Quantum key distribution provides secure keys with information-theoretic security ensured by the principle of quantum mechanics. The continuous-variable version of quantum key distribution using coherent states offers the advantages of its compatibility with telecom industry, e.g., using commercial laser and homodyne detector, is now going through a booming period. In this review article, we describe the principle of continuous-variable quantum key distribution system; focus on protocols based on coherent states, whose systems are gradually moving from proof-of-principle lab demonstrations to in-field implementations and technological prototypes. We start by reviewing the theoretical protocols and the current security status of these protocols. Then, we discuss the system structure, the key module, and the mainstream system implementations. The advanced progresses for future applications are discussed, including the digital techniques, system on chip, and point-to-multipoint system. Finally, we discuss the practical security of the system and conclude with promising perspectives in this research field.

Since 1984, quantum key distribution (QKD)1 has ushered in an era of secure communications using quantum methods by providing information-theoretic secure key distribution.2–8 The combination of this method with one-time-pad encryption provides the ultimate protection for the transmission of confidential messages. In general, for simplified implementations, QKD protocols are formulated in a prepare-and-measure (PM) fashion, where the classical information is encoded on non-orthogonal quantum states: they are randomly prepared by Alice (the sender) and then transmitted to Bob (the receiver) through an insecure quantum channel. At the output of the channel, the states are measured by Bob to retrieve the encoded classical information. The quantum no-cloning theorem dictates that an unknown quantum state cannot be reliably cloned,9 ensuring long-term security based on physical principles10 against unlimited computational power.

So far, various QKD protocols with discrete variables have been proposed to support the long-distance and practical-secure system implementations,1,2,11–28 including the decoy states experiments,29–42 the measurement-device-independent (MDI) experiments,43–59 the twin-field experiments,60–69 the system on chip,59,70–75 and so on.76–86 Specifically, the twin-field QKD with a 3-station scheme has significantly promoted the development of the long-distance QKD, where the total distance can break the Pirandola, Laurenza, Ottaviani, and Banchi (PLOB) bound.87 These achievements have resulted in the long-haul point-to-point connection up to 1000 km,69 high-speed metropolitan system,88–92 and field deployed QKD network,93–97 even with satellite-to-ground links.98–103 Furthermore, it is worth noting a distinct category of protocols where the information is encoded on the quadrature of light that is continuous-variable (CV). The use of such continuous-variable quantum information carriers, instead of qubits, constitutes a potent and alternative approach for QKD104–112 and more broadly, for quantum information processing.108,110,113–120

Continuous-variable QKD (CV-QKD) using coherent states106,107 is now currently experiencing a booming period due to its compatibility with telecom industry, e.g., using commercial continuous-wave laser and coherent receiver. This potential has led to significant advancements in CV-QKD, including the protocol design, security analysis, and system implementation (see Fig. 1). The security of CV-QKD protocol using Gaussian-modulated coherent states was initially proved under asymptotic conditions,121,122 and later extended to the finite-size regime with universal composability against collective attack,123 and general attacks by exploiting Gaussian de Finetti theorem.124 In addition to continuous modulation, the discrete modulation of coherent states has also been well investigated.125–129 Along with the improving security proof, the implementation of CV-QKD system has progressed from the initial proof-of-principle demonstration to the second stage with swift advancements in high performance and system robustness. Currently, it has entered the third stage where a modern architecture is evolving with the benefit of being fully compatible with classical optical coherent communication.

FIG. 1.

Selected key developments in CV-QKD. On both sides of the arrow are theoretical research progresses (left) and experimental research progresses (right). Here, the theoretical research progresses include the protocol proposal, security proof and optimization of protocol steps. The experimental progresses include the development of in-line LO and local LO systems.

FIG. 1.

Selected key developments in CV-QKD. On both sides of the arrow are theoretical research progresses (left) and experimental research progresses (right). Here, the theoretical research progresses include the protocol proposal, security proof and optimization of protocol steps. The experimental progresses include the development of in-line LO and local LO systems.

Close modal

During the initial phase of the CV-QKD system, the primary challenge was to overcome the 3 dB limit, which was solved by the reverse reconciliation.130 Subsequently, the CV-QKD system progressed toward allowing long-distance transmission to facilitate two-user interconnection across a wide range without a trusted relay. Developments of the reconciliation resulted in enhanced error correction capability even with an extremely low signal-to-noise ratio (SNR),131 which played a significant role in the long-distance system covering a distance from 25 (Ref. 132) up to 80 km.133 At this stage, both the quantum signal and local oscillator (LO) are generated by the same laser of transmitter and co-propagated in the quantum channel, known as the in-line LO system, which contributes to the suppression of phase noise when the quantum signal and LO interfere for coherent detection. However, a significant challenge toward achieving long-distance and stable transmission is to reduce crosstalk between the strong LO and the weak quantum signal. The most effective current approach is using pulsed signals with high extinction ratio, then combining polarization multiplexing and time-division multiplexing (TDM).133–139 This methodology has resulted in the longest lab experiment over 202 km,139 the longest field test of 50 km,137 the long-term test of a 3-node CV-QKD network in Qingdao, China,140 and the first chip-based system.138 

In 2015, an alternative scheme was proposed, which relaxed the requirement of the extremely high isolation by generating LO inside the receiver and using a pilot assisted phase recovery to suppress the phase noise introduced by the different laser source.141,142 As the pilot signal has significantly lower power compared to the LO, the high-extinction pulse generation for time-division multiplexing is no longer required. Instead, frequency-division multiplexing (FDM) is widely used, which simplifies the signal generation, and sometimes can be combined with polarization multiplexing for better isolation. For higher secret key rate (SKR) and better phase recovery, the repetition rate of the system is gradually enhanced, where digital techniques in classical optical communication systems, such as the pulse shaping and matched filter, are introduced to overcome the limited bandwidth (BW) of devices. Further, more and more digital algorithms for a CV-QKD system are developed, including the de-multiplexing, impairment compensation, synchronization etc., which then drive the innovation in system architecture. To date, the local LO scheme contributes to the high-speed system with the repetition rate of 5 Gbaud, resulting in 190 Mbps secret key rate at 5 km,143 as well as a flexible network deployment, which has been demonstrated by the software-defined CV-QKD network in Madrid, Spain.144 

The use of digital techniques from classical communications has significantly advanced the development of CV-QKD systems, allowing for the completion of most operations in digital domain, and resulting in a system compatible with classical optical communication in the aspect of both architectures and algorithms.145 Meanwhile, the advanced progresses of the homodyne detector integrated on chip have shown the potential of a compact system with high-performance, where the baud rate of the system using chip-based homodyne detector can reach 10 Gbaud.146 Additionally, the implementation of a high-rate downstream point-to-multipoint CV-QKD network can facilitate large-scale deployments, enabling multi-user access with low-cost devices and simplified network structures.147 

An overview of the typical CV-QKD systems, key techniques, and application scenarios is presented in Fig. 2. These typical system achievements, supported by the advanced reconciliation, digital signal processing (DSP) and chip-based devices have proved that the CV-QKD system is suitable for the metropolitan network and access network, as well as the free space communication and co-existing with the classical optical networks. With these advanced techniques, a large-scale cost-effective QKD network supported by advanced CV-QKD systems is on the way.

FIG. 2.

The overview of the CV-QKD system, including the typical systems, key techniques and the applications. Here, we mainly show the long-distance, chip-based and high-speed system, as well as the key techniques including the reconciliation, chip-based devices and digital techniques.

FIG. 2.

The overview of the CV-QKD system, including the typical systems, key techniques and the applications. Here, we mainly show the long-distance, chip-based and high-speed system, as well as the key techniques including the reconciliation, chip-based devices and digital techniques.

Close modal

In all this panorama, the present review aims to providing an overview of the most important results and the most recent advances in the field of CV-QKD system. After a brief introduction of the general notions, we review the main CV-QKD protocols and security analysis in Sec. II. The system structure and key modules are reviewed in Sec. III, and the typical currently achievable implementations are detailed in Sec. IV, including the in-line LO systems, local LO systems, systems co-existing with classical networks, and so on. We then discuss the advanced progress in future applications, such as the digital continuous-variable system and point-to-multipoint network, in Sec. V. Finally, we will discuss the practical security of the system in Sec. VI and conclude with promising perspectives in this research field in Sec. VII.

The CV-QKD system relies on a protocol to establish the system's operating procedures, where the security of the protocol is determined by security proof. In this section, we introduce the basic notions, the CV-QKD protocols, and security analysis.

The continuous-variable system is a typical infinite dimensional quantum system. Suppose that a CV system consists of a sequence of n modes in the Hilbert space H = i = 1 n H i, there are n pairs of annihilation and creation operators { a ̂ i , a ̂ i } with i = 1 , 2 , , n, which satisfies
[ a ̂ i , a ̂ k ] = δ i k , [ a ̂ i , a ̂ k ] = 0 , [ a ̂ i , a ̂ k ] = 0.
(1)
For each mode, we can correspondingly define the operators x ̂ and p ̂ as
x ̂ = a ̂ + a ̂ , p ̂ = i ( a ̂ a ̂ ) ,
(2)
which are so-called quadratures of electromagnetic field, and the quadratures can be described by a n-mode vector r ̂ = ( x ̂ 1 , p ̂ 1 , x ̂ 2 , p ̂ 2 , , x ̂ n , p ̂ n ) T. Using the standard bosonic canonical commutation relations as well as Eqs. (1) and (2), we can easily get
[ x ̂ i , x ̂ k ] = 0 , [ p ̂ i , p ̂ k ] = 0 , [ x ̂ i , p ̂ k ] = 2 i δ i k ,
(3)
which gives the well-known Heisenberg uncertainty relation
Δ x ̂ Δ p ̂ | [ x , p ] | = 1.
(4)
Here, Δ A ̂ = ( A ̂ 2 A ̂ 2 ) 1 / 2 . Now, it is straightforward to derive the following relation:
[ r ̂ i , r ̂ k ] = 2 i Ω i k ,
(5)
where Ω = i = 1 n [ 0 1 1 0 ], and Ωik is the generic element of Ω.
Gaussian states are the states that their characteristic function is a Gaussian function in phase space. Its displacement operator can be defined as d = r ̂ = T r [ ρ r ̂ ] , while the positive-semidefinite symmetric covariance matrix is defined as
γ i j = 1 2 T r [ ρ { ( r ̂ i d i ) , ( r ̂ j d j ) } ] ,
(6)
where { } denotes the anticommutator, and ρ is a general density operator. Since a state is Gaussian if its Wigner function is Gaussian, it is completely characterized by the first two statistical moments, the mean value d, and the covariance matrix γ.
Since all physical existed Gaussian states should obey the Heisenberg uncertainty relation; therefore, the covariance matrix is generally148 
γ + i Ω 0.
(7)

The most common single-mode Gaussian states include vacuum state, coherent states, and squeezed states. The vacuum state is centered at the origin of the phase space and the covariance matrix is an identity matrix. The coherent states are the displaced vacuum state with non-zero displacement vectors d = ( d x , d p ). Thus, the covariance matrices of the coherent states are also identity matrices. The squeezed states can be obtained by squeezing coherent states at one of the two quadratures. Suppose the states are squeezed on x quadrature, the conjugate p quadrature is anti-squeezed.

For two-mode Gaussian states, the commonly used states in CV system are two mode squeezed vacuum states, which can also be noted as the Einstein–Podolsky–Rosen (EPR) states in the CV system,149 of which the covariance matrix reads
γ EPR = [ cosh 2 r I 2 sinh 2 r σ z sinh 2 r σ z cosh 2 r I 2 ] = [ V I 2 V 2 1 σ z V 2 1 σ z V I 2 ] ,
(8)
where
I 2 = [ 1 0 0 1 ] , σ z = [ 1 0 0 1 ] ,
(9)
r is the squeezed ratio, and V is called the variance of the EPR state. In particular, performing homodyne detection on one of the modes of an EPR state results in the other mode being projected on a squeezed state, while performing heterodyne detection on one of the modes of an EPR state results in the other mode being projected on a coherent state,150 as shown in Fig. 3.
FIG. 3.

The preparation of a squeezed (a) or coherent state (b) using homodyne or heterodyne detection on one mode of the EPR state. HOM: homodyne detection, HET: heterodyne detection.

FIG. 3.

The preparation of a squeezed (a) or coherent state (b) using homodyne or heterodyne detection on one mode of the EPR state. HOM: homodyne detection, HET: heterodyne detection.

Close modal

The first CV-QKD protocol was proposed in 1999, using squeezed states to achieve secret key distribution.104 However, due to the challenges in preparing squeezed states, a protocol of using coherent states and homodyne detection to distribute secret key was proposed in 2002,106 namely, the GG02 protocol. Because the coherent states can be easily generated by a laser, this protocol has received an increasing attention in recent years. Subsequently, the protocol based on Gaussian modulated coherent states got further developments. The no-switching protocol was reported in 2004,107 in which the heterodyne detection instead of homodyne detection was used. In 2009, heterodyne detection was also utilized in the Gaussian modulated squeezed-state protocol and an improvement of performance was found.161 

Although Gaussian modulated CV-QKD protocols have undergone extensive studies and developments, there remain technical challenges to implementing ideal Gaussian modulation in experiments. Therefore, discrete modulated CV-QKD protocol158 was proposed. The initial discrete modulated CV protocol is the four-state modulation protocol, where a modulation method similar to quadrature phase shift keying (QPSK) in classical communications was used. Soon afterward, Leverrier186 highlighted that CV protocols can be used for secret key distribution with multi-dimensional discrete modulation. In addition to discrete modulation, other modulation methods are also considered, including unidimensional modulation.159 It simplifies the modulation process at the Alice side can be compared with the GG02 protocol when the excess noise is small. Recently, a phase-sensitive multimode protocol is proposed, which achieves higher secret key rate and better excess noise tolerance.187 Most of the theoretical analysis of the CV-QKD protocols are based on fiber channels, and recently, the study is extended to the free space scenario for considerations of satellite quantum communications.188 

Generally, the classification of standard one-way CV-QKD protocols, in which the quantum state passes through a single channel, can follow the type of the used quantum states (coherent or squeezed), the methods of modulation (Gaussian modulation, unidimensional modulation, or discrete modulation) or the type of measurement (homodyne or heterodyne). In addition to the one-way protocols, various other protocols correspond to different application scenarios are proposed, such as two-way protocols, source-device-independent (SDI) protocols, MDI protocols, and so forth (Table I).189 

TABLE I.

Current security status of the main one-way CV-QKD protocols.

Protocol State Modulation Measurement Best current-available security proof
Grosshans and Grangier106   Coherent  Gaussian  Homodyne  Asymptotic collective151 
Finite-size collective152–154  
Weedbrook et al.107   Coherent  Gaussian  Heterodyne  Finite-size123,124,152–154 
K coll ε ( N ) K coll asympt for practical N 
K ε ( N ) = 0 for practical N155  
Cerf et al.105   Squeezed  Gaussian  Homodyne  Finite-size156,157 
K ε ( N ) > 0 for practical N 
lim N K ε ( N ) < K coll asympt 
Leverrier and Grangier158   Coherent  QPSK  Homodyne  Asymptotic collective with linear assumption158  
Li et al.125   Coherent  QPSK, arbitrary  Homo/heterodyne  Asymptotic collective125  
Ghorai et al.126   Coherent  QPSK, arbitrary128   Homo/heterodyne  Asymptotic collective126,128 
Lin et al.127   Coherent  QPSK  Homo/heterodyne  Asymptotic collective127  
Usenko and Grosshans159   Coherent  Gaussian 1D  Homodyne  Finite-size collective160  
García-Patrón and Cerf161   Squeezed  Gaussian  Heterodyne  Asymptotic collective161  
Filip162,163  Thermal  Gaussian  Homo/heterodyne  Asymptotic collective164  
Fiurášek and Cerf165 
Walk et al.166  
Coherent  Gaussian  Homo/heterodyne + Gaussian post-selection  Asymptotic collective165–167  
Li et al.168   Coherent  Gaussian + Non-Gaussian Post-selection  Homo/heterodyne  Asymptotic collective168  
Madsen et al.169   Squeezed  Gaussian + Additional Gaussian  Homodyne  Asymptotic collective169  
Protocol State Modulation Measurement Best current-available security proof
Grosshans and Grangier106   Coherent  Gaussian  Homodyne  Asymptotic collective151 
Finite-size collective152–154  
Weedbrook et al.107   Coherent  Gaussian  Heterodyne  Finite-size123,124,152–154 
K coll ε ( N ) K coll asympt for practical N 
K ε ( N ) = 0 for practical N155  
Cerf et al.105   Squeezed  Gaussian  Homodyne  Finite-size156,157 
K ε ( N ) > 0 for practical N 
lim N K ε ( N ) < K coll asympt 
Leverrier and Grangier158   Coherent  QPSK  Homodyne  Asymptotic collective with linear assumption158  
Li et al.125   Coherent  QPSK, arbitrary  Homo/heterodyne  Asymptotic collective125  
Ghorai et al.126   Coherent  QPSK, arbitrary128   Homo/heterodyne  Asymptotic collective126,128 
Lin et al.127   Coherent  QPSK  Homo/heterodyne  Asymptotic collective127  
Usenko and Grosshans159   Coherent  Gaussian 1D  Homodyne  Finite-size collective160  
García-Patrón and Cerf161   Squeezed  Gaussian  Heterodyne  Asymptotic collective161  
Filip162,163  Thermal  Gaussian  Homo/heterodyne  Asymptotic collective164  
Fiurášek and Cerf165 
Walk et al.166  
Coherent  Gaussian  Homo/heterodyne + Gaussian post-selection  Asymptotic collective165–167  
Li et al.168   Coherent  Gaussian + Non-Gaussian Post-selection  Homo/heterodyne  Asymptotic collective168  
Madsen et al.169   Squeezed  Gaussian + Additional Gaussian  Homodyne  Asymptotic collective169  

In 2008, the original two-way protocol was proposed,170 in which an optical switch was used to randomly switch between two working statuses “ON” or “OFF.” The tolerable noise on ON mode is higher than that of one-way protocol. However, the use of optical switches cannot meet the demand for high-speed quantum key distribution. Subsequently in 2012, an improved two-way protocol was reported,172 in which Alice uses a Gaussian modulated coherent state and a beam splitter to replace the ON–OFF switch and translation operation in the original two-way protocol. Very recently, the protocol is proved to be secure in the finite-size regime.171 In addition, the unidimensional two-way CV-QKD protocol is proposed to simplify the system realization and is proved to be secure against collective attack.190 

It should be noted, however, that the one-way and two-way protocols can be considered theoretically secure only with the trustworthy equipment. The issue of practical security remains a major concern due to the possible mismatch between practical devices and theoretical assumptions. An optimal solution would be a device-independent protocol, in which system security is not influenced by the trustworthiness of the devices. However, since achieving comprehensive device independence is challenging, semi-device-independence protocols have been developed and well-studied, including the MDI protocols176,177 and the source-device-independent (SDI) protocols.191 These protocols eliminate certain assumptions regarding the reliability of the devices and, thus, close the corresponding security loopholes.

The CV-MDI QKD was independently proposed by Li et al.176 and Pirandola et al.,177 in which Alice and Bob are both senders, preparing coherent states and sending them through two independent channels to the untrusted party, Charlie, to perform Bell-state measurement. Note that there are no assumptions about the trustworthiness on Charlie, which implies that Eve can have complete control over Charlie, and it can withstand all attacks that are based on detector's loopholes. However, the CV-MDI QKD protocol has a limited transmission distance which restricts the long-haul deployment. In 2019, the discrete modulation is used for CV-MDI QKD,184 whose secret key rate correspondingly decreases but can still guarantee its security against collective attack. The unidimensional CV-MDI QKD protocol was also proposed,182,183 in which more cases are considered in Ref. 182, while the finite-size effect is involved in Ref. 183. The security of the CV-MDI protocol under the source intensity errors is also investigated.192 Here, the current security proofs status of the two-way protocols and the MDI protocols are revealed in Table II.

TABLE II.

Current security status of the main two-way and MDI CV-QKD protocols.

Protocol Alice's side Bob's side Measurement Best currently available
State Modulation State Modulation Security proofs
Pirandola et al.170   Coherent  Gaussian  Coherent  Gaussian  Homo/heterodyne  Finite-size171  
Sun et al.172   Coherent  Gaussian  Coherent  Gaussian  Homo/heterodyne  Asymptotic172  
Zhao et al.173   Coherent  Gaussian + non-Gaussian post-selection  Coherent  Gaussian + non-Gaussian post-selection  Homodyne  Asymptotic collective173  
Li et al.174   Coherent  Gaussian  Coherent  Gaussian  Homo/heterodyne + Gaussian post-selection  Asymptotic collective 
Bian et al.175   Coherent  Gaussian 1D  Coherent  Gaussian  Homodyne  Asymptotic collective175  
Li et al.176   Coherent  Gaussian  Coherent  Gaussian  Bell-state measurement  Finite-size178,179 
K ε ( N ) > 0 for practical N 
Pirandola et al.177   lim N K ε ( N ) < K coll asympt 
Zhang et al.180   Squeezed  Gaussian  Squeezed  Gaussian  Bell-state measurement  Finite-size181 
K ε ( N ) > 0 for practical N
lim N K ε ( N ) < K coll asympt 
Huang et al.182   Coherent  Gaussian 1D  Coherent  Gaussian 1D  Bell-state measurement  Asymptotic collective182,183 
Ma et al.184   Coherent  QPSK  Coherent  QPSK  Bell-state measurement  Asymptotic collective184  
Zhao et al.185   Coherent  Gaussian + non-Gaussian post-selection  Coherent  Gaussian + non-Gaussian post-selection  Bell-state measurement  Asymptotic collective185  
Protocol Alice's side Bob's side Measurement Best currently available
State Modulation State Modulation Security proofs
Pirandola et al.170   Coherent  Gaussian  Coherent  Gaussian  Homo/heterodyne  Finite-size171  
Sun et al.172   Coherent  Gaussian  Coherent  Gaussian  Homo/heterodyne  Asymptotic172  
Zhao et al.173   Coherent  Gaussian + non-Gaussian post-selection  Coherent  Gaussian + non-Gaussian post-selection  Homodyne  Asymptotic collective173  
Li et al.174   Coherent  Gaussian  Coherent  Gaussian  Homo/heterodyne + Gaussian post-selection  Asymptotic collective 
Bian et al.175   Coherent  Gaussian 1D  Coherent  Gaussian  Homodyne  Asymptotic collective175  
Li et al.176   Coherent  Gaussian  Coherent  Gaussian  Bell-state measurement  Finite-size178,179 
K ε ( N ) > 0 for practical N 
Pirandola et al.177   lim N K ε ( N ) < K coll asympt 
Zhang et al.180   Squeezed  Gaussian  Squeezed  Gaussian  Bell-state measurement  Finite-size181 
K ε ( N ) > 0 for practical N
lim N K ε ( N ) < K coll asympt 
Huang et al.182   Coherent  Gaussian 1D  Coherent  Gaussian 1D  Bell-state measurement  Asymptotic collective182,183 
Ma et al.184   Coherent  QPSK  Coherent  QPSK  Bell-state measurement  Asymptotic collective184  
Zhao et al.185   Coherent  Gaussian + non-Gaussian post-selection  Coherent  Gaussian + non-Gaussian post-selection  Bell-state measurement  Asymptotic collective185  

Another semi-device-independent protocol, known as the SDI protocol, has also undergone development in addition to the MDI protocol. The CV-SDI QKD protocol was initially proposed in 2013 and has been demonstrated to be resistant to collective attacks.191 Furthermore, Zhang et al. supplemented the security proof in 2020.193 Similar to the CV-MDI QKD, the CV-SDI QKD protocol does not make any assumptions about the source's credibility. In this protocol, an entanglement source is positioned between Alice and Bob as both Alice and Bob are receivers. In addition, there are also some special CV-QKD protocols such as using a thermal state as the source, so-called the passive protocol.194 

As shown in Fig. 4, ideal CV-QKD protocols are closer to the theoretical limit, known as the PLOB bound,87 which shows the potential of achieving high secret key rate and long transmission distance using CV-QKD. Yet/However, we have to remark that, there is still a gap between the optimal parameters of the existing CV-QKD protocols for practical and ideal situations, where the reconciliation efficiency is normally less than 100% and the optimal modulation variance is limited to less than 5. Therefore, the performance in a practical CV-QKD system still has room to be improved, and more CV-QKD protocols are expected to be proposed for further approaching the theoretical limit.

FIG. 4.

The PLOB bound and the distance between the PLOB bound and various QKD protocols in ideal case. Reprinted with permission from Pirandola et al., Nat. Commun. 8, 15043 (2017). Copyright 2017 Author(s), licensed under a Creative Commons Attribution (CC BY) license.87 

FIG. 4.

The PLOB bound and the distance between the PLOB bound and various QKD protocols in ideal case. Reprinted with permission from Pirandola et al., Nat. Commun. 8, 15043 (2017). Copyright 2017 Author(s), licensed under a Creative Commons Attribution (CC BY) license.87 

Close modal

Before starting the security analysis, it is essential to introduce two equivalent schemes, namely, the prepare-and-measurement (PM) scheme and the entanglement-based (EB) scheme, as shown in Fig. 5. These schemes differ mainly in the method of preparing quantum states. In the PM scheme, Alice generates the states with a light resource, usually a laser, whereas in the EB scheme, Alice generates EPR states. As homodyne (heterodyne) detection performed on one mode of the EPR state has the effect of projecting the other mode onto a squeezed (coherent) state, the transmitter's outputs of both methods are identical for the third party. Therefore, both schemes are equivalent to Bob and Eve, which is an important property.

FIG. 5.

The PM protocol and the equivalent EB protocol in CV-QKD. The most important steps in a CV-QKD protocol are the state preparation, the measurement, and the error correction. The main difference between these two types of the protocols are the state preparation, where the coherent state preparation is equal to the heterodyne detection on one of the modes of the EPR state, and the squeezed state preparation is equal to the homodyne detection on one of the modes of the EPR state.

FIG. 5.

The PM protocol and the equivalent EB protocol in CV-QKD. The most important steps in a CV-QKD protocol are the state preparation, the measurement, and the error correction. The main difference between these two types of the protocols are the state preparation, where the coherent state preparation is equal to the heterodyne detection on one of the modes of the EPR state, and the squeezed state preparation is equal to the homodyne detection on one of the modes of the EPR state.

Close modal

It is important to note that although both schemes are equivalent, they are used in different application scenarios. For instance, the PM scheme is used for experimental implementation, whereas the EB scheme is used for theoretical analysis due to its ease of calculation. Our analysis is based on the EB scheme in the following part.

Reconciliation is the key technique to make Alice and Bob share a same bit string, which can be categorized into two types, the direct reconciliation and the reverse reconciliation.195 In direct reconciliation, the detection data are corrected to the modulation data, however, the tolerable channel loss is limited under 3 dB. Reverse reconciliation is proposed to solve this issue, by correcting the modulation data to the detection data.

In the aspect of an eavesdropper, the attack strategy can be categorized into three types, individual attack, collective attack and coherent attack. In individual attack, Eve manipulates and measures the transmitted states independently and identically. In collective attack, Eve manipulates the transmitted states independently and identically but measures them jointly. While for coherent attack, Eve manipulates and measures the transmitted states jointly. Usually, coherent attack is the strongest one, while in asymptotic case the collective attack is normally the most powerful coherent attack.

1. Gaussian-modulated protocol

The protocols based on Gaussian modulation are the most fundamental among all CV-QKD protocols, which are usually categorized into four types based on types of quantum states (coherent or squeezed) and detection methods (homodyne or heterodyne). So far, the protocols based on Gaussian modulated coherent states, which can be generated by the off-the-shelf laser, have received much attention. Therefore, we detail the security analysis of the Gaussian-modulated coherent state protocol, and briefly introduce the squeezed-state protocol.

The security indicator is the secret key rate. If the secret key rate is greater than zero while considering attacks, then Alice and Bob can distill a secret key under the attack. Otherwise, the protocol will not be effective. The asymptotic secret key rate with reverse reconciliation can be given by196 
R = β I A B S B E ,
(10)
where IAB is the classical mutual information between Alice and Bob, that can be easily estimated, normally written as
I A B hom = 1 2 log 2 V B V B | A = 1 2 log 2 V + χ line 1 + χ line , I A B het = log 2 V B + 1 V B | A + 1 = log 2 T ( V + χ line ) + 1 T ( 1 + χ line ) + 1 ,
(11)
for perfect homodyne and heterodyne detection. Here, V is the variance of EPR state owned by Alice, VB is the variance of the state Bob receives, V A | B is the conditional variance given Bob's measurement result. χ line = 1 / T 1 + ε is the total channel-added noise expressed in shot noise units (SNUs), relevant to the channel parameters, including the transmittance (T) and excess noise (ε).197 Since mainstream CV-QKD implementations use reverse reconciliation, where the modulation data are corrected to the detection data, the quantum mutual information between Bob and Eve, SBE, is the concern.
It is pointed out that the maximum information available to Eve is bounded by Holevo quantity198 
S B E = χ B E = S ( E ) S ( E | m B ) ,
(12)
where S ( E ) is the von Neumann entropy of the eavesdropper's state ρE, and S ( E | m B ) is von Neumann entropy conditional on Bob's measurement result and is determined by the detection method. Based on the fact that the eavesdropper Eve is able to purify the binary quantum system ρAB, Eq. (12) becomes
χ B E = S ( ρ A B ) S ( ρ A B | m B ) .
(13)
As for χBE, usually we use the Gaussian extremity theorem to find its upper bound,199 corresponding to the lower bound of the secret key rate. This means there always exists a Gaussian state ρ A B G with the same covariance matrix as ρAB who makes
χ B E χ B E G = S ( ρ A B G ) S ( ρ A B | m B G ) .
(14)
Specifically, calculations of S ( ρ A B G ) and S ( ρ A B | m B G ) can be simplified using the symplectic eigenvalues of the covariance matrix γAB and γ A B | m B, respectively, corresponding to the states ρAB and ρ A B | m B. Covariance matrix γAB can be estimated from the modulation and detection data
γ A B = ( γ A σ A B σ A B γ B ) = ( V A I 2 C A B σ z C A B σ z V B I 2 ) = ( a I 2 c σ z c σ z b I 2 ) ,
(15)
then γ A B | m B is given by
γ A B | m B = γ A σ A B T H σ A B .
(16)
Here, H is the symplectic matrix on behalf of the measurement operation on mode B, and can be written, respectively,
H hom = ( X γ B X ) M P , H het = ( γ B + I 2 ) 1 ,
(17)
where X = ( 1 0 0 0 ) (for homodyne detection on p quadrature, we use P = ( 0 0 0 1 ) ), and MP represents for the Moore–Penrose pseudo-inverse of a matrix. Notice that γA, γB, and σAB are the subsmatrices of the covariance matrix γAB as detailed in Eq. (15).
Generally, the symplectic eigenvalues of a covariance matrix γ can be achieved by calculating the eigenvalues of i Ω γ. For the two-mode system, one can easily achieve the analytical solution, as detailed in Table III, where S ( ρ A B G ) can be calculated with λ 1 , 2, and S ( ρ A B | m B G ) can be calculated with λ7 for homodyne detection and λ12 for heterodyne detection
χ B E hom = i = 1 2 G ( λ i ) G ( λ 7 ) , χ B E het = i = 1 2 G ( λ i ) G ( λ 12 ) ,
(18)
where
G ( x ) = x + 1 2 log 2 x + 1 2 x 1 2 log 2 x 1 2 .
(19)
TABLE III.

Main calculation equations of secret key rate of Gaussian-modulated CV-QKD protocols.

States Measurement IAB Eigenvalues of the covariance matrix before measurement Type of reconciliation Eigenvalues of the covariance matrix after measurement χ B E
Squeezed  Homodyne  1 2 log 2 V + χ χ + 1 / V  λ 1 , 2 = 1 2 [ Δ ± Δ 2 4 D 2 ]  Direct  λ 3 = T 2 ( V + χ ) ( χ + 1 / V )  i = 1 2 G ( λ i ) G ( λ 3 ) 
Reverse  λ 4 = V ( V χ + 1 ) ( χ + V )  i = 1 2 G ( λ i ) G ( λ 4 ) 
Coherent  Homodyne  1 2 log 2 V + χ χ + 1  Direct  λ 5 , 6 = 1 2 [ A ± A 2 4 B ]  i = 1 2 G ( λ i ) i = 5 6 G ( λ i ) 
Reverse  λ 7 = λ 4 = V ( V χ + 1 ) ( χ + V )  i = 1 2 G ( λ i ) G ( λ 7 ) 
Squeezed  Heterodyne  1 2 log 2 T ( V + χ ) + 1 T ( χ + 1 / V ) + 1  Direct  λ 8 = λ 3 = T 2 ( V + χ ) ( χ + 1 / V )  i = 1 2 G ( λ i ) G ( λ 8 ) 
Reverse  λ 9 , 10 = 1 2 [ A ± A 2 4 B ]  i = 1 2 G ( λ i ) i = 9 10 G ( λ i ) 
Coherent  Heterodyne  log 2 T ( V + χ ) + 1 T ( χ + 1 ) + 1  Direct  λ 11 = T ( χ + 1 )  i = 1 2 G ( λ i ) G ( λ 11 ) 
Reverse  λ 12 = T ( V χ + 1 ) + 1 T ( V + χ ) + 1  i = 1 2 G ( λ i ) G ( λ 12 ) 
Notice  ( a I 2 c σ z c σ z b I 2 ) = ( V I 2 T ( V 2 1 ) σ z T ( V 2 1 ) σ z T ( V + χ ) I 2 ) ,   Δ = a 2 + b 2 2 c 2 ,   D = a b c 2 ,   A = 1 a + 1 ( a + b D + Δ ) , A = 1 b + 1 ( b + a D + Δ ) ,   B = D a + 1 ( b + D ), B = D b + 1 ( a + D ) ,   G ( x ) = x + 1 2 log 2 x + 1 2 x 1 2 log 2 x 1 2, V is the variance of the EPR state which is also written as VA when representing the variance of mode V
States Measurement IAB Eigenvalues of the covariance matrix before measurement Type of reconciliation Eigenvalues of the covariance matrix after measurement χ B E
Squeezed  Homodyne  1 2 log 2 V + χ χ + 1 / V  λ 1 , 2 = 1 2 [ Δ ± Δ 2 4 D 2 ]  Direct  λ 3 = T 2 ( V + χ ) ( χ + 1 / V )  i = 1 2 G ( λ i ) G ( λ 3 ) 
Reverse  λ 4 = V ( V χ + 1 ) ( χ + V )  i = 1 2 G ( λ i ) G ( λ 4 ) 
Coherent  Homodyne  1 2 log 2 V + χ χ + 1  Direct  λ 5 , 6 = 1 2 [ A ± A 2 4 B ]  i = 1 2 G ( λ i ) i = 5 6 G ( λ i ) 
Reverse  λ 7 = λ 4 = V ( V χ + 1 ) ( χ + V )  i = 1 2 G ( λ i ) G ( λ 7 ) 
Squeezed  Heterodyne  1 2 log 2 T ( V + χ ) + 1 T ( χ + 1 / V ) + 1  Direct  λ 8 = λ 3 = T 2 ( V + χ ) ( χ + 1 / V )  i = 1 2 G ( λ i ) G ( λ 8 ) 
Reverse  λ 9 , 10 = 1 2 [ A ± A 2 4 B ]  i = 1 2 G ( λ i ) i = 9 10 G ( λ i ) 
Coherent  Heterodyne  log 2 T ( V + χ ) + 1 T ( χ + 1 ) + 1  Direct  λ 11 = T ( χ + 1 )  i = 1 2 G ( λ i ) G ( λ 11 ) 
Reverse  λ 12 = T ( V χ + 1 ) + 1 T ( V + χ ) + 1  i = 1 2 G ( λ i ) G ( λ 12 ) 
Notice  ( a I 2 c σ z c σ z b I 2 ) = ( V I 2 T ( V 2 1 ) σ z T ( V 2 1 ) σ z T ( V + χ ) I 2 ) ,   Δ = a 2 + b 2 2 c 2 ,   D = a b c 2 ,   A = 1 a + 1 ( a + b D + Δ ) , A = 1 b + 1 ( b + a D + Δ ) ,   B = D a + 1 ( b + D ), B = D b + 1 ( a + D ) ,   G ( x ) = x + 1 2 log 2 x + 1 2 x 1 2 log 2 x 1 2, V is the variance of the EPR state which is also written as VA when representing the variance of mode V

Similarly, the case with direct reconciliation or the security analysis of squeezed states protocols can be analyzed, for simplicity, the analytical solutions are concluded in Table III.

2. Discrete-modulated protocol

The earliest investigation on discrete-modulated CV-QKD is in 2009, when the transmission distance of a CV-QKD system is limited to less than 30 km due to the lack of the efficient error correction strategy of Gaussian variable at low SNR, and the proposed discrete-modulated protocol reduces the requirement of error correction, which can be a promising way to enhance the system transmission distance.158 

The early security proof requires the linear channel assumption, where the input-output relations of the quadrature operators in Heisenberg representation are given by
X out = g X X i n + B X , P out = g P P i n + B P .
(20)
Here, the added noises B X , BP are uncorrelated with the input quadratures Xin, Pin. Only based on this assumption, the covariance matrix describing the system after the quantum state transmission can be written as
γ = ( ( V M + 1 ) I 2 T Z σ z T Z σ z ( T V M + 1 + T ϵ ) I 2 ) ,
(21)
where VM, T, and ϵ correspond, respectively, to modulation variance ( V M = V 1, V is the variance of mode A), the channel transmittance, and the excess noise estimated experimentally in the prepare and measure scenario. Here, Z is a function of VM. Once the covariance matrix is achieved, the Gaussian extremity theorem can be used to calculate the upper bound of the eavesdropper's knowledge, which is similar to the security analysis method in Gaussian-modulated protocol. Then, the lower bound of secret key rate can be derived.

The linear channel assumption is adopted since the quadrature measurement of one mode of an EPR state cannot directly map the other mode to a group of discrete-modulated coherent states. This results in the lack of covariance item Z in the covariance matrix, leading to the need for an additional assumption. If considering general case without linear channel assumption, the unknown of Z will lead to the worst-case estimation of the secret key rate, which is zero. Since the security proof of the discrete-modulated CV-QKD is not perfect, the discrete-modulated CV-QKD system is less concerned for a period of time.

This situation did not change until 2018, as the security proof of discrete-modulated protocols gradually improved and no longer required linear channel assumptions.125 The eavesdropping behavior can be bounded through methods such as the uncertainty principle (UP),125 the semidefine programming,126,127 and the entropy uncertainty,129 then the secret key rate of the protocol can be obtained by searching for the lower bound.

Introducing an auxiliary mode into the EB scheme is a feasible strategy to continuously use the security analysis method based on covariance matrix.125 Before sending the mode into the unsecured quantum channel, the mode is divided by a beam splitter, and one of the output mode is preserved by the sender. This preserved mode can be used to construct correlations between Alice and Bob. Therefore, the covariance matrix describing the system contains three modes, which weakens the negative influence of the undefined covariance on secret key rate. This works for arbitrary discrete modulation formats, specifically, 256 quadrature amplitude modulation (QAM) with Gaussian probability shaping performs close to the Gaussian modulated protocol, and the 64 QAM system can still support the transmission of more than 100 km.

Specifically, after the transmission of the quantum state, the covariance matrix of the quantum state shared by Alice and Bob can be written as
γ AC B = ( γ A ϕ AC κ A B ϕ AC T γ C ϕ C B κ A B T ϕ C B T γ B ) ,
(22)
where γ A , γ C, and ϕ AC can be theoretically calculated, ϕ C B, γB can be estimated through the measured data, and only the covariance term κ A B is unknown. Since the covariance matrix γN for a N-mode state is constrained by the uncertainty principle [Eq. (7)]. The constraint set S κ which limits the possible value of κ A B can be obtained as
S κ = { ϕ A B | γ AC B [ κ A B = ϕ A B ] + i Ω N 0 } ,
(23)
and the maximum value of S B E G can be obtained by searching in the set.
Overall, the secret key rate at the asymptotic limit can be calculated as follows:
K = β I ( M A : H B ) sup κ A B S κ S B E G ( κ A B ) ,
(24)
where I ( M A : H B ) is the classical mutual information, and β is the reconciliation efficiency.

In 2019, Ghorai et al. proposed another security framework based on formulating the above problem as a semidefinite program (SDP) and focused on analyzing the security of a QPSK protocol.126 In this framework, SDP is used to search a state bounded by, in particular, designed statistics between modulation and detection data. It can be extended to a high-order modulation format and can be derived with an analytical solution of secret key rate in a symmetric modulation case.128 

Soon later in 2019, Lin et al. proposed another strategy to analyze the security of a discrete-modulated CV-QKD protocol with SDP.127 The security of two QPSK protocols, with homodyne and heterodyne detection, respectively, are analyzed. It adopts a mapping and postselection based on the detection data to construct the positive operator valued measurement of the receiver. In principle, this security framework can also be extended to high-order modulation format, but practically, it is limited by the demand of high computational resource.

In the method proposed by Lin et al.,127 the secret key rate under collective attacks in the asymptotic limit can be can rewritten as
K = min ρ A B S D ( G ( ρ A B ) | | Z [ G ( ρ A B ) ] ) p pass δ EC ,
(25)
where D ( σ | | τ ) : = tr ( σ log σ ) tr ( σ log τ ) is the quantum relative entropy, G is a completely positive map related to the postselection in terms of actions on the bipartite state ρAB, Z is a completely positive trace preserving map related to the key map, δ EC stands for the actual amount of information leakage per signal, and p pass is the sifting probability.

In the transformed formula, only the first term is unknown, so the rate calculation problem has become a convex optimization problem for solving the minimum value of the first term in the formula. The set S is the feasible set of the optimization problem, which contains all bipartite density operators ρAB that are compatible with experimental observations.

From the measurement of Bob, the expectation values of the first and second moments of the quadrature operators x ̂ , x ̂ 2 , p ̂ , p ̂ 2 can be obtained. In addition, the operators n ̂ = a ̂ a ̂ and d ̂ = a ̂ 2 + ( a ̂ ) 2 to constrain ρAB.

The relevant optimization problem is
minimize D ( G ( ρ A B ) | | Z [ G ( ρ A B ) ] ) ,
(26)
subject to
{ Tr [ ρ A B ( | k k | A x ̂ ) ] = p k q ̂ k , Tr [ ρ A B ( | k k | A p ̂ ) ] = p k p ̂ k , Tr [ ρ A B ( | k k | A n ̂ ) ] = p k n ̂ k , Tr [ ρ A B ( | k k | A d ̂ ) ] = p k d ̂ k , Tr [ ρ A B ] = 1 , Tr B [ ρ A B ] = i , j = 0 3 p i p j φ j | φ i | i j | A , ρ A B 0 ,
(27)
where k { 0 , 1 , M }, pk is the probability of sending the corresponding state, M is the modulation order, and q ̂ k , p ̂ k , n ̂ k , d ̂ k denote the corresponding expectation values of operators x ̂ , q ̂ , n ̂ , d ̂ for the conditional state ρ B x. This security analysis framework is further developed to higher modulation level with various formats.200–207 

In addition to the security analysis methods we mentioned above, there also exists some other strategies that can reach security under finite-size effect, such as the binary modulated protocol,208 the QPSK protocol using the entropy accumulation209 and the discrete alphabet CV-QKD.210 The recent progress of the security analysis of discrete-modulated protocol is shown in Table IV and the performance is shown in Fig. 6. In conclusion, the mainstream strategy to provide a general security analysis of the discrete-modulated protocol is to introduce more correlation between Alice and Bob, which contributes to a tighter bound on the possible eavesdropping behavior.

TABLE IV.

The security framework of discrete-modulated CV-QKD.

Security analysis methods Years Representative results
Uncertainty principle125   2018  Arbitrary formats, 256 QAM, QPSK, etc. 
Linear semidefinite program126   2019  Arbitrary formats, 256 QAM, QPSK, etc. 
Nonlinear semidefinite program127   2019  12-state double ring, QPSK, etc. 
Entangled photon pairs129   2021  2-state 
Security analysis methods Years Representative results
Uncertainty principle125   2018  Arbitrary formats, 256 QAM, QPSK, etc. 
Linear semidefinite program126   2019  Arbitrary formats, 256 QAM, QPSK, etc. 
Nonlinear semidefinite program127   2019  12-state double ring, QPSK, etc. 
Entangled photon pairs129   2021  2-state 
FIG. 6.

The performance of different heterodyne detected discrete-modulated CV-QKD security analysis, including the linear SDP (red and blue line), the nonlinear SDP (purple line), and the security analysis using uncertainty principle (UP) (green line). The modulation variance is optimal for different security analysis. The performance of the no-switching protocol is also presented (yellow line).

FIG. 6.

The performance of different heterodyne detected discrete-modulated CV-QKD security analysis, including the linear SDP (red and blue line), the nonlinear SDP (purple line), and the security analysis using uncertainty principle (UP) (green line). The modulation variance is optimal for different security analysis. The performance of the no-switching protocol is also presented (yellow line).

Close modal

3. Practical protocol with trusted noise

The practical measurement of a CV-QKD system usually suffers from the imperfect detection efficiency and electronic noise, leading to the increase in channel loss and excess noise. While in device-dependent system, the trusted device with specific noise model can relax the degradation caused by device imperfections.132,211,212 Normally, the coherent receiver of a CV-QKD system can be trusted, where the loss and noise inside the detector can be modeled by an EPR state with one mode (denoted as F0) coupled into the signal path by a beam splitter. The trusted detector module significantly enhances the transmission distance and the secret key rate of the system, which is demonstrated in the early experiment.132 Further, the feasibility of enhancing the system performance using optical amplifiers is proved.213–217 As shown in Fig. 7, here we denote the output mode after the coupling as F, and the other mode of the EPR state as G. The transmittance of the beam splitter, η, reflects the detection efficiency. The variance of the EPR state is written as
V D = 1 + ν ele / ( 1 η ) ,
(28)
where νele reflects the variance of the electronic noise of a homodyne detector. For heterodyne detection, νele should be replaced by 2 ν ele. The security analysis is based on the covariance matrix γAFGB
γ AFGB = ( γ AFG σ AFGB T σ AFGB γ B ) .
(29)
FIG. 7.

The EB scheme of the security analysis with trusted detector module. The structure of Alice is the same as preparing coherent state with EPR states. The beam splitter at the receiver site has the transmittance of η, and the variance of the EPR state is V D = 1 + ν ele / ( 1 η ). Here, νele is the electronic noise of the homodyne detector.

FIG. 7.

The EB scheme of the security analysis with trusted detector module. The structure of Alice is the same as preparing coherent state with EPR states. The beam splitter at the receiver site has the transmittance of η, and the variance of the EPR state is V D = 1 + ν ele / ( 1 η ). Here, νele is the electronic noise of the homodyne detector.

Close modal
For convenience, we will discuss both homodyne and heterodyne scenarios simultaneously in this section. A practical detector is characterized by an efficiency η and a noise νele due to detector electronics. As we did for the channel, we can define a detection-added noise referred to Bob's input and expressed in shot-noise units that we devote, in general, as χh, and is given by the expressions
χ hom = [ ( 1 η ) + ν ele ] / η ,
(30)
and
χ het = [ 1 + ( 1 η ) + 2 ν ele ] / η ,
(31)
for homodyne and heterodyne detection, respectively. The total noise referred to the channel input can then be expressed as χ tot = χ line + χ h / T.
The mutual information between Alice and Bob is given in the case of practical protocol with trusted noise by the same expressions as Eq. (11) by replacing χline to χtot. The upper bound of Eve's knowledge, χBE becomes
χ B E = i = 1 2 G ( λ i ) i = 3 5 G ( λ i ) ,
(32)
where λ 1 , 2 represent the symplectic eigenvalues of covariance matrix γAB. λ 3 , 4 , 5 represent the symplectic eigenvalues of covariance matrix γ AFGB | m A which is given by
γ AFGB | m A = γ AFG σ AFGB T H σ AFGB .
(33)
Here, γAFG and σAFGB are the sub-matrix of γAFGB. The symplectic eigenvalues can be given by expressions of the form
λ 1 , 2 2 = 1 2 [ Δ ± Δ 2 4 D ] ,
(34)
λ 3 , 4 2 = 1 2 [ E ± E 2 4 F ] ,
(35)
and λ 5 = 1. For the homodyne case,
E hom = Δ χ hom + V D + T ( V + χ line ) T ( V + χ tot ) ,
(36)
F hom = D V + D χ hom T ( V + χ tot ) ,
(37)
and for the heterodyne case,
E het = Δ χ het 2 + D + 1 + 2 χ het ( V D + T ( V + χ line ) ) + 2 T ( V 2 1 ) ( T ( V + χ tot ) ) 2 ,
(38)
F het = ( V + D χ het T ( V + χ tot ) ) 2 ,
(39)
where Δ, D are given in Table III.

In this section, we will provide an overview of the architecture and the details of the main modules in a CV-QKD system. A summary of the current status of the key modules in a CV-QKD system using coherent states can be found in Table V. Generally, CV-QKD system can be categorized into two types, the in-line LO and the local LO. As shown in Fig. 8, of all the differences between these two types of systems, the greatest one is whether the LO is generated inside the receiver. For the in-line LO system, as shown in Fig. 8(a), the light generated by the laser source is divided, where part of the light is modulated and attenuated to quantum level, while the other part of the light is used as the strong LO. The quantum signal and LO are then multiplexed and transmitted to the receiver simultaneously. For the local LO system, displayed in Fig. 8(b), in principal the transmitter only need to modulate and send the quantum signal, and the receiver uses the locally generated LO to perform coherent detection, which simplifies the system structure and prevents the access of LO by Eve. These two different system schemes result in different main noise source, therefore various system architectures are adopted for suppressing the excess noise and raise the secret key rate.

TABLE V.

Current implementation status of the key module technology of CV-QKD system using coherent states. TDM: Time-Division Multiplexing, Pol.M: Polarization Multiplexing, FDM: Frequency-Division Multiplexing, MIMO: Multiple-Input Multiple-Output, LDPC: Low Density Parity Check.

Key module Function Notes
Transmitter  Source  Pulsed  Pulsed light generation  High extinction ratio of 60 dB with narrow linewidth 
Continuous-wave  Continuous-wave light generation  Narrow linewidth 20 kHz 
Modulation  Gaussian modulation  Preparation of coherent states obeying Gaussian distribution  1 GHz repetition frequency with IQ modulator 
Discrete modulation  Preparation of coherent states obeying discrete distribution  1 Gbaud 256 QAM Gaussian probability shaping with IQ modulator 
Attenuation  Reducing the power of signals to quantum level for security  Variable optical attenuator or amplitued modulator 
Multiplexing  Co-propagation of quantum signal and LO/pilot-tone  TDM, Pol.M, TDM + Pol.M, FDM, FDM + Pol.M, Dual Pol. 
Transmitter monitoring  Source monitoring  Source modeling  Detecting a fraction of the modulated signal 
Injected light monitoring  Closing potential security loopholes  Detecting the injected light 
Receiver  Receiver monitoring  LO monitoring  Closing potential security loopholes  Detecting a fraction of the LO 
Injected light monitoring    Detecting the injected light 
De-modulation  Sychronization  Keeping the receiver's clock consistent with the sender's clock  Co-propagation or a separately transmission of the clock signal 
De-multiplexing  Separating the quantum signal and LO (or pilot signal if necessary) before detection  Optical delay line and/or polarization beam splitter before detection 
Optical compensation  Suppressing the noise from polarization or phase mismatch  Dynamic polarization controller and/or phase shifter 
Detection  Detection balance  Compensation of the imbalance from different optical paths  Variable optical attenuator before photodiodes 
Hom/het detection  Measurement of the quadrature information  Shot noise limited homodyne detection, heterodyne detection 
QRNG  ⋯  Continuous  Getting continuous-distributed random numbers to support Gaussian modulation  Transmitting from the discrete-distributed random number, or QRNG with continuous output 
Discrete  Getting 0 &1 random numbers for discrete modulation, sifting, and postprocessing  High-speed QRNG, normally based on continuous-variable system 
SNU calibration  ⋯  Two time  Achieving the SNU for data normoalization  Calibrating the total noise and electronic noise 
One time  Calibrating the total noise 
DSP  Pulse shaping  ⋯  Generating signal pulses and raise the spectrum efficiency  RRC filter 
Framing  ⋯  Quantum signal, LO/pilot tone and frame signal  Frequency division multiplexing 
Synchronization  Clock  Keeping the receiver's clock consistent with the sender's clock  Co-propagation or a separately transmission of the clock signal 
Frame  Definition of the starting and ending positions  Data frame in LO or pilot tone 
Equalization  Static  Compensation of device imperfections  S21 compensation, matched filter, skew compensation 
Dynamic  Compensation of transmission impairments  Phase and polarization mismatch with MIMO algorithms 
Post-processing  Sifting  ⋯  Preserving the modulation data with the same detection basis as the detector  Detection basis announcement 
Parameter estimation  ⋯  Estimation of the secret key rate  Estimating the covariance matrix or system parameters 
Information reconciliation  Reconciliation  Mapping the continuous data to discrete form  Slice reconciliation and multidimensional reconciliation 
Error correction  Making the two parties share a same bit string  LDPC and Polar code 
Privacy amplification  ⋯  Distilling the final secret key bits  Toepliz matrix 
Key module Function Notes
Transmitter  Source  Pulsed  Pulsed light generation  High extinction ratio of 60 dB with narrow linewidth 
Continuous-wave  Continuous-wave light generation  Narrow linewidth 20 kHz 
Modulation  Gaussian modulation  Preparation of coherent states obeying Gaussian distribution  1 GHz repetition frequency with IQ modulator 
Discrete modulation  Preparation of coherent states obeying discrete distribution  1 Gbaud 256 QAM Gaussian probability shaping with IQ modulator 
Attenuation  Reducing the power of signals to quantum level for security  Variable optical attenuator or amplitued modulator 
Multiplexing  Co-propagation of quantum signal and LO/pilot-tone  TDM, Pol.M, TDM + Pol.M, FDM, FDM + Pol.M, Dual Pol. 
Transmitter monitoring  Source monitoring  Source modeling  Detecting a fraction of the modulated signal 
Injected light monitoring  Closing potential security loopholes  Detecting the injected light 
Receiver  Receiver monitoring  LO monitoring  Closing potential security loopholes  Detecting a fraction of the LO 
Injected light monitoring    Detecting the injected light 
De-modulation  Sychronization  Keeping the receiver's clock consistent with the sender's clock  Co-propagation or a separately transmission of the clock signal 
De-multiplexing  Separating the quantum signal and LO (or pilot signal if necessary) before detection  Optical delay line and/or polarization beam splitter before detection 
Optical compensation  Suppressing the noise from polarization or phase mismatch  Dynamic polarization controller and/or phase shifter 
Detection  Detection balance  Compensation of the imbalance from different optical paths  Variable optical attenuator before photodiodes 
Hom/het detection  Measurement of the quadrature information  Shot noise limited homodyne detection, heterodyne detection 
QRNG  ⋯  Continuous  Getting continuous-distributed random numbers to support Gaussian modulation  Transmitting from the discrete-distributed random number, or QRNG with continuous output 
Discrete  Getting 0 &1 random numbers for discrete modulation, sifting, and postprocessing  High-speed QRNG, normally based on continuous-variable system 
SNU calibration  ⋯  Two time  Achieving the SNU for data normoalization  Calibrating the total noise and electronic noise 
One time  Calibrating the total noise 
DSP  Pulse shaping  ⋯  Generating signal pulses and raise the spectrum efficiency  RRC filter 
Framing  ⋯  Quantum signal, LO/pilot tone and frame signal  Frequency division multiplexing 
Synchronization  Clock  Keeping the receiver's clock consistent with the sender's clock  Co-propagation or a separately transmission of the clock signal 
Frame  Definition of the starting and ending positions  Data frame in LO or pilot tone 
Equalization  Static  Compensation of device imperfections  S21 compensation, matched filter, skew compensation 
Dynamic  Compensation of transmission impairments  Phase and polarization mismatch with MIMO algorithms 
Post-processing  Sifting  ⋯  Preserving the modulation data with the same detection basis as the detector  Detection basis announcement 
Parameter estimation  ⋯  Estimation of the secret key rate  Estimating the covariance matrix or system parameters 
Information reconciliation  Reconciliation  Mapping the continuous data to discrete form  Slice reconciliation and multidimensional reconciliation 
Error correction  Making the two parties share a same bit string  LDPC and Polar code 
Privacy amplification  ⋯  Distilling the final secret key bits  Toepliz matrix 
FIG. 8.

Two mainstream structures of CV-QKD system implementation: (a) In-line LO scheme and (b) Local LO scheme. The phase modulator at the receiver's side, is used to choose the quadrature of measurement for homodyne detection, which is not needed for heterodyne detection. Mod: Gaussian or discrete modulation, VOA: variable optical attenuator, DPC: dynamic polarization controller, PM: phase modulator, Hom: homodyne detector, and Het: heterodyne detector.

FIG. 8.

Two mainstream structures of CV-QKD system implementation: (a) In-line LO scheme and (b) Local LO scheme. The phase modulator at the receiver's side, is used to choose the quadrature of measurement for homodyne detection, which is not needed for heterodyne detection. Mod: Gaussian or discrete modulation, VOA: variable optical attenuator, DPC: dynamic polarization controller, PM: phase modulator, Hom: homodyne detector, and Het: heterodyne detector.

Close modal

Generally, the structure of a CV-QKD system can be concluded in Fig. 9. The transmitter and receiver are the optical modules of the system, which are responsible for the information encoding and decoding.

FIG. 9.

The key modules in a CV-QKD system. The transmitter and receiver form the optical part. Optical fiber and free space are the two kinds of quantum channel, where the optical fiber is the mainstream way to transmit the quantum signals. System control is normally used to realize the synchronization between the transmitter and the receiver. QRNG are deployed at both sides to provide the random numbers for modulation, detection, and postprocessing. Shot noise unit (SNU) calibration is the security module, which provides the normalized unit of the detection data. Post-processing uses classical channel to exchange the information on modulation and detection data, and getting the final secret key bits.

FIG. 9.

The key modules in a CV-QKD system. The transmitter and receiver form the optical part. Optical fiber and free space are the two kinds of quantum channel, where the optical fiber is the mainstream way to transmit the quantum signals. System control is normally used to realize the synchronization between the transmitter and the receiver. QRNG are deployed at both sides to provide the random numbers for modulation, detection, and postprocessing. Shot noise unit (SNU) calibration is the security module, which provides the normalized unit of the detection data. Post-processing uses classical channel to exchange the information on modulation and detection data, and getting the final secret key bits.

Close modal

The transmitter consists of the laser source, the modulation module and the monitoring module. The laser source can be pulsed or continuous-wave light. The mostly commonly employed modulation formats are Gaussian and discrete modulation. Additionally, the modulator must modulate and multiplex a classical auxiliary signal with the quantum signal, which is the LO in an in-line LO system and the pilot tone in a local LO system. The quantum signal is multiplexed with LO or pilot tone using time-division, frequency-division, and polarization multiplexing techniques. For security reasons, monitoring is typically employed at the output stage.

At the receiver end, the co-transmitted quantum and classical signals are demodulated and detected by shot-noise-limited balanced homodyne detectors (BHDs). A seperate monitoring module is deployed to ensure the practical security. Several automatic feedback methods are used to calibrate sampling time, polarization, and phase of the quantum states in order to overcome perturbations in the channel due to changing environmental conditions. These calibrations can be realized using either hardware or digital techniques.

To map the output of the detector to the quadrature information, DSP is employed with the aim of achieving maximal correlation between the transmitter and receiver. With the assist of DSP, SNU calibration enables the establishment of a connection between theoretical security analysis and the practical system, a crucial aspect of system security. Finally, postprocessing is processed to extract the secret key bits from the correlation established by the aforementioned procedures. It comprises sifting, parameter estimation, information reconciliation, and privacy amplification. The randomness of the overall system is supported by the quantum random number generator (QRNG), which provides the information of modulation and controls the postprocessing.

Randomness determines the security of a CV-QKD system. In fact, all of the random numbers used in a CV-QKD system should satisfy the true randomness, which is essential to the unconditional security.3–6 An outstanding alternative is a QRNG, which exploits the intrinsic random nature of quantum mechanics, acts as a promising method in generating truly random numbers.218–220 

The random numbers are used for controlling the modulators so that the sender can prepare random coherent states following a certain modulation format, determining the detection basis during homodyne detection, and constructing mappings or universal hash functions in postprocessing. Specifically, Gaussian distributed random numbers, Rayleigh distributed or uniformly distributed random numbers in continuous-variable form are required in Gaussian modulation of coherent states. Discrete-variable random numbers are required in discrete-modulation, basis selection and postprocessing.

Based on different security levels, the QRNG can be divided into the practical type,221,236–240 the semi-device independent type241–250 and the device independent type.251–254 The QRNG can also be divided into the discrete-variable and continuous-variable types corresponding to different types of entropy source. Normally, the continuous-variable QRNG can support high generation rate with simple structure, where the randomness can come from the amplifier spontaneous emission (ASE) noise,233–235,255–258 the phase noise,226–231,259–268 and the vacuum noise.223–225,269–271 The QRNG based on vacuum noise can achieve high-speed and simple structure, using only a laser source and a homodyne detector.223,224,271 The state of the art QRNG based on the vacuum noise can achieve a generation rate of 100 Gbps using photonic integrated circuits,272 where the speed, size and scalability can well satisfy the need of a CV-QKD system.225 Here, we summarize the most commonly used QRNG implementations as shown in Table VI.

TABLE VI.

Current QRNG implementations. The bandwidth with * represents the repetition rate of the laser pulse.

Scheme Year Bandwidth Generation rate
Vacuum fluctuation  2011  120 MHz  2 Gbps (real-time)221  
2019  1 GHz  6.83 Gbps (real-time)222  
2021  3.5 GHz  18.8 Gbps (real-time)223  
2021  400 MHz  2.9 Gbps (real-time)224  
2023  10 GHz  100 Gbps (Ref. 225
Laser phase noise  2010  1 GHz  500 Mbps (Ref. 226
2016  1 GHz  5.4 Gbps (real-time)227  
2014  2.5 GHz *  20 Gbps (Ref. 228
2015  12 GHz  68 Gbps (Ref. 229
2019  1 GHz *  8 Gbps (real-time)230  
2021  2.5 GHz *  10 Gbps (Ref. 231  
2023  20 GHz  218 Gbps (Ref. 232
ASE  2010  7.5 GHz  12.5 Gbps (Ref. 233
2011  15 GHz  20 Gbps (Ref. 234
2020  5 GHz  118.375 Gbps (Ref. 235
Scheme Year Bandwidth Generation rate
Vacuum fluctuation  2011  120 MHz  2 Gbps (real-time)221  
2019  1 GHz  6.83 Gbps (real-time)222  
2021  3.5 GHz  18.8 Gbps (real-time)223  
2021  400 MHz  2.9 Gbps (real-time)224  
2023  10 GHz  100 Gbps (Ref. 225
Laser phase noise  2010  1 GHz  500 Mbps (Ref. 226
2016  1 GHz  5.4 Gbps (real-time)227  
2014  2.5 GHz *  20 Gbps (Ref. 228
2015  12 GHz  68 Gbps (Ref. 229
2019  1 GHz *  8 Gbps (real-time)230  
2021  2.5 GHz *  10 Gbps (Ref. 231  
2023  20 GHz  218 Gbps (Ref. 232
ASE  2010  7.5 GHz  12.5 Gbps (Ref. 233
2011  15 GHz  20 Gbps (Ref. 234
2020  5 GHz  118.375 Gbps (Ref. 235
However, the most of the QRNG generates random numbers that are uniform distributed. Therefore, a transformation from the uniform distributed random numbers to the Gaussian distributed random numbers would be a mandatory step. There are several ways of transforming the uniform distributed random numbers into the Gaussian distributed random numbers. For example, the cumulative distribution function (CDF) Inversion Method,273 Box–Muller Transform,274 Central Limit Theorem,275 Piecewise Linear Approximation using Triangular Distributions,276 Rejection methods,277 and so on. Typically, the Box–Muller Transform is one of the most widely used methods. It is based on the independent samples, U1 and U2, chosen from the uniform distribution on the unit interval (0, 1). Let
Z 0 = 2 l n U 1 cos ( 2 π U 2 ) , Z 1 = 2 l n U 1 sin ( 2 π U 2 ) .
(40)
Then, Z0 and Z1 are independent random variables with a standard normal distribution. A discrete-modulated CV-QKD system can naturally avoid this issue, where the only step using continuous-variable random numbers, the Gaussian modulation, is replaced.

The function of the transmitter of a CV-QKD system is to prepare the modulated quantum signals and the classical auxiliary signals such as the LO and pilot tones. It usually consists of the laser source, the modulation module and the monitoring module.

1. Source

Laser source usually requires the narrow linewidth and low relative intensity noise to achieve high-performance and stability. Among the wide range of lasers, fiber lasers are the most commonly used, which is advanced in monochromaticity, directionality, and stability. The distributed feedback lasers and external cavity lasers are also adopted in some systems.278–281 

The laser source can be pulsed or continuous-wave form. The pulsed laser source usually consists of a laser diode with amplitude modulators, while the continuous-wave laser source only requires a narrow-linewidth laser diode. In the early stage of CV-QKD system, pulsed light is naturally used since the separation in time domain provides a clear understanding of different quantum states. Moreover, it is suitable for time division multiplexing to suppress the crosstalk between quantum and classical auxiliary signals. Since the necessary classical auxiliary signal is around 104–108 photons per pulse, to eliminate the leakage from the classical pulse to quantum signal pulse, the required extinction ratio is normally about 80 dB or more. Usually, a conventional amplitude modulators has an extinction ratio less than 40 dB, therefore, two or more cascaded amplitude modulators are required for pulse generation.282 

As the system repetition frequency increases for higher performance, it is harder to achieve pulses with high extinction ratio and high repetition frequency simultaneously, resulting in the demand of directly using continuous-wave laser source. Meanwhile, the local LO system reduces the crosstalk between quantum and classical signals, which relaxes the requirement of the extremely high isolation. Therefore, the continuous-wave laser source without the complex cascaded amplitude modulators is widely used in the recent local LO systems.143,283–287 However, for an accurate interference with signals from two different lasers, the laser diodes in an local LO system require narrower linewidth. In addition, a laser locking module can be optionally used to reduce the phase noise.

2. Modulation

The light output from the laser source is then modulated to encode the quantum information, generate the classical signals such as frame signals, and the LO or reference signal, which are combined at the output of the transmitter through various multiplexing techniques. In this part, we will detail the modulation process in three steps, encoding information, controlling the average power of quantum signal and adding classical auxiliary signals.

For encoding information, two mainstream methods are adopted as shown in Figs. 10(a) and 10(b). One is the combination of a phase modulator and an amplitude modulator, and the other is the use of an in-phase quadrature (IQ) modulator. The structure of the modulators used here is detailed in Figs. 10(c)–10(e). The modulation format of a CV-QKD system includes Gaussian modulation and discrete modulation, as shown in Figs. 11(a) and 11(b). Both of them require displacements of coherent states on two quadratures of the phase space. An exception is the unidimensional modulation shown in Fig. 11(c), which only requires the modulation of one quadrature and can be realized with a single amplitude modulator. In addition, the Phase Shift Keying (PSK) discrete-modulation only requires a phase modulator for encoding, as shown in Fig. 11(d).

FIG. 10.

(a) The structure of modulation module for quantum signals. QRNG is used for providing modulation data, amplitude modulator (AM) and PM is used to load the modulation information, and variable optical attenuator is used to adjust the intensity of quantum signal to quantum level. (b) The modulation module using IQ modulator. (c) A simple structure of the phase modulator, which consists of a PIN junction. (d) The structure of the amplitude modulator, which consists of two phase modulators. (e) The structure of the IQ modulator, with two amplitude modulators and one phase modulator.

FIG. 10.

(a) The structure of modulation module for quantum signals. QRNG is used for providing modulation data, amplitude modulator (AM) and PM is used to load the modulation information, and variable optical attenuator is used to adjust the intensity of quantum signal to quantum level. (b) The modulation module using IQ modulator. (c) A simple structure of the phase modulator, which consists of a PIN junction. (d) The structure of the amplitude modulator, which consists of two phase modulators. (e) The structure of the IQ modulator, with two amplitude modulators and one phase modulator.

Close modal
FIG. 11.

(a) The Gaussian modulation format with phase and amplitude modulation or IQ modulation. The coherent states on phase space obeys a two-dimensional Gaussian distribution, where the x and p quadrature obeys independent identical Gaussian distribution. (b) The discrete-modulation format with phase and amplitude modulation or IQ modulation. Here, a 16 QAM is specified. (c) The unidimensional modulation on x quadrature with only amplitude modulation. (d) The PSK modulation with only phase modulation, while the amplitude of each coherent state is equal. AM: amplitude modulator, PM: phase modulator, and IQ: in-phase quadrature modulator.

FIG. 11.

(a) The Gaussian modulation format with phase and amplitude modulation or IQ modulation. The coherent states on phase space obeys a two-dimensional Gaussian distribution, where the x and p quadrature obeys independent identical Gaussian distribution. (b) The discrete-modulation format with phase and amplitude modulation or IQ modulation. Here, a 16 QAM is specified. (c) The unidimensional modulation on x quadrature with only amplitude modulation. (d) The PSK modulation with only phase modulation, while the amplitude of each coherent state is equal. AM: amplitude modulator, PM: phase modulator, and IQ: in-phase quadrature modulator.

Close modal
In fact, using the phase and amplitude modulators or using an IQ modulator, are the different perspectives of a two-dimensional distribution, as shown in Figs. 11(a) and 11(b). Take the Gaussian modulation as an example, for an IQ modulator, if we denote I and Q as the data loaded to the in-phase and quadrature path of the IQ modulator, which corresponds to the x and p quadrature on phase space, they should obey normal distribution as
I N ( 0 , σ 2 ) , Q N ( 0 , σ 2 ) ,
(41)
where σ 2 is the variance and N represents the normal distribution. For phase and amplitude modulators, the information is loaded with a polar coordinate system, therefore requires the Rayleigh distributed amplitude
f ( x , σ ) = x σ 2 e x 2 / 2 σ 2 ,
(42)
and the uniform distributed phase information.

We remark that, sometimes the x or p quadrature is also called basis, but it is different to the basis in single-photon protocol since the security of CV-QKD is not determined by quadrature selection. Actually, the security of a coherent state CV-QKD system is ensured by the indistinguishability of coherent states on phase space. There also exists a noval CV-QKD protocol based on the basis encoding, where the secret information is encoded on the random choices of two measurement basis, and the security against individual attack has been proved.288 The scheme exhibits the potential to tolerate high excess noise.

For practical implementations, we remark that these two methods require different acquisitions.289 In addition to that, the working parameters of the modulators should be accurately adjusted, since the imperfect modulation may increase the excess noise and open security loopholes.290 

After the encoding, one should adjust the average power of the prepared quantum states to a proper level. Although in principle, CV-QKD protocols can use the quantum states with high average power, the practical implementations always require the extremely low average power in a few photon number levels, since the practical devices with limited resolution cannot measure the quantum characteristics of the high-power states. Using the variable optical attenuator (VOA) with manual adjustment or automatic control is a general method to adjust the level of attenuation, as shown in Fig. 10. Further, Zhang et al. used an amplitude modulator to realize the real time attenuation control. It allows one to flexibly raise the launching power of the frame signals for better SNR, and reduce the power of the quantum signals.139 

In addition, the passive-state-preparation CV-QKD without modulation modules has also been proposed, where the transmitter consists of a thermal source, beam splitters, optical attenuators, and homodyne detectors.194,291,292

In the earliest experimental demonstrations, the quantum signals and the LOs are transmitted separately.130 Later, in order to avoid any polarization and phase drifts that may occur between the signal and LO over long-distance fiber transmissions, time-division multiplexing scheme was proposed to co-transmit the quantum signals and the LOs in the same fiber.132 In another literature, Qi et al. also co-transmitted the quantum signals with the LOs, but adopted a scheme combining polarization and frequency-division multiplexing.293 In later experimental demonstration, the co-transmission schemes basically adopt the combination scheme of time-division multiplexing and polarization multiplexing.133,136,137,139,294 In this way, the leakage from the LOs to the quantum signals can be maximally suppressed, while maintaining a relatively simple implementation structure.

For local LO systems, though LO is generated by the receiver, a classical reference signal is still necessary for phase recovery. Early local LO systems using pulsed laser source is suitable with time division multiplexing, where the quantum signal and the classical pilot tone are alternately transmitted.141,142 It can be combined with the polarization multiplexing to suppress the leakage of the pilot tone.295 Toward high-speed and continuous-wave system, frequency division multiplexing of quantum signal and pilot tone is widely used.283,284,287 Since the power of pilot tone is far lower than that of the LO, the requirement of isolation is relaxed. It can also be combined with polarization multiplexing for higher isolation.143,285

In addition to the LO or reference signal, some classical frame signals are inserted in the quantum signal sequence to provide the essential information for synchronization, phase compensation, etc. These frame signals are usually generated by the same modulation module of quantum signals, and time-division multiplexed.

3. Transmitter monitoring

A source monitor is deployed after the modulation module to evaluate Alice's real output state by detecting a fraction of the signal before entering into the quantum channel. It can be categorized into the active source monitor and the passive source monitor. As shown in Fig. 12(a), the active source monitor adopts the optical switch for getting a part of the signal for monitor, while the passive source monitor uses a beam splitter to divide the quantum signal for monitor, shown in Fig. 12(b).

FIG. 12.

(a) The active transmitter monitor. (b) The passive transmitter monitor. (c) The transmitter monitor aiming at monitoring the injected light.

FIG. 12.

(a) The active transmitter monitor. (b) The passive transmitter monitor. (c) The transmitter monitor aiming at monitoring the injected light.

Close modal

The monitor module can be a homodyne or heterodyne detector, which provides the statistic of the modulated coherent states, including the modulation variance, which is related to the power of the modulated signals. In addition, for Gaussian modulation, since the modulation variance corresponds to the average photon number, which is related to the optical power, an optical power meter can replace the homodyne or heterodyne detector for source monitor.

Specifically, for Gaussian modulation, we can get
n ̂ = 1 4 ( x 2 + p 2 ) 1 2 = 1 2 ( V 1 ) = V M 2 ,
(43)
where V = V M + 1 is the variance of the mode, and VM is defined as the modulation variance. The average photon number of the output mode, n ̂, can be achieved by detecting the power of the output signal, denoted as Pout. Each photonic has the energy of E = h ν, where h is the Plank constant and ν is the frequency. Assuming N pulses are detected, where N is a sufficient large number, and the repetition frequency of the system is frep. The average photon number can be achieved by
n ̂ = P out h ν f rep .
(44)
Therefore, the modulation variance is V M = 2 P out / ( h ν f rep ). If we denote the modulation variance of the electrical data as V M e and assume the modulator works linearly, the scale coefficient can be achieved as c = V M / V M e. Therefore, the output of the sender can be denoted by ( D x B 0 , D p B 0 ) = c ( D x B 0 , D p B 0 ). Here, ( D x B 0 , D p B 0) is the electrical modulation data and ( D x B 0 , D p B 0) is the calibrated modulation data on phase space.

In this way, one can define the data of state preparation on phase space corresponding to the electrical modulation data entered into the modulation module, and the estimated average power of the output quantum states, which is a crucial step for security analysis of a practical system.

The source monitor also contributes to a tight estimation of channel parameters. In a practical system, the laser fluctuation,296 imperfect modulation290 and other factors introduce source noise into state preparation stage.297 It has been shown that the secret key rate may be undermined by the source noise.163,298,299 Traditionally, source noise is ascribed into the channel noise to calculate the secret key rate, while in practice it is controlled neither by Eve, nor by legitimate users. So, this untrusted source noise model just overestimates Eve's power and leads to an untight security bound. By real-time monitoring the modulated quantum signals, the source noise can be calibrated and removed from the channel noise, which helps to enhance the system performance.

In addition, for practical security considerations, the monitoring module of the source can help to resist the potential attacks on the system by injecting a strong light, such as the Trojan-horse attack,300 which can open a side channel for Eve. The monitoring structure is shown in Fig. 12(c), where a circulator isolates the injected light from the components inside the transmitter, and directs it to the monitoring module, which can be a homodyne detector, or an optical power meter. The specific attack methods and countermeasures are detailed in the section of practical security.

The receiver of a CV-QKD system should accurately measure the quadrature of the received state on phase space, which normally contains the monitoring, de-modulation and detection sub-modules, detailed as below.

1. Receiver monitoring

The receiver monitoring module is mainly used to monitor the classical light from the channel, including the wavelength, frequency, power, and amplitude of the LO in an in-line LO system, as well as the pilot tone in a local LO system.301 

Receiver monitoring is essential for an in-line LO system, since the LO is transmitted in the quantum channel, which may be manipulated by Eve, and directly participates in the homodyne or heterodyne detection. For an in-line LO system with polarization multiplexed quantum signal and LO, after the de-multiplexing of the received signal, the LO can be divided by an unbalanced beam splitter. The stronger output is sent to the detector and the weaker one is detected by a photodiode (PD) for monitoring.

In addition to that, the monitor also need to ensure that the receiver is not affected by the potential injection of a strong light. Several efficient attacking strategies for the CV-QKD system are aiming at the receiver by injecting a strong light to disturb the detection or SNU calibration process. The attacks and countermeasures are detailed in the section of practical security.

2. De-modulation

The de-modulation module responses for the compensation and de-multiplexing in optical path to well separate the quantum and classical signals, mainly including the polarization302,303 and phase compensation,304–307 as well as the de-multiplexing of polarization and time. It also includes the synchronization in hardware layer.308–312 

Since the quantum signal is transmitted in single-mode fiber while the receiver is a polarization-maintaining system, the compensation of polarization is crucial for reducing the loss of quantum signals. More importantly, it can suppress the excess noise caused by the crosstalk of quantum and classical auxiliary signals in a polarization-multiplexing system. For proof-of-principle experiments, the polarization compensation is realized by a manual polarization controller, while dynamic polarization controller (DPC) with feedback systems is adopted in long-term or field tests.137 For simpler deployments, the digital polarization compensation is a crucial technique, where the recently proposed polarization tracking algorithm, in particular, designed for CV-QKD system has shown the possibility of realizing a simple and effective digital polarization compensation for extremely weak quantum signals.313 

Phase noise is inevitably introduced in a CV-QKD system, caused by the phase mismatch between quantum signal and LO. Though they are co-transmitted in an in-line system, the differences in transmission paths before and after multiplexing, as well as the disturbance of fiber link, result in different phases. The local LO system is worse, since quantum signal and LO are generated separately. Generally, the phase mismatch consists of the slow-fading and fast-fading ones. The slow-fading phase noise is normally caused by the optical path difference, while the fast-fading phase noise is caused by the channel disturbance and the frequency drift between the two lasers in local LO systems. The slow-fading ones can be compensated with the inserted frame signals, such as the four-state modulated signals. While more reference signals are required for fast-fading phase compensation, such as pilot tones. The phase compensation in optical path is normally realized with a phase modulator. Specifically, for the system with GG02 protocol, phase compensation can be integrated with the phase modulator for detection basis switching.

In a pulsed CV-QKD system, a de-multiplexing operation is usually performed before the homodyne or heterodyne detection to seperate the quantum signals and LO (or pilot tone). After the polarization compensation at the beginning of the receiver, a polarization beam splitter is used to separate the quantum and classical signals in orthogonal polarization directions. Then, for the time-division multiplexed signals, such as the quantum signal and LO, an optical delay line is adopted to align the quantum signal pulse and LO pulse for homodyne detection. In this structure, a phase modulator in the LO path realizes the basis switching and phase compensation as we mentioned before. Finally, the detection results can be used as the raw data.

The continuous-wave system is different, where most of the de-multiplexing and compensation can be realized in digital domain, using the data after the detection. The architecture of the receiver is similar to the integrated coherent receiver (ICR) in classical coherent optical communications, and lots of algorithms participate in the compensation and de-multiplexing process. We will detail this process in the part after detection.

Clock synchronization responses for the alignment of the sampling points at the transmitter and the receiver site. If the sampling points of the receiver are mismatched to those of the transmitter, the correlation between the modulation data and the detection data will be reduced. As for clock synchronization, there are many hardware layer solutions, such as transmitting in a cable,314 in a paired fiber,315 multiplexing with quantum signal in one fiber by wavelength division multiplex (WDM),316 and distilling the synchronization signal from LO. Each of the above options has its advantages and disadvantages. The electric cable is not only expensive and also instable for distant transmission. Transmitting clock signal and quantum signal in the same fiber by WDM can compensate the difference of signal arrival time but may introduce excess noise generated by WDM crosstalk. Distilling the synchronization signal from local oscillator need divide the local oscillator beam. The division of LO power will decrease the maximal transmission distance or require higher gain of homodyne detection to compensate. Transmitting clock signal in another independent fiber will generate the fluctuation between quantum and clock signal.

The recent system normally adopts the clock synchronization in digital domain,317 using algorithms to realize the above requirements, which will be detailed in DSP part.

3. Detection

Homodyne detection is the basis of measuring the quantum signals in a CV-QKD system.318–329 As shown in Fig. 13(a), the quantum and LO signals are interfered by a 50:50 coupler, then the two output signals are detected by two photodiodes. The two branches of the photocurrent generated by the photodiodes are differentiated and output. The differential current contains the information on the quadrature of the quantum signal. A simple derivation of homodyne detection is shown as below.

FIG. 13.

The two mainstream detection strategies in CV-QKD systems. (a) The homodyne detector, where the quantum signal and local oscillator are interfered by a 50:50 coupler, then the two output signals are detected by two photodiodes, finally the output of the two photodiodes, the differential current, is output. A phase shifter is necessary to switch the detection basis between x and p for ensuring the system security. (b) The heterodyne detector, where the quantum and local oscillator are divided, respectively, and detected by two homodyne detectors. A phase shift of π / 2 between the two local oscillators is introduced to realize the detection of x and p quadratures of the quantum signals. LO: local oscillator, PD: photodiode, Diff: differentiator, and HOM: homodyne detector.

FIG. 13.

The two mainstream detection strategies in CV-QKD systems. (a) The homodyne detector, where the quantum signal and local oscillator are interfered by a 50:50 coupler, then the two output signals are detected by two photodiodes, finally the output of the two photodiodes, the differential current, is output. A phase shifter is necessary to switch the detection basis between x and p for ensuring the system security. (b) The heterodyne detector, where the quantum and local oscillator are divided, respectively, and detected by two homodyne detectors. A phase shift of π / 2 between the two local oscillators is introduced to realize the detection of x and p quadratures of the quantum signals. LO: local oscillator, PD: photodiode, Diff: differentiator, and HOM: homodyne detector.

Close modal
We define the modes of quantum signal and LO as a ̂ S and a ̂ L. Therefore, the output modes of after the coupler are
a ̂ 1 = 1 2 ( a ̂ S + a ̂ L ) , a ̂ 2 = 1 2 ( a ̂ S a ̂ L ) .
(45)
Then, the photon number of the two output modes can be achieved,
n ̂ 1 = a ̂ 1 a ̂ 1 = 1 2 ( a ̂ S + a ̂ L ) ( a ̂ S + a ̂ L ) , n ̂ 2 = a ̂ 2 a ̂ 2 = 1 2 ( a ̂ S a ̂ L ) ( a ̂ S a ̂ L ) .
(46)
The differential current can be written as
δ I = I 1 I 2 ( n ̂ 1 n ̂ 2 ) = ( a ̂ S a ̂ L + a ̂ L a ̂ S ) .
(47)
The strong LO can be seen as a classical light, written as
a ̂ L = | a L | e i θ .
(48)
Therefore, one can get
δ I | a L | ( a ̂ S e i θ + a ̂ S e i θ ) .
(49)
We get the measurement result of x quadrature when θ = 0, where
δ I ( θ = 0 ) | a L | ( a ̂ S + a ̂ S ) x ̂ ,
(50)
and p quadrature when θ = π / 2
δ I ( θ = π / 2 ) i | a L | ( a ̂ S a ̂ S ) p ̂ .
(51)

A homodyne detector can only measure one quadrature at a time but the security analysis requires detection of both quadratures. Therefore, a phase modulator is deployed on the path of the LO, for switching the phase difference between the LO and quantum signal between 0 and π / 2 randomly. This can realize the function of switching the detection basis, satisfying the requirement of getting the statistic data of both quadratures. Further, by combining two homodyne detector together, a heterodyne detector which enables the detection of both quadratures of the quantum signal is realized, as shown in Fig. 13(b). It can simultaneously detect the x and p quadrature of a quantum signal since a phase shift of π / 2 is introduced to one path of the LO. To avoid the low frequency noise, the heterodyne detection can also be realized by moving the quantum signal to the intermediate band in frequency domain.143,189,283–285,287 Both quadratures can be simultaneously distilled with downconversion in analog domain or digitally, while a full architecture is still required to avoid the image band issue. Here, we remark that the heterodyne detector in CV-QKD represents the dual-homodyne structure, which has different meanings of that in coherent optical communications.

The homodyne detector can be divided into two types, with direct output and the integral output.331,335,336 The integral-output homodyne detector is widely used in the early CV-QKD system since the signal and LO are both pulsed light. Therefore, it requires the integration of each laser pulse and output a field quadrature signal. At this stage, the homodyne detector is heading toward the high bandwidth, balance, and common mode rejection ratio (CMRR).325,330,337–339 Later, since the CV-QKD system adopts the continuous-wave light, the direct-output homodyne detector is enough, which has less requirement on the balance, and it is easier to realize a high-speed homodyne detection.

The bandwidth, detection efficiency, electronic noise and quantum to classical noise ratio (QCNR) are the key parameters of homodyne detectors. The bandwidth of the receiver directly affects the settings of the system in frequency domain, including the multiplexing and processing of the quantum and phase reference signals. The detection efficiency is another crucial parameter of the practical homodyne detector, corresponding to the detector parameter η in Eq. (28). It is limited by the photodiodes, and the balance of the two arms of the homodyne detectors. The electronic noise of the practical homodyne detector is vital in the CV-QKD systems, which corresponds to νele in Eq. (28). Since the power of the quantum signal is extremely small, a high electronic noise can significantly reduce the SNR, therefore resulting in a low-quality detection. The last parameter that are normally used to describe the homodyne detector is the QCNR. The QCNR demonstrate how good the weak quantum signals can be amplified while suppressing the electronic noise. The general requirement for the QCNR is that it should be at least 10 dB. We also list some reported homodyne detectors with their parameters in Table VII, common-mode rejection ratio is introduced to reflect the balance of the detector.

TABLE VII.

A comparison between BHDs. Here, BW means the 3 dB bandwidth, QCNR means quantum to classical noise ratio, and CMRR means the common mode rejection ratio.

Year BW QCNR (dB) CMRR (dB)
Bulk  2011  104 MHz  13  46 (Ref. 323
2011  100 MHz  13  52.4 (Ref. 324
2013  300 MHz  14  54 (Ref. 326
2015  5 MHz  37  75.2 (Ref. 330
2018  40 MHz  14.5  // (Ref. 331
2018  1.2 GHz  18.5  57.9 (Ref. 328
On chip  2019  1–10 MHz  // (Ref. 138
2021  750 MHz  26.82  40 (Ref. 332
2021  2.6 GHz  21.1  50 (Ref. 333
2021  1.5 GHz  28  80 (Ref. 272
2021  1.7 GHz  14  52 (Ref. 334
2023  //  19.42  86.9 (Ref. 335
Year BW QCNR (dB) CMRR (dB)
Bulk  2011  104 MHz  13  46 (Ref. 323
2011  100 MHz  13  52.4 (Ref. 324
2013  300 MHz  14  54 (Ref. 326
2015  5 MHz  37  75.2 (Ref. 330
2018  40 MHz  14.5  // (Ref. 331
2018  1.2 GHz  18.5  57.9 (Ref. 328
On chip  2019  1–10 MHz  // (Ref. 138
2021  750 MHz  26.82  40 (Ref. 332
2021  2.6 GHz  21.1  50 (Ref. 333
2021  1.5 GHz  28  80 (Ref. 272
2021  1.7 GHz  14  52 (Ref. 334
2023  //  19.42  86.9 (Ref. 335

The homodyne detector can be integrated on chip driven by the photonics integrated circuit techniques, as shown in Fig. 14. The highly balanced photonics circuit, photodiode with high detection efficiency, and the low noise transimpedance amplifier are the core issues. The 3 dB bandwidth of the chip-based homodyne detector can break 1.5 GHz, the clearance between the shot noise and the electronic noise can reach 28 dB, and the common-mode rejection ratio can reach 80 dB.272 These meaningful parameters show that the homodyne detectors on chip have achieved high-speed, low electronic noise and excellent balance.

FIG. 14.

(a) The chip-based homodyne detector for beyond 20 GHz shot-noise-limited measurements. (b) The chip-based homodyne detector for 9 GHz measurement of squeezed light. (a) Reproduced with permission from Bruynsteen et al., Optica 8, 1146–1152 (2021). Copyright 2021 Optica Publishing Group.272 (b) Reproduced with permission from Tasker et al., Nat. Photonics 15, 11–15 (2021). Copyright 2021 Springer Nature.334 

FIG. 14.

(a) The chip-based homodyne detector for beyond 20 GHz shot-noise-limited measurements. (b) The chip-based homodyne detector for 9 GHz measurement of squeezed light. (a) Reproduced with permission from Bruynsteen et al., Optica 8, 1146–1152 (2021). Copyright 2021 Optica Publishing Group.272 (b) Reproduced with permission from Tasker et al., Nat. Photonics 15, 11–15 (2021). Copyright 2021 Springer Nature.334 

Close modal

As we mentioned before, the electrical modulation data are transformed to the phase space based on the source monitoring. Correspondingly, the electrical detection data also requires the transformation, which is realized by SNU calibration.

SNU is defined as the variance of the shot noise. In security analysis, the variance of the quantum fluctuation on phase space is defined as unity, while in a practical system, this fluctuation can be measured and recorded as electrical signals, simply by measuring the vacuum. With enough electrical detection data of vacuum state, the variance of the shot noise measurement result can be estimated in a practical system and used for the normalization of the detection data of coherent states. In this way, the electrical detection output can be transformed to the data for security analysis. Therefore, accurate SNU calibration is crucial for the security of the CV-QKD system.336 

However, SNU calibration of a practical system needs to consider the additive electronic noise, which is introduced inevitably by a practical measurement, shown in Fig. 15. Usually, the variance of electronic noise, Vele, can be calibrated independently. Therefore, SNU can be achieved in a practical CV-QKD system with twice measurements. As shown in Fig. 16(a), the electronic noise in the CV-QKD systems can be directly calibrated as follows: first, turn-on the electric power of the homodyne detector, and cutoff the two optical input ports, the measured variance is the raw electronic noise. Then, total noise can be calibrated with LO on, shown in Fig. 16(b). The difference of the two variables is the SNU, denoted as u.

FIG. 15.

The power density of measurement. The electronic noise and the superposition of electronic and shot noise (vacuum noise) can be achieved in practical measurements. Vd: the variance of total noise, Vele: the variance of the electronic noise. SNU: shot noise unit, which is the variance of the shot noise.

FIG. 15.

The power density of measurement. The electronic noise and the superposition of electronic and shot noise (vacuum noise) can be achieved in practical measurements. Vd: the variance of total noise, Vele: the variance of the electronic noise. SNU: shot noise unit, which is the variance of the shot noise.

Close modal
FIG. 16.

The calibration of electronic noise and total noise with a practical balanced homodyne detector (BHD). (a) The calibration of electronic noise, where the signal and LO path are cutoff. (b) The calibration of the total noise with LO inputted.

FIG. 16.

The calibration of electronic noise and total noise with a practical balanced homodyne detector (BHD). (a) The calibration of electronic noise, where the signal and LO path are cutoff. (b) The calibration of the total noise with LO inputted.

Close modal
Specifically, considering the limited detection efficiency ηd, the detection results of the quantum signal before normalization can be written as
X out = A X L O ( η d x ̂ s + 1 η d x ̂ v ) + X ele .
(52)
Here, x ̂ s x ̂ v, and Xele are the quadrature information of quantum signal, vacuum state (shot noise), and electronic noise. XLO represents the effect of LO, and A is the amplification coefficient of circuits. Therefore, the SNU calibrated with the method we mentioned before is ( A X L O ) 2. In this way, after normalization, we can get
x out = X out u = ( η d x ̂ s + 1 η d x ̂ v ) + X ele A X L O .
(53)
Based on this normalized output, we can establish the trusted detector module detailed in Sec. II. The variance of the electronic noise after normalization with SNU, νele, is the variance of X ele / ( A X L O ). The scheme of the trusted detector is shown in Fig. 17(a).
FIG. 17.

The traditional trusted detector module (a) and the trusted detector module of one-time SNU calibration (b).

FIG. 17.

The traditional trusted detector module (a) and the trusted detector module of one-time SNU calibration (b).

Close modal

In fact, this SNU calibration method has been widely applied in the early experimental demonstrations134,340 through different implementation schemes. However, the LO power and electronic noise are not constant in the practical CV-QKD operations, it tends to drift with the time or temperature changes. Thus, the SNU calibration should be performed in real-time. For example, in Ref. 340, the SNU calibration is performed before the CV-QKD operation, which is called a pre-calibration scheme. The SNU would be calibrated through the above method, the raw data which is obtained in the later running of the CV-QKD can be normalized by using the calibrated SNU. This implementation scheme is surely fine in the proof-of-principle demonstrations, but in reality, the fading of SNU may cause severe security issues. Therefore, monitor scheme that can trace the SNU change should be applied.

The implementation scheme based on the combination of the pre-calibration scheme as well as the LO monitor scheme is adopted.133,134 In this scheme, the pre-calibration still runs before the CV-QKD operation. Also, before the system running, Bob will measure a series of SNU according to different powers of the LO transmitted from Alice. These data would later form a linear relation between the optical power and the SNU. During the CV-QKD system operating, a small portion of the LO is separated and constantly measured. Then, based on the obtained optical power, Bob adjusts the SNU according to the linear relation that has been formed previously. The raw data obtained from the CV-QKD operation can be then normalized by the modified SNU.

Although the conventional SNU calibration method has been applied in many experimental demonstrations, there are still several issues that are unsolved. First, the SNU calibration process is rather complicated, two steps are required at the optical paths. Additionally, with the deeper studies on the practical security of CV-QKD, it makes us realize that the existing SNU calibration method can have security loopholes.

Recently, the SNU calibration method has been improved to meet the needs of the practical implementations of CV-QKD systems, and to reduce the complexity of SNU calibration. An improved security analysis with one-time SNU calibration method has been proposed by redefining SNU as
u = V d = u + V ele .
(54)
In this way, SNU can be achieved by just measuring the total noise, which significantly simplifies the procedure.297,341,344–345 Therefore, we get
u = ( A X L O ) 2 + V ele .
(55)
Here, Vele is the variance of the electronic noise before normalization. Further, we can get the output after the normalization with SNU as x out = X out / u . If we use another vacuum state to represent the electronic noise as X ele = V ele x ̂ v , then we can get
x out = A X L O ( A X L O ) 2 + V ele ( η d x ̂ s + 1 η d x ̂ v ) + V ele ( A X L O ) 2 + V ele x ̂ v = η e ( η d x ̂ s + 1 η d x ̂ v ) + 1 η e x ̂ v ,
(56)
where
η e = ( A X L O ) 2 ( A X L O ) 2 + V ele = 1 1 + ν ele .
(57)
This means the imperfect detector scheme in security analysis can be built with two beam splitters, one represents the detection efficiency, the other one represents the electronic noise, as shown in Fig. 17(b). The beam splitters represent the electronic noise and the detection efficiency can be exchanged in order. Note that, since electronic noise is not estimated in one-time SNU calibration, the output mode of the beam splitter representing the electronic noise cannot be seen as trusted. This means the loss introduced by electronic noise is untrusted, which is the reason that the performance of the protocol with one-time SNU calibration is slightly lower than that using the traditional calibration method.341 

With this novel SNU calibration method, it is possible to achieve a real-time SNU calibration, since we only need to monitor the power of the split LO, without the demand of constantly measuring the electronic noise to finish the calibration procedure. Several experimental demonstrations137,341 have successfully adopted this SNU calibration methods. A conclusion of the SNU calibration methods in CV-QKD systems is shown in Table VIII.

TABLE VIII.

The SNU calibration schemes in CV-QKD systems.

Calibration Strategy Procedures
Traditional two-time340   Pre-calibration  (1) Calibration of electronic noise 
(2) Calibration of total noise 
(assuming a stable SNU) 
Traditional two-time133,134  Real-time  (1) Calibration of electronic noise 
(2) Calibration of total noise with different LO power (monitoring the real-time LO power) 
One-time137,341  Real-time  (1) Calibration of total noise with different LO power before system operation (monitoring the real-time LO power) 
Calibration Strategy Procedures
Traditional two-time340   Pre-calibration  (1) Calibration of electronic noise 
(2) Calibration of total noise 
(assuming a stable SNU) 
Traditional two-time133,134  Real-time  (1) Calibration of electronic noise 
(2) Calibration of total noise with different LO power (monitoring the real-time LO power) 
One-time137,341  Real-time  (1) Calibration of total noise with different LO power before system operation (monitoring the real-time LO power) 

For the early systems, DSP is mainly used for the compensation in optical layer, such as providing the feedback information for phase and polarization control. Later in the high-speed local LO systems, the DSP is gradually becoming widely used, which is applied to the transmitter and receiver, including the clock synchronization, the static equalization, the dynamic equalization and the frame synchronization. The ultimate purpose of DSP in a CV-QKD system is to maximize the data correlation between the transmitter and receiver, which is consistent with the traditional optical communication algorithm to improve SNR. Therefore, CV-QKD system can widely use the algorithms in classical optical communications, and finally form the current routine, as shown in Fig. 18.

FIG. 18.

The DSP routine of a CV-QKD system, which includes upsampling, pulse shaping, and multiplexing in transmitter side, as well as de-multiplexing, clock synchronization (sync), static equalization, down sampling, dynamic equalization, and frame sync in receiver side. RRC means Root-Raised-Cosine, freq. means frequency, and Pol. means polarization.

FIG. 18.

The DSP routine of a CV-QKD system, which includes upsampling, pulse shaping, and multiplexing in transmitter side, as well as de-multiplexing, clock synchronization (sync), static equalization, down sampling, dynamic equalization, and frame sync in receiver side. RRC means Root-Raised-Cosine, freq. means frequency, and Pol. means polarization.

Close modal

At the transmitter site, for raising the accuracy of the modulation, upsampling is performed before the Root-Raised-Cosine (RRC) pulse shaping.346 Then, the pulse shaping of the quantum signal is processed to reduce the correlation between each quantum signal and satisfying the definition of a quantum pulse in a CV-QKD protocol. Practically, the signal pulse should be bounded in frequency domain so that the modulation and detection with limited bandwidth will not affect the shape of the signal in time domain. Yet/However, this will result in the infinite expansion in time domain. The mostly used solution is the RRC filter, where the integration of each two quantum signal pulse is 0 in time domain while the frequency band is limited, which both satisfies the requirements of the temporal mode of a CV-QKD protocol and the practical implementation. After that, the quantum signal is digitally shifted in frequency domain at the transmitter site, and the pilot tone for phase reference is added. Also, for frame synchronization, a Constant Amplitude Zero Auto-Correlation (CAZAC) sequence is added at the beginning of each frame. The widely used CAZAC sequence is the Zadoff–Chu sequence.

FIG. 19.

The state-of-the-art digital signal processing routines of different local LO CV-QKD systems. (a) The routine of a discrete modulated system with polarization and frequency division multiplexing of quantum and pilot signals.143 (b) The routine of a discrete modulated dual-polarization system where the polarization compensation is finished digitally.145 (c) The routine of a Gaussian modulated system with frequency division multiplexing of quantum and pilot signals. Machine learning (ML) is used for high-quality phase compensation with a wide range of pilot signal-to-noise ratios.342,343 (a) Reproduced with permission from Wang et al., Commun. Phys. 5, 162 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license. (b) Reproduced with permission from Roumestan et al., “Experimental demonstration of discrete modulation formats for continuous variable quantum key distribution,” arXiv:2207.11702 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license. (c) Reproduced with permission from Chin et al., npj Quantum Inf. 7, 20 (2021). Copyright 2021 Author(s), licensed under a Creative Commons Attribution (CC BY) license.

FIG. 19.

The state-of-the-art digital signal processing routines of different local LO CV-QKD systems. (a) The routine of a discrete modulated system with polarization and frequency division multiplexing of quantum and pilot signals.143 (b) The routine of a discrete modulated dual-polarization system where the polarization compensation is finished digitally.145 (c) The routine of a Gaussian modulated system with frequency division multiplexing of quantum and pilot signals. Machine learning (ML) is used for high-quality phase compensation with a wide range of pilot signal-to-noise ratios.342,343 (a) Reproduced with permission from Wang et al., Commun. Phys. 5, 162 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license. (b) Reproduced with permission from Roumestan et al., “Experimental demonstration of discrete modulation formats for continuous variable quantum key distribution,” arXiv:2207.11702 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license. (c) Reproduced with permission from Chin et al., npj Quantum Inf. 7, 20 (2021). Copyright 2021 Author(s), licensed under a Creative Commons Attribution (CC BY) license.

Close modal

For the receiver, the frequency-division multiplexed quantum and pilot signal are first separated from the output of the detection data, then the quantum signals are down-converted to the baseband corresponding to the frequency shift at the transmitter. Second, clock synchronization is processed, which is a digital alternative to the hardware solution mentioned before. Subsequently, the static equalization algorithms are performed to compensate the impairments, including the IQ imbalance compensation and S21 compensation, and to recover the signal pulse with matched RRC filter. Down-sampling at the best sampling point is then performed to achieve the information with the best SNR. Then, the dynamic equalization is processed to compensate the phase and polarization mismatch, normally using Multiple-Input Multiple-Output (MIMO) algorithms.304–306,347–350 Finally, frame synchronization is performed to align the beginning of the modulation and detection data. The final output of the DSP is treated as the raw data, which is then sent to the postprocessing process.

The order of the DSP steps can be exchanged for the linearity of the algorithms. The state-of-the-art DSP routines are shown in Fig. 19. The coefficients in DSP is normally adjusted dynamically with the system situation for better performance, especially in long-distance or high-noise scene. For this purpose, machine learning (ML) is recently introduced to achieve consistently excellent phase estimation under a wide range of pilot SNR.342,343 The compatibility with classical coherent optical algorithms significantly promotes the development of CV-QKD, which provides a large number of tools and experience when developing toward high speed and long distance.

The quantum stage is followed by classical data processing steps (normally called postprocessing) as is illustrated in Fig. 20, which includes four steps: base sifting, information reconciliation, parameter estimation, and privacy amplification.351–353 For this purpose, Alice and Bob use an authenticated channel on which Eve cannot modify the communicated messages but can learn their content. Also, after the steps in postprocessing process, Alice and Bob will perform verification to ensure that the step is successful processed.354 

FIG. 20.

The postprocessing steps in CV-QKD systems, where reverse reconciliation is adopted. Before postprocessing, Alice and Bob establish correlation by means of modulation, transmission and detection of quantum states. They then process sifting, parameter estimation, information reconciliation and privacy amplification to obtain the final secret key bits.

FIG. 20.

The postprocessing steps in CV-QKD systems, where reverse reconciliation is adopted. Before postprocessing, Alice and Bob establish correlation by means of modulation, transmission and detection of quantum states. They then process sifting, parameter estimation, information reconciliation and privacy amplification to obtain the final secret key bits.

Close modal

1. Sifting

Base sifting is required for systems with homodyne detection or squeezed states, where only one quadrature can used for each measurement. Bob announces the detection basis after a round, and Alice save the corresponding quadrature data. Further developments of CV-QKD systems such as the heterodyne detection scheme can save the data of both quadratures, resulting in a system without sifting. The procedure is significantly simplified since the switching and sifting of detection basis is removed.

2. Parameter estimation

The parameter estimation requires Alice and Bob to estimate the security parameters of the system for getting the secret key rate, based on the modulation and detection data. Take the Gaussian modulated CV-QKD system as an example, the key point is to obtain the covariance matrix we detailed in Eq. (21). This requires first converting the electrical data to the information on phase space in a PM scheme (detailed in transmitter monitoring and SNU calibration), and then the conversion between a PM scheme and EB scheme. Specifically, we denote the modulation data as ( D x B 0 , D p B 0 ) and the normalized detection data as ( D x B , D p B ). For EB scheme, the sender performs heterodyne detection on one mode of the EPR state. If the detection results is ( x A x , p A p ), the other mode B0 is projected onto a Gaussian state with
( x B 0 , p B 0 ) = 2 V 1 V + 1 ( x A x , p A p ) .
(58)
This means ( x B 0 , p B 0 ) and ( x A x , p A p ) has a linear transformation relationship. Note that, here the x and p quadrature corresponds to the modes after a 50:50 beam splitter, where
A x = 1 2 A + 1 2 N , A p = 1 2 A 1 2 N .
(59)
Here, A is one mode of the EPR state, N is the mode of vacuum state. A x and A p are the two modes after the beam splitter. ( x A x , p A p ) are the x and p quadrature of A x and A p, respectively. Therefore, the calibrated data ( D x B 0 , D p B 0 ) can be converted to ( D x A x , D p A p ). With ( D x A x , D p A p ) and ( D x B , D p B ), the covariance and variance of x A x , p A p , x B, and p B can be estimated. Since mode Ax and Ap are symmetric, the covariance and variance of xA, pA, x B, and p B can be further estimated, which results in the covariance matrix γAB.
Further, for a physical existed convariance matrix, the variance of mode B can be expressed as below
V B = T V M + ξ + 1 = T ( V M + ε ) + 1 ,
(60)
where T and ε are the two parameters related to the system security, estimated from the modulation and detection data.

Based on the security analysis with analytical solution we detailed in Sec. II, the secret key rate can be calculated. For a fiber channel, the loss and noise corresponds to the physical meanings of T and ε, which can be used for simulating the system performance.

The estimation above is based on the modulation and detection data with infinite size. However, in the practical CV-QKD systems, the length of the data should be limited. The finite-size data length leads to a fluctuation of the estimated parameter. The secret key rate under the finite-size analysis is
K = n N [ β I A B χ B E ϵ P E Δ ( n ) ] .
(61)
Here, n/N represents the proportion of the preserved data, since part of the data, m = N n, is publicized for parameter estimation. χ B E ϵ P E is the Holevo bound considering the effect of finite size, and the probability that the expression is wrong is ϵPE, meaning that the true parameters lie within a certain confidence interval around the estimated channel parameters.
The estimation of χ B E ϵ P E is based on the parameters, tmin and σ max 2, which lead to the worst-case secret key rate. Here, tmin means the minimum square root of the channel transmittance, and σ max 2 means the maximum of the variance of noise. Specifically,
t min T z ϵ P E / 2 1 + T ε m V M , σ max 2 1 + T ε + z ϵ P E / 2 ( 1 + T ε ) 2 m .
(62)
Here, z ϵ P E / 2 should satisfy
1 erf ( z ϵ P E / 2 / 2 ) / 2 = ϵ P E / 2 ,
(63)
where erf is the error function.
Δ ( n ) is related to the security of privacy amplification, which can be calculated as
Δ ( n ) = ( 2 d i m H X + 3 ) l o g 2 ( 2 / ϵ ¯ ) n + 2 n l o g 2 ( 1 / ϵ P A ) .
(64)
Here, HX corresponds to the Hilbert space of the raw key, ϵ ¯ is a smoothing parameter, and ϵPA is the failure probability.356 

3. Information reconciliation

Information reconciliation is an essential part of CV-QKD postprocessing, which makes sure that the transmitter and receiver share a same bit string. It consists of two parts, mapping the quadrature results to several bits, and error correction. The reconciliation in practical systems requires the public transmission of part of the information, therefore causes the loss of the secret information, leading to the efficiency lower than 100%, which can be written as β
β = H ( X ) leak I A B .
(65)
Here, H(X) is the Shannon information of the target bit string, leak represents the information leakage during the public transmission (usually the syndrome), and IAB is the mutual information between Alice and Bob. The efficiency of information reconciliation plays a crucial role in the final system's secret key rate and the maximal transmission distance, which are seriously affected by the reconciliation strategy. We remark that, the purpose of the reconciliation in a practical system is to optimize the whole system, rather than simply chasing the highest efficiency. It is necessary to balance all resources of the system under a given hardware condition to maximize the transmission distance or secret key rate. The comprehensive optimization method proposed by Ma et al. which considers the simultaneous optimization of the modulation variance and error correction matrix achieves a significant improvement of the system performance by at least 24% compared with the previously used optimization methods.357 

The early reconciliation strategy corrects the detection data to make it consistent with the modulation data, so-called the direct reconciliation.106 However, the system cannot go beyond 3 dB loss since the potentially leaked information is larger than the information can be utilized be the receiver, which corresponds to the 15 km fiber transmission distance. Aiming at this problem, reverse reconciliation is proposed, where the modulation data are corrected to match the detection data. This enables the system to break the 3 dB limit, making reverse reconciliation the most common information reconciliation strategy in CV-QKD system. The main parameters of the information reconciliation in a CV-QKD system includes the reconciliation efficiency, the frame error rate, the throughput and the SNR range. Different approaches have been explored to increase the reconciliation efficiency for a Gaussian modulation, especially in the regime of a low SNR, detailed in Table IX.

TABLE IX.

The reconciliation methods and performance in CV-QKD systems.

References Year Method SNR (dB) Reconciliation efficiency Frame error rate (FER)
Van Assche et al.351   2004  Slice, turbo  ⋯  ⋯  ⋯ 
Lodewyck et al.132   2007  Slice, LDPC  ⋯  88.7%  ⋯ 
Jouguet et al.358   2011  MD, LDPC  0.4, −7.93, −11.25, −15.38, −18.39, −21.4  93.6%, 93.1%, 95.8%, 96.9%, 96.6%, 95.9%  ⋯ 
Jouguet et al.359   2014  Slice, LDPC  0, 4.77, 7.09, 11.63, 18.2  94.2%, 94.1%, 94.40%, 95.80%, 94.8%  ⋯ 
Bai et al.360   2017  Slice, LDPC  0, 4.77  95.02%, 95.26%  ⋯ 
Wang et al.361   2018  MD, LDPC  −15.24  96.46%  ⋯ 
Milicevic et al.362   2018  MD, LDPC  −15.47, −7.93  99.0%, 93.0%  0.883, 0.04 
Zhao et al.363   2018  MD, polar  −0.46, −0.97, −1.55  81%, 88.4%, 97.9%  0.013, 0.019, 0.04 
Zhou et al.364   2019  MD, raptor  0, −4, −8, −12, −16, −20  95.0%, 95.0%, ∼96.0%, ∼96.0%, ∼97.0%, 98.0%  ⋯ 
Li et al.365   2020  MD, LDPC  −7.93, −11.19, −15.23  92.9%, 94.6%, 93.8%  0.17, 0.25, 0.32 
Yang et al.366   2020  Slice, LDPC  0, 4.77  93.0%, 93.06%  0.14, 0.09 
Zhang et al.139   2020  MD, raptor  −26.38  98%  0.9 
MD, LDPC  −15.11, −7.43, −3.35  96.0%, 96.0%, 96.0%  0.1, 0.1, 0.1 
Slice, polar  0.3, 4.48  95%, 95%  0.5, 0.5 
Mani et al.367   2021  MD, LDPC  −8.16, −11.34, −15.46, −18.45  97.5%, 97.8%, 98.8%, 97.7%  ⋯ 
Jeong et al.368   2022  MD, LDPC  −15.25, −14.25, −14.2  ⋯  ⋯ 
References Year Method SNR (dB) Reconciliation efficiency Frame error rate (FER)
Van Assche et al.351   2004  Slice, turbo  ⋯  ⋯  ⋯ 
Lodewyck et al.132   2007  Slice, LDPC  ⋯  88.7%  ⋯ 
Jouguet et al.358   2011  MD, LDPC  0.4, −7.93, −11.25, −15.38, −18.39, −21.4  93.6%, 93.1%, 95.8%, 96.9%, 96.6%, 95.9%  ⋯ 
Jouguet et al.359   2014  Slice, LDPC  0, 4.77, 7.09, 11.63, 18.2  94.2%, 94.1%, 94.40%, 95.80%, 94.8%  ⋯ 
Bai et al.360   2017  Slice, LDPC  0, 4.77  95.02%, 95.26%  ⋯ 
Wang et al.361   2018  MD, LDPC  −15.24  96.46%  ⋯ 
Milicevic et al.362   2018  MD, LDPC  −15.47, −7.93  99.0%, 93.0%  0.883, 0.04 
Zhao et al.363   2018  MD, polar  −0.46, −0.97, −1.55  81%, 88.4%, 97.9%  0.013, 0.019, 0.04 
Zhou et al.364   2019  MD, raptor  0, −4, −8, −12, −16, −20  95.0%, 95.0%, ∼96.0%, ∼96.0%, ∼97.0%, 98.0%  ⋯ 
Li et al.365   2020  MD, LDPC  −7.93, −11.19, −15.23  92.9%, 94.6%, 93.8%  0.17, 0.25, 0.32 
Yang et al.366   2020  Slice, LDPC  0, 4.77  93.0%, 93.06%  0.14, 0.09 
Zhang et al.139   2020  MD, raptor  −26.38  98%  0.9 
MD, LDPC  −15.11, −7.43, −3.35  96.0%, 96.0%, 96.0%  0.1, 0.1, 0.1 
Slice, polar  0.3, 4.48  95%, 95%  0.5, 0.5 
Mani et al.367   2021  MD, LDPC  −8.16, −11.34, −15.46, −18.45  97.5%, 97.8%, 98.8%, 97.7%  ⋯ 
Jeong et al.368   2022  MD, LDPC  −15.25, −14.25, −14.2  ⋯  ⋯ 

Usually, the detection data are converted to discrete format first, then the error correction code for discrete data are used. A first approach is the slice reconciliation using multilevel coding and multistage decoding, as shown in Fig. 21. It is suitable for the detection signal with large SNR, normally more than 0 dB. In principle, this method can extract more than 1 bit of information per pulse. When slice reconciliation is used, the SNR of each layer of data are different, so different error correction codes need to be used for subsequent error correction steps, such as the low density parity check (LDPC) code or the Polar code.

FIG. 21.

The slice reconciliation in CV-QKD, where the information is sliced. Reproduced with permission from Wen et al., Entropy 23, 1317 (2021). Copyright 2021 Author(s), licensed under a Creative Commons Attribution (CC BY) license.355 

FIG. 21.

The slice reconciliation in CV-QKD, where the information is sliced. Reproduced with permission from Wen et al., Entropy 23, 1317 (2021). Copyright 2021 Author(s), licensed under a Creative Commons Attribution (CC BY) license.355 

Close modal

The other method called multidimensional (MD) reconciliation was proposed to be employed for low SNRs, i.e., below 0 dB,131,369 which reduces the Gaussian variables reconciliation problem to the discrete variable channel coding problem, shown in Fig. 22. It is suitable for the SNR lower than 0, even to −26 dB, which is the crucial technique for a long-distance CV-QKD system. The multidimensional reconciliation can be combined with the LDPC code or the other codes such as the Raptor codes.366 The final reconciliation efficiency one obtains with such a scheme depends on two things: The intrinsic efficiency of the error correcting code used on the virtual channel on the Binary Input Additive White-Gaussian-Noise Channel (BIAWGNC). The quality of the approximation between the virtual channel and the BIAWGNC. One can therefore improve the reconciliation efficiency based on these two points.

FIG. 22.

The multidimensional reconciliation in CV-QKD, where the information us mapped to the sphere, which can be well separated and the symmetry is preserved. Reproduced with permission from Leverrier et al., Phys. Rev. A 77, 042325 (2008). Copyright 2008 American Physical Society.131 

FIG. 22.

The multidimensional reconciliation in CV-QKD, where the information us mapped to the sphere, which can be well separated and the symmetry is preserved. Reproduced with permission from Leverrier et al., Phys. Rev. A 77, 042325 (2008). Copyright 2008 American Physical Society.131 

Close modal

In a long distance system where the SNR is low, LDPC code is usually used.370–376 The graphical representation of a typical multi-edge-type (MET) LDPC code is shown in Fig. 23. The state-of-the-art decoding throughput can reach 1.44 and 0.78 Gbps for the code rates 0.2 and 0.1, which can support the real-time secret key generation with the speed of 71.89 and 9.97 Mbps in 25 and 50 km.376,377 Toward the practical application, the rate adaptive error correction is proposed to support the system with fading SNR.378–381 In addition, to raise the utilization rate of the raw data, exchanging the order of parameter estimation and reconciliation is proposed. One can process the parameter estimation after the error correction. In this way, the abandoned data for parameter estimation can be reduced.

FIG. 23.

The graphical representation of typical MET-LDPC. (a) Reproduced with permission from Mani et al., Phys. Rev. A 103, 062419 (2021). Copyright 2021 American Physical Society.367 (b) Reproduced with permission from Jeong et al., npj Quantum Inf. 8, 6 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license.368 

FIG. 23.

The graphical representation of typical MET-LDPC. (a) Reproduced with permission from Mani et al., Phys. Rev. A 103, 062419 (2021). Copyright 2021 American Physical Society.367 (b) Reproduced with permission from Jeong et al., npj Quantum Inf. 8, 6 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license.368 

Close modal

4. Privacy amplification

The output of the error correction is a same bit string between Alice and Bob, which can be denoted as Kn with n bits. Privacy amplification is finally processed to realize the distillation of secret key, of which the requirements are consistent between CV-QKD and DV-QKD. The initial proposed method is aiming at the case of asymptotic limit,382 after that, the leftover hashing is used which extends the it to the finite-size case.383 We denote this operation as G, which is a universal hash function mapping the bit string with length N to L. If the mutual information between eavesdropper and Kn is known, a proper privacy amplification can make the eavesdropper's knowledge on the final secret key, K l = G ( K n ), close to 0. For practical implementation, the speed of privacy amplification is crucial.384,385

The most common method is using Toeplitz matrix, which can be written as
γ Toepliz = ( t 0 t n t 1 t 0 t n + 1 t 2 n 2 t n t 2 t 1 t n 1 t n t n + 1 t 1 t 2 t 0 t 1 t n t 0 ) .
(66)
The elements on the main diagonal of the Toeplitz matrix are equal, and the elements on the lines parallel to the main diagonal are also equal. In this way, a Toeplitz matrix can be easily constructed. With the calculated secret key rate after parameter estimation, the length of the secret key bits can be distilled is known. Assuming the length of K′ is L′ and the length of K is L, G can be a L × L′ Toeplitz matrix.

The main purpose of the early CV-QKD systems is to demonstrate the feasibility of the Gaussian modulation and shot-noise limited homodyne detection.130 After that, the enhancement of system performance begins. The efficient error correction successfully supports the long distance systems, from 80 and up to 202 km. Meanwhile, different system strctures are proposed and implemented to suppress the excess noise, where the most representative one is the local LO scheme. The overview of the CV-QKD system development is shown in Fig. 24.

FIG. 24.

The overview of the CV-QKD system development. Since the first demonstration in 2003, the in-line LO system has been subsequently developed. After the early stage development, the in-line LO scheme has effectively supported the long-distance system, by reducing the crosstalk from LO to quantum signals. In 2015, the local LO scheme was proposed, which then heads toward high speed system with advance DSP technique.

FIG. 24.

The overview of the CV-QKD system development. Since the first demonstration in 2003, the in-line LO system has been subsequently developed. After the early stage development, the in-line LO scheme has effectively supported the long-distance system, by reducing the crosstalk from LO to quantum signals. In 2015, the local LO scheme was proposed, which then heads toward high speed system with advance DSP technique.

Close modal

The CV-QKD system is heading toward high secret key rate at long distance. For the early CV-QKD systems, the quantum signal and LO are generated by the same laser in the transmitter and co-propagate through the quantum channel. However, the longer transmission distance raises the requirement of the power of LO, which leads to more excess noise caused by the LO leakage. Meanwhile, the transmission of LO in an unsecure quantum channel makes it easy for the manipulation of LO by an eavesdropper, leading to a security loophole. To solve the issues above, the local LO system with the LO generated at the receiver side is proposed. Here, the LO no longer needs to be transmitted through the quantum channel, therefore it never affects the quality of quantum signals and the practical security of the system. However, the system is seriously affected by the phase mismatch between the LO and quantum signal since they are not generated from the same laser source, thus a classical pilot tone generated by the transmitter is necessary in most of the local LO systems for phase recovery.

Though the local LO system still requires the co-propagation of quantum and classical signals, the leakage of the pilot tone will not seriously affect the excess noise, since the requirement of the power of the pilot tone is much lower than the LO. Therefore, the multiplexing of the quantum signal and pilot tone is more flexible. Various multiplexing schemes are proposed to adapt to different hardware configurations and system requirements, such as using the frequency division multiplexing, or further combined with polarization multiplexing in high isolation scenarios. Naturally, raising the repetition frequency contributes to the accuracy of phase tracking and phase noise suppression as we mentioned before. To compensate the influence from the limited hardware resources, DSP is introduced. A highly digitized system can compensate both of the polarization and phase change in digital domain, which significantly simplifies the system structure and leads to a more practical system. In this section, we review the development of the in-line LO and local LO systems, as well as the system co-existed with classical network and the other system schemes such as the free space system and the entanglement-based systems.

The main feature of the in-line LO CV-QKD system is that the quantum signal and LO are generated by the same laser, therefore the interference at the receiver is not seriously affected by the signal mismatch. However, the large power difference between the quantum signal and LO makes the leakage of LO significantly affect the quantum signal, which is the main noise source of the system. For instance, the average photon number of a quantum signal is no more than 20, but the average photon number of LO is usually higher than 107 at the receiver site to provide sufficient power for a high-quality shot-noise limited homodyne detection. The leakage of LO leads to the increase in excess noise. Moreover, longer transmission distance requires higher LO launch power. Therefore, higher isolation between quantum signal and LO is required by the long-distance in-line LO system.

The key to reduce the LO leakage is using multiplexing including time-division multiplexing, the polarization multiplexing and the frequency-division multiplexing. The quantum signal and LO are encoded on different dimensions for co-transmission in fiber (that is why we call the in-line LO), and de-multiplexed in physical layer at the receiver.130,132–139,293,294,386–388 Now, we review the development of in-line LO CV-QKD systems, including the early systems, the long-distance achievements, the chip-based systems, and the field tests. The details of the representative in-line LO system experiments are concluded in Table X.

TABLE X.

A Comparison Between Different in-line LO CV-QKD Systems. β is the reconciliation efficiency, Lmax is the maximum transmission distance or loss, and SKR is the secret key rate corresponds to Lmax. MD means multidimensional reconciliation.

Years Key modules Key indicators
Multiplexing Reconciliation β (%) Lmax SKR
Lab system  2003  Transmitting separately  Slice  85  3.1 dB  75 kbps (Ref. 130
2007  Time  Slice  89.8  25 km  2 kbps (Ref. 132
2007  Polarization and frequency  Slice  89.8  5 km  0.3 bit/pulse (Ref. 293
2013  Time and polarization  MD  95  80 km  0.2 kbps (Ref. 133
2016  Time and polarization  MD  95.6  100 km  0.5 kbps (Ref. 136
2020  Time and polarization  MD  98  202.81 km  6.214 bps (Ref. 139
Field test system  2012  Time and polarization  Slice  ∼90  17.7 km  0.3 kbps (Ref. 134
2016  Time and polarization  MD  ∼95  17.52 km  0.2 kbps (Ref. 135
2019  Time and polarization  MD  95.1  49.85 km  5.77 kbps (Ref. 137
Chip-based system  2019  Time and polarization  MD  97.99  2 m  0.25 Mbps (Ref. 138
Years Key modules Key indicators
Multiplexing Reconciliation β (%) Lmax SKR
Lab system  2003  Transmitting separately  Slice  85  3.1 dB  75 kbps (Ref. 130
2007  Time  Slice  89.8  25 km  2 kbps (Ref. 132
2007  Polarization and frequency  Slice  89.8  5 km  0.3 bit/pulse (Ref. 293
2013  Time and polarization  MD  95  80 km  0.2 kbps (Ref. 133
2016  Time and polarization  MD  95.6  100 km  0.5 kbps (Ref. 136
2020  Time and polarization  MD  98  202.81 km  6.214 bps (Ref. 139
Field test system  2012  Time and polarization  Slice  ∼90  17.7 km  0.3 kbps (Ref. 134
2016  Time and polarization  MD  ∼95  17.52 km  0.2 kbps (Ref. 135
2019  Time and polarization  MD  95.1  49.85 km  5.77 kbps (Ref. 137
Chip-based system  2019  Time and polarization  MD  97.99  2 m  0.25 Mbps (Ref. 138

1. Early systems

The first CV-QKD system implementation is realized in 2003, as shown in Fig. 25(a), where the secret key rate can reach 1.7 Mbps in a loss free channel and 75 kbps in a channel with 3.1 dB loss.130 The system is based on the free space optical devices, working at the wavelength of 780 nm. Reverse reconciliation is first implemented to support a secret key distillation beyond 3 dB limit. The quantum signal and LO are generated from the same laser, where the light outputs from Alice's laser is first divided, part of the light is Gaussian modulated as the quantum signal of coherent states, and the other part of the light is used to provide the LO signal. The Gaussian modulation is realized based on the amplitude and phase modulation method with pulsed light. To compensate the phase difference between quantum signal and LO since they go through different path, training sequence is introduced. These features are reserved and improved in the later fiber based CV-QKD systems.

FIG. 25.

The early in-line LO CV-QKD systems. (a) The first CV-QKD system. (b) The first all-fiber CV-QKD system with time division multiplexing, from (c) The first all-fiber CV-QKD system with polarization and frequency-division multiplexing. (a) Reproduced with permission from Grosshans et al., Nature 421, 238–241 (2003). Copyright 2003 Nature Publishing Group.130 (b) Reproduced with permission from Lodewyck et al., Phys. Rev. A 76, 042305 (2007). Copyright 2007 American Physical Society.132 (c) Reproduced with permission from Qi et al., Phys. Rev. A 76, 052323 (2007). Copyright 2007 American Physical Society.293 

FIG. 25.

The early in-line LO CV-QKD systems. (a) The first CV-QKD system. (b) The first all-fiber CV-QKD system with time division multiplexing, from (c) The first all-fiber CV-QKD system with polarization and frequency-division multiplexing. (a) Reproduced with permission from Grosshans et al., Nature 421, 238–241 (2003). Copyright 2003 Nature Publishing Group.130 (b) Reproduced with permission from Lodewyck et al., Phys. Rev. A 76, 042305 (2007). Copyright 2007 American Physical Society.132 (c) Reproduced with permission from Qi et al., Phys. Rev. A 76, 052323 (2007). Copyright 2007 American Physical Society.293 

Close modal

The first all-fiber CV-QKD system is realized in 2007, where 2 kbps secret key rate is achieved with a 25 km (5.2 dB) optical fiber channel.132 The most important enhancement is that the quantum signal and the LO are co-transmitted in the same fiber to reduce the accumulation of phase noise caused by the seperate transmission. As shown in Fig. 25(b), the multiplexing strategy is the time division multiplexing using an unbalanced Mach Zender interferometer (MZI) structure. Specifically, the light from the pulsed laser is divided by a 1:99 beam splitter, where the 1% weak light path is used to generate the modulated coherent states with amplitude and phase modulators, and the strong light is used as the LO. With a variable optical attenuator, the modulated coherent states are attenuated to the quantum level, which is then time-division multiplexed with the LO by combining with a 99:1 coupler, and then transmitted to the receiver side. The optical delay line deployed in the LO path is used to adjust the gap between quantum signal and LO. This time division multiplexing strategy is reserved in the long distance system to enhance the isolation between quantum signal and LO. The de-multiplexing is realized with an unbalanced beam splitter (10:90) to reduce the loss of quantum signal, where the quantum signal with high power is interfered with the low power LO after the beam splitter. A delay line is deployed at the quantum signal path to align the signal pulses. In addition, the automatic system control is introduced into the system, where the average power of the quantum signal is monitored and real-time adjusted to adapt the SNR requirement of error correction. The training sequence is used for synchronizing Alice and Bob, and determining the relative phase between the signal and the LO. An automatic adjustment of the bias voltages that need to be applied to the amplitude modulators in Alice's site is performed in every 10 s. The repetition rate of the system is 350 kHz, the detection efficiency of the detector is 0.606. The modulation variance of the system is 18.5, and the excess noise is 0.005.

Qi et al. realized a CV-QKD system over 5 km fibers using polarization and frequency division multiplexing to co-transmit the quantum signals and LO.293 The final secret key rate at 5 km is 0.3 bit/pulse. As shown in Fig. 25(c), the quantum signals and LO in different polarizations are combined with a polarization coupler, and de-multiplexed at the receiver by another polarization beam splitter. The frequency division multiplexing is realized with an acousto-optic modulator. By applying both polarization and frequency division multiplexing, the isolation between quantum signal and LO comes up to 70 dB, well preventing the LO leakage. An isolator is placed in the signal arm of Bob's MZI to reduce the noise due to multiple reflections of LO. The phase compensation on hardware layer is replaced by a digital compensation at Alice's site. The noise from the receiver is assumed to be independent from Eve's control, which contributes to the performance enhancement.

2. Long distance achievements

In 2013, the first long-distance CV-QKD system shown in Fig. 26(a) is realized by Jouguet et al., which achieves the secret key rate of over 100 bps at 80 km.133 Such an improvement is supported by the optimized reconciliation strategy and system architecture. The multi-dimensional reconciliation first introduced into the practical experiment significantly enhances the reconciliation efficiency of a CV-QKD system, from no more than 90% to 95%. This promotes the developments of long-distance CV-QKD system and supports all of the long-distance CV-QKD system until now. The main features of this experimental system include the polarization and time division multiplexing, the trusted detection noise, the polarization control using a dynamic polarization controller and the clock synchronization with part of the LO. The multiplexing scheme used in this system is widely used for achieving high isolation between quantum signal and LO in most of the long-distance systems.

FIG. 26.

The in-line LO CV-QKD systems with long distance. (a) 80 km CV-QKD system. (b) 100 km CV-QKD system. (c) 202.81 km CV-QKD system. (a) Reproduced with permission from Jouguet et al., Nat. Photonics 7, 378–381 (2013). Copyright 2013 Springer Nature.133 (b) Reproduced with permission from Huang et al., Sci. Rep. 6, 19201 (2016). Copyright 2016 Author(s), licensed under a Creative Commons Attribution (CC BY) license.136 (c) Reproduced with permission from Zhang et al.,139 Phys. Rev. Lett. 125, 010502 (2020). Copyright 2020 American Physical Society.

FIG. 26.

The in-line LO CV-QKD systems with long distance. (a) 80 km CV-QKD system. (b) 100 km CV-QKD system. (c) 202.81 km CV-QKD system. (a) Reproduced with permission from Jouguet et al., Nat. Photonics 7, 378–381 (2013). Copyright 2013 Springer Nature.133 (b) Reproduced with permission from Huang et al., Sci. Rep. 6, 19201 (2016). Copyright 2016 Author(s), licensed under a Creative Commons Attribution (CC BY) license.136 (c) Reproduced with permission from Zhang et al.,139 Phys. Rev. Lett. 125, 010502 (2020). Copyright 2020 American Physical Society.

Close modal

As shown in Fig. 26(b), Huang et al. later realized a CV-QKD system with transmission distance over 100 km and more than 300 bps secret key rate by controlling the excess noise to low level.136 An efficient scheme is proposed to perform high-precision phase compensation under low SNR conditions which contributes to the excess noise of 0.015. For system hardware, they developed a low-noise detector, which reduces the requirement of the high LO power.

As shown in Fig. 26(c), the CV-QKD system with the longest transmission distance is realized by Zhang et al. at 2020, where the transmission distance can reach 202.81 km, which doubles the previous transmission distance record.139 In this work, two amplitude modulators are used for generating pulsed light, then an amplitude and a phase modulator are used for Gaussian modulation, and an amplitude modulator is used to attenuate the modulated light signal to quantum level, as well as enhancing the SNR of frame sequence. Time-division multiplexing and polarization multiplexing are used to ensure sufficient isolation between the co-transmit of quantum signals and LO. Moreover, LO is amplified at the receiver site therefore the requirement of the launch power of LO at the transmitter site is reduced, which is beneficial for reducing the crosstalk. Automatic feedback systems are used to overcome the channel perturbations, and high-precision phase compensation is adopted to supress the excess noise and highly efficient postprocessing is realized to achieve long transmission distances at sufficiently high secret key rates. In addition to the transmission distance of 202.81 km, the system was also tested with the link distance of 27.27, 49.30, 69.53, 99.31, and 140.52 km, where the secret key rate reached 278, 62, 4.28, 1.18, and 0.318 kbps.

The key modules of an in-line LO CV-QKD system are the multiplexing module and the reconciliation module. It can be seen that the development of the reconciliation directly supports the long-distance transmission, where the long transmission distance always combines with high reconciliation efficiency. The multiplexing scheme finally evolves into the time and polarization multiplexing, since this is the simplest method to achieve sufficient isolation between quantum signal and LO.

In addition to the reconciliation and multiplexing, the modulation, monitoring, sampling and compensation techniques are also well developed. The generation of light pulses with high extinction ratio is demonstrated in 2015,282 where the extinction ratio overpasses 80 dB by using a double cascaded MZI modulation. Later, the imperfect quantum state preparation is theoretically and experimentally investigated in 2017, which demonstrates that the incorrect calibration of the working parameters for the amplitude modulator and phase modulator can lead to a significant increase in the excess noise and misestimate of the channel loss. Schemes for calibrating the working parameters of the modulators are proposed and demonstrated to solve the imperfect state preparation issue. An LO monitoring scheme is proposed to enhance the practical security of a CV-QKD system.301 The LO is monitored by the balanced photodiode, and the SNU is real-time calibrated. The excess noise in the system and its impact on the performance is also investigated.388 Finite sampling bandwidth of the analog-to-digital (AD) converter may lead to inaccurate results of pulse peak sampling, which is solved by a dynamic delay adjusting module and a statistical power feedback-control algorithm.389 

As for polarization compensation, a feedback algorithm is proposed to stable the system, where a polarization feedback signal is produced by an amplified Root Mean Square to Direct Current conversion by picking out a 10% portion of the LO light in real time.390 With the output data, one can estimate the mean value and the standard deviation of the polarization drift. Then, a dynamic polarization controller is deployed at the receiver's site to stable the polarization automatically. For phase noise compensation, a widely used scheme is to insert one frame of training sequence into the quantum signal path, to calculate the expectations and evaluate the phase difference.390 Long term stable phase locking is employed to seperately compensate the fast-fading and the slow-fading phase mismatch by adjusting the phase modulator and fiber length.391 Later, a novel phase compensation scheme based on an optimal iteration algorithm is proposed to realize the fast-fading phase compensation accurately.304 

3. Field tests

In addition to the system in laboratory, field tests of the in-line CV-QKD system are also widely performed. The first field test CV-QKD system is realized by Fossier in 2009,340 the system structure is shown in Fig. 27(a). It was automatically operated over 57 h, and achieved a secret key rate of 8 kbps over a 3 dB loss optical fiber. The system is part of the Secure Communication based on Quantum Cryptography (SECOQC) network,94 where its practical fiber length is 9 km. Later, the system was used for the encryption of point-to-point communications, which demonstrated the reliability of a CV-QKD system over a long period of time in a server room environment.134 The map of the CV-QKD link is shown in Fig. 27(b). The stability of this field test system is studied in detail, and the results show that, the birefringence, and consequently the polarization, in the installed fiber typically varied ten times slower than a laboratory fiber spool of equivalent length, while the phase drift linked to temperature changes in the devices is typically of 2 π every 30 s and these vibrations have a typical frequency of 50–1000 Hz.

FIG. 27.

The field tests of in-line LO CV-QKD systems. (a) The first field test of CV-QKD system. (b) The field test of using CV-QKD for classical symmetric encryption. (c) Field demonstration of a CV-QKD network. (d) The longest field test of CV-QKD with 50 km commercial fiber. (a) Reproduced with permission from Fossier et al., New J. Phys. 11, 045023 (2009). Copyright 2009 IOP Publishing Ltd.340 (b) Reproduced with permission from Jouguet et al., Opt. Express 20, 14030–14041 (2012). Copyright 2012 Google.134 (c) Reproduced with permission from Huang et al., Opt. Lett. 41, 3511–3514 (2016). Copyright 2016 Google.135 (d) Reproduced with permission from Zhang et al., Quantum Sci. Technol. 4, 035006 (2019). Copyright 2019 IOP Publishing Ltd.137 

FIG. 27.

The field tests of in-line LO CV-QKD systems. (a) The first field test of CV-QKD system. (b) The field test of using CV-QKD for classical symmetric encryption. (c) Field demonstration of a CV-QKD network. (d) The longest field test of CV-QKD with 50 km commercial fiber. (a) Reproduced with permission from Fossier et al., New J. Phys. 11, 045023 (2009). Copyright 2009 IOP Publishing Ltd.340 (b) Reproduced with permission from Jouguet et al., Opt. Express 20, 14030–14041 (2012). Copyright 2012 Google.134 (c) Reproduced with permission from Huang et al., Opt. Lett. 41, 3511–3514 (2016). Copyright 2016 Google.135 (d) Reproduced with permission from Zhang et al., Quantum Sci. Technol. 4, 035006 (2019). Copyright 2019 IOP Publishing Ltd.137 

Close modal

A full-mesh 4-node CV-QKD field test is realized in 2016 by Huang et al.,135 where 6 point-to-point CV-QKD links with distances of 19.92, 35.35, 37.44, 15.34, 17.52, and 2.08 km connect 4 nodes together, as shown in Fig. 27(c). This work adopts wavelength division multiplexing to co-transmit the quantum signal and the essential classical signals for clock synchronization and the forward and backward classical data communication. The reflection caused by the connectors of the field fiber links is well studied, and the results show that the connectors feature a nominal reflectance of −40 dB, and more than 20 reflective events are measured in the experiments.

The longest field test of CV-QKD system is realized in 2019, by Zhang,137 through 49.85 km commercial fiber, as shown in Fig. 27(d). By applying an efficient calibration model with one-time evaluation, a rate-adaptive reconciliation method which maintains high reconciliation efficiency with high success probability in fluctuated environments, and a fully automatic control system which stabilizes system noise, a secret key rate which is two orders-of-magnitude higher than the previous field test demonstrations is achieved.

Later, the first network application demonstration with clear application scenarios over a long period of time through existing commercial optical fiber links is tested in Qingdao, China, as shown in Figs. 28(a) and 28(b).140 The performance of the 3-node network is tested for a month, where the total length of the application demonstration link is 71.03 km, with a trusted relay in the middle. As shown in Fig. 28(c), the average secret key rate achieves higher than 12.00 kbps over 71.03 km optical fiber line, which paves the way to deploy CV-QKD in metropolitan settings.

FIG. 28.

The long-term field test in Qingdao, China. (a) The layer structure of the 3-node network. (b) A Bird's-eye view of the field test environment. (c) 28-day continuous test results. Reproduced with permission from Zhang et al., Bull. Am. Phys. Soc. 65 (2020). Copyright 2020 APS.140 

FIG. 28.

The long-term field test in Qingdao, China. (a) The layer structure of the 3-node network. (b) A Bird's-eye view of the field test environment. (c) 28-day continuous test results. Reproduced with permission from Zhang et al., Bull. Am. Phys. Soc. 65 (2020). Copyright 2020 APS.140 

Close modal

4. Systems on chip

Photonic integrated circuit is a promising way to realize a large scale and cost effective system. After the design is finalized, the production cost of the chip will sharply decrease with the increase in production. Therefore, in addition to miniaturizing the system, chipization can also greatly promote the low-cost mass production for the cost sensitive CV-QKD system. The earliest attempt to chip-based CV-QKD systems is in 2015, where a silicon photonic chip comprising all major CV-QKD components as well as complete subsystems are designed and fabricated.392 

Later the first chip-based CV-QKD platform is demonstrated in 2019,138 where most of the active devices such as the phase modulator, amplitude modulator, optical variable attenuator and homodyne detector are integrated on Silicon-On-Insulator chip, as shown in Fig. 29. The phase and amplitude modulator have a 90% switching time of 2.5 ns, corresponding to a 200 MHz modulation frequency. However, the homodyne detector limits the bandwidth of the system to 10 MHz, mainly affected by the two-stage transimpedance amplifier. The shot noise is 5 dB higher than the electronic noise, and the detection efficiency is 0.498. With these on-chip devices, an in-line LO system is demonstrated. A grating coupler introduces the light from an external laser source into the chip, then an 1:99 directional coupler splits it into two path, where the weak one is used for quantum signal modulation, while the stronger one is the LO. After that, the Gaussian modulated quantum signal and LO are multiplexed into two orthogonal polarization states with a 2D grating coupler, and output to the channel. The receiver uses a 2D grating coupler to separate the quantum signal and LO, then the quantum signal is homodyne detected. The system is tested with a 2 m fiber for proof-of-principle demonstration, the secret key rate can reach 0.25 Mbps.

FIG. 29.

The first chip-based CV-QKD system. Reproduced with permission from Zhang et al., Nat. Photonics 13, 839–842 (2019). Copyright 2019 Springer Nature.138 

FIG. 29.

The first chip-based CV-QKD system. Reproduced with permission from Zhang et al., Nat. Photonics 13, 839–842 (2019). Copyright 2019 Springer Nature.138 

Close modal

This work demonstrates that the Silicon-On-Insulator platform can basically satisfy the requirement of a CV-QKD system. A two-dimensional grating coupler integrated on chip can be directly used for the polarization multiplexing and de-multiplexing. The pulse generation, the Gaussian modulation, the variable optical attenuator and the detector are all realized with chip-based components. The insertion loss of the grating coupler, the detection efficiency and the bandwidth of the chip-based detector are the concerns, where a part of these issues are solved in the later works, and we detailed them in the local LO system part. A comparison of the secret key rate of different systems is shown in Fig. 30.

FIG. 30.

The overview of the key achievements of the secret key rate in the in-line CV-QKD systems. The longest transmission distance is 202.81 km in laboratory, and 50 km with field test. The back-to-back test of the on-chip system is demonstrated, and the estimated parameters can support the 100 km system.

FIG. 30.

The overview of the key achievements of the secret key rate in the in-line CV-QKD systems. The longest transmission distance is 202.81 km in laboratory, and 50 km with field test. The back-to-back test of the on-chip system is demonstrated, and the estimated parameters can support the 100 km system.

Close modal

5. Other in-line LO systems

In addition to Gaussian modulation, discrete modulation and unidimensional modulation is also realized with in-line LO system, as shown in Fig. 31. The discrete modulation format has lower requirement for digital to analog conversion, and the unidimensional modulation can be realized with a single amplitude modulator, which are suitable for cost-effective applications. Polarization multiplexing is also used in these systems. The four-state modulation CV-QKD system from Wang et al. can reach 1 kbps secret key rate with the transmission distance of 30.2 km,393 the four-state modulation CV-QKD system from Hirano et al. can reach 50 kbps secret key rate with the transmission distance of 10 km,394 and the unidimensional modulated system achieves 5.4 and 0.7 kbps secret key rate at 30 and 50 km.395 

FIG. 31.

The in-line LO CV-QKD systems with particular modulation format. (a) The 4-state modulated in-line LO CV-QKD system.394 (b) The unidimensional modulated in-line LO CV-QKD system.395 (a) Reproduced with permission from Hirano et al., Quantum Sci. Technol. 2, 024010 (2017). Copyright 2017 Author(s), licensed under a Creative Commons Attribution (CC BY) license. (b) Reproduced with permission from Wang et al., Phys. Rev. A 95, 062330 (2017). Copyright 2017 American Physical Society.

FIG. 31.

The in-line LO CV-QKD systems with particular modulation format. (a) The 4-state modulated in-line LO CV-QKD system.394 (b) The unidimensional modulated in-line LO CV-QKD system.395 (a) Reproduced with permission from Hirano et al., Quantum Sci. Technol. 2, 024010 (2017). Copyright 2017 Author(s), licensed under a Creative Commons Attribution (CC BY) license. (b) Reproduced with permission from Wang et al., Phys. Rev. A 95, 062330 (2017). Copyright 2017 American Physical Society.

Close modal

Though the in-line LO system has developed for a long time, some problems are still inevitable. The most critical issue is the security loophole caused by the LO accessible to a potential eavesdropper.405–408 The manipulation of LO can make the sender and receiver perform parameter estimation mistakenly, leading to an overestimate of secret key rate. Monitoring the LO can defend part of the attacks, but the loophole still exists and more attacking strategies aiming at it can be continuously developed. In addition, from the system development, when we hope to achieve high key rate by raising the repetition frequency or achieve long distance overcoming the large channel loss, the crosstalk from LO to quantum signal will increase, which weakens the system performance. Therefore, after more than a decade of development, the local LO CV-QKD system without the transmission of LO is proposed.

The local LO system is first proposed in 2015, intends to solve the problems above by generating LO inside the receiver, which is a once and for all solution. Since the quantum signal and the LO are generated by different lasers, a fast-fading phase noise is introduced, leading to the increase in excess noise. The key of a local LO system is to establish a reliable phase reference between the sender and receiver, usually realized by a classical reference signal, namely, pilot tone. When heading toward high-speed system with high repetition rate, the pulsed system with time division multiplexing is no more effective. Considering that the power of pilot tone is low enough so that its leakage is not as much as the in-line transmitted LO, the frequency division multiplexed quantum and pilot tone signals with continuous-wave light becomes the mainstream scheme of the local LO system. In addition, the DSP is introduced to the local LO system for more accurate phase recovery, high speed modulation with continuous-wave light and simpler detection. A review of the evolution of local LO CV-QKD system is shown in Table XI, including the typical systems with different settings, and there are also some noteworthy local LO systems.409–411 

TABLE XI.

A Comparison Between Different Local LO CV-QKD Systems. Here, f means the repetition frequency, Lmax means the maximum transmission distance and SKR is the secret key rate corresponding to Lmax.

Years Key modules Key indicators
Modulation format Modulator Multiplexing f Lmax SKR
Lab systems  2017  8-PSK  DP-MZM  Frequency  40 Mbaud  40 km  0.006 bit/symbol (Ref. 284
2020  Gaussian  AM + PM  Frequency and polarization  100 MHz  25 km  7.04 Mbps (Ref. 285
2022  QPSK  IQ modulator  Frequency and polarization  5 Gbaud  10 km  133.6 Mbps (Ref. 143
2022  256 QAM  IQ modulator  Frequency  600 Mbaud  25 km  24 Mbps (Ref. 145
2022  256 QAM  IQ modulator  Frequency and polarization  1 Gbaud  50 km  9.212 Mbps (Ref. 286
2022  Gaussian  Sagnac fiber loop  Time  10 MHz  50 km  0.08 Mbps (Ref. 396
2023  Gaussian  IQ modulator  Frequency  100 MHz  20 km  0.0471 bit/symbol (Ref. 287
2023  16 state  IQ modulator  Frequency  2.5 Gbaud  80 km  2.11 Mbps (Ref. 397
2023  Gaussian  IQ modulator  Frequency and polarization  1 GHz  100 km  0.51 Mbps (Ref. 398
2024  Gaussian  IQ modulator  Frequency  100 Mbaud  100 km  0.0254 Mbps (Ref. 399
Field tests  2019  //  //  //  //  3.9 km  0.07 Mbps (Ref. 144
2023  Gaussian  //  //  12.5 Mbaud  22.5 dB  0.01 kbps (Ref. 400
2023  Gaussian  Sagnac fiber loop  Time  50 kHz  10.4 km  1.6 kbps (Ref. 401
Chip-based systems  2023  Gaussian  IQ modulator  Frequency  100 MHz  6.9 km  0.28 Mbps (Ref. 402
2023  Gaussian  IQ modulator  Time  8 MHz  11 km  0.4 Mbps (Ref. 403
2023  Gaussian  IQ modulator  Time  0.25 Gbaud  50 km  0.75 Mbps (Ref. 404
Years Key modules Key indicators
Modulation format Modulator Multiplexing f Lmax SKR
Lab systems  2017  8-PSK  DP-MZM  Frequency  40 Mbaud  40 km  0.006 bit/symbol (Ref. 284
2020  Gaussian  AM + PM  Frequency and polarization  100 MHz  25 km  7.04 Mbps (Ref. 285
2022  QPSK  IQ modulator  Frequency and polarization  5 Gbaud  10 km  133.6 Mbps (Ref. 143
2022  256 QAM  IQ modulator  Frequency  600 Mbaud  25 km  24 Mbps (Ref. 145
2022  256 QAM  IQ modulator  Frequency and polarization  1 Gbaud  50 km  9.212 Mbps (Ref. 286
2022  Gaussian  Sagnac fiber loop  Time  10 MHz  50 km  0.08 Mbps (Ref. 396
2023  Gaussian  IQ modulator  Frequency  100 MHz  20 km  0.0471 bit/symbol (Ref. 287
2023  16 state  IQ modulator  Frequency  2.5 Gbaud  80 km  2.11 Mbps (Ref. 397
2023  Gaussian  IQ modulator  Frequency and polarization  1 GHz  100 km  0.51 Mbps (Ref. 398
2024  Gaussian  IQ modulator  Frequency  100 Mbaud  100 km  0.0254 Mbps (Ref. 399
Field tests  2019  //  //  //  //  3.9 km  0.07 Mbps (Ref. 144
2023  Gaussian  //  //  12.5 Mbaud  22.5 dB  0.01 kbps (Ref. 400
2023  Gaussian  Sagnac fiber loop  Time  50 kHz  10.4 km  1.6 kbps (Ref. 401
Chip-based systems  2023  Gaussian  IQ modulator  Frequency  100 MHz  6.9 km  0.28 Mbps (Ref. 402
2023  Gaussian  IQ modulator  Time  8 MHz  11 km  0.4 Mbps (Ref. 403
2023  Gaussian  IQ modulator  Time  0.25 Gbaud  50 km  0.75 Mbps (Ref. 404

1. Early systems

The early experiments adopt a pulsed laser source with LiNbO3 amplitude and phase modulators for generating quantum and pilot tone signals.141,142 In the work finished by Qi et al.,141 the quantum signals and pilot tones are time-division multiplexed and then detected by receivers using heterodyne detection. The sender's and receiver's LO laser sources are free running without any connections, and the heterodyne detection results of the pilot tone provide the phase reference for data rotation. In Soh's work,142 the signal and LO are generated from one laser for proof-of-principle demonstration. Homodyne detection is used for detecting the quantum signal and pilot tone. Each pilot tone is sent twice in a pair for the receiver to get both quadratures with homodyne detection.

In the above works, continuous-wave LO signals are adopted, while in Huang's work,280 an amplitude modulator is deployed inside the receiver side for generating pulsed LO. The quantum and pilot tone signals are also generated by the same modulation module with time division multiplexing. The commonalities of these early systems are using pulsed light, and time-division multiplexed quantum and pilot tone signals are generated by the same modulation module. The key role of these early systems is verifying the possibility of compensating the phase mismatch between the quantum and LO signal with high precision required in a CV-QKD system using a pilot tone.

2. Systems with continuous-wave light

As we mentioned above, the most crucial issue of a local LO CV-QKD system is the phase recovery with pilot tone. To improve the accuracy of the phase recovery, raising the repetition frequency of the quantum and pilot tone signals for a more accurate track of the phase shift is a direct and effective way. However, the pulsed system with time division multiplexing significantly limits the system repetition frequency. Therefore, it is a general trend to use continuous-wave light instead of pulsed light to support a high speed system.283,284 Without time division multiplexing, the repetition rate of the system is significantly enhanced, resulting in a high-rate system with 1 GHz repetition rate.143,285,286

In addition, for the multiplexing of quantum signal and pilot tone, since the high power pilot tone is not necessary required, the quantum signal and pilot tone can be modulated simultaneously with the same modulation module in a frequency division multiplexed scheme.283,284 Naturally, by introducing a frequency difference between the quantum signal and LO, a digital heterodyne detection can be realized, where we can use the detection results from one homodyne detector to recover both information of quadratures.143,283–286,398 In this way, the experimental demonstration of the system is significantly simplified.

Brunner et al. demonstrated a local LO CV-QKD system as shown in Fig. 32(a).283 The 4-state discrete modulation of coherent states is realized with quadrature phase-shift keying modulation used in classical communications, and a variable optical attenuator is used to adjust the power to the quantum level. No amplitude modulator for pulse generation is used, instead, a RRC filter in the digital domain completes the pulse shaping. Moreover, combined with an analog electronic low-pass filter at the output of the digital-to-analog (DA) convertor, the quantum signal is concentrated in the 10 MHz bandwidth. Digitally, the quantum signal is up-converted and combined with a pilot tone. To reduce the quantization noise since the weak quantum signal is produced and detected together with a much stronger pilot tone, the DA and AD convertor bit width are 16 and 14 bits, respectively. The heterodyne detection is also performed digitally, the LO is set to have a frequency difference with the quantum signal, and a downconversion in digital domain is then performed to recover the information on both quadratures.

FIG. 32.

The continuous-wave local LO CV-QKD system. (a) The software defined CV-QKD transmitter and receiver. (b) The local LO CV-QKD system with DSP where the quantum signal and two pilot tones are frequency division multiplexed. (a) Reproduced with permission from Brunner et al., “A low-complexity heterodyne CV-QKD architecture,” in 19th International Conference on Transparent Optical Networks (ICTON) (IEEE, 2017). Copyright 2017 IEEE.283 (b) Reproduced with permission from Kleis et al., Opt. Lett. 42, 1588–1591 (2017). Copyright 2017 Optical Society of America.284 

FIG. 32.

The continuous-wave local LO CV-QKD system. (a) The software defined CV-QKD transmitter and receiver. (b) The local LO CV-QKD system with DSP where the quantum signal and two pilot tones are frequency division multiplexed. (a) Reproduced with permission from Brunner et al., “A low-complexity heterodyne CV-QKD architecture,” in 19th International Conference on Transparent Optical Networks (ICTON) (IEEE, 2017). Copyright 2017 IEEE.283 (b) Reproduced with permission from Kleis et al., Opt. Lett. 42, 1588–1591 (2017). Copyright 2017 Optical Society of America.284 

Close modal

As shown in Fig. 32(b), Kleis et al. realized a complete system with the simultaneous modulation of 8 phase-shift keying discrete modulated quantum signal and two pilot tones using a dual-parallel Mach–Zehnder modulator (MZM).284 Digital heterodyne detection is used to get both quadratures with a single homodyne detector. This work achieved the secret key rate of 6 × 10 3 bit/symbol at 40 km, which shows the way of low-complexity QKD system demonstration within metropolitan distances. The core ideas of the above works is to realize CV-QKD system with continuous-wave light and a structure similar to the classical coherent communications, DSP is widely used in the system, which opens the new way of CV-QKD systems.

Subsequently, the discrete local LO CV-QKD system is extended to high-order modulation formats for better performance. As theoretically analyzed, the increasing of modulation order results in higher secret key rate with most of the security framework of discrete-modulation CV-QKD. Moreover, when the constellation is similar to the Gaussian distribution, the secret key rate of the system can be better than the constellation with uniform distribution. In this guidance, a high-order discrete modulated CV-QKD system is realized with 16-order two-ring phase shift key modulated coherent states.397 Compared with the high-order quadrature amplitude modulation, 16-order two-ring phase shift key modulation can be realized with less DA requirements, contributing to suppressing the modulation noise. The achieved secret key rates are 49.02, 11.86, and 2.11 Mbps over 25, 50, and 80 km optical fiber. 67.4%, 70.0%, and 66.5% of the performance of a Gaussian modulated protocol can be achieved with this simpler scheme.

3. Systems with polarization multiplexing

In addition to modulating the quantum signals together with pilot tone, the quantum signals can also be modulated individually and combined with the pilot tone in different polarization directions.285,295,398,412,413

As shown in Fig. 33(a), the optical carrier is first amplitude modulated to generate 250 MHz signal pulses, then sent into the dual-polarization IQ modulator for the modulation of the discrete coherent states and the pilot tone. The quantum signal and pilot tone are multiplexed in different frequency and polarization directions. The receiver performs heterodyne detection of both polarizations after the compensation of a polarization controller. This scheme can help to reduce the excess noise since the isolation between the quantum signal and pilot tone is more sufficient than the frequency division multiplexed method.

FIG. 33.

Local LO CV-QKD system with polarization multiplexed quantum signal and pilot tone. (a) Reproduced with permission from Laudenbach et al., Quantum 3, 193 (2019). Copyright 2019 Author(s), licensed under a Creative Commons Attribution (CC BY) license.413 (b) Reproduced with permission from Wang et al., Opt. Express 28, 32882 (2020). Copyright 2020 Optical Society of America.285 

FIG. 33.

Local LO CV-QKD system with polarization multiplexed quantum signal and pilot tone. (a) Reproduced with permission from Laudenbach et al., Quantum 3, 193 (2019). Copyright 2019 Author(s), licensed under a Creative Commons Attribution (CC BY) license.413 (b) Reproduced with permission from Wang et al., Opt. Express 28, 32882 (2020). Copyright 2020 Optical Society of America.285 

Close modal

Further, a Gaussian modulated system with frequency division multiplexing and polarization multiplexing is realized by Wang et al.,285 shown in Fig. 33(b). Digital heterodyne detection is used for detecting quantum and pilot tone signals, respectively. It can achieve 7.04 Mbps asymptotic-limit secret key rate at 25 km and 1.85 Mbps with finite-size.

4. Recent progresses

Based on the digital modulation and detection scheme, local LO CV-QKD system is heading toward high secret key rate,143 composable security,287 and long distance.343 

As shown in Fig. 34(a), in Wang's work,143 using frequency division multiplexing and polarization multiplexing to transmit the quantum and pilot signal, as well as two digital heterodyne detector for measuring, a system with 4-state discrete modulated coherent states achieved 233.87, 133.6, and 21.53 Mbps secret key rate at 5, 10, and 25 km. This increases the asymptotic secret key rate to sub-Gbps level, which can satisfy the one-time pad cryptographic task. The further investigation on optimizing the practical system parameters shows an effective way to the high-performance system.357 

FIG. 34.

The high-speed, composable-security and long-distance local LO CV-QKD systems. (a) The high-speed system with 4-state modulation format. (b) The system which generates composable secret keys. (c) The system supporting 100 km transmission distance considering finite-size effect. (a) Reproduced with permission from Wang et al., Commun. Phys. 5, 162 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license.143 (b) Reproduced with permission from Jain et al., Nat. Commun. 13, 4740 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license.287 (c) Reproduced with permission from Pi et al., Opt. Lett. 48, 1766 (2023). Copyright 2023 Optica Publishing Group.398 

FIG. 34.

The high-speed, composable-security and long-distance local LO CV-QKD systems. (a) The high-speed system with 4-state modulation format. (b) The system which generates composable secret keys. (c) The system supporting 100 km transmission distance considering finite-size effect. (a) Reproduced with permission from Wang et al., Commun. Phys. 5, 162 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license.143 (b) Reproduced with permission from Jain et al., Nat. Commun. 13, 4740 (2022). Copyright 2022 Author(s), licensed under a Creative Commons Attribution (CC BY) license.287 (c) Reproduced with permission from Pi et al., Opt. Lett. 48, 1766 (2023). Copyright 2023 Optica Publishing Group.398 

Close modal

Jain's system with composable security realized 0.0471 bits/symbol secret key rate at 20.3 km with extremely simple devices shown in Fig. 34(b), an IQ modulator produces frequency division multiplexed quantum and pilot signals which are detected by a digital heterodyne detector.287 The system is able to generate composable secret keys with 2 × 10 8 coherent states, which is far less than the previous requirements due to improvements to the security proof.

A recent work with the structure shown in Fig. 34(c) can realize a transmission distance over 100 km, and the asymptotic secret key rate can reach 7.55, 1.87, and 0.51 Mbps over transmission distance of 50, 75, and 100 km.398 This work significantly increases the transmission distances of a local LO CV-QKD system, and shows a promising way to realize long-distance and high-speed QKD using telecom devices.

The homodyne and heterodyne detection in CV-QKD system act as a matched filter since the LO naturally introduces a frequency selection on the received signal, therefore the filter in time and frequency domain is unnecessary. Moreover, the devices in a CV-QKD system is compatible with the classical coherent optical communications. Therefore, CV-QKD is suitable for coexisting with classical signals, which is easy for deployments.

The test of the system co-existing with classical channels was first demonstrated in 2010,418 and has been further developed in recent years.278,414,419–422 The further test results show that, over a 25 km fiber, a CV-QKD operated over the 1530.12 nm channel can tolerate the noise arising from up to 11.5 dB m classical channel at 1550.12 nm in the forward direction and 9.7 dB m in backward.278 The system with 75 km transmission distance can work in the channel with −3 dBm forward classical signals or −9 dBm backward classical signals. These results demonstrate the outstanding capacity of CV-QKD to coexist with classical signals of realistic intensity in optical networks. In 2018, the spontaneous Raman scattering noise of a CV-QKD system co-exisiting with classical channels is investigated, which is the most dominant impairment in a wavelength division multiplexed co-existence environment for CV-QKD.414 The setting of the quantum signal and the classical signals in frequency domain is shown in Fig. 35. The influence of the spontaneous Raman scattering noise on a CV-QKD system under different transmission situation is investigated, resulting in a scheme which can support a secret key rate of 90 kbps over 20 km, for an ideal QKD system multiplexed with 2 mW optical power.

FIG. 35.

The CV-QKD systems coexisting with classical signals. (a) The frequency spectrum of the CV-QKD system co-existing with classical communication systems. (b) The performance of the CV-QKD system co-existing with 18.3 Tbps data channels. (a) Reproduced with permission from Karinou et al., IEEE Photonics Technol. Lett. 30, 650–653 (2018). Copyright 2018 IEEE.414 (b) Reproduced with permission from Eriksson et al., Commun. Phys. 2, 9 (2019). Copyright 2019 Author(s), licensed under a Creative Commons Attribution (CC BY) license.279 

FIG. 35.

The CV-QKD systems coexisting with classical signals. (a) The frequency spectrum of the CV-QKD system co-existing with classical communication systems. (b) The performance of the CV-QKD system co-existing with 18.3 Tbps data channels. (a) Reproduced with permission from Karinou et al., IEEE Photonics Technol. Lett. 30, 650–653 (2018). Copyright 2018 IEEE.414 (b) Reproduced with permission from Eriksson et al., Commun. Phys. 2, 9 (2019). Copyright 2019 Author(s), licensed under a Creative Commons Attribution (CC BY) license.279 

Close modal

A CV-QKD system co-propagates with large-scale C-band dense WDM (DWDM) channels is investigated in 2019.423 By operating the quantum signals in S- or L-band, the number of co-propagating channels is doubled. 56 density WDM channels with a total launch power of 14.5 dB m are co-propagated with the quantum signal at the distance of 25 km. Meanwhile, CV-QKD system co-existing with 18.3 Tbps data channels is tested, which contains 100 WDM channels, more than 90 times higher classical bit rate than the previous results,279 shown in Fig. 35(b). In 2020, Chu et al. investigated the LO quality of an in-line LO system in a co-existing environment, which is normally ignored in former studies. It is shown that, four-wave mixing in excess noise analysis is a visible factor causing LO fluctuation characterized by the statistical properties of the power evolution of LO.424 

In this part, we introduce the free space and the entanglement based CV-QKD systems. The free space CV-QKD is crucial for the wide range CV-QKD, which is a promising way to connect two distant parties by using the satellite as the relay. On the other hand, for accessing multiple users in complex environment, free space links can be used to construct an access network with simple system structure. For the value in the long-distance and access network applications, the free space CV-QKD is studied, and some results have been achieved. The entanglement-based CV-QKD systems are suitable to distill secret key bits against the high excess noise, which can be used in the scenario with worse channel situation.

1. Free space systems

Compared to the fiber link, the free space link suffers from the disturbance of atmosphere, leading to the fading channel and the beam wandering. The fluctuation of transmission efficiency and induced extra-excess noise will seriously deteriorate the secure key generation. The atmospheric effects on CV-QKD are studied,153,188,425–427 where beam wandering, broadening, deformation, and scintillation are found to be the primary effects to lead to transmittance fluctuation of horizontal link within the boundary layer, and effect of arrival time fluctuations will induce phase excess noise. Except for the fast fading of the channel parameters such as the channel loss and excess noise, the fading of phase also increases the difficulty of phase recovery. Therefore, new coding strategy and phase compensation methods should be developed.

In 2014, a free space continuous-variable quantum communication is demonstrated with a point-to-point free space link of 1.6 km in urban conditions.428 Later, a satellite to ground experiment on the quantum limited measurement of the quadrature information is demonstrated,413 as shown in Fig. 36(a). A series of technologies are developed to support the measurement of the coherent state generated by the laser communication terminal on the geostationary Earth orbit, including the pointing, acquisition, and tracking system of the Transportable Adaptive Optical Ground Station, the adaptive optics system to process the phase front distortions for launching the beam into a single mode fiber, and an optical phase lock loop to lock the phase between the signal and the LO, where the LO is generated by the laser source inside the ground station. The feasibility of secret key establishment in a satellite-to-ground downlink configuration based on CV-QKD is further examined theoretically, where positive secret key rate can be achieved for low-Earth-orbit scenario. While for higher orbits, no secure keys will be generated when considering the finite-size effects.429 

FIG. 36.

The free space CV-QKD key techniques and systems. (a) The demonstration of the satellite to ground quantum limited experiment.415 (b) Phase compensation for a free space CV-QKD system.416 (c) Passive-state-preparation CV-QKD system with free space channel.417 (a) Reproduced with permission from Günthner et al., Optics. 4, 611–616 (2017). Copyright 2017 Optical Society of America. (b) Reproduced with permission from Wang et al., Opt. Express 28, 10737–10745 (2020). Copyright 2020 Optical Society of America. (c) Reproduced with permission from Zhang et al., Opt. Lett. 48, 1184–1187 (2023). Copyright 2023 Optica Publishing Group.

FIG. 36.

The free space CV-QKD key techniques and systems. (a) The demonstration of the satellite to ground quantum limited experiment.415 (b) Phase compensation for a free space CV-QKD system.416 (c) Passive-state-preparation CV-QKD system with free space channel.417 (a) Reproduced with permission from Günthner et al., Optics. 4, 611–616 (2017). Copyright 2017 Optical Society of America. (b) Reproduced with permission from Wang et al., Opt. Express 28, 10737–10745 (2020). Copyright 2020 Optical Society of America. (c) Reproduced with permission from Zhang et al., Opt. Lett. 48, 1184–1187 (2023). Copyright 2023 Optica Publishing Group.

Close modal

In 2019, the effective resistance against background noise of CV-QKD is theoretically and experimentally demonstrated.430 In 2020, as shown in Fig. 36(b), a phase compensation strategy is developed and experimental demonstrated.416 This work checks the correlation between data held by Alice and Bob in a free space channel, and proves that the fluctuation of transmittance disappears in the correlation, thus enabling phase compensation for signals over fluctuant channels. Later, a series of methods for free space polarization compensation,431 data and transmittance synchronization,432 data acquisition433 are proposed, and the feasibility of secure key distribution with free space CV-QKD through fog is experimentally demonstrated.434 Recently, a passive-state-preparation CV-QKD system shown in Fig. 36(c) with free space channel is experimentally demonstrated.417 Thermal-state polarization multiplexing transmitted LO, synchronized channel transmittance monitoring and fine-grained phase compensation techniques are proposed to support a secret key rate of 1.015 Mbps with a free space channel of −15 dB simulated transmittance.

2. Entanglement-based systems

The entanglement-based systems have also been developed in recent years as an alternative approach of the CV-QKD system implementation.169,421,435–440 The first entanglement-based CV-QKD system is realized in 2009, a pair of bright EPR entangled beams produced from a non-degenerate optical parametric amplifier is used as the source. The secret key rates of 84 and 3 kbps are achieved agianst collective attack with the channel the transmission efficiency of 80% and 40%.435 Later in 2012, a system using modulated fragile entangled states is realized. The system can generate secret key bits against the excess noise of 0.45, which is unable for any coherent state protocols to distill secret key bits.169 In 2018, the performance of the entanglement-based CV-QKD system is further enhanced, which can achieve an asymptotic secret key rate of 0.03 (0.01) bit per sample at a channel excess noise level of 0.01 (0.1).437 

The future CV-QKD system will head toward the high-speed and compact integration, rely on full scale DSP and integration with photonic chip. In addition to that, the point-to-multipoint CV-QKD system will be widely applied to support a high-speed quantum access network for end-user access.

Impairment compensation on digital domain can significantly simplify the system structure, contributing to a simple and stable system. The study on classical coherent communications promotes the DSP algorithms in a CV-QKD system. For instance, at the transmitter side, the pulse shaping algorithm is used to raise the availability of the frequency band. For the receiver, the frequency shift is recognized and the downconversion is completed in digital domain, time recovery algorithm is used to obtain the optimal sampling points, digital filter is used to reduce the spectrum mismatch between the transmitter and receiver site, and various of algorithms are developed to distill the parameters of polarization compensation and phase compensation. Thanks to the wide application of DSP in CV-QKD systems, the speed of the system is becoming higher and higher, the latest achievement reaches the baud rate of 10 Gbaud.146 

With more DSP algorithms being introduced to the CV-QKD system, the security of the DSP is getting more concerns. The security of the linear DSP algorithms in CV-QKD application is proved in 2023, based on the continuous-mode quantum optics theory.441 

For the transmitter, the modulation based on the continuous-wave light and the pulse shaping can be seen as a sequence of coherent states with different temporal modes, which raises the requirement that the pulse shaping function in different period should be integrated orthogonality. The commonly used RRC pulse shaping function can satisfy this defination.

For the receiver, the pilot tone is individually processed for distilling the parameter for impairment compensation of quantum signals. Various algorithms can be used to raise the accuracy of distilling compensation parameters, since the process of pilot tone does not affect the quantum signal, only how to use the parameters for compensation matter. While the processing of quantum signals has two main steps, including the static and dynamic equalization. The static equalization aims to compensating the imperfections of the measurement process to provide the right quadrature measurement results, in which a proper SNU normalization is crucial. After that, the dynamic equalization is performed to compensate the mismatch of the polarization and phase during the transmission in quantum channel. This can be easily mapped to linear quantum optics, for instance, the phase or polarization rotation and beam splitters (attenuation). Therefore, the key of the security is the static equalization, to obtain a reasonable quadrature measurement result.

The security of static equalization algorithms depends on proper calibration of SNU. The measurement result of tj period, D ̂ t j N, is defined by a linear function of multiple sampled data { D ̂ t j k + i }
D ̂ t j N = f dsp ( D ̂ t j k + 1 , , D ̂ t j k + N ) = Σ i = 1 N f dsp i D ̂ t j k + i .
(67)
If SNU is calibrated from vacuum input following the same equalization procedure, then after SNU normalization, the measurement result forms a single-mode quadrature measurement result (with relative phase θ to LO) with certain temporal mode, Ξ DSP t j, defined by the hardware features and equalization algorithms:
D ̂ t j SNU = A ̂ Ξ DSP t j exp ( i θ ) + A ̂ Ξ DSP t j exp ( i θ ) = X ̂ Ξ DSP t j θ .
(68)

With digital polarization compensation, the polarization-diversity integrated coherent receiver (ICR) can be used to simplify the system, in which optical polarization controller is no longer required, as shown in Fig. 37. Recently, a dual-polarization local LO CV-QKD system is experimentally demonstrated.145 It performs the probability-shaping discrete-modulated 64 and 256 QAM with dual-polarization IQ modulator, and the polarization-diversity ICR is used at receiver side. With all compensation finished in digital domain, it can achieve 91.8 Mbps of secret key rate at 9.5 km and 24 Mbps at 25 km, which can support the high-speed connection within metropolitan distances.

FIG. 37.

The advanced point-to-point dual-polarization CV-QKD systems with digital technologies. Here, both of the polarization direction is modulated with quantum signals, the DSP is used to compensate the phase mismatch and polarization rotation. The polarization controller in the optical path is not required. DP IQ modulator: Dual polarization IQ modulator.

FIG. 37.

The advanced point-to-point dual-polarization CV-QKD systems with digital technologies. Here, both of the polarization direction is modulated with quantum signals, the DSP is used to compensate the phase mismatch and polarization rotation. The polarization controller in the optical path is not required. DP IQ modulator: Dual polarization IQ modulator.

Close modal

The advanced local LO CV-QKD system is developing toward compact module with photonics integration, benefiting from stability and scalability, which enables cost-effective deployments in large-scale. Recently, a series of investigations have been carried out on high-performance chip-based transmitter and receiver for local LO CV-QKD system.146,335,402–404,442–445 There are two mainstream fabrication platforms, Silicon-On-Insulator and III–V.

The Silicon-On-Insulator platform has the advantages of low cost and good ductility, which can utilize mature silicon CMOS processes to manufacture optical devices. The refractive index of the silicon waveguide is 3.42, which can form a significant refractive index difference with silicon dioxide, ensuring that the silicon waveguide can have a smaller waveguide bending radius, which is beneficial for high-density device integration. In 2023, a Silicon-On-Insulator CV-QKD receiver for a digital system is tested. The bandwidth is significantly enhanced to 250 MHz which makes detect the frequency division multiplexed quantum and pilot signal possible.402 The maximal detection efficiency of the overall receiver is 0.26, with a shot noise-to-electronic-noise ratio of 20 dB at low frequencies and more than 7 dB for 250 MHz. Under the untrusted loss of 1.38 dB, a secret key rate of 280 kbps is achieved with excess noise of 0.1102 at Alice's side. The photonics chip shown in Fig. 38(a) is the CV-QKD receiver designed by Bian et al., which achieves the bandwidth of over 2 GHz and the quantum to classical noise ratio of 5 dB at 2 GHz.446 Using the silicon based on-chip receiver with high-efficiency Ge photodiodes, a high-speed system at 10 Gbaud is realized,146 as shown in Fig. 38(b). The system is able to generate high secret key rates exceeding 0.7 Gbps over a distance of 5 km and 0.3 Gbps over a distance of 10 km, paving the way of the high-performance and compact CV-QKD system.

FIG. 38.

The local LO CV-QKD systems with chip-based devices. (a) A silicon based high-speed CV-QKD receiver. (b) The 10 GBaud high-speed CV-QKD system with chip-based receiver. (b) Reproduced with permission from Hajomer et al., “Continuous-variable quantum key distribution at 10 Gbaud using an integrated photonic-electronic receiver,” arXiv:2305.19642 (2023). Copyright 2023 arXiv.146 

FIG. 38.

The local LO CV-QKD systems with chip-based devices. (a) A silicon based high-speed CV-QKD receiver. (b) The 10 GBaud high-speed CV-QKD system with chip-based receiver. (b) Reproduced with permission from Hajomer et al., “Continuous-variable quantum key distribution at 10 Gbaud using an integrated photonic-electronic receiver,” arXiv:2305.19642 (2023). Copyright 2023 arXiv.146 

Close modal

However, the Silicon-On-Insulator platform also suffers some issues, such as the low coupling efficiency for the optical signal input, which limits the detection efficiency, and the lack of an integrated high performance light source. The first issue can be solved through device optimization, such as low loss grating couplers and edge couplers. The latter issue is quite challenging, since silicon is not suitable for producing high performance integrated lasers.

One promising solution is using III–V platform such as InP, the other way is making heterogeneous integration, where the III–V chip-based laser is combined with the silicon chip via bonding or growing. Some recent research have shown the feasibility of implementing the above two technical routines. Aldama et al. has demonstrated a InP CV-QKD transmitter403 including an electro-absorption modulator, an IQ modulator and a variable optical attenuator. These three devices are cascaded and integrated on one chip, supporting more than 1 GHz bandwidth. 0.4 and 2.3 Mbps secret key rate is achieved via a test with 11 km fiber and back-to-back connection, which verifies the possibility of using InP platform to produce a transmitter satisfying the requirement of CV-QKD. Once the laser diode is integrated to the InP chip, a fully integrated CV-QKD chip can be realized.

For chip-based laser diode, Li et al. have demonstrated two high-performance on-chip external cavity lasers based on Si3N4 platform for local LO CV-QKD system.404 The secret key rate can reach 0.75 Mbps within 50 km fiber and the excess noise is controlled at 0.0579. In conclusion, the last obstacle to the fully chip-based CV-QKD system, which is the integrated light source, is expected to be solved through III–V platform with an overall or heterogeneous integration. The chip-based CV-QKD system is a promising way to realize large-scale, small-size and cost-effective applications.

Quantum access network is an efficient way to realize the point-to-multipoint connection between a network node and massive end users.447 There are two mainstream routines, using optical switch with active time-multiplexing control between different end users,400 or passive optical network (PON) with simpler network facilities. However, the 1 × N beam splitter in a PON significantly increases the equivalent channel loss for individual end users. Moreover, multiplexing techniques are required to seperate different users for upstream configuration.448,449 Recently, a downstream point-to-multipoint CV-QKD scheme based on PON is proposed to solve the problems above.147 The performance is significantly improved with a multiuser protocol, shown in Fig. 39.

FIG. 39.

The prepare-and-measure scheme of the point-to-multipoint CV-QKD protocol. Each coherent state prepared by Alice can be responded by all Bobs, for security analysis and secret key distillation. The syndrome is secretly transmitted to avoid the cross information leakage between different Bobs. Reproduced with permission from Bian et al., “High-rate point-to-multipoint quantum key distribution using coherent states,” arXiv:2302.02391 (2023). Copyright 2023 arXiv.147 

FIG. 39.

The prepare-and-measure scheme of the point-to-multipoint CV-QKD protocol. Each coherent state prepared by Alice can be responded by all Bobs, for security analysis and secret key distillation. The syndrome is secretly transmitted to avoid the cross information leakage between different Bobs. Reproduced with permission from Bian et al., “High-rate point-to-multipoint quantum key distribution using coherent states,” arXiv:2302.02391 (2023). Copyright 2023 arXiv.147 

Close modal

The state preparation and measurement are similar to the Gaussian modulated protocols. One of the key points of this protocol is the multi-user parameter estimation and security analysis, in which all Bobs work together with Alice for a tighter estimation of the potential channel eavesdropping behavior. Specifically, Alice discloses part of the modulation data, denoted as Xest, and all Bobs disclose their corresponding detection data, Y 1 est , Y 2 est , , Y N est. With these data, the correlations between Alice and Bobs can be estimated, which forms a covariance matrix γ A B 1 B 2 B N consists of all trusted modes. Further, the secret key rate between Alice and each Bob can be calculated with γ A B 1 B 2 B N.

The other key point is the parallel key distillation for all end users, which enhances the secret key rate of the overall network. In this protocol, each prepared quantum state can be measured by all users. Several techniques are developed to suppress the negative influence of the correlation between different end users on system performance. Therefore, all users can generate independent secret keys with the sender at the same time. The simulation results in Bian et al. show the ability of supporting 128 end users with more than 100 km distance (see Fig. 40), which can well satisfy the multiuser interconnection requirements within metropolitan distances.147 

FIG. 40.

Secret key rate vs transmission distance when the number of the Bobs is 8 (blue), 32 (orange), and 128 (green), including the secret key rate of a single Bob (solid line) and the secret key rate of the overall protocol (dashed line). The simulation parameters are as below, number of Bobs N = 8, modulation variance VM = 4, reconciliation efficiency β = 95.6 % , ε tot = 0.0383, the detection efficiency η d = 60 %, the detection noise vel = 0.15.

FIG. 40.

Secret key rate vs transmission distance when the number of the Bobs is 8 (blue), 32 (orange), and 128 (green), including the secret key rate of a single Bob (solid line) and the secret key rate of the overall protocol (dashed line). The simulation parameters are as below, number of Bobs N = 8, modulation variance VM = 4, reconciliation efficiency β = 95.6 % , ε tot = 0.0383, the detection efficiency η d = 60 %, the detection noise vel = 0.15.

Close modal

A high-rate CV-QKD access network is realized, as shown in Fig. 41. For the transmitter, quantum signal is generated with an IQ modulator, which is multiplexed with pilot tone signal with frequency division multiplexing and polarization multiplexing. For the receiver, the de-multiplexing is realized by a polarization controller and a polarization beam splitter. Then, quantum signal and pilot tone are seperately detected by heterodyne detection. The average secret key rate of each user can reach 4.1 Mbps at 15 km when the network capacity is 4, with the repetition frequency of 500 MHz.462 When the capacity of the network is extended to 8, the secret key rate for each user can reach 7.44 Mbps at 6 km,450 and 3.20 Mbps at 15 km.463 This result can well support the quantum access network, such as linking the end users within a campus (see Fig. 42).

FIG. 41.

The CV-QKD quantum access network using multiuser protocol. The network is based on the local LO scheme, where the transmitter generates quantum signal and pilot tone, which are multiplexed in different polarization directions and frequency. After the transmission in a passive optical network with an optical power splitter, different receivers at different site detects the signal independently, and distill secret key bits. From Bian et al., Laser Science. Copyright 2023 Optica Publishing Group. Reproduced with permission from Optica Publishing Group.450 

FIG. 41.

The CV-QKD quantum access network using multiuser protocol. The network is based on the local LO scheme, where the transmitter generates quantum signal and pilot tone, which are multiplexed in different polarization directions and frequency. After the transmission in a passive optical network with an optical power splitter, different receivers at different site detects the signal independently, and distill secret key bits. From Bian et al., Laser Science. Copyright 2023 Optica Publishing Group. Reproduced with permission from Optica Publishing Group.450 

Close modal
FIG. 42.

The future quantum access network with point-to-multipoint protocol. The OLT means the optical line terminal, and the ONU means the optical network unit. The network can be an optical distribution network, which is widely deployed by the fiber-based classical optical communication network, using as the access network. The quantum signal and classical signals can be co-transmitted with frequency division multiplexing (FDM), while the downstream and upstream signals can be transmitted with time division multiplexing.

FIG. 42.