A.

The BB84 protocol

We first recall the basic concept of the BB84 protocol which mostly applies to the TF protocol. In the BB84 protocol linear polarization of single photons is used to form two bases, each consisting of two symbols, which carry the information [1, 15, 16]. The two symbols of each base are represented by two orthogonal orientations of polarization, namely 0° and 90° for one basis and +45° and -45° for the other (Fig. 1).

Fig. 1.

In this example Alice sends four photons, all in the 0°/90° Basis. Bob changes his measurement basis randomly. He gets the correct symbol, when he is in the same basis as Alice and a random symbol, when he is not.

The photons are prepared randomly in one of the two bases by a sender (Alice) and sent to a receiver (Bob) who measures the photons, again randomly, in one of the two bases. Due to the bases’ properties, measuring in the wrong basis leads to a random outcome and deletes the sent information. After the transmission of single-photon pulses, Alice and Bob communicate over a classical channel which bases they have chosen and only keep the information from photons with coinciding bases. The result is called the sifted key. The fundamental idea of QKD relies on the fact that an Eavesdropper (Eve) also has to choose a measurement basis randomly (she cannot measure in both bases while still getting the full information possibly stored in each), leading to bit errors that will be propagated to Bob. Alice and Bob can detect those errors by comparing a fraction of the photons (which will then be discarded) and deduce Eves knowledge of the sifted key. If Eve’s information on the sifted key is larger than Alice’s and Bob’s, the key distribution process needs to be canceled and redone. If Alice’s and Bob’s information is larger, they can use classical error-correction and privacy amplification to shorten the sifted key to a private and identical key. This key can be used for example as a one-time pad for absolute secure communication. For more details see [3].

B.

The time-frequency QKD protocol

For the TF-QKD protocol, the time-frequency uncertainty relation prevents Eve from getting the full information in both bases. M-PPM and M-FSK symbols represent the time and frequency bases, respectively. These two orthogonal modulations feature, in the time or frequency domain, M pulse slots, in which a single photon is sent or measured (Fig. 2 a)). Each PPM (FSK) pulse is represented by a symbol pulse in the time (frequency) domain carrying the information and a conjugated pulse in the frequency (time) domain, which contains no information at all. Although different pulse shapes can be used, we choose pulses with Gaussian shapes because they offer time-frequency symmetry and can be easily generated.

Fig. 2.

a) Example of transmitted symbols in the time (red) and frequency (blue) bases. Each photon is represented by a pulse with either time or frequency information. Each pulse represents exactly one photon, thus they can be seen as the probability distribution of the photon being measured at a certain position in the time or in the frequency domain. The filter boundaries of Bob’s measurement devices are marked as vertical dashed black lines. b) Possible values for pulse width and separation in both bases for M = 4 symbols per basis. Those pulse parameters can be implemented with today’s technology.

To measure in one basis, a filter is needed which decreases the uncertainty in this basis while simultaneously increasing the uncertainty in the other. This is similar to the BB84 protocol where a wrong-basis measurement changes the polarization of a photon and hereby deletes its information.

Measuring in the wrong basis leads to a random result if the conjugated pulses are wide enough. For a good overlap between the symbol pulses and the conjugated pulses, the conjugated pulses shall be roughly M times wider than the slots. In addition, the symbol pulse should be as wide as the slots to prevent gaps between the pulses. Finally, assuming Fourier-limited pulses, the width of a pulse is inverted after its Fourier transform.. The parameters in Fig. 2 b) obey these three relationships and are a good compromise between available technology for time as well as for frequency filters. A conceptual difference in comparison to the BB84 protocol is the already mentioned possibility to use more than two symbols in each basis increasing the number of bits carried by each photon. In Fig. 2 the example of M = 4 symbols per basis is shown.

C.

Setup

The advantage of the time frequency protocol is that it can be implemented mainly from off-the-shelf telecom components. This is especially true for a single-mode fiber (SMF) based setup, since many components are working with SMFs. A proposed setup is shown in Fig. 3.

Fig. 3.

Suggested implementation of the TF-QKD protocol. Mainly off-the-shelf telecom components are used in this implementation. The solid red lines represent single-mode fibers (SMF), the dashed red line represents the transmission path, which could be a fiber, the atmosphere, water or outer space. A tunable laser, a Mach-Zehnder modulator (MZM) to shape the pulses, a controller for steer the laser and the MZM and an attenuator to obtain single photon level are used for Alice’s setup. A basis switch (for example a MZM with two usable outputs or a beamsplitter), frequency (f-) and time (t-) filters (for example cascaded standard demultiplexers and MZM) and a suitable number avalanche photo-detectors (APD) are used for Bob’s setup. In Alice’s part of the setup, a tunable laser (which will later be attenuated) creates photons with the desired central wavelength which are then shaped by a Mach-Zehnder modulator (MZM). Although lasers do not provide perfect single photons (there is some probability that multi-photon pulses occur) it is possible to still preserve security with the so called decoy state method [17-19].

Assuming Fourier-limited pulses, shaping them with the MZM in the time domain also shapes them in the frequency domain. Both the laser and the MZM must be controlled, for example by arbitrary-waveform generators operated with a computer. After forming the pulses, they need to be attenuated to single-photon level, typically between 0.1 and 0.5 photons per pulse.

The photons are now guided to Bob. Depending on the transmission path (which can be a fiber, the atmosphere, water or outer space) additional devices such as optical antennas for free-space communication, are needed. Note, that due to the quantum mechanical no-cloning theorem, single photons cannot be duplicated or amplified with retaining their states (quantum repeaters [20, 21] could someday be used as amplifiers for quantum communication but are far off from being market-ready). This implies that occurring losses in the transmission path and in Bob’s setup decrease the key rate and thus limits the distance over which a key can be distributed [22, 23].

Bob firstly needs to guide the photons to either the time or the frequency basis. This can be done actively (for example by a MZM with two usable outputs) or passively (for example with a beam splitter). The next step is to respectively filter the photons in time or in frequency. As frequency filters, standard SMF demultiplexers can be used while MZMs can function as time filters (the MZMs only have two outputs and thus need to be cascaded for M > 2). Each filter output must then be terminated by a single-photon detector, e.g. an Avalanche photon diodes (APD). Depending on the available components, optical filtering can implemented differently. One superconducting nanowire single photon detector (SNSPD) [24, 25] could be used as the time and (for example with a prior dispersive element) as a frequency resolving detector. The SNSPDs need to be cooled with liquid helium which is technically challenging and expensive, but the number of detectors can be reduced significantly when a higher number M of symbols per basis is used. In addition, the dead time of SNSPDs is much shorter than the dead time of APDs.

A.

Compatibility with classical communication

The TF-QKD protocol has the following advantages:

TF-QKD is thus a good protocol candidate for satellite based QKD networks.

B.

QKD links over satellite

As mentioned before QKD over fiber or ground-based free-space channels have a limited reach. Up to now, distances no larger than 307 km over fiber [22] and 144 km over free-space [23] have been demonstrated. QKD over satellites, however, offers a much larger coverage with an attenuation that scales quadratically (and not exponentially) with the distance.. Different issues regarding satellite QKD are discussed in the literature like for example in [26-29].

In principle all satellite orbits are suitable for establishing QKD-links. However, for higher altitude satellites like geostationary (GEO) satellites the high loss makes it very challenging to implement single-photon based communication. Thus in the following we will only consider low-earth-orbit (LEO) satellites with an altitude between 200 and 2000 km.

For the downlink, the receiving telescope on ground can be large provided that all the power can be coupled to the photodetector. For the uplink, the transmitting telescope aperture, and thus the antenna directivity, on ground may not be as large because the beam pointing is more challenging. This results in an asymmetry in the achievable secret key rate between up- and downlinks. If SMF receiver is used without adaptive optics, then up and downlinks are symmetrical and will provide the same key rate.

C.

Satellite based QKD networks

Any QKD network needs to have some kind of nodes, firstly to overcome the distance limits of a few hundred kilometers and secondly to switch between different users that pair up to communicate secretly. Since untrusted-node networks (where Eve is allowed to have access to the nodes, without the security being corrupted, for example with the help of quantum repeaters [20, 21]) are not yet ready for use, trusted-node networks (where Eve is not allowed to have access to the nodes) are currently the only possibility to be used in QKD networks. Some examples of trusted-node satellite QKD networks are given in [30].

As an example, a trusted-node satellite QKD network is presented in the following using LEO satellites (see also Fig. 4). The loss of satellites with higher altitudes would be higher decreasing the secret key rate. Two parties called Bob and Charlie, which both have to be in the line of sight of the satellite at some point on its orbit, want to share a secret key. Therefor the satellite first shares a secret key B with Bob, when they have a line-of-sight link and later, when Charlie has a line-of-sight link with the satellite, they share a second secret key C of equal length. Both keys are then added modulo-wise and the resulting key AB is announced publicly. Both Bob and Charlie can deduce the key of the respectively other party with help of their key and the key AB. Either key B or key C (both now known by Bob and Charlie) can now be used for secret one-time pad communication. A network of satellites could connect every point on earth surface, enabling worldwide quantum communication.

Fig. 4.

An Example for satellite QKD is shown which enables absolute secure communication between Bob and Charlie. The satellite, representing Alice, first shares a secret key with Bob and later with Charlie. Bob and Charlie can deduce the key of each other with help from Alice who announces the modulo-wise added sum of Bob’s and Charlie’s key. Either Bob’s or Charlie’s key can be used for one-time-pad encrypted communication.