Discrete-modulation continuous-variable quantum key distribution with a high key rate

Discrete-modulation continuous-variable (CV) quantum key distribution has the potential for large-scale deployment in secure quantum communication networks owing to its low implementation complexity and compatibility with the current coherent optical telecommunication. However, current discrete-modulation protocols require relatively large constellation sizes to achieve a key rate comparable to that of the Gaussian modulation. Here, we show that a high key rate comparable to the Gaussian modulation can be achieved using only ten or so coherent states by implementing suitable key map and numerical convex optimization techniques. Specifically, the key rate of the two-ring constellation with 12 coherent states (four states in the inner ring and eight states in the outer ring) can reach 2.4 times of that of original quadrature phase shift keying and 70% of the Gaussian modulation protocol at 50 km. Such an approach can easily be applied to existing systems, making the discrete-modulation protocol an attractive alternative for high-rate and low-cost applications in secure quantum communication networks.


I. INTRODUCTION
Quantum key distribution (QKD) [1,2], as one of the most prominent application of quantum information sciences, allows two distant parties to share a common secret key, where the security is guaranteed by the fundamental laws of quantum physics [3,4].Continuousvariable (CV) QKD encodes the key information into continuous-spectrum quantum observables, such as the quadrature components of the light field, which has the potential to offer larger key rates at metropolitan distances [5][6][7][8].CV-QKD can employ the similar components as classical telecom systems and has received extensive attentions and witnessed rapid development both theoretically and experimentally .
At present, most of the CV-QKD schemes are based on Gaussian modulation, meaning that Alice displaces the quadratures of the sent states according to a Gaussian distribution, which reaches the channel capacity and achieves a high key rate.However, this type of protocol puts a lot of requirements on the modulation devices and error-correction procedure.Moreover, a perfectly Gaussian modulation cannot be met in realistic applications due to finite range and precision of practice modulators.In practice, the Guassian modulation is approximated by a modulation constellation with a finite number of states and it has shown that at least 8100 states (90 × 90 size constellation) are needed to satisfactorily simulate a Gaussian distribution [36].In order to release these stringent restrictions and simplify the protocol, discretemodulation schemes for CV-QKD are proposed [36][37][38][39][40][41].Among them, four coherent states phase-shift keying (4-PSK) protocol has attracted the most interest.However, * yongmin@sxu.edu.cndifferent from Gaussian modulation that can apply the proof method of Gaussian attacks optimality [42][43][44], the security analysis of discrete modulation CV-QKD is more complex.Previous security proofs for 4-PSK protocol is restricted to Gaussian attacks [45][46][47], which are not believed to be optimal for discrete modulation schemes, thus the key rate obtained cannot be considered to be secure.
Recently, the security of such protocol in the asymptotic regime is established by applying numerical methods [48,49], more precisely convex optimization techniques.Without using the Gaussian optimality proof method, the approach in Ref. [49] provides a tighter bound and thus higher key rate than that in Ref. [48].However, that key rate is still relatively low compared with the optimal Gaussian modulation, about a quarter of the key rate achievable of Gaussian modulation, which makes the 4-PSK protocol less attractive.
In this paper, we focus on the design of the optimized discrete-modulation protocol.To this end, we first extend the 4-PSK protocol to more signal states, eight states (8-PSK) and twelve states (12-PSK), and derive the asymptotic secure key rate by numerical methods considering the realistic trusted noisy detection.The results show that 8-PSK increases the key rate by about 60%, compared with the original 4-PSK protocol, while the key rate has only small improvement from 8-PSK to 12-PSK.This is because the performance of 8-PSK has tended to be saturated for a single-ring constellation protocol, and further increasing the number of states would not gain more advantages.To enlarge the distribution range of states in phase space and further improve the performance, we propose to use the two-ring constellation scheme, where not only the phase quadrature but the amplitude quadrature is modulated.By optimizing the amplitudes and the probabilities assigned to each states, and the boundary between the two rings, the two-ring constellation with twelve states (four states in the inner ring and eight states in the outer ring) get a superior performance.In comparison with the original 4-PSK protocol, the secret key rate is increased to 2.4 times.This value is about 70% of the key rate achievable for Gaussian modulation and therefore the performance of the two-ring constellation protocol is close to the Gaussian modulation protocol, but the implementation is simpler, which makes it very attractive for practical applications.
The rest of the paper is organized as follows.In Sec.II, we analyze the performance of discrete-modulation protocol of 8-PSK and 12-PSK with single-ring constellation.In Sec.III, we apply the two-ring constellation structure to 12-PSK, and investigate the dependence of key rate on various parameters to optimize the protocol.The results are compared with Gaussian modulation CV-QKD protocol under realistic trusted noisy detection.Our conclusions are drawn in Sec.IV.

II. DISCRETE-MODULATION CV-QKD WITH SINGLE-RING CONSTELLATION
A. The protocol description The schematic of single-ring signal constellation for discrete-modulation CV-QKD of 8-PSK and 12-PSK is illustrated in Fig. 1.For 8-PSK, the sender Alice prepares the coherent state |α x = αe ixπ/4 with x ∈ {0, 1, 2, 3, 4, 5, 6, 7}, each coherent state is chosen with an equal probability p x = 1/8.Similarly, for 12-PSK, Alice randomly selects a state from the set |α x = αe ixπ/6 , x = 0, • • •, 11 , where α is a predetermined amplitude and can be optimized.The prepared states are sent to Bob through an insecure quantum channel to generate secret keys.Bob measures the received states with heterodyne detection and records the measurement outcome y ∈ C.After obtaining enough data, Alice and Bob randomly select a small part of the data for parameter estimation.
If the parameter estimation passes, they use the remaining data to extract the keys.Bob obtains his raw key string by a key map.Specifically, Bob labels each outcome y = |y| e iθ according to the region R j as where j ∈ {0, • • •, 7} for 8-PSK and j ∈ {0, • • •, 11} for 12-PSK.The raw key string of Alice consists of the label x of her randomly selected state α x .Finally, Alice and Bob implement error correction and privacy amplification procedures to extract secret keys.

B. Secret key rate
For convenience of security analysis, we consider the equivalent entanglement-based (EB) scheme.Here, we mainly use the numerical security proof method presented in Ref. [49,50] to obtain the secure key rate.In the EB scheme, Alice initially prepares the bipartite state where |x is an orthonormal basis for register A. Alice keeps A and sends the register A ′ to Bob.To establish the equivalence between the EB scheme and the original prepare-and-measure scheme, Alice applies a local projective measurement on register A, which can be described by a POVM M A = M A x = |x x| .When obtaining a measurement outcome x with probability p x , the state sent to Bob is effectively collapsed to |α x .After the quantum channel transmission, the joint state shared by Alice and Bob is where id A is the identity channel acting on A and E A ′ →B describes the quantum channel, which is a completely positive and trace-preserving (CPTP) map.Bob uses his POVM G y on register B to perform realistic trusted noisy detection.
With the reverse reconciliation, the asymptotic secret key rate against collective attacks is expressed as [49] where D ( ρ σ) = Tr (ρlog 2 ρ) − Tr (ρlog 2 σ) is the quantum relative entropy; G describes a completely positive and trace nonincreasing map for postprocessing steps; Z denotes a pinching quantum channel that reads out the result of key map; S represents the set of available density operators compatible with experimental observations; p pass is the sifting probability of data for key generation; δ EC stands for the leaked information of per signal pulse during the error correction phase and can be computed as follows where β is the reconciliation efficiency.X and Z represent the raw key string of Alice and Bob, respectively.In order to compute the expected secret key rate, the key point is to find the minimum value of ), which is a convex optimization problem matching some constraints and expressed as [50] minimize where FQ and FP ( ŜQ and ŜP ) represent the firstmoment (second-moment) observables of quadrature operators q and p, respectively.Also notice that Eve cannot access Alice's system, thus there is an additional constraint where n takes 7 or 11 according to 8-PSK or 12-PSK.
The postprocessing map G and pinching quantum channel Z can be written as [50] To numerically minimize the objective function, available ρ AB must be a finite dimension.The dimension of Alice's system is determined by the number of different signal states that she prepares, which is finite.However the receiver Bob's state is in an infinite dimensional Hilbert space.This can be circumvented by applying the photonnumber cutoff assumption.When the photon number cutoff parameter N c is chosen to be large enough, this assumption is reasonable.Here, we set an appropriate parameter value of N c such that the probability of photon number of the received signal state smaller than N c is close to 1, and larger N c has no meaningful improvement for the key rate.Then, the matrix expressions of the firstmoment observables FQ , FP , the second-moment observables ŜQ , ŜP , and the region operators R j in the photonnumber basis can be obtained [50].
A tight lower bound on the key rate can be achieved by using a two-step procedure developed in Ref. [51].At the first step, the Frank-Wolfe algorithm is used to approximately minimize the convex function, and hence obtaining an upper bound on the key rate.At the second step, converting this upper bound to a reliable lower bound by taking the numerical imprecision into account.By using the two-step procedure and defining where ρ 1 is the suboptimal state obtained in the first step.ǫ is the perturbation parameter and f ǫ (ρ , where d ′ is the dimension of G (ρ).The gradient ∇f ǫ (ρ 1 ) is given by where Γ i and γ i refer to both sides of the equality constraint, respectively, with the form Tr (Γ i ρ) = γ i .nc represents the number of all constraints.ǫ ′ is the security parameter related to the numerical imprecision.
We are now in a position to assess the performance of the protocol based on the above approach.

C. Performance analysis
Considering a typical phase-insensitive Gaussian channel in the context of the optical fiber communication.The simulated statistics are given by [50] FQ where T and ξ represent the transmittance and excess noise of the channel, respectively, and η and v el denote the detection efficiency and electronic noise of the detector.
The probability density function for the result y of a heterodyne measurement conditioned on Alice's choice x is To extract the optimal secret key rate and fairly compare the performance of different protocols, we first investigate the dependence of the key rate on the coherent state amplitude α.In Fig. 2(a), we plot the key rate versus the choice of α for 8-PSK and 12-PSK protocols, at a transmission distance of 50 km.Here, we consider the realistic parameters: reconciliation efficiency β = 0.95, excess noise ξ = 0.01, detection efficiency η = 0.552, and electronic noise v el = 0.015.The dashed line represents the result of step 1 of our algorithm, which gives an upper bound on the key rate, and solid line is the result after step 2, which provides an achievable lower secure bound on the key rate.The gap between step 1 and step 2 is small, hence the obtained bound is tight.We carry out a coarse-grained search for α in the interval [0.7, 1.1] with a step size of 0.05.It is clear that there is an optimal value of α to maximize the key rate.At 50 km, the optimal α for 8-PSK and 12-PSK is 0.9 and 0.92, respectively.In Fig. 2(b), we give the optimal values of α at different transmission distances and the results of 4-PSK protocol are also shown for comparison.Compared with the 4-PSK protocol, 8-PSK allows larger optimal value of α, thus providing higher signal-to-noise ratio (SNR).The difference between the optimal α for the 8-PSK and 12-PSK protocols gradually decreases with the increase of transmission distance and is almost indistinguishable over long distances.
In Fig. 3, we present the achievable key rates at different transmission distances for different discretemodulation protocols and Gaussian modulation protocol.
The key rate has been optimized by adopting the optimal modulation amplitude (Fig. 2(b)) and variance.In addition, we have applied the postselection technology to the 4-PSK protocol to obtain the optimal key rate [50].We can see that the 8-PSK protocol improves the key rate by about 60% over the 4-PSK protocol.Within 10 km, the key rate can be further improved by 10% -30% if 12-PSK is employed.However, beyond 10 km, the key rate can only be increased by about 4%, which means that the performance of 8-PSK modulation is close to saturation and adding more signal states will not make much difference.Compared with the Gaussian-modulation protocol, the achievable key rate of discrete-modulation is still relatively low.Taking 50 km as an example, the key rates per pulse of the 4-PSK, 8-PSK, 12-PSK and Gaussian modulation protocols are 0.00602, 0.00966, 0.01008, and 0.02103 bits/pulse, respectively.The 4-PSK and 8-PSK protocols can reach approximately 28% and 45% of the key rate of Gaussian modulation.The data postselection is also an interesting strategy to further improve the key rate by 8% for 8-PSK and 12-PSK protocols (see Appendix).

III. DISCRETE-MODULATION CV-QKD WITH TWO-RING CONSTELLATION
To further improve the performance of the discretemodulation protocol, we extend the 12-PSK to two-ring constellation structure.As shown in Fig. 4, different from the single-ring PSK protocol, the states are prepared with two different amplitudes α 1 and α 2 in the designed two-ring constellation.The four states in the inner ring are expressed as , where each of states is chosen according to an equal probability p 1 .The eight states in the outer ring take the form of |α x = α 2 e i(x−4)π/4 x=4,•••,11 and each of which is chosen with an equal probability p 2 .p 1 + 2p 2 = 1/4.Alice transmits the randomly selected state α x to Bob and records the sequence of the state she sent.Upon receiving the state, Bob performs a heterodyne detection and obtains the measurement outcome y.According to the region R j , Bob maps his outcome y = |y| e iθ to the discretized raw keys as follows where α c is the amplitude corresponding to the boundary between the inner and outer regions.
The key rate can be optimized by finding the optimal parameter values of α 1 , α 2 , α c , and p 1 (p 1 + 2p 2 = 1/4).The dependence of key rate on these parameters are shown in Fig. 5.For the transmission distance of 50 km, the optimal choices of the parameters are α 1 = 0.7, α 2 = 1.6, α c = 0.85, p 1 = 7/48 and p 2 = 5/96.In this case, we achieve a key rate of 0.01459 bits/pulse, which is 50% higher than that of 8-PSK protocol and 140% higher than that of 4-PSK protocol.By varying the constellation geometry from the single-ring PSK structure to the two-ring constellation structure, we effectively overcomes the limitation of states distribution in phase space, and significantly improves the performance of the 4-PSK discrete-modulation protocol.
Fig. 6, we give the optimal choice of parameters α 1 , α 2 , α c and p 1 at different transmission distances.The cutoff value of photon number N c is selected from the interval [14,22] according to the modulation amplitudes.The optimal p 1 is obtained via a coarse-grained search in the interval [1/48, 11/48] with a step size 1/48.We can see that the optimal α c is closer to α 1 and p 1 is greater than p 2 , which result in an approximate Gaussian distribution in phase space.Next, we employ the optimal parameters values to obtain the optimal key rate and analyze the performance of the protocol.
In Fig. 7, we compare the key rate of the two-ring constellation protocol with the previous PSK protocols and Gaussian modulation protocol.We observe that the key rate of the two-ring constellation with twelve states is higher than that of PSK protocols, and the gap of the key rate between two-ring constellation protocol and Gaussian modulation protocol decreases gradually with the increase of transmission distance.As shown in Fig. 8, for long distance transmission distance above 50 km, the two-ring constellation with twelve states can reach above 70% of key rate of Gaussian modulation protocol.Notice that two-ring constellation with twelve states require only 1-bit discretization for the amplitude of the light field and 3-bit discretization for the phase of the light field.Therefore, we proof that the concise two-ring constellation with  twelve states can exhibit superior performance, which is very close to that of Gaussian modulation protocol.

IV. CONCLUSIONS
The optimized constellation design schemes were proposed to significantly improve the performance of the discrete-modulation CV-QKD protocol.The asymptotic secure key rate in the trusted detector noise scenario is obtained by applying the advanced numerical methods.For the sake of fair comparison, we optimized the coherent state amplitude at each transmission distance.Our numerical results showed that 8-PSK can increase the key rate by about 60% over conventional 4-PSK protocol, however adding the 8-PSK to 12-PSK does not significantly improve the key rate.Interestingly, by allocating twelve coherent states to a two-ring constellation that enlarges the distribution range of coherent states in phase space, the key rate with 140% higher than that of 4-PSK protocol was achieved.This key rate reaches about 70% of that of the Gaussian modulation protocol for transmission distance above 50 km.Our results confirm that the discrete-modulation protocol with ten or so appropriate constellation and optimal modulation parameters can ap- proximate the key rate of Gaussian modulation protocol.We believe that the proposed discrete-modulation protocol can find promising applications in high-rate and low-cost secure quantum communication networks.
The future works include the optimization of the key rate of the discrete-modulation protocol in the short distance transmission by extending current state constellation or other new constellation design schemes [52], and finding better data postselection strategies [53,54].Extending our security analysis to include the impact of finite-size is also an important future task [55][56][57].

FIG. 1 .
FIG. 1. Schematic diagram of the single-ring constellation for multiple signal states: (a) 8-PSK, (b) 12-PSK.Rj represents the key mapping region, where Bob maps the measurement outcomes to the corresponding discretized key values.
) f max d is the dual function and written as ) Then, according to the key mapping area, the probability that Bob obtains the discretized key value Z = z conditioned on Alice's choice x is P ( z| x) = 1)π/8 P re iθ x dθ (8-PSK) 1)π/12 P re iθ x dθ (12-PSK) .

FIG. 2 .
FIG. 2. (a) Secret key rates as a function of the coherent state amplitude α for 8-PSK and 12-PSK protocols at the transmission distance of L = 50 km.(b) The optimal choice of α at different transmission distances for 4-PSK, 8-PSK and 12-PSK protocols.

FIG. 3 .
FIG. 3. Achievable secret key rate versus the transmission distance for different protocols.The modulation amplitude and variance have been optimized.Other parameters are set to β = 0.95, ξ = 0.01, η = 0.552, and v el = 0.015.

FIG. 4 .
FIG. 4. Schematic diagram of the proposed two-ring constellation structure with twelve signal states.

FIG. 8 .FIG. 10 .
FIG.8.Ratio of the key rate of various discrete-modulation protocols to Gaussian modulation protocol.TRC represents two-ring constellation protocol with twelve states and GM represents the Gaussian modulation protocol.