Plug-and-play continuous-variable quantum key distribution for metropolitan networks

: We report a plug-and-play continuous variable quantum key distribution system (CV-QKD) with Gaussian modulated quadratures and a true local oscillator. The proposed conﬁguration avoids the need for frequency locking two narrow line-width lasers. To minimize Rayleigh back-scattering, we utilize two independent ﬁber strands for the distribution of the laser and the transmission of the quantum signals. We further demonstrate the quantum-classical co-existing capability of our system by injecting high-power classical light in both ﬁbers. A secret key rate up to 0.88 Mb/s is obtained by using two ﬁber links of 13 km and up to 0.3 Mb/s when adding 4 mW of classical light in the optical ﬁber used for transmitting the quantum signal. The reported performance indicates that the proposed QKD scheme has the potential to become an eﬀective low-cost solution for metropolitan optical networks


Introduction
Quantum key distribution (QKD) is one of the most mature quantum cryptography technologies [1][2][3][4]. QKD allows for the exchange of secure keys between two authenticated parties, commonly referred as Alice and Bob. QKD combined with one-time pad (OTP) provides a way for achieving information-theoretic security [5]. Two main QKD protocols have been pursued: discrete variable (DV) and continuous variable (CV) [6][7][8]. While DV-QKD heavily relies on single photon detector technology, CV-QKD provides security through shot-noise limited coherent detection. The strong resilience to incoherent background noise and independence of single photon detector technology have made CV-QKD an attractive solution to secure metropolitan scale networks [9][10][11]. Owing to the maturity of the security proofs, most of CV-QKD implementations perform the GG02 protocol, introduced by Grosshands and Grangier in 2002 [8], where the quadratures of coherent state of lights are modulated according to zero-centered Gaussian distribution. In the early demonstrations of CV-QKD, the local oscillator (i. e. reference signal needed for coherent detection) was transmitted along with the quantum signal [12][13][14][15][16][17]. These demonstrations have been shown to be vulnerable to several side-channel attacks based on manipulating the local oscillator by an eavesdropper [18][19][20][21]. Recently, CV-QKD with true local oscillator has been demonstrated where the local oscillator is generated at Bob, without being accessible to the eavesdropper [22][23][24][25][26][27][28]. Despite improving the security of practical CV-QKD, the experimental implementation of the true local oscillator scheme requires two narrow line-width lasers that are frequency-locked, which increases the experimental complexity of the system. In addition, such locking is demanding to be maintained over time, preventing long term stability of the system [26][27][28].
To overcome this problem, plug-and-play CV-QKD with true local oscillator was proposed and implemented by Huang et al. [29]. A single laser was used both as a true local oscillator and as the source to prepare the modulated quadratures, avoiding the need of two frequency-locked lasers. The system reported by Huang et al. relies on two-way communication to implement a dual-phase modulated coherent state protocol (DPMCS) with homodyne detection, which is demonstrated to be equivalent to the GG02 protocol from a security perspective. Nevertheless, the reported plug-and-play CV-QKD suffers from Rayleigh back-scattering noise generated by the high power laser signal simultaneously transmitted with the quantum signal at the same wavelength and fiber channel. The Rayleigh back-scattering noise limits the performance and the maximum secure communication distance of the system compared to one-way CV-QKD protocols [29]. Rayleigh back-scattering noise in plug-and-play QKD, and its consequences on the secret key and maximum distance have been studied theoretically and experimentally for DV-QKD [30,31] and CV-QKD systems [29].
In this paper, we propose and demonstrate a plug-and-play CV-QKD system that minimizes the noise from Rayleigh back-scattering. This is done by relaying on two-way communication, where two different fiber strands are used, one to distribute the laser signal from Bob to Alice and the other one to send quantum states from Alice to Bob. To compensate for the phase fluctuations in the two independent fibers, we use a phase correction algorithm that relies on sending reference pulses interleaved between the quantum signals (LLO sequential design [25]). Contrary to previous work [29], the present design, besides minimizing the effect of Rayleigh back-scattering, allows for implementing a symmetric GG02 protocol with heterodyne detection, for which a general and composable security proof has been developed [32].
We note that in a real-world network, several fiber strands are present in a fiber bundle connecting different nodes, and the use of an additional fiber strand does not impose any additional overhead to the network. Moreover, we demonstrate co-existence of strong classical light in both fibers, removing the requirement of dark fibers which is not only considered an expensive solution but also an additional bottleneck for the deployment of QKD technology [33]. Figure 1(a) shows a schematic of the experimental setup. A CW laser (1550 nm wavelength, 10 kHz line-width, 54 mW power) located at Bob is split in two parts by using a 90:10 beam splitter (BS1). The 90% of the laser is used as a true local oscillator for heterodyne detection, whereas the 10% is sent to Alice through a 13 km fiber spool (Corning SMF28 ULL fiber). At Alice, a polarization controller (PC1) and a polarizing beam splitter (PBS) are used to filter the polarization modes and optimize the performance of the subsequent electro-optic modulators.

Experimental setup
According to the GG02 protocol [8], Alice generates coherent states of light (weak optical pulses) with X and P quadratures modulated according to zero-centered Gaussian random distributions. To this end, Alice uses an amplitude modulator (AM1) to create and modulate a train of optical pulses, and a phase modulator (PM) to encode phase information onto the pulses. Gaussian distributed quadratures are obtained by modulating the amplitude and the phase of the pulses according to a Rayleigh and a uniform random distribution, respectively [16]. As depicted in Fig. 1(b), pulses with constant amplitude and no encoded phase information (reference pulses) are interleaved between the modulated pulses (quantum signal pulses). The reference pulses allow Bob to compensate for phase drifts in the channel and retrieve the quadrature values sent by Alice [23]. The phase correction procedure is described in Section 3.2.
A second amplitude modulator (AM2) is used to increase the extinction ratio of the light pulses by modulating constant amplitude pulses that are overlapped to those generated by AM1. To accurately recover the phase information of the pulses, the amplitude of the reference pulses has to be larger than the amplitude of the signal (e.g. 500 times in Ref. [24]). The ratio between the amplitude of the reference and signal pulses, R, is set by adjusting the bias set-point of a third amplitude modulator (AM3) that operates at half the clock frequency.
The electro-optic modulators are driven by RF signals generated by a field programmable gate array (FPGA) and a 1 GS/s digital to analog converter (DAC) unit. In the present CV-QKD system, the optical pulses have a width of 4 ns and a frequency of 25 MHz. The RF signals for AM1 and PM are obtained from two independent sequences of 2048 pseudo-random numbers that are constantly repeated. We note that in a final prototype, random numbers should be generated continuously by using, for instance, a quantum random number generator [34].
After the modulator AM3, a 50:50 beam splitter (BS2) and PIN photo detector (PD) are used to optimize the bias set-point of the modulators. A variable optical attenuator (VOA) is employed to set the appropriate modulation variance (V mod ) that maximize the secret key for a given channel transmittance. Subsequently, a 99:1 beam splitter (BS3) sends 99% of the light to a power meter (PoM) to measure the mean photon number n and Alice modulation variance, V mod = 2 n , which was set using the VOA. The modulation variance is known by the parties before the communication. The light from the 1% output of BS3 is sent to Bob through a second 13 km fiber spool (Corning SMF28 ULL fiber). At Bob, a polarization controller (PC2) is used to maximize the polarization overlap between the received pulses and the local oscillator for maximal interference. The incoming optical pulses are fed into a 90 • Optical Hybrid (90 • OH), where they interfere with the local oscillator. The four outputs of the 90 • OH are detected by two balanced photodetectors (BDs), which provide measurements of X and P quadratures. The output from the BDs are digitized using a 2.5 GS/s oscilloscope, whose data is then collected and analyzed. The present design, Fig. 1(a), minimizes the noise from Rayleigh back-scattering, as the Rayleigh back-scattered photons generated in the upper fiber spool will go through BS1 to the CW laser which has an integrated isolator and, therefore, will not reach the BDs.
We note that in the proposed plug-and-play system, most of the active components are located at Alice, and Bob only needs to compensate for polarization drifts, which can be done by maximizing the amplitude of the detected quadratures. Another possibility is to use a polarization-diversity 90 • optical hybrid [27] at Bob, avoiding the need of active feedback mechanisms.
Finally, to demonstrate the co-existing capabilities of quantum and classical communication in the same fiber, we multiplex and de-multiplex strong classical light (from 0 to 11 mW input power) using dense wavelength division multiplexers (DWDMs) in both fiber spools as shown in Fig. 1. These DWDMs have a pass-band at (1550 ± 0.12) nm with a directivity of 50 dB and an isolation of 40 dB. The classical light is fed in both forward and backward directions with respect to the quantum light to analyse the effects of forward and backward Raman scattering processes on the performance of the system.

Detector calibration
To achieve shot-noise limited detection with high sensitivity, the local oscillator power should be maximized within the linear operation range of the BDs. Figure 2(a) shows the shot noise variance as a function of the local oscillator power, where the electronic noise variance was subtracted from the measurements. The measurements were carried out by turning off the signal from Alice, having only the local oscillator activated. It can be seen that the detectors have a linear response even for powers up to 54 mW (maximum power of the laser). For the experimental results described below, a local oscillator power of 49 mW is used given the fact that, as mentioned above, 10% of the laser power is transmitted to Alice for quadrature modulation. Figure 2(b) shows the Fourier transform of the shot noise and electronic noise for a power of 49 mW. An average clearance (ratio between shot noise variance and electronic noise variance) of 15.8 dB is obtained over the full bandwidth of the detector (20 kHz-1 GHz). To increase the signal to noise ratio, a low-pass bandwidth filter of 200 MHz is employed at the input of the oscilloscope, which results in an average clearance of 16.8 dB. In CV-QKD, the measured quadrature values are converted from voltage units to shot noise units [35]. To this end, a conversion factor is obtained by: (1) where N 0 and N det are respectively the shot noise and electronic noise variance in units of voltage square.

Phase correction
Since the local oscillator located at Bob and the signal pulses from Alice have not been interferometrically stabilized, the phase of the signal pulses drifts randomly and thereby the encoded information is scrambled. To overcome this, we employ the phase correction procedure described by Qi et al. [23]. As mentioned above, reference pulses are sent in close conjunction to the signal pulses. The phase information of the reference pulses is used to extract the encoded phase information onto the signal pulses. We note that in the present system the phase correction procedure should compensate for fluctuations in two independent fibers, which corresponds to an effective distance of twice the separation between Alice and Bob. As mentioned above, to reduce the phase recovery noise, the intensity of the reference pulses is typically much higher than that of the signal pulses. The measured quadrature X raw and P raw are divided into sets of reference pulse data (X R , P R ) and signal pulse data (X S , P S ), respectively. The phase of the i th reference pulse, Φ R,i is given by The phase of the i th signal pulse (S i ) is calculated by using the reference pulses (R i and R i+1 ) and The quadratures are then remapped using the coordinate transformations: Figure 3 shows an example of phase recovery. For simplicity, the quantum signal corresponds to optical pulses with constant amplitude and phase. The blue trace corresponds to the raw quadratures X raw and P raw , where the reference and signal quadratures correspond to the outer and inner ring, respectively. As expected, the phase of the raw signal and reference are randomly distributed from 0 to 2π. After phase correction, by using Eq. (4), the quadratures are centered at a given phase value, which was assigned by Alice. In the results presented in Section 3.5, the quadrature remapping procedure is applied to Gaussian modulated quadratures. The corrected quadratures are then further analysed to calculate the excess noise and the secret key rate as described below. In the following sections, we rename X ≡ X corr and P ≡ P corr . Figure 4(a) shows a 4µs sample of the X quadrature for Alice and Bob. Bob's data corresponds to the output of the heterodyne detector after phase correction. Alice and Bob quadratures follow zero-centered Gaussian distributions, as it is shown in Fig. 4(b). The variance of Alice and Bob quadrature distributions, V mod and V B , are related by [35]

Estimation of excess noise and channel transmittance
where ε is excess noise measured at the channel output, ν elec is the electronic noise, η is the detection efficiency, and T is the transmittance of the channel. The excess noise can be calculated Fig. 3. Phase correction. The blue and green traces correspond to the raw quadratures (X raw , P raw ) and corrected quadratures (X corr , P corr ), respectively. The raw quadratures are divided into the reference (X R ) and signal (X S ) quadratures. To show the phase correction clearly, this measurement was carried out using high intensity signal pulses with constant amplitude and phase, and a ratio between reference and signal amplitude of R=17.
where V B |A is the conditional variance given by [35] q A = {X Ai , P Ai } and q B = {X Bi , P Bi } are Alice and Bob quadrature data, respectively. The losses in the channel are assumed to be controlled by the eavesdropper (Eve), therefore, T has to be estimated by correlating Alice and Bob data, For the analysis of the experimental data we consider two scenarios, the "realistic scenario" [15,23] where the detection efficiency is trusted and calibrated, and the "paranoid scenario without electronic noise" [36,37] where the detection efficiency is not trusted and treated as losses in the channel. For both scenarios, the electronic noise is trusted and subtracted from the total excess noise. It is important to note that in the asymptotic analysis presented here, the entire data set is used for parameter estimation to obtain accurate values of excess noise and channel transmittance. However, in a future prototype, finite-size effects [36] and key reconciliation [8] will be included to distil a secret key. This might reduce the key rate because part of the correlated data is sacrificed for parameter estimation, whereas the remaining data is used for secret key generation. However, recent results in CV-QKD have shown that the entire data set could be used for both parameter estimation and secret key generation [38].

Estimation of secret key rate
The secret key rate r, in bits per pulse, is given by [23,35] r = fI AB − χ BE (9) where f is the efficiency of the reconciliation algorithm, I AB is the mutual information between Alice and Bob, and χ BE is the Holevo bound. Considering reverse reconciliation [8], the Holevo bound corresponds the maximum accessible information that Eve could have on Bob data. The mutual information I AB can be directly computed from the Shannon entropy and the experimental parameters, where the signal to noise ratio (SNR) is given by SNR = ηTV mod 2 + ε − 2ν elec (11) The calculation of the Holevo bound requires the computation of the co-variance matrix between Alice and Bob, which depends on the experimental parameters. A detailed description for the estimation of the Holevo bound is presented in Ref. [23,35]. Once Alice and Bob mutual information and Holevo bound are calculated, r is directly obtained from Eq. (9). The reconciliation efficiency f is considered to be 0.95 [13]. The secret key rate K in bits per second is obtained by multiplying r by the repetition rate of the signal pulses, 12.5 MHz.

Results
Figure 5(a) shows the excess noise ε, obtained using Eq. (6), as a function of Alice modulation variance V mod for a ratio between reference signal and quantum signal amplitude of R=274. The electronic noise is ν elec = 0.022 snu and the detection efficiency is η = 0.38. The detection efficiency was estimated from the quantum efficiency of the balanced detectors, losses at Bob, and the effect of the low-pass filter. Each point corresponds to ≈1.4 million signal samples, which are collected from the oscilloscope. The raw data is subjected to phase correction and then channel transmittance, excess noise, and secret key rate are calculated. Considering a linear model for excess noise [26], ε = σV mod + ε rest (12) where the first term is the noise that depends on the modulation variance, such as the noise arising from imperfect phase correction [25]. The second term is the noise which is independent of the modulation variance, such as intensity noise of the local oscillator or CMRR-noise [35]. Fitting Eq. (12) to the experimental data, Fig. 5(a), we obtain σ = 0.0067, and ε rest = 0.0004 snu. The value of K as a function of the modulation variance, for the realistic scenario, is shown in Fig. 5(b), where the solid line was obtained using Eq. (9) and Eq. (12). The value of V mod that optimizes K for a distance of 13 km (T = 0.6) is approximately V mod = 2 snu.  Fig. 6(c). Active feedback mechanism for polarization and modulator bias can improve the stability of the system and allows for field demonstrations.
Three contributions to ε can be identified. First, the noise ε drift coming from the error in the phase correction due to phase drift of the signal pulse compared to the reference pulse as they are generated at a time delay τ. For a plug-and-play system with only one laser, ε drift can be calculated as [25] ε drift = (4π∆ντ)V mod Tη (13) where ∆ν is the linewidth of the laser. Considering ∆ν=10 kHz and τ=40 ns, we obtain ε drift = 0.0024 snu. The term Tη is added to scale to noise to the channel output. A second contribution to ε, which also affects the phase correction algorithm, comes from the error present on the reference pulses due to channel noise and shot noise, where χ = 1/T − 1 + ε/(Tη) is the total channel added noise. Considering the parameters of Fig. 6, we obtain ε error = 0.0013. The value of ε error decreases when increasing R, as the noise on the reference pulses is less significant and the estimation of the signal phase is more accurate. A third contribution to ε arises from leak photons due to the finite dynamic range of the amplitude modulator (DR). This noise, referred to as ε AM , contrary to ε error , increases when increasing the amplitude of the reference pulse RV mod . An estimation of ε AM is given by The use of three amplitude modulators, as described in Section 2., allows for a high dynamic range and a large value of R, reducing ε AM and ε error . We achieve a dynamic range of DR = 48 dB which results in ε AM = 0.002 snu. We note that ε AM can be significantly reduced by replacing the second modulator (AM2) by a high extinction amplitude modulator >60dB [39]. A detailed description of additional source of noise can be found in Ref. [35]. Finally, Fig. 6(d) shows a simulation of K versus distance for the realistic and paranoid scenarios. It can be seen that the present system may allow for operation over longer distances. For instance, a secret key of 0.12 Mb/s could be obtained at 25 km in the realistic scenario. We note that longer distances may reduce the accuracy of the phase correction algorithm and increase the excess noise, since the intensity of reference pulses drops due to channel losses, which in principle could be compensated by increasing the intensity of the reference pulses at Alice [26].

Estimation of Rayleigh back-scattering
As it is mentioned above, the proposed design minimizes the effects of Rayleigh back-scattering on the excess noise. To quantify the advantage of this, we estimate the extra excess noise that we would have from Rayleigh back-scattered photons ε RB , considering the parameters of our system. This is done by using [29,30] The parameter β R is the Rayleigh back-scattering coefficient, −80 dB [29]. R rate is the repetition rate, 25 MHz. δt is the detector integration time, 5 ns. α is the fiber attenuation coefficient, 0.17 dB/km, and η A is the total losses at Alice, ≈45 dB. Equation (16) considers the case of minimum Rayleigh back-scattering, where the attenuator at Alice is fully opened and the light sent by Bob is minimized. Considering the values of Sec. 3.5 (L = 13 km, η = 0.38, T = 0.6, V A = 2.11 snu), we estimate that the mean excess noise, Fig. 6(a), would be ≈50% higher in case of Rayleigh back-scattering reaching the detectors, and the secret key rate ≈40% lower. The Rayleigh back-scattering noise becomes higher at longer distances, and at 28 km, without considering any other source of noise, it would make the secret key rate equal to zero for the parameters of our system.

Coexistence with classical light
To demonstrate the coexistence capability between CV-QKD and transmission of classical signal, we input intense classical light (wavelength of 1542 nm) to both fibers strands and characterize the excess noise. Raman scattering from the fiber is the main source of noise when co-propagating intense signals with quantum signals at a different wavelength [9,33,[40][41][42]. First, we added up to 12 mW of power in the fiber used for sharing the lasers between Alice and Bob, without seeing a significant effect on the excess noise. On the other hand, adding classical light to the fiber transmitting the quantum signals increases the excess noise, as depicted in Fig. 7. We study the backward Raman scattering effects, when the classical light and quantum light are propagating in the opposite directions Fig. 7(a), and the forward Raman scattering, when the quantum and classical light are in the same direction , Fig. 7(b). We see that the excess noise increases linearly with the power of the classical light [9]. A positive K can be obtained for power up to 8 mW in the backward or forward direction. For instance, K of 0.3 Mb/s is obtained for a classical light power of 4 mW. These results show that our system can coexist with high speed data communication. For instance, a 10Gb/s error-free communication channel at 50 km can be achieved with an input power of only 0.04 mW [43]. The experimental parameters considered for the measurements shown in Fig. 7 are Tη = 0.20, η = 0.33, and V mod = 3.4 snu. The detection efficiency is lower compared to results showed in previous sections because of losses in Bob's DWDM. The results obtained for backward and forward Raman scattering configurations are similar, which is expected for a distance of 13 km [9]. Due to the fiber loss, forward Raman scattering increases with the distance and reaches a peak value at approximately 21 km, whereas backward Raman scattering increases up to approximately 40 km, where it saturates [9,33]. The Raman scattering at the distance of 13 km, used in this work, corresponds to approximately 80% and 60% of the maximum value for forward and backward directions, respectively. We note that in the results showed in Fig. 7, the quantum signal is placed at a longer wavelength than the classical signal (quantum signal at 1550nm and classical signal at 1542 nm). This corresponds to the worst case scenario, since the Raman Stokes peak overlaps with the quantum signal, which is around 10% stronger that the Anti-Stokes peak [40].

Side channel attacks and preparation noise
Plug-and-play QKD has been traditionally shown to be vulnerable to Trojan horse attacks [44,45]. Recent investigations have proposed techniques to overcome these attacks. In plug-and-play QKD, it is important to have a watchdog detector at the Alice input to detect any unwanted optical signal. Also, the use of frequency filters at Alice input help preventing Eve from injecting optical signals at a frequency outside the bandwidth of the watchdog detector [44]. In our scheme, since the present plug-and-play system uses two fibers links, it is possible to add isolators at the input and output of Alice to avoid Trojan-horse attacks that could exploit reflected light from the modulators.
Contrary to one-way CV-QKD, plug-and-play systems give the eavesdropper access to the laser source [29]. However, there is no key information on the laser signal going from Bob to Alice, and the calibration of the system is performed locally at Bob. Therefore, if side-channel attacks are properly compensated, transmitting the laser source does not generate security problems. Nevertheless, the eavesdropper can manipulate the source to worsen the performance of the QKD session, for instance by adding phase noise to the laser. To overcome this, Alice can characterize the preparation noise of the signal, which may result in a significant improvement on the performance of the system [46,47].

Conclusions
CV-QKD with true local oscillator is known to be a promising solution for the integration of QKD into commercial optical networks. However, the requirement of two frequency stable lasers adds technological complexity to the system. It is also to be noted that, without proper feedback, the intrinsic frequency fluctuations between the lasers will prevent long term stable system operation. With our work, we overcome these drawbacks by demonstrating a plug-and-play CV-QKD system where the same laser is used as true local oscillator and as the source to prepare Gaussian-modulated coherent states. In addition, we avoid the deterioration of the performance due to Rayleigh back-scattering by using a separate fiber to send the light from Bob to Alice. Finally, our system can co-exist with strong classical light, thereby showing that plug-and-play CV-QKD is an effective solution for securing short-reach metropolitan networks.