1 Introduction

The need for secure transmission of information depends crucially on the level of paranoia in an organization. Thus, there has been a need to maintain secure transmission of information within government organizations, especially in defense, or large corporations, especially with regards to trade secrets. Yet, how do we transmit messages securely?

Cryptography, the ancient art of secret writing, has always been a combination of scrambling and confusion. A good scrambling of the plaintexts (messages) is the basis of many symmetric-key encryption schemes, like the Advanced Encryption Standard (AES). There is also asymmetric-key encryption algorithms or public key distribution systems that use a pair of keys, a public key associated with the creator or sender for encrypting messages and a private key that only the receiver (often the originator) knows for decrypting that information. One such public key scheme is the Rivest-Shamir-Adleman (RSA) protocol which relies essentially on the difficulty of factoring two large prime numbers.

Conceived much earlier (at least 10 years earlier), but finally published in 1983, Wiesner outlines a protocol for storing quantum money in two conjugate bases:the first one in vertical and horizontal polarization and the second one in right and left circular polarization [1]. Wiesner communicated this idea to Charles Bennett who subsequently proposed a quantum key distribution with Gille Brassard based on the idea of “conjugate” bases [2, 3]. In an independent research, Artur Ekert proposed a different approach to establish a secret key between two parties based on the correlations of two entangled particles [4].

2 Quantum key distribution

A cryptographic channel comprises of two distant parties that share a communication channel so that they can communicate securely and privately despite the presence of an eavesdropper. The two parties are typically labeled Alice and Bob, two fictitious characters first popularized by the same Rivest, Shamir, and Adleman [5] who propounds the RSA scheme. The search for an unbreakable cipher remained the “Holy Grail” of cryptography until 1949 when it was shown that one could achieve secure communication theoretically via the one-time-pad (OTP) method (Vernam, 1926) as long as the two users, Alice and Bob, share a sufficiently long random string that is kept secret from Eve. Note that for the OTP scheme to be theoretically secured, it is important that the random string used as the one-time pad is as long as the message itself, and that it is used once and never reused [6].

The protocol of distributing such a long key in a one-time pad in the presence of an eavesdropper, typically called Eve, is known as the key distribution problem. Traditionally, such one-time pad are carefully duplicated and distributed to two distant parties through various means, like through a courier, for instance. However, this distribution method suffers from various espionage tactics and it is never very secure. Moreover, once an eavesdropper has access to the one-time pad, he or she can easily copy the contents without either Alice or Bob knowing.

In this review, we survey the landscape for chip-based quantum key distribution. We focus primarily on our two recent work in the area: one on continuous variable QKD and another on measurement device independent (MDI)-QKD.

3 Chip-based technologies

The spectacular success of microelectronics has shown that there is an enormous potential for turning basic physics into applications through miniaturization. Silicon photonic technology offers many unparalleled benefits including small size, low cost, low power consumption, and well-established batch fabrication techniques [7]. Indium phosphide (InP) [8], lithium niobate (LiNbO3) [9] and potassium titanyl phosphate (KTP) [10] have been used to fabricate on-chip lasers and fast modulators. Silicon technology provides low-loss delay lines and fiber-chip couplers. However, the technology lacks rapid modulation [11, 12]. Silicon relies on well-established microfabrication techniques which is ideally suited for on-chip photonic components [13–15].

4 BB84

The theory behind BB84 is well documented [16–20]. Alice randomly transmit random bits based on one of the two bases: {|H〉,|V〉} or {|+〉,|−〉} corresponding to bits {|0〉,|1〉} respectively. When Bob receives the photon, he randomly selects one of the two bases to measure. Naturally, if he selects the correct basis, he gets the correct transmitted bit. However, if he does not selects the correct basis, he incurs an error. Alice and Bob then reveal their bases but not their transmitted bits and discard all bits in which Alice and Bob uses different bases. On average, half of the bits transmitted are lost. To ensure further safety in the transmission, they then chooses to verify their bits (by revealing their bit publicly) and immediately discard those bits. This is the process of reconciliation. If there is no eavesdropper, they should always agree on these bits. Any deviation from perfect fit then gives them an idea on the amount of eavesdropping.

The BB84 protocol has been demonstrated experimentally with linear optics over long distances through optical fibers and free space. The first experiment is done with Alice controlling two pockel cells so that she is able to transmit the four polarization states [17]. Since then, there have been many experimental confirmation of QKD over longer and longer distances through fibers [21, 22], free space [23, 24], and satellites [25–27].

In Ref. [8], the researchers implement the BB84 QKD protocol with time-bin encoding on a chip. With this scheme, a photon encodes the state |0〉 in the first time-bin and a second photon encodes the state |1〉 in the second time-bin. The state |+〉 denotes the superposition of the first and second time-bin photon with zero relative phase. The state |−〉 denotes the superposition of being in the first and second time-bin with a relative phase of π. The BB84 protocol transmits one of two orthogonal states chosen at random and encoded in one of two randomly chosen non-orthogonal bases: the Z-basis {|0〉,|1〉} and the X-basis {|+〉,|−〉}.

In Ref. [8], the BB84 QKD protocol is implemented with time-bin encoding on a chip. In this scheme, the state |0〉 is encoded by a photon in the first time-bin and the state |1〉 is encoded by a photon in the second time-bin. The state |+〉 is encoded as a superposition of the first and second time-bin photon with zero relative phase. The state |−〉 is encoded as superposition of being in the first and second time-bin with a relative phase of π. The BB84 protocol transmits one of two orthogonal states chosen at random, encoded in one of two randomly chosen non-orthogonal bases: the Z-basis {|0〉,|1〉} and the X-basis {|+〉,|−〉}.

In the experiment in Ref. [8], the transmitter chip (using InP) consists of an on-chip tunable laser, formed from two distributed Bragg reflectors (DBR) and a semiconductor optical amplifier (SOA). The continuous wave single-mode laser source has a coherence time >1.5 ns with a side-mode suppression ratio of >50 dB It operates at a wavelength of 1550 nm with a 10 nm tuning range. Short electrical pulses are applied to the reverse biased EOPM in the first Mach—Zehnder interferometer (MZI) and optical pulse with <150 ps duration and 30 dB extinction ratio are generated.

The receiver chip comprises alternating layers of SiO2 and Si3N4 and etched onto a substrate to create a waveguide structure for guiding light with a high index-contrast at a low loss (0.5 dB/cm). The coupling loss between chip and fiber is also low at 2 dB, providing a total loss 9 dB for BB84 configuration.

In Ref. [8], they actually implemented three different protocols: BB84, coherent one-way (COW) [28] and differential phase shift (DPS) [29]. In all cases, the performances are comparable to the state-of-the-art current fiber and bulk optical systems that have been achieved with a key rates of 345 kbps (BB84), 311 kbps (COW) [8] and 565 kbps (DPS). Similar experiments have also been demonstrated elsewhere [30–33].

5 MDI-QKD

5.1 Theory

Measurement-device-independent quantum key distribution (MDI-QKD) employs an untrusted relay to prevent the communication channel from side-channel attacks commonly encountered in earlier QKD protocols.

To understand MDI-QKD, we follow the nice description in Ref. [34]. To do this, we first introduce an Einstein-Podolsky-Rosen (EPR)-based QKD protocol. Alice and Bob first prepares an EPR pair and sends half of it to an untrusted third party, Charles. Charles then performs an entanglement swapping operation [35, 36] on the incoming signals via a Bell state measurement (BSM), and then broadcast his measurement results. On completion of the measurement, Alice and Bob measure their halves of the EPR pairs with two conjugate bases (the rectilinear basis Z, or the diagonal basis X) that they select at random. By doing so they can determine whether or not Charles is honest. For this, they can compare a randomly chosen subset of their data to test if it satisfies the expected correlations associated with the Bell state declared by Charles.

As shown in the excellent review, Ref. [37], this protocol can also be implemented in a “time-reversal” fashion. This is so because Charles’ operations commute with those of Alice and Bob. Therefore, one can reverse the order of the measurements. That is, it is not necessary that Alice and Bob wait for Charles’s results in order to measure their halves of the EPR pairs, but they can measure them beforehand. Note that Charles’ BSM is only used to check the parity of Alice’s and Bob’s bits and, therefore, it does not reveal any information about the individual bit values. This rephrases the original EPR-based QKD protocol into an equivalent prepare-and-measure scheme where Alice and Bob directly send Charles BB84 states and Charles performs the measurements. Most importantly, like in the original EPR-based QKD protocol, Alice and Bob can test the honesty of Charles by just comparing a random portion of their signals.

5.2 Experiment

Experimental demonstration of MDI-QKD has been performed in Refs. [38, 39] with bulk optics over long distances. The set-ups are ideal for a quantum network. In Ref. [38], a time-bin phase-encoding MDI-QKD scheme is realized, whereas in Ref. [39], the researchers assess the feasibility of MDI-QKD using the decoy-state protocol proposed by Wang [40].

Recently, we have realized a fully chip-based MDI-QKD system (see Fig. 1). We were not the only group to do it on photonic chip. There are also two other excellent pieces of work: the first in China led by Feihu Xu and Jianwei Pan [41] and the second in Bristol led by Mark Thompson, John Rarity, and Chris Erven [42]. Here, we describe our system. Our system comprises two transmitter chips (Alice and Bob) and one receiver chip (Charlie). The key components of the transmitter chip are the intensity modulators for the decoy states, phase modulators, and polarization modulators. These devices are fully integrated into a single chip. The receiver chip integrates polarization-independent beam splitters (BS) and polarizing beam splitters (PBS). In our experiment, we demonstrate a key rate per pulse of 2.923×10−6 which is sufficient for low-error quantum communications.

Fig. 1
figure 1

Schematic diagram of the silicon photonic chip-based MDI QKD system. The system comprises three silicon photonic chips (Alice, Bob, and Charlie) among which Alice and Bob chips are the transmitters and Charlie chip is the server. Alice and Bob chips consist of intensity modulators, phase modulators, and polarization modulators, which are capable of generating phase-randomized signal and decoy-state weak coherent pulses in BB84 polarization states. Charlie’s chip is made up of a polarization-independent beam splitter and two polarizing beam splitters and it is capable of performing Bell state measurement of the incoming states with off-chip single-photon detectors (SPDs). MOD, modulator; PPC, path-to-polarization converter; EPC, electrically driven polarization controller

Full size image

For the transmitter chip, a pulse-modulated 1542.3815-nm frequency-locked laser is coupled into the silicon waveguide through a grating coupler. The first Mach-Zehnder interferometer (MZI) modulator modifies the laser intensity to create signal and decoy states, and another phase modulator implements random phase modulations of the input pulses. Polarization states |H〉,|V〉,|+〉 and |−〉 are encoded by a polarization modulator consisting of an MZI modulator, a path-to-polarization convertor (PPC), and phase shifters at the PPC input arms. Light is coupled out of the chip through an adiabatic tapered waveguide coupler and a lensed fiber with a 3- μm spot diameter. The edge coupler is designed with a cross-section of 200nm×220nm to minimize the polarization-dependent loss (PDL). After attenuation, the weak coherent pulses from the two transmitter chips reach the receiver chip (Charlie) via optical fiber spools. The receiver chip consists of a polarization-independent BS and two PBS. Before entering the receiver chip, the pulses are compensated for polarization drift by polarization controllers in order to maximize the Hong-Ou-Mandel (HOM) interference between the transmitted photons from Alice and Bob chips. Finally, Bell states are measured with single-photon detectors, and all coincidence events for secure key generation are publicly announced. The security of MDI-QKD is guaranteed because the measured outcomes do not contain any information on the secret key encoding.

Both the MDI-QKD transmitter and receiver chips were designed and fabricated by using advanced silicon photonic fabrication techniques, which utilized silicon-on-insulator (SOI) wafer with a top silicon layer of 220 nm and a buried oxide layer (BOX) of 3 μm. The top silicon was etched to form grating coupler. Slab layer of ridge waveguide in PPC and other components were fabricated using inductively coupled plasma-reactive ion etching (ICP-RIE). Subsequently, strip waveguide was formed by etching through the remaining silicon. On completion of the waveguide etching, silicon oxide was deposited on the silicon chip. Titanium nitride (TiN) is then added to form the waveguide heaters. Aluminum (Al) was then deposited to provide the necessary electrical connection between external power source and waveguide heaters. Finally, we etch isolation trenches in order to prevent thermal crosstalk between adjacent heaters. The intensity modulators, phase modulators, and polarization modulators were integrated onto a single transmitter chip. Figure 2a and b illustrate the optical micrographs of the transmitter and receiver chip, respectively. Figure 2c shows the transmitter chip packaged on a printed circuit board (PCB).

Fig. 2
figure 2

Picture showing the size of the MDI-QKD chip with integrated photonic circuits together with the peripheral set up. Insets shows the zoom-in version of the tiny chip

Full size image

The MDI-QKD architecture is naturally suited for multi-user QKD networks [43], since the most expensive and intricate component—the measurement device—can be placed in an untrusted relay and shared among many QKD users. Therefore, MDI-QKD has been widely recognized as a promising quantum communication technology for star-type secured networks [34, 44].

6 CV-QKD

Continuous variable QKD or CV QKD refers to quantum communication with weak coherent pulses and homodyne detections. Compared with discrete variable QKD, continuous variable QKD appears to be more suitable for photonic chip integration due to its compatibility with existing telecom technologies. The advantages and disadvantages of discrete QKD and CV QKD is well-documented [45, 46]. Yet, the security analysis of this technique is a lot more complicating compared to discrete-variable QKD despite the simplicity in the actual protocol.

There are two prepare-and-measure continuous variable QKD or Gaussian QKD: (i) an entanglement based scheme using two-mode squeezed states and (ii) a scheme based on coherent states and heterodyne detections.

In the entanglement-based scheme, Alice prepares a two-mode squeezed vacuum state. Alice prepares a coherent state, whose displacement vector is Gaussian distributed in x and p, by applying a heterodyne measurement at her share of the two-mode squeezed state. Bob then applies a homodyne measurement on mode B, measuring quadrature x or p.

Experimental CV QKD has already been performed over long distances of 80 to 100 km [47, 48] with bulk optics. However, less experimental efforts in chip-based technologies have been performed. Given that CV QKD is fully compatible with existing fiber communications, the advent of chip-based technologies for CV QKD will be a defining step towards a better integration with existing network.

In Ref. [9], we provided a proof-of-principle chip-based CV-QKD system that is capable of producing a secret key rate of 0.14 kbps. The protocol is sufficiently robust against collective attack over a simulated distance of 100 km in fiber. This demonstration offers new possibilities for scalable low-cost portable quantum networks.

Figure 3 shows a schematic diagram of the silicon photonic CV-QKD chip. In the protocol, the transmitter chip (often labeled as Alice) is comprised of a 1550-nm continuous-wave laser coupled to a waveguide with a grating coupler. To control the input laser intensity, we introduce a modulator that serves as an attenuator. We then split the input laser into two separate paths using a 1:99 directional coupler: a weak and a strong beam. The weaker one acts as signal and the stronger one serves as the local oscillator (LO). The signal path is then modulated with an amplitude modulator (AM) and a phase modulator (PM) to generate a series of coherent state |xA+ipA〉, where xA and pA are Gaussian distributed random numbers. A digital filter and demodulator then extracts the information from one of the sideband frequencies. As in Ref. [49, 50], information encoding is done with a modulation of the continuous light signal on the sideband ranging from 1–10 MHz. Moreover, in order to keep the relative phase between the signal path and the local oscillator (LO) path after transmission, the modulated signal and LO are multiplexed into two orthogonal polarization states with a two-dimensional grating coupler. After the receiver (Bob) gets the signal transmitted over a line with a transmittance T, he then compensates the polarization drift with a polarization controller followed by a demultiplexing of the signal and the LO with another two-dimensional grating coupler. Finally, Bob arbitrarily selects to measures x or p quadrature with the on-chip homodyne detector and filters out the required frequency.

Fig. 3
figure 3

The silicon photonic chips comprises of two parts, Alice and Bob, which are used as the transmitter and receiver. Alice’s side consists of several AMs, PMs, attenuators and grating couplers, which can modulate the signal (S) and multiplex the signal with the LO in two orthogonal polarization states. Bob demultiplexes and detects the signal with the receiver chip

Full size image

The Heisenberg uncertainty principle provides a fundamental basis for security of CV-QKD between the x and p quadratures due to the fact that the quadratures do not commute. Therefore, any attempt by the eavesdropper’s (Eve) obtain information by to measuring one quadrature results in noise in the other quadrature. In this way, the amount of information of the key leaked to Eve is bound by the noise level detected by Alice and Bob if Eve do not wish to be detected. Clearly, it does not pay for any eavesdropper to be detected.

In our experiment, the homodyne detection efficiency is η=0.498. We also measure 5-dB loss of Bob’s chip due to an additional 68.3% drop in efficiency. The total excess noise is ε=0.0934 shot-noise units (SNU) at a modulation variance of Vmod=7.07 SNU and T=1. Detector electrical noise is νel=0.0691 SNU. Symbol rate is SR=0.8 Mbps. These data allow us to estimate the key rate of the current CV-QKD system. We found that, at 90 km, the Shannon raw key rate and Holevo raw key rate are both roughly 103. Figure 4 shows the reconciliation efficiency and signal to noise ratio (SNR) values. The secure fraction and the calculated SNR is plotted as a function of transmission distance. These values are comparable to existing benchmarks.

Fig. 4
figure 4

Reconciliation efficiency and SNR considerations. a The secure fraction as a function of transmission distance. b The calculated SNR at different simulated fiber transmission distance

Full size image

7 Overall prospect and conclusion

Integrated photonics continues to offer one of the most stable, compact, and robust platforms to miniaturize massive photonic circuits [51]. The mature fabrication processes of silicon chips and its full compatibility with electronic circuits are also advantages for a compact device. This compactness and compatibility with classical devices would also allow QKD devices to be embedded into classical devices without easy detection. Overall, chip-based technologies offer advantages in size compactness, low energy consumption, and a potential for low cost [7, 45].

With no electro-optical nonlinearity, many silicon photonic chips currently utilize slow thermo-optical phase modulators for high fidelity state preparation [52]. Yet, high-speed modulation of quantum states in standard silicon photonics appears possible in the near future with carrier- injection and carrier-depletion modulators even though the latter currently does not quite work well in quantum applications. These limitations can however be overcome [52].

Finally, the compatibility of integrated photonic chips with current integrated photonic telecommunication hardware provides a seamless integration with classical communications channels and transceivers. This integration will pave the way for hybrid classical and quantum communications devices [52].