1. INTRODUCTION

Nowadays, the Internet has been ubiquitous in our daily life and is mainly secured by public-key cryptography, the security of which is still based on computational assumptions and thus will be rendered insecure by substantial progress in algorithms and hardware ^[1]. Unlike conventional cryptography, the security of quantum key distribution (QKD) is based on the fundamental laws of physics, and it promises to realize unconditional secure communication. After more than three decades’ development, QKD has not only gained remarkable achievements both theoretically and experimentally ^{[2–6" target="_self" style="display: inline;">–6]}, but also enjoyed great success in engineering ^[7] and commercialization ^[8,9]. A feasible global-scale quantum communication network might be based on satellite-ground QKD, a simple prototype of which has been demonstrated recently ^[10]. The future QKD Internet consists of the satellite-based QKD ^[11], the fiber backbone QKD network ^[7], the metropolitan QKD network ^[12,13], and the quantum access network ^[14]. The last one aims at offering the last-mile service to multiple end users, for which cost is a key consideration. Therefore, though there has been significant improvement in the performance of QKD systems, such as transmission distance ^[15,16] and key rate ^[17], it is still necessary to develop low-cost QKD systems that can offer enough security at an acceptable price for last-mile applications ^[18,19].

Meanwhile, it has been rigorously proven that QKD can provide unconditional security in principle ^{[2022" target="_self" style="display: inline;">–22]}, yet the real-life implementations always deviate from the ideal protocol. For example, the single-photon source required by the original BB84 protocol is usually replaced by highly attenuated lasers that can generate weak coherent pulses in actual QKD systems, which makes the systems vulnerable to powerful eavesdropping attacks, including the photon-number-splitting attack ^[23,24], and thus only signals originating from single-photon pulses are guaranteed to be secure. Though the two users of QKD, Alice and Bob, only need to estimate a lower bound for the detection events by Bob that have originated from single-photon signals emitted by Alice, instead of identifying which particular detected pulses originated from single-photon emissions, this estimation procedure must assume the worst-case scenario in which the eavesdropper, Eve, blocks as many single-photon pulses as possible, resulting in severe reduction of the system’s performance ^[25]. Fortunately, the decoy-state method can provide good bounds by noticing the existence of Eve and enables the QKD systems with weak coherent pulses to basically reach the performance of the QKD systems with single-photon pulses ^{[26–30" target="_self" style="display: inline;">–30]}.

In our QKD system, we replace the commonly used laser diodes (LDs) with LEDs, because the latter have the potential to cost much less and are easier to integrate than the former. We also multiplex a cheap commercial InGaAs single-photon detector with the help of a simple optical path delay module, which will be explained in detail in the next section ^[31]. Apart from that, we apply a QKD scheme that combines a biased basis choice with the decoy-state method, which can simplify the system by decreasing the number of diodes. What is more, we select 1310 nm as the transmission wavelength instead of 1550 nm, which is normally selected for fiber QKD systems, because it opens the door to share the fiber link with traditional telecommunication ^[32,33]. Last but not least, all the devices at the sender side are passive components, which not only cost much less than active components but also improve the system’s potential for integration. Therefore, we successfully establish a QKD system that has the potential to cost much less than existing QKD systems and be integrated in the future.

2. FEATURES OF OUR QKD SYSTEM

2.1 A. Usage of LEDs as Optical Sources

LDs are usually employed as optical sources in a QKD system. In fact, compared with LDs, LEDs have much simpler structures and can be integrated more easily. To further study whether LEDs are suitable sources for a QKD system, we need to study their optical properties.

Unlike the polarized light from LDs, the light from an LED is nonpolarized, yet can be easily converted into polarized light by using common optical devices like polarizers.

To confirm the photon number distribution of the optical pulses from the LEDs in our QKD system, we have tested their g(2)(0), the second-order correlation function of the photons when the time delay between the two photons exiting, respectively, from the two out ports of the beam splitter (BS) is zero. For light that obeys thermal distribution, g(2)(0) equals 2, while for light that obeys Poisson distribution, g(2)(0) equals 1. The test results show that the value of g(2)(0) for all LEDs is near 1, which means that the optical pulses from all LEDs basically obey Poisson distribution.

As we all know, for a QKD system with multiple optical sources, uniformity between different sources in all degrees of freedom apart from the one that is encoded should be examined strictly, in order to avoid side-channel attacks. Generally, the following degrees of freedom should be considered for photons: spectrum, temporal pattern, polarization, spatial mode, and intensity.

The spectrum of an LED is much broader than that of an LD. In our system, a good spectral indistinguishability is realized without any temperature control measures, just by letting optical pulses from different LEDs pass through a cheap fiber Bragg grating (FBG) with an FWHM of around 0.2 nm, since the filtered spectra depend much more on the filter than on LEDs’ original spectra, which are very broad and normally with an FWHM of around 30 nm. The spectra between different LEDs employed in our system differ very greatly from each other before being filtered. But after filtering by the FBG, their spectra are almost the same, which can be seen from Fig. 1. This gives QKD systems with LEDs as optical sources a potential advantage in terms of the complexity, size, and power budget of the system.

Fig. 1. Optical spectra of the LEDs employed in our system after they are filtered by an FBG.

下载图片 查看所有图片

LEDs’ temporal indistinguishability is not as good as that of LDs. Figure 2 shows the temporal patterns of optical pulses from different LEDs. The temporal indistinguishability between different LEDs is not as good as the spectral indistinguishability in our system. The temporal patterns are determined by not only the driving circuits, but also the characteristics of LEDs.

Fig. 2. Temporal patterns of optical pulses from different LEDs.

下载图片 查看所有图片

Also, in our experiment, information is encoded on the polarization degree of freedom, and the visibility can be as good as 99.5%. And all optical pulses are transmitted through single-mode fiber, which means that they have the same spatial mode. The intensity can be regulated by adjusting the driving circuits and intensity attenuators, and also our QKD system applies the random modulated decoy-state method. In that sense, the intensity degree of freedom cannot be utilized for attacking.

2.2 B. Employment of the Decoy-State QKD Protocol with Biased Basis Choice

In the most widely used QKD protocol—the BB84 protocol, both Alice and Bob choose for each pulse between X and Z bases randomly, uniformly (that is, with equal probability), and independently, which means that only half the time they choose the same basis for the pulses, and the key can only be extracted in this case. In other words, the basis-sift factor is 1/2 in the original BB84 protocol. The efficient BB84 scheme proposed by Lo et al. can raise the basis-sift factor to near 100% in the infinitely long key limit ^[34]. And in this scheme, both Alice and Bob choose for each pulse between X and Z bases unevenly.

In our system, we employ a QKD scheme proposed in Ref. ^[35], which combines a biased basis choice with the decoy-state method. In this scheme, Alice sends out pulses with three different intensities, vacuum states (with an intensity of 0), weak decoy states (with an intensity of ν), and signal states (with an intensity of μ). The procedure of this scheme is as follows. (1)

Alice prepares Ntotal pulses, where Ntotal=Nμ+Nνz+Nνx+N0.(a)

Alice prepares Nμ signal pulses (μ) in the Z basis.

Compared to the original vacuum+weak decoy-state method, this scheme can cut down on diodes and thus simplify the system, since the signal pulses are only prepared in the Z basis.

3. OUR SETUP

To put the theoretical method into a real scenario, we build a QKD system with LEDs as its sources. Our setup is shown schematically in Fig. 3. The sender (Alice) and the receiver (Bob), are connected with a 1-km-long optical fiber coil. Both signal and decoy pulses are sent from Alice to Bob through this fiber coil and then detected at Bob’s side by an InGaAs single-photon detector.

Fig. 3. Schematic of our QKD system. PMBS, polarization-maintaining beam splitter; PMPBS, polarization-maintaining polarization beam splitter; BS, beam splitter; FBG, fiber Bragg grating; SMBS, single-mode beam splitter; PBS, polarization beam splitter; TDC, time-to-digital converter.

下载图片 查看所有图片

As shown in Fig. 3, the optical pulses in our experiment are produced by six LEDs, which are controlled by a field programmable gate array (FPGA). At the beginning, the master computer injects pseudo-random numbers into the FPGA, and then the FPGA stores them in an synchronous dynamic random-access memory (SDRAM). Each time, the FPGA reads a random number from the SDRAM and then decodes it. After that, FPGA sends out a digital signal to a corresponding driving circuit, according to the random number. There are six identical and independent driving circuits, corresponding to six LEDs, respectively. And these circuits can convert the digital signals from FPGA into analogous signals, which can make LEDs produce pulsed light. There is generally no difference between the driving electronics of LEDs and that of LDs. It is just that an LED can emit light as soon as electricity flows through it, while an LD can only emit laser light when the electric current exceeds the threshold current.

Following the scheme that has been previously introduced, each of four LEDs is utilized to produce a decoy pulse in one of the four BB84 states, the horizontal polarization state, the vertical polarization state, the +45° polarization state, and the −45° polarization state, while the remaining two LEDs are utilized to produce signal pulses in the horizontal state and the vertical state, respectively. After each diode, there is a polarizer to transform the nonpolarized light directly produced by an LED into polarized light. The proportion of the vacuum pulse, the decoy pulse, and the signal pulse is 0.02, 0.10, and 0.88, respectively. The average photon number per pulse for the vacuum pulse, the decoy pulse, and the signal pulse is set as 0, 0.1, and 0.4, respectively, and controlled by an attenuator after each polarizer. After that, all six kinds of pulses are coupled together by a series of BSs and polarization beam splitters (PBSs). And before entering the optical fiber coil, each pulse is filtered by an FBG. It should be mentioned that the two input ports of the BS before the FBG are made of polarization-maintaining fiber, and one input port is rotated by 45° so that the pulses in the Z basis are separated from the pulses in the X basis by 45° after exiting the BS.

At Bob’s side, the optical pulses that have passed through the fiber coil are first split by a 90/10 single-mode beam splitter (SMBS). Ninety percent of the pulses go into the Z basis and are then split by a PBS, PBS No. 1, into the horizontal state and the vertical state, while the rest go into the X basis and are then split by another PBS, PBS No. 2 into the +45° state and the −45° state. The bases are adjusted by two polarization controllers (PCs) that connect one output port of the SMBS with one PBS, respectively. Normally, each of the four output ports of PBS No. 1 and No. 2 should be directly linked to a detector, but in our system, the optical pulses in all four states should be coupled before entering the only detector that is employed. The InGaAs detector used in our system is provided by CTek, with a fixed repetition rate of 40 MHz, which equals a period of 25 ns, while the system repetition rate is 10 MHz, which equals a period of 100 ns. One system period contains four detection periods, which are distributed to four BB84 polarization states, respectively. Therefore, the optical pulses in all four BB84 polarization states should not only be coupled, but also have an interval of 25 ns between each other before entering the detector. After exiting PBS No. 1, the pulses in the vertical state pass through a delay polarization-maintaining fiber (Fiber No. 1) that is around 5 m long before entering PBS No. 3, while the pulses in the horizontal state enter PBS No. 3 directly, so that there is an interval of 25 ns between the two states after exiting PBS No. 3. The pulses in the +45° state and the −45° state are arranged in the same way. After exiting PBS No. 3, pulses in the horizontal state and the vertical state pass through a delay fiber (Fiber No. 3) that is around 10 m long before entering a 50/50 SMBS, while pulses in the +45° state and the −45° state directly enter the SMBS after exiting PBS No. 4, so that pulses in all four BB84 polarization states have an interval of 25 ns between each other after exiting this SMBS. Then the output port of the SMBS is linked to the detector. Also, it should be mentioned that, all ports of PBS No. 1, No. 2, No. 3, and No. 4 are made of polarization-maintaining fiber.

4. CALCULATION OF THE FINAL KEY

According to Ref. ^[35], the final key generation rate of our QKD system is given by where q is the raw data sift factor, the product of the basis-sift factor pz and the signal-state ratio Nμ/Ntotal; Iec and Ipa are the key consumption for error correction and privacy amplification, respectively; f(x) is the error correction efficiency as a function of error rate and is set as 1.22 for our QKD system; Qμz and Eμz are the overall gain and quantum bit error rate (QBER) of signal states, respectively; Y1z, Q1z, and e1pz are the yield, gain, and phase error rate of the single-photon states in the Z basis, respectively; and H(x)=−xlog2(x)−(1−x)log2(1−x) is the binary Shannon entropy function. The gain Qμz and QBER Eμz can be measured from the experiment directly. Therefore, a simple way to get a lower bound of the final key rate is to get the lower bound of Y1z and upper bound of e1pz simultaneously.

According to Ref. ^[35], the lower bound of Y1z in our experiment is given by where Qνz is the overall gain of the decoy states in the Z basis, which can also be directly measured in the experiment; Y0z is the background rate in the Z basis, which can be estimated through the vacuum decoy state in the Z basis. The phase error rate in the Z basis e1pz cannot be measured directly, but can be inferred from the bit error rate in the X basis e1bx=e1pz ^[21].

According to Ref. ^[35], the upper bound of e1bx is given by where Qνx and Eνx are the overall gain and QBER of decoy states in the X basis, respectively, which can both be measured directly from the experiment; e0x is the error rate of the dark count in the X basis, which equals 1/2; Y0x is the background rate in the X basis, which can be estimated through the vacuum decoy state in the X basis; and Y1x is the yield of the single-photon states in the X basis.

However, in the scheme ^[35] employed by our QKD system, the signal states are only prepared in the Z basis, so we cannot get the lower bound of Y1x in the same way as we get the lower bound of Y1z. Luckily, there is a relation between Y1z and Y1x. The original scheme ^[35] only considered the case of active basis choice at Bob’s side, and in this case, Y1z equals Y1x. But in our system, the basis is chosen passively by an unbalanced BS at Bob’s side, and in this case, the relation between Y1z and Y1x is given by It should be mentioned that, in the case of passive basis choice by an unbalanced BS at Bob’s side, the counts in the X basis are lower than those in the Z basis, which means that the background noise has a greater impact on the X basis, so the phase error rate e1pz of our system is actually overestimated if we apply Eq. (3) to calculate it. Therefore, the lower bound of key rate is underestimated in our calculation, but obviously the security of the system is still guaranteed in this case. Also, we must consider the effect of finite data set size in real-life experiments on the estimation process for Y1z and e1pz ^[36,37], and we set the statistical failure probability as 10−10 in our experiment.

The theoretical simulation result of the relation between the key rate and the total transmission distance is shown in Fig. 4.

Fig. 4. Theoretical simulation result of the key rate versus the transmission distance (dark gray filled cubes) and the experimental result of the key rate at the transmission distance of 1 km (red filled circle).

下载图片 查看所有图片

In the experiment, we accumulate data for 1000 s, which corresponds to 1010 transmitted pulses at Alice’s side, since the system repetition is 10 MHz. The directly measured parameters and some calculated parameters are shown in Table 1. The calculated key rate per pulse is 0.00109. Therefore, we obtain a final key rate of 10.9 kHz, which fits the theoretical simulation results very well, as shown in Fig. 3.

5. SUMMARY

The performance of our system is not as good as other recent QKD implementations in terms of the maximal transmission distance and the final key rate. Yet, this is mainly due to the poor performance of our detector, not the usage of LEDs. The detector we apply in our system is a commercial InGaAs single-photon detector supplied by CTek ^[8]. In our implementation, its specifications are as follows: the maximal repetition rate is 40 MHz; the efficiency is around 12%; the dark count rate is around 10−4/gate; the dead time is 5 μs. The performance of this detector is mediocre, so that if we replace it with a better and certainly more costly detector, the maximal transmission distance and the final key rate can be easily increased. Yet the purpose of our work is to demonstrate the feasibility of a low-cost system, which aims at offering the last-mile service to multiple end users, for which cost is a key consideration. So we should do all we can do to make the best of every component, especially the detector, which obviously takes up much of the system’s cost. We think that a transmission distance of a few kilometers and a secure key rate of around 10 kbps can meet the demand of the last-mile secure communication, so we stay with this detector in our implementation and make the most of it.

In summary, we have successfully established a QKD system that employs LEDs as optical sources, for the reason that LEDs have much simpler structures, are easier to integrate, and have the potential to cost much less than commonly used LDs; we also multiplex the InGaAs detector and employ a scheme that combines the efficient scheme with the decoy-state method to simplify the system and lower the total cost of it; what is more, we select 1310 nm as the transmission wavelength, so that our QKD system can share the fiber link with traditional telecommunication, which can greatly reduce operating expenses in the future. Eventually, we obtain a final key rate of 10.9 kHz over a 1-km-long fiber coil.

6 Acknowledgment

Acknowledgment. We thank Y. Li and L.-H. Sun for experimental assistance.