METHODS AND SYSTEMS FOR QUANTUM KEY DISTRIBUTION

Abstract

A method for quantum key distribution includes generating an encoder initial bit sequence; generating a quantum signal comprising optical pulses by modulating an intensity profile of the optical pulses according to an intensity function depending on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence, and/or modulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence; transmitting the plurality of optical pulses to a receiver device via a quantum channel; and determining a shared key shared between the transmitter device and the receiver device from the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device and receiving further classical information from the receiver device.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

The instant application claims priority to European Patent Application No. 23216095.2, filed Dec. 13, 2023, which is incorporated herein in its entirety by reference.

FIELD OF THE DISCLOSURE

The present disclosure generally relates to methods and systems for quantum key distribution and, more particularly, to techniques for encoding classical information into quantum signals and decoding classical information from quantum signals.

BACKGROUND OF THE INVENTION

A typical quantum key distribution (QKD) protocol comprises two main stages: quantum communication and classical post-processing. In principle, in a transmitter device (“Alice”) a random bit sequence is generated, encoded into quantum states and sent to a receiver device (“Bob”) via a quantum channel. The encoding regularly comprises generating coherent states (e.g., by a laser) and applying optical elements such as phase shifters, attenuators, or beam-splitters. The transmitted states are measured in the receiver device, after which classical post-processing is performed for establishing a shared secret key.

In practical optical QKD setups, classical information can be encoded into physical systems using:

• • polarization encoding (e.g., the BB84 protocol): different logical bits are translated into different polarizations of single-photon or multi-photon signals/optical pulses,
  • phase encoding (e.g., DPS QKD): different logical bits are translated into different phases of single-photon or multi-photon signals,
  • intensity encoding (e.g., B92 using coherent states): different logical bits are translated into different intensities of optical pulses, or
  • time encoding (e.g., COW protocol): information is encoded in time positions of optical pulses.

UK patent application GB 2,529,228 A relates to interference methods for quantum communication systems. Reference is made to time varying gain modulation comprising arbitrary pulse shapes. However, encoding of classical information is carried out using a conventional BB84 method with setting phases for entire bit-carrying signals.

U.S. Pat. No. 10,153,848 B2 pertains to a transmitter for a continuous variable quantum communication system. Sequences of light pulses are created such that subsequent light pulses have a different phase or intensity with respect to each other.

Chinese patent application CN 110,620,655 A discloses intensity modulation of light pulses and subsequent phase modulation in the context of quantum key distribution. Intensity modulation (of entire pulses) is carried out to create decoy states. In CN 205,961,140 U, a light intensity modulator is described, which acts on the optical signal before encoding or after phase encoding. Intensity is not connected with encoding, but for decoy states.

BRIEF SUMMARY OF THE INVENTION

The present disclosure generally describes improved techniques for encoding classical information into quantum signals and decoding classical information from quantum signals in quantum key distribution.

For solving the problem, an encoding method, a decoding method, a method for quantum key distribution, a transmitter device, a receiver device, and a system for quantum key distribution are provided.

According to an aspect of the invention, an encoding method for quantum key distribution is provided, the method being carried out in a transmitter device having a classical processor and means for preparing and transmitting quantum signals, the method comprising:

• • generating an encoder initial bit sequence;
  • generating, from the encoder initial bit sequence, a quantum signal comprising a plurality of optical pulses, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of:
    • modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence; and
    • modulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence;
  • transmitting the plurality of optical pulses to a receiver device via a quantum channel; and
  • determining a shared key shared between the transmitter device and the receiver device from the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device and receiving further classical information from the receiver device (12).

According to another aspect, a decoding method for quantum key distribution is provided, the method being carried out in a receiver device having a classical processor and means for receiving and measuring quantum signals, the method comprising:

• • receiving a quantum signal comprising a plurality of optical pulses from a transmitter device via a quantum channel;
  • determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising, for each optical pulse, at least one of:
    • determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence, and
    • determining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determining, from the approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; and
    • determining a shared key shared between the transmitter device and the receiver device from the decoder initial bit sequence by classical post-processing and at least one of receiving classical information from the transmitter device and transmitting further classical information to the transmitter device.

According to another aspect, a method for quantum key distribution is provided, the method being carried out in a system comprising a transmitter device having a classical processor and means for preparing and transmitting quantum signals and a receiver device having a further classical processor and means for receiving and measuring quantum signals. The method comprises:

• • generating an encoder initial bit sequence in the transmitter device;
  • generating, from the encoder initial bit sequence, a quantum signal comprising plurality of optical pulses in the transmitter device, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of:
    • modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence and
    • modulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence;
  • transmitting the plurality of optical pulses from the transmitter device to the receiver device via a quantum channel and receiving the plurality of optical pulses in the receiver device;
  • determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising for each optical pulse at least one of:
    • determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence; and
    • determining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determining, from the approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; and
  • determining, in the transmitter device from the encoder initial bit sequence and in the receiver device from the decoder initial bit sequence, by classical post-processing and at least one of transmitting classical information from the transmitter device to the receiver device and transmitting further classical information from the receiver device to the transmitter device, a shared key shared between the transmitter device and the receiver device.

According to another aspect, a transmitter device for quantum key distribution is provided, comprising a classical processor and means for preparing and transmitting quantum signals and being configured to carry out the following steps:

• • generating an encoder initial bit sequence;
  • generating, from the encoder initial bit sequence, a quantum signal comprising a plurality of optical pulses, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of:
    • modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence and
    • modulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence,
  • transmitting the plurality of optical pulses to a receiver device via a quantum channel; and
  • determining a shared key shared between the transmitter device and the receiver device from the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device and receiving further classical information from the receiver device.

According to another aspect, a receiver device for quantum key distribution is provided, comprising a classical processor and means for receiving and measuring quantum signals and being configured to carry out the following steps:

• • receiving a quantum signal comprising a plurality of optical pulses from a transmitter device via a quantum channel,
  • determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising for each optical pulse at least one of:
    • determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence, and
    • determining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins and determining, from approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; and
  • determining a shared key shared between the transmitter device and the receiver device from the decoder initial bit sequence by classical post-processing and at least one of receiving classical information from the transmitter device and transmitting further classical information to the transmitter device.

According to another aspect, a system for quantum key distribution is provided, the system comprising a transmitter device having a classical processor and means for preparing and transmitting quantum signals and a receiver device having a further classical processor and means for receiving and measuring quantum signals. The system is configured to carry out the following steps:

• • generating an encoder initial bit sequence in the transmitter device;
  • generating, from the first initial bit sequence, a quantum signal comprising a plurality of optical pulses in the transmitter device, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of:
    • modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence; and
    • modulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence,
  • transmitting the plurality of optical pulses from the transmitter device to the receiver device via a quantum channel and receiving the plurality of optical pulses in the receiver device;
  • determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising for each optical pulse at least one of:
    • determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence, and
    • determining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins and determining, from approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; and
    • determining, in the transmitter device from the encoder initial bit sequence and in the receiver device from the decoder initial bit sequence, by classical post-processing and at least one of transmitting classical information from the transmitter device to the receiver device and transmitting further classical information from the receiver device to the transmitter device, a shared key shared between the transmitter device and the receiver device.

In one embodiment, modulating the intensity profile of each optical pulse particularly depends on the first encoder value of the at least one first bit of the encoder initial bit sequence. Further, modulating the phase profile of each optical pulse depends on the second encoder value of the at least one second bit of the encoder initial bit sequence.

As a result, a shared key may be determined in a more robust manner, in particular for increased values of possible information leakage to an eavesdropper. High intensity quantum states with comparably weak distinguishability may be employed. In contrast, conventional quantum cryptography assumes that a potential eavesdropper may obtain all losses occurring in the quantum channel between the legitimate parties. Thus, weak coherent states with only few photons per signal are generally used.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

FIG. 1 is a graphical representation of an arrangement of a system for quantum key distribution and an eavesdropper device, in accordance with the disclosure.

FIG. 2 is a graphical representation of steps for determining a shared key by quantum key distribution, in accordance with the disclosure.

FIG. 3 is a reflectogram resulting from optical time-domain reflectometry corresponding to a signal loss profile, in accordance with the disclosure.

FIG. 4 is a graphical representation of an apparatus for preparing the optical pulses, in accordance with the disclosure.

FIG. 5 is a plot of an intensity profile in terms of optical power as a function of time, in accordance with the disclosure.

FIG. 6 is a plot of a key generation rate as a function of a portion of the intercepted signal, in accordance with the disclosure.

FIG. 7 is a plot of the key generation rate for phase coding and for the proposed method, in accordance with the disclosure.

FIG. 8 is a plot of the key generation rate for intensity coding and for the proposed method in accordance with the disclosure.

DETAILED DESCRIPTION OF THE INVENTION

In FIG. 1, a graphical representation of an arrangement comprising a system for quantum key distribution and an eavesdropper device 13 (“Eve”) is shown. The system comprises a communication channel (transmission line) 10 for transmitting classical signals and/or quantum signals, in particular optical pulses, between a transmitter device 11 (“Alice”) and a receiver device 12 (“Bob”). The communication channel 10 may comprise or be a classical channel and/or a quantum channel 10a. Further, the communication channel 10 may comprise at least one optical fiber for transmitting optical pulses. At least one (optical) amplifier (not shown) may be provided along the communication channel 10 for amplifying the optical pulses. An optical amplifier may compensate for losses occurring in a preceding section of the communication channel 10.

The transmitter device 11 may comprise a (classical) processor 11a and a (classical) memory 11b and the receiver device 12 may comprise a further (classical) processor 12a and a further (classical) memory 12b. The transmitter device 11 and the receiver device 12 may be part of the system. The transmitter device 11 and the receiver device 12 are connected to the quantum channel.

The eavesdropper device 13 with an eavesdropping processor 13a and an eavesdropping memory 13b represents a device outside the system with potential access to quantum channel 10. The eavesdropper device 13 may be arranged at the transmission line 10 such that the optical signals transmitted via the transmission line 10 are at least partially received and/or retransmitted by the eavesdropper device 13. The eavesdropper device 13 may also access the further communication channels.

At least one of, preferably each of the transmitter device 11, the receiver device 12, and the eavesdropper device 13 may comprise means to at least one of prepare, transmit, receive, and measure quantum states, in particular optical quantum states. In particular, the transmitter device 11 may comprise means for preparing and transmitting quantum signals and/or quantum states, e.g., a (quantum state) preparation device 11c. Further, the receiver device 12 may comprise means for receiving and measuring quantum signals and/or quantum states, e.g., a (quantum state) measurement device 12c. The eavesdropper device 13 may likewise comprise a preparation and/or measurement device 13c. The transmitter device 11 and the receiver device 12 may each comprise means for receiving and transmitting (further) classical information (e.g., via the classical channel).

The first memory 11b, the second memory 12b, and the eavesdropping memory 13b may each comprise a quantum memory that is configured to store quantum signals and a classical memory that is configured to store classical signals. The quantum memory may be provided using optical delay lines, controlled reversible inhomogeneous broadening (CRIB), a Duan-Lukin-Cirac-Zoller (DLCZ) scheme, revival of silenced echo (ROSE), and/or hybrid photon echo rephasing (HYPER).

(a) Quantum Key Distribution

In the following, the steps for determining a shared key by quantum key distribution will be briefly described. In FIG. 2, a graphical representation of the corresponding steps is shown.

Certain steps will be explained in more detail in the subsequent sections, in particular, loss control of the transmission line (transmission line control) (step 21, section b), encoding (step 23, section c), decoding (step 25, section d), and post-processing (steps 26 to 28, section e).

The transmitter device 11 and the receiver device 12 are connected via an authenticated (public) classical channel and the optical fiber(s) of the transmission line 10 serve as a quantum channel 10a.

In an initial step 20, an initial inner loss profile of the transmission line 10 (in particular its optical fiber segments) is determined, which essentially represents the natural signal losses in the transmission line 10. At this preliminary step, it should be ensured that no eavesdropper is accessing the transmission line 10. The initial loss profile may be shared between the transmitter device 11 and the receiver device 12 via the authenticated classical communication channel.

In a first step 21, physical loss control of the transmission line 10 is carried out by the transmitter device 11 and the receiver device 12 by transmitting optical test pulses. In particular, a loss profile is determined and, preferably, shared between the transmitter device 11 and the receiver device 12 via the classical channel.

By comparing the thus updated inner loss profile with the initial inner loss profile, a fraction r_E of the signal possibly seized by the eavesdropper may be determined. For example, if, in a section of the transmission line 10, the natural signal losses in this section are represented by r₀ and the eavesdropper intercepts an intercepted fraction r_E of the signal, then the intercepted fraction r_E can be derived from total losses r_t via the relation (1−r_t)=(1−r_E) (1−r₀).

If the intercepted fraction r_E grows too large, so that the legitimate users lose their informational advantage over the eavesdropper, the protocol is terminated. Termination of the protocol depends on the length of the transmission line 10. The protocol may in particular be terminated if an effective key rate is below a target key rate value.

Based on the loss profile, protocol settings such as signal shapes, post-selection parameters, error-correction codes may be determined. Physical loss control including transmission of optical test pulses may be carried out in parallel with the transmission of the optical (signal) pulses for determining the shared key. If a change in r_E is detected, the protocol settings may be adapted.

In a second step 22, using a random number generator, a bit sequence is determined in the transmitter device 11.

In a third step 23, the encoder initial bit sequence is encoded into the respective intensity profiles and/or phase profiles of a plurality of optical (signal) pulses.

In a fourth step 24, the optical pulses are transmitted to the receiver device 12 via the quantum channel 10a.

In a fifth step 25, the optical pulses are received and measured by the receiver device 12. A corresponding decoder initial bit sequence is determined in the receiver device 12. Due to quantum and classical noise, quantum states of certain optical pulses corresponding to different bit values cannot be determined accurately. Thus, the second initial bit string may contain additional errors.

In a sixth step 26, inconclusive bits, which correspond to quantum measurements in the receiver device 12 determined as inconclusive, are discarded from the encoder initial bit sequence in the transmitter device 11 and the decoder initial bit sequence in the receiver device 12 (post-selection). This results in a first raw key in the transmitter device and a second raw key in the receiver device. In order to discard the inconclusive bits, bit positions of the inconclusive signal bits (as part of the further classical information) may be transmitted via the classical channel from the receiver device 12 to the transmitter device 11.

In a seventh step 27, by disclosing a part of the encoder initial bit sequence (in particular, the first/encoder raw key) and/or the decoder initial bit sequence (in particular, the second/decoder raw key) via the classical channel (as part of the classical information and/or the further classical information), an error rate may be determined and error correction may be performed on the first raw key and the second raw key by the transmitter device 11 and the receiver device 12, respectively. The error correction maybe carried out employing an error correction code, e.g., a low-density parity-check (LDPC) code, a Hamming code, or a cascade protocol. As a result, an error corrected bit sequence is determined in the transmitter device 11 from the first raw key and in the receiver device 12 from the second raw key.

In an eighth step 28, an amplified key sequence is determined from the error corrected bit sequence using privacy amplification. Known privacy amplification methods may be employed during which (further) classical information is exchanged. The amplified key sequence is shorter than the error corrected bit sequence and any potential eavesdropper has none or negligibly small information on the amplified key sequence. The amplified key sequence represents a shared key sequence between the transmitter device 11 and the receiver device 12 as a result of quantum key distribution. The privacy amplification may be based on the determined value of r_E.

The steps from the first step 21 to the eighth step 28 may be repeated (arrow 29) and the amplified key sequences concatenated to a (total) shared key until a total length of the shared key is as large as required by the application at hand.

During all steps 21 to 28, the transmission line 10 may be continuously controlled (arrow 20a). Hence, a signal loss profile is determined and, preferably, shared between the transmitter device 11 and the receiver device 12 via the classical channel. In case where the integrity of the transmission line 10 is compromised to the extent of a considerable risk that the eavesdropper would decipher the scattering losses, the protocol may be terminated.

(b) Transmission Line Control/Loss Control

In the following, the first step 21 of physical loss control of the transmission line 10 will be explained in more detail.

FIG. 3 shows an exemplary reflectogram resulting from optical time-domain reflectometry corresponding to a signal loss profile. The underlying measurements were carried out with a 2 μs, 1550 nm pulse laser with power less than 100 mW. The experimental data has been averaged over 16 000 measurements.

The reflectogram shows the logarithmic power of backscattered optical test pulses as a function of distance between a reflectometer and the corresponding discontinuity. The reflectometer may be arranged within or close to the transmitter device 11 and/or the receiver device 12.

The natural signal losses along the quantum channel 10a/the transmission line 10 are due to homogenous scattering and result in an exponential decay of power corresponding to linear regions 30. Reflectogram features 31 to 34 comprising deviations from the exponential decay of the reflectogram curve, in particular sharp peaks and/or drops in the reflectogram curve allow for classifying the signal losses at the corresponding position of the transmission line 10. This is especially useful at the initial step 20, where identifying and mitigating local losses is important for comparison with determined losses during key exchange.

The reflectogram features 31 to 34 generally correspond to imperfections of the transmission line 10 and may, e.g., represent low-quality splices, bends and different connectors. Scattering losses from such regions are localized with respect to the transmission line 10. Peaks in the reflectogram features 31 to 34 may result from an excessive scattering which in the case of physical connectors are due to the test pulses undergoing Fresnel reflection. Noisy region 35 at the right-hand side of the reflectogram represents the end of the backscattered signal.

Additionally or alternatively, the transmission line control may comprise transmittometry, i.e., intensities of the optical test pulses transmitted by the transmitter device 11 and received by the receiver device 12 are analyzed for classifying the signal losses at respective positions of the transmission line 10. Classification by analyzing received optical signals in the receiver device 12 may also be carried out in the receiver device 12. The transmitter device 11 may also be configured to carry out classification, in particular by combining measurements of backscattered test pulse components and of optical test pulses received in the receiver device 12.

For increased precision, optical test pulses with highest intensity, in particular with intensity greater than the intensity of the optical (signal) pulses. Parameters of the transmitted optical test pulses, such as intensity, phase, length, and shape, are determined randomly in the transmitter device 11. The parameters remain secret until the quantum measurements are completed by the receiver device 12. Next, the transmitter device 11 announces the employed parameters and the transmitter device 11 and the receiver device 12 perform a cross-check of the parameters and determine the losses in the transmission line 10. The time intervals between the optical test pulses transmission may be determined according to a pre-shared secret bit sequence. This ensures that a potential eavesdropper cannot discern optical test pulses from optical (signal) pulses. As a result, it is impossible for the eavesdropper to create an additional permanent leakage constant or a leakage targeting for certain optical signal pulses and optical test pulses. By analyzing the optical test pulses, the eavesdropper's knowledge about the optical signal pulses can be assessed.

(c) Encoding

Below, the third step 23 of encoding the encoder initial bit sequence into the respective intensity profiles and/or phase profiles of the plurality of optical (signal) pulses will be described in more detail.

In FIG. 4, a graphical representation of an apparatus for preparing the optical pulses is shown. The apparatus may correspond to the preparation device 11c of the transmitter device 11.

Each optical pulse is generated from a laser pulse of a laser 40 and using a Mach-Zehnder (MZ) interferometer 41. The laser pulse (as generated by the laser 40) has a time length T_s and a constant input optical power P_γ=ℏΩ|γ|², wherein Ω is a carrier frequency and γ a (complex) pulse amplitude.

The MZ interferometer 41 may comprise a first phase modulator 43, a second phase modulator 45, a first beam splitter 42, and a second beam splitter 44. The laser pulse may pass through the first beam splitter 42, the first phase modulator 43, the second beam splitter 44, and the second phase modulator 45.

The first beam splitter 42 and the second beam splitter 44 are 50:50 beam splitters. The laser pulse is split at the first beam splitter 42 into a first part and a second part and recombined at the second beam splitter 44. The laser pulse is again split at the second beam splitter 44 into a third part and a fourth part. The first part passes the first phase modulator 43. The second part passes directly to the second beam splitter 44. The third part is transmitted to a control detector 46. The fourth part passes the second phase modulator 45 and is subsequently transmitted to the quantum channel 10a (as one optical pulse of the plurality of optical pulses). By detector 46, the proper preparation of the optical pulses can be monitored.

The parameters of both phase modulators 43, 45 may be controlled in time for modulating the intensity profile and/or phase profile of the optical pulses.

The transformation of an input state (0, γ)^T (vacuum on one port and pulse with complex amplitude γ on another) via the MZ interferometer 41 can be represented by

$\begin{array}{cc}{\hat{U}}_{\mathrm{MZ}}={\hat{U}}_{\psi }·{\hat{U}}_{\mathrm{BS}2}·{\hat{U}}_{\phi }·{\hat{U}}_{\mathrm{BS}1},& \left(1\right)\end{array}$ $\mathrm{with}$ $\begin{array}{cc}{\hat{U}}_{\mathrm{BS}\left(1,2\right)}=\frac{1}{\sqrt{2}}\left(\begin{array}{cc}1& i\\ i& 1\end{array}\right),{\hat{U}}_{\phi }=\left(\begin{array}{cc}{e}^{i\phi }& 0\\ 0& 1\end{array}\right),{\hat{U}}_{\psi }=\left(\begin{array}{cc}1& 0\\ 0& e^{i\psi }\end{array}\right).& \left(2\right)\end{array}$

Û_BS(1,2) denotes the transformation corresponding to the first and the second beam splitter 42, 44. Further, Û_φ denotes the transformation corresponding to a first phase shift φ via the first phase modulator 43 and Û_ψ denotes the transformation corresponding to a second phase shift ψ via the second phase modulator 45. The first phase shift φ(t) and the second phase shift ψ(t) are time-dependent functions and determine the intensity profile profiles and the phase profile of the output optical pulse, respectively. The optical pulse is represented by the following quantum state:

$\begin{array}{cc}{\hat{U}}_{\mathrm{MZ}}\left(\begin{array}{c}0\\ \gamma \end{array}\right)=\left(\begin{array}{c}\gamma {\mathrm{ie}}^{i\phi /2}·\cos \frac{\phi }{2}\\ \gamma e^{i\psi +i\phi /2+i\pi }·\sin \frac{\phi }{2}\end{array}\right)& \left(3\right)\end{array}$

The intensity profile P_line(t) (in terms of optical power) and the phase profile ϕ_line(t) can be represented as follows:

$\begin{array}{cc}{P}_{\mathrm{line}}\left(t\right)=P_{\gamma }·{\sin }^2\left(\frac{\phi \left(t\right)}{2}\right)=\frac{P_{\gamma }}{2}·\left(1-\cos \phi \left(t\right)\right),{\varphi }_{\mathrm{line}}\left(t\right)+\psi \left(t\right)+\frac{\phi \left(t\right)}{2}+\pi \Rightarrow \psi \left(t\right)={\varphi }_{\mathrm{line}}\left(t\right)-\frac{\phi \left(t\right)}{2}-\pi .& \left(4\right)\end{array}$

P_γ denotes the (constant) input optical power from the laser 40. For an intensity profile P_line(t)=ℏΩ|F(t)|² (in terms of optical power) with intensity profile |F(t)|² in terms of intensity, the corresponding first phase shift φ(t) may be determined as

$\begin{array}{cc}\phi \left(t\right)=\mathrm{arc}\cos \left[1-\frac{2\hslash \Omega {❘F\left(t\right)❘}^2}{P_{\gamma }}\right]& \left(5\right)\end{array}$

by using that

$\begin{array}{cc}\hslash \Omega {❘F\left(t\right)❘}^2=\frac{P_{\gamma }}{2}·\left(1-\cos \phi \left(t\right)\right).& \left(6\right)\end{array}$

Since |cos(φ(t))|≤1, for the input optical power P_γ applies: P_γ≥ℏΩ|F(t)|². The input optical power P_γ is thus greater than the intensity profile (in power terms) for each time t.

The first phase shift φ(t) may be compensated and a desirable phase profile P_line(t) be prepared by controlling the second phase shift ψ(t).

In a particular example, the classical (first) bits of the encoder initial bit sequence are encoded only in the intensity profiles. In this case, the phase profile can be time-dependent for each optical pulse but be the same for each first encoder value (i.e., be independent from the first encoder value). Moreover, a single first bit is encoded per optical pulse. Hence, for each optical pulse, the intensity function depends on a first encoder value of a (single) first bit of the encoder initial bit sequence).

The intensity profile in terms of optical power for a first (bit) value a can be written as:

$\begin{array}{cc}{P}_a\left(t\right)=P^{\prime }+P^{″}·\cos \left({\zeta }_a\left(t\right)\right),a\in \left\{0,1\right\},& \left(7\right)\end{array}$

where ξ_a(t) is a time-dependent function and depending on/determined by a, P′ is constant (optical power) component and P″ is an amplitude of a modulation component, here: an oscillatory component. The function P′+P″·cos(ξ_a(t)) may be considered (up to a constant factor) to be the intensity function according to which the intensity profile is modulated. By combining Eq. (4) und Eq. (7), i.e.,

$\begin{array}{cc}\frac{P_{\gamma }}{2}·\left(1-\cos \phi \right)=P^{\prime }+P^{″}·\cos \left({\zeta }_a\left(t\right)\right),& \left(8\right)\end{array}$

the employed first phase shift φ(t) (depending on the first encoder value a) may be determined as:

$\begin{array}{cc}{\phi }_a\left(t\right)=\mathrm{arc}\cos \left[1-2·\frac{P^{\prime }+P^{″}·\cos \left({\zeta }_a\left(t\right)\right)}{P_{\gamma }}\right],& \left(9\right)\end{array}$

where P_γ≥P′+P″ (since |cos(φ_a(t))|≤1).

In FIG. 5, a plot of the intensity profile in terms of optical power as a function of time is shown. The intensity profile for the first encoder value being equal to zero (a=0) corresponds to a first time-dependent curve 50 and the intensity profile for the first encoder value being equal to one (a=1) corresponds to a second time-dependent curve 51.

For a=0, the intensity profile can be represented by

$\begin{array}{cc}{P}_0\left(t\right)=P^{\prime }+P^{″}·\cos \left(\frac{2\pi \left(f_1-f_0\right)}{3T_s^2}·t^3+2\pi f_0·t\right),& \left(10\right)\end{array}$

and for a=1 by

$\begin{array}{cc}{P}_1\left(t\right)=P^{\prime }+P^{″}·\cos \left(\frac{2\pi \left(f_0-f_1\right)}{3T_s^2}·t^3+2\pi f_1·t\right),& \left(11\right)\end{array}$

wherein P′=10⁻⁸ W, P″=10⁻⁹ W, T_s=100 ns, ƒ₀=90 MHZ, and ƒ₁=110 MHz. As can be seen from curves 50, 51, for a=0, the instantaneous frequency increases with time, while for a=1, the instantaneous frequency decreases with time. The factors

$\frac{2\pi \left(f_1-f_0\right)}{3T_s^2}\mathrm{and}\frac{2\pi \left(f_0-f_1\right)}{3T_s^2}r$

may be understood as a first chirp rate and a second chirp rate, respectively.

(d) Measuring and Decoding

In the following, the measuring and decoding of optical pulses received in the receiver device 12 (step 25) is described in more detail.

From the optical pulses, a decoder initial bit sequence is determined in the receiver device 12. To this end, an approximate intensity profile of each optical pulse is determined by measuring intensity values of the optical pulse for a plurality of time bins. Using the approximate intensity profile, (first decoder) values of the decoder initial bit sequence can be determined. Further, an approximate phase profile of the optical pulse is determined by measuring phase values of the optical pulse for a plurality of time bins. From the approximate phase profile, further (second decoder) values of the decoder initial bit sequence can be determined.

Measuring the intensity values and/or the phase values may comprise carrying out heterodyne measurements for each time bin. The heterodyne measurements include splitting a received optical pulse into two beams which interfere with two further beams of local oscillators (LO) and measuring interference events using photo-diode detectors.

For matching a local oscillator phase with a phase of the laser (using which the optical pulses have been generated), unmodulated optical pulses (of constant intensity and phase) may be transmitted from the laser via an additional quantum channel (in parallel to the (modulated) optical pulses).

In the following example, an approximate intensity profile is determined without determining an approximate phase profile. Hence, the phases of the optical pulses can remain constant in time. Thus, there is no phase difference between different optical pulses and in-between one optical pulse. The intensity profile of each optical pulse of the plurality of optical pulses has been modulated in the transmitter device 11 according to an intensity function depending on time and on the first encoder value of one first bit of the encoder initial bit sequence. Further, the plurality of optical pulses has been transmitted via the quantum channel 10a and been received in the receiver device 12.

In the receiver device 12, a plurality of quantum measurements is carried out, such that a plurality of (average) photon numbers is determined for a plurality of time bins characterized by a time interval Δt. Once per time interval Δt, an intensity value (i.e., a number of photons received during the time interval Δt) is determined. Thus, a discrete set of time values and corresponding photon numbers is determined (approximate/discretized intensity profile). From the approximate intensity profile, the intensity profile as initially generated in the transmitter device 11 can be reconstructed with a certain accuracy and, thus, the corresponding bit value be estimated.

The intensity profiles may be generated such that their total energies remain constant for each of the plurality of optical pulses and for each possible bit value. That is, the total number of photons of each optical pulse is constant:

$\begin{array}{cc}\sum _t{N}_0\left(t\right)=\sum _t{N}_1\left(t\right),& \left(12\right)\end{array}$

where N_a(t) denotes the average number of photons of an optical pulse in the time interval [t, t+Δt] in case of the first (bit) value being a. Due to Poisson noise, the determined approximate intensity profiles will in general not coincide with the ideal ones. The measured number of photons in the time interval [t, t+Δt] for bit value a can be represented by

$\begin{array}{cc}{\tilde{N}}_a\left(t\right)=N_a\left(t\right)+n_a\left(t\right),& \left(13\right)\end{array}$

where n_a(t) is random variable associated with noise. For high signal intensities, n_a(t) may be treated as a Gaussian random variable at every time t. According to the bosonic model of optical amplifiers, the resulting mean value and variance can be written as:

$\begin{array}{cc}\begin{array}{c}\forall t𝔼\left[{\tilde{N}}_a\left(t\right)\right]=N_a\left(t\right)+\frac{\Delta t}{T_s}·M\left(G-1\right),\\ 𝔻\left[{\tilde{N}}_a\left(t\right)\right]=\left(2M\left(G-1\right)+1\right)·N_a\left(t\right)+M\left(G-1\right)·\left(M\left(G-1\right)+1\right)·\frac{\Delta t}{T_s},\end{array}& \left(14\right)\end{array}$

where M is a number of optical amplifiers along the quantum channel 10a, G is an amplification factor of one optical amplifier. Thus, M=D_AB/d and G=1/T, where D_AB IS the distance between the transmitter device 11 and the receiver device 12, d is the distance between neighboring optical amplifiers and T=10^−0.02·d is an attenuation parameter of an optical fiber. The number of photons and the optical power P_a(t) at time t with the time discretization Δt are related as follows:

$\begin{array}{cc}{N}_a\left(t\right)=\frac{\Delta t}{\hslash \Omega }·P_a\left(t\right),& \left(15\right)\end{array}$

wherein ℏΩ is the energy of one photon. In order to determine the (first decoder) value of one (first) bit of the decoder initial bit sequence in the receiver device 12, a first measured correlator difference ΔQ from the approximate intensity profile {Ñ(t)}_t and ideal approximate intensity profiles {N₀(t)}_t and {N₁(t)}_t for first encoder value 0 and 1, respectively, is determined.

For establishing the procedure to determine first decoder value a, the statistical properties of correlators Q_a⁽⁰⁾, Q_a⁽¹⁾ between ideal approximate intensity profiles and noisy approximate intensity profiles are analyzed in the following. The correlators Q_a⁽⁰⁾, Q_a⁽¹⁾ are defined as:

$\begin{array}{cc}\begin{array}{cc}{Q}_a^{\left(0\right)}=\frac{{\sum }_t{N}_0\left(t\right)·{\tilde{N}}_a\left(t\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)},& Q_a^{\left(1\right)}=\frac{{\sum }_t{N}_1\left(t\right)·{\tilde{N}}_a\left(t\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)},\end{array}& \left(16\right)\end{array}$

wherein Σ_tN₀(t)N₁(t) is a normalization factor. The correlators may be treated as Gaussian random variables, since they can be represented as weighted sums of Gaussian variables. Hence, the difference between Q_a⁽⁰⁾ and Q_a⁽¹⁾ (correlator difference for value a),

$\begin{array}{cc}\Delta Q_a=Q_a^{\left(0\right)}-Q_a^{\left(1\right)}=\frac{{\sum }_t\left(N_0\left(t\right)-N_1\left(t\right)\right)·{\tilde{N}}_a\left(t\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)},& \left(17\right)\end{array}$

can be assumed to be normally distributed as well. Considering the relation between optical power and photon number according to Eq. (15), the mean value of the correlator difference ΔQ_a (correlator mean difference e_a) is

$\begin{array}{cc}{e}_a=𝔼\left[\Delta Q_a\right]=\frac{{\sum }_t\left(N_0\left(t\right)-N_1\left(t\right)\right)·𝔼\left[{\tilde{N}}_a\left(t\right)\right]}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)}=\frac{{\sum }_t\left(N_0\left(t\right)-N_1\left(t\right)\right)·\left(N_a\left(t\right)+\frac{\Delta t}{T_s}M\left(G-1\right)\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)}=\frac{{\sum }_t\left(P_0\left(t\right)-P_1\left(t\right)\right)·\left(P_a\left(t\right)+\frac{\hslash \Omega }{T_s}M\left(G-1\right)\right)}{{\sum }_t{P}_0\left(t\right)P_1\left(t\right)}=\frac{{\sum }_t\left(P_0\left(t\right)-P_1\left(t\right)\right)·P_a\left(t\right)}{{\sum }_t{P}_0\left(t\right)P_1\left(t\right)}.& \left(18\right)\end{array}$

The correlator mean difference e_a can thus be explicitly represented as a sum of Gaussian random variables. Hence, using Eq. (15), the variance of the correlator difference ΔQ_a is also a weighted sum of variances:

$$\begin{gathered} \begin{array}{cc}{\sigma }_a^2=𝔻\left[\Delta Q_a\right]=\frac{{\sum }_t{\left(N_0\left(t\right)-N_1\left(t\right)\right)}^2·𝔻\left[{\tilde{N}}_a\left(t\right)\right]}{{\left({\sum }_t{N}_0\left(t\right)N_1\left(t\right)\right)}^2}=\text{ \\ ∑t⁢(N0(t)-N1(t))2·((2⁢M⁢(G-1)+1)·Na⁢(t)+M⁢(G-1)·(M⁢(G-1)+1)·Δ⁢tTs)(∑t⁢N0(t)⁢N1(t))2=(h⁢ΩΔ⁢t)·∑t⁢(P0(t)-P1(t))2·((2⁢M⁡(G-1)+1)·Pa(t)+M⁡(G-1)·(M⁡(G-1)+1)·ℏΩTs)(∑t⁢P0(t)⁢P1(t))2.}& \left(19\right)\end{array} \end{gathered}$$

In summary, the correlator difference ΔQ_a can be treated as a normally distributed random variable with mean value e_a (Eq. (18)) and variance σ_a² (Eq. (19)). Thus, the probability of a measurement result for the correlator difference ΔQ under the condition, that sent bit has first encoder value a, is as follows:

$\begin{array}{cc}p\left(\Delta Q❘a\right)=\frac{1}{\sqrt{2\pi {\sigma }_a^2}}·\exp \left(-\frac{{\left(\Delta Q-e_a\right)}^2}{2{\sigma }_a^2}\right)& \left(20\right)\end{array}$

According to Bayes' rule, the probability that the sent bit had first encoder value a—under the condition that the measured correlator difference has value ΔQ—can be written as

$\begin{array}{cc}p\left(a❘\Delta Q\right)=\frac{p\left(\Delta Q❘a\right)}{p\left(\Delta Q❘0\right)+p\left(\Delta Q❘1\right)}=\frac{\frac{1}{{\sigma }_a}·\exp \left(-{\left(\Delta Q-e_a\right)}^2/2{\sigma }_a^2\right)}{\frac{1}{{\sigma }_0}\exp \left(-{\left(\Delta Q-e_0\right)}^2/2{\sigma }_0^2\right)+\frac{1}{{\sigma }_1}·\exp \left(-{\left(\Delta Q-e_1\right)}^2/2{\sigma }_1^2\right)}.& \left(21\right)\end{array}$

For further post-selection and error correction procedures, a (first) threshold value ΔQ is determined so that p(0|ΔQ)=p(1|ΔQ). In other words, both bit values are equiprobable if ΔQ is measured, i.e.:

$\begin{array}{cc}\frac{1}{{\sigma }_0}·\exp \left(-{\left(\stackrel{\_}{\Delta Q}-e_0\right)}^2/2{\sigma }_0^2\right)=\frac{1}{{\sigma }_1}·\exp \left(-{\left(\stackrel{\_}{\Delta Q}-e_1\right)}^2/2{\sigma }_1^2\right).& \left(22\right)\end{array}$

To provide an estimate of ΔQ, it can be assumed that of σ₀²≈σ₁². Hence,

$\begin{array}{cc}\begin{array}{ccc}{\left(\stackrel{\_}{\Delta Q}-e_0\right)}^2\approx {\left(\stackrel{\_}{\Delta Q}-e_1\right)}^2& \Rightarrow & \stackrel{\_}{\Delta Q}\approx \frac{\left(e_0+e_1\right)}{2}.\end{array}& \left(23\right)\end{array}$

For a determined threshold value ΔQ, it may be decided on the first decoder value of the first bit (the reconstruction in the receiver device 12 of the first encoder value of the first bit from the transmitter device 11) as follows.

From the approximate intensity profile {Ñ(t)}_t, i.e., from the measured intensity values Ñ(t), the (first) measured correlator difference ΔQ (which can be expressed as the difference from the correlators Q⁽⁰⁾ and Q⁽¹⁾) is determined by:

$\begin{array}{cc}\Delta Q=Q^{\left(0\right)}-Q^{\left(1\right)}=\frac{{\sum }_t{N}_0\left(t\right)\tilde{N}\left(t\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)}-\frac{{\sum }_t{N}_1\left(t\right)\tilde{N}\left(t\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)}=\frac{{\sum }_t\left(N_0\left(t\right)-N_1\left(t\right)\right)·\tilde{N}\left(t\right)}{{\sum }_t{N}_0\left(t\right)N_1\left(t\right)}& \left(24\right)\end{array}$

In case the measured correlator difference ΔQ is greater than the threshold value ΔQ, i.e., ΔQ>ΔQ, it is decided that the first encoder value of the first bit (generated in the transmitter device 11) had been 0 and the first decoder value of the first bit is determined in the receiver device 12 as 0. In case ΔQ<ΔQ, the first decoder value of the first bit is determined in the receiver device 12 as 1. In summary:

$\begin{array}{cc}\begin{array}{cc}\Delta Q>\stackrel{\_}{\Delta Q}\to \mathrm{bit}\mathrm{value}0,& \Delta Q<\stackrel{\_}{\Delta Q}\to \mathrm{bit}\mathrm{value}1.\end{array}& \left(25\right)\end{array}$

In another example, in case an approximate phase profile {{tilde over (Π)}(t)}_t is determined, a second measured correlator difference ΔR=R⁽⁰⁾−R⁽¹⁾ can analogously be determined from measured phase values {circumflex over (Π)}(t) by

$\begin{array}{cc}\Delta R=\frac{{\sum }_t\left({\prod }_0\left(t\right)-{\prod }_1\left(t\right)\right)·\prod ^{~}\left(t\right)}{{\sum }_t{\prod }_0\left(t\right){\prod }_1\left(t\right)}& \left(26\right)\end{array}$

and be compared with a second threshold value ΔR in order to determine the second decoder value of the second bit (as a reconstruction in the receiver device 12 of the second encoder value of the second bit from the transmitter device 11).

(d) Classical Post-Processing and Key Generation Rate

In this section, certain aspects of the classical post-processing steps (including post-selection, error correction and privacy amplification—steps 26 to 28) carried out in the transmitter device 11 and/or the receiver device 12 will be described in more detail. During these steps, (further) classical information is exchanged between the transmitter device 11 and the receiver device 12.

At the post-selection stage (step 26), measurement results which do not lead to an information advantage with respect to the eavesdropping device 13 are discarded by the receiver device 12.

In particular, measurement results and/or value allocations of the at least one first (second bit) of the decoder initial bit sequence may be discarded based on the first (second) measured correlator difference ΔQ (ΔR) being greater or smaller than the first (second) threshold value ΔQ(ΔR) by a first (second) post-selection parameter θ ({tilde over (θ)}).

In case of a single first bit of the decoder initial bit sequence, allocating the first decoder value may thus be carried out as follows:

$\Delta Q>\stackrel{\_}{\Delta Q}+\theta \to \mathrm{bit}o,\Delta Q<\stackrel{\_}{\Delta Q}-\theta \to \mathrm{bit}1,\stackrel{\_}{\Delta Q}-\theta \le \Delta Q\le \stackrel{\_}{\Delta Q}+\theta \to \mathrm{discard}.$

The four value may be allocated analogously. The first (second) post-selection parameter θ ({tilde over (θ)}) may be a non-negative value, and is preferably determined such that a resulting key generation rate is maximized.

The normalized key generation rate after error correction and privacy amplification may be expressed as

$\begin{array}{cc}\frac{L_f}{L}=p(\surd )·\left(I\left(A:B\right)-I\left(A:E\right)\right),& \left(27\right)\end{array}$

wherein L is the length of the encoder initial bit sequence generated in the transmitter device 11. The expression in Eq. (27) and its constituting terms will be derived in the following subsection.

FIG. 6 shows a plot of the normalized key generation rate L_ƒ/L as a function of the portion of the intercepted signal r_E (signal leakage value) for different distances d between neighboring optical amplifiers when employing the intensity profiles according to Eq. (10) and Eq. (11), i.e.,

$P_0\left(t\right)=P^{\prime }+P^{″}·\cos \left(\frac{2\pi \left(f_1-f_0\right)}{3T_s^2}·t^3+2\pi f_0·t\right),P_1\left(t\right)=P^{\prime }+P^{″}·\cos \left(\frac{2\pi \left(f_0-f_1\right)}{3T_s^2}·t^3+2\pi f_1·t\right),P^{\prime }={10}^{-8}W,P^{″}={10}^{-9}W,T_s=100\mathrm{ns},f_0=90\mathrm{MHz},\mathrm{and}{f}_1=110\mathrm{MHz}.$

The distance between the transmitter device 11 and the receiver device 12 is D_AB=1000 km. The key generation rate is obtained by numerical optimization over the post-selection parameter θ. For the considered signal leakage values r_E, the optimal post-selection parameter θ lies in the interval [0.08; 0.1]. These values are of the order of the difference between the correlator mean differences |e₁−e₀|.

Derivation of the Key Generation Rate

For the mutual information I(A:B) between the transmitter device 11 and the receiver device 12, the conditional probabilities p(0|a), p(1|a) of obtaining bit value b∈{0,1} in case of bit a is sent are determined as follows:

$\begin{array}{cc}p\left(0❘a\right)=p\left(\Delta Q>\stackrel{\_}{\Delta Q}+\theta ❘a\right)=\underset{\stackrel{\_}{\Delta Q}+\theta }{\overset{+\infty }{\int }}\frac{1}{\sqrt{2\pi {\sigma }_a^2}}·\exp \left(-\frac{{\left(\Delta Q-e_a\right)}^2}{2{\sigma }_a^2}\right)d\left(\mathrm{\Delta Q}\right)=\frac{1}{\sqrt{\pi }}·\stackrel{+\infty }{\underset{\frac{\stackrel{\_}{\Delta Q}+\theta -e_a}{\sqrt{2{\sigma }_a^2}}}{\int }}\exp \left(-x^2\right)\mathrm{dx}=\frac{1}{2}·\mathrm{erfc}\left(\frac{\theta +\stackrel{\_}{\Delta Q}-e_a}{\sqrt{2{\sigma }_a^2}}\right)& \left(28\right)\end{array}$ $\mathrm{and}$ $\begin{array}{cc}p\left(1❘a\right)=p\left(\Delta Q<\stackrel{\_}{\Delta Q}-\theta ❘a\right)=\frac{1}{2}·\mathrm{erfc}\left(\frac{\theta -\stackrel{\_}{\Delta Q}+e_a}{\sqrt{2{\sigma }_a^2}}\right).& \left(29\right)\end{array}$

Eq. (28) and Eq. (29) can be combined as

$\begin{array}{cc}p\left(b❘a\right)=\frac{1}{2}·\mathrm{erfc}\left(\frac{\theta +{\left(-1\right)}^b·\left(\stackrel{\_}{\Delta Q}-e_a\right)}{\sqrt{2{\sigma }_a^2}}\right).& \left(30\right)\end{array}$

Hence, the mutual information I(A:B) between the transmitter device 11 and the receiver device 12 is:

$\begin{array}{cc}I\left(A:B\right)=H\left(A\right)+H\left(B\right)-H\left(\mathrm{AB}\right)=h_2\left(\sum _{b=0,1}\frac{p\left(b❘0\right)}{p(\surd )}\right)+h_2\left(\sum _{a=0,1}\frac{p\left(0❘a\right)}{2p(\surd )}\right)+\sum _{a=0,1}\sum _{b=0,1}\frac{p\left(b❘a\right)}{2p(\surd )}·{\log }_2\left(\frac{p\left(b❘a\right)}{2p(\surd )}\right),& \left(31\right)\end{array}$

and the probability for a conclusive result p(✓) is:

$\begin{array}{cc}p(\surd )=\frac{1}{2}\sum _{a=0,1}\sum _{b=0,1}p\left(b❘a\right),& \left(32\right)\end{array}$

where H(X) is the Shannon entropy of a system X, h₂(x)=−x·log₂(x)−(1−x)·log₂(1−x) is the binary entropy function.

LDPC codes provide a more efficient error correction if the error probability for each bit is estimated independently instead of a collective estimation of an average error. In such a case, the mutual information I(A:B) between the transmitter device 11 and the receiver device 12 according to Eq. (31) becomes:

$\begin{array}{cc}I\left(A:B\right)=1-\underset{-\infty }{\overset{\stackrel{\_}{\Delta Q}-\theta }{\int }}{h}_2\left(p\left(0❘\Delta Q\right)\right)·\left(\frac{p\left(\Delta Q❘0\right)+p\left(\Delta Q❘1\right)}{2}\right)d\Delta Q-\underset{\stackrel{\_}{\Delta Q}+\theta }{\overset{+\infty }{\int }}{h}_2\left(p\left(1❘\Delta Q\right)\right)·\left(\frac{p\left(\Delta Q❘0\right)+p\left(\Delta Q❘1\right)}{2}\right)d\Delta Q& \left(33\right)\end{array}$

By introducing, J₀ and J₁ with

$J_0\equiv \frac{1}{2\sqrt{2\pi }}\underset{-\infty }{\overset{\stackrel{\_}{\Delta Q}-\theta }{\int }}{h}_2\left(\frac{\exp \left(\frac{-{\left(\Delta Q-e_0\right)}^2}{2{\sigma }_0^2}\right)/{\sigma }_0}{\exp \left(\frac{-{\left(\Delta Q-e_0\right)}^2}{2{\sigma }_0^2}\right)/{\sigma }_0+\exp \left(\frac{-{\left(\Delta Q-e_1\right)}^2}{2{\sigma }_1^2}\right)/{\sigma }_1}\right)·\left(\frac{\exp \left(\frac{-{\left(\Delta Q-e_0\right)}^2}{2{\sigma }_0^2}\right)}{{\sigma }_0}+\frac{\exp \left(\frac{-{\left(\Delta Q-e_1\right)}^2}{2{\sigma }_1^2}\right)}{{\sigma }_1}\right)d\Delta Q$ $\mathrm{and}$ $J_1\equiv \frac{1}{2\sqrt{2\pi }}\underset{\stackrel{\_}{\Delta Q}+\theta }{\overset{\infty }{\int }}{h}_2\left(\frac{\exp \left(\frac{-{\left(\Delta Q-e_1\right)}^2}{2{\sigma }_1^2}\right)/{\sigma }_0}{\exp \left(\frac{-{\left(\Delta Q-e_0\right)}^2}{2{\sigma }_0^2}\right)/{\sigma }_0+\exp \left(\frac{-{\left(\Delta Q-e_1\right)}^2}{2{\sigma }_1^2}\right)/{\sigma }_1}\right)·\left(\frac{\exp \left(\frac{-{\left(\Delta Q-e_0\right)}^2}{2{\sigma }_0^2}\right)}{{\sigma }_0}+\frac{\exp \left(\frac{-{\left(\Delta Q-e_1\right)}^2}{2{\sigma }_1^2}\right)}{{\sigma }_1}\right)d\Delta Q,$

the mutual information I(A:B) takes the form:

$\begin{array}{cc}I\left(A:B\right)=1-J_0-J_1.& \left(34\right)\end{array}$

Physical loss control (step 21) further restricts possible eavesdropping attacks that may go unnoticed: the only option left for an eavesdropper is to create relatively small artificial signal leakages. In the case of one leakage position with factor r_E at the quantum channel 10a in the vicinity of the transmitter device 11, the mutual information I(A: E) between the eavesdropping device 13 and the transmitter device 11 can be estimated as the i.e., Holevo quantity of the ensemble

$\{(\frac{1}{2},❘\sqrt{r_E}{\alpha }_0\rangle ),(\frac{1}{2},❘\sqrt{r_E}{\alpha }_1\rangle )\},$

i.e.,

$\begin{array}{cc}I\left(A:E\right)=h_2\left(\frac{1-❘\langle {\alpha }_0❘{\alpha }_1\rangle {❘}^{r_E}}{2}\right),& \left(35\right)\end{array}$

wherein

$\begin{array}{cc}|\langle {\alpha }_0|{\alpha }_1\rangle {|}^{r_E}=\exp \left(-\frac{r_E}{2\hslash \Omega }\underset{0}{\overset{T}{\int }}{\left\{\sqrt{P_0\left(t\right)}-\sqrt{P_1\left(t\right)}\right\}}^{2}dt\right).& \left(36\right)\end{array}$

From this, the final key generation rate L_ƒ/L after error correction and privacy amplification procedures according to Eq (27) is obtained using the Devetak-Winter equation.

The scalar product |(α₀|α₁ may be determined as follows.

Derivation of the Scalar Product

Optical pulses with time-dependent amplitude F(t)e^iΩt∈ (with intensity profile F(t) and carrier frequency Ω) are generated, for instance, by the laser 40 with the frequency Ω and controlled attenuation and phase-shifts (see above section c). The normalized amplitude ƒ(t)e^iΩt and the normalized intensity profile ƒ(t) can be expressed as follows:

$\begin{array}{cc}f\left(t\right)e^{i\Omega t}=\frac{F\left(t\right)e^{i\Omega t}}{\sqrt{\int |F\left(t\right){|}^{2}dt}},f\left(t\right)=\frac{F\left(t\right)}{\sqrt{\int |F\left(t\right){|}^{2}dt}},& \left(37\right)\end{array}$

where the integral is taken over or over the subspace {t|F(t)≠0}. Hence, ∫dt|ƒ(t)|²=1. The spectrum of the considered intensity profile can be found as the Fourier transform of the normalized amplitude ƒ(t)e^iΩt, i.e.,

$\begin{array}{cc}FT\left[f\left(t\right)e^{i\Omega t}\right]\left(\omega \right)=\frac{1}{\sqrt{2\pi }}\underset{ℝ}{\int }\mathrm{dt}f\left(t\right)e^{i\Omega t}{e}^{-i\omega t}=FT\left[f\left(t\right)\right]\left(\Omega -\omega \right)\equiv \tilde{f}\left(\Omega -\omega \right)& \left(38\right)\end{array}$

The normalized intensity profile ƒ(t) may define the light quantum mode. The creation operator associated with the mode is

$\begin{array}{cc}{\hat{b}}_f^{†}=\underset{ℝ}{\int }d\omega \tilde{f}\left(\Omega -\omega \right){\hat{a}}_{\omega }^{†}& \left(39\right)\end{array}$

By introducing the further operator

$\begin{array}{cc}{\hat{a}}_t^{†}\equiv \frac{1}{\sqrt{2\pi }}\underset{ℝ}{\int }d\omega e^{-i\omega t}{\hat{a}}_{\omega }^{†}\mathrm{with}& \left(40\right)\end{array}$ $\begin{array}{cc}\left[{\hat{a}}_{t_1},{\hat{a}}_{t_2}^{†}\right]=\frac{1}{2\pi }\underset{{ℝ}^2}{\int }d{\omega }_{1}d{\omega }_2{e}^{i\left(-{\omega }_2{t}_2+{\omega }_1{t}_1\right)}\left[{\hat{a}}_{{\omega }_1},{\hat{a}}_{{\omega }_2}^{†}\right]=\frac{1}{2\pi }\underset{{ℝ}^2}{\int }d{\omega }_{1}d{\omega }_2{e}^{i\left(-{\omega }_2{t}_2+{\omega }_1{t}_1\right)}\delta \left({\omega }_1-{\omega }_2\right)=\delta \left(t_1-t_2\right),& \left(41\right)\end{array}$

the creation operator can be written as:

$\begin{array}{cc}{\hat{b}}_f^{†}=\underset{ℝ}{\int }\mathrm{dt}f\left(t\right)e^{i\Omega t}{\hat{a}}_t^{†}.& \left(42\right)\end{array}$

The creation operator {circumflex over (b)}₅^† consists of photon creations for times t, described by the further operators â_t^†, with weights ƒ(t). The phase factor e^iΩt appears due to time evolution of excited atoms in the laser medium. The commutation relation for new operators are as follows:

$\begin{array}{cc}\left[{\hat{b}}_f,{\hat{b}}_f^{†}\right]=\int d{t}_{1}d{t}_2·f*\left(t_1\right)e^{-i\Omega t_1}·f\left(t_2\right)e^{i\Omega t_2}·\left[{\hat{a}}_{t_1},{\hat{a}}_{t_2}^{†}\right]=\int \mathrm{dt}{❘f\left(t\right)❘}^2=1.& \left(43\right)\end{array}$

A coherent state |α> in the mode ƒ(t) is defined as an eigenstate of the corresponding annihilation operator:

$\begin{array}{cc}{\hat{b}}_f❘\alpha ,f\rangle =\alpha ❘\alpha ,f\rangle \Rightarrow ❘\alpha ,f\rangle =\exp \left(-\frac{|\alpha {|}^2}{2}\right)·\sum _{n=0}^{\infty }\frac{{\alpha }^n}{n!}{\left({\hat{b}}_f^{†}\right)}^n❘0\rangle .& \left(44\right)\end{array}$

α may a real non-negative number. Thus, all information about the time-dependent phase of the pulse is included in the complex-valued function ƒ(t):

$\begin{array}{cc}{\alpha }^2=|\alpha {|}^2={❘\alpha ❘}^2·\int \mathrm{dt}{❘f\left(t\right)❘}^2=\int \mathrm{dt}{❘F\left(t\right)❘}^2.& \left(45\right)\end{array}$

The scalar product of Fock states in different modes ƒ(t) and g(t) is calculated as follows:

$\begin{array}{cc}\langle m,g|n,f\rangle =\langle 0\left|\frac{{\left({\hat{b}}_g\right)}^m}{\sqrt{m!}}·\frac{{\left({\hat{b}}_f^{†}\right)}^n}{\sqrt{n!}}\right|0\rangle =\langle 0\left|\frac{1}{\sqrt{m!}}{\left(\int dt·g*\left(t\right)·e^{-i\Omega t}·{\hat{a}}_t\right)}^m·\frac{1}{\sqrt{n!}}{\left(\int \mathrm{dT}·f\left(T\right)·e^{i\Omega T}·{\hat{a}}_T^{†}\right)}^n\right|0\rangle =\frac{1}{\sqrt{m!n!}}\underset{{ℝ}^m}{\int }d{t}_{1}g*\left(t_1\right)\dots {\mathrm{dt}}_{m}g*\left(t_m\right)·e^{-i\Omega \Sigma t}\underset{{ℝ}^n}{\int }d{T}_{1}f\left(T_1\right)\dots {\mathrm{dT}}_n·e^{i\Omega \Sigma T}f\left(T_n\right)·\langle 0\left|{\hat{a}}_{t_1}\dots {\hat{a}}_{t_m}·{\hat{a}}_{T_1}^{†}\dots {\hat{a}}_{T_n}^{†}\right|0\rangle =\frac{1}{\sqrt{m!n!}}\underset{{ℝ}^m}{\int }d{t}_{1}g*\left(t_1\right)\dots {\mathrm{dt}}_{m}g*\left(t_m\right)\underset{{ℝ}^n}{\int }d{T}_{1}f\left(T_1\right)\dots {\mathrm{dT}}_{n}f\left(T_n\right)·\left({\delta }_{nm}·\sum _{\sigma }\prod _{i=1}^n\delta \left(T_{\sigma \left(i\right)}-t_i\right)\right)=\frac{{\delta }_{nm}}{n!}·n!·\int d{t}_{1}g*\left(t_1\right)f\left(t_1\right)\dots {\mathrm{dt}}_{n}g*\left(t_n\right)f\left(t_n\right)={\delta }_{nm}{\left(\int \mathrm{dt}·f*\left(t\right)·g\left(t\right)\right)}^n,& \left(46\right)\end{array}$

wherein the sum is taken over all permutations σ on a set {1, . . . , n}. After integration, each of the n! components, corresponding to different permutations, contributes equally to the overall sum, which results in the factor n!.

The scalar product of differently shaped coherent states (i.e., of coherent states in different modes) can be calculated as

$$\begin{gathered} \begin{array}{cc}\langle \beta ,g|\alpha ,f\rangle =\exp \left(-\frac{{\beta }^2}{2}\right)·\exp \left(-\frac{{\alpha }^2}{2}\right)\sum _{n,m=0}^{\infty }\frac{{\beta }^m·{\alpha }^n}{\sqrt{m!n!}}\left(\langle m,g|n,f\rangle \right)=\text{ \\ =exp⁢(-β22)·exp⁢(-α22)·exp⁢(βα⁢∫dt·g*(t)·f⁡(t))= \\ =exp⁢(-12⁢∫dt⁢{|β·g⁡(t)|2-2⁢β·g*(t)·α·f⁡(t)+|α·f⁡(t)|2}).}& \left(47\right)\end{array} \end{gathered}$$

Thus:

$\begin{array}{cc}\langle \beta ,g|\alpha ,f\rangle =\exp \left(-\frac{1}{2}\int dt\left\{\left|G\left(t\right){|}^2-2G*\left(t\right)·F\left(t\right)+\right|F\left(t\right){|}^2\right\}\right)& \left(48\right)\end{array}$

Eq. (48) describes the most general case. Since each intensity profile F(t), G(t) for fixed time t is a complex number, they may be expressed in terms of absolute value and phase by F(t)=|F(t)|e^iϕF(t) and G(t)=|G(t)|e^iϕG(t). For two modulated states that differ only by a constant phase factor and average photon number, an expression of the scalar product of standard coherent states may be obtained.

In the exemplary case of constant phases (ϕ_F(t)=ϕ_G(t)=const, i.e., only the intensity profiles |F(t)|², |G(t)|² are time-dependent functions), the scalar product is:

$\begin{array}{cc}{❘\langle \beta ,g|\alpha ,f\rangle ❘}^2=\exp \left(-\int \mathrm{dt}·{\left\{❘F\left(t\right)❘-❘G\left(t\right)❘\right\}}^2\right).& \left(49\right)\end{array}$

By expressing the intensity profile in terms of optical power P_F(t) (energy density in time) as opposed to in terms of photon number density in time |F(t)|² (wherein ℏΩ·|F(t)|²=P_F(t) with the energy of one photon being ℏΩ, the scalar product can be expressed as:

$\begin{array}{cc}{❘\langle \beta ,g|\alpha ,f\rangle ❘}^2=\exp \left(-\frac{1}{\hslash \Omega }\int \mathrm{dt}·{\left\{\sqrt{P_F\left(t\right)}-\sqrt{P_G\left(t\right)}\right\}}^2\right)& \left(50\right)\end{array}$

Eq. (48) can be alternatively derived as follows. Using |α|²=∫dt|F(t)|² and |β|²=§ dt|G(t)|² with real α and β, the two coherent states can be written as

$\begin{array}{cc}❘F\rangle =\exp \left(\int dtF\left(t\right){\hat{a}}_t^{†}-h.c.\right)❘0\rangle =\exp \left(\alpha {\hat{b}}_f^{†}-h.c.\right)❘0\rangle =e^{\alpha {\hat{b}}_f^{†}}❘0\rangle e^{-{❘\alpha ❘}^2/2}=❘\alpha ,f\rangle .& \left(51\right)\end{array}$

Similarly, |G=|β, g=e^βbg|0e^−|β|2/2, using e^X+Y=e^Xe^Ye^−[X,Y]/2. The commutator [{circumflex over (b)}_f, {circumflex over (b)}_g^†] can hence be written as:

$\begin{array}{cc}\left[{\hat{b}}_f,{\hat{b}}_9^{†}\right]=\int {\mathrm{dt}}_1{\mathrm{dt}}_2·f*\left(t_1\right)e^{-i\Omega t_1}·g\left(t_2\right)e^{i\Omega t_2}·\left[{â}_{t_1},{â}_{t_2}^{†}\right]==\int {\mathrm{dt}}_1{\mathrm{dt}}_2·f*\left(t_1\right)e^{-i\Omega t_1}·g\left(t_2\right)e^{i\Omega t_2}·\delta \left(t_1-t_2\right)==\int {\mathrm{dt}}_1·f*\left(t_1\right)·g\left(t_1\right)==\frac{\int {\mathrm{dt}}_1·F*\left(t_1\right)·G\left(t_1\right)}{\sqrt{\int {❘F\left(t\right)❘}^2\mathrm{dt}}\sqrt{\int {❘G\left(t\right)❘}^2\mathrm{dt}}}.& \left(52\right)\end{array}$

Using e^X+Y=e^Xe^Ye^−[X,Y]/2=e^Ye^Xe^[X,Y]/2, the scalar product α, ƒ|β, g is:

$\begin{array}{cc}\begin{array}{cc}\langle \alpha ,f❘\beta ,g\rangle & =e^{-\frac{{❘\alpha ❘}^2+{❘\beta ❘}^2}{2}}\langle 0❘e^{\beta {\hat{b}}_f}{e}^{\alpha {\hat{b}}_g^{†}}❘0\rangle \\ & =e^{-\frac{{❘\alpha ❘}^2+{❘\beta ❘}^2}{2}}\langle 0❘e^{\alpha {\hat{b}}_g^{†}}{e}^{\beta {\hat{b}}_f}{e}^{\alpha \beta \left[{\hat{b}}_f,{\hat{b}}_g^{†}\right]}❘0\rangle \\ & =e^{-\frac{{❘\alpha ❘}^2+{❘\beta ❘}^2}{2}}{e}^{\mathrm{\alpha \beta }C\left[F,G\right]}\langle 0❘e^{\alpha {\hat{b}}_g^{†}}{e}^{\beta {\hat{b}}_f}❘0\rangle \\ & =\exp \left(\mathrm{\alpha \beta }C\left[F,G\right]-\frac{{❘\alpha ❘}^2+{❘\beta ❘}^2}{2}\right)\\ & =\exp \left(\frac{1}{2}\int \mathrm{dt}·\left(2F*\left(t\right)·G\left(t\right)-{❘F\left(t\right)❘}^2-{❘G\left(t\right)❘}^2\right)\right)\end{array}& \left(53\right)\end{array}$

(e) Comparison with Phase Coding

To illustrate the effectiveness of the proposed intensity/phase profile coding method, the key generation rates of other coding methods may be compared.

A plot of the key generation rate for phase coding (for different values of input optical power P (0.05 nW and 0.1 nW)) and for the proposed method (“shape coding”) as a function of r_E is shown in FIG. 7. The length of the quantum channel 10a is 1000 km with a distance of 50 km between neighboring optical amplifiers. The values for shape coding correspond to the values for d=50 km in FIG. 6. As illustrated by FIG. 7, the proposed coding method is more robust for increased of leakage values r_E than phase coding. Thus, the proposed coding method allows legitimate users to utilize high intensity quantum states with weak distinguishability.

In phase coding, optical pulses corresponding to different logical bits have phases differing by π or, alternatively, by some other value. Here, both optical pulses have identical arbitrary intensity profiles, which do not affect security analysis.

Thus, a constant (time-independent) intensity profile may be considered for comparison. To produce such states, no Mach-Zehnder interferometer needs to be employed but merely one controllable phase modulator. In the case of phase difference π, the scalar product (Eq. (50)) of the quantum states intercepted by the eavesdropper reads:

$\begin{array}{cc}{❘\langle {\alpha }_0❘{\alpha }_1\rangle ❘}^{r_E}=\exp \left(-\frac{r_E}{2\hslash \Omega }\underset{0}{\overset{T}{\int }}{\left\{\sqrt{P_0\left(t\right)}+\sqrt{P_1\left(t\right)}\right\}}^2\mathrm{dt}\right),& \left(54\right)\end{array}$

wherein the optical power terms are equal and do not depend on time: P₀(t)=P₁(t)=P. Here, the eavesdropping device 13 is assumed to be at the quantum channel 10a close to the transmitter device 11. Thus, there are no additional correlations between the subsystems of the eavesdropping device 13 and the receiver device 12, caused by the optical amplifiers. Hence, the Holevo value of the ensemble of pure states may be employed for estimating the intercepted information. The error probability p_err and the probability p(✓) of a conclusive result at the receiver device are as follows:

$\begin{array}{cc}{p}_{\mathrm{err}}=\frac{1}{2}·\left(1-\mathrm{erf}\left(\frac{\sqrt{2}\left(\theta +\sqrt{\overline{N}\left(1-r_E\right)}\right)}{\sqrt{1+2\left(G-1\right)}}\right)\right),p(\surd )=1-\frac{1}{2}·\mathrm{erf}\left(\frac{\sqrt{2}\left(\theta -\sqrt{\overline{N}(1-r_E}\right))}{\sqrt{1+2\left(G-1\right)}}\right)-\frac{1}{2}·\mathrm{erf}\left(\frac{\sqrt{2}\left(\theta +\sqrt{\overline{N}\left(1-r_E\right)}\right)}{\sqrt{1+2\left(G-1\right)}}\right),& \left(55\right)\end{array}$

wherein θ is the post-selection parameter and N=P·T_s/(ℏΩ) is the average total number of photons in each optical pulse. A sequence of optical amplifiers and losses can be reduced to one pair of loss and amplification. G=1+(10^0.02·d−1). D_AB/d is the effective amplification factor. Since all probabilities are determined, one may estimate the key generation rate analogous to Eq. (27).(f) Comparison with Intensity Coding

In intensity coding, different logical bits get encoded into coherent states with differing mean numbers of photons (i.e., different mean optical powers). Thus, optical pulses corresponding to different bit values have the same time distribution of photons but a different average number of photons.

FIG. 8 shows a plot of the key generation rate for intensity coding and for the proposed method (“shape coding”) as a function of r_E. The length of the quantum channel 10a is 1000 km with a distance of 50 km between neighboring optical amplifiers. The values for shape coding correspond to the values for d=50 km in FIG. 6. As illustrated by the figure, the proposed method provides an increased key generation rate for given r_E.

To prepare quantum states with intensity coding, the transmitter device 11 may control only the first phase shift φ(t). For the purpose of security analysis, it is sufficient to consider rectangular pulses with constant phase value zero. After preparation, the pure quantum states pass through a quantum channel 11a comprising optical amplifiers. Hence, the resulting quantum states at the receiver device 12 are mixed:

$\begin{array}{cc}“0”\mapsto ❘{\alpha }_0\rangle \langle {\alpha }_0❘\mapsto {\rho }_0,“1”\to ❘{\alpha }_1\rangle \langle {\alpha }_1❘\mapsto {\rho }_1,& \left(56\right)\end{array}$

wherein |α_a are coherent states with α_a∈. To distinguish between the mixed states ρ₀ and ρ₁, simple intensity measurements can be carried out in the receiver device 12. The photon-number distributions may be approximated by Gaussian distributions. Thus, the random variable describing the outcomes of a measurement in the receiver device 12 with bit “a” has a normal distribution with the following parameters:

$\begin{array}{cc}{e}_a=𝔼\left[{\tilde{N}}_a\right]=N_a+M\left(G-1\right)=\frac{T_s}{\hslash \Omega }{P}_a+M\left(G-1\right),& \left(57\right)\end{array}$ ${\sigma }_a^2=𝔻\left[{\tilde{N}}_a\right]=\left(2M\left(G-1\right)+1\right)·N_a+M\left(G-1\right)·\left(M\left(G-1\right)+1\right),$

wherein M denotes the number of optical amplifiers along the quantum channel 10a and G denotes the amplification factor of each amplifier. The variables P₀₍₁₎ denote the average optical powers of each signal. The discrete value N may be treated as a continuous value so that the probability density distributions describing the outcomes of the measurements may be expressed as follows:

$\begin{array}{cc}p\left(N❘a\right)\equiv p(\mathrm{measured}N❘\mathrm{sent}\mathrm{bit}“a”)=\frac{1}{\sqrt{2\pi {\sigma }_a^2}}·\exp \left(\frac{-{\left(N-e_a\right)}^2}{2{\sigma }_a^2}\right).& \left(58\right)\end{array}$

Hence,

$\begin{array}{cc}p\left(b=0|a\right)=\frac{1}{\sqrt{2\pi }{\dot{\sigma }}_a}\underset{-\infty }{\overset{\overline{N}-{\theta }_0}{\int }}\exp \left(\frac{-{\left(N-e_a\right)}^2}{2{\sigma }_a^2}\right)\mathrm{dN}=\frac{1}{\sqrt{\pi }}\underset{-\frac{N-{\theta }_0-e_a}{\sqrt{2}·{\sigma }_a}}{\stackrel{+\infty }{\int }}{e}^{-z^2}\mathrm{dz}=\frac{1}{2}\mathrm{erfc}\left(\frac{{\theta }_0-\overline{N}+e_a}{\sqrt{2}·{\sigma }_a}\right),& \left(59\right)\end{array}$ $p\left(b=1|a\right)=\frac{1}{\sqrt{2\pi }{\dot{\sigma }}_a}\underset{\overline{N}+{\theta }_1}{\overset{+\infty }{\int }}\exp \left(\frac{-{\left(N-e_a\right)}^2}{2{\sigma }_a^2}\right)\mathrm{dN}=\frac{1}{\sqrt{\pi }}\underset{-\frac{N+{\theta }_1-e_a}{\sqrt{2}·{\sigma }_a}}{\stackrel{+\infty }{\int }}{e}^{-z^2}\mathrm{dz}=\frac{1}{2}\mathrm{erfc}\left(\frac{{\theta }_1+\overline{N}-e_a}{\sqrt{2}·{\sigma }_a}\right),$

which is equivalent to:

$\begin{array}{cc}p\left(b|a\right)=\frac{1}{2}\mathrm{erfc}\left(\frac{{\theta }_b+{\left(-1\right)}^b·(e_a-\overline{N}}{\sqrt{2}·{\sigma }_a}\right)=\frac{1}{2}\mathrm{erfc}\left(\frac{{\theta }_b+{\left(-1\right)}^b·\left(e_a-e_0/2-e_1/2\right)}{\sqrt{2}·{\sigma }_a}\right)=\frac{1}{2}\mathrm{erfc}\left(\frac{{\theta }_b+{\left(-1\right)}^{a+b}·\left(e_0-e_1\right)/2}{\sqrt{2}·{\sigma }_a}\right).& \left(60\right)\end{array}$

Assuming without loss of generality that e₁>e₀, the error probability can be expressed as

$\begin{array}{cc}{p}_{\mathrm{err}}=\frac{1}{2}·p\left(N<\overline{N}-\theta |1\right)+\frac{1}{2}·p\left(N>\overline{N}+\theta |0\right),& \left(61\right)\end{array}$

wherein N=(e₀+e₁)/2 is the average number of photons in an optical pulse.

Including Eq. (58) yields:

$\begin{array}{cc}{p}_{\mathrm{err}}=\frac{1}{2\sqrt{2\pi }{\sigma }_1}·\underset{-\infty }{\overset{\overline{N}-\theta }{\int }}\exp \left(\frac{-{\left(N-e_1\right)}^2}{2{\sigma }_1^2}\right)\mathrm{dN}+\frac{1}{2\sqrt{2\pi }{\sigma }_0}·\underset{\overline{N}+\theta }{\overset{+\infty }{\int }}\exp \left(\frac{-{\left(N-e_0\right)}^2}{2{\sigma }_0^2}\right)\mathrm{dN}==\frac{1}{2\sqrt{2\pi }{\sigma }_1}\underset{-\infty }{\overset{\overline{N}-\theta -e_1}{\int }}\exp \left(-{\left[\frac{y}{\sqrt{2}{\sigma }_1}\right]}^2\right)\mathrm{dy}+\frac{1}{2\sqrt{2\pi }{\sigma }_0}\underset{\overline{N}+\theta -e_1}{\overset{+\infty }{\int }}\exp \left(-{\left[\frac{y}{\sqrt{2}{\sigma }_0}\right]}^2\right)\mathrm{dy}==\frac{1}{4}·\frac{2}{\sqrt{\pi }}\underset{-\frac{\stackrel{\_}{N}-\theta -e_1}{\sqrt{2}{\sigma }_1}}{\stackrel{+\infty }{\int }}\exp \left(-z^2\right)\mathrm{dz}+\frac{1}{4}·\frac{2}{\sqrt{\pi }}\underset{-\frac{\stackrel{\_}{N}+\theta -e_0}{\sqrt{2}{\sigma }_0}}{\stackrel{+\infty }{\int }}\exp \left(-z^2\right)\mathrm{dz}==\frac{1}{4}\left[\mathrm{erfc}\left(\frac{-\overline{N}+\theta +e_1}{\sqrt{2}{\sigma }_1}\right)+\mathrm{erfc}\left(\frac{\overline{N}+\theta -e_0}{\sqrt{2}{\sigma }_0}\right)\right].& \left(62\right)\end{array}$

Analogously to the preceding section, the resulting expression for the probability of a conclusive outcome is:

$\begin{array}{cc}p(\surd )=\frac{1}{4}\left[\frac{2}{\sqrt{\pi }}\stackrel{\frac{\overline{N}-\theta -e_1}{\sqrt{2}{\sigma }_1}}{\underset{-\infty }{\int }}\exp \left(-z^2\right)\mathrm{dz}+\frac{2}{\sqrt{\pi }}\stackrel{\frac{\overline{N}-\theta -e_0}{\sqrt{2}{\sigma }_0}}{\underset{-\infty }{\int }}\exp \left(-z^2\right)\mathrm{dz}+\frac{2}{\sqrt{\pi }}\stackrel{+\infty }{\underset{\frac{\overline{N}+\theta -e_1}{\sqrt{2}{\sigma }_1}}{\int }}\exp \left(-z^2\right)\mathrm{dz}+\frac{2}{\sqrt{\pi }}\stackrel{+\infty }{\underset{\frac{\overline{N}+\theta -e_0}{\sqrt{2}{\sigma }_0}}{\int }}\exp \left(-z^2\right)\mathrm{dz}\right]==\frac{1}{4}\left[\mathrm{erfc}\left(\frac{-\overline{N}+\theta +e_1}{\sqrt{2}{\sigma }_1}\right)+\mathrm{erfc}\left(\frac{-\overline{N}+\theta +e_0}{\sqrt{2}{\sigma }_0}\right)+\mathrm{erfc}\left(\frac{\overline{N}+\theta -e_1}{\sqrt{2}{\sigma }_1}\right)+\mathrm{erfc}\left(\frac{\overline{N}+\theta -e_0}{\sqrt{2}{\sigma }_0}\right)\right].& \left(63\right)\end{array}$

Corresponding to Eq. (31) and Eq. (32), the mutual information between the transmitter device 11 and the receiver device 12 can be calculated as:

$\begin{array}{cc}I\left(A:B\right)=H\left(A\right)+H\left(B\right)-H=h_2\left(\sum _{b=0,1}\frac{p\left(b|0\right)}{2p(\surd )}\right)+h_2\left(\sum _{a=0,1}\frac{p\left(0|a\right)}{2p(\surd )}\right)+\sum _{a=0,1}\sum _{b=0,1}\frac{p\left(b|a\right)}{2p(\surd )}·{\log }_2\left(\frac{p\left(b|a\right)}{2p(\surd )}\right)p(\surd )=\frac{1}{2}\sum _{a=0,1}\sum _{b=0,1}p\left(b|a\right).& \left(64\right)\end{array}$

Estimating the eavesdropper's information requires the scalar product of the seized quantum states, which for constant phase value and different average photon numbers is:

$\begin{array}{cc}{❘\langle {\alpha }_0|{\alpha }_1\rangle ❘}^{r_E}=\exp \left(-\frac{r_E}{2}·\frac{T_s}{\hslash \Omega }{\left\{\sqrt{P_1}-\sqrt{P_0}\right\}}^2\right)& \left(65\right)\end{array}$

For FIG. 8, the key generation rate for different values of average power

$P=\frac{P_0+P_1}{2}$

was optimized over the power difference |e₀−e₁|. The optimal difference for all the considered P was determined to be about |e₀−e₁|≈10⁻¹·P.

The features disclosed in this specification, the figures and/or the claims may be material for the realization of various embodiments, taken in isolation or in various combinations thereof.

In the present disclosure, due to their (non-trivial) time-dependency, the intensity function and the phase function may be assumed to be non-constant in time. In other words, the intensity function and the phase function may be considered to vary with time. Analogously, the intensity function and the phase function may be considered to vary with the first encoder value and, respectively, second encoder value. Further, the modulating of the intensity profile and the modulating of the phase profile may be considered to depend on time and on the first encoder value and, respectively, the second encoder value.

The time-dependent intensity and/or phase profiles may vary fast in time, making information on the encoded logical bits contained in the scattered radiation very difficult to retrieve for an eavesdropper. Thus, security with respect to conventional encoding routines is substantially increased.

The quantum signal may comprise a plurality of quantum states. For example, each quantum state may correspond to one of the optical pulses. Each optical pulse may comprise a plurality of photons.

Each optical pulse may correspond to an optical wave-packet which starts and ends on a time scale when its (instant) intensity drops to zero and/or below a noise level, which may, e.g., be between 0.01% and 1.0% of the average peak value of the plurality of optical pulses. A pulse length of an optical pulse may correspond to the difference between its start and end on the time scale.

The intensity (time-) profile (shape) of an optical pulse may correspond to the intensity and/or photon number and/or optical power of the optical pulse depending on time. The phase (time-) profile of an optical pulse may correspond to its phase depending on time.

The encoder initial bit sequence may be randomly generated, preferably using a quantum random number generator (QRNG). Alternatively, a classical pseudo random number generator may be employed.

The at least one first bit of the encoder initial bit sequence may be different from the at least one second bit of the encoder initial bit sequence. Thus, more information can be encoded in the optical pulses.

Alternatively, the at least one first bit and the at least one second bit of the encoder initial bit sequence may be the same. In this case, the intensity function may depend on time and on a (first encoder) value of at least one (first) bit of the encoder initial bit sequence and the phase function may depend on time and the (first encoder) value of the at least one (first) bit of the encoder initial bit sequence. Hence, the same first bit or first bits may be encoded in both intensity and phase, resulting in increased redundancy and robustness (e.g., to noise).

The at least one first bit of the decoder initial bit sequence may be different from the at least one second bit of the decoder initial bit sequence. Alternatively, the at least one first bit and the at least one second bit of the decoder initial bit sequence may be the same.

At least one of the first encoder value, the second encoder value, the first decoder value, and the second decoder value may be a binary value. For example, in case the intensity function depends on a single first bit of the encoder initial bit sequence, the first encoder value may be a bit value, i.e., the first encoder value may be “0” or “1”. In case the intensity function depends on two first bits of the encoder initial bit sequence, the first encoder value may be one of “00”, “01”, “10”, and “11”.

The classical post-processing, transmitting classical information to the receiver device, and receiving further classical information from the receiver device may comprise classical post-processing, transmitting and receiving during at least one of bit reconciliation, post selection, error estimation, error correction, and privacy amplification. The classical post-processing, receiving classical information from the transmitter device, and transmitting further classical information to the transmitter device may comprise classical post-processing, transmitting and receiving during at least one of bit reconciliation, post selection, error estimation, error correction, and privacy amplification.

The total number of photons of each of the plurality of optical pulses and for each first encoder value may be constant.

The (each) optical pulse may be generated from a (pulsed) laser beam and/or using a Mach-Zehnder interferometer (of the encoder device). The Mach-Zehnder interferometer may comprise a first phase modulator, a second phase modulator, a first beam splitter, and a second beam splitter. The laser beam may pass through the first beam splitter, the first phase modulator, the second beam splitter, and the second phase modulator.

Before modulation, each optical pulse may comprise, e.g., a rectangular intensity profile. In particular, before modulation, each optical pulse may comprise constant optical power (for the duration of the optical pulse).

The first beam splitter and/or the second beam splitter may be a 50:50 beam splitter. The laser beam may be split at the first beam splitter (into a first and a second part) and recombined at the second beam splitter. The laser beam may further be (again) split at the second beam splitter (into a third and a fourth part). The first part may pass the first phase modulator. The second part may pass directly to the second beam splitter. The third part may be transmitted to a control detector. The fourth part may pass the second phase modulator and subsequently be transmitted to the quantum channel (as the optical pulse).

The input optical power of the laser for generating the optical pulses may be from 0.15 nW to 100.00 nW, preferably from 1 nW to 20 nW. Each of the optical pulses may have a photon number from 100 to 80 000, preferably from 800 to 15 000. The laser may, e.g., comprise a DFB PM laser diode. A central wavelength of the optical pulses may be between 1510 nm and 1550 nm, preferably between 1529 nm and 1531 nm, more preferably at 1530 nm. The line width may be 2 MHz or less.

Each of the optical pulses (after modulation) may comprise a (time-dependent) optical power from 0.1 nW to 50.0 nW (between its start and end on the time scale), preferably from 1 nW to 20 nW, more preferably from 5 to 15 nW.

The intensity profile may be modulated by at least one of a first phase modulator and a laser source intensity (input intensity). The phase profile may be modulated by the second phase modulator.

The intensity function may comprise, depending on the first encoder value, an oscillatory component, preferably with time-dependent (instantaneous) frequency. Further, the phase function may comprise, depending on the second encoder value, a (further) oscillatory component with time-dependent frequency.

Generally, the intensity function and/or the phase function may comprise at least two (local) maxima.

Modulating the intensity profile of the optical pulse according to (with) the intensity function may comprise at least one of (pointwise) multiplying the intensity profile with the intensity function, convolving the intensity profile with the intensity function, and (pointwise) adding the intensity function to the intensity profile. Further, modulating the phase profile of the optical pulse according to (with) the phase function may comprise at least one of (pointwise) multiplying the phase profile with the phase function, convolving the phase profile with the phase function, and (pointwise) adding the phase function to the phase profile.

For each first encoder value, the intensity function may be unique. In other words, for each first encoder value, the intensity function may be different from the intensity function for another first encoder value. In particular, for each first encoder value, the intensity function may have a unique time evolution. For example, for each first encoder value, the intensity function may be different from a constant multiple of the intensity function for another first encoder value. Correspondingly, for each second encoder value, the phase function may be unique. In other words, for each second encoder value, the phase function may be different from the phase function for another second encoder value. In particular, for each second encoder value, the phase function may have a unique time evolution. For example, for each second encoder value, the phase function may be different from a constant multiple of the phase function for another second encoder value.

The intensity function and the phase function may be the same for coinciding first encoder value and second encoder value. Alternatively, the intensity function and the phase function may be different for coinciding first encoder value and second encoder value and, in particular for any (pair of) first encoder value and second encoder value.

The intensity function and/or the phase function may be quasiperiodic.

For first encoder value a, the oscillatory component may have the form c_a cos(ζ_a(t)+η_a) with factor c_a, angle η_a and angular function ζ_a(t) depending on the first encoder value. The factor c_a and the angle η_a may also be constant with respect to the first encoder value. In other words, the oscillatory component may have the form c cos(ζ_a(t)+η). For second encoder value a, the further oscillatory component may have the form {tilde over (c)}_a cos({tilde over (ζ)}_a(t)+{tilde over (η)}_a) with further factor {tilde over (c)}_a, further angle {tilde over (η)}_a and further angular function {tilde over (ζ)}_a(t) depending on the second encoder value. The further factor {tilde over (c)}_a and the further angle {tilde over (η)}_a may also be constant with respect to the second encoder value. In other words, the oscillatory component may have the form {tilde over (c)} cos({tilde over (ζ)}_a(t)+{tilde over (η)}).

The oscillatory component and/or the further oscillatory component may comprise oscillations with an instantaneous period (local period) from 1 ns to 50 ns, preferably from 1 ns to 20 ns, more preferably from 1 ns to 10 ns. The instantaneous period may be change with time. The oscillatory component may also comprise oscillations with an instantaneous frequency (local frequency) from 10 MHz to 500 MHz, preferably from 45 MHz to 300 MHz, more preferably from 70 MHz to 130 MHz. The instantaneous frequency may change with time.

The intensity function may also comprise a constant (offset) component (a component constant in time). The phase function may also comprise a further constant (offset) component. The intensity function may comprise a sum of the oscillatory component and the constant component. The phase function may comprise a sum of the further oscillatory component and the further constant component.

The intensity function may comprise, depending on the first encoder value, a frequency chirp component, preferably at least one of a linear frequency chirp component, a quadratic frequency chirp component, a cubic frequency chirp component, and an exponential frequency chirp component. The phase function may comprise, depending on the second encoder value, a (further) frequency chirp component, preferably at least one of a linear frequency chirp component, a quadratic frequency chirp component, a cubic frequency chirp component, and an exponential frequency chirp component. The (further) oscillatory component may be or may comprise the (further) frequency chirp component.

The frequency chirp component may comprise a chirp rate depending on the first encoder value. The further frequency chirp component may comprise a further chirp rate depending on the second encoder value. The (further) chirp rate may be unique for each first (second) value.

The intensity function may depend on the first encoder value of (at least) two first bits of the encoder initial bit sequence and/or the phase function may depend on the second encoder value of (at least) two second bits of the encoder initial bit sequence.

In other words, generating each optical pulse of the plurality of optical pulses may comprise at least one of: modulating an intensity profile of the optical pulse according to an intensity function which depends on time and on a first encoder value of at least two first bits of the encoder initial bit sequence, and modulating a phase profile of the optical pulse according to a phase function which depends on time and a second encoder value of at least two second bits of the encoder initial bit sequence.

The intensity function may also depend on the first encoder value of at least three first bits of the encoder initial bit sequence and/or the phase function may depend on the second encoder value of at least three second bits of the encoder initial bit sequence. The intensity function may depend on the first encoder value of at least four first bits of the encoder initial bit sequence and/or the phase function may depend on the second encoder value of at least four second bits of the encoder initial bit sequence.

In general, the intensity function may depend on the first encoder value of at least one first bit and at most 100 first bits (in particular, at most 20 first bits; especially at most 4 first bits) of the encoder initial bit sequence. The phase function may depend on the second encoder value of at least one second bit and at most 100 second bits (in particular, at most 20 second bits; especially at most 4 second bits) of the encoder initial bit sequence.

In case the intensity (phase) function depends on one first (second) bit, the intensity (phase) profile may be modulated according to two different shapes (according to the intensity (phase) function for bit value 0 and according to the intensity (phase) function for bit value 1). In case the intensity (phase) function depends on two first (second) bits, the intensity (phase) profile may be modulated according to four different shapes (according to the intensity (phase) function for bit values 00, 01, 10, and 11). In general, in case the intensity (phase) function depends on n first (second) bits, the intensity (phase) profile may be modulated according to 2ⁿ different shapes.

The first bits of the encoder initial bit sequence may be different from the second bits of the first bit sequence. Alternatively, the first bits and the second bits may be the same or may partially overlap.

Each optical pulse may have a pulse length from 1 ns to 1000 ns, preferably from 50 ns to 200 ns, more preferably from 80 ns to 120 ns. Each optical pulse may have (essentially) the same pulse length. Each optical pulse may have a pulse length different from an average pulse length of the plurality of optical pulses by at most 0.1%.

Modulating the intensity profile and/or the phase profile may be carried out such that the pulse length of each optical pulse is changed by at most 10%, preferably at most 5%.

Determining the first decoder value may comprise comparing the approximate intensity profile with ideal approximate intensity profiles (for different possible first encoder values). Determining the second decoder value may comprise comparing the approximate phase profile with ideal approximate phase profiles (for different possible second encoder values).

The approximate intensity profile may comprise the plurality of intensity values. The approximate phase profile may comprise the plurality of phase values. For each time bin, the approximate intensity profile may comprise a corresponding intensity value and/or the approximate phase profile may comprise a corresponding phase value.

Measuring the intensity values and/or the phase values (for the plurality of time bins) may comprise carrying out heterodyne measurements for each time bin. Carrying out the heterodyne measurements may include splitting a (received) optical pulse into two beams which interfere with two further beams of local oscillators (LO) and measuring interference events using (photo-diode) detectors.

Each time bin may comprise a time bin length from 1 ns to 50 ns, preferably from 1 ns to 5 ns, more preferably from 1 ns to 2 ns.

The first decoder value of (at least) two first bits of the decoder initial bit sequence and/or the second decoder value of (at least) two second bits of the decoder initial bit sequence may be determined. Further, the first decoder value of (at least) three first bits of the decoder initial bit sequence and/or the second decoder value of (at least) three second bits of the decoder initial bit sequence may be determined. Moreover, the first decoder value of (at least) four first bits of the decoder initial bit sequence and/or the second decoder value of (at least) four second bits of the decoder initial bit sequence may be determined. In general, the first decoder value of at least one first bit and at most 100 first bits (in particular, at most 20 first bits; especially at most 4 first bits) of the decoder initial bit sequence and/or the second decoder value of at least one second bit and at most 100 second bits (in particular, at most 20 second bits; especially at most 4 second bits) of the decoder initial bit sequence may be determined.

Each one of the possible first encoder values may correspond to one of the ideal approximate intensity profiles. Each one of the possible second encoder values may correspond to one of the ideal approximate phase profiles. For example, in case of determining the first decoder value of a single first bit of the decoder initial bit sequence, the first decoder value may be 0 or 1. In case of determining the first decoder value of two first bits of the decoder initial bit sequence, the first decoder value may be one of 00, 01, 10, and 11. In general, in case of determining the first (second) decoder value of n first (second) bits of the decoder initial bit sequence, there are 2ⁿ possibilities for the first (second) decoder value. Hence, in case of determining the first (second) decoder value of n first (second) bits of the decoder initial bit sequence, there are 2ⁿ ideal approximate intensity (phase) profiles.

Comparing the approximate intensity profile with the ideal approximate intensity profiles may comprise determining a first characteristic indicative of the approximate intensity profile in relation to the ideal approximate intensity profiles. Comparing the approximate phase profile with the ideal approximate phase profiles may comprise determining a second characteristic indicative of the approximate phase profile in relation to the ideal approximate phase profiles.

The first characteristic may, e.g., comprise a first measured correlator difference determined from the approximate intensity profile and the ideal approximate intensity profiles. Determining the first decoder value may then comprise comparing the first measured correlator difference with a first threshold value. The second characteristic may comprise a second measured correlator difference determined from the approximate phase profile and the ideal approximate phase profiles. Determining the second decoder value may comprise comparing the second measured correlator difference with a second threshold value.

In other words and including variable symbols, the method may comprise at least one of:

• • determining the first measured correlator difference ΔQ from the approximate intensity profile {Ñ(t)}_t and the ideal approximate intensity profiles {N_a(t)}_t (comprising ideal intensity values N_a(t)) and determining the first decoder value by comparing the first measured correlator difference ΔQ with the first threshold value ΔQ and
  • determining the second measured correlator difference ΔR from the approximate phase profile {{tilde over (Π)}(t)}_t and the ideal approximate phase profiles {Π_a(t)}_t (comprising ideal phase values Π_a(t)) and determining the second decoder value by comparing the second measured correlator difference ΔR with the second threshold value ΔR.

Determining the first measured correlator difference ΔQ may comprise determining a (preferably normalized) sum of differences of ideal intensity values N_a(t) dependent on the first encoder value a for each of the plurality time bins, wherein each of the differences is weighted by the (measured) intensity value for the respective time bin. Determining the second measured correlator difference ΔR may comprise determining a (preferably normalized) sum of differences of ideal phase values Π_a(t) dependent on the second encoder value a for each of the plurality time bins, wherein each of the differences is weighted by the (measured) phase value for the respective time bin.

The first threshold value ΔQ may be determined from correlator mean differences e₀, e₁ for the first decoder value of the at least one first bit, in particular from an arithmetic mean of the correlator mean differences e₀, e₁ for the first decoder value of the at least one first bit. The second threshold value ΔR may be determined from correlator mean differences q₀, q₁ for the second decoder value of the at least one second bit, in particular from an arithmetic mean of the correlator mean differences for the second decoder value of the at least one second bit. Specifically, the first threshold value ΔQ may be determined as (e₀+e₁)/2 with e_a=[Q_a⁽⁰⁾−Q_a⁽¹⁾] with correlators Q_a⁽⁰⁾ and Q_a⁽¹⁾ for first encoder value a. The second threshold value ΔR may be determined as (q₀+q₁)/2 with ƒ_a=[R_a⁽⁰⁾−R_a⁽¹⁾] with correlators R_a⁽⁰⁾ and R_a⁽¹⁾ for second encoder value a.

The first decoder value may be determined based on the first measured correlator difference ΔQ being greater or smaller than the first threshold value ΔQ. The second decoder value may be determined based on the second measured correlator difference ΔR being greater or smaller than the second threshold value ΔR.

In particular, the first decoder value may be determined based on the first measured correlator difference ΔQ being greater or smaller than the first threshold value ΔQ by a first post-selection parameter. Based on the first measured correlator difference ΔQ not being greater or smaller than the first threshold value ΔQ by the first post-selection parameter, the intensity measurement of the corresponding optical pulse may be determined as inconclusive (and be discarded). The second decoder value may be determined based on the second measured correlator difference ΔR being greater or smaller than the second threshold value ΔR by a second post-selection parameter. Based on the second measured correlator difference ΔR not being greater or smaller than the second threshold value ΔR by the second post-selection parameter, the phase measurement of the corresponding optical pulse may be determined as inconclusive (and be discarded).

The first post-selection parameter and/or the second post-selection parameter may be determined such that a key generation rate for determining the shared key is maximized. In particular, the first post-selection parameter and/or the second post-selection parameter may be determined by numerical optimization over a set of candidate post-selection parameters and, preferably, by varying test input bit sequences for the encoder initial bit sequence and/or assumed signal leakage values.

The first post-selection parameter and/or the second post-selection parameter may be from 0.01 to 0.30, preferably from 0.05 to 0.20, more preferably from 0.08 to 0.10.

The method may comprise determining (and/or monitoring) optical signal losses along the quantum channel (and/or transmission line), in particular along the optical fiber, preferably optical signal losses depending on a position along the quantum channel. In other words, the optical signal losses may be determined as a function of the position along the quantum channel. In particular, for each position along the quantum channel, corresponding optical signal losses may be determined. The optical signal losses may thus correspond to a signal loss profile. The optical signal losses may be determined via optical test pulses (different from the plurality of optical pulses). The optical test pulses may comprise a greater optical power than the optical pulses, preferably by a factor of a least 10, more preferably by a factor of at least 100.

The optical signal losses may be determined by optical time-domain reflectometry. The optical signal losses may be determined during and/or prior to and/or subsequent to determining the shared key. The optical signal losses may be determined repeatedly. For example, the optical signal losses may be determined repeatedly within a time interval from 10 ns to 50 s, preferably from 10 ns to 10 s, in particular from one of 100 ns to 100 ms, 500 ns to 500 ms, 100 ms to 1000 ms, 0.5 s to 5 s, and 5 s to 10 s.

The method may comprise determining an intrusion event based on the optical signal losses and/or aborting (terminating) determining of the shared key based on the optical signal losses. The method may comprise discarding the shared key based on the optical signal losses.

Within the context of the present disclosure, intervals and value ranges (e.g., “from . . . to . . . ”, “between . . . and . . . ”) include their boundary points.

The aforementioned embodiments related to the methods for quantum key distribution can be provided correspondingly for the transmitter device, the receiver device, and the system for quantum key distribution.

All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein.

The use of the terms “a” and “an” and “the” and “at least one” and similar referents in the context of describing the invention (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. The use of the term “at least one” followed by a list of one or more items (for example, “at least one of A and B”) is to be construed to mean one item selected from the listed items (A or B) or any combination of two or more of the listed items (A and B), unless otherwise indicated herein or clearly contradicted by context. The terms “comprising,” “having,” “including,” and “containing” are to be construed as open-ended terms (i.e., meaning “including, but not limited to,”) unless otherwise noted. Recitation of ranges of values herein are merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated herein, and each separate value is incorporated into the specification as if it were individually recited herein. All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language (e.g., “such as”) provided herein, is intended merely to better illuminate the invention and does not pose a limitation on the scope of the invention unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the invention.

Preferred embodiments of this invention are described herein, including the best mode known to the inventors for carrying out the invention. Variations of those preferred embodiments may become apparent to those of ordinary skill in the art upon reading the foregoing description. The inventors expect skilled artisans to employ such variations as appropriate, and the inventors intend for the invention to be practiced otherwise than as specifically described herein. Accordingly, this invention includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the invention unless otherwise indicated herein or otherwise clearly contradicted by context.

Claims

1. An encoding method for quantum key distribution, the method being carried out in a transmitter device having a classical processor and instrumentalities for preparing and transmitting quantum signals, the method comprising: generating an encoder initial bit sequence;generating, from the encoder initial bit sequence, a quantum signal comprising a plurality of optical pulses, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of: modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence; andmodulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence;transmitting the plurality of optical pulses to a receiver device via a quantum channel; anddetermining a shared key shared between the transmitter device and the receiver device from the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device and receiving further classical information from the receiver device.

2. The method according to claim 1, wherein each optical pulse is generated from a laser beam and using a Mach-Zehnder interferometer.

3. The method according to claim 1, wherein the intensity profile is modulated by at least one of a first phase modulator and a laser source intensity; and/or wherein the phase profile is modulated by a second phase modulator.

4. The method according to claim 1, wherein the intensity function comprises, depending on the first encoder value, an oscillatory component with time-dependent frequency; and/or wherein the phase function comprises, depending on the second encoder value, a further oscillatory component with time-dependent frequency.

5. The method according to claim 1, wherein the intensity function comprises, depending on the first encoder value, a frequency chirp component.

6. The method according to claim 5, wherein the frequency chirp component includes at least one of a linear frequency chirp component, a quadratic frequency chirp component, a cubic frequency chirp component, and an exponential frequency chirp component.

7. The method according to claim 1, wherein the intensity function depends on the first encoder value of at least two first bits of the encoder initial bit sequence; and/or wherein the phase function depends on the second encoder value of at least two second bits of the encoder initial bit sequence.

8. The method according to claim 1, wherein each optical pulse has a pulse length from 1 ns to 1000 ns.

9. A decoding method for quantum key distribution, the method being carried out in a receiver device having a classical processor and instrumentalities for receiving and measuring quantum signals, the method comprising: receiving a quantum signal comprising a plurality of optical pulses from a transmitter device via a quantum channel;determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising, for each optical pulse, at least one of: determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence, anddetermining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determining, from the approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; anddetermining a shared key shared between the transmitter device and the receiver device from the decoder initial bit sequence by classical post-processing and at least one of receiving classical information from the transmitter device and transmitting further classical information to the transmitter device.

10. The method according to claim 9, wherein determining the first decoder value comprises comparing the approximate intensity profile with ideal approximate intensity profiles; and/or wherein determining the second decoder value comprises comparing the approximate phase profile with ideal approximate phase profiles.

11. The method according to claim 9, further comprising at least one of: determining a first measured correlator difference from the approximate intensity profile and the ideal approximate intensity profiles and determining the first decoder value by comparing the first measured correlator difference with a first threshold value; anddetermining a second measured correlator difference from the approximate phase profile and the ideal approximate phase profiles and determining the second decoder value by comparing the second measured correlator difference with a second threshold value.

12. The method according to claim 9, further comprising determining optical signal losses along the quantum channel.

13. The method according to claim 12, wherein the optical signal losses depend on a position along the quantum channel.

14. A method for quantum key distribution, the method being carried out in a system comprising a transmitter device having a classical processor and instrumentalities for preparing and transmitting quantum signals; and a receiver device having a further classical processor and instrumentalities for receiving and measuring quantum signals, the method comprising: generating an encoder initial bit sequence in the transmitter device;generating, from the encoder initial bit sequence, a quantum signal comprising a plurality of optical pulses in the transmitter device, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of: modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence andmodulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence;transmitting the plurality of optical pulses from the transmitter device to the receiver device via a quantum channel and receiving the plurality of optical pulses in the receiver device;determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising for each optical pulse at least one of: determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence; anddetermining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins, and determining, from the approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; anddetermining, in the transmitter device from the encoder initial bit sequence and in the receiver device from the decoder initial bit sequence, by classical post-processing and at least one of transmitting classical information from the transmitter device to the receiver device and transmitting further classical information from the receiver device to the transmitter device, a shared key shared between the transmitter device and the receiver device.

15. A transmitter device for quantum key distribution comprising a classical processor and instrumentalities for preparing and transmitting quantum signals and being configured to carry out the following steps: generating an encoder initial bit sequence;generating, from the encoder initial bit sequence, a quantum signal comprising a plurality of optical pulses, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of: modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence andmodulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence,transmitting the plurality of optical pulses to a receiver device via a quantum channel; anddetermining a shared key shared between the transmitter device and the receiver device from the encoder initial bit sequence by classical post-processing and at least one of transmitting classical information to the receiver device and receiving further classical information from the receiver device.

16. A receiver device for quantum key distribution comprising a classical processor and instrumentalities for receiving and measuring quantum signals and being configured to carry out the following steps: receiving a quantum signal comprising a plurality of optical pulses from a transmitter device via a quantum channel;determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising for each optical pulse at least one of: determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence, anddetermining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins and determining, from approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; anddetermining a shared key shared between the transmitter device and the receiver device from the decoder initial bit sequence by classical post-processing and at least one of receiving classical information from the transmitter device and transmitting further classical information to the transmitter device.

17. A system for quantum key distribution, comprising a transmitter device having a classical processor and means for preparing and transmitting quantum signals; and a receiver device having a further classical processor and means for receiving and measuring quantum signals, the system being configured to carry out the following steps: generating an encoder initial bit sequence in the transmitter device;generating, from the first initial bit sequence, a quantum signal comprising a plurality of optical pulses in the transmitter device, wherein generating each optical pulse of the plurality of optical pulses comprises at least one of: modulating an intensity profile of the optical pulse according to an intensity function which depends on a time and on a first encoder value of at least one first bit of the encoder initial bit sequence; andmodulating a phase profile of the optical pulse according to a phase function which depends on a time and a second encoder value of at least one second bit of the encoder initial bit sequence,transmitting the plurality of optical pulses from the transmitter device to the receiver device via a quantum channel and receiving the plurality of optical pulses in the receiver device;determining a decoder initial bit sequence from the plurality of optical pulses, the determining comprising for each optical pulse at least one of: determining an approximate intensity profile of the optical pulse by measuring a plurality of intensity values of the optical pulse for a plurality of time bins, and determining, from the approximate intensity profile, a first decoder value of at least one first bit of the decoder initial bit sequence, anddetermining an approximate phase profile of the optical pulse by measuring a plurality of phase values of the optical pulse for a plurality of time bins and determining, from approximate phase profile, a second decoder value of at least one second bit of the decoder initial bit sequence; anddetermining, in the transmitter device from the encoder initial bit sequence and in the receiver device from the decoder initial bit sequence, by classical post-processing and at least one of transmitting classical information from the transmitter device to the receiver device and transmitting further classical information from the receiver device to the transmitter device, a shared key shared between the transmitter device and the receiver device.