A low cost, short range quantum key distribution system

We present a miniaturized quantum key distribution system, designed to augment the more mature quantum key distribution systems currently commercially available. Our device is designed for the consumer market, and so size, weight and power are more important than raw performance. To achieve our form factor, the transmitter is handheld and the receiver is a larger fixed terminal. We envisage users would bring their transmitters to centrally located receivers and exchange keys which they could use at a later point. Transmitting qubits at 80 MHz, the peak key rate is in excess of 20 kbps. The transmitter device fits within an envelope of <150 ml, weighs 65 g and consumes 3.15 W of power.


Introduction
The majority of current research in the field of quantum key distribution (QKD) focuses on either commercializing high speed fibre systems in networks [1][2][3][4] or long distance free space links to satellites [5][6][7][8][9]. A combination of these services will form the backbone of a global "Quantum Internet" [10] but this does not address access to this network for end-users. We propose small handheld devices which could be brought to a terminal, co-located with a quantum network node to top up a secret key store which could then be used to encrypt day-to-day activity on conventional platforms such as the internet. We are calling these terminals Quantum ATMs (QATMs). The requirements of the mass consumer market places a greater constraint on cost with a relatively low demand for key rate meaning that these handheld devices need not have state of the art performance, and as such can achieve drastic reductions in size, weight and power (SWaP) over other QKD systems.
The QATM concept also helps the SWaP reduction of the consumer devices by not having to be too concerned with the SWaP of the QATM itself. In our case, it makes most sense to place the receiver (Bob) in the QATM due to the relative difficulty in detecting single photon level signals compared to producing them. We will show later (Sect. 4.2) that the majority of the data post-processing can be performed on the QATM as well, so there is minimal requirement for computing hardware in the handheld device.
The design goal for the consumer QKD device is to produce a minimal device such that it could be made cheaply enough to be distributed widely, possibly by banks (like the chip and pin CAP readers) or even integrated into an existing consumer device (such as a mobile phone). These examples provide a good starting point to define our SWaP restrictions, namely that the devices should be approximately the size of a CAP reader (80 mm × 60 mm × 10 mm) [11], weigh no more than a mobile phone (<150 g) [12] and require only as much power as could be provided by a typical smartphone (≈2.5 W) [12].

Optics
Given that true on-demand deterministic single photon sources [13] are currently not sufficiently practical for a consumer device, it is clear that for now, the weak coherent pulse (WCP) method [14,15] of approximating a single photon source is the best method for producing a low SWaP QKD transmitter. Given the SWaP reduction philosophy of this system, it was decided that the WCP source should use LEDs (LA HR070EP1, λ = 650 nm), rather than laser diodes. Although LEDs have limitations in electrical bandwidth compared with laser diodes, they have the advantage of not needing to be temperature stabilized [16], being inherently less polarized and not having a threshold current. The wide spectral bandwidth makes matching multiple sources to make them indistinguishable relatively easy using narrow band interference filters, ensuring security. This process is shown in Fig. 1, showing the spectra of the four LEDs in the transmitter, before and after filtering with a Thorlabs FBH650-10 bandpass filter. Comparing the maximum and minimum values of the spectra at each point gives an improvement of the correlation coefficient from 99.88% to 99.96%, and more importantly removes the features in the spectrum far from the peak (such as at ≈630 nm) which contain the majority of the variance between the LEDs.
The protocol chosen for this system is polarization encoded BB84. Polarization encoding was chosen since generation and detection can both be performed by passively combining and splitting the light using polarization sensitive components whereas encodings such as time-bin and phase require active modulation, high bandwidth pulse shaping [17] or interferometry which are not compatible with our low SWaP philosophy. BB84 is em- Figure 1 Spectra of the LEDs in the transmitter, before (a) and after (b) a Thorlabs FBH650-10 bandpass filter. The figure shows a narrow range to make the differences between the spectra clearer Figure 2 The scheme of combining multiple sources into one spatial mode. The LEDs (a) are individually polarized by a patterned polarizer (b). The LEDs are placed closely so their emission cones overlap and an optical fibre is placed such that its NA overlaps the LEDs (c). The fibre is bent to remove cladding modes (d) and the fibre output is single moded (e) ployed due to its simplicity, and due to the low loss regime we are operating in, many of the more complex protocols do not provide much of a benefit to performance.
As mentioned above, using active modulation of the photons to produce the states was dismissed on all three SWaP criteria. Instead four separate sources are polarized in their respective BB84 polarizations and combined. This has previously been done with diffraction gratings [18], mirrors [19], beamsplitters [20,21] and waveguides [22]. In the interest of reducing the cost as much as possible our device uses, a short single mode fibre (SMF) (Thorlabs SM600), positioned to collect equal amounts of light from each source (Fig. 2), this has the additional benefit of ensuring that the output from the device is single moded, an important criterion for indistinguishability. A drawback of this method is that due to birefringence, SMF is not polarization maintaining and the polarizations will be rotated. This rotation is, however a unitary process so it can be corrected using an appropriate selection of wave plates. The requirement for extra wave plates is acceptable for our application as these can be placed in the QATM, therefore not increasing the SWaP of our transmitter.
Given the small NA of our single mode fibre [23] (NA = 0.1), to maximize coupling from the device, the LEDs need to be closely spaced. For this an LED package was assembled placing a 2 × 2 grid of LEDs in a chip carrier with 300 μm spacing ( Fig. 4. This allows for a minimum fibre-LED distance of 3 mm. A custom glass polarizer was commissioned (Codixx Colorpol) with linear polarization regions corresponding to the LED positions ( Fig. 3), this was glued to the package which also served as a protective window over the LED dies.  Using the apparatus shown in Fig. 5, the fibre position was scanned (in 100 μm steps) in front of the LEDs to find the best position to collect the maximum amount of light with high degree of polarization. Figure 6(a) shows the total counts received as the fibre is scanned across the LEDs. There are four overlapping peaks corresponding to slightly different points for maximum light collection from each LED. Mostly this step is used to ensure that the LEDs are relatively centred in the scan area and as corroboration for the later steps. Figure 6(b) shows the same data as Fig. 6(a), but only for the weakest coupled of the LEDs at each position. The peak occurs at the point corresponding to the middle of the LEDs where there is an amount of light coupled from each LED large enough to ensure WCP with a mean photon number compatible with QKD. Figure 6(c) shows the ratio of the brightest to the dimmest LED at each position. Ideally at some position, this value would be unity, showing equal coupling between all LEDs. This is similar to Fig. 6(b) but shows a better idea of the balance between the LED brightnesses.
The peaks at Fig. 6(b) and 6(c) are at the same position. Qualitatively, this position is also inside the square defined by the four peaks in 6(a), as expected. The fibre was then glued in this optimum position using low shrinkage UV cured adhesive (Norland NOA63).

Electronics
As the aim of this work is to build a fully functioning low SWaP QKD system, the control electronics must also adhere to that philosophy and hence the transmitter electronics is a  The FPGA clock is provided by a 100 MHz oven controlled crystal oscillator (OCXO) or from an external clock input if synchronisation to other devices is required. Additionally the FPGA generates a 10 MHz output derived from the OCXO, to allow optional external synchronisation. This 10 MHz output was connected to a Picoquant Picoharp300 to perform a time correlated single photon counting (TCSPC) measurement to determine the optical pulse with of the LEDs shown in Fig. 8. The FWHM pulse width was measured to be 1.6 ns from a 1 ns driving pulse from the FPGA. The drive pulse width of 1 ns was the shortest achievable with our current electronics design.
The current bill of materials for circuits and optics is below £500 and for large scale deployment one would certainly design bespoke optics and application specific integrated circuits (ASICs), which would dramatically decrease the cost per unit.

Receiver
The optics in the QATM comprise the standard beamsplitter design, using beamsplitters (BSs) (for passive basis choice) and polarizing beam splitters (PBSs) (for basis measurement) [24]. Even though this system uses the BB84 protocol, measuring in the rectilinear (H/V) and diagonal (D/A) bases, this receiver also measures in the circular basis (R/L) -this is to characterize the birefringence in the transmitter mentioned in Sect. 2.1, a schematic and photograph is shown in Fig. 9. Using all three bases allows measurement of the full Stokes parameters of the incoming light and from this the waveplate correction angles can be found using Mueller calculus. This does have an impact on the QKD rate, since during the transmission R/L detections do not contribute to the key, however the fraction diverted to this channel can be minimized using an appropriately chosen asymmetric BS. Each of the six outputs from the optics is coupled into an optical fibre (Thorlabs M43L01) to deliver the light to single photon avalanche diodes (SPADs) (2× Excelitas SPCM-AQ4C).
There exists many methods for aligning optical channels, previously we have used kinematic magnetic mounts (Newport M-BK-2A) [25] but these were large and unwieldy. Active beamsteering [20,26] is a compelling addition to the system but it adds extra complexity for an initial prototype device. For system simplicity, a 3D printed dock was designed. The transmitter fibre output ferrule protrudes from the device and is guided by the dock into a fixed focus collimator, pre-aligned with the receiver optics. Between the dock and detector optics is a stack of three waveplates (2× Thorlabs WPQ05M-633, 1× WPH05M-633) in motorized rotation mounts (Thorlabs DDR25), which perform on-demand correction of the transmitter birefringence.
The electronic pulses from the SPADs are connected to individual channels on a time tagger developed in house at the University of Bristol with a resolution of ≈50 ps and a maximal event rate of ≈1 MHz [27]. The time tagger digitizes the pulse arrival times for processing by a computer. The computer processes the received data and performs the calibration and key distillation.

System operation 4.1 Calibration
Before the QKD process can begin, the bases of the transmitter and receiver must be aligned. This process is performed by the transmitter lighting each LED in turn and the receiver measuring count rates in each detector for each LED. The ratio of counts in each basis is used to calculate the S 1,2,3 parameters of the Stokes vectors for each LED. Using the process of [28], the waveplate angles θ Q1 , θ Q2 , θ H are calculated and applied, the intermediate steps of this process are shown in Fig. 10.

Figure 10
The intermediate steps of correcting for fibre birefringence using quarter, quarter, half (QQH) wave plates. In this example, angles for the QQH wave plates were 66.2 • , 40.6 • , 77.2 • , respectively. Using Mueller matrices of polarizers, a predicted error rate of 5.6% is obtained. This is an upper limit. When we confine ourselves to measurements in the equatorial plane (V/H;D/A), and include postprocessing, a lower error rate is measured (see Sect. 5) To collect the data shown in Fig. 10, one second of counts in the six channels of the receiver was collected for each LED, with 0.5 second blank periods between to ensure no crosstalk between LEDs. Calculating the waveplate angles took 4.5 seconds and the waveplates set in less than 0.5 seconds. The total time for this process was 11 seconds.
While fibre birefringence is dependent on environmental conditions such as temperature [29], over the time scale of a QKD transmission, they are stable and this correction does not have to be carried out live. However, if QKD data processing could be performed in real time, an alternative calibration method could be used in which the transmitter simply starts transmitting QKD data and the receiver uses this data to work out the calibration angles, the receiver would then simply ignore the detections from before the system was adequately calibrated. This has been shown in [30] to only require a small number of detections. Another advantage of doing live calibration is that if the docking method of establishing the channel is replaced with an actively tracked method, the half wave plate could be used to compensate the rotation of the transmitter. Given our philosophy of re-ducing complexity in the transmitter, this method of compensating rotation is preferable to using other methods, such as the RFI protocol [31], which would require adding extra channels into the transmitter. There is no theoretical issue with implementing a real-time correction although the increased interactivity between processing algorithms and control logic will require careful implementation to ensure smooth operation of both.

Transmission isolation
To ensure the full transmission is collected by the receiver, the protocol requires that the receiver turns on their detectors before the transmitter starts sending photons and waits for the transmitter to declare they have finished sending photons before turning off the detectors. There is no high accuracy time synchronization between the devices however, so the first step in the processing is for the receiver to isolate the transmission in their received data stream. This is simply performed by examining the differences between successive time tags and observing where the intervals get smaller, indicating an increased count rate, this process can identify the start detection to approximately 10 3 clock cycles.

Clock synchronization
There is no shared clock reference between the transmitter and receiver, so small discrepancies in the on-board clocks of both devices will quickly cause the devices to desynchronize. To resolve this, the receiver reconstructs the transmitter clock by using the nominal rate (100 MHz in this case) as an initial value for the transmission frequency and refining this by processing the detections.
If the exact clock period is known, the received time tags can be divided modulo the clock period and plotted on a histogram to produce a peak (this is a variation on time correlated single photon counting -where the clock signal is exchanged using a wire -as such these histograms will be referred to TCSPC histograms). If the clock period guess is wrong, there will be no correlation and the histogram will be flat. Critically, over a short time scale, a slightly incorrect clock period will just lead to a widening of the histogram peak. This means that a guess can be refined by applying small adjustments ± from the guess and observing the peak width, as in Fig. 11(a). The histogram peak for 5 ms of received data is shown in Fig. 11(b). Performing a high resolution search here would be time consuming so a coarser search is performed, refining the guess only enough to perform the next step.
Following this bruteforce clock search, the clock drift is small enough to observe by plotting TCSPC histograms for subsequent small time slices of the data. Figure 12(a) shows the first 5, 20 ms slices which can be seen to "drift" along the x-axis, showing the clocks are not perfectly synchronized. This drift can be quantified by plotting the progression of the histogram peaks along the x-axis ( Fig. 12(b), blue). The peak positions "wrap" around the x-axis so this must be corrected by adding/subtracting a clock period at the discontinuities.
If the clock drift trend (Fig. 12(b), orange), is constant, the gradient of the line can be used to correct an offset factor to correct all the received time tags to synchronize them. If the trend is not constant, the time tags in each received slice can be corrected by subtracting that slice's peak position (Fig. 12(b)'s y axis). This is not as accurate since it does not take the exact position of a time tag in the slice into account but it allows this method to be used in a wider range of circumstances.

Gating and reconciliation
The tags are then divided modulo the recovered clock period (Fig. 13(a), and any detections with a remainder outside of the peak are discarded as these do not correspond to photons emitted by the transmitter. The quotient of the division is retained as a pulse number corresponding to the Nth transmitted photon (± K, an integer offset). The offset (K) is then found during reconciliation, where the transmitter sends a subset of their transmitted bits and the receiver tries to correlate it to their received data for varying offset values. Invalid K-values will produce uncorrelated results (error rate 50%) but one value will yield an acceptable error rate which can then be used to generate key ( Fig. 13(b)).
The gating process can also be used to estimate the temporal matching of the sources from the transmitter. By using one of the R/L channels in the receiver, where the collection from all the transmitted polarizations is equal, separate gating histograms can be plotted, observing the difference between their peaks. Since this is from one detector in the receiver, there is no effect of the receiver on the timing. Making this measurement optically is also preferred over measuring the logic pulses from the FPGA since it is the temporal matching of the optical pulses which is most important.   Figure 14 shows that at maximum the photons are 270 ps from perfectly overlapped, ideally this would be corrected in the FPGA by adding delays to the relevant channels. Unfortunately this functionality is not working as intended in the device as described in Sect. 2.2, but will be designed in to the next generation transmitter electronics that will replace this. This process also shows some sources have a small secondary pulse after the main pulse which is obviously harmful to temporal indistinguishability. This will be solved with more sophisticated driving electronics in future iterations.

Results
To test the system performance thoroughly, the QKD process was repeated many times with varying levels of background light, provided by a daylight simulating alarm clock (Lumie Bodyclock Glow 150). This was set to go from full brightness to off in 45 minutes, corresponding to approximately 150 QKD data collections. Figure 15 shows the error rate and predicted secret key rate over this period (for now, using the asymptotic regime [14,32] for simplicity), and also these metrics plotted against an estimate of the background rate obtained by counting the detections falling outside of the gate width.
Even at background light levels comparable to standard room lighting, non-zero key was achievable. In total darkness, the key rate reached up to 25 kbps.
Due to the wide range of conditions in which this system may be deployed, we analysed the effect of the gate width on the secret key rate. Naively one might think to set the gate width to the optical pulse width, but at high backgrounds this will likely allow too many errors and at low backgrounds will reject too much signal. To investigate this, the data was processed as described in Sect. 4.2 up to the point of gating, and then gating and reconciliation were performed repeatedly while changing the gate width. The results are shown in Fig. 16 for a high and low background data point (5 and 40 from Fig. 15). It can be seen that as the gate width increases, the error rate also increases since a wider gate allows more noise. Up to some point this error rate increase is counteracted by an increase in the signal also allowed through the gate. However beyond this point the increase in signal does not overcome key loss due to the increased error rate and the projected secret key rate starts to drop again [32].

Conclusion
We have demonstrated a prototype QKD system using a handheld transmitter and a large fixed terminal. The prototype device shows non-zero secret key rate in a range of background light levels. The system achieved a maximum key rate of over 20 kbps, sufficient for re-keying symmetric cryptographic algorithms and one-time pad protection of short high security messages such as in remote PIN verification.

Figure 15
The performance of the system given by the error rate (red, dashed/crosses) and secret key rate(blue, solid) as the background light was gradually dimmed (left), and same data from but plotted against the number of ungated tags (right), which estimates the level of background light Figure 16 Determining the optimum gate width by maximizing the secret key rate (blue, solid). This process is shown for high background (left) and low background (right). The values determined in this process were 2 ns and 4.2 ns respectively. Error rate is also shown as a guide (red, dashed) The SWaP of our prototype transmitter is shown in Table 1, compared to the targets discussed in Sect. 1. It is clear that we have achieved weight goals but are slightly over power and size budgets. However with careful engineering of optics and electronics we should be able to achieve these specifications.
Beyond the SWaP of the system, there are some outstanding issues with the design which we will continue to work on, these include: QRNG: Minimally, our transmitter requires 200 Mbps random numbers. This is without decoy states or unbalanced bases. There is not currently an off-the-shelf quantum random number generator with compatible SWaP available, although it has been shown that mobile phone cameras can be appropriated for quantum random number generator (QRNG) purposes [33]. For our prototypes the best we can do is settle for some other randomness source or rely on a large cache of randomness which is slowly replenished when the system is not generating key. We hope to investigate using recent IDQuantique devices such as IDQ20MC1 [34]. Processing speed: The clock recovery process is currently about 2x slower than the data collection so real time processing is not currently feasible. This does not appear to be a fundamental limitation, rather that the algorithm is a fairly brute-force method and further effort should be made into investigating more nuanced methods of clock synchronisation. Alternatively, we could take advantage of the fact that the algorithm is highly parallelizable, since each clock guess can be optimised independently. Equipping the receiver with hardware capable of fast parallel execution (such as GPUs), would significantly improve the performance of the existing methods and not violate our philosophy of cheap transmitter. Device size: While the device is unarguably handheld, the optics module is too big for anything other than a standalone device. For example at its current size this device could not practically be integrated into a mobile phone. That said much of the size of the optics module is "useless" plastic which is simply to aid manufacture and testing. The next generation optics is planned to be 50% smaller by better integrating the optical, mechanical and electronic components. Channel establishment: The slot dock demonstrated here is a simple proof of concept that enables the devices to be demonstrated. However practically this places unnecessary constraints on further development. For example any devices which wished to incorporate our QKD transmitter would have to be a certain shape to be compatible with the dock. A much more sensible evolution of this system would be to include active tracking to establish the link while the user continues to hold the device in their hand. Going forward we have partnered with the University of Oxford, integrating our system with a beamsteering solution based on their work in [20]. Brightness: The existing mean photon number is quite low (μ = 0.025), we suspect this is due to the driving electronics, namely the ONET 1101L chips which were designed to driver laser diodes not LEDs. Whilst there are no commercial LED driver chips with ≈GHz bandwidth, we have identified promising alternatives which have a higher maximum current capacity which would be able to counteract the higher junction capacitance of LEDs compared to laser diodes. In terms of security as our channel loss is less that 10 dB we can expect to be able to increase mean photon number to μ = 0.1 with needing to use additional security schemes such as decoy states. Security Analysis: This work has mainly focused on the engineering aspects of building a QKD system, and whilst Sect. 5 quoted secret key rate estimates using [14,32], finite key effects [35,36] have not yet been considered in the key rate calculations.