitigating local losses is important for comparison with the determined losses during key exchange.

[0157] Reflection map features 31 to 34 generally correspond to defects in the transmission line 10 and can represent, for example, low-quality joints, bends, and different connectors. The scattering losses from these regions are localized with respect to the transmission line 10. The peaks in reflection map features 31 to 34 may be caused by excessive scattering, which, in the case of physical connectors, is attributed to the test pulse experiencing a Fresnel reflection. The noise region 35 on the right-hand side of the reflection map represents the end of the backscattered signal.

[0158] Additionally or alternatively, the transmission line control can include transmission metrology, i.e., analyzing the intensity of the optical test pulse transmitted by the transmitter device 11 and received by the receiver device 12 to classify the signal loss at the corresponding location of the transmission line 10. The classification performed by analyzing the optical signal received in the receiver device 12 can also be carried out in the receiver device 12. The transmitter device 11 can also be configured to perform the classification, in particular by combining the measured values of the backscattered test pulse component with the measured values of the optical test pulse received in the receiver device 12.

[0159] To increase precision, the optical test pulses should have the highest intensity, in particular an intensity greater than that of the optical (signal) pulses. The parameters of the emitted optical test pulses, such as intensity, phase, length, and shape, are determined randomly in the transmitter device 11. The parameters remain secret until the receiver device 12 has completed the quantum measurement. Next, the transmitter device 11 publishes the parameters used, and the transmitter device 11 and the receiver device 12 perform a cross-check on the parameters and determine the loss in the transmission line 10. The time interval between optical test pulse transmissions can be determined based on a pre-shared secret bit sequence. This ensures that potential eavesdroppers cannot distinguish between optical test pulses and optical (signal) pulses. Thus, it is impossible for an eavesdropper to create additional permanent leakage constants or leakage targets for certain optical signal pulses and optical test pulses. By analyzing the optical test pulses, the knowledge of the eavesdropper about the optical signal pulses can be evaluated.

[0160] (c) Encoding

[0161] The third step 23 of encoding the encoder initial bit sequence into the corresponding intensity curve and / or phase curve of a plurality of optical (signal) pulses will be described in more detail below.

[0162] In Figure 4 a graphical representation of a device for preparing optical pulses is shown. The device may correspond to the preparation device 11c of the transmitter device 11.

[0163] Each optical pulse is generated using a Mach-Zehnder (MZ) interferometer 41 based on the laser pulse of the laser 40. The laser pulse (generated by the laser 40) has a time length T s and a constant input optical power where Ω is the carrier frequency and γ is the (complex) pulse amplitude.

[0164] The MZ interferometer 41 may include a first phase modulator 43, a second phase modulator 45, a first beam splitter 42, and a second beam splitter 44. The laser pulse may pass through the first beam splitter 42, the first phase modulator 43, the second beam splitter 44, and the second phase modulator 45.

[0165] The first beam splitter 42 and the second beam splitter 44 are 50:50 beam splitters. The laser pulse is split into a first part and a second part at the first beam splitter 42 and recombined at the second beam splitter 44. The laser pulse is split again into a third part and a fourth part at the second beam splitter 44. The first part passes through the first phase modulator 43. The second part is directly transmitted to the second beam splitter 44. The third part is emitted to the control detector 46. The fourth part passes through the second phase modulator 45 and is then emitted to the quantum channel 10a (as one of the plurality of optical pulses). The correct preparation of the optical pulse can be monitored through the detector 46.

[0166] The parameters of the two phase modulators 43 and 45 can be controlled in a timely manner for modulating the intensity profile and / or phase profile of the optical pulse.

[0167] The transformation of the input state (0, γ) T (with vacuum on one port and a pulse with complex amplitude γ on the other port) via the MZ interferometer 41 can be expressed as

[0168]

[0169] where

[0170]

[0171] represents the transformation corresponding to the first beam splitter 42 and the second beam splitter 44. Further, represents the transformation corresponding to the first phase shift via the first phase modulator 43, and represents the transformation corresponding to the second phase shift ψ via the second phase modulator 45. The first phase shift and the second phase shift ψ(t) are time-dependent functions and respectively determine the intensity profile and phase profile of the output optical pulse. The optical pulse is represented by the following quantum state:

[0172]

[0173] The intensity profile P line (in terms of optical power) and the phase profile φ line (t) can be expressed as follows:

[0174]

[0175] P γ represents the (constant) input optical power from the laser 40. For the intensity profile (in terms of optical power) and the intensity profile |F(t)| in terms of intensity 2 , the corresponding first phase shift can be determined as

[0176]

[0177] By using

[0178]

[0179] Since For the input optical power P γ , it holds that: Thus, the input optical power P γ is greater than the intensity curve (in terms of power) for each time t.

[0180] The first phase shift can be compensated, and the desired phase curve φ line (t) is prepared by controlling the second phase shift ψ(t).

[0181] In a specific example, the classical (first) bits of the encoder initial bit sequence are encoded only in the intensity curve. In this case, for each optical pulse, the phase curve can be time-dependent, but for each first encoder value, the phase curve is the same (i.e., independent of the first encoder value). Additionally, each optical pulse encodes only a single first bit. Thus, for each optical pulse, the intensity function depends on the first encoder value of the (single) first bit of the encoder initial bit sequence.

[0182] The intensity curve in terms of optical power for the first (bit) value a can be written as:

[0183]

[0184] where is a time-dependent function and depends on / is determined by a, P′ is a constant (optical power) component, and P″ is the amplitude of the modulation component (here an oscillating component). The function can be considered (up to a constant factor) as the intensity function on which the modulated intensity curve is based. By combining Equation (4) and Equation (7), i.e.,

[0185]

[0186] The first phase shift employed (depending on the first encoder value a) can be determined as:

[0187]

[0188] where P γ > P′ + P″ (since ).

[0189] Figure 5 shows a plot of the intensity curve in terms of optical power versus time. The intensity curve for the first encoder value equal to zero (a = 0) corresponds to the first time-dependent curve 50, and the intensity curve for the first encoder value equal to one (a = 1) corresponds to the second time-dependent curve 51.

[0190] For a = 0, the intensity curve can be expressed as

[0191]

[0192] And for a = 1, the intensity curve can be expressed as

[0193]

[0194] where P′ = 10 -8 W, P″ = 10 -9 W, T s = 100 ns, f 0 = 90 MHz, and f 1 = 110 MHz. As can be seen from curves 50, 51, for a = 0, the instantaneous frequency increases with time, while for a = 1, the instantaneous frequency decreases with time. The factors and can be understood as the first chirp rate and the second chirp rate, respectively.

[0195] (d) Measurement and decoding

[0196] The measurement and decoding of the received optical pulses in the receiver device 12 (step 25) are described in more detail below.

[0197] Based on the optical pulses, an initial decoder bit sequence is determined in the receiver device 12. To this end, for a plurality of time bins, an approximate intensity curve of each optical pulse is determined by measuring the intensity values of the optical pulses. Using the approximate intensity curve, the (first decoder) value of the initial decoder bit sequence can be determined. Further, for a plurality of time bins, an approximate phase curve of the optical pulse is determined by measuring the phase values of the optical pulses. Based on the approximate phase curve, another (second decoder) value of the initial decoder bit sequence can be determined.

[0198] Measuring the intensity values and / or the phase values may include performing heterodyne measurements for each time bin. Heterodyne measurements include splitting the received optical pulse into two beams (which interfere with two additional beams of a local oscillator (LO)), and measuring the interference events using a photodiode detector.

[0199] To match the phase of the local oscillator with the phase of the laser (used to generate the optical pulses), an unmodulated optical pulse (with a constant intensity and phase) can be transmitted from the laser via an additional quantum channel (in parallel with the (modulated) optical pulse).

[0200] In the following example, the approximate intensity curve can be determined without determining the approximate phase curve. Therefore, the phase of the optical pulse can be kept constant over time. Thus, there is no phase difference between different optical pulses and between the same optical pulse. The intensity curve of each of the plurality of optical pulses has been modulated in the transmitter device 11 according to an intensity function of a first encoder value of a first bit depending on time and the initial bit sequence of the encoder. Further, the plurality of optical pulses have been transmitted by the quantum channel 10a and received in the receiver device 12.

[0201] In the receiver device 12, a plurality of quantum measurements are performed such that a plurality of (average) photon numbers are determined for a plurality of time bins characterized by a time interval Δt. Once per time interval Δt, an intensity value (i.e., the number of photons received during the time interval Δt) is determined. Thus, a set of discrete time values and corresponding photon numbers (approximate / discrete intensity curve) are determined. Based on the approximate intensity curve, the intensity curve initially generated in the transmitter device 11 can be reconstructed with a certain accuracy, thereby estimating the corresponding bit value.

[0202] The intensity curves can be generated such that their total energy remains constant for each of the plurality of optical pulses and for each possible bit value. That is, the total number of photons of each optical pulse is constant:

[0203]

[0204] where N a (t) represents the average number of photons of the optical pulse in the time interval [t, t + Δt] in the case where the first (bit) value is a. Due to Poisson noise, the determined approximate intensity curve will generally not coincide with the ideal intensity curve. For the bit value a, the measured number of photons in the time interval [t, t + Δt] can be expressed as

[0205]

[0206] where n a (t) is a random variable associated with the noise. For high signal intensity, n a (t) can be regarded as a Gaussian random variable at each time t. According to the boson model of the optical amplifier, the obtained mean value and variance can be written as:

[0207]

[0208] where M is the number of optical amplifiers along the quantum channel 10a and G is the amplification factor of an optical amplifier. Thus, M = D AB / d and G = 1 / T, where D ABis the distance between the transmitter device 11 and the receiver device 12, d is the distance between adjacent optical amplifiers, and T = 10 -0.02·d is the attenuation parameter of the optical fiber. The number of photons and the optical power R a (t) as a function of the time discretization Δt is as follows:

[0209]

[0210] where is the energy of a single photon. To determine the value of a (first) bit of the initial bit sequence of the decoder in the receiver device 12, based on the approximate intensity curve and the ideal approximate intensity curves {N 0 (t)} t and {N 1 (t)} t for the first encoder values 0 and 1 respectively, the first measurement correlation factor difference ΔQ is determined.

[0211] To establish a procedure for determining the first decoder value a, the correlation factors between the ideal approximate intensity curve and the noisy approximate intensity curve are analyzed below . The correlation factor is defined as:

[0212]

[0213] where Σ t N 0 (t)N 1 (t) is the normalization factor. The correlation factors can be considered Gaussian random variables because they can be expressed as weighted sums of Gaussian variables. Thus, the difference between and

[0214]

[0215] the correlation factor difference for a, a the mean value of the correlation factor difference e a is

[0216]

[0217] The correlation factor mean difference e a can thus be explicitly expressed as a sum of Gaussian random variables. Thus, using equation (15), the variance of the correlation factor difference ΔQ a is also a weighted sum of variances:

[0218]

[0219] In summary, the correlation factor difference ΔQ a can be regarded as a normal distribution random variable with an average value e a (Equation (18)) and a variance (Equation (19)). Therefore, under this condition, the probability of the measurement result of the correlation factor difference ΔQ (the transmitted bit has the first encoder value a) is as follows:

[0220]

[0221] According to Bayes' rule, the probability that the transmitted bit has the first encoder value a - under the condition that the measured value of the correlation factor difference is ΔQ - can be written as

[0222]

[0223] For another post-selection and error correction procedure, determine the (first) threshold such that In other words, in the case of measurement the two bit values are equally probable, that is:

[0224]

[0225] To provide an estimate of it can be assumed that Therefore,

[0226]

[0227] For the determined threshold the first decoder value of the first bit can be judged as follows (the reconstruction of the first encoder value of the first bit from the transmitter device 11 in the receiver device 12).

[0228] According to the approximate intensity curve that is, according to the measured intensity value (the first) measured correlation factor difference ΔQ (which can be expressed as the difference between the correlation factor Q (0) and Q (1) ) is determined by the following formula:

[0229]

[0230] If the measured correlation factor difference ΔQ is greater than the threshold that is then it is judged that the first encoder value of the first bit (generated in the transmitter device 11) is 0, and the first decoder value of the first bit is determined to be 0 in the receiver device 12. If Determine the first decoder value of the first bit as 1 in the receiver device 12. In summary:

[0231]

[0232] In another example, if an approximate phase curve is determined Similarly, the second measurement correlation factor difference ΔR = R can be determined according to the measured phase value by the following formula (0) -R (1)

[0233]

[0234] and compared with a second threshold to determine the second decoder value of the second bit (as the reconstruction in the receiver device 12 of the second encoder value of the second bit from the transmitter device 11).

[0235] (e) Classical post - processing and key generation rate

[0236] In this section, certain aspects of the classical post - processing steps (including post - selection, error correction, and privacy amplification - steps 26 to 28) performed in the transmitter device 11 and / or the receiver device 12 will be described in more detail. During these steps, (another) classical information is exchanged between the transmitter device 11 and the receiver device 12.

[0237] In the post - selection phase (step 26), the receiver device 12 discards those measurement results that do not bring an information advantage over the eavesdropping device 13.

[0238] Specifically, based on whether the first (second) measurement correlation factor difference ΔQ (ΔR) is greater or smaller than the first (second) threshold by a first (second) post - selection parameter at least one measurement result and / or value assignment of the first (second) bit of the initial decoder bit sequence can be discarded.

[0239] In the case where there is a single first bit in the initial decoder bit sequence, the first decoder value can be assigned as follows:

[0240]

[0241] These four values can be assigned similarly. The first (second) post - selection parameter can be a non - negative value and is preferably determined such that the resulting key generation rate is maximized.

[0242] The normalized key generation rate after error correction and privacy amplification can be expressed as

[0243]

[0244] Among them, L is the length of the encoder initial bit sequence generated in the transmitter device 11. The expressions in Equation (27) and their constituent terms will be obtained in the next section.

[0245] Figure 6 Shows the normalized key generation rate L f / L as a function of the fraction r E (signal leakage value) of the intercepted signal, that is, P′ = 10 - 8 W, P″ = 10 -9 W, T s = 100 ns, f 0 = 90 MHz, and f 1 = 110 MHz. The distance between the transmitter device 11 and the receiver device 12 is D AB = 1000 km.

[0246] The key generation rate is obtained by numerically optimizing the post-selection parameter θ. For the considered signal leakage value r E , the optimal post-selection parameter θ lies in the interval [0.08; 0.1]. These values are of the same order of magnitude as the difference between the mean values of the correlation factors |e 1 -e 0 |.

[0247] The key generation rate

[0248] For the mutual information I(A:B) between the transmitter device 11 and the receiver device 12, the conditional probabilities p(0|a), p(1|a) of obtaining the bit value b ∈ {0, 1} in the case of sending a are determined as follows:

[0249]

[0250] And

[0251]

[0252] Equations (28) and (29) can be combined as

[0253]

[0254] Therefore, the mutual information I(A:B) between the transmitter device 11 and the receiver device 12 is:

[0255]

[0256] And the probability p(√) of obtaining a definite result is:

[0257]

[0258] where H(X) is the Shannon entropy of system X, and h 2 (x) = -x·log 2 (x) - (1 - x)·log 2 (1 - x) is the binary entropy function.

[0259] If the error probability of each bit is estimated independently instead of collectively estimating the average error, the LDPC code can provide more efficient error correction. In this case, according to equation (31), the mutual information I(A:B) between the transmitter device 11 and the receiver device 12 becomes:

[0260]

[0261] By introducing J 0 and J 1 , where,

[0262]

[0263] And

[0264]

[0265] The mutual information I(A:B) has the following form:

[0266] I(A:B) = 1 - J 0 - J 1 . (34)

[0267] Physical loss control (step 21) further restricts the eavesdropping attack that may not be noticed: the only option for the eavesdropper is to create a relatively small artificial signal leakage. In the case where there is a leakage position with a factor r E at the quantum channel 10a near the transmitter device 11, the mutual information I(A:E) between the eavesdropping device 13 and the transmitter device 11 can be estimated as the Holevo quantity of the set , that is,

[0268]

[0269] where,

[0270]

[0271] It can be seen that the final key generation rate after obtaining the error correction and privacy amplification procedures according to equation (27) using the Devetak-Winter equation

[0272] The scalar product <a 0 |α 1 > can be determined as follows.

[0273] The scalar product is obtained

[0274] An optical pulse with a time-dependent amplitude (where the intensity curve is F(t) and the carrier frequency is Ω) is generated, for example, by laser 40 at a frequency of Ω with controlled attenuation and phase shift (see section c above). The normalized amplitude f(t)e iΩt and the normalized intensity curve f(t) can be expressed as follows:

[0275]

[0276] where the integral is taken over or the subspace {t|F(t)≠0}. Thus, ∫dt|f(t)| 2 = 1. The spectrum of the intensity curve under consideration can be found as the Fourier transform of the normalized amplitude f(t)e iΩt , that is,

[0277]

[0278] The normalized intensity curve f(t) can define a quantum optical mode. The creation operator associated with the mode is

[0279]

[0280] By introducing another operator

[0281]

[0282] where

[0283]

[0284] The creation operator can be written as:

[0285]

[0286] The creation operator consists of the creation of photons at time t and is described by another operator with a weight f(t). The phase factor e iΩt appears due to the time evolution of the excited atoms in the laser medium. The commutation relations of the new operator are as follows:

[0287]

[0288] The coherent state |α> in the mode f(t) is defined as the eigenstate of the corresponding annihilation operator:

[0289]

[0290] α can be a non - negative real number. Thus, all the information about the time - dependent phase of the pulse is contained in the complex - valued function f(t):

[0291] α 2 = |α| 2 = |α| 2 ·∫dt|f(t)| 2 = ∫dt|F(t) 2 . (45)

[0292] The scalar product of Fock states in different modes f(t) and g(t) is calculated as follows:

[0293]

[0294] where the sum is taken over all permutations σ of the set {1,..., n}. After integration, each of the n! components corresponding to different permutations contributes equally to the sum, resulting in a factor of n!.

[0295] The scalar product of coherent states of different shapes (i.e., coherent states of different modes) can be calculated as

[0296]

[0297] Thus:

[0298]

[0299] Equation (48) describes the most general case. Since each intensity curve F(t), G(t) at a fixed time t is complex, they can be represented in terms of the absolute value and phase by and . For two modulation states that differ only by a constant phase factor and the average number of photons, an expression for the scalar product of standard coherent states can be obtained.

[0300] In the typical case of a constant phase (φ F (t) = φ G (t) = const, i.e., only the intensity curves |F(t)| 2 , |G(t)| 2 are time - dependent functions), then the scalar product is:

[0301] |〈β,g|α,f>| 2 = exp(-∫dt·{|F(t)| - |G(t)|} 2 ). (49) By using the optical power P F (t) (energy density in time) instead of the photon number density |F(t)| in time 2 to express the intensity curve, where hΩ·|F(t)| 2 = P F (t), and the energy of one photon is ), the scalar product can be expressed as:

[0302]

[0303] Alternatively, equation (48) can be obtained as follows. Using |α| 2 = ∫dt|F(t)| 2 and |β| 2 = ∫dt|G(t)| 2 with real numbers α and β, two coherent states can be written as

[0304]

[0305] Similarly, using e X+Y = e X e Y e -[X，Y] / 2 . The commutator can thus be written as:

[0306]

[0307] Using e X+Y = e X e Y e -[X，Y] / 2 = e Y e X e [X，Y] / 2 , the scalar product <α, f|β, g> is:

[0308]

[0309] (f) Comparison with phase encoding

[0310] To illustrate the effectiveness of the proposed intensity / phase curve encoding method, the key generation rates of other encoding methods can be compared.

[0311] The key generation rates of phase encoding (for different input optical power values p (0.05 nW and 0.1 nW)) and the proposed method ("shape encoding") versus r E are shown in the figure Figure 7 as follows. The length of the quantum channel 10a is 1000 km, where the distance between adjacent optical amplifiers is 50 km. The values of shape encoding correspond toFigure 6 the value of d = 50 km in. As Figure 7 shown, compared with phase encoding, the proposed encoding method is more robust to the increase in the leakage value r E . Therefore, the proposed encoding method allows legitimate users to utilize high-intensity quantum states with weak distinguishability.

[0312] In phase encoding, optical pulses corresponding to different logical bits have phases that differ by π, or alternatively by other values. Here, the two optical pulses have the same arbitrary intensity profile, which does not affect the security analysis.

[0313] Therefore, a constant (time-independent) intensity profile can be considered for comparison. To generate such a state, a Mach-Zehnder interferometer is not required, but only a controllable phase modulator. When there is a phase difference of π, the scalar product of the quantum state intercepted by the eavesdropper (Equation (50)) reads:

[0314]

[0315] where the optical power terms are equal and do not depend on time: P 0 (t) = P 1 (t) = P. Here, it is assumed that the eavesdropping device 13 is located at the quantum channel 10a close to the transmitter device 11. Therefore, there is no additional correlation caused by optical amplifiers between the subsystems of the eavesdropping device 13 and the receiver device 12. Therefore, the Holevo value of the pure state ensemble can be used to estimate the intercepted information. The probability p(√) of the definite result and the error probability p err are as follows:

[0316]

[0317] where θ is the post-selection parameter, and is the total average number of photons in each optical pulse. A series of optical amplifiers and losses can be simplified to a pair of losses and amplifications. G = 1 + (10 0.02·d -1)·D AB / d is the effective amplification factor. Since all probabilities are determined, the key generation rate can be estimated similar to Equation (27).

[0318] (g) Comparison with intensity encoding

[0319] In intensity encoding, different logical bits are encoded as coherent states with different average photon numbers (i.e., different average optical powers). Therefore, optical pulses corresponding to different bit values have the same photon time distribution but different average photon numbers.

[0320] Figure 8Shows the key generation rate of intensity coding and the proposed method ("shape coding") as a function of r E The length of the quantum channel 10a is 1000 km, where the distance between adjacent optical amplifiers is 50 km. The value of shape coding corresponds to Figure 6 the value of d = 50 km in E As shown, the proposed method provides an increased key generation rate for a given r

[0321] To prepare the quantum state under intensity coding, the transmitter device 11 can only control the first phase shift For the purpose of security analysis, it is sufficient to consider rectangular pulses with a constant phase value of zero. After preparation, the pure quantum state passes through the quantum channel 11a including optical amplifiers. Therefore, the quantum state obtained at the receiver device 12 is mixed:

[0322]

[0323] where |α a > is a coherent state, where To distinguish the mixed states ρ 0 and ρ 1 , a simple intensity measurement can be performed in the receiver device 12. The photon number distribution can be approximated by a Gaussian distribution. Therefore, the random variable describing the measurement result in the receiver device 12 with bit "a" has a normal distribution with the following parameters:

[0324]

[0325] where M represents the number of optical amplifiers along the quantum channel 10a, and G represents the amplification factor of each amplifier. The variable P 0(1) represents the average optical power of each signal. The discrete value N can be regarded as a continuous value, so that the probability density distribution describing the measurement result can be expressed as follows:

[0326]

[0327] Therefore,

[0328]

[0329] which is equivalent to:

[0330]

[0331] Without loss of generality, assume e 1 > e 0 , then the error probability can be expressed as

[0332]

[0333] wherein, is the average number of photons in the optical pulse. Combining with Equation (58), we get:

[0334]

[0335] Similar to the previous section, the obtained expression for the probability of a definite result is:

[0336]

[0337] Corresponding to Equation (31) and Equation (32), the mutual information between the transmitter device 11 and the receiver device 12 can be calculated as:

[0338]

[0339] Estimating the information of the eavesdropper requires the scalar product of the quantum states to be captured. For constant phase values and different average numbers of photons, this scalar product is:

[0340]

[0341] For Figure 8 , optimize the key generation rate for different average power values 0 -e 1 | on the power difference |e The optimal difference is determined to be approximately |e 0 -e 1 |≈10 -1 ·P for all considered P.

[0342] The features disclosed in this specification, the drawings, and / or the claims may be materials for implementing various embodiments either individually or in various combinations.

Claims

1. A coding method for quantum key distribution, the method being performed in a transmitter device (11) having a classical processor (11a) and means for preparing and transmitting a quantum signal, the method comprising: -Generate encoder initial bit sequence; - generating a quantum signal comprising a plurality of optical pulses according to the encoder initial bit sequence, wherein generating each of the plurality of optical pulses comprises at least one of the following: - modulating the intensity profile of the optical pulses according to an intensity function that is time-dependent and that depends on a first encoder value of at least one first bit of the encoder initial bit sequence; and - modulating the phase curve of the optical pulses according to a phase function that depends on time and on a second encoder value of at least one second bit of the encoder initial bit sequence; - transmitting the plurality of optical pulses to a receiver device (12) via a quantum channel (10a); and - determining a shared key shared between the transmitter device (11) and the receiver device (12) based on the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device (12) and receiving another classical information from the receiver device (12).

2. The method according to claim 1, wherein: Each optical pulse is generated from a laser beam using a Mach-Zehnder interferometer (41).

3. The method according to claim 1 or 2, wherein: - the intensity profile is modulated by at least one of a first phase modulator and a laser source intensity; and / or - The phase curve is modulated by a second phase modulator.

4. The method according to at least one of the preceding claims, wherein: - the intensity function comprises an oscillating component having a time-dependent frequency depending on the first encoder value; and / or - said phase function comprises a further oscillating component having a time-dependent frequency depending on said second encoder value.

5. The method according to at least one of the preceding claims, wherein: The intensity function comprises a frequency chirp component depending on the first encoder value, preferably comprises at least one of a linear frequency chirp component, a quadratic frequency chirp component, a cubic frequency chirp component and an exponential frequency chirp component.

6. The method according to at least one of the preceding claims, wherein: The intensity function depends on the first encoder value of at least two first bits of the encoder initial bit sequence; and / or the phase function depends on the second encoder value of at least two second bits of the encoder initial bit sequence.

7. The method according to at least one of the preceding claims, wherein: The pulse length of each optical pulse is 1 ns to 1000 ns, preferably 50 ns to 200 ns, more preferably 80 ns to 120 ns.

8. A decoding method for quantum key distribution, the method being performed in a receiver device (12) having a classical processor (12a) and means for receiving and measuring quantum signals, the method comprising: - receiving a quantum signal comprising a plurality of optical pulses from a transmitter device (11) via a quantum channel (10a); - determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising performing at least one of the following for each optical pulse: - determining an approximate intensity curve of the optical pulse by measuring a plurality of intensity values ​​of the optical pulse for a plurality of time bins, and determining a first decoder value of at least one first bit of the decoder initial bit sequence from the approximate intensity curve, and - determining an approximate phase curve of the optical pulse by measuring a plurality of phase values ​​of the optical pulse for a plurality of time bins, and determining a second decoder value of at least one second bit of the decoder initial bit sequence from the approximate phase curve; as well as - determining a shared key shared between the transmitter device (11) and the receiver device (12) based on the decoder initial bit sequence by classical post-processing and at least one of receiving classical information from the transmitter device (11) and transmitting another classical information to the transmitter device (11).

9. The method according to claim 8, wherein: - determining the first decoder value comprises comparing the approximate intensity curve with an ideal approximate intensity curve; and / or - Determining the second decoder value comprises comparing the approximated phase curve with an ideal approximated phase curve.

10. The method according to claim 9, comprising at least one of the following: - determining a first measured correlation factor difference from the approximate strength curve and the ideal approximate strength curve, and determining the first decoder value by comparing the first measured correlation factor difference with a first threshold; and - determining a second measured correlation factor difference from the approximate phase curve and the ideal approximate phase curve, and determining the second decoder value by comparing the second measured correlation factor difference with a second threshold.

11. The method according to at least one of the preceding claims, further comprising determining an optical signal loss along the quantum channel (10a), preferably the optical signal loss being dependent on the position along the quantum channel (10a).

12. A method for quantum key distribution, the method being implemented in a system, the system comprising: - a transmitter device (11) having a classical processor (11a) and means for preparing and transmitting a quantum signal; as well as - a receiver device (12) having a further classical processor (12a) and means for receiving and measuring quantum signals, The method comprises: - generating an encoder initial bit sequence in said transmitter device (11); - In the transmitter device (11), generating a quantum signal comprising a plurality of optical pulses according to the encoder initial bit sequence, wherein generating each of the plurality of optical pulses comprises at least one of the following: - modulating the intensity profile of the optical pulses according to an intensity function that is time-dependent and that depends on a first encoder value of at least one first bit of the encoder initial bit sequence, and - modulating the phase curve of the optical pulses according to a phase function that depends on time and on a second encoder value of at least one second bit of the encoder initial bit sequence; - transmitting the plurality of optical pulses from the transmitter device (11) to the receiver device (12) via a quantum channel (10a) and receiving the plurality of optical pulses in the receiver device (12); - determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising performing at least one of the following for each optical pulse: - determining an approximate intensity curve of the optical pulse by measuring a plurality of intensity values ​​of the optical pulse for a plurality of time bins, and determining a first decoder value of at least one first bit of the decoder initial bit sequence from the approximate intensity curve; and - determining an approximate phase curve of the optical pulse by measuring a plurality of phase values ​​of the optical pulse for a plurality of time bins, and determining a second decoder value of at least one second bit of the decoder initial bit sequence from the approximate phase curve; and - determining a shared key shared between the transmitter device (11) and the receiver device (12) in the transmitter device (11) based on the encoder initial bit sequence and in the receiver device (12) based on the decoder initial bit sequence by classical post-processing and at least one of transmitting classical information from the transmitter device (11) to the receiver device (12) and transmitting another classical information from the receiver device (12) to the transmitter device (11).

13. A transmitter device (11) for quantum key distribution, comprising a classical processor (11a) and means for preparing and transmitting a quantum signal, and configured to perform the following steps: -Generate encoder initial bit sequence; - generating a quantum signal comprising a plurality of optical pulses according to the encoder initial bit sequence, wherein, Generating each optical pulse in the plurality of optical pulses comprises at least one of: - modulating the intensity profile of the optical pulses according to an intensity function that is time-dependent and that depends on a first encoder value of at least one first bit of the encoder initial bit sequence, and - modulating the phase curve of the optical pulse according to a phase function that depends on time and on a second encoder value of at least one second bit of the encoder initial bit sequence, - transmitting the plurality of optical pulses to a receiver device (12) via a quantum channel (10a); as well as - determining a shared key shared between the transmitter device (11) and the receiver device (12) based on the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device (12) and receiving another classical information from the receiver device (12).

14. A receiver device (12) for quantum key distribution, the receiver device comprising a classical processor (12a) and means for receiving and measuring a quantum signal, and configured to perform the following steps: - receiving a quantum signal comprising a plurality of optical pulses from a transmitter device (11) via a quantum channel (10a), - determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising performing at least one of the following for each optical pulse: - determining an approximate intensity curve of the optical pulse by measuring a plurality of intensity values ​​of the optical pulse for a plurality of time bins, and determining a first decoder value of at least one first bit of the decoder initial bit sequence from the approximate intensity curve, and - determining an approximate phase curve of the optical pulse by measuring a plurality of phase values ​​of the optical pulse for a plurality of time bins, and determining a second decoder value of at least one second bit of the decoder initial bit sequence based on the approximate phase curve; and - determining a shared key shared between the transmitter device (11) and the receiver device (12) based on the decoder initial bit sequence by classical post-processing and at least one of receiving classical information from the transmitter device (11) and transmitting another classical information to the transmitter device (11).

15. A system for quantum key distribution, comprising: - a transmitter device (11) having a classical processor (11a) and means for preparing and transmitting a quantum signal; as well as - a receiver device (12) having a further classical processor (12a) and means for receiving and measuring quantum signals, The system is configured to perform the following steps: - generating an encoder initial bit sequence in said transmitter device (11); - In the transmitter device (11), a quantum signal comprising a plurality of optical pulses is generated according to a first initial bit sequence, wherein generating each of the plurality of optical pulses comprises at least one of the following: - modulating the intensity profile of the optical pulses according to an intensity function that is time-dependent and that depends on a first encoder value of at least one first bit of the encoder initial bit sequence; and - modulating the phase curve of the optical pulse according to a phase function that depends on time and on a second encoder value of at least one second bit of the encoder initial bit sequence, - transmitting the plurality of optical pulses from the transmitter device (11) to the receiver device (12) via a quantum channel (10a) and receiving the plurality of optical pulses in the receiver device (12); - determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising performing at least one of the following for each optical pulse: - determining an approximate intensity curve of the optical pulse by measuring a plurality of intensity values ​​of the optical pulse for a plurality of time bins, and determining a first decoder value of at least one first bit of the decoder initial bit sequence from the approximate intensity curve, and - determining an approximate phase curve of the optical pulse by measuring a plurality of phase values ​​of the optical pulse for a plurality of time bins, and determining a second decoder value of at least one second bit of the decoder initial bit sequence based on the approximate phase curve; and - determining a shared key shared between the transmitter device (11) and the receiver device (12) in the transmitter device (11) based on the encoder initial bit sequence and in the receiver device (12) based on the decoder initial bit sequence by classical post-processing and at least one of transmitting classical information from the transmitter device (11) to the receiver device (12) and transmitting another classical information from the receiver device (12) to the transmitter device (11).

Images