1. Introduction

In 1991, Ekert proposed the distribution of absolutely secure keys by using quantum entanglement [1]. This idea was followed by a modified protocol devised by Bennett, Brassard and Mermin, which is now referred to as the BBM92 quantum key distribution (QKD) protocol [2]. These concepts of entanglement-based QKD fascinated many physicists and communication researchers, and resulted in several experimental demonstrations. Entanglement-based QKD has certain possible advantages over QKD systems with attenuated laser sources. For example, Waks et al. showed that we can approximately double the key distribution distance, based on a security analysis that took account of individual attacks [3]. Moreover, the unconditional security of entanglement-based QKD with practical sources and detectors has recently been proved [4–7]. Another merit of entanglement-based QKD protocols is that we can eliminate the need for a random number generator, which is one of the components that are currently difficult to implement in point-to-point QKD systems with a GHz clock rate [8–11]. Here, we would like to note that high-speed physical random number generators are currently being intensively studied to solve this problem [12–14].

Several entanglement-based QKD experiments have already been reported [15–22]. Our group, in collaboration with NIST, Stanford University and NICT, reported BBM92 QKD experiments performed over 100 km of optical fiber using superconducting single photon detectors (SSPD) [22]. Thanks to the extremely small dark count rate of the SSPDs, we successfully distributed keys that were secure against general individual attacks [3] over 100 km (50 km × 2) of fiber. However, there were several drawbacks with this experiment. One such drawback was the relatively small key generation rate: even at 0 fiber length, we observed a secure key rate of 20 bit/s. This low rate is mainly because of the low detection efficiencies of the SSPDs used in the experiment (approximately 1%). Since the key generation rate is proportional to the square of the detection efficiency in entanglement-based QKD systems, it is important to use detectors with high detection efficiencies to increase the key rates. In addition, the SSPDs had to be cooled to below 4 K, which made them hard to use in practical communication systems. Another problem was the complexity of the source. We employed two periodically-poled lithium niobate (PPLN) waveguides, one of which was used for generating 780-nm pulses from 1550-nm pump pulses through second harmonic generation (SHG). The other used for generating time-bin entangled pairs via spontaneous parametric downconversion (SPDC). This setup enabled us to use high-speed modulators in the 1.5-µm band to prepare 780-nm pulses with a high clock frequency, but the need for two nonlinear media made the system complex and bulky. Moreover, the temperatures of the two PPLN waveguides had to be controlled precisely to achieve a phase matching condition.

In this paper, we present an entanglement-based QKD experiment using practical devices. We implemented the BBM92 protocol using an entangled photon-pair source based on spontaneous four-wave mixing (SFWM) in a silicon photonic wire waveguide, by which we obtained high-purity time-bin entangled photon pairs in the 1.5-µm band with a very simple setup and without the need for temperature control [23,24]. We also used four channels of single photon detectors based on InGaAs/InP avalanche photodiodes (APD). These detectors were all operated with a sinusoidal gating scheme with a gate frequency of as high as 500 MHz [25], which contributed to a significant increase in the sifted key rate compared with previous entanglement-based QKD experiments [18,19,21,22]. To estimate the secure key rate, we employed a security proof based on squash operators [4, 5, 7], which can be applied to QKD systems with practical threshold detectors. As a result, we confirmed the successful generation of secure keys between Alice and Bob separated by 100 km of fiber with a key rate of 0.15 bit/s.

 

Fig. 1. Experimental setup.

Download Full Size | PDF

2. Setup

Figure 1 shows the experimental setup. 1.5-µm band double pulses were produced at a clock frequency of 100 MHz by modulating a continuous laser light with an intensity modulator. The pulse width and interval were 100 ps and 2 ns, respectively. The pulses were launched into a silicon wire waveguide [26] module after the polarization state was adjusted so that it was horizontal. In the module, single mode fibers were connected to the input and output of the waveguide using UV adhesive. This means the module can be used as a stable entanglement source that does not require any active components except for the pump laser. The loss induced in the fiber coupling was estimated to be 1.4 dB per point, including the loss caused by the spot size converters fabricated at both edges of the waveguide [27]. The waveguide used in the experiment was 0.9 cm long, 460 nm wide, and 220 nm thick. The SFWM inside the waveguide [23, 24] generated time-bin entangled photon pairs, whose approximate state is shown by the following equation [28].

Here, ∣k〉_x denotes a state where there is a photon in mode x(= s: signal, i: idler) and time slot k. We set the peak pump power at 0.028 W, thereby obtaining entangled pairs whose average photon-pair number per a pair of time bins was approximately 0.03. This implies that the nonlinear coefficient γ of our silicon wire waveguide exceeded 10⁵ [1/W/km], which is five orders of magnitude larger than that of a conventional silica fiber. The very tight confinement of light in the nano-scale waveguide enabled this very large third-order nonlinearity. A detailed experimental characterization of our waveguide is included in [29]. The generated photons were input into a dielectric filter to separate signal and idler photons whose wavelengths were 1546.3 and 1555.9 nm, respectively. The insertion loss and the 3-dB bandwidth of the filter for both channels were 2.0 dB and 115 GHz, respectively. The signal and idler photons were transmitted over spools of 50-km dispersion shifted fiber (DSF) and sent to Alice and Bob, respectively. Alice and Bob input the received photons into 1-bit delayed interferometers fabricated using planar lightwave circuit (PLC) technology [30]. The insertion loss of the interferometers was 2.0 dB. The two output ports of each PLC interferometer were connected to single photon detectors based on sinusoidally-gated InGaAs/InP APDs. The detection efficiency and dark count probability per gate of the four detectors were set at 8% and 10⁻⁵, respectively. The details of our sinusoidally-gated detectors are reported in [31]. The detection signals from the detectors were input into a 4-port OR logic gate after appropriate delay lines had been added. Trigger signals synchronized with the pump pulses and the signals from the OR gate were used as start and stop pulses for a time interval analyzer (TIA) (Fast ComTec P7889), by which we were able to record the arrival times of the start and stop signals with a rate as high as 5 GHz and a timing resolution of 100 ps. The period of the trigger signal was 10 µs, and the TIA records stop events for a 6.5536-µs temporal span after each trigger. Thus, the effective measurement time was ~66% of the real measurement time. The experimentally obtained key rates presented in section 4 correspond to the key rate in this effective measurement time window, and so the actual key rates are simply obtained by multiplying the values in section 4 by ~0.66.

We implemented the BBM92 protocol with the scheme presented in [17], in which two non-orthogonal measurement bases are passively selected by using 1-bit delayed interferometers. When a time-bin qubit state passes through a 1-bit delayed interferometer, there is the possibility of observing a photon in three time slots. Photon detection at the first or third slot and that at the second time slot correspond to two non-orthogonal measurement bases. Conventionally, the former is called the “time basis”, while the latter called the “energy basis”. A 1-bit delayed interferometer whose relative phase difference is adjusted to 0 converts a quantum state ∣k〉_x to $\frac{1}{2}({\mid k,p_1〉}_x-{\mid k,p_2〉}_x+{\mid k+1,p_1〉}_x+{\mid k+1,p_2〉}_x)$ , where p ₁ and p ₂ denote the interferometer output ports. Then, Eq. (1) is converted to

where only terms that contribute to the coincidences in the matched bases are shown. The 5th and 6th terms on the right hand side of Eq. (2) correspond to the coincidences in the energy basis, while the other terms correspond to those in the time basis. This equation clearly shows that we observe correlations in “ports” in the energy basis coincidences and correlations in “time slots” in the time basis coincidences, and thus Alice and Bob can share the correlated measurement results that can be converted into a sifted key.

Since the entanglement source is based on a spontaneous parametric process, the source probabilistically generates multiple pairs in a pulse. These multiple pairs cause “accidental coincidences” between Alice and Bob, which lead to an increase of the error rate. The multiplepairs also cause events in which two detectors owned by Alice or Bob click simultaneously (double click). In our experiment, Alice or Bob assigned a random bit to each double click event.

3. Secure key rate calculation

According to [4, 5], by introducing a squash operator, which is a quantum operation that transforms an incoming n-photon state to a qubit state, we can show that security proofs based on the virtual entanglement distillation protocol (EDP) [32,33] are valid for a system using threshold detectors. In addition, this theoretical approach has been expanded to multimode threshold detectors [5, 7]. Therefore, we calculated the secure key rate based on the EDP assisted by the squash operator. Based on the EDP reported in [33], the secure key rate R_sec is given by

 

Fig. 2. Coincidence rate (squares) and idler count rate (circles) as a function of idler interferometer temperature.

Download Full Size | PDF

Here, R_sif, e, and h are the sifted key rate, error rate, and the binary entropy function, respectively. f(e) represents the efficiency of the error correcting code. In the calculation of the experimental secure key rates described below, we used f(e) values as listed in Table I of [3].

4. Results

To evaluate the quality of the entangled photon pairs generated from the silicon-based source, we first undertook a two-photon interference experiment. We employed a 500-MHz pulse train to generate a sequential time-bin entangled state [34]. We fixed the signal interferometer temperature at 21.8 deg. and measured the coincidence count rate as a function of the idler interferometer temperature. The result is shown in Fig. 2. Here, we set the pump peak power at the same value as that used for the QKD experiment described below. We observed a clear two-photon interference fringe with a visibility of 93.3%.

Table 1. QKD results

View Table

We then undertook a BBM92 QKD experiment with fiber lengths of 0, 20, 50 and 100 km. To reduce the statistical error in the error rate estimation, we set the measurement times for each transmission distance to obtain at least 10,000 sifted key bits. The obtained results are summarized in Table I.

 

Fig. 3. Sifted and secure key rates as a function of fiber length between Alice and Bob. Theoretical key rates are calculated assuming a fiber loss of 0.2 dB/km.

Download Full Size | PDF

Based on Eq. (3), we calculated the secure key rates using the sifted key rates, error rates and double click fraction that we obtained experimentally. Figure 3 shows the sifted (circles) and secure key rates (squares) as a function of fiber length between Alice and Bob. As we discuss in Appendix B, the experimentally obtained double click fraction was very small as expected from a theoretical model indicating that the effect on the secure key rate was fairly limited. The fitted curves are a theoretical estimation based on the equations given in Appendix A. To calculate the secure key rate, we assumed a system error rate of 3% so that the back-to-back error rate coincided with the experimentally obtained error rate (4.7%). The obtained curves agreed reasonably well with the experimental results. According to our previous study, the noise photons caused by spurious nonlinear effects and pump leakage in the silicon-based source were well below the sensitivity of our detection system [29]. We estimate that regarding the 3% system error rate, approximately 2% comes from the timing jitter of the detectors, and the remaining 1% from the limited extinction ratio of the interferometers. At 100 km, most of the errors were presumably caused by accidental coincidences, which includes coincidences caused by multi-photon emission and dark counts.

We note that we successfully improved the key rate compared with previous entanglement-based QKD experiments over optical fiber. At 0 km, we obtained a secure key rate of 208 bit/s, which is about ten times larger than that obtained in our previous experiment using superconducting single photon detectors [22]. This significant increase is achieved thanks to the relatively large detection efficiencies of the InGaAs/InP based detectors. Moreover, we were able to generate secure keys over 100 km of fiber with a secure key rate of 0.15 bit/s. With the experimental result in [22], we can obtain a secure key rate of 0.12 bit/s. Thus, the present result outperformed the previous experiment using SSPDs up to a transmission distance of 100 km, which clearly reveals that the high-speed InGaAs/InP detectors are useful for entanglement-based QKD systems.

5. Conclusion

We have reported a long-distance entanglement-based QKD experiment. We employed a 1.5-µm band entanglement source based on a silicon wire waveguide module, which generated high-purity time-bin entangled photons with a relatively simple setup. The use of high-speed single photon detectors based on InGaAs/InP APDs resulted in approximately a tenfold increase in the key rate compared with the previous results for telecom-band entanglement-based QKD. Based on the security proofs recently reported in [4, 5, 7], we were able to generate sifted keys from which we could distill secure keys over up to 100 km of fiber. We believe that the technologies established in the present experiment will constitute important tools for realizing entanglement-based quantum communication systems over optical fiber networks.

A. Theoretical sifted key rate and error rate for Poissonian photon-pair source

Here, we derive equations for estimating the sifted key rate and error rate obtained in a QKD system using an entanglement source based on a spontaneous parametric process. In our experiments, the coherence time of the photon pairs was estimated to be ~4 ps, while the pump pulse width was 100 ps. Therefore, a pump pulse can generate photon pairs in many different temporal modes. In this situation, the number distribution of the photon pairs becomes Poissonian [35, 36]. In the following, we assume the use of entangled photon pairs with an average photon-pair number per pulse of μ. Then, the pair number distribution is given by the following equation.

A.1. Sifted key rate

A.1.1. Energy basis

The quantum state of the pair, which is given by Eq. (1) in the time basis, is shown by the following energy-basis expression.

where ∣a〉 = (∣1〉+∣2〉)/√2 and ∣b〉 = (∣1〉−∣2〉)/√2.

We denote D_k as the detection probability when k photons are incident on a detector, whose collection efficiency (including the coupling efficiency between the nonlinear medium and the fiber, the filter loss, the fiber transmission loss, and the detection efficiency of the detector) and dark count probability are given by α and d, respectively. Here, we exclude the 3-dB loss caused by the passive selection of the measurement bases. Then, when α,d << 1, D_k is expressed as

We consider a case where x independent pairs (the state of each pair is shown by Eq. (5)) are generated in two pulses. Then, the whole quantum state is given by [36]

Since the state in Eq. (7) is a classical mixture of Fock states from each of Alice and Bob’s viewpoints, we are allowed to work on each Fock state independently. Based on the binominal theorem, when there are y pairs that cause the detection at detector b, the number of combinations is given by ${}_x{C}_y=\frac{x!}{y!(x-y)!}$ . In this case, the detection probability at either Alice or Bob is given by D_x−y + D_y. Then, taking account of the 50% loss caused by the basis selection, the coincidence probability for x pairs is given by

In the parentheses on the right hand side of the above equation, the term 2D_x−y D_y corresponds to the events where detector a on Alice’s site and b on Bob’s site, or vice versa, registered a click, which induces errors. Therefore, the coincidence probability that contributes to errors is expressed as

The overall sifted key rate per qubit for the energy basis R_energy is obtained as

The coincidence rate that causes an error is given by

By using Eq. (6), these values are simplified to

The above agree with the equations derived in [36]. Note that the above equations represent the probability of simultaneous clicks between two detectors, one from Alice’s site and the other from Bob’s, but do not exclude double clicks, where three or all four detectors click. The same is true for the time basis, which we will describe next.

A.1.2. Time basis

In the time basis measurement, we discriminate the temporal position of the photon output from either port A or B. This setup is equivalent to a time discrimination experiment using a single detector with the same collection efficiency α but with a dark count probability of 2d. Then, the detection probability in the time basis is given by

Other than the difference of the detection probability, we can use the same procedure as that used for deriving energy basis equations. Consequently, we can obtain the following sifted key rate and the coincidence rate that causes error as follows.

A.2. Double click rate

Again we consider a case where x pairs are generated in a qubit. With a similar procedure to that used in the sifted key rate calculation, the probability of obtaining threefold coincidences, which gives double clicks either at Alice or Bob, is given by the following equation.

Using the above equation, we can derive the double click rate (= threefold coincidence rate) per qubit as

With Eqs. (6) and (14), we can obtain the double click rates for the energy and time bases. The results are simplified to:

Thus, the overall double click rate is given by

A.3. Sifted key rate and error rate

As described above, the coincidence rates given by Eqs. (12), (13), (15), and (16) include the cases in which three or four detectors simultaneously click. This means that double click events are double-counted in the derivation of those rates. In the following, we neglect events where all four detector click simultaneously. Then, the sifted key rate R is given by the following equation.

Since we assign a random bit to each double click event, a double click event contributes to an error with a 50% probability. Therefore, the overall rate of the coincidences that cause errors, R_er, is given by

The error rate e is obtained as

We can obtain the theoretical secure key rate by plugging Eqs. (22) and (24) into Eq. (3).

B. Experimental result of double click rate

In the experiments, we observed very few double clicks: even without transmission fibers, the total number of double clicks was 44 in an effective measurement time of ~295 s, yielding a double click fraction with respect to the sifted key of 2.9×10⁻⁴. According to the theory described in Appendix A, 49 double clicks were expected in the measurement time and this is in good agreement with the experimental result. In addition, we observed no double clicks at 50 or 100 km. For example, the expected number of double clicks at 100 km is 0.6, even with a measurement time as long as ~ 40 minutes. These calculated and experimental results clearly show that double clicks have a negligible effect on the error rate for photon-pair sources based on spontaneous parametric processes, if we set the photon number per pulse at a relatively small value as in our experiment.