Dense Wavelength Division Multiplexed Quantum Key Distribution Using Entangled Photons
DDense Wavelength Division Multiplexed Quantum Key DistributionUsing Entangled Photons
J. Mower, F.N.C Wong, J. H. Shapiro, and D. Englund
1, 3 Department of Electrical Engineering, Columbia University, New York, NY 10027 USA Research Laboratory of Electronics, MassachusettsInstitute of Technology, Cambridge, Massachusetts 02139 Department of Applied Physics and Applied Mathematics,Columbia University, New York, NY 10027 USA
Quantum key distribution (QKD) enables two parties to establish a secret key over a potentiallyhostile channel by exchanging photonic quantum states, relying on the fact that it is impossiblefor an eavesdropper to tap the quantum channel without disturbing these photons in a way thatcan be detected [1]. Here we introduce a large-alphabet QKD protocol that makes optimal use oftemporal and spectral correlations of entangled photons, reaching the maximum number of inde-pendent basis states (the Schmidt number) and enabling extremely high information content perphoton together with an optimal rate of secret key generation. This protocol, which we call ‘DenseWavelength Division Multiplexed Quantum Key Distribution’ (DWDM-QKD), derives its securityby the conjugate nature of the temporal and spectral entanglement of photon pairs generated byspontaneous parametric down conversion. By using a combination of spectral and temporal bases,we can adjust the protocol to be resource efficient. We show that DWDM-QKD is well suited toapproach the optimal key generation rate using present-day sources, detectors, and DWDM opti-cal networks from classical communications, as well as emerging optical interconnect and photonicintegrated chip (PIC) systems.
There has been growing interest in QKD schemes employing photons in high dimensional Hilbertspaces, resulting in a potentially very large-alphabet size [1, 2]. Different degrees of freedom havebeen considered, including temporal [3, 4] and spatial modes [5]. Ultimately, the number of bits perphoton is limited by the number of independent basis states spanning the Hilbert space, given by theSchmidt decomposition. While previous large-alphabet protocols in the temporal basis have reachedup to 16 time bins [4] with a bit error rate of 5%, they were not able to reach the Schmidt numberbecause, in practical situations, the detector timing jitter greatly exceeds the correlation time ofentangled photons generated by typical spontaneous parametric down conversion (SPDC) sources.We overcome this limitation by employing temporal and spectral correlations simultaneously tomatch the performance of present-day detectors. Thus, given a certain detected-pair flux n andphase-matching bandwidth ∆Ω, the DWDM-QKD protocol proposed here allows two parties, Aliceand Bob, to generate a secure key at the maximum rate possible in the time-frequency bases. Inparticular, DWDM-QKD enables Alice and Bob to generate their shared key at a maximum rate of n log (∆Ω /n ). Here, ∆Ω /n corresponds to the maximum number of independent time-frequencystates in time interval of duration 1 /n , and thus the maximum number of bits per photons is givenby log (∆Ω /n ).We consider time-frequency entangled photon pairs with a correlation time σ cor produced byfrequency-degenerate SPDC [6], assuming a pump field at frequency ω p with coherence time σ coh .In the weak pumping limit, the down-converted photon pair can be approximated by the state | Ψ (cid:105) = (cid:82) ∞−∞ (cid:82) ∞−∞ ψ ( t A , t B ) | t A , t B (cid:105) dt A dt B , where | t A , t B (cid:105) = ˆ a † A ( t A )ˆ a † B ( t B ) | (cid:105) , and ˆ a † A,B ( t j ) denotethe creation operators at time t j for Alice and Bob, and ψ ( t A , t B ) is the normalized time-domainbiphoton wave function. This state can be written equivalently in the spectral domain, | Ψ ω (cid:105) = (cid:82) ∞−∞ (cid:82) ∞−∞ ψ ( ω A , ω B ) | ω A , ω B (cid:105) dω A dω B , where ψ ( ω A , ω B ) = FT { ψ ( t A , t B ) } and FT denotes thetwo-dimensional Fourier transform. In these expressions, time and frequency represent conjugate a r X i v : . [ qu a n t - ph ] O c t bases that can be employed to generate a secure key [2]. Specifically, we first discretize the biphotonstate into n t orthogonal temporal basis states, | σ ibin (cid:105) , of duration σ bin , given by | σ ibin,A , σ ibin,B (cid:105) = (cid:82) ( i +1) σ bin iσ bin (cid:82) ( i +1) σ bin iσ bin ψ ( t A , t B ) | t A , t B (cid:105) dt A dt B , and alternatively into n ω orthogonal spectral basisstates, | ν i (cid:105) , of bandwidth δν , given by | ν iA , ν iB (cid:105) = (cid:82) ( i +1) δνiδν (cid:82) ( i +1) δνiδν ψ ( ω A , ω B ) | ω A , ω B (cid:105) dω A dω B . Weassume σ bin > σ cor and δν > /σ coh . n t and n ω are bounded by the Schmidt number, K = n t n ω .In the protocol, Alice creates a biphoton pair, keeps one photon for herself, and sends the otherphoton to Bob. Alice and Bob randomly switch between measurements in the temporal ( n t = K , n ω = 1) and spectral ( n t = 1, n ω = K ) bases at intervals of T = 1 /n . After a certain time, theypublicly compare their basis choices and divide their measurements into three categories, in whichthey (i) both detected photons and measured in the same basis set, (ii) both detected photons andmeasured in different basis sets, and (iii) did not both measure a photon. They discard category(iii) measurements. Type (i) measurements should be perfectly correlated, providing Alice and Bobwith the raw sifted key. Eve does not know in which basis Alice and Bob are observing, and willtherefore measure in the wrong basis set half of the time. If, for example, Alice and Bob do spectralmeasurements and Eve does a temporal measurement, she spreads the photon pair in frequencyand increases the error probability in the type-(i) measurements, revealing her presence to Aliceand Bob.The use of two conjugate bases ensures security in the DWDM-QKD protocol. While measure-ments in these bases is practical for relatively small basis size, the demands on instruments becomeunrealistic for larger bases; for instance, generating the secure key at 10 bits per photon wouldrequire a minimum basis size of 1024, and therefore as many detectors (in a continuously runningscheme). The temporal measurements present an additional a challenge because typical SPDCsources at 1550 nm produce photon pairs with σ cor ∼ (PPKTP) ( σ cor ∼ .
04 ps for type-0 phase-matched periodically poled LiNbO (PPLN)), which corresponds to a bandwidth of ∼ ∼
100 nm). No detector exists to measuresuch short time bins continuously [12]. This timing mismatch between practical detectors and prac-tical sources implies that the realizable number of time bins n t < K . When Alice and Bob measurein the temporal domain, they cannot check arrival temporal correlations to their fundamental limit.For instance, if the detector jitter is σ det ∼
30 ps, as for SNSPD detectors [7], then n t /K ≈ / K ≈ σ coh /σ cor to K (cid:48) < σ coh /σ det , and Eve can obtain finite spectral information without creating observable errorsin the temporal basis. This example illustrates that in general, technological limitations reduce thenumber of basis states far below the fundamental limit.To solve this problem, Alice and Bob can employ a hybrid basis that constitutes a superpositionof temporal and spectral states. They measure in the temporal basis with resolution σ bin andsimultaneously in the spectral basis with resolution ( σ bin ) − . In this case, the maximum number oftime bins becomes n t = σ coh /σ bin and the number of spectral bins becomes n ω = σ bin /σ cor so thatthe total alphabet size becomes n t n ω = σ coh /σ cor , which recovers the original Schmidt number, K .Now photons are measured in the spectral and temporal basis simultaneously, as shown in Figs. 1band 1d.The key generation rate depends on the phase-matching bandwidth, ∆Ω, and the number ofphoton pairs available for transmission. Alice and Bob can choose to transmit a single pair overthis bandwidth, or can split the spectrum into some number of channels, N c , each with photon flux, n/N c . In both cases, the maximum key generation rate evaluates to R ≈ n log (cid:18) ∆Ω n (cid:19) . (1) SPDC dComputer Computer
Classical Comm dAliceBob Alice Bob time bins time bins f r e q . b i n s Alice Bob Computer Computer
Classical Comm
SPDC d1d2d3
Alice Bob d e m u x D W D M σ det σ cor σ det σ cor (a) (b)(c) (d) d4 d4d3d2d1 d e m u x D W D M Thursday, October 20, 2011
FIG. 1: (a) The temporal-coding scheme. A strong laser pumps a nonlinear crystal. Photons pairs aregenerated by SPDC and sent across channels of equal length to Alice and Bob who measure their arrivaltimes. (b) Time bins agreed upon by Alice and Bob over a public channel. If a photon pair is detected ina given time bin, then that character is shared between Alice and Bob. (c) Alice and Bob place a DWDMbefore their detectors to obtain spectral information. (d) The new two-dimensional state space.
In Fig. 2a, we plot this relationship for two typical sources in the telecom band: a 1-cm type-IIphase-matched PPKTP crystal generating photons pairs at 1550 nm with a 4 nm bandwidth; anda 2-cm type-0 phase-matched PPLN crystal at 1550 nm with a 100 nm bandwidth. Alice and Bobcan generate a key at almost 20 bpp and 2 Gb/s using the PPLN source.A careful analysis must take into account the finite overlap of the basis states. When weinclude this overlap as well as the detector timing jitter, we can calculate the mutual informa-tion between Alice and Bob as I ( A, B ) = H ( A ) + H ( B ) − H ( A, B ), using the Shannon entropy, H = − (cid:80) { x } p { x } log p { x } , where { x } is the complete set of indices spanning a probability densityfunction p . We evaluate I ( A, B ) in Appendix II A and plot the results in Fig. 2b, as a function ofthe number of Gaussian spectral channels, and the number of time bins. We use Gaussian channelsto approximate modern DWDM filters. The continuous lines represent the ideal information perphoton, and the data points represent our simulated results for the mutual information using a two-dimensional Gaussian, ψ ( t A , t B ) ∝ e − ( t A − t B ) / σ cor e − ( t A + t B ) / σ coh e − iω p ( t A + t B ) / , for the biphotonwave function, where ω p is the pump frequency. For a small number of spectral channels, we seegood agreement. For large numbers, the Gaussian filters slightly underperform the ideal result dueto crosstalk in the closely spaced temporal and spectral bins. This is evident in Fig. 2b for 32spectral channels with FWHM of ( n ω σ cor ) − and channel spacing 4( n ω σ cor ) − , and two 40 ps timebins.Our formalism also enables us to study the effect of detector timing jitter. The results are plottedin the inset in Fig. 2b and show that the mutual information drops rapidly when the timing jitterapproaches the time bin duration.The security check employing conjugate bases in purely frequency and time relies on the mutu-ally unbiased nature of these bases; a measurement in the wrong basis reveals no information aboutthe state in the other basis and by their conjugate nature introduces errors. We therefore seek amutually unbiased basis to that employed in our resource-efficient scheme. Alice and Bob’s coarse PCPBS BS1 DBSL lossy interferometerjitter
BS2 n (photons/s)bits per photon key gen. rate (bit/s)1550-1551 nm1500-1600 nm n Ω A,B bits (a) (b) B A,B Resource-Efficient Dense Wavelength Division Multiplexed QuantumKey Distribution Using Entangled Photons
J. Mower, F.N.C Wong, J. H. Shapiro, and D. Englund Department of Electrical Engineering, Columbia University, New York, NY 10027 USA Research Laboratory of Electronics, MassachusettsInstitute of Technology, Cambridge, Massachusetts 02139 Department of Applied Physics and Applied Mathematics,Columbia University, New York, NY 10027 USA
Quantum key distribution (QKD) enables two parties to establish a secret key over a potentiallyhostile channel by exchanging photonic quantum states, relying on the fact that it is impossiblefor an eavesdropper to tap the quantum channel without disturbing these photons in a way thatcan be detected [1]. Here we introduce a large-alphabet QKD protocol that makes optimal use oftemporal and spectral correlations of entangled photons, reaching the maximum number of inde-pendent basis states (the Schmidt number) and enabling extremely high information content perphoton together with an optimal rate of secret key generation. This protocol, which we call ‘DenseWavelength Division Multiplexed Quantum Key Distribution’ (DWDM-QKD), derives its securityby the conjugate nature of the temporal and spectral entanglement of photon pairs generated byspontaneous parametric down conversion. By using a combination of spectral and temporal bases,we can adjust the protocol to be resource efficient. We show that DWDM-QKD is well suited toapproach the optimal key generation rate using present-day sources, detectors, and DWDM opti-cal networks from classical communications, as well as emerging optical interconnect and photonicintegrated chip (PIC) systems. σ det /σ bin (1)There has been growing interest in QKD schemes employing photons in high dimensional Hilbertspaces, resulting in a potentially very large-alphabet size [1, 2]. Different degrees of freedom havebeen considered, including temporal [3, 4] and spatial modes [5]. Ultimately, the number of bits perphoton is limited by the number of independent basis states spanning the Hilbert space, given by theSchmidt decomposition. While previous large-alphabet protocols in the temporal basis have reachedup to 16 time bins [4] with a bit error rate of 5%, they were not able to reach the Schmidt numberbecause, in practical situations, the detector timing jitter greatly exceeds the correlation time ofentangled photons generated by typical spontaneous parametric down conversion (SPDC) sources.We overcome this limitation by employing temporal and spectral correlations simultaneously tomatch the performance of present-day detectors. Thus, given a certain detected-pair flux n andphase-matching bandwidth ∆Ω, the DWDM-QKD protocol proposed here allows two parties, Aliceand Bob, to generate a secure key at the maximum rate possible in the time-frequency bases. Inparticular, DWDM-QKD enables Alice and Bob to generate their shared key at a maximum rate of n log (∆Ω /n ). Here, ∆Ω /n corresponds to the maximum number of independent time-frequencystates in time interval of duration 1 /n , and thus the maximum number of bits per photons is givenby log (∆Ω /n ).We consider time-frequency entangled photon pairs with a correlation time σ cor produced byfrequency-degenerate SPDC [6], assuming a pump field at frequency ω p with coherence time σ coh .In the weak pumping limit, the down-converted photon pair can be approximated by the state | Ψ = ∞−∞ ∞−∞ ψ ( t A ,t B ) | t A ,t B dt A dt B , where | t A ,t B = ˆ a † A ( t A )ˆ a † B ( t B ) | , and ˆ a † A,B ( t j ) denotethe creation operators at time t j for Alice and Bob, and ψ ( t A ,t B ) is the normalized time-domain ( ) Thursday, October 20, 2011
FIG. 2: (a) Key exchange rate and bits per photon as a function of phase-matching bandwidth and photonflux. (b) Mutual information as a function of the number of spectral channels, n ω . The individual spectralchannels have bandwidth δν = ∆ ω/n ω and spacing 4 δν . Increasing the number of spectral channels increasesthe bits per photon, until the time duration of the filtered photon approaches σ bin . The inset shows mutualinformation as a function of detector timing jitter, σ det , normalized to σ bin . measurements in spectrum are described by an operator that projects subsets of spectral statesonto degenerate eigenvalues Ω l . The degeneracy within these subsets is lifted by also performingmeasurements in time, which are described by an operator with coarse timing resolution T m thatcorrespond to degenerate sets of eigenstates. Simultaneous eigenstates for time and spectral mea-surements | Ω l T m (cid:105) describe one basis set. A conjugate basis can be found that forms the secondbasis for measurements by Alice and Bob.Under certain conditions, a security check can be performed using simple instrumentation. Fornow, we assume that Eve chooses to attack by using either a Gaussian envelope in time or one infrequency, i.e., ˆ E t = (cid:82) ∞−∞ e − t / σ Ecoh ) | t (cid:105) (cid:104) t | dt [4] or ˆ E ω = (cid:82) ∞−∞ e − ( σ Ecor ) ( ω − ω p / | ω (cid:105) (cid:104) ω | dω , respec-tively. Eve’s temporal measurement leads to a decrease in σ coh , and her frequency measurementcreates an increase in the biphoton correlation time, σ cor . Alice and Bob can detect both of theseattacks with the ‘extended Franson interferometer’ (eFI) shown in Fig. 3. The eFI is composed oftwo unbalanced Mach-Zehnder interferometers (MZI) in the possession of Alice and Bob, where thelong path on one arm can be actively modulated.The probability for Alice and Bob to detect a photon coincidence in their eFI is [9] P C ∝
12 + 12 cos[ ω (2∆ t − δt )] e − δt / σ cor e − ∆ t / σ coh , (2)where ω = ω p / t is the path-lengthdifference between the long and short arm of Alice’s MZI, and δt is the path-length differencebetween Alice’s and Bob’s long arm. ∆ t is large enough to avoid single photon interference betweenlong and short paths of a single arm of the eFI, and δt is varied on the order of 1 /ω about zero. Theinterference is plotted in Fig. 3 as a function of an additional delay in Alice’s MZI. This interferencecurve shows the oscillations in P C that is typical of the Franson interferometer near δt = 0. Inaddition, this oscillation has a Gaussian envelope whose width is given by σ cor .The visibility of the eFI interference is V = e − δt / σ cor e − ∆ t / σ coh . If Eve measures in thetemporal domain with a resolution better than ∆ t , then Alice and Bob can detect a drop in V near δt = 0; this is the security check used by Kahn et. al in Ref. [4]. On the other hand, if Evemeasures in the spectral domain with a resolution better than ∆Ω, then Alice and Bob can detect SPDC
PCPBS BS D ∆ t fs P C ∆ t fs P C ∆ t fs P C Thursday, October 20, 2011
FIG. 3: The eFI used for security checks. Alice switches the short arm of her Franson between lengths δt and δt . This allows determination of both σ coh and σ cor so that weak spectral and temporal measurementson the photon pair can be detected. Alice and Bob do security checks by varying δt as shown in the insets.We show one possible switching scheme that makes use of Pockels cells (PC) to rotate the polarization ofthe photon by π/ an increase in V near δt = σ cor . To guard against temporal and spectral measurements by Evesimultaneously, Alice and Bob measure V while Alice switches randomly between delays of 0 and σ cor (see Fig. 3).Alice and Bob can deduce the correlation time and coherence time from two visibility measure-ments V and V using two delays, δt and δt , respectively. We label these extrapolated values σ E (cid:48) coh and σ E (cid:48) cor , which are given by ( σ E (cid:48) cor ) = 18 δt − δt ln V − ln V (3)( σ E (cid:48) coh ) = 18 ∆ t ( δt − δt ) δt ln V − δt ln V . (4)Using ( σ Ecoh ) = 1 / [( σ E (cid:48) coh ) − − σ − coh ] and ( σ Ecor ) = 1 / [( σ E (cid:48) cor ) − − σ − cor ] derived from this measurement,the bound on Eve’s information per photon is I E ≤ log ( σ coh /σ Ecoh ) + log ( σ Ecor /σ cor ), which is thesum of her information obtained from temporal and spectral measurements. Our assumption of aGaussian form of Eve’s POVM will be generalized in future work. I. CONCLUSION
The often limited photon budget for quantum key distribution makes high-dimensional encodingdesirable. However, achieving the limit on this dimensionality in the temporal domain usingtime-frequency entangled photon pairs requires detectors with sub-ps timing jitter and resolution.By invoking conjugate spectral correlations, we present a protocol to approach this fundamentallimit using current detectors and existing telecom networks. The conjugate nature of temporal andspectral encoding means that one can trade spectral for temporal bits (and vice versa) to minimizethe effect of channel distortion such as nonlinear frequency conversion and dispersion, in additionto optimizing over transmission rate and channel bandwidth.This work was supported by the DARPA Information in a Photon program, through grantW911NF-10-1-0416 from the Army Research Office.
II. METHODSA. Mutual information
Alice and Bob ideally communicate information by discretizing the wave function into agreed-upon time-bin | σ ibin (cid:105) and frequency-bin | ν i (cid:105) macrostates by | ¯Ψ (cid:105) = (cid:88) i,j,k,l G i,j,k,l | σ ibin,A , σ jbin,B , ν kA , ν lB (cid:105) , (5)where G ijkl = (cid:90) ( i +1) σ bin iσ bin (cid:90) ( j +1) σ bin jσ bin FT (cid:34)(cid:90) ( k +1) δνkδν (cid:90) ( l +1) δνlδν ψ ( ω A , ω B ) dω A dω B (cid:35) dt A dt b (6). The probability of Alice and Bob projecting into time bins | σ ibin,A (cid:105) and | σ jbin,B (cid:105) and frequencybins | ν kA (cid:105) and | ν lB (cid:105) is p i,j,k,l = | (cid:104) σ ibin , σ jbin , ν kA , ν lB | ¯Ψ (cid:105)| = | G i,j,k,l | . We label the frequency bins sothat for k = l , the center frequencies of these bins add to the pump frequency. We plot the mutualinformation in Fig. 2b as a function of the number of spectral channels added. The wave function is atwo-dimensional Gaussian. As we increase the number of spectral channels, the mutual information(MI) increases, however the timing correlations eventually start to decrease, as the filtered photonsextend into neighboring time bins. Jitter is also a very important to the MI calculation. We includethis in the inset to Fig. 2b. B. Detector timing jitter
Detector timing jitter refers to the added uncertainty in the photon detection time of somestimulus, purely a result of detector electronics. Superconducting nanowire single photon detectorsand InGaAs APDs both exhibit jitter of roughly 30 to 40 ps [10]. We model timing jitter as aGaussian projection, ˆ σ det = (cid:82) e − t x / σ det | t (cid:105) (cid:104) t + t x | dt x . The jitter profile of a real photodetectoris not truly Gaussian and can be quite asymmetric, however (1) this model allows for first-orderanalysis and (2) certain single photon detectors do have approximately Gaussian timing jitter [7].If we apply ˆ σ det on both Alice and Bob’s photons, assuming the two-dimensional Gaussian givenearlier, we getˆ σ det,A ˆ σ det,B | Ψ (cid:105) ∝ (cid:90) ∞−∞ (cid:90) ∞−∞ exp (cid:20) − ( t A + t B ) σ det + 16 σ coh (cid:21) exp (cid:20) − ( t A − t B ) σ det + 4 σ cor (cid:21) e iω p ( t A + t B ) / | t A , t B (cid:105) dt A dt B (7)Since σ coh (cid:29) σ det , the most important effect of jitter is to increase the observed correlation timeroughly from σ cor to σ det . This can have a significant effect on the mutual information betweenAlice and Bob if σ det is on the order of σ bin , as shown in Fig. 2b. III. SUPPLEMENTARY INFORMATIONA. Lossy Franson interferometry
The Franson interference derived in the text assumes lossless propagation through the interferom-eter. This assumption is not valid in photonic integrated chips or fiber networks. We can accountfor loss in our analysis by adding a virtual beam splitter in the long path of the otherwise-losslessFranson, which couples the waveguide mode with a vacuum mode (see Fig. 4). We work in theHeisenberg construction, evolving the annihilation operator through the virtual-loss beam splitterand the two Franson beam splitters. The matrix for beam splitters 1 and 2, which leave the thirdmode undisturbed is given by ˆ U i = √ r i √ − r i √ − r i −√ r i
00 0 1 (8)where i ∈ ,
2. The virtual-loss beam splitter is given byˆ U L = √ t L √ − t L √ − t L −√ t L (9)The resulting annihilation operators are then ˆ a A ( t A ) = C ˆ a ( t ) + C ˆ a ( t − ∆ t ) and ˆ a B ( t B ) = C ˆ a ( t ) + C ˆ a ( t − ∆ t − δt ), disregarding the vacuum term, which will not affect coincidence counting. C = √ r √ r and C = √ − r √ − r √ t L . For r = r = 1 /
2, and t L = e − t/τ α where τ α is thelifetime of the photon in the interferometer arm, the visibility simplifies to V P IC = 2 e − t/τ α e − t/τ α e − δt / σ cor e − ∆ t / σ coh . (10)However for maximum visibility, C = C , so √ r √ r √ − r √ − r = √ t L . (11)The Franson beam splitters can therefore be tuned to account for loss in the interferometer. PCPBS BS1 DBSL lossy interferometerjitter
BS2 n (photons/s)bits per photon key gen. rate (bit/s)1550-1551 nm1500-1600 nm n Ω A,B bits B A,B (a) (b) Thursday, October 20, 2011
FIG. 4: The eFI with an additional virtual beam splitter for loss in the long arm.
B. Eve and the wave function