1 Introduction

Recent progress in the development of quantum computers poses new risks for today’s cryptography  [1]. One possible solution to prevent attacks against classical key distribution schemes is quantum key distribution (QKD) [2]. In this paper, we demonstrate the flexibility of a multi-user QKD network we have recently developed.

The basic functionality of the network has been described in Ref.  [3]. The system consists of multiple fiber-based modules, as depicted in Fig. 2, enabling easy handling and simplifying modifications. Up to four identical receiver modules, each consisting of an imbalanced Michelson-type interferometer and two detectors, are connected to the photon pair source by optical fiber links. The star-shaped topology allows to efficiently scale up the number of users in the network and is advantageous compared to prepare-and-measure QKD networks requiring a QKD transmitter and receiver for each network participant. The network distributes time-bin entangled photon pairs from a central untrusted source to the users, which derive quantum keys from the arrival times of the photons according to the BBM92 time-bin QKD protocol [4,5,6].

In this paper, we present additional features of this modular QKD system, demonstrating the flexibility, robustness, and scalability required in practical quantum network applications. Entanglement-based QKD networks have been realized with polarization-entangled photons [7,8,9] as well as with QKD protocols based on dispersive optics [10, 11] or phase coding [12, 13]. An advantage of such networks is that they do not require a trusted node, which benefits security. Furthermore, they are scalable to a higher number of users with longer transmissions distances than ring-shaped networks [14].

Fig. 1
figure 1

Scheme of the implemented BBM92 time-bin protocol enabling a network of the four participants Alice, Bob, Charlie, and Diana. The phases of the imbalanced interferometers are \(\varphi\), \(\alpha\), \(\beta\), \(\gamma\), and \(\delta\). Mach–Zehnder interferometers are shown for clarity, but in practice, Michelson interferometers with Faraday mirrors are employed

Full size image

2 Setup

In the photon pair source, a LiNbO3 amplitude modulator shapes pulses from a frequency-locked cw (continuous wave) laser centered around the frequency of 193.35 THz corresponding to roughly 1550.5 nm. The pulses are amplified by an erbium-doped fiber amplifier (EDFA) and pass an imbalanced interferometer with an optical path length difference exceeding the pulse duration. Photon pairs are produced in a cascade of second-harmonic generation (SHG) and spontaneous parametric down-conversion (SPDC) and are then distributed to the users. In the receiver modules, the photons pass through phase-stabilized interferometers with a path length difference precisely matched to that in the photon source. The photons are detected at the two interferometer outputs with single-photon avalanche detectors (SPADs) operated at a dead time of 10 \(\upmu\)s and a detection efficiency of 20%. A time tagger records the photon arrival times with 13 ps resolution. Depending on the path combinations of the long and short interferometer arms in the source and receiver, the photons arrive in one of three different time bins. Quantum bits in the time basis are derived from photon detections in the two outer time bins. The bit value is zero or one, depending on photon arrival in the early or late time bin. When both photons of a pair are detected in the central time bin, the outputs at which they leave the interferometers are correlated due to two-photon interference [15]. The phases are adjusted to maximize the interference contrast by controlling the interferometer temperatures with sub-millikelvin precision. They are automatically realigned during the key exchange to minimize the quantum bit error rate (QBER), which is evaluated every 90 s, at the minimum. By assigning bit values to the two detectors, the users obtain quantum bits with a value depending on which detector clicked, which constitutes the second QKD basis.

Each user recovers the clock time of the photon source from the photon arrival times, such that neither an additional synchronization channel nor highly precise local clocks are needed. Thereby, the receiver modules become technically simpler and more cost-efficient simplifying the scalability of the network.

We have implemented two different SPDC modules for the source, containing different periodically poled LiNbO3 waveguides. One module contains a crystal for the generation of orthogonally-polarized photon pairs by type-IISPDC and the other contains a crystal generating parallel polarized photon paris with a broad spectrum by type-0 SPDC. Changing the source operation mode between type-II and type-0 SPDC requires only swapping a single module resulting in a large flexibility.

The orthogonal photons are efficiently separated by a polarization beam splitter with a low insertion loss. The parallel photons are separated into different frequency channels by a wavelength division demultiplexer (WDM), enabling the simultaneous distribution of independent keys to multiple pairs of users (cf. Fig. 1). A pair of communication partners is assigned to a pair of WDM frequency channels symmetric around the central frequency.

Fig. 2
figure 2

Modular setup of the photon pair source generating time-bin entangled photon pairs either in single-pass or double-pass configuration

Full size image

2.1 Long-term key exchange

To demonstrate the robustness and long-term stability of our QKD setup, we operated the type-0 SPDC module and performed a simultaneous QKD exchange between the user combinations of Alice, Bob, and Charlie, Diana. The whole setup was placed at a facility of Deutsche Telekom AG. A field-deployed 27 km long dark fiber loop connects the source to Alice’s receiver module. Bob is connected via 81 km of spooled fiber. Charlie and Diana are connected through optical fiber spools as well.

A key exchange over 86 h over a total distance of 108 km between Alice and Bob, including the deployed fiber, is shown in Fig. 3. After the initial fully automated phase alignment, taking roughly 40 min, we achieved an averaged sifted key rate of 17.0(8) bits\(/s\) with a mean QBER of 4.25 % between Alice and Bob. Charlie and Diana were connected through a total fiber distance of 31 km leading to a recorded averaged sifted key rate of 171(5) bits\(/s\) with a mean QBER of 2.3 %. Hence, we demonstrated a continuous, automatic operation over three days with very stable key rates showcasing the robustness of our system.

Fig. 3
figure 3

QBER and sifted key rate of simultaneous quantum key exchange between the pairs Alice–Bob and Charlie–Diana. Alice is connected to the source via 27 km of field-deployed fiber. Bob, Charlie, and Diana are connected via 81 km, 10 km and 21 km fiber spools, respectively. The SHG power pumping the type-0 crystal was set to 90 \(\upmu\)W and the width of the WDM channels was chosen to 50 GHz for Alice and Bob and to 25 GHz for Charlie and Diana. QBER fluctuations (spikes) are caused by phase drifts of the interferometers. They are automatically detected and compensated by temperature adjustments of the interferometers. During the measurement, the data link connection to the time taggers was lost twice so that the data for a few runs could not be evaluated (blue lines). The connection loss was automatically detected and reestablished so that the key exchange could continue

Full size image

3 Flexible source operation

Any practical source should allow the flexible adaption to changing key parameters such as different transmission losses, key rate requirements, and receiver detection capabilities to optimize the QKD performance without time-consuming and costly setup modifications. Therefore, this flexibility of our source was demonstrated next.

3.1 Time bin interleaving

Chromatic dispersion leads to an elongation of the photon wave packets in time with 17 ps per nanometer of spectral width and per kilometer of optical fiber [16]. For fiber lengths in the range of tens of kilometers, our photon wave packets become hundreds of picoseconds longer. If the delay in the interferometers is too short, photons can leak into adjacent time bins because of the chromatic dispersion, which would increase the QBER. Dispersion compensation modules can be used to reduce the elongation of the wave packets and to avoid the leakage. However, using such modules would increase the losses and would make the receiver modules more expensive.

Alternatively, the delay between the time bins must be chosen so large that although the wave packets are elongated, they do not leak into the adjacent time bins. For the QKD network the delay was chosen to 3.03 ns, which is much longer than the time bin width (cf. Fig. 4a). Leakage due to chromatic dispersion is, therefore, avoided. When the wave packets become longer, the time bin width can be increased such that all photons are still assigned to the correct time bins. However, the large separation of the time bins increases the total pulse repetition cycle time and in turn reduces the pulse repetition rate and thereby the key rate. For short transmission distances where the chromatic dispersion is low, it would be desirable to use the empty time intervals between the time bins to keep the key rate high.

We initially run the source at a fundamental repetition frequency of 110 MHz, leading to an equally distributed three-peak structure in the arrival time histogram of each receiver. Provided the optical pulsewidth does not lead to pulse overlapping, a second three-peak structure can be interleaved with the first one by doubling the repetition rate to 220 MHz (cf. Fig. 4b). By simultaneously increasing the repetition frequency and the SHG pump power in the source, we can achieve higher key rates at equal QBER values. This can be performed a second time and thus, for the first time, we demonstrate QKD with four interleaved pulse cycles, i.e., at a 440 MHz repetition frequency (cf. Fig. 4c). Table 1  shows the system performance at constant \(\mu\) operated with the different repetition frequencies.

When the average SHG pump power is kept constant while the repetition rate is increased, the effective mean photon pair number per repetition \(\mu\) decreases. Lowering \(\mu\) leads to a lower multi-pair emission probability per repetition and, therefore, to a reduceded QBER. The pulse interleaving can, therefore, also be used to reduce the QBER.

Fig. 4
figure 4

Photon arrival time histograms at repetition frequencies of a 110 MHz, b 220 MHz and c 440 MHz. a At 110 MHz, the time between the equally spaced peaks corresponds to the interferometer’s time delay. The photons are sorted into three 1-ns wide time bins (blue). b Doubling the frequency leads to two interleaved three-peak structures (blue and red). The pulsewidth is chosen to 300 ps. c At the repetition frequency of 440 MHz, the pulsewidth has been reduced to 180 ps

Full size image
Table 1 Results for different interleaving levels at a constant mean-photon number per pulse \(\mu\) between Alice and Bob
Full size table

3.2 SPDC type-II and type-0 modules

Our QKD system can be operated with both type-0 and type-II SPDC modules. In type-II measurements, photon pairs emerge in a 125-GHz wide spectrum as shown in Ref. [17] and are separated by a polarization beam splitter. The conversion efficiency is 7.6(2) × 10-10 photon pairs per pump photon. In type-0 measurements, photons are produced in a 9.3 THz wide spectrum and separated by WDM before being sent to all four users. The conversion efficiency density in the center of the spectrum is 6.81 × 10-7/THz. The conversion efficiency per channel is the product of this density and the channel width.

Due to the lower conversion efficiency, the source must be operated at a higher mean SHG power for type-II SPDC. An advantage of the type-II setup is the photon separation by the polarization beam splitter which has a much lower insertion loss than the WDMs, yielding higher key rates at the same \(\mu\). Alternatively, at comparable key rates, the type-II key exchange occurs with a lower \(\mu\) value resulting in a reduced QBER due to fewer multi-photon pair emissions.

Using the source with the type-II module is favorable when the setup is used to distribute quantum keys between only two users. Table  2 compares the results between inserted type-0 and type-II module for a QKD exchange between Alice and Bob. Alice was connected to the source via the 27 km deployed fiber loop and Bob via a 50 km long fiber spool. The secret key rate is calculated as [18]

$$\begin{aligned} r_{\rm sec}= r_{\rm sift}\left[ 1-\big (1+f\big )H_b(q)\right] \end{aligned}$$
(1 )

with the sifted key rate \(r_{\rm sift}\) and the QBER q. The function \(H_b(p) = -p\log _2(p)-(1-p)\log _2(1-p)\) is the binary entropy. As an estimate for the reconciliation efficiency we use \(f=1.5\) [18] . Although the type-II and type-0 processes have been recorded with the same sifted key rate, the lower QBER in the type-II measurement yielded an approximately 37 % higher secret key rate.

Table 2 Performance comparison for QKD between Alice and Bob over a distance of 77 km using type-0 and type-II modules
Full size table

3.3 Double-pass configuration

The photon pair source configuration discussed so far requires two nonlinear optical crystals for SHG and SPDC. Both crystals are 34 mm long periodically poled lithium niobate (PPLN) crystals of the same type. Therefore, in principle, only a single crystal is required when passed in forward direction for SHG and in backward direction for SPDC. Using the same crystal for SHG and SPDC significantly reduces the cost of the source. Here, we demonstrate a bidirectional operating scheme producing time-bin entangled photon pairs. A similar scheme has been used to produce polarization-entangled photon pairs [19].

For double-pass operation, a polarization-maintaining circulator is placed in front of the type-0 module, after which a 2 m tightly curled 775 nm fiber is placed acting as a filter for remaining pump light. A retro-reflector then directs the SHG light back into the crystal for the SPDC process. An additional narrow filter for 1550 nm pump light consisting of two dense wavelength division multiplexing (DWDM) filters and two fiber Bragg gratings is inserted to suppress residual laser photons at the center wavelength leaking into the output of the circulator.

The double-pass setup requires a careful design in order to avoid effects deteriorating the QKD performance. The crystal has angle-cut anti-reflection-coated end facets suppressing reflections in order to avoid noise in the photon pair production. Photon pairs down-converted during the forward pass are removed by propagating them through a tightly coiled fiber.

The pump laser light at 1550 nm can generate a broad Raman background in the optical fibers again increasing the noise level [20]. Raman photons generated at wavelengths outside of the WSS are filtered out by the C-band filter. Raman noise generated in the optical fibers before the crystal within the bandwidth of the filter is filtered out by the coiled fiber, similar to the pump light. However, Raman photons generated from pump light in the fiber between the circulator and the SHG crystal traveling in the backward direction could lead to background noise. The effect can be reduced by shortening this fiber section to a minimum.

Table  3 compares the QKD performance over 77 km transmission distance between the single-pass and double-pass configuration. In double-pass configuration, the key rate is significantly lower due to additional losses introduced by the filters after the pair generation. Additional losses ahead of the SPDC process are compensated by adjusting the pump power of the EDFA and thus do not affect the measured key rate and QBER. However, we observe an increased and unstable QBER in the phase basis compared to the QBER determined in the time basis caused by phase instabilities of the pump-interferometer due to the considerably higher power dissipated in the interferometer.

This is confirmed by repeating a QKD measurement with a slightly lower \(\mu\) by reducing the pump power showing that the fluctuations and mean value of the QBER in the phase basis match the QBER in the time basis. However, this problem can easily be solved. By reversing the order of the EDFA and the pump interferometer (cf. Fig. 2), the weak pulses pass the interferometer before they are amplified such that phase instabilities are drastically reduced. We have confirmed that in this configuration, the QBER in the phase basis reaches values as low as in the time basis proving that Raman noise does not limit the performance of the double-pass source.

Table 3 QKD performance with a single nonlinear PPLN crystal operated in double-pass (DP) configuration in comparison with results obtained with two crystals in single-pass (SP) configuration (cf. Fig. 2)
Full size table

4 Network topology

The distribution of photon pairs to multiple communication partners is realized by demultiplexing the type-0 SPDC spectrum of the source. We demonstrate the flexibility of our system to allocate WDM channels with three different commercial wavelength demultiplexers. Two standard arrayed-waveguide gratings with 100 GHz and 50 GHz channel spacing as well as a \(1 \times 9\) wavelength-selective switch (Lumentum TrueFlex) are at our disposal. The C-band filter suppresses cross-talk with higher diffraction orders of the arrayed-waveguide gratings after the SPDC module. The filter reduces the accessible photon pair spectrum to 5 THz. The QKD performance using the three different WDMs is shown in Fig. 5. Using the 50 GHz AWG, up to 78 participants can be connected to the network.

Fig. 5
figure 5

QKD performance as a function of the WDM channel distance from the center frequency of 193.35 GHz for the three demultiplexers. A total of 16 channel pairs can be connected to the 100 GHz arrayed-waveguide grating (red) and 40 pairs to the 50 GHz AWG (green). Two output channels of this AWG (marked with a*) showed exceptionally low key rates because the fibers of these channels were defective. Measurements with the 100 GHz arrayed-waveguide grating were performed between Bob and Charlie at a total distance of 60 km, whereas for the 50 GHz AWG and the WSS the combination Alice-Bob was connected through 77 km of fiber. The secure rate is calculated by Eq. (1) based on Ref. [18]

Full size image

4.1 Optical switching

Using the WSS, channels can be configured to any of the fiber output ports [8] and the channel’s widths can be adjusted individually and down to a minimum of 6.25 GHz. Thus, adaptive bandwidth allocation based on the user’s key demands becomes possible, constituting another way to control the effective mean photon pair number \(\mu\) received by each two-party combination [21, 22] . Furthermore, the predefined party combinations can now be dynamically switched during operation, turning the presented static star-shaped network into a dynamic reconfigurable network. We demonstrate for the first time such dynamic network allocation in an entanglement-based QKD network using a time-bin protocol. The results of a key exchange measurement with dynamic switching between all possible network combinations every six hours are shown in Fig. 6. After reconfiguration, the interferometer phases of the newly connected user pairs are generally not aligned, resulting in a high QBER. Therefore, after each reconfiguration, re-alignment by the phase alignment algorithm is automatically executed. Once the QBER is minimal, key exchange can commence.

Fig. 6
figure 6

Dynamic reconfiguration between all possible party combinations. The WSS switches the channel configuration every six hours. The channel width is set to 50 GHz. Alice, Bob, Charlie, and Diana are connected through fiber lengths of \(27\) km, \(50\) km, \(10\) km and \(21\) km, respectively. The different secure key rates are due to different total fiber distances between the user combinations. The required times for phase alignment are marked in grey. This procedure takes roughly 30 min

Full size image

4.2 Co-propagation of QKD signals

In the standard star-shaped network configuration, each party is connected to the photon pair source through a dedicated optical fiber. However, it might be either necessary or beneficial to shorten the total length of dark fibers used for QKD to save on infrastructure costs. The fiber resources can be used more efficiently by sending multiple wavelength channels through the same optical fiber. Based on this approach, a modification of the star-shaped network structure is feasible, where a single source connection fans out into sub-nets. Users located close to each other can be connected to a node, which is connected to the photon pair source by a single fiber. The node receives all wavelength channels assigned to this sub-net and carries out demultiplexing, as depicted in Fig. 7. To demonstrate such a network configuration, a QKD measurement between Alice-Bob, and Charlie–Diana was performed, with two nodes, each connecting two users over the same optical fiber to the source. The sub-net of Alice and Diana was connected through the 27 km deployed fiber, whereas the sub-net of Bob and Charlie was connected through a 50 km fiber spool. Two channels were assigned to the same output of the wavelength-selective switch before they were demultiplexed after transmission by dense–wavelength–division–multiplexing filters (DWDMs). The DWDMs were specified with a pass bandwidth of 200 GHz, and two 100 GHz channels were configured with the WSS. A secure key rate between Alice and Bob of 16.9(45) bits/s was achieved over a duration of 2 h. The rate for Charlie–Diana was slightly lower with 13.6(22) bits/s due to relatively high losses in the DWDM filter connected to Diana.

To achieve the full flexibility in such a topology, the filters can be replaced by wavelength-selective switches (WSSs). They allow for channel widths as low as 6.25 GHz and are commercially available with more than 30 add/drop ports. With the current WSS, a bandwidth of 4.5 THz of the photon pair spectrum can be used. By connecting each of the outputs of the first WSS to a second WSS, a remotely switchable QKD network with hundreds of users could be established with only one further layer of WSSs.

Fig. 7
figure 7

Tested network topologies utilizing a wavelength-selective switch for WDM. Our standard star network topology in a can be modified to a network structure with a cascade of demultiplexers, as shown in b to share entanglement. The network is divided into two sub-nets Alice–Charlie and Bob–Diana, which are connected via demultiplexing nodes (DWDM) to the central photon pair source

Full size image

5 Discussion and outlook

We have demonstrated the flexibility and versatility of a robust and scalable QKD system using a time-bin entanglement-based protocol. It can be used e.g. to establish metropolitan-scale QKD networks covering distances up to 100 km between the users. The network enables flexible and continuous QKD via a robust, all-fiber photon pair source in a modular setup. We achieve key rates over 77 km distance above 40 bits\(/s\) with a QBER below 3 %. Implementing fourfold pulse interleaving by setting the pulse repetition rate to 440 MHz, we can increase the sifted key rate to 63 bits\(/s\) at comparable QBERs.

Increasing the repetition frequency to even higher powers of two of the fundamental frequency would be possible by further shortening the SHG pulse in the source and by employing detectors with significantly lower timing jitter. The timing jitter of the currently used single-photon avalanche detectors is 250 ps. By using commercially available superconducting-nanowire single-photon detectors with a jitter below 25 ps and detection efficiencies around 70 %, the system could be operated at GHz repetition frequencies and key rates in the kbits/s become feasible.

We have demonstrated photon pair generation using a cascade of SHG and SPDC within a single nonlinear PPLN crystal, reducing costs significantly. Our system is compatible with time- and wavelength-division multiplexing schemes, similar to fully connected networks presented in Ref. [8, 9], but does not require polarization control of the transmitted photons. By wavelength demultiplexing of the SPDC pair spectrum, multiple users can share keys pairwise in a star-shaped network topology via a single untrusted source.

We prove the direct scalability of our current system to 78 users, using an AWG with 50 GHz wide channels. Employing a WSS, we demonstrate dynamic and on-demand reconfiguration of the network links during system operation. As the output ports of the implemented WSS are limited, scalability can still be achieved by cascading a second demultiplexing stage. While this can occur at the central photon source of the star-shaped network, we also demonstrate cascaded demultiplexing with DWDM filters after the co-propagation of two distinct quantum channels in a single optical fiber. If instead of the DWDM filters, wavelength selective switches are implemented, a fully connected network can be realized.

We thank Paul Wagner, Felix Wissel and Matthias Gunkel from Deutsche Telekom Technik GmbH for lending us AWG, WSS, and fiber spools and for the opportunity of field-testing the QKD system with a deployed dark fiber.