Secure and efficient synchronization scheme for quantum key distribution

To establish a time reference frame between two users in quantum key distribution, a synchronization calibration process is usually applied for the case of using gated mode single-photon detectors (SPDs). Traditionally, the synchronization calibration is independently implemented by the line length measurement for each SPD. However, this will leave a loophole which has been experimentally demonstrated by a special attack. Here, we propose an alternative synchronization scheme by fixing the relative delay of the signal time window among all SPDs and jointly performing the line length measurement with multiple SPDs under combining low-precision with high-precision synchronization. The new scheme is not only immune to the vulnerability but also improves the synchronization time from usually a few seconds to tens of milliseconds.


I. INTRODUCTION
Quantum key distribution (QKD) [1,2] is one of the most successful applications of quantum information science. It promises unconditionally secure key generation between two distant parties via the fundamental laws of quantum physics [3,4], rather than unproven computational complexity assumptions. The best-known QKD protocol is the Bennett-Brassard-1984 (BB84) protocol [1], combining the decoy-state method [5][6][7], which has been researched extensively both theoretically [8][9][10][11] and experimentally [12][13][14][15][16]. Currently, many practical BB84 QKD systems use optical communication fibers as quantum channels and work at the telecom wavelengths of around either 1550 nm or 1310 nm [17][18][19]. The detection at these wavelengths is often performed by the single-photon detector (SPD) with InGaAs avalanche photodiodes operated in Geiger mode [20], i.e., it is only activated for a narrow window when a signal pulse is expected to arrive. Therefore, Alice and Bob should synchronize the optical pulse with the center of SPD's open window in the calibration routine.
Obviously, in this design, the synchronization between Alice's source and Bob's detectors is critical because the receiver will not identify the quantum signal correctly without the time gate synchronized to the photon arrival. How to choose an appropriate synchronization in the fiber network is worth considering carefully. Improper synchronization will not only affect the efficiency (long synchronization time) but also compromise the security of the QKD system. For example, the synchronization process is independently implemented by the line length measurement for each SPD [14,21], i.e., only using those detected pulse count from one detector to align the time of that detector. However, this synchronization calibration process is not efficient. More importantly, it will leave a loophole for Eve to attack the QKD system. During the synchronization calibration phase, Eve can shift the arrival time of each synchronization pulse and cause the detector efficiency mismatch for gated mode SPD. After the synchronization calibration process, Eve can use the fake-state attack [22][23][24] or time-shift attack [25,26] to successfully steal the secret key, which has been experimentally demonstrated in a commercial plug-and-play phase-coding QKD system [27].
In this paper, we present a secure and efficient synchronization method for QKD. Based on the assumption of the fixed relative delay of signal time window among all SPDs, it is secure against the synchronization calibration attack [27]. Furthermore, the time of the synchronization calibration will be greatly decreased by using the pulse count from different detectors jointly. This paper is organized as follows. In the second part, we first introduce a synchronization calibration attack for the traditional polarization-coding system, which independently implements the line length measurement for each SPD [14]. Then, we experimentally verify an assumption that the relative delay of signal time window among different SPDs in QKD system can be fixed even after a long time running. In the third and fourth parts, we propose and experimentally demonstrate a secure and efficient synchronization scheme. For each synchronization calibration process, the required time of the new scheme is only tens of milliseconds. In the final part, we have a conclusion.

II. SYNCHRONIZATION LOOPHOLE AND COUNTERMEASURE
During the synchronization calibration process, Eve can replace the synchronization signal with his own signal and cause detector-efficiency mismatch if the line length measurement for each SPD is independently implemented [27]. Taking a polarization-coding QKD system as an example, Eve can set the horizontal pulse |H to arrive at t 0 , and the vertical pulse |V at t 1 in the synchronization calibration process. At the receiver's side, the time window that has the largest number of triggering is considered as a signal time window for the detector [28][29][30]. Consequently, the time window for |H is t 0 and the time window for |V is t 1 . Moreover, Eve could set t 0 and t 1 carefully so that the detector efficiencies of the detectors differ greatly. After the synchronization calibration process, Eve can use fake-state attack [22][23][24] or time-shift attack [25,26] to acquire the key.
In order to circumvent this loophole, we assume that the relative delay of signal time window among different SPDs can be fixed since the optical lengths and electrical delays for different detectors almost unchange at the receiver. We run one QKD system for 16 days to record the relative delay of signal time window among different SPDs. The experimental result supports our hypothesis which can be found in Fig. 1. We remark that the time-shift attack cannot be immune if one only uses our synchronization scheme, such as the case of the difference in detector efficiency characteristics.

III. NEW SYNCHRONIZATION SCHEME
Here, we propose a secure and efficient synchronization scheme. On the one hand, we exploit the fact that the difference between the signal time window of multiple detectors remains the same. On the other hand, we implement a parallel synchronization method, where the time search range is divided evenly into N portions and each portion is searched by only one detector. The time search can be simultaneously performed by using multiple detectors. Therefore, the time of the synchronization process can be considerably decreased. A schematic diagram of parallel synchronization is illustrated in Fig.2.
The repetition rate of a QKD system is typically from tens of megahertz to gigahertz, while synchronization accuracy typically reaches tens of picoseconds. If the traversal method is utilized to finish the synchronization, the number of time windows that need to be searched can reach several hundreds to several thousands. Therefore, this synchronization method is extremely inefficient.
Here, we use a combination of low-precision and high-precision synchronization to reduce the number of searches. First, a low-precision traversal search is utilized to confirm the approximate time range of the optical pulse over the full-time range. The high-precision search is then used to obtain the signal time window in this relatively small time range. The high-precision search scheme can be applied by the dichotomy method or other high-performance search algorithms. By adopting the synchronization scheme combined with low-precision and high-precision, the search number can be significantly reduced, and the accuracy of the synchronization can be guaranteed. First, we need to calibrate the synchronization time difference among different SPDs in the lab or some other safe zone. In a BB84-QKD system, typically, Bob uses four separate SPDs, which are labeled as SPD 1 , SPD 2 , SPD 3 and SPD 4 . Two SPDs are used for the X basis and two SPDs are used for the Z basis. Based on the signal time window T 1 of SPD 1 , the differences between the signal time window of the remaining detectors SPD i and SPD 1 are recorded as ∆T i , which can be given by where T i is the signal time window of detector SPD i , and i = 2, 3, 4.
In the low-precision synchronization process, the receiver of the QKD system calculates the time search range of each detector according to the number of detectors (N ), the relative delay value of each detector, and the repetition rate of the QKD system f . The full time search range is divided evenly into N portions. For the ith detector, the time search range Ra i is: The requirement for low precision is no more than the full width at half maximum of the optical pulse. A low-precision synchronous search is finished when all detectors complete the search. According to the detector count data of all the detectors in the low-precision process, we can find the time window t l and the detector number n l corresponding to the maximum detector count. The time search range of high-precision synchronization is calculated based on t l and n l . The high-precision bit synchronization process and the low-precision bit synchronization process are roughly identical. The difference is that, firstly, in order to ensure the accuracy of synchronization, the accumulation time of the detector count in the high-precision synchronization process is usually greater than that in the low-precision synchronization process. Secondly, the high-precision synchronization process can further improve the efficiency by using the dichotomy algorithm.
According to the detector count data of all the detectors in the high-precision process, one need to find the time window t h and the detector number n h corresponding to the maximum detector count. For the mth detector, the signal time window is calculated as follows: Fig.3 displays a schematic diagram of our polarization-coding decoy-state QKD system setup, including transmitter (Alice), quantum channel and receiver (Bob). At Alice's side, we employ the phase-randomized weak-coherent pulse of 500 ps duration emitted by a 1550.12nm distributed feedback laser operating at 100 MHz as a source. The randomly changed intensity of each pulse is realized by an intensity modulator. The polarization of the signal is encoded by a fast polarization modulator. Intensity modulation and polarization modulation are controlled by a true random number generator. At Bob's side, we use an electronic polarization controller to recover the polarization alignment before his polarization decoding optics module. Four InGaAs avalanche photodiodes operated in Geiger mode are used for single-photon detection at a clock rate of 100 MHz. The detection efficiency is 15.3% while the dark count probability is approximately 8.0 × 10 −7 per gate. Between Alice and Bob, we use 50km standard single mode fiber SMF-28 with an attenuation loss of 10.3 dB as the quantum channel. During the synchronization calibration process, the intensity of each pulse is changed to 3 to accelerate the entire process.

A. Method I
We divide the synchronization process into two round processes. The first round is low-precision synchronization, and the second round is high-precision synchronization. We fixed the detector count statistical time to 1ms in lowprecision synchronization and 5ms in high-precision synchronization. The fixed high-precision is 10ps. In low-precision synchronization, we need to optimize the synchronization precision parameter t. The time T 1 taken for synchronization initialization is calculated as follows, where we have 10 ≤ t ≤ 500. The optimal t is 120 ps, and the total time T 1 spent in the synchronization calibration process of method I is 36 ms. The synchronization calibration process of method I is shown in Fig. 4.  0  360  720  1080  1440  1800  2160  2520  2880  3240  3600  3960  4320  4680  5040  5400  5760  6120  6480  6840  7200  7560  7920  8280  8640  9000  9360

B. Method II
Although the total time spent in the synchronization calibration process of method I is reduced, this method is still not optimal. Here, we discuss how the optimal synchronization calibration process is implemented. Same as method I, we divide the synchronization process into two round processes. The difference lies in that we use the dichotomy algorithm with four detectors in the high-precision synchronization process. In the low-precision synchronization process, The time search range of SPD 1 is [0, 2.5] ns, the time search range of SPD 2 is [2.5, 5.0] ns, the time search range of SPD 3 is [5.0, 7.5] ns, and time search range of SPD 4 is [7.5, 10.0] ns. After the low-precision synchronization process, we find the time window corresponding to the maximum count is 1.92 ns, and the corresponding detector is SPD 1 . Therefore, the first time search range of high-precision synchronization is [1.44, 2.88] ns. Then, we divide this time search range into four equal parts, so that the time window for the first search are 1.62 ns for SPD 1 , 1.81 ns for SPD 2 , 2.00 ns for SPD 3 and 2.19 ns for SPD 4 , respectively. The subsequent operation is similar, and the detailed processing and results are shown in the following Fig. 5. The total time T 2 spent in the synchronization calibration process of method II is 20 ms.

V. DISCUSSION AND CONCLUSION
In Ref. [31], the time required for the synchronization calibration process is about one minute. In Ref. [32], the time required for the synchronization calibration process is typically 1-10 seconds. In comparison, the parallel synchronization method in this paper can only require tens of milliseconds. We remark that the synchronization time required by our parallel rules is at most 1/N of the previous one [31,32] even under the same conditions, where N is the number of detectors. For the QKD system based on the Large-alphabet protocol [33,34], the number of detectors used at the receiver is generally not less than 8. The time of synchronization calibration process can be reduced even more. During the synchronization process, Eve can shift the arrival time of each pulse sent from Alice by employing a variable optical delay line. This type of attack causes the signal time window of multiple detectors to shift forward or backward as a whole. Under the condition that the time efficiency curves of multiple detectors are consistent or close to each other, such an attack will only reduce the detection efficiency of the QKD system without causing the detector time-dependent efficiency mismatch in our new synchronization scheme.
In summary, an efficient synchronization method without security loophole is proposed. This synchronization method adopts the parallel search method, and divides the time search range of the synchronization process depending to the number of detectors at the receiver, and then all the time search simultaneously in their respective search ranges. Through this parallel search method, the synchronization initialization time can be greatly reduced without security loophole. As the number of detectors increases, the time of bit synchronization is significantly decreased. Most of the current QKD systems use a multi-detector scheme, the application scenario of this synchronization method is expected to be very wide.

VI. ACKNOWLEDGMENTS
We gratefully acknowledge support from the National Natural Science Foundation of China under Grant No. 61801420, the Fundamental Research Funds for the Central Universities.