1.

INTRODUCTION

Quantum key distribution (QKD) over satellite-to-ground optical links provides a way to establish a secure key for cryptographic purposes between two or more sites without deploying costly terrestrial network infrastructure.¹ Furthermore, entanglement-based QKD protocols allow legitimate users to treat the satellite as an untrusted node by verifying quantum correlations between photons emitted from an onboard source of non-classical light. Inherently low brightness of such sources^{2, 3} combined with substantial propagation losses makes it of paramount importance to use efficiently the photon flux reaching the receive terminals.^{4, 5} In this paper we present and analyze theoretically a method to extract multiple secret key bits from detection of individual photon pairs using qubit-based QKD protocols, such as E91⁶ or BBM92.⁷ The essential advantage of qubit-based QKD protocols is thorough theoretical understanding of their security.⁸

The method presented here is based on scalable encoding of m logical qubits into a single photon prepared as a superposition of 2^m time slots. Quantum states of individual qubits can be read out using a cascade of interferometric stages in a manner analogous to the recently proposed receiver for photon-efficient classical communication with BPSK signals.^{9, 10} As increasing the number of logical qubits encoded in one photon may augment the detrimental effects of broadband background optical radiation on the detected quantum correlations, we use a simple model to identify the optimal operating point determined by the attenuation of the satellite-to-ground optical channels and the background noise strength. Based on the parameters of the MICIUS mission,^{11, 12} numerical results indicate the potential of multiqubit encoding for a nearly tenfold increase of the attainable key rate for entanglement-based LEO satellite QKD systems.

This paper is organized as follows. Sec. 2 describes the concept of multiqubit encoding. The scalable optical receiver in the form of a cascade of interferometric stages decoding the qubit states is presented in Sec. 3. Implementation of a multiqubit QKD protocol in the presence of background noise is modelled in Sec. 4 and optimized in Sec. 5. Finally, Sec. 6 concludes the paper.

2.

MULTIQUBIT ENCODING

The principle of multiqubit encoding is shown schematically in Fig. 1(a). Suppose that a single photon occupies one of 2^m temporal slots. The kth temporal slot, where k = 0,1,…, 2^m – 1, corresponds to a combination of basis states |0⟩ or |1⟩ for each one of m logical qubits. The states of individual qubits are specified by digits in a binary string representing the integer k, as exemplified in Fig. 1(b). This map ping is naturally extended to superposition states. In particular, logical qubits prepared in equatorial states that are equally weighted superpositions of |0⟩ and |1⟩ correspond to the photon uniformly distributed across all 2^m slots. The phases φ_j of the equatorial states define a hierarchy of relative phases between temporal slots depicted in Fig. 1(c). As illustrated in Fig. 1(d), a combination of basis states and equatorial states, the latter taken for concreteness as , is represented by the photon occupying only some of the temporal slots.

Figure 1.

Encoding of multiple logical qubits into a single photon prepared as a superposition of temporal slots. (a) The slot number written in the binary representation specifies the basis states of individual qubits. (b) The presence of a photon in a single temporal slot corresponds to a product of qubit basis states. (c) An equally weighted superposition of a photon across all the slots with a hierarchy of relative phases is isomorphic to a product of equatorial states . (d) An example of a combination of a product state and two equatorial states . (e) A pair of photons, labeled with A and B, prepared in an entangled state with one-to-one correlations between individual temporal slots.

The above encoding is generalized in a straightforward manner to pairs of photons, labelled in Fig. 1(e) with indices A and B. Suppose that the two photons are generated in a quantum mechanical pure state such that the temporal locations of individual photons across all the 2^m slots are totally random, but they are perfectly correlated up to single slots. Such a state is formally equivalent to a set of m qubit pairs, each pair prepared in a maximally entangled state . In order to utilize this resource for a qubit-based QKD protocol, one needs a receiver implementing projection of individual logical qubits onto superposition states.

3.

SCALABLE RECEIVER

The basic idea of the scalable receiver is to read out the states of individual logical qubits using a cascade of interferometric stages.¹³ As depicted in Fig. 2(a), each stage acts as a beam splitter in the temporal domain, combining the optical field in pairs of adjacent time intervals. At the output of the cascade shown in Fig. 2(b), detecting the photon in a given temporal slot corresponds to projecting each of the logical qubits onto one of the two states constituting the measurement basis for that qubit. Importantly, the measurement basis can be selected independently for each of the logical qubits by an appropriate choice of the phase and the splitting ratio of the corresponding stage.

Figure 2.

(a) An interferometric stage acting as a beam splitter combining the optical field in two adjacent time intervals of duration T. The parameters φ and θ determine the field transformation realized by the beam splitter. (b) Transformation introduced by a cascade of interferometric stages. With a suitable choice of beam splitter parameters, orthogonal pairs of states of logical qubits are bijectively mapped onto the temporal position of the photon at the output of the cascade. (c) Implementation of an interferometric stage based on polarization switching and polarization-dependent delay lines. PM, phase modulator; HWP, half-wave plate; PBS, polarizing beam splitter.

A possible realization of an interferometric module based on polarization switching, polarization-dependent delay lines, and birefringent elements is shown in Fig. 2(c). Unless adaptive optics is used in the receive telescope, the interferometers need to tolerate wavefront distortions introduced by atmospheric turbulence. Spatially multimode delay-line interferometers have been demonstrated in the context of space-to-ground optical communication links using the DPSK format¹⁴ as well as time-bin qubit QKD over free-space channels.^{15, 16}

4.

BACKGROUND NOISE

In practice, the number of logical qubits that can be usefully encoded into the temporal degree of freedom of single photons is limited by the effects of background radiation. Consider a model where the source produces entangled photon pairs at a rate R_source and the acceptance bandwidth of the spectral filter at the receiver entrance is adjusted in line with the slot rate, i.e. inversely with the slot duration. If broadband background radiation contributes to the incoming optical signal, the amount of noise allowed in by the filter can be then treated as independent of the slot duration. Let n_b denote the mean number of background photons per slot. Further analysis will be carried out in the regime n_b << 1, typical for space communication systems operated at optical frequencies.

Let the power transmission of the optical channels from the source to each of the ground stations be equal and given by η << 1. This parameter can incorporate also the signal attenuation introduced by the transmit and receive optics as well as the non-unit efficiency of photodetectors. Further, let p_pair be the probability of generating a photon pair within a frame of 2^m slots. The leading-order contributions to the event rate R_event originate from coincidences between pairs of signal photons, η²R_Source, coincidences between signal and background photons, 2·2^mn_b·η·R_source, coincidences between pairs of background photons, , and coincidences triggered by double photon pairs, 2 · η² · p_pair · R_source. Altogether this gives:

Assuming symmetric collective attacks and ideal one-way postprocessing, the asymptotic key rate for qubit-based QKD protocols considered here reads:⁸

where H (x) = –x log₂ x – (1 – x) log₂ (1 – x) is the binary entropy function and QBER stands for the quantum bit error rate. In the scenario under consideration, coincidences occurring between signal and background photons as well as those produced by pairs of background photons generate errors with the probability 50%. Furthermore, non-ideal optical interference in the receiver stages can be described¹⁰ by a visibility parameter V ≤ 100%. If the logical qubits are measured in equatorial bases, a coincidence between two signal photons will also contribute to the QBER with the probability (1 – V²)/2. Finally, double pairs produce 50% error probability if photons from different pairs are detected, and (1 – V²)/2 error probability if photons from the same pair make it to the receiver, which yields the average error probability in this case equal to . Consequently one has:

Note that the channel transmission η and the background noise strength n_b enter the above expression through the ratio n_b/η. In order to ensure a positive key rate one needs H(QBER) < 1/2, which translates to a very good approximation into a 11% threshold for the QBER at which quantum key distribution becomes impossible.

5.

OPTIMIZATION

Further analysis will assume that the pair production rate R_source is independent of the slot duration. A useful performance metric is the amount of the cryptographic key per one detected signal photon pair, given by the ratio R_key/(η²R_source). This quantity depends on the ratio n_b/η, the pair probability p_pair, the visibility V of the interferometric modules in the receiver, as well as the number m of logical qubits encoded in one photon. Fig. 3(a-c) depicts the result of optimizing the ratio R_key/(η²R_source) over an integer m as a function of n_b/η for visibilities V = 100%, 99%, and 98% and the pair generation probability p_pair = 10^-2. It is seen that with a diminishing noise contribution the benefit of multiqubit encoding becomes more substantial. As seen in Fig. 3(d-f), the optimal QBER stays at low single-digit percents which corresponds to high key contents per logical qubit. Non-unit visibility in the interferometric receiver has rather substantial effect on the attainable key rate.

Figure 3.

The key rate per one detected signal photon pair for the interference visibilities (a) V = 100%; (b) V = 99%; (c) V = 98% shown along with the optimal number of logical qubits m* as a function of the ratio n_b/η which specifies the relative probability of detecting a background photon within one slot with respect to detecting a signal photon. The probability of producing a photon pair within one frame is p_pair = 10⁻². (d-f) The quantum bit error rate QBER for the optimal m* and the resulting key amount in bits per one logical qubit.

Fig. 4 shows the actual key rate for the source brightness R_source = 5.6 · 10⁶ pairs/s as a function of the channel transmission η and the background noise strength n_b for the interference visibilities V = 100%, 99%, and 98%. Regions corresponding to a given optimal number m* of logical qubits are separated with white solid lines. The symbols “+” and “x” indicate respectively the best- and the worst-case operating conditions of the MICIUS mission^{11, 12} assuming that the time-bandwidth area selected by the receiver filter is equal to ten. It is seen that up to tenfold improvement in the key rate is possible, but this requires nearly ideal operation of the interferometric receiver.

Figure 4.

The key rate in bits per second for the source brightness R_source = 5.6 · 10⁶ pairs/s as a function of the optical channel transmission η and the background noise strength n_b for the interferometric visibility of the receiver stages: (a) V = 100%; (b) V = 99%; (c) V = 98%. White lines separate regions corresponding to a given optimal number m* of logical qubits. The symbols “+” and “x” indicate respectively the best- and the worst-case operating conditions of the MICIUS mission assuming that the time-bandwidth area selected by the receiver filter is equal to ten.

6.

CONCLUSIONS

Scalable multiqubit time-bin encoding offers a method to boost the key rate in QKD scenarios limited by the brightness of sources of entangled photon pairs. Importantly, the key security can be analyzed using the well established theory developed for qubit-based protocols. It should be noted that this approach to security analysis makes rather conservative assumptions regarding eavesdropping strategies that can be pursued by the adversary. Further increase in key rates may be achieved by implementing QKD protocols designed for higher-dimensional discrete systems.^17–19

Close attention needs to be paid to the design of entangled photon pair sources to ensure high production rates and good quality of quantum correlations.^20–23 The source characteristics should be matched by signal filtering at the receiver entrance to reduce as much as possible the contribution of background noise without substantial attenuation of the signal photon flux. Performance trade-offs inherent to conventional time-frequency filters²⁴ could be in principle relaxed by currently explored techniques for nonlinear coherent filtering.²⁵