Metropolitan quantum key distribution with silicon photonics

Photonic integrated circuits (PICs) provide a compact and stable platform for quantum photonics. Here we demonstrate a silicon photonics quantum key distribution (QKD) transmitter in the first high-speed polarization-based QKD field tests. The systems reach composable secret key rates of 950 kbps in a local test (on a 103.6-m fiber with a total emulated loss of 9.2 dB) and 106 kbps in an intercity metropolitan test (on a 43-km fiber with 16.4 dB loss). Our results represent the highest secret key generation rate for polarization-based QKD experiments at a standard telecom wavelength and demonstrate PICs as a promising, scalable resource for future formation of metropolitan quantum-secure communications networks.

Quantum key distribution (QKD) remains the only quantum-resistant method of sending secret information at a distance [1,2]. The first QKD system ever devised used polarization of photons to encode information [3,4]. QKD has since progressed rapidly to several deployed systems that can reach point-to-point secret key generation rates in the upwards of 100 kbps [5][6][7][8] and to other photonic degrees of freedom: time [9][10][11][12], frequency [13][14][15][16], phase [17], quadrature [18][19][20][21], and orbital angular momentum [22]. While polarization remains an attractive choice for free-space QKD due to its robustness against turbulence [23][24][25][26][27][28], polarization is commonly thought to be unstable for fiber-based QKD. For this reason, there has been a strong interest in translating the polarization QKD components into photonic integrated circuits (PICs), which provide a compact and phase-stable platform capable of correcting for polarization drifts in the channel. Recently, silicon-based polarization QKD transmitters were used for laboratory QKD demonstrations [29,30], but their performance advantage over standard telecommunication components has yet to be demonstrated. Here we report the first field tests using high-speed silicon photonics-based transmitter for polarization-encoded QKD.
The silicon photonics platform allows for the integration of multiple high-speed photonic operations into a single compact circuit [31][32][33][34]. Operating at gigahertz bandwidth, a silicon photonics polarization QKD transmitter can correct for polarization drifts with typical millisecond time scales in a metropolitan-scale fiber link. Furthermore, silicon nanophotonic devices are compatible with the existing complementary metal-oxidesemiconductor (CMOS) processes that have enabled monolithic integration of photonics and electronics, possibly leading to future widespread utilization of QKD.
The QKD transmitter demonstrated here is manufactured using a CMOS-compatible process. The trans-mitter combines a 10-Gbps Mach-Zehnder Modulator (MZM) with interleaved grating couplers, which convert the polarization of a photon in an optical fiber into the path the photon takes in the integrated circuit, and vice versa. The high-speed polarization control is enabled by electro-optic carrier depletion modulation within the MZM [35]. We show the performance of the device in a local field test and an intercity field test. With a clock rate of 625 MHz, we generated secret keys at a rate of 950 kbps and observed a bit error rate of 2% in the local test between two neighboring buildings connected by a 103.6 m fiber (with an additional 9 dB emulated loss). In the 43 km (16.4 dB channel loss) intercity test between the cities of Cambridge and Lexington, we generated secret keys at a rate of 106 kbps and observed a bit error rate 2.8%. Both QKD operations are demonstrated to be secure against collective attacks in a composable security framework with a tight security parameter of ε sec = 10 −10 . Our results demonstrate how silicon photonics-supported by the currently existing CMOS technology-can pave the way for a high-speed metropolitan-scale quantum communication network.

Silicon photonics transmitter
Our QKD transmitter and its cross-section are shown in Fig. 1(a-c). Light is coupled in and out of the transmitter using a standard fiber v-groove array of 250 µm pitch. Owing to the large index contrast between the silicon layer and the buried oxide, the transmitter is compact within a total area of 0.75 × 1.5 mm 2 . Polarization grating couplers are used to convert between polarization-encoding in the input/output fibers and path-encoding within the PIC. The unitary trans- formation is similar to that of a polarizing beam splitter (PBS). Within the PIC, the photons' paths-and their relative phases-are manipulated using an MZM with two internal and two external electro-optic phase modulators, which in turn manipulate the photon polarization in the output fiber.
The input polarization grating coupler separates light from the horizontal and vertical polarizations onto two different paths, both in the transverse-electric (TE) polarization: with its electric field oscillating parallel to the chip surface. Any light inadvertently converted into the transverse-magnetic (TM) polarization in these waveguides is greatly attenuated by the phase modulators which strongly support higher transmission in TE polarization over TM polarization.
The electro-optic phase modulators in the MZM are based on depletion-mode free-carrier dispersion from a doped p-i-n junction superimposed on the optical mode [36,37]. The overlap between the optical mode and the free carriers results in free carrier refraction [38], which can be controlled with gigahertz RF signals to achieve high-speed phase modulation.
The polarization states generated by the transmitter have a purity of 1.000 ± 0.005, measured using a polarimeter. In Fig. 1(d), the relative phases of the internal phase shifters (∆θ) as well as the relative phases of the external phase shifters (∆φ) are swept with a reverse bias voltage between 0 and 8 V. For this voltage range, the polarization states lie on the surface of the Bloch sphere indicating that they remain pure throughout.
The BB84 QKD protocol requires Alice to prepare three quantum states: two eigenstates of Z and an eigenstate of X [39,40]. Alice randomly chooses the basis she prepares in. When Z-basis is selected, Alice prepares either |0 z = |H or |1 z = |V with equal probabilities of 1/2. Otherwise, when X-basis is selected, Alice prepares the state |0 x = |D = (|H + |V )/ √ 2. We prepared the three quantum states at high fidelity, as shown in Figs. 1(e-f), with a polarization extinction ratio better than 25 dB which is required for low-error QKD operations. The internal and external phase modulators were configured to produce the state (|t +|b )/ √ 2, which we take to be |0 z . RF signals of differing voltages were applied to one of the external phase modulators to generate (|t + e iφ |b )/ √ 2, where φ is the applied phase shift. All the three BB84 states can be generated by applying the phase shifts φ = 0, π/2, and π. The polarization states were measured using a PBS followed by two InGaAs photodiodes. A polarization controller before the PBS allowed measurements in the two BB84 bases: the Z-basis and the X-basis.
As shown in the eye diagram in Fig. 1(g), the phase modulators allowed us to generate the polarization states at 10 Gbps. These measurements were acquired by using an in-line polarizer placed at the output of the transmitter that converts the polarization state |V into an on-state and the polarization state |H into an off-state. When the transmitter was modulated at 6 Gbps or lower, not a single error was observed for a five-minute operation. At a 10 Gbps data rate, as shown here, we measured a low error rate of 9.0 × 10 −10 s −1 .

Field tests
We performed two QKD field tests: a local test and an intercity test. Fig. 2 shows a map of the greater Boston area, identifying the locations of Alice and Bob, together with the experimental setups implementing the asymmetric polarization-based BB84 protocol. Alice, located in the Compton Laboratories at MIT for both field tests, prepares the three polarization BB84 states at random. Bob measures in either the Z-basis or the X-basis using four superconducting nanowire single-photon detectors (SNSPDs) at a different location for each field test. He is located in the Fairchild Building for the local test and at MIT Lincoln Laboratory in Lexington for the intercity test. Bob makes his basis choices using the polarization controller placed before each PBS.
Alice creates (non-phase randomized) attenuated laser pulses of width 800 ps at 1480 nm with a 625 MHz repetition rate. The pulses are modulated into the three BB84 polarization states by the silicon photonics trasmitter. Alice first calibrates for the polarization rotation through the channel, and DC reverse voltage biases are applied to the transmitter such that the state |D is generated by default. To generate the states |H and |V , Alice applies synchronized RF pulses with a full-width-at-halfmaximum of 400 ps. To maximize the length of secret keys generated, Alice chooses to prepare either in the Zbasis with a probability of 15/16 (and in the X-basis with a probability of 1/16).
In the local test, Alice sends her prepared states to Bob through a 103.6 m fiber link connecting the two laboratories. The loss through the link is 0.2 dB, and we emulated longer fiber distances by installing a variable optical attenuator before the channel. On the other hand, the deployed intercity fiber connecting Cambridge and Lexington is 43 km long with 16.4 dB loss.
Bob detects the pulses he receives in either of the two bases with 50% probability to maximize the number of security check events when the key-generating detectors are saturated. For the local test, Bob uses four individual WSi SNSPDs, each with a quantum efficiency greater than 85%, a timing resolution of ∼ 250 ps, and a background dark count rate of ∼ 1000 counts/s. For the intercity test, Bob uses four NbN SNSPD systems, each consisting of two interleaved NbN nanowires with a single optical fiber input. A single NbN SNSPD system has a quantum efficiency of 30%, a timing resolution of tens of ps, and a background dark count rate of ∼ 1000 counts/s. While the WSi nanowire has a better quantum efficiency than the NbN system, the WSi detector saturates at a lower count rate of 5 × 10 6 counts/s. Alice and Bob only generate secret keys when both parties choose the Z-basis. The quantum bit error rate e bit is measured by checking the number of bits that have been flipped between their raw bit strings. On the other hand, the quantum phase error rate e phase can be estimated from X-basis events along with the mismatched basis events, where Alice and Bob chose different preparation and measurement bases (see Methods) [39,40].
An automated polarization feedback system is placed in the intercity channel between Alice and Bob, which can drift significantly on the timescale of the experiment. To correct for the drift, Alice sends a series of calibration signals and optimizes her DC voltage biases such that the error rate on both measurement bases is kept low. As seen in Fig. 2(b), the relative fluctuations of e bit (relative to its starting value) are limited to 2% with feedback, and to about 50% without feedback.
Composable secret key generation Figure 3 shows the performance of the QKD transmitter in both field tests, in terms of the observed secret key rate (SKR), e bit , and e phase . For clarity, we plotted the SKRs against the channel loss and the equivalent fiber distance assuming an optimistic fiber loss of 0.2 dB/km. We kept the number of pulses sent from Alice to Bob at N = 2.81 × 10 11 to maintain a uniform collection time of 450 s for each experiment, and analyzed the security with a small security parameter of ε sec = 10 −10 .
For the local test, at a total channel attenuation of 9.2 dB, we obtained a SKR of 950 kbps using mean photon numbers of 0.12, 0.012, 0.003 for the signal and the two decoy states-chosen with probabilities 2/3, 2/9, and 1/9-respectively. The mean photon numbers were kept low to avoid detector saturation. The total channel attenuation was further increased from 9.2 dB to 24.2 dB to simulate longer fiber distances. We observed an average e bit of ∼ 2%, except for the lowest channel attenuation where e bit is higher at 3.97% as the WSi detectors are saturated. As expected from theoretical simulations, the phase error rate e phase increased from 7.92% to 21.31% as we increased the channel attenuation.
For the metropolitan intercity test, we obtained an SKR of 106 kbps using mean photon numbers 0.5, 0.03, 0.015 for the signal and the decoy states with the same probabilities as above. Here the mean photon numbers could be chosen higher while being well under the NbN detector systems' saturation point. We observed an e bit of 2.82% and an e phase of 13.29% in this 43 km experiment.

DISCUSSION
To illustrate the progress entailed by our results, we summarize our work in Table I along with recent demonstrations of high-speed polarization-based QKD. Our work represents the highest observed SKR for any polarization-based QKD operations at comparable channel losses, and it performs comparably to other stateof-the-art QKD field demonstrations. It is also the first demonstration of the asymmetric loss-tolerant BB84 QKD protocol with guaranteed security against collective attacks [40]. The silicon photonics platform has enabled The (blue) squares and upright triangles are asymptotic SKRs for the local test and the 43 km metropolitan intercity test, respectively. Similarly, the (red) circles and inverted triangles are the SKRs calculated within the composable security framework with εsec = 10 −10 for the local test and the metropolitan field test, respectively. In the local tests, a variable attenuator is used to provide higher attenuation beyond the channel's 0.2 dB loss. Solid and dashed lines correspond to numerical simulations of the SKRs for the local test and the intercity test, respectively. Bottom: Bit and phase error rates against channel loss in the composable security framework. The symbols used here are the same as the ones above.
us to design a compact transmitter with high-speed and high-fidelity operations using a CMOS-compatible process. This points to the possibility of low-cost and resilient QKD transmitters for metro-scale quantum-secure networks.
PICs offer opportunities for further integration for both the transmitter and the receiver and for closing possible security flaws and side-channel attacks. Dense wavelength-division multiplexing has been one major thrust in classical communications, and a compact solution is available in silicon photonics by using an array of add-drop ring resonators [43,44]. This scheme can be integrated with our current QKD transmitter design with only minimal changes in the footprint. Furthermore, single photon detectors have been integrated into silicon photonics [45], showing the possibility of a compact QKD receiver.
Moreover, the configurability of the silicon photonics platform allows for complex monitoring circuits that pro-tect against side-channel attacks [46]. For example, a Trojan horse attack can be thwarted by placing watchdog detectors in our transmitter [47,48]. Possible detector vulnerabilities, such as the detector blinding attack [49,50], can be eliminated using the measurementdevice-independent configuration [9,51,52].
In conclusion, we have demonstrated short-range and metro-scale QKD field tests based on a silicon photonics transmitter, reaching secret key rates of 950 kbps and 106 kbps, respectively. These are the first field tests using PIC-based QKD transmitters. The PIC platform provides a compact and phase-stable platform for high-speed QKD that is well suited for further scaling by wavelength division multiplexing.