simply measuring the time-of-arrival of photons and is thus insensitive to optical

errors [16]. This concept will be established in the following COW protocol where

the Y basis is replaced by the Z basis, the X basis being used only occasionally to

check coherence [48].

Now Fig. 6.3 comes into play. Alice™s CW laser diode (1550 nm) together with

the intensity modulator either prepares pulses of coherent states of mean photon

number μ or completely blocks the beam (empty or “vacuum” pulses). The source

pulses leaving Alice™s laboratory with encoded information form a sequence of

coherent states. In particular, the protocol exploits the coherence between any pair of

subsequent pulses. The kth logical bits 0 and 1 are encoded in two-pulse sequences

√

which can be written in each case as a product of a coherent state | μ and an

empty state |0 leading to

√ √

√ √

|0k = | μ |0 , |1k = | 0 2k’1 | μ . (6.4)

2k’1 2k 2k

Note that in Eq. (6.4) the states |0k and |1k are not orthogonal because coherent

states are not orthogonal by nature. A time-of-arrival measurement, whenever con-

clusive, provides the optimal unambiguous determination of the bit value [28]. To

check coherence, a fraction f 1 of decoy sequences is produced which can be

√

√

written as a tensor product | μ 2k’1 | μ 2k . Now due to the very narrow-banded

CW laser including a large coherence length there is a well-de¬ned phase between

any two non-empty pulses within both, each decoy sequence but also across the bit

separation [a (1 ’ 0)’ bit sequence]. Since equally spaced pulses are produced,

the coherence of both, decoy and (1 ’ 0)- bit sequences, can be checked with a

single interferometer. Eve cannot count the number of photons in any ¬nite number

of pulses without introducing errors: photon number splitting (PNS) attacks can

be detected [28]. This is in contrast to the BB84 protocol where PNS attacks are

repelled by a decoy-state technique, which consists in varying μ [42, 83, 49].

The pulses propagate to Bob through a quantum channel characterized by a trans-

mission t and are split at a [t B : (1 ’ t B )]’ beam splitter with a transmission

1 (e.g. t B = 0.9 ). Only about 10% of the pulses are re¬‚ected

coef¬cient t B

into Bob™s interferometer (monitoring line) which is destined to check quantum

coherence. The pulses that are transmitted with about 90% (data line) are used to

establish the raw key by measuring the times of arrival. The counting rate at detector

D B is R = 1 ’ e’μtt B · ≈ μtt B · , where · is the quantum ef¬ciency of the photon

counter (between 5 and 15%) and μ ≈ 0.1’0.5 . Dark counts and limited ef¬ciency

of the detectors have to be taken into account.

The phase shift • in Bob™s interferometer is adjusted in such a way that within

the time slots (dashed lines in Fig. 6.3) only detector D M1 clicks for regular two-

pulse sequences (logical bits 0 or 1). When both pulses are non-empty [decoy

sequence or a (1 ’ 0)-bit sequence] detector D M2 can ¬re as well at a time where

only D M1 should have ¬red [78] resulting in a reduced visibility (both detectors

¬re). Here coherence can be quanti¬ed by Alice and Bob through the visibility

6 QKD Systems 105

p (D M1 ) ’ p (D M2 )

V= , (6.5)

p (D M1 ) + p (D M2 )

where p (D M j ) is the probability that detector D M j ¬res. These probabilities are

small, the average detection rate on the monitoring line being ∝ μt(1 ’ t B )· per

pulse. However, if the bit rate is high, enough counting rates can be achieved in a

reasonable time. The interferometer is only used to estimate the information of the

eavesdropper and cannot introduce errors on the key.

The system is tolerant to reduced visibility and robust against PNS attacks. The

system is insensitive to polarization ¬‚uctuations in ¬ber. One other advantage is that

standard telecom components can be used.

The protocol can be summarized as follows:

1. Alice sends a large number of sequences of “logical bit 0” and “logical bit 1,”

both with probability 1’ f , and “decoy sequences” with probability f 1.

2

2. Bob, after reception of the sequences, reveals for which bits he obtained detec-

tions on D B in the data line (raw key) and when the detector D M2 has ¬red in

the monitoring line.

3. Alice tells Bob which bits he has to remove from his raw key, since those bits

are due to the detections of decoy sequences (sifting).

4. Alice analyzes the detections in Bob™s detector D M2 . She estimates the break of

coherence through the visibilities V(1’0) (coherence across a bit separation) and

Vd (decoy sequences) and computes Eve™s information. It is considered as a part

of the protocol that Alice and Bob reject the key unless Vd = V(1’0) .

5. Alice and Bob run error correction and privacy ampli¬cation ending up with a

secret key.

Proving the security of the COW protocol remains a work in progress. The stan-

dard methods for proving the security of QKD protocols were, so far, developed

for protocols in which the quantum symbols are sent one by one (e.g., qubits in

the BB84, B92, six-state protocols [27]). The COW protocol, however, does not

use this symbol-per-symbol type of coding and the standard security proofs do not

apply in any straightforward way. To the contrary, the COW protocol is a so-called

distributed-phase-reference protocol (such as also the “differential-phase-shift”

protocol [43]) that relies on the overall phase, or more speci¬cally, the coherence

between successive non-empty pulses, to ensure the security of the protocol. For

this family of protocols, much is still to be done at the level of security proofs.

So far, the security of the COW protocol has been proven against some partic-

ular attacks, such as the beam-splitting attack (BSA) [28, 75, 10, 11] and some

intercept-resend (IR) attacks [28, 75]. Proofs for more speci¬c attacks, such as

zero-error attacks based on unambiguous state discrimination (USD) [10] and (in

the limit of high losses) against 1-pulse or 2-pulse attacks that generalize the BSA

by introducing errors [11], have also been shown (see Chap. 5).

106 M. Suda

6.2.4 Continuous Variables with Gaussian Modulation, QKD

with Coherent States (CV)

The designed and realized prototype that implements a continuous variable (CV)

QKD protocol is based on coherent states and reverse reconciliation [21, 2]. This

is a stable and automatic system working constantly during 57 h and yielding an

average secret key distribution rate of 8 kbits/s over 15 km standard optical ¬ber,

including all quantum and classical communication.

So-called CV protocols rely on both quadratures of a coherent state and have

been proposed in [67, 39, 14, 37, 34]. A complete implementation of the Gaussian-

modulated coherent-state reverse reconciliation (RR) CV-QKD protocol is described

in [50]. In the protocol, the quadratures operators of position x = √2 (a + + a) and

1

ˆ ˆ

ˆ

momentum p = √2 (a + ’ a) of a train of coherent-state pulses are modulated in the

±

ˆ ˆ ˆ

complex plane with a Gaussian modulation of variance V A N0 at Alice™s side, where

N0 is the shot noise variance that appears in the Heisenberg relation ”x” p ≥ N0 .

The quantities a and a + are the bosonic annihilation resp. creation operators de¬ned

ˆ ˆ

for a coherent state |± using the Eigenvalue equation a|± = ±|± . The Eigen-

ˆ

value ± = |±|e = (x + ± p) is a complex number. These coherent states are

±θ

sent from Alice to Bob through the quantum channel, along with a strong phase

reference (phase angle θ L O ) “ or strong local oscillator (LO) expressed classically

by the complex number ± L O = |± L O |e±θL O . Bob randomly measures the x or p ˆ ˆ

quadrature by making the signal interfere with the LO in a pulsed, shot noise-

limited homodyne detector. The phase shifting • rotates the quadratures x and p

ˆ ˆ

to x• = x cos • + p sin • and p• = ’x sin • + p cos •, and it can be shown eas-

ˆ ˆ ˆ ˆ ˆ

ˆ

ily [25] that balanced homodyne detection (measuring the difference of the output

ˆ

intensities I21 behind a 50/50 beam splitter) means measuring the rotated quadrature

component: I21 ∝ |± L O |x• . A balanced homodyne detection is an ampli¬er. The

ˆ ˆ

LO ampli¬es the signal by the mutual optical mixing of the two. Or, seen from

a different point of view, the homodyne detection is an interferometer that can be

measurably imbalanced by a weak signal mode, because the reference ¬eld (LO) is

very intense.

We now discuss the CV-QKD system [21]. As shown in Fig. 6.4. Alice produces

coherent light pulses of 1550 nm wavelength with a frequency of ω = 500 k H z; the

time between two pulses amounts therefore to ”t = 1/ω = 2 μs. The length of the

generated pulses is 100 ns. The pulses are separated into a weak signal (path above)

and a strong LO (path below) using an asymmetric 99/1 coupler. The LO contains

typically 107 photons per pulse. Both the signal and the LO have to be polarized

in the same direction. The signal pulses are then displaced in the complex plane,

with arbitrary amplitude |±| and phase θ, randomly chosen from a two-dimensional

Gaussian distribution centered at zero and with an adjustable variance V A N0 . Alice™s

intended modulation variance is adjusted with a second amplitude modulator. Time

and polarization multiplexing are used so that S and LO are transmitted to Bob in

.

the same optical ¬ber without interfering. A 2 — 40 m delay line (= time delay

”t = 80 n = 400 ns, where n = 3 is the index of refraction, and c is the speed of

c 2

6 QKD Systems 107

Photodiode

Alice

Faraday Mirror

2 μs 40 m

Signal

Polarizer Amplitude Phase

Modulator Modulator

100 ns Local 50/50

Oscillator

Laser diode

1550 nm

PBS

Polarizer

99/1

Bob Channel

_

S

50/50

Homodyne LO

Polarization

LO

detector S

controller

Phase

Modulator

400 ns

PBS

40 m

F. Mirror

Pulse generation Modulation Quantum channel Homodyne detection

Fig. 6.4 Sketch of the optical layout of the CV-QKD prototype; LO: local oscillator, S: signal,

PBS: Polarizing beam splitter; see text for details

light in vacuum) is inserted using a PBS (because the signal is polarized) and includ-

ing a Faraday mirror (FM). The FM consists of a standard mirror and a 45—¦ rotator.

It therefore re¬‚ects the signal pulse by imposing a 90—¦ rotation on its polarization.

This system eliminates therefore all birefringence-induced polarization drifts. Using

a 50/50 beam splitter, Alice can detect and store the Gaussian-modulated coherent-

state signal S. Because of the orthogonal polarizations, the signal pulses (which

contain about 102 photons after attenuation) and the LO pulses are then coupled

in the transmission ¬ber using a PBS. The signal and LO pulses leave the PBS

therefore at the same output port and travel through the quantum channel with

orthogonal polarizations, being delayed by 400 ns.

In Bob™s system, the LO pulse is transmitted through a PBS and a phase modu-

lator imposes randomly a phase shift θ L O = 0 or θ L O = π . Using an analog delay

2

line as at Alice™s side the LO pulses are delayed by 400 ns and polarization rotated

by 90—¦ . Having now the same polarization, S and LO hit simultaneously the 50/50

beam splitter of a homodyne detection device where they interfere. The homodyne

detection system outputs an electric signal, whose intensity is proportional to the

rotated quadrature x• of the signal, where • = (θ ’ θ L O ) is the phase difference

ˆ

ˆ ˆ

between S and LO. Bob measures randomly either xθ and xθ’π/2 to select one of

the two quadratures. Later, using a public authenticated channel, he informs Alice

about which quadrature he measured, so she may discard the irrelevant data. After

many similar exchanges, Alice and Bob share a set of correlated Gaussian variables,

which are called “key elements.”

On Bob™s side, homodyne detection is performed by choosing at random one

of the two relevant quadrature measurements. Consider then a simple detection

108 M. Suda

scheme, in which bit values are assigned by the sign of the detection signal, +

or ’, with respect to the half planes in the quantum optical phase space. As a result,

both sender and receiver have binary data at hand. Classical data processing is then

necessary for Alice and Bob to obtain a fully secret binary key.

Classical data processing means that Alice and Bob apply an error correction (or

reconciliation) algorithm to their data. In order for Alice to correct the errors that

appear in her data with respect to Bob™s data (reverse reconciliation), the two par-

ties perform a multilevel reconciliation process based on low-density parity check

(LDPC) codes which are described in detail in [50]. To extract the secret informa-

tion, Alice and Bob use privacy ampli¬cation algorithms based on hash functions

yielding at the end a shorter bit sequence unknown to Eve. In Chaps. 3 and 4 error

correction and privacy ampli¬cation are discussed in more detail.

Security proofs against individual Gaussian attacks including direct or reverse

reconciliation are treated in the literature [37, 36, 34, 35]. Using Shannon™s for-

mula, simple analytical expressions for a Gaussian channel are derived. Security

proofs against general collective attacks can be found in [60] and [24] with Shannon

information being replaced by the Holevo quantity. Unconditional security against

coherent attacks has also been proven [33, 69].

The secret key rate R is given as the difference between the amount of informa-

tion shared by Alice and Bob and the amount of information available to Eve. For

the system under consideration, the following results have been obtained [50, 21]:

V + χtot

1

I AB = ,

log2 (6.6)

1 + χtot

2

I AB , mutual information between Alice and Bob

V = (V A + 1), excess noise (V ≈ 18.5 shot noise units N0 )

V A , Gaussian modulation of variance at Alice™s side

χtot = (χline + χhom /T ), total noise added between Alice and Bob

χline = (1/T ’ 1 + ), channel noise referred to the channel input

T = 10’±l/10 , transmission coef¬cient of the channel

±, attenuation of the line (= 0.2 dB/km)

l, length of the line (e.g., 15 km ’ T = 0.5)

, excess noise at the channel™s input (= 0.005 shot noise units N0 )

χhom = (1 + vel )/· ’ 1, detector™s noise referred to Bob™s input

vel , noise added by the detection electronics (= 0.041 N0 units)

·, detector ef¬ciency (= 0.606).

Now two different attacks are taken into account yielding different key rates.

These are (a) individual attacks which entail the Shannon rate and (b) collective

attacks which give rise to the Holevo rate.

(a) Shannon rate (individual attacks): In the individual attack, Eve performs her mea-

surement after Bob reveals his quadrature measurement (sifting) but before the

error correction. Thus, her information is restricted to the Shannon information.

6 QKD Systems 109

In the reverse reconciliation protocol Eve™s information reads

T ( V + χtot )

1

IB E = ,

log2 (6.7)

+ χhom

1

2 T ( 1/V +χline )

and the Shannon raw key rate reads

R Sh = β I AB ’ I B E . (6.8)

β is a factor which takes into account the ef¬ciency of reconciliation algorithm

(β = 0.898 [50]).

(b) Holevo rate (collective attacks): Eve™s accessible information after error correc-

tion is now upper bounded by the Holevo quantity [68]. One obtains

R Hol = β I AB ’ χ B E . (6.9)

χ B E , the Holevo information bound, reads as follows:

»1 ’ 1 »2 ’ 1 »3 ’ 1 »4 ’ 1

χB E = G +G ’G ’G ,

2 2 2 2

(6.10)

G(x) = (x + 1) log2 (x + 1) ’ x log2 x,

√ √

»1,2 = (1/2)[A ± A2 ’ 4B] , »3,4 = (1/2)[C ± C 2 ’ 4D] ,

A = V √(1 ’ 2T ) + 2T + T 2 (V + χline )2√, B = T 2 (V χline + 1)2 ,

2

√

C = V B+TT(V +χline ) hom , D = B VT+ +χtot ) .

)+Aχ Bχhom

(V +χtot (V

Example: l = 25 km (T = 0.30) ’ R Sh = 15.2 kb/s and R Hol = 12.3 kb/s.

6.2.5 Entanglement-Based QKD (EB)

The use of quantum entanglement in combination with existing ¬ber telecommuni-

cation networks extends the possibility to implement long-distance QKD communi-

cation in the future [18].

The most important quotation related to the entanglement-based QKD system

(polarization encoding) described here is given in [40]. A schematic picture of some

technical details of the system is shown in Fig. 6.5.

The source emits polarization-entangled photons. The state can be written as

1

|¦ = √ ( | H810 H1550 + | V810 V1550 ) . (6.11)

2

Here H (V ) indicates horizontal (vertical) polarization of a photon. The signal-

mode photon (wavelength 1550 nm) and the idler-mode photon (wavelength 810 nm)

are generated in pairs by an asymmetric SPDC (spontaneous parametric down-

110 M. Suda

Fig. 6.5 Schematic picture of the entanglement-based QKD system. The source emits polarization-

entangled photons of different wavelengths: 810 and 1550 nm. The 810 nm pair-photons are polar-

ization analyzed locally by Alice and detected by her silicon detectors (APDs, avalanche photo

diodes). The partner photons at 1550 nm are transmitted to Bob via telecom ¬bers on spool,

analyzed and detected by InGaAs-APDs. Classical communication is carried out via a TCP/IP

(transmission control protocol/internet protocol). FPGA: ¬eld programmable gate array; see text

for details

conversion) process [70, 63, 46] activated by two quasi-phase matched periodically,

poled KTiOPO4 ( ppK T P) crystals which have been tailored from a 532 nm pump

laser for type-I collinear generation of the photons (the pump laser and the crystals

are not shown in the picture).

The reason for choosing the 1550/810 set of wavelengths is twofold: Because of

the low absorption the signal is transmitted very well over optical ¬bers (1550 nm),

but has to be registered using InGaAs detectors which must be gated. Therefore,

the second pair photon (idler) is generated at a wavelength of 810 nm, which is

detectable more easily with Si-APDs. This photon is immediately measured at

Alice (at the source) with a passive BB84 detector module described in the next

section in more detail. Then the outcomes are correlated with the measurement

results at Bob™s 1550 nm-detection module in both bases. The implemented pro-

tocol is called BBM92 protocol and is a version of BB84 for entanglement-based

systems [7].

The description of the system shown in Fig. 6.5 goes as follows: The source at

Alice described above produces asymmetric entangled photons which are separated

by wavelength and coupled into single-mode ¬bers. The polarization analyzer for

810 nm photons is a free-space unit with a passive basis choice between measure-

ments in the H/V or +/’ basis. This basis choice is realized by a ¬rst 50/50 beam

splitter. The polarization measurements are performed with two polarizing beam

splitters (PBSs). The 810 nm photons are detected in a four-channel Si-APD array.

A delay module can set individual delay values for each Si-APD eliminating side

6 QKD Systems 111

channel attacks based on timing differences on Alice™s side. Each detection event is

recorded with a time stamp and an optical pulse (trigger) is generated at 1610 nm.

The trigger signal is wavelength multiplexed onto the quantum channel operating at

1550 nm.

The quantum channel is made up of a single-mode standard telecom ¬ber.

At Bob™s side the quantum signal is wavelength multiplexed to separate the quan-

tum signal at 1550 nm from the trigger at 1610 nm. Electronic polarization controller

is used to correct for polarization drifts in the quantum channel. Classical polariza-

tion state analysis is performed using polarimeters both on Alice™s and on Bob™s

side (not shown in Fig. 6.5). A ¬ber beam splitter acts as basis choice for the BB84

polarization analysis at Bob. Two ¬ber-based PBSs split the incoming light into two

orthogonal polarization components. Four InGaAs detectors measure the photon in

each of the four BB84 polarization states. Trigger signals are converted into gate

pulses on Bob™s FPGA board. Delay lines guarantee that the four InGaAs detectors

at Bob™s side open their gate at the same time.

Coincidences of detector clicks between Alice and Bob establish a secret key

after classical communication over TCP/IP.

Long-distance transmission of EB polarization-encoded qubits was successfully

demonstrated in free space up to 144 km [82]. In long-distance ¬ber-based EB

communication [57, 79] chromatic dispersion (CD) and birefringence (because of

polarization-mode dispersion, PMD) [15] seem to play an important role. A similar

EB QKD scheme described above was used to demonstrate the successful distri-

bution of secret keys over 1.45 km ¬ber glass in an urban environment where the

system was installed between the headquarters of a large bank and the Vienna city

hall in order to accomplish a bank transfer [65].

Security proofs for EB systems, in which the source is under Eve™s control, and

where higher losses can be tolerated if the source is in the middle between Alice

and Bob rather than if it is on Alice™s side, are presented in [53]. If deviations from

a perfect two-photon source are observed, EB security proofs take the presence of

multi-photon components into account when error rates are considered [45]. Tech-

nological imperfections of single photon detectors produce nonobservable increase

in the quantum bit error rate QBER (fake-state attacks [55, 54, 56] and time-shift

attacks [66, 86]).

The goal of the QKD system is to estimate a ¬nal secret bit rate R. In the EB

system discussed above the formula for the achievable secret key fraction reads [3]

[81, 4](SECOQC project [58])

1

ν A p D [ 1 ’ H (δ) ’ f (δ) H (δ) ] .

R= (6.12)

2

The particular quantities have the following meaning:

, this factor stems from the BB84 sifting procedure

1

2

ν A , Alice™s detection rate, ν A ≈ · A t A μ ≈ 106 s ’1

· A , quantum ef¬ciency of Alice™s detector (50%)

t A , transmittance in Alice™s side (40%)

112 M. Suda

μ, optimal pair generation (μ ≈ 5.106 s ’1 )

p D , measured probability of Bob™s detection ( p D ≈ 2 pd B + · B t B t)

pd B , probability of dark count per gate at Bob™s detector (= 3.10’5 )

· B , quantum ef¬ciency of Bob™s detector (10%)

t B , transmittance in Bob™s side (40%)

t, line transmittance with d being a distance (t = 10’±d/10 )

±, ¬ber attenuation (± = 0.25 dB/km)

H (δ) = ’δ log2 (δ) ’ (1 ’ δ) log2 (1 ’ δ), Shannon entropy

f (δ), depends on implemented error correction algorithm (= 1.1)

δ = QBER, measured quantum bit error rate (0.5% δ 3.5%)

δ is a function of t, p D , PMD, the two-photon visibility V and of multi-pair

contributions. Neglecting dark counts on Alice™s side the approximate formula for

the error rate reads [4]

1’V μ”T

1 d

δ≈ pd B + + +β ·B tB t . (6.13)

pD 2 2 d0

V, two-photon visibility (= 99%)

μ”T

, multi-pair contribution to the error rate

2

”T, width of the gate pulse at Bob™s detector (= 2 ns)

β d0 , formula for PMD [27]

d

β = 0.001 and d0 = 25 km, two parameters, experimentally found

d, distance Alice“Bob in kilometer

For d = 0 km ’ δ ≈ 0.5 % ’ R ≈ 20 kHz . If we take the distance

between Alice and Bob to be d = 17 km one obtains a quantum bit error rate

δ ≈ 1.3% and a key rate R ≈ 6 kHz.

6.2.6 Free-Space QKD (FS)

Quantum cryptography is not necessarily restricted to the transmission of the quan-

tum state by means of ¬ber glass. Free-space QKD has become an accepted method

which has some advantages compared to the systems discussed so far. Interestingly

enough, the ¬rst laboratory demonstration of QKD by Bennett and Brassard in 1989

was a free-space experiment over 30 cm air using the polarization state of photons

for the generation of a quantum key. This system is described in detail in [5, 6]. In

the meanwhile one is able to execute QKD over large free-space distances [73, 72].

Here we report on a free-space QKD implementation which uses strongly attenuated

laser pulses over a distance of 500 m [84].

The system corresponds to the BB84 protocol [6] where qubits are encoded in the

polarization of faint laser pulses. This protocol can be described as follows: Alice

prepares single photons with randomly chosen polarization of four non-orthogonal

states (horizontal (H), vertical (V), +45—¦ or ’45—¦ ). She sends the photons to Bob,

6 QKD Systems 113

who analyzes the polarization in a randomly and independently chosen basis (either

H/V or ±45—¦ ). Subsequently, Alice and Bob compare publicly their basis choices

while discarding events where they had chosen different bases (sifting).

Quantum mechanics does not allow an eavesdropper (Eve) to measure the polar-

ization of a single photon without introducing errors between the communicating

parties. The quantum bit error rate (QBER) of the sifted key gives an upper bound

on the information Eve might have gained. This quantity is calculated during the

classical error correction procedure and at the same time is needed to make sure

that the information of a potential eavesdropper on the key is negligible (privacy

ampli¬cation).

There have been some free-space experiments over relatively large distances

[73, 41, 47] showing the possibility to build global quantum key exchange systems

based on quantum communication satellites [64]. Below, a QKD free-space system

is described which can be applied to shorter distances in urban areas [84]. In Fig. 6.6

a sketch of the elements of such a system is drawn. Two units can be identi¬ed: the

left side belongs to the transmitter unit (Alice) and the right side belongs to the

receiver unit (Bob). The units are discussed subsequently.

Fig. 6.6 Simpli¬ed diagram of the free-space Alice and Bob setup: D: cube, housing the laser-

diodes, F: ¬ber mode¬lter, Q: quarter- and half-wave plates for polarization compensation of the

¬ber, BS: beam splitter, CD: detector for calibration of mean photon numbers, S: shutter to prevent

daylight coming in when calibrating the mean photon numbers. The front lens of the Alice tele-

scope is protected from sunlight by a 25 cm long black coated tube. Therefore the receiver collects

less stray light. Bobs unit see text

The transmitter unit consists of four laser diodes together with a conical mirror

and a spatial ¬lter. The diodes produce in random sequence (according to the choices

of basis and bit values) weak coherent pulses of polarized light (polarization: H, V,

+45—¦ , ’45—¦ ) of mean photon number μ of 0.1 approximately. The advantage of this

method is that no active polarization manipulation is needed. The four laser diodes

emitting 850 nm wavelength are seen on the left side in Fig. 6.6. They are arranged

around a conical mirror where the four beams are re¬‚ected and combined into one

direction. The beams have to pass a spatial ¬lter in order to let pass only a single

spatial mode and are then injected into a single-mode ¬ber. A monitoring APD is

114 M. Suda

mounted behind a BS. The second output of the BS leads to a telescope which emits

the photons into free space.

To ensure that as many photons from Alice as possible are detected by Bob, two

telescopes are employed, one at each end. Detailed data can be achieved elsewhere

[73]. In [84], a distance of about 500 m between two buildings in downtown Munich

has been chosen.

The receiver unit (Bobs module, right side of Fig. 6.6) is directly attached to the

end of the receiver telescope. A non-polarizing BS, a set of two PBSs, and a HWP

are used to perform the polarization analysis of the incoming photons. The 50/50

BS selects the basis (H/V or ±45—¦ ) randomly and the subsequent PBS including the

HWP determines whether a conclusive polarization measurement can be obtained.

The module acts completely passive. The single photons are detected by four silicon

APDs. Attached to the outputs of Bob™s module is the time stamp unit that records

the time-of-arrival of each detection event (timing resolution better than 1 ns).

Once the synchronization task is ¬nished, Alice and Bob can start the key sifting

process. If Alice has sent the photon in the same basis as measured by Bob, they

will use the assigned bit value for the sifted key. Ideally, both sifted keys would be

perfectly correlated. But experimental imperfection and/or an eavesdropper cause

errors. The CASCADE algorithm is used for error correction [38]. Public commu-

nication is necessary during this procedure. Each publicly transmitted bit increases

the eavesdropper™s knowledge of the key. Hence, these announced bits have to be

taken into account during the privacy ampli¬cation process [52]. In Chaps. 3 and 4

CASCADE and privacy ampli¬cation are treated more precisely.

A sifted key of about 50 kbit/s (QBER=3.2%) and a secure key of about 17 kbit/s

could be achieved during night operation. However, weather conditions affect the

attenuation of the free-space link. It has been observed that only fog, heavy rain,

or snowfall limits the transmission severely as well as strong turbulence above sun-

heated roofs close to the optical path.

Recently, a paper has been published presenting an entanglement-based QKD

system overcoming the limitation of the night operation. Here spectral, spatial, and

temporal ¬ltering techniques are used in order to achieve a secure key continuously

over several days under varying light and weather conditions [62].

6.2.7 Low-Cost QKD (LC)

A free-space quantum-cryptographic system that can operate in daylight conditions

is described in the following [17]. The system acts at a wavelength of 632.8 nm.

It works over a short range of a few meters and is designed to eventually work in

short-range consumer applications. The free-space QKD system for short distances

should be a low-cost application that is aimed at protecting consumer transactions.

The design philosophy is based on a future hand-held electronic credit card using

free-space optics. A method is proposed to protect these transactions using the

shared secret stored in a personal hand-held transmitter. Thereby Alice™s module

6 QKD Systems 115

is integrated within a small device such as a mobile telephone, or PDA (personal

digital assistant), and Bob™s module consists of a ¬xed device such as a bank ATM

(a-synchrone transfer mode).

Quantum cryptography provides a means for two parties to securely generate

shared messages. The information is encoded in non-orthogonal quantum states

which an eavesdropper cannot measure without disturbing. The most commonly

used method is devised on the BB84 protocol [6]. It is based on polarization encod-

ing presented in the preceding section. This method is also applied in the low-cost

QKD system described here. After the sifting procedure Alice and Bob should the-

oretically be correlated unless eavesdropping has taken place on the quantum chan-

nel. The eavesdropper must measure in a random polarization basis uncorrelated to

that of Alice and will therefore inject errors. This should be actively monitored by

measuring the error rate and discarding data where the error rate exceeds a certain

threshold (typically ∼ 12%).

In an experimental setup errors like optical imperfections, background counts,

and detector noise limit the signi¬cance of the results. Therefore, the processes of

error correction [13] and privacy ampli¬cation [8] are performed resulting in a secret

key shared only by Alice and Bob.

Long-distance free-space QKD experiments have been developed over 23 km

[47] and 10 km [41] just as well as studies in order to develop QKD systems between

ground and low earth orbit satellites [31].

Alice™s module uses a driver circuit which produces sub-5 ns pulses. The driver

pulses are combined with the output from a digital input/output card (NuDAQ) and

passed to four AlInGaP LEDs, see Fig. 6.7. The NuDAQ card is regulated by an

external clock and passes a random bit string, generated by a quantum number gen-

erator (QRNG, idQuantique), to the Alice module, recording which LED ¬res. The

driver pulses are produced at a repetition rate of 5 MHz. The four LEDs are attached

to a holder with dichroic sheet polarizers which are orientated in each of the four

polarization states, 0—¦ , 90—¦ , 45—¦ and ’45—¦ , placed over each output. Not till then

the light is polarized. To combine the four beam paths, a diffraction grating is used.

Because of the special design the holder serves to direct the polarized light toward

PC PC

Quantum

transmission

NuDAQ Alice Bob TIA

CLK

Public channel

Network connection

TCP/IP

Fig. 6.7 Schematic diagram of a short-distance free-space QKD system. NuDAQ: digital

input/output data acquisition card, CLK: external clock, TIA: time interval analyzer card, TCP/IP:

transmission control protocol/internet protocol; see text for details

116 M. Suda

the grating. A pinhole is placed after the grating together with a 50 mm focal lens

to collimate the beam. A 632.8 ± 3 nm ¬lter is included to limit the bandwidth.

Currently the free-space quantum transmission between Alice and Bob consists

of a ¬xed connection of roughly 5 cm distance. In addition, Alice and Bob commu-

nicate classically via the internet which is a real public channel.

Bob™s module consists of a setup similar to Alice™s module but in reversed order.

First the beam coming from Alice is ¬ltered and focused to a similar grating, where

the beam is diffracted to four detectors with dichroic sheet polarizers (orientated in

the four polarization directions) over each detector. Four passively quenched silicon

avalanche photodiodes are used for detection. A simple circuit takes the output from

the detectors and converts it to a readable positive pulse. Time-of-arrival information

is recorded by a time interval analyzer card (TIA).

The bit error rate is B E R = Nwrong /Ntotal where Nwrong is the number of erro-

neous bits and Ntotal is the number of bits received in total. The module has to be

able to operate in daylight conditions, so the background error rate [31] is the most

limiting factor of the entire system.

The signal count S for this system is

RνT ·

S= (6.14)

4

including the following quantities:

R, pulse repetition rate (5 MHz)

ν, expected photon number (∼ 0.3 [52])

T , lumped transmission including geometric losses (∼ 1, because of the short-range

system)

·, ef¬ciency of the detection system (∼ 0.045)

The protocol effectively splits the signal into four on the detectors, leading to a

factor 4 reduction in signal bit rate after sifting the key. The background rate is given

by

Pb = B t , (6.15)

where B is the background count rate per detector ( B ¤ 36,000 counts/s) and t

is the time synchronization gate (5 ns). The background error rate for this system is

[17]

Pb

E = 0.027 + . (6.16)

S

The current version of Bob™s module can operate in shaded areas but not in full

direct sunlight.

Most QKD systems use the CASCADE algorithm [38] for error correction,

which we discussed in Sect. 3.2. Another method has been adapted here. The

6 QKD Systems 117

so-called low-density Parity Check (LDPC) algorithm [23] is implemented for the

system in the case under consideration. The advantage of this code is that the

protocol has very little interactive communication compared to CASCADE. The

error corrected keys are then passed through the privacy ampli¬cation process. This

effectively reduces the length of the key. To estimate the key length, the L¨ tkenhaus

u

bound is used [51]. Currently the system is able to establish more than 4000 secret

bits per second between transmitter and receiver in low-light conditions.

In the next generation device it is expected to be able to operate at 10,000 secret

bits per second up to full daylight conditions. Eventually, Alice™s module must be

able to be brought to Bob™s module and fully automatically aligned. This can be

done using a ¬xed alignment cradle or docking station.

6.3 Summary

Quantum key distribution has triggered intense and proli¬c research work during the

past 10 years and now progresses to maturity. During the EC/IST project SECOQC

the seven most important QKD systems have been developed or re¬ned, and this

work compiled to some extent the physical and technical principles developed so far.

These systems are (1) the plug and play system, (2) the Phase-Coding QKD, (3) the

time-coding QKD, (4) the continuous variables system, (5) the entanglement-based

system, (6) the free-space system, and (7) the low-cost QKD.

(1) The Plug and Play auto-compensating system designed by idQuantique SA

employs a strong laser pulse (» = 1550 nm) emitted by Bob™s laser diode. The

pulse is separated at a ¬rst 50/50 BS. The two pulses travel down to the two input

ports of a PBS, after having traveled, respectively, through a short and a long arm

which includes a phase modulator and a delay line. The linear polarization is turned

by 90—¦ in the short arm, so that the two pulses exit the PBS by the same port.

The separated pulses travel down to Alice, are re¬‚ected on a FM, attenuated, and

come back orthogonally polarized. In turn, both pulses now take the other path at

Bob™s interferometer and arrive simultaneously at the ¬rst BS where they interfere.

They are detected by InGaAs APD™s. Since the two pulses follow the same path

in the interferometer (short“long or long“short), the system is auto-compensated.

The BB84 and the SARG protocols are implemented using phase coding. Alice

applies one of the four phase shifts on the second pulse of each pair and Bob™s

phase modulator completes the protocol. In order to avoid noise enhancement by

elastic Rayleigh scattering, the laser pulses are emitted in trains and are stored in

a long delay line at Alice™s side before being sent back to Bob. The Plug and Play

auto-compensating design offers the advantage of being highly stable and passively

aligned.

(2) The one-way weak pulse system (phase-coding) designed by Toshiba Research

Europe Ltd. is a ¬ber-optic, decoy-state system with phase encoding. It employs

a decoy protocol using weak and vacuum pulses. It uses two asymmetric Mach-

Zehnder interferometers for encoding and decoding. Both the signal and the decoy

118 M. Suda

pulses are generated by a 1550 nm pulsed laser diode. The pulses are modu-

lated with an intensity modulator to generate the necessary ratio of signal pulse

strength to decoy pulse intensity and are then strongly attenuated to the desired level

before leaving Alice™s side. An active stabilization technique is used for continuous

operation.

(3) The coherent one-way system (time-coding) designed by GAP-Universit´ de e

Gen` ve, idQuantique SA and ARC realizes the novel distributed-phase-reference

e

COW protocol. Here Alice™s CW laser diode (1550 nm) and an intensity modulator

prepares pulses of weak coherent states or completely blocks the beam. A time-

of-arrival measurement and an interferometer at Bob™s side provide both optimal

unambiguous determination of bit values and check of coherence for signal and

decoy sequences using a phase shifter. The visibility of the various pulse sequences

behind the interferometer provides information about an attack of an eavesdropper.

(4) The continuous variables system developed by CNRS-Institute d™Optique-

Univ. Paris-Sud, THALES Research and Universit´ Libre de Bruxelles implements

e

a coherent-state reverse-reconciliated QKD protocol. The protocol encodes the key

information on both quadratures of the electromagnetic ¬eld. Alice uses a pulsed

laser diode and an asymmetric BS to generate signal and local oscillator pulses.

The signal pulses are appropriately modulated in amplitude and phase. The signal

is then time- and polarization-multiplexed with the delayed local oscillator before

propagating through the quantum channel. After de-multiplexing, Bob uses a time-

resolved homodyne detection system in order to measure the quadrature selected

by his phase modulator. Alice and Bob share therefore correlated continuous data.

Ef¬cient low-density parity check error correction and privacy ampli¬cation provide

for generating a binary secret key.

(5) The entanglement-based QKD system was developed by an Austrian“Swedish

consortium (University of Vienna, ARC and Royal Institute of Technology of Kista).

The system uses the unique quantum mechanical property of entanglement for trans-

ferring the correlated measurements into a secret key. The asymmetric source at

Alice produces two photons of different wavelengths (810 nm and 1,550 nm) by

spontaneous parametric down-conversion in a ppKTP crystal set. The 810 nm pho-

ton is measured by Alice in a passive system (one 50/50 BS and two PBSs, four Si

detectors), thus implementing the BBM92 protocol for entangled states. The other

1,550 nm photon travels down the quantum channel with low-transmission losses

and is registered by Bob using a similar passive system except for the four InGaAs

detectors. The quantum correlations between the photons create a secret key.

(6) The free-space QKD system was developed by the group of H. Weinfurter

from the university of Munich. It employs the BB84 protocol using polarization-

encoded attenuated laser pulses with photons of 850 nm wavelength. Decoy states

are used to ensure key security even with faint pulses. The system is applicable to

day and night operation using excessive ¬ltering in order to suppress background

light. The transmitter (Alice) applies four laser diodes producing random sequences

of weak coherent pulses of different polarization. The photons travel down a free-

space distance between two telescopes (at Alice™s and Bob™s side) and are registered

6 QKD Systems 119

by the receiver (Bob). The receiver mainly consists of the spatial ¬lter and the polar-

ization analyzing module with single-photon detectors.

(7) The low-cost QKD system was developed by John Rarity™s team of the uni-

versity of Bristol. The system can be applied for secure banking including con-

sumer protection. The system can operate in daylight conditions and uses the BB84

protocol. The transmitter (Alice) consists of a hand-held computer interfaced to a

FPGA. Pulses from the FPGA drive four polarized LEDs which are combined in

a diffractive optical element. The receiver (Bob) is run from a laptop computer.

His optical system uses a standard BS-based analyzer with four photon detec-

tors. The main error source is background light. Error correction is accomplished

by the low-density parity check code followed by privacy ampli¬cation to ensure

security.

References

1. All´ aume (Editing author), R., Bouda, J., Branciard, C., Debuisschert, T., Dianati, M., Gisin,

e

N., Godfrey, M., Grangier, P., L¨ nger, T., Leverrier, A., L¨ tkenhaus, N., Painchault, P., Peev,

a u

M., Poppe, A., Pornin, T., Rarity, J., Renner, R., Ribordy, G., Riguidel, M., Salvail, L., Shields,

A., Weinfurter, H., Zeilinger, A.: Quantum key distribution and cryptography. SECOQC White

Paper (2007) 97

2. Assche, G., Cardinal, J., Cerf, N.: IEEE Trans. Inf. Theory 50, 394 (2004) 106

3. Beaudry, N., Moroder, T., L¨ tkenhaus, N.: arXiv:0804.3082 (2008) 111

u

4. Beaudry, N., Moroder, T., L¨ tkenhaus, N.: in preparation (2008) 111, 112

u

5. Bennett, C., Bessette, F., Brassard, G., Salvail, L., Smolin, J.: J. Cryptol. 5, 3 (1992) 98, 100, 112

6. Bennett, C., Brassard, G.: Conf. on Computers, Systems and Signal Processing, Bangalore,

India (IEEE, New York) p. 175 (1984) 98, 100, 103, 112, 115

7. Bennett, C., Brassard, G., Mermin, N.: Phys. Rev. Lett. 68, 557 (1992) 110

8. Bennett, C., Brassard, G., Robert, J.M.: SIAM J. Comp. 17(2), 210 (1988) 115

9. Branciard, C., Gisin, N., Kraus, B., Scarani, V.: Phys. Rev. A 72, 032,301 (2005) 100

10. Branciard, C., Gisin, N., L¨ tkenhaus, N., Scarani, V.: Quant. Inf. Comput. 7, 639 (2007) 105

u

11. Branciard, C., Gisin, N., Scarani, V.: New. J. Phys. 10, 013,031 (2008) 105

12. Brassard, G., L¨ tkenhaus, N., Mor, T., Sanders, B.: Phys. Rev. Lett. 85, 1330 (2000) 100, 101

u

13. Buttler, W., Lamoreaux, S., Torgerson, J., Nickel, G., Donahue, C., Peterson, C.: Phys. Rev. A

67(5), 052,303 (2003) 115

14. Cerf, N., L´ vy, M., Assche, G.: Phys. Rev. A 63, 052,311 (2001) 106

e

15. Damask, J.: Polarization Optics in Telecommunications. Springer, New York (2005) 111

16. Debuisschert, T., Boucher, W.: Phys. Rev. A 70, 1042,306 (2004) 104

17. Duligall, J., Godfrey, M., Harrison, K., Munro, W., Rarity, J.: New J. Phys. 8, 249 (2006) 114, 116

18. Dusek, M., L¨ tkenhaus, N., Hendrych, M.: Progress in Optics 49, 381 (2006) 97, 109

u

19. Dynes, J., Yuan, Z., Sharpe, A., Shields, A.: Opt. Express 15/13, 8465 (2007) 100

20. F´ lix, S., Gisin, N., Stefanov, A., Zbinden, H.: J. Mod. Opt. 48, 2009 (2001) 100

e

21. Fossier, S., Diamanti, E., Debuisschert, T., Villing, A., Tualle-Brouri, R., Grangier, P.:

arXiv:0812.3292 (2008) 106, 108

22. Fuchs, C., Gisin, N., Grif¬ths, R., Niu, C., Peres, A.: Phys. Rev. A 56, 1163 (1997) 100

23. Gallager, R.: IRE Trans. Inf. Th. IT-8, 21 (1962) 117

24. Garc´a-Patr´ n, R., Cerf, N.: Phys. Rev. Lett. 97, 190,503 (2006) 108

± o

25. Gerry, C., Knight, P.: Introductory quantum optics. 1st edn. Cambridge University Press,

Cambridge (2005) 102, 106

120 M. Suda

26. Ghernaouti-H´ lie (Editing author), S., Tashi, I., L¨ nger, T., Monyk, C.: Quantum cryptogra-

e a

phy: An innovation in the domain of secure information transmission. SECOQC Business

White Paper (2008) 97

27. Gisin, N., Ribordy, G., Tittel, W., Zbinden, H.: Rev. Mod. Phys. 74, 145 (2002) 97, 98, 100, 103, 105, 112

28. Gisin, N., Ribordy, G., Zbinden, H., Stucki, D., Brunner, N., Scarani, V.: arXiv:0411022

(2004) 103, 104, 105

29. Gobby, C., Yuan, Z., Shields, A.: Appl. Phys. Lett. 84, 3762 (2004) 100

30. Gobby, C., Yuan, Z., Shields, A.: Electron. Lett. 40, 1603 (2004) 103

31. Gorman, P., Rarity, J., Tapster, P., Knight, P.: New J. Phys. 4, 82 (2002) 115, 116

32. Gottesman, D., Lo, H.K., L¨ tkenhaus, N., Preskill, J.: Quant. Inf. Comp. 5, 325 (2004) 100, 101, 103

u

33. Gottesmann, D., Preskill, J.: Phys. Rev. A 63, 022,309 (2001) 108

34. Grosshans, F., Assche, G., Wenger, J., Brouri, R., Cerf, N., Grangier, P.: Nature 421, 238

(2003) 106, 108

35. Grosshans, F., Cerf, N.: Phys. Rev. Lett. 92, 047,905 (2004) 108

36. Grosshans, F., Cerf, N., Wenger, J., Tualle-Brouri, R., Grangier, P.: Quant. Inf. Comp. 3, 535

(2003) 108

37. Grosshans, F., Grangier, P.: Phys. Rev. Lett. 88, 057,902 (2002) 106, 108

38. Helleseth, T: (ed.). Advances in cryptology - proceedings of eurocrypt ™93. Lecture Notes in

Computer Science, Springer, Berlin 765, 410 (1994) 114, 116

39. Hillery, M.: Phys. Rev. A 61, 022,309 (2000) 106

40. H¨ bel, H., Vanner, M., Lederer, T., Blauensteiner, B., Lor¨ nser, T., Poppe, A., Zeilinger, A.:

u u

Opt. Express 15/12, 7853 (2007) 109

41. Hughes, R., Nordholt, J., Derkacs, D., Peterson, C.: New J. Phys. 4(43), 1 (2002) 113, 115

42. Hwang, W.Y.: Phys. Rev. Lett. 91, 057,901 (2003) 101, 103, 104

43. Inoue, K., Walks, E., Yamamoto, Y.: Phys. Rev. Lett. 89, 037,902 (2002) 105

44. Intallura, P., Ward, M., Karimov, O., Yuan, Z., See, P., Shields, A.: arXiv:0710.0565 (2007) 103

45. Koashi, M., Preskill, J.: Phys. Rev. Lett. 90, 057,902 (2003) 111

46. Konig, F., Mason, E., Wong, F., Albota, M.: Phys. Rev. A 71, 033,805 (2005) 110

47. Kurtsiefer, C., Zarda, P., Halder, M., Weinfurter, H., Gorman, P., Tapster, P., Rarity, J.: Nature

419, 450 (2002) 113, 115

48. Lo, H.K., Chau, H., Ardehali, M.: J. Cryptology 18, 133 (2005) 104

49. Lo, H.K., Ma, X., Chen, K.: Phys. Rev. Lett. 94, 230,504 (2005) 100, 101, 104

50. Lodewyck, J., Bloch, M., Garc´a-Patr´ n, R., Fossier, S., Karpov, E., Diamanti, E., Debuiss-

± o

chert, T., Cerf, N., Tualle-Brouri, R., McLaughlin, S., Grangier, P.: Phys. Rev. A 76, 042,305

(2007) 106, 108, 109

51. L¨ tkenhaus, N.: Phys. Rev. A 59, 3301 (1999) 117

u

52. L¨ tkenhaus, N.: Phys. Rev. A 61, 052,304 (2000) 114, 116

u

53. Ma, X., Fung, C.H., Lo, H.K.: Phys. Rev. A 76, 012,307 (2007) 111

54. Makarov, V., Anisimov, A., Skaar, J.: Phys. Rev. A 74, 022,313 (2005) 103, 111

55. Makarov, V., Hjelme, D.: J. Mod. Opt. 52, 691 (2005) 103, 111

56. Makarov, V., Skaar, J.: Quant. Inf. Comput. 8, 622 (2008) 103, 111

57. Marcikic, I., de Riedmatten, H., Tittel, W., Zbinden, H., Legr´ , M., Gisin, N.: Phys. Rev. Lett.

e

93, 180,502 (2004) 111

58. Monyk (Coordinator), C.: Development of a global network for secure communication based

on quantum cryptography. EC/IST Integrated Project SECOQC Contract No. 506813 (2004-

2008) 97, 111

59. Muller, A., Herzog, T., Huttner, B., Tittel, W., Zbinden, H., Gisin, N.: Appl. Phys. Lett. 70,

793 (1997) 98, 102

60. Navasqu´ s, M., Grosshans, F., Ac´n, A.: Phys. Rev. Lett. 97, 190,502 (2006) 108

e ±

61. Niederberger, A., Scarani, V., Gisin, N.: Phys. Rev. A 71, 042,316 (2005) 100

62. Peloso, M., Gerhardt, I., Ho, C., Lamas-Linares, A., Kurtsiefer, C.: arXiv:0812.1880 (2008) 114

63. Pelton, M., Marsden, P., Ljunggren, D., Tenger, M., Karlsson, A., Fragemann, A., Canalias,

C., Laurell, F.: Opt. Express 12, 3573 (2004) 110

6 QKD Systems 121

64. Pfennigbauer, M., Aspelmeyer, M., Leeb, W., Baister, G., Dreischer, T., Jennewein, T., Neck-

amm, G., Perdigues, J., Weinfurter, H., Zeilinger, A.: J. Opt. Netw. 4, 549 (2005) 113

65. Poppe, A., Fedrizzi, A., Ursin, R., B¨ hm, H., Lor¨ nser, T., Maurhardt, O., Peev, M., Suda, M.,

o u

Kurtsiefer, C., Weinfurter, H., Jennewein, T., Zeilinger, A.: Opt. Express 12/16, 3865 (2004) 111

66. Qi, B., Fung, C.H., Lo, H.K., Ma, X.: Quant. Inf. Comput. 7, 73 (2007) 103, 111

67. Ralph, T.: Phys. Rev. A 61, 010,303(R) (1999) 106

¨

68. Renner, R.: Ph.D. thesis ETH Zurich (2005) 109

69. Renner, R., Cirac, J.: arXiv:0809.2234 (2008) 108

70. Ribordy, G., Brendel, J., Gautier, J., Gisin, N., Zbinden, H.: Phys. Rev. A 63, 012,309 (2000) 110

71. Scarani, V., Bechmann-Pasquinucci, H., Cerf, N., Dusek, M., L¨ tkenhaus, N., Peev, M.:

u

arXiv:0802.4155 (2008) 97

72. Schmitt-Manderbach, T.: Diss., LMU M¨ nchen (2007) 112

u

73. Schmitt-Manderbach, T., Weier, H., F¨ rst, M., Ursin, R., Tiefenbacher, F., Scheidl, T.,

u

Perdigues, J., Sodnik, Z., Kurtsiefer, C., Rarity, J., Zeilinger, A., Weinfurter, H.: Phys. Rev.

Lett. 98, 010,504 (2007) 112, 113, 114

74. Stucki, D., Barreiro, C., Fasel, S., Gautier, J.D., Gay, O., Gisin, N., Thew, R., Thoma, Y.,

Trinkler, P., Vannel, F., H., Z.: arXiv:0809.5264 (2008) 103

75. Stucki, D., Brunner, N., Gisin, N., Scarani, V., Zbinden, H.: Appl. Phys. Lett. 87, 194,108

(2005) 103, 105

76. Stucki, D., Gisin, N., Guinnard, O., Ribordy, G., Zbinden, H.: New. J. Phys. 4, 41.1 (2002) 98, 100

77. Stucki, D., Ribordy, G., Stefanov, A., Zbinden, H., Rarity, J.: J. Mod. Opt. 48, 1967 (2001) 100

78. Suda, M., Herbst, T., Poppe, A.: Eur. Phys. J. D 42, 139 (2007) 102, 104

79. Takesue, H.: Opt. Express 14, 3453 (2006) 111

80. Tancevski, L., Slutsky, B., Rao, R., Fainman, S.: Proc. SPIE 3228, 322 (1997) 100

81. Tsurumaru, T., Tamaki, K.: arXiv:0803.4226 (2008) 111

82. Ursin, R., Tiefenbacher, F., Schmitt-Manderbach, T., Weier, H., Scheidl, T., Lindenthal, M.,

¨

Blauensteiner, B., Jennewein, T., Perdigues, J., Trojek, P., Omer, B., F¨ rst, M., Meyenburg,

u

M., Rarity, J., Sodnik, Z., Barbieri, C., Weinfurter, H., Zeilinger, A.: nature physics doi,

10.1038/nphys629 (2007) 111

83. Wang, X.B.: Phys. Rev. Lett. 94, 230,503 (2005) 100, 101, 104

84. Weier, H., Schmitt-Manderbach, T., Regner, N., Kurtsiefer, C., Weinfurter, H.: Fortschr. Phys.

54/8-10, 840 (2006) 112, 113, 114

85. Yuan, Z., Sharpe, A., Shields, A.: Appl. Phys. Lett. 90, 011,118 (2007) 101

86. Zhao, Y., Fung, C.H., Qi, B., Chen, C., Lo, H.K.: arXiv:0704.3253 (2007) 103, 111

Chapter 7

Statistical Analysis of QKD Networks

in Real-Life Environment

K. Lessiak and J. Pilz

As discussed before, Quantum Key Distribution (QKD) has already been realized in

various experiments. Due to this there is an interest to prove whether or not external

in¬‚uences like temperature, humidity, sunshine duration, and global radiation have

an effect on the quality of QKD systems. In consequence there is also an interest

to predict the qubit error rate (QBER) and the key rate (KR). In the course of the

SECOQC project [10], measurements of different devices in the prototype network

in Vienna have been conducted. Within these measurements the correlation between

QBER, KR, and these environmental in¬‚uences is analyzed. Therefore, statistical

methods such as generalized linear models and generalized linear mixed models are

used. Applying these two models predictions become possible. For the implemen-

tations we used the statistical software R c (R version 2.7.1).

In Sect. 7.1 the statistical methods used for the analysis are introduced. There

the basic principles of generalized linear models (GLMs) are established. An intro-

duction to generalized linear mixed models (GLMM) is also given. Furthermore,

the results of the ¬eld experiment in Vienna are shown and processed in Sect. 7.2.

Hereafter, in Sect. 7.3 the analyses and processing of the data take place.

7.1 Statistical Methods

Linear models play a decisive role in the economic, social, and engineering sciences,

especially in the investigation of causal relationships. They establish a ¬rm basis of

statistical methodologies. Because of the different requirements in these sciences, a

variety of models have been studied and made available. Very important extensions

K. Lessiak (B)

Safety & Security Department, Quantum Technologies, AIT Austrian Institute of Technology

GmbH, Lakeside B01A, 9020 Klagenfurt, Austria, katharina.lessiak@ait.ac.at;

http://www.ait.ac.at

J. Pilz

Institute of Statistics, Klagenfurt University, Universit¨ tsstraße 65-67, A-9020 Klagenfurt, Austria,

a

juergen.pilz@uni-klu.ac.at

Lessiak, K., Pilz, J.: Statistical Analysis of QKD Networks in Real-life Environment. Lect. Notes

Phys. 797, 123“149 (2010)

c Springer-Verlag Berlin Heidelberg 2010

DOI 10.1007/978-3-642-04831-9 7

124 K. Lessiak and J. Pilz

of linear models are, for example, generalized linear models, mixed effect models,

and nonparametric regression models.

The starting point for these extensions is the linear regression model:

y = β0 + β1 x1 + · · · + β p x p + µ, (7.1)

with response variable y and predictors x1 , ..., x p . In this regression model µ is the

error, which is assumed to be normally distributed.

In principle, there are three extensions of the linear model. The ¬rst extension

of the above-mentioned regression model generalizes the x part. Basically, the pre-

dictors x in a linear model are combined in a linear way to model the effect on the

response. But sometimes it is inadequate to capture the structure of the data in a

linear way, because more ¬‚exibility is necessary. Additive models, trees, and neural

networks are methods that allow a more ¬‚exible regression modeling of the response

that combine the predictors in a nonparametric manner.

There also exist data which have a grouped, nested, or hierarchical structure and

that lead to the second extension of the above-mentioned regression model, namely

the generalization of the µ part. Because repeated measures, longitudinal, and man-

ifold data consist of several observations taken on the same individual or group and

the fact that this induces a correlation structure in the error µ, mixed effect models

are needed.

In the following, the third extension is explained in detail, which generalizes the

y part of the linear model.

7.1.1 Generalized Linear Models (GLMs)

GLMs have been introduced by Nelder and Wedderburn (1972) [7] and a detailed

representation is given by McCullagh and Nelder (1989) [6]. GLMs are necessary

to represent categorical, binary, and other response types because in standard linear

models it is not possible to handle non-normal responses such as counts or propor-

tions. Logit-, probit-, and Poisson models are important special cases of GLMs.

To de¬ne a GLM it is necessary to specify two components. At ¬rst, it is essential

that the distribution of the response variable is a member of the exponential family.

Furthermore, the link function shows how the mean of the response and a linear

combination of the predictors are related.

De¬nition 7.1 (cf. [4]) In a GLM the distribution of Y is from the exponential family

of distributions which take the general form

yθ ’ b(θ )

+ c(y, φ) .

f (y | θ, φ) = exp (7.2)

a(φ)

The θ is called the canonical parameter and represents the location while φ is

called the dispersion parameter and represents the scale.

7 Statistical Analysis of QKD Networks in Real-life Environment 125

The exponential family distributions have mean and variance (cf. [4]):

E(Y ) = μ = b (θ ), (7.3)

var (Y ) = b (θ ) a(φ). (7.4)

The mean is a function of θ only, while the variance is a product of functions of

the location and the scale. b (θ ) is called the variance function and describes how

the variance relates to the mean.

Let · denote the linear predictor:

· = β0 + β1 x1 + · · · + β p x p , (7.5)

then the link function g describes how the mean response E(Y ) = μ is linked to the

covariates through the linear predictor:

· = g(μ). (7.6)

Thus, a speci¬c generalized linear model is characterized by choosing the dis-

tributional type of the exponential family, the choice of the link function, and the

de¬nition of the predictors.

An example from the exponential family is the normal or Gaussian which is in

the following de¬ned by specifying the functions a, b, and c of Eq. 7.2 (cf. [4]):

(y ’ μ)2

1

exp ’

f (y | θ, φ) = √

2π σ 2σ 2

(7.7)

yμ ’ μ2 /2 1 y 2

= exp ’ + log(2π σ 2 ) ,

σ 2σ

2 2

with

θ = μ, φ = σ 2 , a(φ) = φ, b(θ ) = θ 2 /2, and c(y, φ) = ’(y 2 /φ + log(2π φ))/2.

The parameter φ is free in contrary to other exponential family members as, for

example, for the Poisson and binomial distributions. The reason is that the normal

distribution is a two-parameter family. It is also important to state that in the normal

case b (θ ) = 1 and hence the variance is independent of the mean. The identity link

in the normal distribution is de¬ned as · = μ.

Usually, the parameters β of a GLM can be estimated using maximum likelihood

[6]. Furthermore, having estimated a GLM for a data set the goodness of ¬t has to

be tested. In GLMs a measure for the goodness of ¬t is the deviance which measures

how closely the observed values are approximated by the model-based ¬tted values

of the response. To compare the deviance of two models a likelihood ratio test can be

used. There a statistic is used, which has a χ 2 -distribution with degrees of freedom

equal to the difference in the number of parameters estimated under each model.

126 K. Lessiak and J. Pilz

7.1.2 Generalized Linear Mixed Models (GLMMs)

The generalized linear mixed model (GLMM) is an extension of the GLM, espe-

cially to the context of clustered measurements. In a GLMM the idea of the GLM

is combined with the idea to include random effects. So, in a GLMM the linear

predictor · = x T β of the GLM is extended by adding random effects, which

are responsible to account for the correlation structure of clustered observations.

According to Faraway (2006) [4] the model takes the following form.

De¬nition 7.2 In a GLMM the response is a random variable Y taking values

y1 , ..., yn and with a distribution coming from the exponential family as before,

yi θi ’ b(θi )

f (yi | θi , φ) = exp + c(y, φ) . (7.8)

a(φ)

Moreover, with the canonical link θi = μi , the ¬xed effects β and the random

effects γ are related to θi through

θi = xiT β + z iT γ , (7.9)

where xi and z i are the corresponding rows from the design matrices X and Z for the

¬xed and random effects. The random effects are assumed to follow a probability

density h(γ |V ) with given (hyper-) parameters V.

A more speci¬c de¬nition for longitudinal and cluster data is given in Fahrmeir,

Kneib, and Lang (2007) [3].

Furthermore, according to Faraway (2006) [4] for estimation the likelihood takes

the form

n

f (yi |β, φ, γ )h(γ |V )dγ .

L(β, φ, V /y) = (7.10)

i=1

Due to the integral in the likelihood it becomes in general very dif¬cult to com-

pute this term explicitly. So, there are a lot of approaches to approximate the likeli-

hood using theoretical or numerical methods. Following Verbeke and Molenberghs

[13, 14] there are three main approximations to explain

• approximating the integrand

• approximating the data

• approximating the integral

The Laplace method is used for the approximation of the function to be inte-

grated, a speci¬c approach is given in Tierney and Kadane (1986) [12]. A penalized

quasi-likelihood approach (PQL) can be used for “approximating the data” and is

detailed in Wol¬nger and O™Connel (1993) [15]. For the case that these methods fail

(adaptive), Gaussian quadrature methods can be used, details are given in Pinheiro

7 Statistical Analysis of QKD Networks in Real-life Environment 127

and Bates (1995) [8], (2000) [9]. Demidenko [2] gives an introduction to approxi-

mations of maximum likelihood by statistical simulation methods, especially Monte

Carlo methods. Moreover, a Bayesian approach is possible, which is considered in

Sinha (2004) [11] and a further interesting approach is the generalized estimating

equations (GEE) considered by Zeger, Liang and Albert (1988) [17].

7.2 Results of the Experiments

As already described in Sect. 9.1, in the course of the SECOQC project in Vienna a

prototype of a QKD network was implemented. There were seven QKD-link devices

(described in Chap. 6) which connected ¬ve subsidiaries of SIEMENS Austria.

The measurements started on October 1, 2008 and were concluded on November

8, 2008. During this time the devices were tested and upgrades were executed. The

data used in this chapter are based only on the measurements from the different

devices from October 8, 2008 to October 10, 2008 of the quantum network because

a lot of data gaps arise out of upgrades on the devices. During the measurements in

the ¬ber ring network in Vienna data about the quality of QKD systems, especially

the qubit error rate (QBER) and the key rate (KR), are obtained. The data on air

temperature, humidity, sunshine duration, and global radiation are obtained from the

Central Institute for Meteorology and Geodynamics (ZAMG), which is the national

weather service agency in Austria. The calculations have been implemented in R

and are based on [4] and [16].

7.2.1 Data Set for the Device “Entangled”

First of all the entangled-based device is discussed which is called “Entangled.”

Alice was positioned in the SIEMENS Austria location in Erdberg (ERD) and Bob

was located in Siemensstrasse (SIE). The route ERD“SIE was used. The data set

consists of qubit error rate (QBER), key rate (KR), temperature, humidity, sunshine

duration, and global radiation. In Table 7.1 a short extract of the data set is presented.

Table 7.1 Extract of the data set of the device “Entangled”

QBER KR Temperature Humidity Sunshine duration Global radiation

329 2734 148 88 0 0

345 2650 145 89 0 0

329 2728 143 90 0 0

336 3151 141 91 0 0

379 2489 140 91 0 0

354 3056 141 91 0 0

An initial graphical and numerical look at the data is essential for any data

analysis. To get a compact numerical overview of the data the six statistics mini-

mum, 1st quantile, median, mean, 3rd quantile, and maximum for each numerical

128 K. Lessiak and J. Pilz

Table 7.2 Numerical overview of the results from the device “Entangled”

QBER KR Temperature

Min. : 291.0 Min. : 1707 Min. : 117.0

1st Qu.: 345.0 1st Qu.: 2304 1st Qu.: 134.0

Median : 364.0 Median : 2559 Median : 148.0

Mean: 374.3 Mean: 2519 Mean: 149.5

3rd Qu.: 393.0 3rd Qu.: 2700 3rd Qu.: 163.0

Max. : 513.0 Max. : 3595 Max. : 184.0

Humidity Sunshine duration Global radiation

Min. : 71.00 Min. : 0.0 Min. : 0.0

1st Qu.: 80.00 1st Qu.: 0.0 1st Qu.: 0.0

Median: 83.00 Median : 0.0 Median : 0.0

Mean : 84.07 Mean : 101.2 Mean : 92.98

3rd Qu.: 91.00 3rd Qu.: 0.0 3rd Qu.: 140.00

Max. : 93.00 Max. : 600.0 Max. : 539.00

variable are requested which are suf¬cient to get a rough idea of the distributions. In

Table 7.2 these six statistics of the data set from the device “Entangled” are shown.

In Fig. 7.1 the scatterplot of the data set is shown. A high correlation between

the variables is indicated by an elongated ellipse in the plot and it can be distin-

guished between a positive correlation and a negative correlation which depends on

the orientation. It can be seen that QBER and KR are highly correlated. To get a

numerical overview about the pairwise correlations the correlation matrix is useful.

The correlation matrix of the device “Entangled” can be seen in Table 7.3.

The scatterplot matrix and the correlation matrix show that external in¬‚uences

like temperature, humidity, sunshine duration, and global radiation do not have an

in¬‚uence on the quality of QKD systems, i.e., on the entangled-based device. In

contrast to the results of the measurements of April 23, 2008 shown in [5] an in¬‚u-

ence of these external in¬‚uences on the quality of QKD systems can be observed.

This difference is due to the fact that the devices were upgraded.

The next step to get a good overview and a good understanding of the data is

to have a look on graphical summaries. An essential means to get an idea of the

distribution of each numerical variable are histograms. A further well-known means

is a density estimate. Boxplots are very useful to ¬nd out the outliers in the data set.

In Fig. 7.2 the histogram, the density function, and the boxplot of QBER and KR are

given. The boxplot of QBER shows a lot of outliers. Before testing the distributions

it is important to eliminate these outliers. The reason is that these outliers can falsify

the result.

To get further information about the distributions different tests are possible,

for example, the Kolmogorov“Smirnov test. A good alternative is the Cramer“

von Mises two sample test [1] because it is more powerful than the Kolmogorov“

Smirnov test. The Cramer“von Mises two sample test declares that QBER can be

assumed to be gamma distributed because the p-value is 0.36. The fact that the

p-value is greater than 0.05 is an indication that this hypothesis cannot be rejected.

7 Statistical Analysis of QKD Networks in Real-life Environment 129

2000 3000 75 85 0 200 400

500

400

QBER

300

3000

KR

2000

180

150

temperature

120

85

humidity

75

500

sunshine duration

200

0

400

global radiation

200

0

300 400 500 120 150 180 0 200 500

Fig. 7.1 Scatterplot matrix for the data set of the entangled-based device

Table 7.3 Correlation matrix for the device “Entangled”

QBER KR Temperature

QBER 1.0000000 “0.7000019 0.0276082

KR “0.7000019 1.0000000 “0.0179497

Temperature 0.0276082 “0.0179497 1.0000000

Humidity “0.0824010 0.0895992 “0.9473179

Sunshine duration 0.0968474 “0.2794770 0.5800525

Global radiation 0.0075992 “0.2888295 0.5531215

Humidity Sunshine duration Global radiation

QBER “0.0824010 0.0968474 0.0075992

KR 0.0895992 “0.2794770 “0.2888295

Temperature “0.9473179 0.5800525 0.5531215

Humidity 1.0000000 “0.6192554 “0.5692125

Sunshine duration “0.6192554 1.0000000 0.8631108

Global radiation “0.5692125 0.8631108 1.0000000

130 K. Lessiak and J. Pilz

Histogram of QBER Density function of QBER Boxplot of QBER

0.012

70

500

60

450

50

0.008

Frequency

40

Density

400

30

0.004

20

350

10

300

0.000

0

300 350 400 450 500 250 350 450 550

Data$QBER N = 293 Bandwidth = 10.35

Histogram of key rate Density function of key rate Boxplot of key rate

0.0015

3500

80

3000

60