Measurement-device-independent quantum key distribution coexisting with classical communication

The possibility for quantum and classical communication to coexist on the same fiber is important for deployment and widespread adoption of quantum key distribution (QKD) and, more generally, a future quantum internet. While coexistence has been demonstrated for different QKD implementations, a comprehensive investigation for measurement-device independent (MDI) QKD—a recently proposed QKD protocol that cannot be broken by quantum hacking that targets vulnerabilities of single-photon detectors—is still missing. Here we experimentally demonstrate that MDI-QKD can operate simultaneously with at least five 10 Gbps bidirectional classical communication channels operating at around 1550 nm wavelength and over 40 km of spooled fiber, and we project communication rates in excess of 10 THz when moving the quantum channel from the third to the second telecommunication window. The similarity of MDI-QKD with quantum repeaters suggests that classical and generalized quantum networks can co-exist on the same fiber infrastructure.


Introduction
The prospect of building a quantum internet, which promises information-theoretic secure communication [1] as well as blind or networked quantum computing [2], is generating a rapidly increasing amount of academic and corporate development efforts [3].To minimise operating costs and hence facilitate deployment, it is important to benefit as much as possible from existing infrastructure.Starting in 1995, this has encouraged many experiments with deployed telecommunication fibre [4,5,6], and, since 1997, demonstrations of quantum key distribution (QKD) -the most mature application of quantum networks -together with classical data on the same fibre [7,8,9,10,11,12].Yet, to date, comprehensive studies of the latter have been limited to so-called prepare-and-measure (P&M) QKD [1], in which one user, Alice, encodes a random string of classical bits into non-orthogonal quantum states of photons, and the other user, Bob, makes projection measurements onto a set of randomly chosen bases.Mapping measurement outcomes onto bit values leads to the so-called raw-key-two partially correlated sequences of zeros and ones (one at Alice, and one at Bob)-and, after key distillation, either to the creation of an error-free secret key, or to abortion of the key generation session.
While the security of properly implemented P&M QKD can be proven, it is threatened by blinding attacks -quantum hacking that exploits vulnerabilities of singlephoton detectors to change their functioning [13] (see Appendix A for more information).This problem can be overcome by measurement-device-independent (MDI) QKD [14], in which Alice and Bob both send photons to a central station, Charlie, who projects their joint state onto one or more of the four maximally entangled Bell states Here |0 and |1 denote two orthogonal quantum states, e.g.orthogonal polarisation or temporal modes.As in the case of P&M QKD (or entanglement-based QKD [1]), any eavesdropping during photon transmission will lead to errors and shortening of the secret key -possibly to zero length.However, beyond what is offered by all QKD protocols, this feature also holds in MDI-QKD if the actual measurement devices-that is the detectors-deviate from the ideal, including due to blinding attacks by Eve.
The proposal of the MDI-QKD protocol in 2012 triggered rapid experimental progress.The first proof-of-principle demonstrations were reported only a year later [15,16,17], and the performance of MDI-QKD systems-including maximum distance, secret key rates, and robustness-has improved ever since [18,19,20,21].However, unlike for P&M QKD, coexistence of MDI-QKD with classical data on the same fibre has not yet been investigated in a comprehensive manner, neither experimentally nor through simulations.(But we note that spectraly multiplexed light was used in one MDI-QKD implementation to assess and compensate for polarisation transformations in the quantum channel, as well as to transmit a 1 MHz clock signal [17].) The difficulty of combining classical and quantum communication over the same fibre lies in the generation of noise photons that may mask the quantum data.While adequate spectral filtering can efficiently prevent all light at the classical data wavelength, assumed to be different from that used for the quantum channel, from reaching the single-photon detectors, this is no longer true for photons that are created by processes that convert the classical light to wavelengths within the quantum channel.Of particular concern is the interaction with phonons, so-called Raman scattering, which leads to the generation of noise over a wide range of wavelengths.The scattered power in case of co-and counter-propagating classical and quantum channels, P co and P ct , respectively, is given by [10] where L is the fibre length, P l is the average power launched in the classical channel, β is the Raman scattering coefficient (β depends on the wavelengths of the quantum and the classical channels as well as properties of the optical fibre), ∆λ is the bandwidth of the quantum channel, and α Q and α C are the fiber attenuation coefficients for quantum and classical channels, respectively.The photon scattering rate, n, and the scattered power, P , are related by nhc/λ = P , where h is Planck's constant, c the speed of light, and λ the photon wavelength.For bidirectional communication, allowing the exchange of classical data between Alice and Bob over a single fibre, the rates for co-and counterpropagating data have to be added: P bi = P co + P ct .
In this paper we experimentally demonstrate that measurement-device independent (MDI) QKD can operate simultaneously with at least five 10 Gbps bidirectional classical communication channels at around 1550 nm wavelength over 40 km of spooled fibre, and we project communication rates in excess of 10 THz when moving the quantum channel from the third to the second telecommunication window.As MDI-QKD is ideally suited for building cost-effective QKD networks with star-type topology, and can be upgraded into quantum-repeater-based networks [22], our demonstration is a first step towards a future quantum network in which secret keys, or qubits, can be distributed over arbitrarily long distances, and using which networked quantum information processing and blind quantum computing will become possible.

Methods
Our demonstration of coexistence with classical data is based on the MDI-QKD setup depicted in figure 1 and further detailed in Appendix B (see also [23]).Additional classical communication channels are prepared using four 1548 nm DFB lasers, sending continuous-wave light from Alice to Charlie, from Charlie to Alice, from Bob to Charlie, and from Charlie to Bob.The launch power of each laser is chosen such that at the remaining power at the receiver side is an integer multiple of 2 µW -the minimum power needed for a 10 Gbps link [9].For instance, 10 µW at the receiver side corresponds to either one 50 Gbps channel, or to five 10 Gbps channels realized using different frequencies within the ITU grid.Provided neighbouring channels are chosen, the Raman noise created by all classical channels at the quantum channel wavelength 16 nm away can be considered equal, and it does therefore not matter over how many channels classical data is distributed.Quantum and classical data are combined and split using dense wavelength division multiplexer (DWDM).

Raman noise
To assess the effect of Raman scattering on MDI-QKD, we first measured the noise in a narrow spectral window centred at 1532 nm-the operating wavelength of our MDI-QKD system-caused by strong light of various wavelengths propagating bi-directionally through 20 km-long standard telecommunication fibre between Alice and Charlie, and Bob and Charlie.The measurement is described in more detail in figure 2a.

Experimental secret key rates
Next, we ran our QKD system over two different lengths of spooled fibre -2 × 20 km, and 2 × 40 km.As in the case of assessing cross-talk, the quantum channels between Alice and Charlie, and Bob and Charlie, were combined with pairs of bi-directional classical data channels.To test the worst case in which Raman noise is maximized, we used 1548 nm laser light for the data channel (this choice is motivated by the result of the measurement shown in figure 2b), and to emulate different numbers of classical channels, we changed the power at each input in integer multiples of ∼ 8 µW (∼ 20 µW), corresponding to 2 µW steps in output power after 20 km (40 km) transmission.As shown before [9], 2 µW suffices to operate one 10 Gbps data channel with bit error rates ≤10 −12 , and having hence N time that power at the four receivers hence allows for N bi-directional 10 Gbps links between Alice and Bob.
For each configuration of fibre length and number of bi-directional 10 Gbps channels, emulated using continuous-wave light with appropriately chosen power, we created sifted keys and evaluated the secret key rate according to Here, Q 11 is the gain (the probability of a projection onto a Bell state) per emitted pair of qubits; e 11 the associated error rate; and the superscript indicates the jointly used basis (the Z basis features eigenvectors |0 and |1 ), and the X-basis eigenvectors is the binary Shannon entropy function; f = 1.14 is the efficiency of error correction; and the subscript "inf" denotes the assumption of infinitely long keys.

Simulations
We simulated secret key rates in the presence of classical communications using the code described in detail in our previous studies [24,23].Noise caused by Raman scattering is taken into account by increasing the detector noise according to the results shown in figure 2. For simulations that require Raman noise within a quantum channel centered around 1310 nm wavelength and a classical channel within the C-band, we used experimental data published elsewhere [11].
Here |0i and |1i denote two orthogonal quantum states, orthogonal polarization or temporal modes.As in the case of P&M QKD, any eavesdropping during photon transmission will lead to observable errors and, if too much information has leaked out, abortion of the protocol.However, beyond what is o↵ered by P&M QKD (or entanglement-based QKD[? ]), the same holds for all deviations of the actual measurement devices from the ideal, regardless of whether they are caused by imperfect equipment, a dishonest Charlie, or side-channel attacks by Eve.Furthermore, MDI-QKD is also ideally suited for building QKD networks with star-type topology in which several users are connected to the same central measurement node (Charlie).Using optical switches, it becomes then possible to connect any pair of users on demand.As users only need sender modules (the receiver, including expensive single-photon detectors, will be located at the central node and accessible to all users), this solution is both simpler and more cost-e↵ective than the creation of a fully connected network using P&M QKD, which requires all users to have a sender and s receiver module.
In addition, note that MDI-QKD shares the Bell-state measurement with quantum-repeaters [].This makes the implementation of MDI-QKD a first step towards a future (repeater-based) quantum network in which secret keys, or qubits, can be distributed over arbitrarily long distances, and using which networked quantum information processors and blind quantum computing will become possible [2].
Triggered by the first description of the MDI-QKD protocol in 2012 [10], which combines Bell-statemeasurement-based QKD [? ] with decoy states[?], experimental progress has been very rapid.The first proof-of-principle demonstrations were already reported in 2013 [? ??], and the performance of MDI-QKD systems-including maximum distance, secret key rates, and robustness-is constantly improving [? ???].However, unlike for P&M QKD[8, 12? -28], a demonstration of the possibility for MDI-QKD to coexist with classical data on the same fibre has remained an open challenge.(But we note that o↵-resonant classical light was used in one MDI-QKD implementation to stabilize polarization transformations in the quantum channel[?].However, the power at the receiver side was only of noise photons in a quantum channel at 1532 nm-the operating wavelength of our MDI-QKD system-caused by Raman scattering of o↵-resonant light propagating bi-directionally in classical channels between Alice and Charlie, and Bob and Charlie (see Fig. 1.Raman scattering is caused by the interaction of light with phonons and leads to the creation of photons at di↵erent wavelengths, including at 1532 nm.
EQU AT ION S?
Limiting ourselves to the extensively used C-band (extending from 1530 to 1565 nm wavelength), we find that the most cross-talk happens at 1546 nm wavelength.
Next, we ran our QKD system, depicted in Fig. 2 and described in the methods section, over two di↵erent lengths of spooled fibre.As in the case of assessing cross-talk (Fig. 1a), the quantum channels between Alice (Bob) and Charlie were combined with bi-directional classical channels.To test the worst case of maximum cross-talk, we used 1546 nm laser light, and to emulate di↵erent numbers of classical channels, we stepped the input power in integer multiples of XX mW (XX mW), corresponding after 20 km (40 km) transmission to an average output power of 2µW.As specified by ??[], this

Discussion
Most importantly, we find that MDI-QKD and bi-directional classical communication is possible over the same fibre.More precisely, we experimentally demonstrated positive secret key rates over a total of 40 km fibre together with the possibility for up to 50 Gbps bi-directional classical communication, and theoretically predicted positive secret key rates with up to 70 Gbps of classical data over the same fibre length.In addition, we demonstrated the possibility for QKD over a total of 80 km fibre with 10 Gbps of classical data.This is comparable to results obtained for P&M QKD, e.g. in [9] where the possibility for secure key exchange over 70 km fibre distance and coexisting with 10 Gbps of bi-directional classical communication was demonstrated.However, the quantum-classical channel spacing was only of 2.5 nm in this case, resulting in approximately three times less Raman noise as compared to the worst-case scenario of 16 nm spacing chosen in our implementation (see figure 2).The apparent increased resilience of MDI-QKD to Raman noise may be due to the need for detecting two photons per key bit.However, the flip-side is a reduced key rate, at least as long as single-photon detectors with quantum efficiencies significantly below unity are employed.The classical communication rate or, alternatively, the number of classical data channels at neighbouring spectral channels can straightforwardly be increased by 50% by moving the classical data within the C-band from 1548 nm to 1565 nm wavelength, where Raman noise is reduced (see figure 2b).Furthermore, as shown by the simulations depicted in figure 3, the maximum classical data rate would increase by almost two orders of magnitude, e.g. for a total distance of 40 km from around 70 Gbps to around 5 Tbps, when shifting the QKD wavelength to 1310 nm wavelength (the classical data is assumed to be at 1548 nm wavelength, but changes within the C-band barely affect performance).In this configuration, increased photon transmission loss-normally degrading QKD performance-is more than compensated for by a reduction of Raman scattering.
Even better performance is expected when moving from bi-directional transmission of classical data to uni-directional transmission, where data co-propagates with QKD photons.In this case, most Raman photons, created in the region of highest laser power, i.e. close to Alice or Bob, would be absorbed in the fibre before arriving at Charlie's detector.As shown in figure 3-and still assuming a QKD wavelength of 1310 nm and classical data to be encode in the C-band-this would allow the distribution of secret keys together with classical communications over a total of 40 km at more than 10 Tbps rate.This suffices for most applications.
We note that our QKD system currently employs pairs of fibres -one fibre for clock synchronisation and announcement of successful measurements at Charlie, and one for quantum communication.However, our results shows that quantum and classical signals can be multiplexed into the same fibre.We also point out that the calculation of the secret key rate in Eq. 5 assumes the limit of an infinitely long sifted key.This is in reality impossible, and an additional reduction that depends on the key length before post processing has to be taken into account [25].For instance, with ∼0.2 kbps of sifted key, as in our current setup over 2x20 km fibre, it would take ∼ 139 hours to pass the threshold between no secret key and secret key.While feasible, this is is impractical.The time can be reduced by two orders of magnitude by increasing the clock rate from its current value of 20 MHz to a few GHz.Current bottlenecks to this solution are the maximum clock rate of the (sequentially-operated) FPGAs in the QKD senders; limited accuracy (e.g.ringing) of the signals used to drive intensity and phase modulators; and the recovery time of the superconducting nanowire single-photon detectors.They can be overcome by more advanced FPGA programming, better electronics, and the use of detector arrays [26].

Conclusion
Our investigation establishes the possibility for MDI-QKD to coexist with classical communication on the same fibre.Moreover, as MDI-QKD shares an essential feature with quantum repeater-based communication -the need for a Bell state measurement with photons that are created far apart -it also shows that classical and generalised quantum networks can co-exist on the same fibre infrastructure.We additionally note that MDI-QKD is ideally suited for building QKD networks with star-type topology in which several users are connected to the same central measurement node (Charlie).Using optical switches, it becomes then possible to connect any pair of users on demand.As users only need sender modules but no receivers (the latter will be located at the central node and be accessible to all users), this solution is both simpler and more cost-effective than the creation of a fully connected network using P&M QKD, which requires all users to have both a sender and a receiver module.Hence, our demonstration increases the commercial viability of MDI-QKD and, more generally, quantum communications, will facilitate the adoption of the new quantum technology, and therefore constitutes an important step towards a world in which quantum information processing will help meeting challenges in secure data transmission, and will provide opportunities for unparalleled data processing.and synchronization is maintained by delaying the clock signal sent from Charlie to either Alice or Bob.Furthermore, polarization indistinguishability is ensured by means of polarizing beam-splitters (PBS, with feedback to maximize transmission) and polarization-maintaining fibres that connect to the 50/50 beam-splitter that is at the heart of the Bell-state measurement.In addition, we verify the frequency difference between Alice's and Bob's temperature-stabilized laser diodes every 5 minutes and, if necessary, reduce it to less than 10 MHz.
Photons are detected using WSi superconducting nanowire single-photon detectors (SNSPDs) cooled to 0.8 K in a sorption cooler [30].They feature system efficiencies of around 50%, dark counts of around 100 Hz, and detection time jitter of 100 ps.Successful Bell-state measurements are communicated to Alice and Bob using laser pulses sent over additional fibre.

Appendix B.3. Key sifting
The first step in key sifting is the reduction of the local bit strings at Alice's and Bob's to those that describe the states of photons that were detected in Charlie's Bell-state measurement.In order to avoid memory-intensive storage of time-tagged data that characterizes all photon states-most of which will be discarded during this step-Alice and Bob send the information of their prepared qubits (with the exception of time) into first-in-first-out (FIFO) buffers in their FPGAs while the corresponding qubits are sent to Charlie.The delays in the buffers equal the combined time required by the qubits to reach Charlie, and by the BSM signals to travel back to Alice or Bob.A simple logic operation then allows singling out only qubit generations that resulted in a successful BSM -only those are further processed during subsequent basis reconciliation.

FIG. 1 :
FIG.1: Cross-talk between classical and quantum channels.a, Light was injected bidirectionally into two 20 km-long fibres (Corning SMF-28) connecting Alice, and Bob, to Charlie.The launch power for each unidirectional channel, XX mW, was chosen so that each output power was 2 µWsu cient for 10 GBps classical classical communication[?]. b, Raman noise counts measured at Charlie in a XX GHz broad spectral channel centered at 1532 nm wavelength for di↵erent classical channel wavelengths.

Figure 2 .
Figure2.Crosstalk.a, Schematics of the setup used for assessing crosstalk due to Raman scattering.Classical transmitter (Tx) and receiver (Rx), dense wavelength demultiplexers (DWDM), beam splitter (BS), narrow spectral filter (F), superconducting nanowire single-photon detector (SNSPD).Classical light was injected bi-directionally into two 20 km-long fibres (Corning SMF-28 standard telecommunication fibre) connecting Alice, and Bob, to Charlie.The launch power for each classical channel, ∼8µW, was chosen so that each output power was 2 µW -sufficient for 10 Gbps classical communication[9].b, Raman noise measured using a single-photon detector at Charlie in a 6 GHz broad spectral channel centred at λ QKD =1532.68 nm wavelength for different classical channel wavelengths λ C .

Figure 3 .
Figure 3. Results.Predicted (lines) and experimentally obtained (squared) secret key rates (per clock cycle and assuming the infinite key limit) for different fibre lengths, data rates, wavelengths of the quantum channel, and assuming bi-directional or uni-directional (co-propagating) classical communication between Alice and Bob (connected via Charlie).Classical data is assumed to be at λ C =1548 nm wavelength.Experimental error bars indicate one standard deviation and are obtained assuming Poisson detection statistics.

Table C1 .
Raman noise measured at Charlie in a 6 GHz wide spectral window centered at 1532 nm wavelength for different classical channel wavelengths.