Quantum key distribution (QKD)^[1] enables two remote users to securely exchange cryptographic keys in the presence of an eavesdropper, and it has received a great deal of attention^{[2– 7]} since Bennett and Brassard proposed the first QKD protocol (BB84) in 1984.^[1] Theoretically, it is unconditionally secure.^{[8, 9]} However, in a practical QKD system, an eavesdropper (Eve) might successfully eavesdrop some information of the key by utilizing the defects of measurement devices.^{[10– 13]} Recently, a measurement device independent quantum key distribution (MDI-QKD) protocol has been proposed to make the BB84 protocol free from any possible side-channels in detectors.^[6] In the MDI-QKD protocol, neither Alice nor Bob performs any measurements, but an untrusted third party, called Charlie, detects photons. Alice and Bob distill a secret key according to Charlie’ s measurement results. It is shown that MDI-QKD protocol is free from side-channels because Alice and Bob do not employ photon detectors in the protocol. The MDI-QKD protocol has been extensively studied both experimentally^{[14– 18]} and theoretically^{[19– 27]} since it was proposed.

Most of the MDI-QKD protocols rely on either the polarization^[6] or phase^{[18, 19]} of faint laser pulses as information carriers, and the use of polarization encoding limits the degree of a photon to encode information. Unlike the limited degree of freedom on polarization or phase states, orbital angular momentum (OAM) states have attracted a great deal of attention since there are infinite OAM eigenstates in a single-photon. Furthermore, OAM states are invariant under rotations about the propagation direction, which makes the sender and receiver to avoid the reference frame alignment.^{[28, 29]} These outstanding properties make OAM states that have been used in the BB84-type QKD protocol in free-space links.^{[30– 32]} However, the MDI-QKD with OAM states as information-carriers has been so far much less analyzed and reported.

In this paper, we propose an MDI-QKD protocol using OAM in the free-space link, named the OAM-MDI-QKD protocol. In the protocol, OAM states of photons are used as the information carriers. The decoy-state method^[7] is adopted to overcome the security loophole caused by the weak coherent pulse source, together with a high efficient OAM sorter^{[33, 34]} that is employed to differentiate the different OAM states. Since OAM describes the spatial distributions of wave-functions with helical phases, ^[35] the OAM-MDI-QKD protocol is inevitably sensitive to atmospheric turbulence (AT) interference.^{[36– 39]} The performance of the proposed protocol under atmospheric turbulence and link attenuation is further discussed.

The organization of the paper is arranged as follows. In Section 2, the decoy-state MDI-QKD protocol using orbital angular momentum states is presented. In Section 3, the key generation rate of the proposed protocol is analyzed, in conjunction with the influence on the performance by both AT and link attenuation in the free-space communications. Here, the general formulas for the contribution of single-photon pulses (gain and error rate ) and the contribution of signal states (total gain and total QBER ) are derived. In Section 4, the security analysis is given. In Section 5, the performance of the OAM-MDI-QKD protocol is discussed by numerical simulations. Finally, Section 5 concludes the paper.

Figure 1 shows the schematic diagram of the proposed OAM-MDI-QKD protocol. Both Alice and Bob produce a laser beam and modulate the photons to be the desired OAM states by illuminating the beam to a spatial light modulator (SLM) with a special hologram. Alice and Bob then obtain phase-randomized weak coherent states, including the decoy states and the signal state by using attenuators. Here, the intensity of the signal state for Alice and Bob is expressed as μ and ν , respectively. Assume both Alice and Bob could use infinite decoy states in the protocol. At a later moment, Alice and Bob send their pulses carrying OAM states to Charlie through a free-space communications link, which is disturbed by AT and link attenuation. In the protocol, Charlie is the only one who operates measurements. The measurement device comprises a beam-splitter (BS), two OAM-sorters and four single photon detectors. After Charlie’ s measurements, Alice and Bob could distill a secret key based on Charlie’ s successful measurement results.

Fig. 1.

Figure Option ViewDownloadNew Window

Fig. 1. A schematic diagram of the decoy-state MDI-QKD protocol using OAM states. SLM: spatial light modulator, to convert a Gaussian beam from a laser to a designed OAM state beam by a specific hologram. Attenuator: to produce weak coherent states, including decoy states or signal states. Aperture: the diameter of the receiver aperture is D. BS: beam splitter with 50:50. L0, L1, R0, and R1: detectors for single photon. OAM sorter: to sort OAM states, which employ two static optical elements (R1 and R2) and a lens (L) to efficiently differentiate the different OAM states.

An OAM state is associated with the azimuthal phase of a beam. It could be given as, ^[39]

where A denotes an amplitude of the beam, r and θ are the radial and azimuthal coordinates respectively, l is an OAM topological charge and it is an integer, and W(r/R) is an aperture function with radius R. W(r/R) can be expressed as,

It is shown that the OAM states do not need to align the shared reference frames as long as the z axis is synchronized in the QKD system since the spatial profile of the OAM states is rotational invariance.^{[28, 29]}

For simplification and generality, a two-dimensional OAM-MDI-QKD protocol is discussed. One of the two two-dimensional OAM mutually unbiased bases for the proposed protocol could be defined as

where n represents the encoding bit, which can be taken an integer index from the set {0, 1}. It is named OAM basis. The two states in OAM basis are orthogonal and rotational-invariant. The property of the rotational invariance enables quantum communication without alignment of shared reference frames and decreases the errors due to misalignment of shared reference frames.

Meanwhile, the other basis, called the superposition basis (SUP basis) is defined as

where n is the encoding bit (0 or 1). The states in the SUP basis are a superposition of the | l〉 state and the | − l〉 state, and the two states in the SUP basis are orthogonal too. However, the two states in the SUP basis do not have the property of the rotational invariance, thus alignment of shared reference frames is necessary.

Charlie is the only one who could operate measurements. His measurement device is composed of a beam-splitter (BS), two OAM-sorters, and four single photon detectors. When both the photons carrying OAM states arrive at the 50:50 BS, a Hong– Ou– Mandel (HOM) effect takes place.^[40] Assume that the photon with the OAM state is sent from Alice and the photon with the OAM state is sent from Bob, where the subscript i of the ket represents the ith arm of BS. The action of the BS on the OAM state should be given by and the action of the BS on the OAM state should be given by , where is the photon creation operator for the i-th input arm of the BS. Note that the reflection from BS will flip the sign of the OAM state. Hence, is adopted to represent the state of reflecting from the BS. Hence, the output of the BS is

where

and

It is indicated that | Σ ⁻ 〉 will disappear if both Alice and Bob send the same photon states and choose the SUP basis (namely ), or both of them send the opposite photon states and choose the OAM basis (namely ). Therefore, both photons appear in the same output arm of BS (3rd arm or 4th arm). Otherwise, | Σ ⁺ 〉 and | Σ ⁻ 〉 both exist.

Moreover, high efficient OAM-sorters^{[33, 34]} are adopted to differentiate the different OAM states. For OAM basis states, they are converted to the different truncated plane waves with wavefront tilts which are proportional to the OAM charge l. For SUP basis states, they are transformed to two different truncated plane waves. In fact, the OAM-sorter has two static special optical transformations (unwrapper (R1) and phase corrector (R2) in Fig. 1) to map the azimuthal phase profile of an OAM mode to a tilted planar wavefront, and the plane waves are then separated and focused to specified lateral positions by a lens. The sorting is exclusively based on unitary transformations and in theory can achieve a power transmission efficiency of unity.

Four single photon detectors (L0, L1 or R0, R1) are placed in the focal planes of the lenses to detect two OAM states simultaneously (L0 or R0 for the OAM state | l〉 , while R1 or L1 for the OAM state | − l〉 ). Assume that if and only if two of Charlie’ s four detectors are triggered at the same time (triggers both at L0 and L1, at R0 and R1, at L0 and R0, and at L1 and R1), Charlie gets a successful measurement result. After Charlie announces his measurement results, Alice and Bob tell each other what basis she or he chooses, and only keep the results with the same basis. Table 1 shows a probability distribution of the successful measurements for Charlie when both Alice and Bob choose the same basis. The results show that when Alice and Bob choose the SUP basis and Charlie announces that both L0 and R0, or both R1 and L1 are triggered at the same time, Alice and Bob have opposite bits; otherwise, Alice and Bob have the same bit. On the other hand, when Alice and Bob choose the OAM basis and Charlie announces a successful measurement, Alice and Bob have the same bit. Therefore, if Alice and Bob use the results with the OAM basis as the key bits and simultaneously use the results with the SUP basis as the testing bits, Alice and Bob can share a secret key after error correction and privacy amplification procedures.

Table 1.

Table 1.

Table 1. A probability distribution for Charlie’ s successful measurements when both Alice and Bob choose the same basis. Basis Alice Bob L0 L1 R0 R1 L0 R0 L1 R1 m = SUP n = 0 n = 0 0.25 0.25 0 0 n = 1 n = 0 0 0 0.25 0.25 n = 0 n = 1 0 0 0.25 0.25 n = 1 n = 1 0.25 0.25 0 0 m = OAM n = 0 n = 0 0.25 0.25 0.25 0.25 n = 1 n = 0 0 0 0 0 n = 0 n = 1 0 0 0 0 n = 1 n = 1 0.25 0.25 0.25 0.25

Table 1. A probability distribution for Charlie’ s successful measurements when both Alice and Bob choose the same basis.

Correspondingly, the proposed protocol has some advantages. Firstly, the proposed protocol uses OAM states to carry information. It paves a way to exploit a high-dimensional MDI-QKD protocol for transmitting more than one bit per photon, so as to greatly enhance the key generation rate performance. Secondly, the property of the rotational invariance of the states in OAM basis has enabled quantum communication without alignment of shared reference frames and decreases the errors due to misalignment of shared reference frames, which slightly improves the performance and further simplifies the practical system. In addition, Alice and Bob can reduce the number of flipping bits in the secure key distillation.

The details of the proposed OAM-MDI-QKD protocol are listed below.

Step 1 Alice and Bob randomly choose a basis (OAM basis or SUP basis) and a bit (n = {0, 1}). Then they display the corresponding hologram on their SLMs to convert a Gaussian beam to the desired OAM state beam. Subsequently, Alice and Bob randomly produce the signal states and the decoy states by attenuating the beam into various intensities. Then, Alice and Bob send the pulses carrying OAM states to Charlie through a free-space turbulent channel.

Step 2 Charlie receives the pulses and carries out OAM states measurements. If and only if two of the four detectors (L0, L1, R0, and R1) are triggered at the same time, i.e., the same click at L0 and L1, R0 and R1, L0 and R0, and L1 and R1, Charlie gets a successful measurement. Then Charlie announces his measurement results to Alice and Bob.

Step 3 Alice and Bob tell each other what basis she or he chooses, and only keep those results with the same basis corresponding to Charlie’ s successful measurements.

Step 4 Alice and Bob use the results with OAM basis as the key bits and the results with the SUP basis as the testing bits, and then they testify the security of the key distribution.

Step 5 If Alice and Bob make sure the key distribution is secure, they can obtain a raw key. After error correction and privacy amplification, they can distill a secure key.

The key generation rate for the proposed scheme can be written as follows according to the concepts in Ref. [6]

where is the gain when both Alice and Bob send single photons with the OAM basis, is the quantum bit error rate (QBER) when Alice and Bob send single photons with the SUP basis, is the total gain when both Alice and Bob send signal states with the OAM basis, and is the total QBER when both Alice and Bob send signal states with the OAM basis. In addition, H(x) = – x log₂(x) – (1 – x) log₂(1 – x) is a binary Shannon entropy, and f is the error correction efficiency.

Unfortunately, the purity of OAM states is sensitive to AT and link attenuation, ^{[36– 38]} and the key generation rate will be influenced by AT and link attenuation. Usually, the transmission probability η ₀, which illustrates the probability of the received photon with the same OAM state as the input, and the transmission probability , which describes the probability of the received photon with the different OAM state to the input, are used to describe the aberration about AT and link attenuation.^[39]η ₀ and are expressed as,

where D is the diameter of the receiver aperture, α is the coefficient caused by the atmospheric absorption and scattering loss (link attenuations), and r₀ is the Fried parameter (atmosphere turbulence), ^[41] which can be further described as,

where is the refractive-index structure parameter, which is the strength of atmosphere turbulence, L is the propagation distance, and λ is the wavelength. The transmission probability of the states in the OAM basis is the same as that of the states in the SUP basis. Therefore, the whole transmission probability η is , and the crosstalk probability is .

To obtain the key generation rate, the gain in the OAM basis, the error rate in the SUP basis, the total gain in the OAM basis, and the total QBER in the OAM basis should be deduced^[19] first. To estimate , two cases should be considered. One is the case where both Alice and Bob choose the same encoding bit, so that n − n′ = 0. The other is the case where both Alice and Bob choose different encoding bits where n − n′ = ± 1. Fortunately, the two cases are symmetric so that only one of them should be considered.

Without loss of generality, the case where both Alice and Bob send a single photon carrying | − l〉 is analyzed, which means that both Alice and Bob choose the same encoding bit n = 0. The joint states after BS are

where the subscript i = {1, 2, 3, 4} represents the ith arm of BS. If Charlie receives a vacuum state from Alice (or Bob) because of the losses in the aberration links, the joint states are changed to

Hence, the gain for two of four of Charlie’ s detectors (L0, L1, R0, and R1) triggered at the same time when both Alice and Bob choose n = 0 is

where is defined as the gain of a single photon for Charlie’ s detectors R0 and R1 are triggered at the same time when both Alice and Bob choose n = 0. Similarly, , , and are defined as the gain of a single photon are triggered at the same time when both Alice and Bob choose n = 0 for Charlie’ s detectors L0 and L1, Charlie’ s detectors R0 and L0, and Charlie’ s detectors R1 and L1, respectively. P_d is the background count rate of a detector, and η _a (η _b) is the transmission probability between Alice (Bob) and Charlie.

Similarly, the gains when both Alice and Bob choose n = 1, and Alice and Bob choose different encoding bits (n − n′ = ± 1) could be expressed as

and

Therefore, the gain of single-photon pulses in the OAM basis for two of four of Charlie’ s detectors triggered at the same time is

and the gain of single-photon pulses in the OAM basis is

Likely, the gain in the SUP basis can also be estimated with similar steps,

can be written as , and

where describes the gain of single-photon pulses in the SUP basis when the states of the pulses received by Charlie are different from those sent by Alice and Bob, and describes the gain of single-photon pulses in SUP basis when the states of the pulses received by Charlie are the same as those sent by Alice and Bob.

On the other hand, errors are induced by misalignment and crosstalk between states in the SUP basis when Alice and Bob choose different encoding bits while L0 and L1 (or R1 and R0) are triggered simultaneously, or when Alice and Bob choose the same encoding bit while R0 and L0 (or R1 and L1) are triggered simultaneously. According to the crosstalk between different states induced by AT, Charlie receives the different states with the probability t₊ = (t_a(1 − t_b) + (1 − t_a)t_b)(1 − e_d) + ((1 − t_a)(1 − t_b) + t_at_b)e_d and the same states with the probability t₋ = (t_a(1 − t_b) + (1 − t_a)t_b)e_d + ((1 − t_a)(1 − t_b) + t_at_b)(1 − e_d). So the can be given as

where t_a and t_b are the crosstalk probability for the states sent by Alice and Bob to Charlie, respectively, and e_d represents the misalignment-error probability.

The total gain in the OAM basis can be derived^[19] as follows. Alice and Bob separately prepare the phase-randomized weak coherent states with intensities of μ and ν , respectively, so Alice and Bob’ s joint state is

where θ _a and θ _b are randomized phases. After the pulses pass through two lossy channels between Alice or Bob and Charlie with transmission probability η _a and η _b, the joint state can then be written as

Then, two cases should be considered. One is both Alice and Bob choose the same encoding bit (n − n′ = 0) and the other case is they choose different encoding bits (n − n′ = ± 1). Let us consider the gain that both Alice and Bob choose the different encoding bits (n − n′ = ± 1) first. Alice is assumed to choose n = 0 and Bob is assumed to choose n′ = 1. So after passing through the BS of Charlie, the joint state can be transformed into the detection modes as follows:

then the detection probabilities of the single-photon detector R0 and L1 should be

where P_d is the background count rate per detector, , Δ θ = θ _a − θ _b, and μ ′ = η _aμ + η _bν . Due to symmetry, the case when Alice chooses n = 1 and Bob chooses n′ = 0 is the same result as above, so the gain is given by taking the integral of Δ θ over 0 to 2π ,

where I₀(x) is the modified Bessel function of the first kind.

Similarly, the gain that both Alice and Bob choose the same encoding bits in the OAM basis can be derived by the same methods^[19] as

Due to equal probability, the is given by

Because the rotational invariance of OAM states enables quantum communication without alignment of shared reference frames, the is only caused by turbulence-induced crosstalk and is given by

In this section, we will discuss the unconditional security proof of the proposed protocol, which is determined by the EPR-based QKD protocol^[7] and the decoy state method.^[42] In the protocol, both Alice and Bob use the decoy state method, resulting in the protocol that can avoid a photon number splitting attack.^[43] Moreover, Alice and Bob could obtain that gain and QBER when the photons sent to Charlie are single photons. On the other hand, with the help of the virtual qubit idea proposed in Ref. [44], the OAM photon sent from Alice (Bob) to Charlie could be considered as the one real photon of a virtual entangled OAM photons pair, where the virtual OAM photon is kept by Alice (Bob). According to the principles of quantum swapping, ^[45] the virtual photons kept by Alice and Bob are entangled after Charlie finishes his Bell measurements and announcements. At this time, Alice and Bob are sharing virtual Bell-entangled OAM photons. Therefore, a secure key could be generated by performing the measurements on the virtual Bell-entangled OAM photons. It is indicated that the security of the proposed protocol is equivalent to that of the EPR-based QKD protocol. It has been shown that there is an unconditional security analysis for the EPR-based QKD protocol.^[8] Hence, our proposed protocol is an unconditional secure protocol.

In this section, we discuss the performance of the proposed protocol by numerical simulations. The parameters for the numerical simulation are the following. The background count rate for the detector P_d is 3 × 10^{− 6}. The misalignment-error probability in the SUP basis e_d is 1.5%. The error correction efficiency f is 1.16. The OAM charge l is 10. The diameter of the receiver aperture D is 15cm and the wavelength λ is 1550 nm. Assume that the distance between Alice and Charlie is equivalent to the distance between Bob and Charlie (L_a = L_b), the transmission probability from Alice to Charlie is the same as that of Bob to Charlie (η _a = η _b), and the crosstalk probability of Alice (t_a) is equal to that of Bob (t_b), where .

Figure 2 shows the key generation rate performance of the OAM-MDI-QKD protocol against the transmission distance, in comparison with that of the polarization-based MDI-QKD protocol with the same experimental parameters. The results show that the key generation rate performance of the proposed protocol is slightly better than that of the polarization-based MDI-QKD protocol, because Alice and Bob need not align their reference frames when both Alice and Bob use the OAM basis in the proposed protocol, which results in a lower error rate . It is shown that the MDI-QKD using OAM states is feasible, and a high-dimensional MDI-QKD protocol using OAM states could be supposed for a significant improvement of the key generation rate.

Fig. 2.

	Figure Option ViewDownloadNew Window
	Fig. 2. The key generation rate performance of the OAM-MDI-QKD protocol against the transmission distance, in comparison with that of the polarization-based MDI-QKD protocol. Here, link attenuation α is 1.38× 10− 4 (0.6 dB/km) and no atmospheric turbulence.

In order to demonstrate the key generation rate performance influenced by AT and link attenuation, figure 3 illustrates the key generation rate against the transmission distance with different strength of AT and different link attenuations (α ). Figure 3(a) is for different AT and the same link attenuation, where α is setup to 1.38× 10^{− 4} (0.6 dB/km), in addition to the performance of the proposed protocol without turbulence. Figure 3(b) is for different link attenuation and the same AT, where is set to 10^{− 15} m^{− 2/3}. Here, the four different link attenuations in Ref. ^[46] are discussed to illustrate the different weather conditions. The results show that the key generation rate decreases with the increase of the transmission distance under AT and link attenuation. In other words, AT and link attenuation decrease the transmission distance of the proposed QKD protocol. The stronger AT and higher link attenuation make the key generation rate performance drop quickly. Furthermore, the key generation rate performance is influenced heavily by the different weather conditions.

Fig. 3.

	Figure Option ViewDownloadNew Window
	Fig. 3. The key generation rate against the transmission distance with different strength of AT and different link attenuations. Panel (a) is for different AT and the same atmospheric attenuation, where α is 1.38× 10− 4 (0.6 dB/km). Panel (b) is for different link attenuations and the same AT, where is set to 10− 15 m− 2/3.

In order to display the benefits of using decoy states, figure 4 shows the key generation rate of the proposed protocol using the weak coherent states without decoy states, the weak coherent states with the infinite decoy states, and the perfect single photon source. Figure 4(a) is the performance as a function of the strength of AT , where the distance between Alice (Bob) and Charlie is setup to 10 km, and α is set to 1.38× 10^{− 4} (0.6 dB/km). Figure 4(b) is the performance as a function of the distance between Alice and Bob, where and α = 1.38× 10^{− 4}. It is shown that the key generation rate with the infinite decoy states is higher than that without decoy states, and it is still much lower than that with the perfect single photon source. With the increase of the strength of AT and the transmission distance, the key generation rate performance falls down quickly. For the same key generation rate, for example, R = 10^{− 5}, the transmission distance for the three different sources are 36 km, 60 km, and 76 km, respectively. The results imply that the proposed protocol with the decoy-state could get a considerable good performance without the need of an ideal source.

Fig. 4.

Figure Option ViewDownloadNew Window

Fig. 4. The key generation rate of the proposed protocol using the infinite decoy states, the weak coherent states without decoy states, and the perfect single photon source. Panel (a) is the performance as a function of the strength of AT , where the distance between Alice (Bob) and Charlie is setup to 10 km, and α is set to 1.38 × 10− 4 (0.6 dB/km). Panel (b) is the performance as a function of the distance between Alice and Bob, where , and α = 1.38× 10− 4.

We have proposed a decoy-state MDI-QKD protocol using orbital angular momentum states in this paper. In the protocol, the mutually unbiased bases of OAM states are prepared, and the modes of different OAM states in the MUBs are represented for different information. In order to overcome the security loophole caused by the weak coherent pulse source, the decoy states are used. A highly efficient OAM-sorter is adopted in the measurement device to obtain the output OAM state. We analyzed the key generation rate performance of the proposed protocol through a free-space atmospheric turbulent link, and discussed the performance by numerical simulations. The results show that the protocol has a slightly improved performance in comparison with that of the polarization-based MDI-QKD protocol with the same experimental condition. Moreover, the MDI-QKD protocol based on OAM states with higher dimensions could further enhance the key generation rate performance. In addition, AT and link attenuation have influenced on the key generation rate performance and the transmission distance. The stronger AT and higher link attenuation make the key generation rate performance drop quickly, and the transmission distance decreases straightway. Finally, the results demonstrate that the proposed protocol with the decoy states could get a considerably good performance without the need of an ideal source.