A balanced homodyne detector for high-rate Gaussian-modulated coherent-state quantum key distribution

We discuss excess noise contributions of a practical balanced homodyne detector in Gaussian-modulated coherent-state (GMCS) quantum key distribution (QKD). We point out the key generated from the original realistic model of GMCS QKD may not be secure. In our refined realistic model, we take into account excess noise due to the finite bandwidth of the homodyne detector and the fluctuation of the local oscillator. A high speed balanced homodyne detector suitable for GMCS QKD in the telecommunication wavelength region is built and experimentally tested. The 3dB bandwidth of the balanced homodyne detector is found to be 104MHz and its electronic noise level is 13dB below the shot noise at a local oscillator level of 8.5*10^8 photon per pulse. The secure key rate of a GMCS QKD experiment with this homodyne detector is expected to reach Mbits/s over a few kilometers.


I. INTRODUCTION
Quantum key distribution (QKD) based on Gaussian-modulated coherent-state (GMCS) protocol has attracted a lot of attention [1][2][3][4][5][6][7]. Comparing with the BB84 QKD, the GMCS QKD presents several advantages. The coherent state required by GMCS QKD can be produced easily by a practical laser source, while the perfect single photon source required by BB84 QKD is hard to obtain. Although improved BB84 protocols (such as decoy protocols [8][9][10][11]) are compatible with coherent laser sources, they do require single photon detectors, which are expensive and have low efficiency. The homodyne detector in the GMCS QKD, on the other hand, can be constructed using high efficiency PIN photodiodes [3]. The GMCS QKD also has an advantage of transmitting multiple bits per symbol [1,12]. The security of the GMCS QKD was first proven against individual attacks with direct [13] or reverse [1,14] reconciliation schemes. Security proofs were then given against general individual attacks [14] and general collective attacks [15][16][17]. To date, three groups have independently claimed that they have proved the unconditional security of GMCS QKD [18][19][20].
Fiber-based GMCS QKD systems over a practical distance are challenging and only a few groups have demonstrated QKD experiments over tens of kilometers [6,15,21,22]. Current repetition rates used in those GMCS QKD experiments are below 1 MHz, which in turn, makes the GMCS QKD less competitive than the single photon BB84 QKD operating at GHz repetition rates [24,25]. The repetition rate of GMCS QKD is limited by a few factors: (1) the speed of the homodyne detector [6]; (2) the speed of the data acquisition system; and (3) the speed of the classical data processing algorithm [3]. The speed of date acquisition and classical data processing can be increased by hardware engineering and are not fundamental limits in GMCS QKD. In this work, we mostly focus on increasing the homodyne detector speed and analyzing various excess noise contributions introduced by a practical homodyne detector.
The balanced homodyne detection used in quantum measurement, proposed by Yuen and Chan [26], plays an important role in quantum optics [27][28][29] and quantum cryptography [1,3,6,15,22,23]. In a balanced homodyne detector (BHD), the signal to be measured is mixed with a local oscillator (LO) at a beam splitter. The interference signals from the two output ports of the beam splitter are sent to two photodiodes followed by a subtraction operation, and then, amplification may be applied. The output of a BHD can be made to be proportional to either the amplitude quadrature or the phase quadrature of the input signal depending on the relative phase between the signal and the LO. The output of the BHD can be captured in either frequency [30] or time domains [31][32][33][34]. For GMCS QKD, measurement in the time domain that is capable of resolving each individual pulse (representing a weak coherent state) is required in order to extract random key information [1]. This pulseresolving requirement demands that the bandwidth of the detection system be significantly higher than the repetition rate of the QKD operation, which highlights the importance of developing high bandwidth BHDs.
In this paper, we develop a broadband BHD suitable for GMCS QKD operating at a repetition rate of tens of MHz. To predict its performance in GMCS QKD, we first analyze the excess noise contributed by this practical BHD. In the GMCS QKD, excess noise is defined in units of shot noise and includes all noises due to system imperfections and eavesdropping, which are above and beyond the vacuum noise associated with channel loss and losses in Bob's system. It determines the maximum amount of information that could be obtained by Eve. In the original realistic model proposed in previous GMCS QKD literature [1,6,15], the excess noise contributed by a BHD is the electronic noise of the BHD. This model does not consider the excess noise that originates from other imperfections in a practical BHD and is not conservative enough in estimating the information possibly be leaked to Eve. In this paper, we refine the original realistic model which has been widely adopted to calculate key rates for practical GMCS QKD systems and identify two new noise sources of a practical homodyne detector: (1) the excess noise caused by the BHD electrical pulse overlap at the BHD output; and (2) the excess noise caused by LO fluctuation. Under the refined realistic model, we quantify the various excess noise contributions from the broadband BHD we constructed. Based on our simulation using the experimentally determined excess noise of the BHD, secure GMCS QKD key rates using this BHD is predicted to reach Mbits/s over a few kilometers. This paper is organized as follows: In Section II, we revisit GMCS QKD protocol, identify two new excess noise sources, and introduce the key generation rate formulas based on the refined realistic model. In Section III, we analyze the excess noise contribution of a practical BHD. In Section IV, we discuss practical issues in building a high speed BHD, including different temporal responses of two photodiodes, appropriate pulse duration, and the BHD linearity and the construction of a high speed HD in GMCS QKD. In Section V, we will report the performance of the BHD and predict the key rates by simulation.

II. GAUSSIAN-MODULATED COHERENT-STATE PROTOCOL
The basic GMCS QKD protocol is as follows: Alice generates two random sets of continuous variables x and p with a Gaussian distribution that has a zero average. Alice encodes random bits (key information) by modulating the amplitude quadrature (x) and the phase quadrature (p) of weak coherent states |x + ip (typically less than 100 photons in each pulse) with her Gaussian-distributed random variable sets {x, p}. On the receiver's side, Bob measures either x or p quadrature of the weak coherent states randomly by using homodyne detection. By repeating this procedure multiple times, Alice shares a set of correlated Gaussian variables (called the "raw key") with Bob. By comparing a random sample of their raw key, they can evaluate parameters of QKD and upper bound on Eve's information. Finally, they can generate secure key by performing reconciliation.
In the presence of individual attacks, one can estimate the information leaked to Eve from the amount of excess noise quadrature noise observed by Bob in excess of standard quantum limit [1]. The most conservative estimation (the general model ) assumes all the excess noise is introduced by eavesdropping, whereas the original realistic model assumes that Eve cannot control the LO or take advantage of the excess noise generated within Bob's system [1]. In the original realistic model, the excess noise has several contributions: (1) noise due to imperfection outside Bob's system is denoted as ε A . This part of noise can be controlled by Eve; (2) noise from Bob's system that is uncontrollable by Eve, called N Bob . In Refs. [3,15], the latter refers to the homodyne detector noise (N hom ), while in Refs. [6,21], it consists both homodyne detector noise (N hom ) and the noise associated with the photon leakage from the LO to the signal (N leak ). In previous papers [3,6,15,21], N hom is regarded to consist of only the electronic noise (i.e. N hom = N ele ). In this paper, we refine this realistic model and consider other imperfections of a practical BHD, and conclude that excess noise caused by a practical BHD (N hom ) could be divided into three parts: (1) electronic noise In Ref. [40], the need to monitor the intensity of the LO for security proofs in discrete QKD protocol embedded in continuous variables has been discussed. In GMCS QKD experiment, Alice and Bob can monitor LO, and discard pulses with large intensity changes in LO. However, there is always a small measurement error due to imperfect measurement instrument. Therefore, it is reasonable to assume there is a small amount of LO fluctuation that Eve can take advantage of. Therefore, in this refined realistic model, ε overlap and N LO generated by a BHD, as well as N leak associated with leakage LO photons, are all considered controllable by Eve. N LO is caused by imperfect subtraction of BHD in the presence of LO intensity fluctuation while N leak is due to the interference between leakage photons and LO photons.
Following an approach similar to that in [1], we will now present the GMCS QKD key rate formulas based on refined realistic model. The mutual information between Alice and Bob I AB is determined by the Shannon entropy [35]. According to Refs. [1,3], where In Eq. (1), V = V A + 1 is the quadrature variance of the coherent state prepared by Alice (1 is the shot noise of a coherent state) and V A is Alice's modulation variance (variance of x or p quadrature modulated by Alice). In Eqs. (1) and (2), χ is the equivalent noise measured at the input, which is composed of "vacuum noise" χ vac (noise associated with the channel loss and detection efficiency of Bob's system) and "excess noise" ε (noise due to the imperfections in a non-ideal QKD system). G is the channel efficiency (transmission), and η is the total efficiency of Bob's device (optical loss and detector efficiency).
We will now discuss the key rate formulas for the case of the refined realistic model, which we defined earlier in this Section. Under the refined realistic model, noise that can in principle be controlled by Eve (ε E ) includes (1) ε A due to imperfections outside Bob's system; (2) ε overlap introduced by electrical pulse overlap due to finite response time of the BHD; (3) N LO due to LO fluctuations in the presence of incomplete subtraction of a BHD and (4) N leak associated with the leakage from LO to signal. Excess noise that is out of Eve's control (N Bob ) is electronic noise from the homodyne detector (N ele ). Therefore, the total excess noise ǫ can be written as [1] where ε E = ε A + ε overlap + N LO /ηG + N leak /ηG and N Bob = N ele . ε A and ε overlap are referring to the input. N LO , N leak and N ele are defined from the output and need to be divided by ηG when we convert them to the input. Figure 1 summarizes the various noise terms considered in the original realistic model and the refined realistic model. N leak is mostly determined by the design of the QKD system rather than by the BHD. Since our main goal is to study the excess noises contributed by the BHD, we simply assume N leak = 0 in this paper. From Eqs. (2) and (3), the equivalent input noise is With a reverse reconciliation scheme, the mutual information shared by Bob and Eve under the refined realistic model is If a reverse reconciliation algorithm [1] is adopted, the secure key rate is where β is the reconciliation efficiency (β ≤ 1). In real QKD systems, β is 0.9 in Ref. [22] and 0.898 in Ref. [15]. If the laser repetition rate of QKD experiment is R Hz, the secure key per second can be written by

III. EXCESS NOISE CONTRIBUTED BY THE BHD IN A GMCS QKD
As previously stated, excess noise represents the amount of information that could possibly be leaked to Eve in a GMCS QKD system and is important in estimating the amount of secure information.
In this section, we will evaluate various sources of the excess noise for a practical BHD.

A. BHD electronic noise
Electronic noise N ele of a BHD is mainly contributed by thermal noise of electronic components and amplifier noise [36]. Since shot noise scales with LO power and electronic noise is independent of the LO power [37], by measuring the BHD noise as a function of the LO power when vacuum is sent to the signal port, we can quantify the electronic noise in units of shot noise. Electronics noise in a BHD has been discussed in [38].

B. Excess noise due to electrical pulse overlap
Ideally, the secure key rate of a GMCS QKD system is proportional to its operation rate. However, in practice, the BHD has a finite bandwidth. As the laser pulse repetition rate approaches the bandwidth of the BHD, we will expect a non-negligible overlap between adjacent electrical pulses at the output of the BHD. If the electrical pulses have overlap in the time domain, the measured quadrature value contains contributions from adjacent pulses.
We will estimate the amount of excess noise contributed by the electrical pulse overlap.
The exact relation between the electrical pulse width τ and the BHD bandwidth B depends on the electrical pulse shape. We have experimentally found that the relation τ ∼ 1/B applicable to our homodyne detector. In this case, we can estimate the overlap by writing the following functions for two consecutive pulses: (a) e −(t−1/R) 2 /2τ 2 and (b) e −t 2 /2τ 2 , where R is the laser repetition rate and τ is the Gaussian pulse width. If the quadrature value is determined by the peak of the measured electrical pulse, the contribution of pulse (a) to Since each pulse has two adjacent pulses, the excess noise contributed by electrical pulses overlap (referring to the input) is where V A is Alice's modulation. We remark that the excess noise due to the overlapping between adjacent pulses could be further reduced by deconvolution [34].
By decreasing this repetition rate, we can reduce the excess noise caused by overlap.
However, the GMCS QKD key rate per second will be reduced too. In Fig. 2, we simulate the GMCS QKD key rate per second as a function of the repetition rate using Eqs. (1), (5), (6) and (7). With a BHD bandwidth of 100 MHz, the optimal pulse repetition rate is around 36 MHz. At repetition rates beyond ∼ 46 MHz, there will not be any secure key generated.
At low repetition rate, the excess noise due to electrical pulse overlap is negligible compared to other excess noise contribution (ε A ), and the key rate per second is almost proportional to the repetition rate. As the repetition rate is increased beyond a critical point, the excess noise due to overlap is dominant and the key rate drops quickly with the repetition rate.

C. Excess noise contributed by LO fluctuations
One of the advantages of BHD is that ideally the fluctuations of LO will be canceled after the subtraction. However, in a practical BHD, the positive and negative pulses cannot be canceled completely due to several reasons, such as different quantum efficiencies of the two photodiodes, different temporal responses of the photodiodes and the subsequent electronic amplifiers, or different optical intensities of the two balanced beams. The difference can be partially compensated, for example, by adjusting the losses and the relative delay of the two balanced arms, however, it cannot be completely canceled out. The remaining difference also varies with LO power. The consequence is that the fluctuation of the LO power will contribute to the excess noise.
The quadrature measurement corresponds to the time integrated electronic response of the detector. Neglecting the shot noise, this response equals where I LO is the number of photons in the local oscillator pulse, t is the beam splitter transmittance, r is reflectivity and G 1,2 are the time integrated gains of the amplifiers associated with the two photodiodes. We assumed that the quantum efficiency of the photodiodes is 1 and the signal is in the vacuum state. On the other hand, given that the variance in the number of photoelectrons in each photodiode due to the shot noise equals to the number of incident photons, we obtain the the output shot noise as If the relative fluctuation of the LO power is ∆I 2 LO /I LO = f , the mean square fluctuation in the number of output photoelectrons in the units of shot noise is [39] For a well-balanced detector, t 2 ≈ r 2 ≈ 1/2 and G 1 ≈ G 2 . In this case, the above expression can be written as δ ≈ δ opt + δ el , where δ opt = t 2 − r 2 is the imbalance of the optical beam splitter whereas δ el = (G 1 − G 2 )/(G 1 + G 2 ) is the electronic characteristic of the balanced detector related to its common-mode rejection ratio (CMRR). In what follows, it is convenient to discuss N LO in terms of generalized CMRR which is measured in decibels and defined as CMRR = −20 log 10 (2δ).
The magnitude of N LO can be estimated from the Taylor decomposition of the noise variance as a function of the local oscillator power. The shot noise variance is proportional to the LO level, whereas N LO depends on it quadratically [36]. We note that for determining  With the same GMCS QKD parameters used to produce Fig. 2, we simulate the GMCS QKD secure key rate as a function of the CMRR of the BHD in Fig. 3. When CMRR is lower than 55 dB (where key rate is 90 % of the maximum), key rate drops quickly as the CMRR drops. To obtain a positive key rate, the CMRR of the BHD should be greater than ∼ 44 dB. When CMRR is greater than 55 dB, the secure key rate will not improve too much by increasing the CMRR since other excess noise contribution (ε A ) is dominant.

IV. CONSTRUCTION AND PERFORMANCE
In this section, we will present our construction and test results of a high speed BHD in the telecommunication wavelength region. We will also predict the excess noise and secure key rate by using this BHD in a GMCS QKD experiment. Figure 4 (a) shows a schematic of our balanced homodyne detection system. In the telecommunication wavelength region, the signal and the LO beams will interfere at a twoby-two fiber coupler with a splitting ratio of 50:50. A variable optical attenuator and a variable optical delay are placed in the output paths of the fiber coupler, for adjusting losses and the lengths of the two paths accurately. Two photodiodes will detect the interference beams of the signal and the LO after precise balancing of time and intensity. Finally, a subtraction of the photocurrents generated by the two photodiodes is performed and the differential signal is amplified. To avoid disturbances from the environment, we used an enclosure to isolate the system of Fig. 4 (a).
In the electronic circuit shown in Fig. 4 (b), two InGaAs photodiodes from Thorlabs (FGA04, 2 GHz bandwidth, quantum efficiencies: 90 % and 93%) are reversely biased. The differential signal is amplified by two OPA847 operational amplifiers. The whole BHD circuit is built on a custom-designed printed circuit board. To minimize the parasitic capacitance, two photodiodes with short electrical contact legs are placed very close to each other. In GMCS QKD, continuous Gaussian random numbers encoded on each pulse have to be recovered by the balanced homodyne detection on Bob's side. To ensure the BHD output is proportional to the electric field quadrature of each pulse, the linearity of the BHD has to be guaranteed. In practice, the photodiode and electronic amplifiers can both have nonlinearities. A proper pulse width should be carefully chosen to guarantee that the photodiodes are working in their linear regions. In the test of the photodiode linearity, we send pulsed light to only one photodiode while blocking the other one. At a laser repetition rate of 10 MHz, we measure the output photocurrent generated by the photodiode (before it goes to the electronic amplifiers) at different incident optical powers using an oscilloscope. In Fig.   5, we compare the output electrical pulse peak current when a laser source with (a) ∼1 ps or (b) 50 ns pulse duration is used. We can see from Fig. 5 (a), the photodiodes saturate at a low optical input photon number per pulse than that of (b). In fact, the high peak power of the ∼1 ps-pulse (∼ 18 W) saturates the photodiodes. In the case of 50-ns pulse as a source (Fig. 5 (b)), photodiodes are working in their linear regions (4 % deviation) up to 10 9 photons/pulse.
The linearity test of the electronic amplifiers is shown in Fig. 6. By sending positive or negative electrical pulses (50-ns width, 10 MHz repetition rate) to the electrical amplifiers shown in Fig. 6 (a), we measure the output electrical pulse peak voltage as a function of the input electrical current. The trans-impedance gain is measured to be 22 kV/A in Fig. 6 (b). The trans-impedance gains for the positive and negative pulses are almost equal with less than 1 % deviation from their linear fits.

C. BHD bandwidth
We first characterize the bandwidth of our BHD by sending a CW LO. In this case, the residual signal caused by different temporal responses of the photodiodes can be eliminated by adjusting the loss in one arm (Fig. 4 a). Using an RF spectrum analyzer, the spectral noise is measured and shown in Fig. 7. In the frequency domain, the trace (a) is the electronic noise and is measured when no optical signal is sent to the BHD. We can see the 3-dB bandwidth of the BHD is 104 MHz. Trace (b) is measured when 6.64 mW CW LO is sent to the BHD. The noise includes electronic noise and shot noise.

D. Homodyne detector noise measurement in the time domain
In GMCS QKD, each pulse will be measured individually. In the time domain, we first performed HD noise measurement at a pulse repetition rate of 10 MHz and obtained 12 dB shot noise to electronic noise ratio at an LO photon level of 8.2 ×10 8 . We further increase the repetition rate to 32 MHz and will demonstrate our results here. where I LO is the LO photon number per pulse. The coefficient of determination is 0.999 [43]. The electronic noise N ele (in shot noise unit) can be determined from the ratio of the third term and the second term, which is 4.0×10 7 /I LO . We find the shot noise to electronic noise ratio is 13 dB at an LO photon level of 8.5 × 10 8 per pulse. In the meantime, N LO (in shot noise unit) can be determined from the ratio of the first term to the second term, which is 1.1 × 10 −10 × I LO . As a simple check of the randomness of the noise, we measure the correlation coefficient (CC) between adjacent sampling results. CC is defined as CC = E(X(n)X(n + 1)) − E(X(n))E(X(n + 1)) while X(n) is the quadrature value of the nth pulse. At 3.4×10 8 LO photons/pulse, the correlation coefficient between consecutive pulses is 0.051, which is comparable with other BHDs reported in Ref. [41] (0.04) and Ref. [42] (0.07). We can use the CC to determine the upper bound of the excess noise caused by electrical pulse overlap ε overlap . In GMCS QKD, with the quadrature variance of the coherent state prepared by Alice V , the excess noise due to the overlap between pulses will be V × CC 2 = (V A + 1) × CC 2 (referring to the input) [44]. Assuming Alice's modulation V A = 16.9 [6] and each pulse has two neighboring pulses, we derive the excess noise caused by BHD pulse overlap to be 0.044 referring to the input.

E. Common mode rejection ratio
To quantify the subtraction capability of the BHD, we measure the CMRR. In the frequency domain, we obtain CMRR by measuring the spectral power difference at the repetition rate of 32 MHz in two cases: (a) one photodiode is blocked and the other is illuminated (b) both photodiodes are illuminated. At an LO power of 24.6 µW, the spectral noise for both cases is shown in Fig. 9. The CMRR is obtained to be 46.0 dB.  Table I. Given this practical BHD, we can also optimize operation parameters based on the refined realistic model. In Fig. 10, we simulate the key rate per pulse as a function of the LO level.
The key rate under the refined realistic model will reach the maximum at an LO photon number of 1.3 × 10 8 per pulse, because there is a tradeoff between N LO (increasing with LO level) and N ele (decreasing with LO level). In Fig. 11, we simulate the secure key rate of GMCS QKD using this BHD under the refined realistic model by choosing the optimal LO level for each transmittance. With this high speed BHD allowing a repetition rate of tens of MHz, the secure key generation rate of GMCS QKD can be improved by 1-2 orders of magnitude comparing to current systems at 500 kHz repetition rate in Ref. [15] (with a key rate of 2 kbits/s over 25 km fiber), and in Ref. [22] (with a key rate of 8 kbits/s over 3 dB loss channel) and at 100 kHz in Ref. [21] (with a key rate of 5 kbits/s over 20 km fiber). From the key rate simulation in Fig. 11, we expect to achieve a few Mbits/s over a short distance in future GMCS QKD under the refined realistic model.  Table I and Ref. [6], V A = 16.9, η = 0.44, ε A = 0.056, and β=0.898. Fiber loss is 0.21 dB/km. For each distance, the LO level is chosen to maximize the secure key rate. No secure key rate can be generated beyond 20 km due to the excess noise.

V. CONCLUSION
In conclusion, we have analyzed the excess noise contributed by a practical BHD and refined the realistic model. The electronic noise N ele , excess noise due to electrical pulse overlap ε overlap and excess noise caused by LO fluctuations in the presence of incomplete subtraction N LO are three excess noise sources for a practical BHD. They introduce a security loophole since Eve can monitor the pulse width and slightly change the LO intensity.
Implementing attacks with current technology to GMCS QKD will be an interesting research direction to explore.
We also developed a high speed BHD with a 104 MHz bandwidth in the telecommu-nication wavelength region for the first time. A comparison of the specifications between our BHD and other high speed BHD is shown in Table II. We achieved a shot-noise-toelectronic-noise ratio of 13 dB in the time domain at a pulse repetition rate of 32 MHz.
The BHD has a high CMRR of 46.0 dB. Various sources of excess noise introduced by this practical BHD are identified, and their contributions to excess noise are evaluated. With this BHD, the key generation rate of GMCS QKD experiments is expected to reach a few Mbits/s under the refined realistic model.