WO2020052788A1

WO2020052788A1 - Quantum key distribution system and method

Info

Publication number: WO2020052788A1
Application number: PCT/EP2018/074967
Authority: WO
Inventors: Fred Chi Hang FUNG; Bernhard Schrenk; Hannes HÜBEL
Original assignee: Huawei Technologies Duesseldorf Gmbh
Priority date: 2018-09-14
Filing date: 2018-09-14
Publication date: 2020-03-19
Also published as: CN112449748A

Abstract

The invention relates to a continuous variable quantum key distribution, CV-QKD, system (100), comprising: a transmitter (101) a splitter (111), and a plurality of receivers (121-1, 121-2, 121-N). The transmitter (101) comprises a modulator (103) which modulates a quantum coherent signal according to a continuous or discrete distribution in phase and amplitude. The splitter (111) splits the modulated quantum signal into a plurality of modulated quantum sub-signals. Each modulated quantum sub-signal is an attenuated version of the modulated quantum signal. Each receiver receives via a respective quantum communication channel the respective modulated quantum sub-signal from the splitter and determines a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal. Each receiver determines a common secret key based on the plurality of phase space positions using a respective post-processing protocol between the transmitter and each of the plurality of receivers The CV-QKD system can be operated to share a common secret key between the transmitter and the plurality of receivers.

Description

QUANTUM KEY DISTRIBUTION SYSTEM AND METHOD

TECHNICAL FIELD The invention relates to the field of quantum key distribution. More specifically, the invention relates to a continuous variable quantum key distribution (CV QKD) system and method.

BACKGROUND

Quantum key distribution (QKD) uses quantum carriers (also referred to as quantum signals), typically single-photon or strongly attenuated light pulses, for sharing a secret electronic key. Typically, a sequence of such light pulses, i.e. quantum signals, is transmitted from a transmitter (often referred to as "Alice") via a quantum channel to a receiver (often referred to as "Bob"), wherein each light pulse encodes a key bit. The quantum properties of light, in particular the Heisenberg uncertainty principle, ensure that no information can be gained on these key bits without disturbing the quantum state of the photons. Public communications over an additional classical channel are then used to estimate the maximum amount of information that a potential eavesdropper may have acquired, and to distil a secret key out of the raw data.

Several practical schemes for quantum key distribution have been proposed and implemented in the past, including discrete-variable (DV) and continuous-variable (CV) QKD are employed to distribute secret keys. DV-QKD is based on the principle of detecting individual photons, while CV-QKD is based on the principle of detecting the quadratures of light fields to obtain possibly more efficient alternatives to conventional photon-counting QKD techniques. From a practical point of view, the CV approach has potential advantages because it is compatible with the standard optical telecommunication technologies. It is foreseeable that this approach will become a viable candidate for large- scale secure quantum communications.

In discrete-variable quantum key distribution (DV-QKD), the transmitter and receiver devices differ greatly in their functionality. Whereas the production of optical quantum states is fairly easy (at least for approximate single photon states), the detection of said photonic states is hard and requires complicated, bulky and expensive single photon detectors. In access links it is therefore advantageous to have an expensive node connecting to the metropolitan network and inexpensive modules at the user side. Ideally, the expensive node should be able to cater for many users. In that way the cost of deployment per user can be kept low.

For continuous-variable quantum key distribution (CV-QKD), there is also an imbalance between the transmitter and receiver. The transmitter generally requires a fast random number generator, optical modulators and DAC converters. At the receiving side, the main components are the optical hybrid, a balanced detector and ADC card. Although not directly obvious in the CV-QKD case, the receiver is actually the cheaper component at least for small bandwidth transmission. ADC and balanced receivers for GHz transfer rates are very expensive, whereas rates below 100 MHz can be accommodated with modest cost in equipment. Therefore, in a CV-QKD system the receiver should constitute the device at the end-user.

This leaves still open the question of how to link multi users (receivers) to a single transmitter, in particular sharing a secret key between a transmitter and a plurality of users.

A simple solution to QKD-based secret sharing or multiuser QKD with the goal of establishing a common secret key is to set up QKD links covering all parties who need to share a common secret key. Then the party connected to two links may pass on the QKD key of one link to the other party of the other link. But this setup is complicated and resource intensive.

So far multiuser QKD has been only attempted with either active switching or wavelength- division multiplexing (WDM techniques). For DV-QKD, passive optical splitting has been proposed, but the operational characteristics are different. In active switching the quantum channel is always linked with one receiver. When another receiver wants to communicate with the transmitter an optical switch changes the quantum channel from the old user to the new user. With active optical switching, problems arise with the complexity and maintenance of the switch.

Also the active switching prevents multi users of receiving data simultaneously, since the switching only connects different users sequentially. This leads to a poor usage of the quantum channel, since the maximum key generation rate is that of a single link. Also, due to the complete severing of the quantum channel, important control signals, used for alignment of the CV-QKD system, can no longer be transmitted to all users. Hence a long recalibration time is needed every time a user is connected to the transmitter.

WDM techniques were also employed with QKD. Although, being better than active switching in that WDM increases the bandwidth by combining more optical quantum channels on a single fiber, it is still very rigid. Additional users can only connect if there is a spare WDM channel free. The wavelength selection of the channel cannot be modified without changing optical components at the receiver.

DV-QKD on PON (passive optical network) relies on single photons being redirected at the optical splitter to reach the different users. Since a photon cannot be split, it is detected by one user only. It is not possible to split the quantum signal for detection by multiple users, which is useful for secret sharing among multiple users.

Thus, there is still a need for an improved QKD system as well as a method operating such a system for sharing a common secret key between a transmitter and a plurality of receivers in a secure manner.

SUMMARY

The foregoing and other objects are achieved by the subject matter of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.

According to a first aspect the invention relates to a continuous variable quantum key distribution, CV-QKD, system. The CV-QKD system comprises: a transmitter comprising a modulator configured to modulate a quantum coherent signal according to a continuous or discrete distribution in phase and amplitude; a splitter configured to split the modulated quantum signal into a plurality of modulated quantum sub-signals, wherein each modulated quantum sub-signal is an attenuated version of the modulated quantum signal; and a plurality of receivers, wherein each receiver is configured to receive via a respective quantum communication channel the respective modulated quantum sub-signal from the splitter and to determine a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal. Either each receiver is configured to determine a common secret key between the transmitter and the plurality of receivers based on the plurality of phase space positions using a respective post-processing protocol between the transmitter and each of the plurality of receivers, wherein the post-processing protocol includes a direct reconciliation stage comprising sending correction information via a respective classical communication channel from the transmitter to the respective receiver for determining the common secret key by the respective receiver. Alternatively, the CV-QKD system further comprises a postprocessing unit configured to perform a post-processing protocol with the transmitter, wherein each receiver is configured to transmit the plurality of phase space positions to the post-processing unit for combining the respective pluralities of phase space positions from the plurality of receivers by the post-processing unit and to obtain a common secret key between the transmitter and the plurality of receivers from the post-processing unit.

Thus, an improved CV-QKD system is provided for sharing a common secret key between a transmitter and a plurality of receivers in a secure manner.ln a further possible implementation form of the first aspect, the transmitted quantum state is a coherent state. In contrast to DV-QKD which is based on single photons, the quantum coherent states used in CV-QKD can be split indefinitely.

In a further possible implementation form of the first aspect, one of the plurality of receivers comprises or provides the post-processing unit.

In a further possible implementation form of the first aspect, each receiver is configured to transmit the plurality of phase space positions to the post-processing unit via a secure communication channel and/or wherein each receiver is configured to obtain the common secret key between the transmitter and the plurality of receivers from the post-processing unit via a secure communication channel.

In a further possible implementation form of the first aspect, the post-processing unit is configured to combine the respective pluralities of phase space positions from the plurality of receivers using the same weights or different weights.

In a further possible implementation form of the first aspect, the transmitter is configured to execute at least some of the plurality of post-processing protocols with at least some of the plurality of receivers in parallel, e.g., by implementing for at least some of the receivers a corresponding plurality of instances of the post-processing protocol. In a further possible implementation form of the first aspect, the transmitter is configured to execute at least some of the plurality of post-processing protocols with at least some of the plurality of receivers using time-multiplexing.

In a further possible implementation form of the first aspect, each of the plurality of modulated quantum sub-signals is associated with a respective signal power, wherein the plurality of modulated quantum sub-signals have the same signal power.

In a further possible implementation form of the first aspect, each of the plurality of modulated quantum sub-signals is associated with a respective signal power, wherein at least two of the plurality of modulated quantum sub-signals have different signal powers.

In a further possible implementation form of the first aspect, the transmitter is further configured to transmit a synchronization signal via the splitter to each of the plurality of receivers. The synchronization signal can include, for instance, frequency and/or phase information about the modulated quantum signal.

In a further possible implementation form of the first aspect, the transmitter is configured to transmit the synchronization signal as part of the modulated quantum signal via the splitter to each of the plurality of receivers.

In a further possible implementation form of the first aspect, the transmitter comprises a random number generator for generating the quantum signal.

In a further possible implementation form of the first aspect, the post-processing protocol further includes a sifting stage, a parameter estimation stage, and/or a privacy amplification stage.

In a further possible implementation form of the first aspect, each receiver comprises a homodyne detector or a heterodyne detector for determining the plurality of phase space positions defined by the plurality of quadrature components of the respective modulated quantum sub-signal.

In a further possible implementation form of the first aspect, the splitter is a passive beam splitter. According to a second aspect the invention relates to a passive optical network, PON, comprising the CV-QKD system according to the first aspect of the invention.

According to a third aspect the invention relates to a CV-QKD method, comprising the following steps: modulating a quantum coherent signal according to a continuous or discrete distribution in phase and amplitude; splitting the modulated quantum signal into a plurality of modulated quantum sub-signals, wherein each modulated quantum sub-signal is an attenuated version of the modulated quantum signal; receiving by each of a plurality of receivers via a respective quantum communication channel the respective modulated quantum sub-signal from the splitter; and determining by each of a plurality of receivers a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal. Either the CV-QKD method comprises the further step of determining a common secret key between the transmitter and the plurality of receivers based on the plurality of phase space positions using a respective postprocessing protocol between the transmitter and each of the plurality of receivers, wherein the post-processing protocol includes a direct reconciliation stage comprising sending correction information via a respective classical communication channel from the transmitter to the respective receiver for determining the common secret key by the respective receiver. Alternatively, the CV-QKD method comprises the further step of performing a post-processing protocol between a post-processing unit and the transmitter, including, for each of the plurality of receivers, transmitting the plurality of phase space positions to the post-processing unit for combining the respective pluralities of phase space positions from the plurality of receivers by the post-processing unit and obtaining a common secret key between the transmitter and the plurality of receivers from the postprocessing unit.

The CV-QKD method according to the third aspect of the invention can be performed by the CV-QKD system according to the first aspect of the invention. Further features of the CV-QKD method according to the third aspect of the invention result directly from the functionality of the CV-QKD system according to the first aspect of the invention and its different implementation forms described above and below.

According to a fourth aspect the invention relates to a computer program product comprising program code for controlling a CV-QKD system to perform the method according to the second aspect when the computer program is executed on a computer. The computer program product may comprise a non-volatile memory on which the program code is stored.

The invention can be implemented in hardware and/or software.

BRIEF DESCRIPTION OF THE DRAWINGS

Further embodiments of the invention will be described with respect to the following figures, wherein:

Fig. 1 shows a schematic diagram illustrating a CV QKD system according to an embodiment of the invention;

Fig. 2 shows a schematic diagram illustrating a CV QKD system according to an embodiment of the invention;

Fig. 3 shows a schematic diagram illustrating some more details of the CV QKD system of figure 2; and

Fig. 4 shows a flow diagram illustrating a method of operating a CV QKD system according to an embodiment of the invention.

In the various figures, identical reference signs will be used for identical or at least functionally equivalent features.

DETAILED DESCRIPTION OF THE EMBODIMENTS

In the following description, reference is made to the accompanying drawings, which form part of the disclosure, and in which are shown, by way of illustration, specific aspects in which the invention may be placed. It is understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of the invention. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the invention is defined by the appended claims.

For instance, it is understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if a specific method step is described, a corresponding device may include a unit to perform the described method step, even if such unit is not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary aspects described herein may be combined with each other, unless specifically noted otherwise.

Figure 1 shows a CV-QKD system 100 according to an embodiment. The CV-QKD system 100 comprises a transmitter 101 (also referred to as "Alice") and a plurality of receivers 121-1 , 121-2, 121-N (also referred to as "Bob 1 ", Bob 2" ... "Bob N"). The CV- QKD system 100 could be implemented, for instance, as a component of a passive optical network (PON).

The transmitter 101 comprises a modulator 103 (referred to as quantum state generation in figure 1 ) configured to modulate a quantum coherent signal according to a continuous or discrete distribution in phase and amplitude. As illustrated in figure 1 , the quantum signal could be based on sequence of random numbers provided by a random number generator 105 of the transmitter 101. As will be appreciated, in contrast to DV-QKD which is based on single photons, the quantum coherent states used in CV-QKD can be split indefinitely.

Moreover, the CV-QKD system 100 comprises a splitter 1 1 1. The splitter may be a passive beam splitter 1 1 1. The splitter 1 1 1 is configured to split the modulated quantum signal provided by the modulator 103 of the transmitter 1 1 1 into a plurality of modulated quantum sub-signals in such a way that each modulated quantum sub-signal is an attenuated version of the modulated quantum signal. In an embodiment, the splitter 1 1 1 can be implemented as part of the transmitter 100. In an embodiment, the splitter 1 1 1 can be configured to split the modulated quantum signal provided by the modulator 103 of the transmitter 1 1 1 in such a way that each of the plurality of modulated quantum sub-signals has the same signal power. Alternatively, the splitter 1 1 1 can be configured to split the modulated quantum signal provided by the modulator 103 of the transmitter 1 1 1 in such a way that at least two of the plurality of modulated quantum sub-signals have different signal powers.

Each receiver 121-1 , 121-2, 121-N is configured to receive via a respective quantum communication channel the respective modulated quantum sub-signal from the splitter 1 1 1 and to determine a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal. In the embodiment shown in figure 1 , the plurality of phase space positions can be determined by a respective quantum state measurement unit 123-1 , 123-2, 123-N of the respective receiver 121-1 , 121-2, 121-N. In an embodiment, the respective quantum state measurement unit 123-1 , 123-2, 123-N of the respective receiver 121-1 , 121-2, 121-N can comprise a homodyne detector or a heterodyne detector for determining the plurality of phase space positions defined by the plurality of quadrature components of the respective modulated quantum sub-signal.

In the embodiment shown in figure 1 , the CV-QKD system 100 further comprises a postprocessing unit 133 (referred to as "Charlie" in figure 1 ) configured to perform a postprocessing protocol with the transmitter 101 (in particular a QKD post-processing unit 107 of the transmitter 101 ) using a classical communication channel for determining a common secret key 108. As illustrated in figure 1 , each receiver 121-1 , 121-2, 121-N is configured to transmit the plurality of phase space positions determined by the respective quantum state measurement units 123-1 , 123-2, 123-N to the post-processing unit 131 , which comprises a signal combiner 133 configured to combine the respective pluralities of phase space positions from the plurality of receivers 121-1 , 121-2, 121-N. The signal combiner 133 may add up the sequences of signals, i.e. the respective pluralities of phase space positions from the plurality of receivers 121-1 , 121-2, 121-N after aligning them to have the same signal boundary and same phase reference. In an embodiment, combining of the signals of the plurality of receivers 121-1 , 121-2, 121-N and the distribution of the secret key 108 thereto may happen by bringing all receivers 121 -1 , 121-2, 121-N together at a single location. On the other hand, the reception of the QKD signals by the receivers 121-1 , 121-2, 121-N may happen at different location at an earlier time. Thus, according to embodiments of the invention there can be a substantial time gap between the signal reception by the plurality of receivers 121-1 , 121-2, 121-N and the QKD post-processing stage.

On the basis of the combination of the respective pluralities of phase space positions from the plurality of receivers 121-1 , 121-2, 121-N a QKD post-processing unit 135 of the postprocessing unit 133 is configured to obtain the common secret key 108 using the postprocessing protocol with the transmitter 101. Once the post processing protocol between the transmitter 101 and the post-processing unit 135 has been completed and the common secret key 108 has been obtained, the post-processing unit 131 can provide the common secret key 108 to each of the receivers 121-1 , 121-2, 121-N. Although the post- processing unit 131 is illustrated in figure 1 as a separate unit, in an alternative embodiment, one of the pluralities of receivers 121-1 , 121-2, 121-N can implement the function of the post-processing unit 131.

In an embodiment, each receiver 121-1 , 121-2, 121-N is configured to transmit the plurality of phase space positions to the post-processing unit 131 via a secure communication channel, e.g., a cryptographically secured communication channel. In an embodiment, each receiver 121-1 , 121-2, 121-N is configured to obtain the common secret key 108 between the transmitter 101 and the plurality of receivers 121-1 , 121-2, 121-N from the post-processing unit 131 via a secure communication channel, e.g., a cryptographically secured communication channel.

In an embodiment, the signal combiner 133 of the post-processing unit 131 is configured to combine the respective pluralities of phase space positions from the plurality of receivers 121-1 , 121-2, 121-N using the same weights or different weights. For instance, the signal combiner 133 of the post-processing unit 131 could be configured to use a higher weight for the respective pluralities of phase space positions from a reliable receiver than for the respective pluralities of phase space positions from a less reliable receiver.

In an embodiment, the transmitter 101 is further configured to transmit a synchronization signal (e.g., a pilot tone) via the splitter 1 1 1 to each of the plurality of receivers 121-1 , 121-2, 121-N. The synchronization signal can include, for instance, frequency and/or phase information about the modulated quantum signal. In an embodiment, the transmitter 101 is configured to transmit the synchronization signal as part of the modulated quantum signal via the splitter 1 1 1 to each of the plurality of receivers 121-1 , 121-2, 121-N. The synchronization signal can keep the transmitter 101 and the plurality of receivers 121-1 , 121-2, 121-N in sync with each other. By using a passive splitter 1 1 1 , the synchronization signal can always be active between the transmitter 101 and the plurality of receivers 121- 1 , 121-2, 121-N keeping them in sync all the time.

Figure 2 shows a further embodiment of the CV-QKD system 100, which is similar to the embodiment of the CV-QKD system 100 shown in figure 1. In the embodiment shown in figure 2 each receiver 121-1 , 121-2, 121-N is configured to determine the common secret key 104 (referred to as \ in figure 2) between the transmitter 101 and the plurality of receivers 121-1 , 121-2, 121-N based on the plurality of phase space positions determined by the plurality of receivers 121-1 , 121-2, 121-N using a respective post-processing protocol between the transmitter 1 1 1 (in particular the QKD post-processing unit 107 of the transmitter 101 ) and each of the plurality of receivers 121-1 , 121-2, 121-N. Each postprocessing protocol includes a direct reconciliation stage comprising sending correction information via a respective classical communication channel from the transmitter 101 to the respective receiver 121-1 , 121-2, 121-N for determining the common secret key 108 by the respective receiver 121-1 , 121-2, 121-N. Thus, as will be appreciated, the embodiment shown in figure 2 differs from the embodiment shown in figure 1 essentially in that the measurement results, i.e. the pluralities of phase space positions determined by the plurality of receivers 121-1 , 121-2, 121-N are not combined in a post-processing unit 131 and that direct reconciliation is used for determining the common secret key 108.

In an embodiment, the transmitter 101 is configured to execute at least some of the plurality of post-processing protocols with at least some of the plurality of receivers 121-1 , 121-2, 121-N in parallel, e.g., by implementing for at least some of the receivers 121-1 , 121-2, 121-N a corresponding plurality of instances of the post-processing protocol, which can be implemented by the QKD post-processing unit 107 of the transmitter 101. In a further embodiment, the transmitter 101 is configured to execute at least some of the plurality of post-processing protocols with at least some of the plurality of receivers 121-1 , 121-2, 121-N using time-multiplexing.

Figure 3 illustrates in more detail some further steps of the respective post-processing protocols between the transmitter 101 and two exemplary receivers 121-1 , 121-2 of the CV-QKD system 100 illustrated in figure 2. As will be appreciated, similar or the same steps can be implemented for the post-processing protocol between the transmitter 101 and the post-processing unit 131 of the CV-QKD system 100 illustrated in figure 1. Generally, in addition to the information reconciliation, in particular direct reconciliation stage already described above, the post-processing protocol(s) can further include a sifting stage, a parameter estimation stage and/or a privacy amplification stage.

As illustrated in figure 3 and already described above, the random number generator 105 of the transmitter 101 produces random numbers from which the quantum states (p-i , p_å, ... , PM) to be transmitted and the associated sequence of numbers xi=(xn, X12, ... , x ) to be used by the QKD post-processing unit 107 of the transmitter 101 are determined. Each number, for example, may be the index to a quantum state in a set of possible quantum states to be sent. The quantum states are sent over a quantum channel and an eavesdropper (referred to as Eve) may manipulate (including measuring) the quantum states in transmission and may gain information about them. The respective receivers 121-1 , 121-2 (i.e. "Bob 1 " and "Bob 2") measure the quantum states they receive, e.g., using coherent detection to produce a respective sequence of numbers yi=(y-ii, i , ... , y-i_M ) and zi=(zii , z-i₂, ... , z-i_M) representing the measurement results (also referred to as initial keys). For simplicity it can be assumed that the data generated by the receivers 121-1 , 121-2 ii, ZM corresponds to the data xu determined by the transmitter 101. In a next stage, using the measurement results, the transmitter 101 and the respective receiver 121-1 , 121-2 can determine the channel characteristics such as the channel loss and the channel noise, by comparing a subset of their respective data. For example, the transmitter 101 may select random positions in the sequence xi and inform the respective receivers 121-1 , 121-2 about the positions and the corresponding values. The respective receiver 121 -1 , 121-2 can then compare them with its values in its sequence y zi at the same positions. Alternatively, the values of the keys i and z-_\ at p re-determined positions are announced by the receivers 121-1 , 121-2 to the transmitter 101. The transmitter 101 compares these values with its values of the key x_\ at the same positions to estimate the losses and noises of the channels of the receivers 121-1 , 121-2. Since the data at these positions are transmitted publicly via classical communication channels, they should be discarded from the further sequences x₂ and yi_å, zi₂ to be processed. The channel parameters determined by the transmitter 101 will be used in the subsequent postprocessing stages, including the information reconciliation stage and the privacy amplification stage.

During the information reconciliation stage the transmitter 101 and the respective receiver 121-1 , 121-2 exchange error correction information to derive a common sequence of numbers fe. Two kinds of reconciliation models exist in QKD: direction reconciliation and reverse reconciliation. In reverse reconciliation, which can be used in the CV-QKD system 100 shown in figure 1 , a sequence at the post-processing unit 131 can be considered to be correct and the transmitter 101 attempts to correct its sequence to match it by using the error correction information provided by the post-processing unit 131.

In contrast, in direct reconciliation, which is used in the embodiment of the CV-QKD system 100 shown in figure 2, but can be used in the CV-QKD system 100 shown in figure 1 as well, the transmitter's sequence x₂ is considered to be correct and the respective receiver 121-1 , 121-2 attempts to correct its sequence y , z₂ to match it by using the error correction information provided by the transmitter 101. In an embodiment, all receivers 121-1 , 121-2 receive the same piece of error correction information. This information is sufficient for the receiver with the worst data quality to correct the errors in it. This means that all receivers 121-1 , 121-2, 121-N can correct their own errors. However, this information should be insufficient for an eavesdropper to correct its errors or to obtain non-zero information on the final secret key k₄, which the transmitter 101 and the receivers 121-1 , 121-2 will generate after privacy amplification. This situation holds when the eavesdropper’s information on the transmitter’s data is smaller than the information of any receivers on the transmitter’s data (which may be guaranteed by using the channel parameters estimated in the parameter estimation step in the QKD post-processing step). This situation may also hold if one can ascertain that the eavesdropper, perhaps due to its limited capability, is unable to correct its errors to match the transmitter’s data.

After establishing the same sequence fe, the transmitter 101 and the respective receiver 121-1 , 121-2 can perform privacy amplification to remove the information about the sequence possibly obtained by an eavesdropper to form the final secret key k₄. As illustrated in figure 3, in an embodiment, the transmitter 101 sends privacy amplification information to all receivers 121-1 , 121-2, which informs the receivers 121-1 , 121-2 which privacy amplification function to use in order to transform the intermediate key fe (provided by the information reconciliations stage and about which the eavesdropper may have some information) into the final secret key k₄.

In an embodiment, all the communication involved in the QKD post-processing protocol(s) is done over a classical communication channel.

As will be appreciated, variations of the above described post-processing stages are possible, such as reversing the role of the transmitter 101 and the respective receiver 121-1 , 121-2 for parameter estimation and privacy amplification, e.g., the estimation of the losses and the noises of the channels may be performed not at the transmitter’s side but at the receivers’ sides. For instance, for parameter estimation the respective receiver 121- 1 , 121-2 can pick the random positions and provide them to the transmitter 101 along with their values at those positions. Also as a variation, the channel parameters such as loss and noise levels may be communicated from the respective receiver 121-1 , 121-2 to the transmitter 101.

Figure 4 is a flow diagram showing an example of a corresponding CV-QKD method 400, comprising the following steps: modulating 401 a quantum signal according to a continuous or discrete distribution in phase and amplitude; splitting 403 the modulated quantum signal into a plurality of modulated quantum sub-signals, wherein each modulated quantum sub-signal is an attenuated version of the modulated quantum signal; receiving 405 by each of the plurality of receivers 121-1 , 121-2, 121-N via a respective quantum communication channel the respective modulated quantum sub-signal; and determining 407 by each of a plurality of receivers 121-1 , 121-2, 121-N a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal.

Either the CV-QKD method 400 comprises the further step 409a of determining a common secret key between the transmitter 101 and the plurality of receivers 121-1 , 121-2, 121-N based on the plurality of phase space positions using a respective post-processing protocol between the transmitter 101 and each of the plurality of receivers 121-1 , 121-2, 121-N, wherein the post-processing protocol includes a direct reconciliation stage comprising sending correction information via a respective classical communication channel from the transmitter 101 to the respective receiver 121-1 , 121-2, 121-N for determining the common secret key 108 by the respective receiver 121-1 , 121-2, 121-N.

Alternatively, the CV-QKD method 400 comprises the further step 409b of performing a post-processing protocol between the post-processing unit 131 and the transmitter 101 , including, for each of the plurality of receivers 121-1 , 121-2, 121-N, transmitting the plurality of phase space positions to the post-processing unit 131 for combining the respective pluralities of phase space positions from the plurality of receivers 121-1 , 121-2, 121-N by the post-processing unit 131 and obtaining the common secret key 108 between the transmitter 101 and the plurality of receivers 121-1 , 121-2, 121-N from the postprocessing unit 131.

Some of the embodiments described above provide one or more of the following advantages: a single transmitter can exchange keys with many receivers; a common secret key can be generated between the transmitter 101 and the plurality of receivers 121-1 , 121-2, 121-N; only passive switching is required; only one wavelength-division multiplexing (WDM) optical channel needed for multiple users; synchronization signals may always be active, keeping the transmitter 101 and all receivers 121-1 , 121-2, 121-N always in sync. The person skilled in the art will understand that the "blocks" ("units") of the various figures (method and apparatus) represent or describe functionalities of embodiments of the invention (rather than necessarily individual "units" in hardware or software) and thus describe equally functions or features of apparatus embodiments as well as method embodiments (unit = step).

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus embodiment is merely exemplary. For example, the unit division is merely logical function division and may be other division in actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, functional units in the embodiments of the invention may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.

Claims

1. A continuous variable quantum key distribution, CV-QKD, system (100), comprising: a transmitter (101 ) comprising a modulator (103) configured to modulate a quantum signal according to a continuous or discrete distribution in phase and amplitude; a splitter (1 11 ) configured to split the modulated quantum signal into a plurality of modulated quantum sub-signals, wherein each modulated quantum sub-signal is an attenuated version of the modulated quantum signal; and a plurality of receivers (121-1 , 121-2, 121-N), wherein each receiver is configured to receive via a respective quantum communication channel the respective modulated quantum sub-signal from the splitter (1 1 1 ) and to determine a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal; wherein each receiver (121-1 , 121-2, 121-N) is configured to determine a common secret key based on the plurality of phase space positions using a respective post-processing protocol between the transmitter (101 ) and each of the plurality of receivers (121-1 , 121-2, 121-N), wherein the post-processing protocol includes a direct reconciliation stage comprising sending correction information via a respective classical communication channel from the transmitter (101 ) to the respective receiver (121-1 , 121-2, 121-N) for determining the common secret key by the respective receiver (121-1 , 121-2, 121-N); or wherein the CV-QKD system (100) further comprises a post-processing unit (131 ; 121-1 , 121-2, 121-N) configured to perform a post-processing protocol with the transmitter (101 ), wherein each receiver (121-1 , 121-2, 121-N) is configured to transmit the plurality of phase space positions to the post-processing unit (131 ; 121-1 , 121-2, 121-N) for combining the respective pluralities of phase space positions from the plurality of receivers (121-1 , 121-2, 121-N) by the post-processing unit (131 ; 121-1 , 121-2, 121-N) and to obtain a common secret key from the post-processing unit (131 ; 121-1 , 121-2, 121- N).

2. The CV-QKD system (100) of claim 1 , wherein one of the plurality of receivers (121-1 , 121-2, 121 -N) comprises the post-processing unit (121-1 , 121-2, 121-N).

3. The CV-QKD system (100) of claim 1 , wherein each receiver (121-1 , 121-2, 121- N) is configured to transmit the plurality of phase space positions to the post-processing unit (131 ; 121-1 , 121-2, 121-N) via a secure communication channel and/or wherein each receiver (121-1 , 121-2, 121-N) is configured to obtain the common secret key from the post-processing unit (131 ; 121-1 , 121-2, 121-N) via a secure communication channel.

4. The CV-QKD system (100) of any one of the preceding claims, wherein the postprocessing unit (131 ; 121-1 , 121-2, 121-N) is configured to combine the respective pluralities of phase space positions from the plurality of receivers (121-1 , 121-2, 121-N) using the same weights or different weights.

5. The CV-QKD system (100) of claim 1 , wherein the transmitter (101 ) is configured to execute at least some of the plurality of post-processing protocols with at least some of the plurality of receivers (121-1 , 121-2, 121-N) in parallel.

6. The CV-QKD system (100) of claim 1 , wherein the transmitter (101 ) is configured to execute at least some of the plurality of post-processing protocols with at least some of the plurality of receivers (121-1 , 121-2, 121-N) using time-multiplexing.

7. The CV-QKD system (100) of claims 1 , 5 or 6, wherein each of the plurality of modulated quantum sub-signals is associated with a respective signal power and wherein the plurality of modulated quantum sub-signals have the same signal power.

8. The CV-QKD system (100) of claims 1 , 5 or 6, wherein each of the plurality of modulated quantum sub-signals is associated with a respective signal power and wherein at least two of the plurality of modulated quantum sub-signals have different signal powers.

9. The CV-QKD system (100) of any one of the preceding claims, wherein the transmitter (101 ) is further configured to transmit a synchronization signal via the splitter (1 1 1 ) to each of the plurality of receivers (121-1 , 121-2, 121-N).

10. The CV-QKD system (100) of claim 9, wherein the transmitter (101 ) is configured to transmit the synchronization signal together with the modulated quantum signal via the splitter (1 1 1 ) to each of the plurality of receivers (121-1 , 121-2, 121-N).

1 1. The CV-QKD system (100) of any one of the preceding claims, wherein the transmitter (101 ) comprises a random number generator (105) for generating the quantum signal.

12. The CV-QKD system (100) of any one of the preceding claims, wherein the postprocessing protocol further includes a sifting stage, a parameter estimation stage, and/or a privacy amplification stage.

13. The CV-QKD system (100) of any one of the preceding claims, wherein each receiver (121-1 , 121-2, 121-N) comprises a homodyne detector or a heterodyne detector for determining the plurality of phase space positions defined by the plurality of quadrature components of the respective modulated quantum sub-signal.

14. The CV-QKD system (100) of any one of the preceding claims, wherein the splitter (1 1 1 ) is a passive beam splitter (1 1 1 ).

15. A passive optical network comprising the CV-QKD system according to any one of the preceding claims.

16. A continuous variable quantum key distribution, CV-QKD, method (400), comprising: modulating (401 ) a quantum signal according to a continuous or discrete distribution in phase and amplitude; splitting (403) the modulated quantum signal into a plurality of modulated quantum subsignals, wherein each modulated quantum sub-signal is an attenuated version of the modulated quantum signal; receiving (405) by each of a plurality of receivers (121-1 , 121-2, 121-N) via a respective quantum communication channel the respective modulated quantum sub-signal; determining (407) by each of a plurality of receivers (121-1 , 121-2, 121-N) a plurality of phase space positions defined by a plurality of quadrature components of the respective modulated quantum sub-signal; and determining (409a) a common secret key based on the plurality of phase space positions using a respective post-processing protocol between the transmitter (101 ) and each of the plurality of receivers (121-1 , 121-2, 121-N), wherein the post-processing protocol includes a direct reconciliation stage comprising sending correction information via a respective classical communication channel from the transmitter (101 ) to the respective receiver (121-1 , 121-2, 121-N) for determining the common secret key by the respective receiver

(121-1 , 121-2, 121-N); or performing (409b) a post-processing protocol between a post-processing unit (131 ; 121-1 , 121-2, 121-N) and the transmitter (101 ), including, for each of the plurality of receivers (121-1 , 121-2, 121-N), transmitting the plurality of phase space positions to the postprocessing unit (131 ; 121-1 , 121-2, 121-N) for combining the respective pluralities of phase space positions from the plurality of receivers (121-1 , 121-2, 121-N) by the postprocessing unit (131 ; 121-1 , 121-2, 121-N) and obtaining a common secret key from the post-processing unit (131 ; 121-1 , 121-2, 121-N).

17. A computer program product comprising program code for controlling a CV-QKD system to perform the CV-QKD method (400) of claim 16 when the program code is executed on a computer.