WO2020192910A1

WO2020192910A1 - Synchronization in quantum key distribution

Info

Publication number: WO2020192910A1
Application number: PCT/EP2019/057761
Authority: WO
Inventors: Hans Brunner; Stefano Bettelli; David Hillerkuss
Original assignee: Huawei Technologies Duesseldorf Gmbh
Priority date: 2019-03-27
Filing date: 2019-03-27
Publication date: 2020-10-01
Also published as: CN113545001A; CN113545001B

Abstract

A receiver and a transmitter, which are configured to operate in a quantum key distribution system, are provided. The receiver is for receiving and the transmitter is for transmitting an optical signal that includes a data block including raw key data and control information related to the data block. The data block and the control information are multiplexed in frequency domain.

Description

SYNCHRONIZATION IN QUANTUM KEY DISTRIBUTION

TECHNICAL FIELD

Embodiments of the present invention relate to the field of quantum key distribution (QKD).

QKD is a technique that enables two distant, legitimate parties to establish a common (or shared) secret key in a way that is, considering the laws of quantum mechanics, secure against eavesdropping on the used communication channel(s). To be specific, a shared secret key is a piece of information that is known to both the legitimate parties and unknown to anyone else. Since the shared secret (key) is known only to the legitimate parties, it plays a key role in cryptography where it has many application, such as secure communication, e.g., encryption, decryption of messages and message

authentication. In optical data communications, an eavesdropper, conventionally called Eve, can acquire information about a signal (e.g., a key) transmitted from a sender to a receiver, conventionally called Alice and Bob, respectively, e.g., by splitting of and detecting a fraction of the information carrying light.

In non-QKD systems, the security of the key exchange between two distant parties is typically based on asymmetric cryptography, which relies on the computational complexity of certain mathematical problems, e.g., Diffie-Hellman key exchange or Rivest-Shamir-Adleman public-key cryptosystems. However, as soon as a sufficiently powerful (quantum) computer is available or mathematical progress (e.g., more efficient algorithms) has been made, such key distribution methods may become insecure. Even worse, all data that has been encrypted using keys distributed with these methods can retroactively be broken if the key exchange has been recorded by an eavesdropper.

In QKD, on the other hand, the security of the key distribution is guaranteed by the laws of quantum mechanics, which allow to derive Heisenberg’s uncertainty principle and the no- cloning theorem. The uncertainty principle, which states that certain variables cannot be known simultaneously with arbitrary precision, implies that measuring one variable destroys information about some other variable. Thus, when Eve performs measurements on the transmitted signal, she inevitably leaves a trace by introducing transmission errors. The no cloning theorem states that it is impossible to make a perfect copy of an unknown quantum state, e.g., of a random signal (or a fraction thereof) encoded in an optical mode.

Consequently, it is also impossible to circumvent the uncertainty principle by performing measurements on perfect copies.

Thus, in short, the presence of an eavesdropper spying on communication between the sender and the recipient inevitably leaves a trace that can be detected by way of observing the amount of transmission errors or, equivalently, noise in the transmission channel. In QKD, this is exploited by calculating, based on the observed noise, an upper bound for the information accessible to any eavesdropper. If this upper bound is sufficiently small, a shared secret key can be extracted from the information shared between the sender and the recipient. Under certain conditions, this shared secret key extraction can be proven to be information theoretic secure.

QKD systems can be divided into discrete variable QKD (DV QKD) systems and continuous variable QKD (CV QKD) systems. In DV QKD systems, the information from which the shared secret key is extracted is encoded in a discrete variable, which usually is the polarization/spin degree of freedom of, ideally, single photons, as, e.g., in the BB84 protocol. However, single photon sources and detectors are expensive and difficult to miniaturize. In CV QKD systems, on the other hand, the information from which the shared secret key is extracted is encoded in a continuous variable. Correspondingly, CV QKD protocols are usually based on the transmission of coherent or squeezed states of light, where said information is continuously encoded in the quadratures (phase and amplitude) of the transmitted light/electromagnetic field. At the receiver, the received signal can thus be measured by means of coherent detection (e.g., homodyne, intradyne, or heterodyne detection) using a strong local oscillator (LO). For these reasons, CV QKD is more compatible with standard components and equipment used in current telecommunications systems, and it is even possible to simultaneously use the same optical fiber for QKD and classical signal transmission. SUMMARY

Starting from the above described approaches, one of the aims of the present disclosure can be seen as how to further increase the performance of QKD systems, in particular, by providing an efficient tool for synchronization tasks between transmitter and receiver.

The foregoing and other objectives are achieved by the subject matter of the independent claims. Further advantageous implementations are apparent from the dependent claims, the description, and the figures.

Embodiments of the present application provide apparatuses and methods for receiving and transmitting signals according to the independent claims.

In particular, according to a first aspect, the invention relates to an apparatus for receiving an optical signal. The apparatus is configured to operate in a quantum key distribution system and comprises an optical detector for generating a multiplexed signal from the optical signal. The apparatus further comprises a processing circuitry configured to generate, by de multiplexing from the multiplexed signal, a data block including raw key data and control information related to the data block, which are multiplexed in frequency domain.

According to a second aspect, the invention relates to an apparatus for transmitting an optical signal is provided. The apparatus is configured to operate in a quantum key distribution system and comprises a processing circuitry configured to generate a data block including raw key data, control information related to the data block, and, by multiplexing the data block and the control information in frequency domain, a multiplexed signal. The apparatus further comprises an optical transmitter for transmitting the multiplexed signal within the optical signal.

The control information may be used for and/or facilitate high granularity frame

synchronization, service information, and continuous detection of synchronization. In particular, the signal transmitted in the service channel may be used to support carrier and sampling clock synchronization or synchronization error compensation. Furthermore, the control information may be used to transmit service information for in-time (dynamic) configuration.

Advantageously, in the first or second aspect, the starting position of the data block in time domain is arranged in a predefined manner relatively to the control information. Since the control information can be transmitted with a higher power than the data blocks, it may be easier to determine a position of the control information than a position of the data block. Therefore, arranging the starting position of the data block(s) in time domain in a predefined manner relatively to the control information, may facilitate the detection of the frame start of a data block(s).

Furthermore, advantageously, in the first or second aspect, the control information includes information identifying the data block.

Advantageously, the information identifying the data block is a sequence number of the data block. The two measures above may further facilitate determination of the position of the control information in time domain and, thus, facilitate the detection of the frame start of a data block(s). This may improve further synchronization tasks between transmitter and receiver.

Advantageously, in the first or second aspect, the information identifying the data block is scrambled with a first sequence. Advantageously, the first sequence is a predetermined pseudo-noise, PN, sequence.

Advantageously, in the first or second aspect, the control information includes a second predetermined sequence, which is post- or pre-pended to the information identifying the data block.

Advantageously, in the first or second aspect, the data block further includes a third predetermined sequence, which is post- or pre-pended to the raw key data.

Advantageously, in the first or second aspect, the information identifying the data block is scrambled with a first sequence, the control information further includes a second predetermined sequence, which is post- or pre-pended to the information identifying the data block, and the data block further includes a third predetermined sequence, which is post- or pre-pended to the raw key data.

Scrambling a data block, in particular with a PN sequence, may whiten the transmit signal which may improve clock recovery and/or may reduce the intermodulation.

Such a post/pre-pended sequence may facilitate identifying the beginning of a frame via detection of correlation. In particular, the good auto-correlation properties of PN sequences may be exploited for a precise determination of the position of a PN sequence. Thus, a post/pre-pended sequence may facilitate identifying the beginning of the data block and/or the raw key data via detection of correlation. Furthermore, the position (in time domain) of a predetermined sequence that is post- or pre-pended to the information identifying the data block, which may be sent with a higher power than the data block and/or raw key data signal, may be particularly easy to localize. This may, in turn, allow to determine the position of the raw key data (or data block) even more easily and/or even more precisely.

Advantageously, two or more sequences of the first sequence, the second predetermined sequence, and the third predetermined sequence are identical.

This may facilitate a simple implementation.

Advantageously, in any of the above implementations of the first or second aspect, the processing circuitry may further be configured to generate a plurality of data blocks, wherein each data block includes respective raw key data. Advantageously, in a first subset of the plurality of data blocks, the respective raw key data is post- or pre-pended by a predetermined sequence, and, in a second subset of the plurality of data blocks, the respective raw key data is not post- or pre-pended by a predetermined sequence.

By only post- or pre-pending a subset of raw key data with a predetermined sequence the efficiency of the communication (e.g., the spectral efficiency) may be increased. Thus, rate with which a shared secret key is generate may be increased.

Furthermore, advantageously, in any of the above implementations of the first or second aspect, the apparatus may further be configured to operate in a continuous variable quantum key distribution system.

According to a third aspect, the invention relates to a method for receiving an optical signal. The method is for quantum key distribution and includes the step of generating a multiplexed signal from the optical signal. The method further includes the step of generating, by de multiplexing from the multiplexed signal, a data block including raw key data and control information related to the data block, which are multiplexed in frequency domain.

According to a forth aspect, the invention relates to a method for transmitting an optical signal. The method is for quantum key distribution and includes the step of generating a data block including raw key data, control information related to the data block, and, by multiplexing the data block and the control information in frequency domain, a multiplexed signal. The method further includes the step of transmitting the multiplexed signal within the optical signal. The control information may be used for and/or facilitate high granularity frame

Advantageously, in the third or fourth aspect, the starting position of the data block in time domain is arranged in a predefined manner relatively to the control information.

Since the control information can be transmitted with a higher power than the data blocks, it may be easier to determine a position of the control information than a position of the data block. Therefore, arranging the starting position of the data block(s) in time domain in a predefined manner relatively to the control information, may facilitate the detection of the frame start of a data block(s).

Furthermore, advantageously, in the third or fourth aspect, the control information includes information identifying the data block. Advantageously, the information identifying the data block is a sequence number of the data block.

The two measures above may further facilitate determination of the position of the control information in time domain and, thus, facilitate the detection of the frame start of a data block(s). This may improve further synchronization tasks between transmitter and receiver.

Advantageously, in the third or fourth aspect, the information identifying the data block is scrambled with a first sequence. Advantageously, the first sequence is a predetermined pseudo-noise, PN, sequence.

Advantageously, in the third or fourth aspect, the control information includes a second predetermined sequence, which is post- or pre-pended to the information identifying the data block. Advantageously, in the third or fourth aspect, the data block further includes a third predetermined sequence, which is post- or pre-pended to the raw key data.

Advantageously, in the third or fourth aspect, the information identifying the data block is scrambled with a first sequence, the control information further includes a second

predetermined sequence, which is post- or pre-pended to the information identifying the data block, and the data block further includes a third predetermined sequence, which is post- or pre-pended to the raw key data.

Advantageously, in any of the above implementations of the third or fourth aspect, the method further includes the step of generating a plurality of data blocks, wherein each data block includes respective raw key data. Advantageously, in a first subset of the plurality of data blocks, the respective raw key data is post- or pre-pended by a predetermined sequence, and, in a second subset of the plurality of data blocks, the respective raw key data is not post- or pre-pended by a predetermined sequence.

Furthermore, in any of the above implementations of the third or fourth aspect, the method may further be for continuous variable quantum key distribution.

According to a fifth aspect, a computer program product is provided including program code for performing the method according the third and or fourth aspect and their implementations, when the program code is run by a processor.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following embodiments of the invention are described in more detail with reference to the attached figures and drawings, in which:

Fig. 1 is a block diagram illustrating a receiving device and a transmitting device for a QKD system;

Fig. 2 is a flow diagram illustrating exemplary steps performed at the transmitter side for generating a multiplexed signal carrying raw key data and a frame identifier;

Fig. 3 is a graph illustrating an exemplary spectrum allocation including quantum channel, synchronization channel, and pilot signal;

Fig. 4 is a flow diagram illustrating exemplary steps performed at the receiver side for processing a multiplexed signal carrying raw key data and a frame identifier;

Fig. 5 are block diagrams illustrating exemplary transmitter and receiver implementations;

Fig. 6 is a schematic drawing illustrating an exemplary structure of a multiplexed signal with pre-pended synchronization sequences;

Fig. 7 is a schematic drawing illustrating an exemplary structure of a multiplexed signal with post-pended synchronization sequences and a relative offset between data block and control information;

Fig. 8 is a schematic drawing illustrating an exemplary structure of a multiplexed signal in which data frame and service frame have a different time length and bandwidth;

Fig. 9 is a schematic drawing illustrating an exemplary structure of a multiplexed signal that includes multiple data blocks and related control information; Fig. 10 is a schematic drawing illustrating an exemplary structure of a multiplexed signal with reduced training in the quantum channel;

Fig. 11 is a block diagram illustrating an exemplary structure of a transmitter;

Fig. 12 is a block diagram illustrating a first part of an exemplary structure of a receiver; and

Fig. 13 is a block diagram illustrating a second part of an exemplary structure of a receiver.

In the following identical reference signs refer to identical or at least functionally equivalent features.

DETAILED DESCRIPTION OF THE EMBODIMENTS

In the following description, reference is made to the accompanying figures, which form part of the disclosure, and which show, by way of illustration, specific aspects of embodiments of the invention or specific aspects in which embodiments of the present invention may be used. It is understood that embodiments of the invention may be used in other aspects and comprise structural or logical changes not depicted in the figures. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of the present invention is defined by the appended claims.

For instance, it is understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if one or a plurality of specific method steps are described, a corresponding device may include one or a plurality of units, e.g. functional units, to perform the described one or plurality of method steps (e.g. one unit performing the one or plurality of steps, or a plurality of units each performing one or more of the plurality of steps), even if such one or more units are not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on one or a plurality of units, e.g. functional units, a corresponding method may include one step to perform the functionality of the one or plurality of units (e.g. one step performing the functionality of the one or plurality of units, or a plurality of steps each performing the functionality of one or more of the plurality of units), even if such one or plurality of steps are not explicitly described or illustrated in the figures. Further, it is understood that the features of the various exemplary embodiments and/or aspects described herein may be combined with each other, unless specifically noted otherwise. Moreover, it is noted that, in general, all numerical values are examples for the sake of a full description.

In general, a QKD protocol requires that Alice and Bob can communicate via two different transmission channels, a quantum channel and a (classic) public channel. In the context of QKD, the quantum channel is an optical channel which may provide increased privacy, and the public channel may be a channel on any medium (optical or electrical, wired or wireless).

More specifically, in the quantum channel, the properties of quantum mechanics are exploited in order to detect eavesdropping on signals transmitted through said channel, which are henceforth denoted as quantum signals. The quantum channel thus provides (increased) privacy. Depending on the particular quantum mechanical principle(s) exploited in the quantum channel, QKD protocols can be divided into prepare-and-measure protocols and entanglement-based protocols.

Prepare-and-measure protocols are usually based on Heisenberg’s Uncertainty Principle and the no-cloning theorem. In these protocols, Alice generates a quantum signal (e.g., by encoding information in quantum states of the electromagnetic field) and subsequently sends it to Bob. Bob performs measurements (e.g., using a detector) on the received quantum signal, which may be different from the quantum signal sent by Alice, in particular, in case of eavesdropping by Eve.

Entanglement-based protocols are usually based on quantum entanglement. In these protocols, entangled quantum states, each comprising at least two entangled particles (e.g., polarized photons), are generated (not necessarily by/at Alice or Bob). Alice and Bob each receive at least one of the entangled particles of such an entangled quantum state, and perform a measurement thereon. In this case, eavesdropping cannot be seen in an increased error rate, but is detected bytesting Bell’s inequality.

The public channel is a classic channel, i.e., properties of quantum mechanics are not exploited to detect eavesdropping and, hence, the signals transmitted in this channel can have a much higher intensity than the intensity of the quantum signals. Consequently, in the security analysis, it is usually assumed that any message exchanged between Alice and Bob over the public channel is known to Eve. The public channel is nevertheless an important part of any QKD protocol as it is used, e.g., for QKD post-processing. The public channel is advantageously an authenticated channel, such that Alice and Bob can be certain that they are communicating with each other.

Alice, corresponding to the transmitting device, generates, using a random number generator, a raw key (or raw key data), which is henceforth denoted also as Alice’s raw key. In general, in the present disclosure, a key may be a string (e.g., sequence) of symbols or of bits. Alice then encodes her raw key onto quantum states of an optical signal (e.g., light, electromagnetic wave, photons), thereby generating a quantum signal. The quantum signal (e.g., the quantum states), generated in accordance with Alice’s raw key, are sent to Bob over the quantum channel, i.e., to the receiving device. Bob, when receiving a quantum signal (the received quantum signal is usually different from the sent quantum signal), performs measurements on the received quantum signal and thereby obtains a raw key (or raw key data), henceforth denoted also as Bob’s raw key.

After Bob has generated, based on results of said measurements performed on the received quantum signal, the raw key, Alice and Bob each have a respective raw key. However, Alice’s raw key is, in general, different from Bob’s raw key. Furthermore, neither Alice’s raw key nor Bob’s raw key is, in general, with certainty, (completely) secret to a potential eavesdropper (It cannot be excluded that an eavesdropper may have obtained some information about one or both of the raw keys).

For these reasons, Alice and Bob subsequently perform QKD post-processing. QKD post processing, which is usually performed on classical computing devices, is a procedure which allows Alice and Bob to generate, from the two raw keys (Alice’s raw key and Bob’s raw key), a shared secret key. Any information exchanged between Alice and Bob during QKD post-processing is exchanged via the public channel. QKD post-processing usually includes a reconciliation step/phase, privacy amplification step/phase. These steps are outlined in turn below. It is noted that, depending on the used QKD protocol, QKD post-processing may also include a sifting step/phase.

As part of QKD post-processing, Alice and Bob estimate an upper bound for the information that an eavesdropper may, by spying on the quantum channel, have been able to obtain about Alice’s and/or Bob’s raw key. This estimated is usually based on the experienced noise or, equivalently, the number of errors between Alice’s raw key and Bob’s raw key.

In particular, in the error estimation step (or parameter estimation phase), Alice and/or Bob estimate the (total) error/error rate of a raw key (Alice’s raw key and/or Bob’s raw key). More specifically, the total error may be the count/number of differences between Alice’s raw key and Bob’s raw key (e.g., bits/symbols of one raw key that have a different value than the respective corresponding bit/symbol of the respective other raw key). The error rate may, e.g., be said total number of errors divided by (total) length of the respective raw key.

Consequently, the total error or total noise of a raw key includes errors caused by

eavesdropping as well as errors caused by imperfections in the transmission line (optical fiber(s), detectors, etc.).

In order to estimate said total noise of a raw key, henceforth denoted simply as the total noise, Alice and/or Bob have to disclose some information (parameter estimation information) , which is preferably selected randomly, about one or both raw keys via the public channel. Alice and/or Bob can then compare the corresponding information (bits/symbols) of their own raw key with the information about the other raw key, obtained via the public channel, which allows Alice and/or Bob to estimate the total noise.

For instance, Alice may announce/disclose, via the public channel, a randomly chosen subset of symbols/bits of her raw key. Bob, for instance, then compares said subset of Alice’s raw key with the corresponding subset of his own raw key. Thereby, Bob can determine the number of errors between the two subsets. By dividing the number of errors determined in this way by the length of the disclosed subset (number of bits/symbols of the disclosed subset). Bob can further estimate, the error rate of his (entire) raw key. Moreover, for instance, by multiplying this error rate with the length of his raw key, Bob may obtain an estimate for the total noise in his raw key.

If the subsets are sufficiently large and chosen randomly (of course, the two subset are not chosen one subset completely determines the other subset), the estimate of the total noise can be expected to be accurate.

Subsequently, in the error correction step, Alice and Bob generate/establish, from Alice’s raw key and Bob’s raw key, a shared key. More specifically, at the end of the error correction step, Alice and Bob share, with high probability, a same (e.g., identical) key. Said same key, obtained from Alice’s raw key and Bob’s raw key as a result of the error correction step, is henceforth denoted as the shared key. It is noted that, in the error correction step, Alice and Bob attempt to correct any errors whether they are caused by eavesdropping or not.

Finally, in the privacy amplification, Eve's information about the shared key is reduced (i.e., effectively eliminated). More specifically, Alice and Bob produce, from the shared key, a new, shorter key, in such a way that Eve has, with high probability, only negligible information about the new key, henceforth denoted as the shared secret key or final key. Of course, if Eve’s information about the shared key is not partial (e.g., if Eve has complete information about the shared key) no such shared secret key can be generated.

In order to generate a shared secret key, Alice and Bob first have to estimate how much information about the shared key Eve may have been able to obtain. Since, in order to gain information from the quantum channel, Eve has to interact with the quantum states, Eve’s information gain necessarily causes transmission errors. In other words, the experienced noise may be a signature of Eve’s interaction with the quantum state sent from Alice (e.g., the transmitter) to Bob, and, thus, may be related to information gain of an eavesdropper.

Therefore, an upper bound for Eve’s information gain, required for privacy amplification, can be derived from the experienced noise/transmission errors.

Of course, the higher the (estimated) upper bound for Eve’s information gain, the smaller the shared secret key that can be generated (e.g., from a given shared key). In fact, if the upper bound for Eve’s information gain becomes too large, (secret) key generation may even prevented entirely.

However, noise caused by eavesdropping can usually not be determined precisely and/or distinguished reliably from other noise. Therefore, for a strict security analysis, it is often necessary to attribute all power loss in the quantum channel and all noise on top of the fundamental shot noise to the eavesdropper. These noises, attributed to Eve,

contribute/increase the upper bound for Eve’s information gain and thus reduce the size of the shared secret key or, in short, reduce the final key rate. This puts the eavesdropper in the most powerful position limited only by the laws of quantum mechanics. The transmit power in QKD is in general at the single photon level, e.g. -90dBm for a 10MHz symbol rate at 193THz. The signal at the receiver is weak compared to the shot noise in the detector and has an SNR typically between -KMB and -20dB. Reliable detection of such a weak signal with such a narrow bandwidth at such a high carrier frequency is a difficult task.

In general, from a signal processing point of view, the key performance indicator of a setup is the noise on top of the shot noise, which has a severe impact on the final key rate. The dominant noise is the electronic noise of the receiver side amplifiers. This noise source might be trusted under certain security assumptions and, therefore, can be disregarded. The remaining noise on top of the shot noise can be estimated by subtracting the mean-squared values of the calibrated shot noise, the calibrated electronic noise, and the recovered signal from the total mean-squared value in the quantum channel. Expressing this value normalizing to the mean-squared value of the shot noise is the typical figure of merit for CV-QKD systems.

Therefore, it is of particular importance in QKD to reduce transmission errors and additional noise. A source for such additional noise and/or even loss (e.g., of raw key data), which typically is also attributed to an eavesdropper, is an imperfect synchronization between transmitter and receiver clocks in frequency and/or phase for the carrier frequency, the sampling frequency, and/or data alignment, corresponding to carrier clock synchronization, sampling clock synchronization, and frame synchronization, respectively.

In particular, frame synchronization refers to the alignment of data at transmitter and receiver (e.g., determining which bit/symbol of Bob’s raw key corresponds to which bit/symbol of Alice’s raw key). In CV-QKD, this issue may be addressed by offline processing, which means that only a snapshot of data is detected, stored, and compared with the transmit sequence on a computer where both sequences are available. In DV-QKD, this issue may be addressed with external sources for synchronization, since it can be done with a slow clock in general. For instance, a trigger signal on an additional, low-delay connection between transmitter and receiver can be used to indicate the start of a frame once per second. Between trigger signals the synchronization can be kept up by tracking the number of processed symbols. The disadvantages of this method is the strict separation between data and synchronization signals, which may not be aligned precisely enough, and that the

synchronization signals are rare, which requires that large blocks of continuous data are aligned jointly. This low granularity may also be inefficient, if the channel conditions change quickly or in scenarios, where the signal is switched, e.g., time multiplexed onto different fibers reaching different receivers, so that the respective receivers might not see a signal continuously.

It is noted that, in general,“ aligned” refers to the transmitter, i.e., signals/data/frames/b locks are generated“aligned” at the transmitter). The signals/blocks may no longer, depending on the channel conditions, be aligned when received at the receiver (which is one of the reasons synchronization is required to begin with). Carrier clock synchronization refers to the synchronization of the LO of the receiver’s detector(s) with the transmitter laser, and therefore mainly concerns CV-QKD. Here,“inline” LO setups and“local” LO setups have to be distinguished.

In“inline” LO setups, there is no separate laser used as an LO at the receiver. The transmitter time-interleaves the quantum signal with strong pulses of light, the“inline” LO, these are then delayed at the receiver and beaten with a following quantum signal. Since the quantum signal and the“inline” LO originated from the same laser, maybe even during its coherence time, the quantum signal is down-converted with a frequency and phase synchronized carrier with some remaining phase noise. The drawbacks of this approach are that the“inline” LO might spill a substantial amount of power into the quantum time slots, which again could prevent key generation or reduce the final key rate. Moreover, since the“inline” LO is sent over the optical channel, it is potentially in the hands of the eavesdropper. The eavesdropper could vary the power of the“inline” LO in such a way, that it could hide a copying attack in an undetectable way, which implies a loss of security.

In“local” LO setups there is a transmitter and a receiver side laser. The receiver side laser needs to be aligned to the transmit side laser in frequency and phase. This is typically done by locking onto a pilot tone, which is sent from the transmitter. This pilot tone is sent either in a different polarization and/or separated by frequency and/or time. The pilot tone can have a much stronger power, since it does not leak information and is assumed to be known to the eavesdropper from the beginning on. This strong power signal can be found much more easily compared to the quantum signal and it also has a much better SNR. The high SNR allows to extract precise frequency and phase information. This information can be used to align the receiver side laser optically or compensate the error digitally. The pilot tone can be detected with the same or different detector(s) as the quantum channel.

Different receiver/detection setups are discussed below using Figures 5(a)-(c) as reference.

Figures 5(a) and 5(b) show the detection of the quantum channel in the most common inline LO setups, where pilot tone and quantum signal are typically detected with different detectors. In particular, the receiver side laser 500 generates a“local” local oscillator E_L, which is used to down-convert the quantum channel and detect it.

Figure 5(a) illustrates the setup of a receiver that performs a single quadrature intradyne or homodyne detection on a received quantum signal. In this case, only one phase component, e.g., the in-phase component, is detected/measured with a balanced detector 520, which requires that frequency and phase of the“local” local oscillator E_L have to be aligned precisely to the transmit side laser.

Figure 5(b) illustrates the setup of a receiver that performs dual quadrature intradyne or homodyne detection on a received quantum signal. Here, both phase components are detected with the balanced detectors 521 and 522, which requires only that the frequency of the“local” local oscillator E_L is aligned precisely to the transmit side laser. Since both phase space components are detected, the phase can be corrected in software afterwards (e.g., via digital processing). Most CV-QKD setups are built according to 5(b) and use different detectors for the quantum channel and the pilot tone. This requires a high amount of optical complexity and introduces the need for synchronization between the detectors. Relying on pilot tones for synchronization is in general an inefficient bandwidth allocation.

Figure 5(c) illustrates the setup of a heterodyne detection, which relaxes the frequency and phase alignment such that precise frequency and phase correction can be done in software. A coarse frequency alignment is still necessary such that the transmit signal stays in the detectable bandwidth of the balanced detector 523. In heterodyne detection, pilot tone and quantum channel are typically detected with the same detector with significantly less optical complexity and facilitated synchronization.

From a communication point of view, both setups 5(b) and 5(c) reach the same performance and the same SNR. They have however different implementation issues: While dual quadrature homodyne or intradyne has a larger optical complexity, it directly recovers the baseband signal after the balanced detectors 521 and 522, which offers the largest signal- detection bandwidth for a given balanced-detector bandwidth. For heterodyne detection instead the main complexity lies in the electrical domain. As the detected signal is still modulated at an intermediate frequency, the balanced detector 523 must have a larger bandwidth to support the signal bandwidth. However heterodyne detection is especially beneficial for CV-QKD for two reasons: First, it allows for a reduced system complexity by using electronic integration. Second, it improves robustness, as the electrical signal is amplified right after detection before being processed in the electrical domain, thus relaxing the requirements for subsequent signal-mixing and processing stages. The achievable final key rate and the supported reach with a strict security model benefit more from reducing the losses and noise in the system than from increasing the raw symbol rate. Here, it is important to note that several measures have to be taken to ensure security of CV- QKD systems. First, if, at a given time, only one quadrature of the incoming light is measured (e.g., if, as shown Fig. 5(a) and Fig. 5(c), only one balanced detector is used), it is necessary to randomize the phase of the LO. This will give access to both quadratures, which is necessary to detect attacks that are based on squeezed states. Second, one needs to harden the system against side channel attacks. This is achieved by adding isolators and optical filters at the output of the transmitter and the input of the receiver as well as by monitoring the output of the transmitter and the shot noise at the detector.

Finally, sampling clock synchronization, which mainly concerns CV-QKD as well, may be addressed by using a setup with multiple pilot tones. Then, the clock at the transmitter defines the exact separation in frequency, and the measured frequency at the receiver indicates the clock offset. This information can be used for compensation. The drawback of this method is the inefficient usage of the bandwidth.

Thus, precise synchronization in carrier frequency (and phase), sampling frequency (and phase), as well as frame synchronization are essential tasks especially for a proper operation of CV-QKD. The present invention facilitates improvement of these three related

synchronization issues (frame synchronization, carrier clock synchronization, and sampling clock synchronization), may support all these synchronization tasks with high precision, and allows to detect whether there is sufficient synchronization. Additionally, the present invention facilitates sending of service information for in-time configuration.

Figure 1 illustrates an exemplary QKD system with a QKD transmitter 120 and a QKD receiver 190 communicating over an optical channel 130. Figure 6 illustrates an exemplary signal conveyed over the optical channel 130.

In particular, according to an aspect of the present invention an apparatus 120 is provided for transmitting an optical signal, the apparatus being configured to operate in a quantum key distribution system and comprising a processing circuitry 100 configured to generate a data block 620 including raw key data 625, control information 610 related to the data block 620, and, by multiplexing the data block 620 and the control information 610 in frequency domain, a multiplexed signal 600; and an optical transmitter 110 for transmitting the multiplexed signal 600 within the optical signal.

In general, the data block 620 including the raw key data 625 (or just the raw key data 625) may be transmitted as a quantum signal in a quantum channel. Conversely, the bandwidths of the optical signal that is used for the transmission of data block(s) 620, including the raw key data 625, may correspond to a/the quantum channel.

In the following, the bandwidths of the optical signal that is used for the transmission of the control information is interchangeably denoted as key-id channel(s), synchronization channel(s), or also service channel(s). In general, such a synchronization channel is an additional (in addition to the quantum channel and the channel(s) of the pilot tone(s)), non secret, frequency-multiplexed, discrete-modulated channel in the bandwidth of Bob’s detector(s). More specifically, a service channel(s) is a discrete-modulated service channel(s) separated in frequency from the quantum channel(s) (and from the pilot signal). It is further noted that, in general, a synchronization channel may use the same or a different bandwidth as the quantum channel(s). The term“service channel” emphasizes that the channel may carry some signaling information. The term“key-id channel” emphasizes that the service channel specifically carries a key-id. The key-id is a sequence number which identifies a chunk with the raw key data also referred to as data block. The term“synchronization channel” emphasizes that the channel is coded/modulated in such a way that the resulting signal has some synchronization supporting properties. For example, the synchronization channel may be scrambled with (or formed by) a PN sequence having advantageous synchronization properties such as low (ideally zero) autocorrelation at least in a predefined offset range. This enables the transmitter to identify the synchronization channel even within a noisy signal. More specifically, the flexible, multi-purpose synchronization channel may be used for frame synchronization, but it can also be used to extract synchronization information for the recovery of carrier clock frequency and phase and sampling clock frequency and phase as well as transmitting additional service information.

It is noted that, in general, it is possible to have multiple quantum channels and/or synchronization channels, which are frequency-multiplexed. In this case, each channel may use, for the transmission of its signal(s) (e.g., a respective control information 610 or a respective data block 620), a different bandwidth within the same time domain resources. Correspondingly, in general, multiplexed signals may include a plurality of data blocks 620 and/or a plurality of control information 610. Henceforth, for sake of simplicity, usually only one quantum channel and one synchronization channel is mentioned. However, if not explicitly stated otherwise, there may also be multiple quantum channels and/or service channels, which function similarly to the ones described.

Advantageously, quantum and synchronization channel (e.g., the corresponding data and signals) are processed (in particular, generated) with the same hardware at the transmit side (laser(s), DAC(s), filter(s), mixer(s), amplifiers(s), modulator(s), etc.) and processed (in particular, detected) with the same hardware at the receiver side (laser(s), filter(s), switch(s), detector(s), mixer(s), amplifier(s), ADC(s), etc.). Furthermore, in some exemplary implementations, the quantum channel and the service channel are jointly processed digitally at the transmitter side as well as the receiver side. The joint generation and detection assures that the errors due to imperfections of the involved clock pairs (lasers, ADC/D AC rate, mixers, etc.) are highly correlated in the quantum channel(s) and the service channel. Due to the non-secretness, the synchronization channel has reduced limitations. In particular, in the service channel, a higher transmit power is possible, the code rate can be set such that close to “perfect” error correction is possible, and discrete modulation may, advantageously, be used.

The data modulated onto the service channel(s) may be used for high granularity frame synchronization, service information, and continuous detection of synchronization. In particular, the signal transmitted in the service channel or even only the structure of the additional, discrete-modulated signal (without carrying any information) can be used to support carrier and sampling clock synchronization or synchronization error compensation. Furthermore, service information for in-time (dynamic) configuration may be transmitted via the service channel.

Fig. 1 further illustrates an exemplary functional structure of the processing circuitry 100. In particular, the processing circuitry embodies a multiplexer 105 which obtains a quantum signal and service channel data (e.g., control information) and multiplexes them for transmission on the optical channel 130. The multiplexing may be performed by some of frequency multiplex approaches such as FDMA or OFDMA or DFT-FDMA or the like. An exemplary multiplexing is described below with reference to Fig. 2.

In general, as illustrated in Fig. 9, there may be multiple (two or more) data blocks carrying raw key data, and there may be multiple respective control information blocks. In particular, Fig. 9 shows a multiplexed signal 900 with N>2 data blocks, labelled 920_#1 to 920_#N, that comprise respective raw key data, labelled 925_#1 to 925_#N. Furthermore, for each data block 920_#i (i=l, 2, ... , N) of a multiplexed signal 900, there is a respective control information (block) 910_#i that is related to the respective data block 920_#i (in short,

“ related control information 910_# ). In particular, for each control information 910_#i, there may be a respective data block 920_#i; and for each data block 920_#i, there may be a respective control information 910_#i (thus, in some embodiments, there may be a one to one correspondence between data blocks and control information blocks).

Advantageously, the starting position of the data block 620 in time domain is arranged in a predefined manner relatively to the control information 610.

For instance, the resources used to transmit a single data block (e.g., to transmit a data block 920_#i) or to transmit just a single raw key data (e.g., raw key data 925_#i) may correspond to a (single) frame. A frame is a resource unit in the time domain, to which data/signal are mapped. Thus, the starting/end position (in time domain) of a data block may correspond to the starting/end position (in time domain) of a data frame (or, in short, may correspond a start/end of a data frame).

Similarly, the resources used to transmit control information (e.g., to transmit a control block 910_#i) may correspond to a (single) frame. Thus, the starting/end position (in time domain) of a control block may correspond to the starting/end position (in time domain) of a control frame (or, in short, may correspond a start/end of a control frame).

It should be noted that, in the present disclosure the terms“ data block”,“ data frame”, and the like are used interchangeably. Likewise, the terms“ control block”,“ control frame”,“ control information block”,“ control information”, and the like are used interchangeably.

In general, the frames in the quantum channel and the synchronization channel may be aligned such that one can derive the frame start of all channels of a multiplexed signal from a single synchronization channel. In particular, the frame start of a data block (data frame) may be derived from a position (in time domain) of the related control information (e.g., from a position of the related control frame, in particular, the starting/end position of the related control information).

In general, the start of a data frame may be positioned in time domain at a predefined (relative) position with respect to the control information, e.g. immediately after the control information, or at the same time as the control information or the like.

For instance, data block 920_#i and related control information 910_#i may be aligned as illustrated in Fig. 9. More specifically, the starting position (omitting“ time domain” from here on) of the control information 910_#i may coincide with the starting position of the data block 920_#i.

However, as illustrated, for instance in Fig. 7, embodiments of the present invention are not limited thereto. In particular, Fig. 7 shows a multiplexed signal 700 in which there is a time offset 750 between the starting position of the control information 710 and the starting position of the data block 720. More specifically, in Fig. 7, the data block 720 is delayed by the time offset 750 with respect to the control information 710. Advantageously, the time offset 750 is known to the receiver (e.g., since the time offset 750 is predetermined or predefined).

It is further noted that, in general, the quantum channel and the synchronization channel do not have to have the same frame size, oversampling rate/bandwidth as long as the frame start in the quantum channel can be derived from the synchronization channel. For instance, the control frames and the data frames may have different lengths in time domain. Furthermore, the signals in the different channels may, for instance, be sampled with the same rate but with different baudrate (bandwidth, sampling rate/over sampling rate). For example, the signal in the quantum signal may be sampled with a sampling rate of 200MHz and a symbol rate of 20MHz (corresponding to a oversampling rate 10), whereas the signal in the service channel may be sampled with a sampling rate of 200MHz and a symbol rate of 10MHz in the

(corresponding to a oversampling rate 20).

For instance, as shown in Fig. 8, a synchronization channel may have only half the bandwidth of the quantum channel and also only half the frame length of the quantum channel. In particular Fig. 8 shows a multiplexed signal 800 in which the data block 820 occupies a bandwidth that is twice as large as the bandwidth used for the control information 810.

Furthermore, in the multiplexed signal 800, the data block 820 has twice the frame length (length in time domain) as the control information 810. The ratio of one half is only exemplary and the present disclosure may work as well with other ratios between the length of the synchronization (service) frame and the data frame.

As also shown in Fig. 8, frequency band of the quantum channel may be located (in frequency) above the frequency band of the service channel. Of course, the present invention is not limited thereto as has already been shown, e.g., in Fig. 6 in which the frequency band of the quantum channel may is located (in frequency) below the frequency band of the service channel.

In particular since the control information can be transmitted with a higher power than the data blocks, it may be easier to determine a position of the control information than a position of the data block (compare Fig. 3, which shows an exemplary spectrum/power allocation of an optical signal according to the present invention including quantum channel,

synchronization channel, and pilot signal). Therefore, the present embodiment may facilitate the detection of the frame start of a data block(s).

Advantageously, the control information 610 includes information 615 (also denoted as frame identifier 615) identifying the data block 620. In particular, advantageously, the information 615 identifying the data block 620 is a sequence number of the data block 620.

In general, control information may include a data part. This data part may include information that can be used to identify the corresponding/related data block (which is that data block to which is the particular control information is related). In the present disclosure, the terms“frame identifier”,“frame index”,“key-id”, and the like are used interchangeably to refer to a frame identifier used for identification of a related data block.

In general, the frame identifier may be an encoded integer representing the frame index for alignment of transmitter and receiver data streams. Said integer may be communicated from a higher layer and may be used to identify the corresponding data block (the (corresponding) data block can be identified from the predefined relation between the position of the data block and the related control information.

For instance, the frame identifier may be a 32bit integer repeated 32 times in both quadrature components.

However, in general, the repetition rate may be smaller or larger, and a code more efficient than a repetition code may be used. In order to increase the encoding efficiency, the coding of the key- id may also be adapted to the physical channel conditions.

In other words, in general, at least one synchronization channel may carry a frame identifier or (frame) index, e.g., a number that changes from frame to frame and, preferably, shall not be reused on a short to medium time scale. Coding and modulating the frame identifier into the service channel may facilitate, for instance, high-granularity frame synchronization. In particular, it may allow receiver and transmitter to align each frame individually and, therefore, guarantees instantaneous, continuous and consistent frame synchronization of the data streams at transmitter and receiver necessary for key extraction. Furthermore, it may facilitate the immediate alignment after communication is started or resumed. Key generation can start as soon as the receiver is locked to (e.g., synchronized with) the transmit laser. It may also allow fast recovery after short term outages or calibration routines and facilitates the implementation of networking functionality like switching of the transmit signal between multiple receivers. Moreover, detection of missing data or frames may be facilitated.

It is noted that the control information may (in addition or exclusively) be used to carry arbitrary service information (such as signaling related to transmission of the service channel, transmission of synchronization signals or pilots, and/or transmission of the quantum signal) or tag the quantum data (raw key data), e.g., in a multi-receiver setup. Amongst others, these may be operational parameters, timing information, indicators for future events, and/or parameters and commands for networking. For example, the transmit signal may be time multiplexed onto multiple fibers reaching different receivers. The additional/service information could then be timing information about the transmit side switching.

Advantageously, the information identifying the data block is scrambled with a first sequence. In particular, advantageously, the first sequence is a predetermined pseudo-noise, PN, sequence.

In general, the frame identifier and/or other data included in the control information may be scrambled with a sequence (a“first sequence”). This sequence may be some sort of pseudo random sequence (or pseudo-noise (PN) sequence), e.g., a Gold-code sequence. Such a sequence may be predefined/predetermined and/or is, advantageously, known to transmitter and receiver. This may be done, for instance, to whiten the transmit signal, which may improve clock recovery and/or may reduce the intermodulation. It is noted that the Gold-code is only an example for a PN sequence. In general, any self-dissimilar sequence (with autocorrelation function close to zero) may be used. There are also several well-known families of orthogonal and quasi-orthogonal codes which also have advantageous cross correlation features (limited cross-correlation within certain range or for the entire sequence). These may be beneficial especially when a plurality of channels are multiplexed in the same time period. Apart from Gold-codes, Hadamard, Kasami, Zadoff-Chu or any other codes may be used.

For instance, when the frame identifier is a 32bit integer repeated 32 times in both quadrature components, the frame identifier may be scrambled with a pseudo-random sequence (1024 QPSK symbols Gold-code sequence) known to transmitter and receiver.

Advantageously, the control information further includes a second predetermined sequence, which is post- or pre-pended (e.g., in time domain, forming respective postamble or respective preamble/header) to the information identifying the data block. Furthermore, advantageously, the data block further includes a third predetermined sequence, which is post- or pre-pended (e.g., in time domain) to the raw key data.

Advantageously, the data block is scrambled with a first sequence; the control information further includes a second predetermined sequence, which is post- or pre-pended (e.g., in time domain) to the information identifying the data block; and the data block further includes a third predetermined sequence, which is post- or pre-pended to the raw key data.

Advantageously, two or more sequences of the first sequence, the second sequence, and the third sequence are identical.

In general, control information block may include a sequence that is post- or pre-pended to the frame identifier; and/or the data block may include a sequence that is post- or pre-pended to the raw key data. Henceforth, these sequences are also referred to as synchronization sequences. It is noted that, in general, any two sequences of the sequence used to scramble the data part (e.g., a frame identifier) of a control block, the sequence post- or pre-pending the related data block, the sequence post- or pre-pending the control information related to the data block may be identical or may be mutually different.

An exemplary implementation of the present embodiment is given in Fig 6. In particular, in the multiplexed signal 600, the frame identifier 615 is pre-pended with the sequence 602, and the raw key data 625 is pre-pended with the sequence 603. In this case, the sequence 602 and the sequence 603 may be referred to as header sequences. The pre-pended/post-pended sequences 602 and 603 may have good synchronization features and serve for frame synchronization, i.e. for finding the start of one or more data and control blocks. It may be advantageous if the pre-pended/post-pended synchronization sequence(s) does/do not carry any information to enable robust frame synchronization. However, the present disclosure is not limited thereto and in some embodiments, the pre-pended/post-pended sequences may also be used to carry data (e.g. by scrambling and/or spreading data symbols).

An alternative implementation of the present embodiment is given in Fig 7. In particular, in the multiplexed signal 700, the frame identifier 615 is post-pended with the sequence 602, and the raw key data 625 is post-pended with the sequence 603.

Alternatively, one of the frame identifier and the raw key data may be post-pended by its respective sequence, and the other of the frame identifier and the raw key data may be pre pended by its respective sequence.

In general, a synchronization sequence may also be split into multiple parts and distributed in the frame, interleaved with the data part. For instance, half of a synchronization sequence may be pre-pended and half of it may be post-pended.

In general, a sequence post- or pre-pending a data block (a“ second sequence”) or raw key data (a“ third sequence”) may be some sort of pseudo-random sequence or pseudo-noise (PN) sequence, e.g., a Gold-code sequence. Such a sequence may be predetermined/predefined and/or is, advantageously, known to transmitter and receiver. Advantageously, it is also predetermined/predefined and/or known to transmitter and receiver whether or not the respective synchronization sequences are post-or pre-pended to raw key data and data part (e.g., frame identifier) of the control information. These sequences may be any PN sequences, such as Hadamard, Kasami or Zadoff-Chu sequence, or any other sequences. In particular, any sequence that is suitable as a“first sequence” (as explained above) may also be suitable as a“ second sequence” and/or a“ third sequence

For example, the control information may comprise 1024 QPSK symbols of a Gold-code sequence, which are known to transmitter and receiver, and a data part of 1024 symbols (e.g., a frame identifier in the form of a 32bit integer repeated 32 times in both quadrature components and, possibly, scrambled). Similarly, for example, a data block may comprise 1024 QPSK symbols of a Gold-code sequence which are known to transmitter and receiver and 1024 symbols of raw key data.

It is noted that such a header sequence (or a post-pended sequence) can be used to identify the beginning of a frame via detection of correlation. More specifically, it may be exploited that PN sequences have, in general, good auto-correlation properties (e.g., a strong peak at zero displacement). Therefore, it is usually easy to determine the position of a PN sequence precisely. In particular, the position of the synchronization sequence of the control information, which may be sent with a higher power than the quantum signal, may be easy to localize (in time domain). This may, in turn, allow to determine the position of the raw key data and/or frame identifier/service information precisely.

For instance, a data frame may be considered to start at a predefined position with respect to the synchronization sequence of the control information, e.g. immediately after said synchronization sequence, or at the same time as the synchronization sequence or the like.

An exemplary description operations performed by a transmitter according to the present embodiment is now given below using Fig. 2 as reference.

For each frame of the quantum signal, an equally sized frame in the key-id/synchronization channel is formed. It may include a pseudo-random training sequence (e.g., 1024 QPSK symbols Gold-code sequence) known to transmitter. For example, the quantum signal may be split into blocks (e.g., 1024 symbols each) and time interleaved with a pseudo-random training sequence (e.g., 1024 QPSK symbols Gold-code sequence) known to transmitter and receiver for synchronization. The training sequence combined with one data block forms a frame.

For instance, a sequence of complex transmit symbols may be received from a higher layer. These symbols might be of any modulation representable with a coherent state (phase space representation) consisting of an X and P (in-phase and quadrature) component. For instance, data in the quantum channel and data synchronization channel(s) may be cut into frames. The frames in the channels are aligned such that one can derive the frame start of all channels from a single synchronization channel.

As shown above in Figure 1, the service channel and the quantum key channel are multiplexed in frequency. Figure 2 illustrates exemplary processing based on frequency division multiplexing (FDM) that may be performed at a transmitter side.

The input to the digital processing are two parallel streams obtained in step 200: o a first stream includes vectors s i with i being an index from 1 to the number of data blocks for carrying the raw key data. Each vector s i has a length M corresponding to the raw key data length. The raw key data here is in general in form of modulation symbols, such as QPSK symbols. In general, the symbols in the stream are taken from a pre-defmed set of modulation points with potentially uneven probability, e.g.

probabilistically-shaped high-order QAM. o a second stream of the key IDs denoted K i. In this example, for each vector s i there is one corresponding scalar identifier K i. The K i may be an integer which can take a predefined number of values. For example, if K_i has 8 bits, 2^L8 = 256 values may be distinguished.

In step 210, the key- id is encoded. After the encoding, the key- id has in this example the same length M as the raw key data. Then, the encoded key-id data is scrambled with a sequence as described above. Scrambling refers to bit/symbol-wise XOR operation between the scrambled data and scrambling sequence. This is expressed by ki = Se(Ki), wherein K i is the key- id and Se denotes the operator for encoding and scrambling ki denotes the resulting encoded and scrambled key data, i.e. the content of the control information to be carried on the service channel.

In step 220, the data block q_i and the control information block k i are formed as follows: q_t = [h^T s ]^T, k_t = [ ^T k_i ^T]^T·

In other words, the raw key data s i is pre-pended with a header sequence, vector h - resulting in data block q_i. In this example, the encoded and scrambled key-id data is also pre-pended with the same sequence, corresponding to the vector h, resulting in control information block k i.

In step 230, the data blocks q_i and the control information blocks k i are joint into a stream corresponding to a quantum channel q and service channel k, respectively:

The two parallel streams of quantum channel q and key-id channel k are individually up- sampled in step 240 (e.g. up-sampling rate of 16) and pulse-shaped with a root-raised-cosine filter (e.g. b = 0.35) in step 250. Both channels are individually up-converted to an intermediate frequency (e.g. -50MHz for the quantum channel and -15.625MHz for the key- id channel in complex representation under the assumption of a 200MS/s sampling clock and a bandwidth of 12.5MHz each). Both channels are individually scaled in 260 so their mean- squared values fulfill the requirements.

Here, in this particular example, the mean-squared value of the key-id channel is tuned to be KMB smaller than the mean-squared value of the pilot tone. The mean-squared value of the quantum channel is set to be 30dB smaller than the mean-squared value of the pilot tone. A high resolution DAC bit width (16bit) at the transmitter side and a high resolution analog-to- digital conversion (ADC) bit width (14bit) at the receiver side allow for combining the strong and weak signals without introducing significant noise. These differences in the mean-squared values will directly translate into power difference in the analog domain. These operations can be performed in time domain or frequency domain. In this example, they are performed in the frequency domain with the overlap-and-save method as explained below.

After the individually scaling both channels in step 260, the two channels are combined in such a way that the start of a frame coincides in both channels (by applying FDM).

Additionally they are superimposed with a much stronger complex exponential function, namely the pilot tone

in step 260 (cf. addition of“1”). In more detail: in step 240, the key-id and quantum data (raw key data) streams are individually brought with a discrete Fourier transformation (size 256, overlap 603/16) to the frequency domain according to j- = Wq. k₎ = Wk

The matrix W is a matrix corresponding to a Fourier transformation. This may be, for example, DFT or FFT. However, the present disclosure is not limited thereto and other basis functions may be used instead. Advantageously, this up-conversion is performed by overlap- and-save fashion, i.e. the Fourier window is applied to the key stream k in an overlapping manner.

In the frequency domain, the key-id and quantum data are up-sampled and pulse-shaped before they are combined in a single frequency domain representation together with the pilot tone. In particular, in step 250, the root-raised cosine (RRC) filter is applied to the data q_f and control information k_f in frequency domain: qf=Hqf, kf=Hkf This results in the respective pulse-shaped digital signal

and kf.

In step 260, the pulse-shaped raw key data and the pulse shaped control information kf weighted by the respective scalars smaller than 1, and a pilot with power 1 is added:

Operator J stands for joining the respective pulse-shaped and scaled raw key data q^ and the pulse shaped and scaled control information k as well as the pilot signal in frequency domain into signal y_f. The scaling corresponds to power scaling which ensures that the quantum signal q^ is scaled down and transmitted with a lower power than the control information kf.

In step 270, the transformation back into time domain is done with a single inverse discrete Fourier transformation (size 4096, overlap 603 symbols). More specifically, the signal y_f is inverse transformed from the frequency domain into the time domain, e.g. by applying an IFFT or IDFT: y = W y_f.

Here, W¹ represents matrix of the inverse transformation, which may be applied - again - in the overlap-and-save manner, corresponding to the FFT.

In step 280, a scaling is performed for the digital to analog convertor (DAC): x[n] = ay[n\

In step 290, the samples x[n] leave the digital part of the processing and are provided to the DAC for analog processing.

A resulting channel allocation obtained after step 290 is shown in Figure 3. As can be seen in Figure 3, the quantum channel carrying the raw key data is separated in frequency domain from the synchronization (service) channel. It is noted that the second pilot that can be seen in Figure 3 results from the receiver side laser and transmit side laser running with a frequency difference of 100MHz. The carrier frequency of the transmit side laser then shows up as another pilot. This is an imperfection caused by not well suppressed DC components in the modulation and flicker noise. Exemplary analog processing steps of the transmitter side are explained below using Fig.

5(d). The above digital domain steps may have been performed as part of the digital processing (DSP) of Fig. 5d:

The transmit hardware depicted in Figure 5(d) operates with a continuous-wave laser 530. As explained above, the pulse shaping was already done in the digital domain with a root-raised- cosine filter. An analog low-pass filter at the output of the digital-to-analog conversion (DAC) suppresses the digital aliasing fragments. The combination of the digital and analog low-pass filters assures that the signal power is concentrated in the bandwidth of the transmission. The analog signal is modulated onto the optical carrier as a single-sideband signal to reduce the complexity at the receiver. The modulator 540 is fed with the laser 530 of, e.g., 1 ldBm output power at 1550nm. As can be seen in Figure 5(d), the output of the modulator 540 is attenuated with a variable attenuator 550. Before the signal leaves the transmitter, it is split with a 20dB coupler 560. The strong arm is almost entirely observed with a power meter 570, while the weak arm is sent to the receiver. With a 30dB stronger pilot-tone power, approximately - 45 dBm can be measured with the power meter, which is well within the region where an accurate measurement is possible.

It is noted that an electrical up-conversion step at the transmitter is also possible before the optical modulation. This requires four DAC signals to feed to up-converters, which then feed the two inputs of the modulator.

It is noted that the present invention is not limited to a particular CV QKD system (e.g., limited to a setup that uses homodyne/intradyne/or heterodyne detection). In particular, while only the setup 5(c)/5(d) are described in detail, the synchronization channel(s) can also be multiplexed and de-multiplexed in setups 5(a) and 5(b), if the (de)multiplexing happens in the digital domain. However, it may be necessary to reduce the bandwidth of the quantum channel has to allow for the multiplexing. In general, the above mentioned transmitter is only exemplary. Further transmitter configurations may be employed as well for further processing the digital signal generated in the digital domain as described above.

Channel allocations: Many combinations of quantum, key-id and pilot tone channel frequency allocations, bandwidths and power ratios are thinkable within the scope of the present disclosure. The allocations should be optimized according to the conditions of the physical channel, inter-channel interference versus bandwidth efficiency trade-offs, and the requirements for the estimation accuracy for the correction of phase noise and sampling clock recovery. E.g., the synchronization channel and/or pilot tone power and at the same time the frequency separation between them and the quantum channel might be increased for scenarios with higher loss compared to scenarios with low loss between transmitter and receiver.

Instead of the above-described FDM approach, it is also possible to utilize OFDM for multiplexing and de-multiplexing the quantum and synchronization channel(s). Some sub channels would be allocated with quantum signal, some sub-channels with synchronization signals and some sub-channels will remain empty to guard the quantum signal. Especially it has to be taken care of that the quantum channel(s) do not suffer from remaining inter-channel interference phase noise even after phase noise compensation. This noise might still be significant, since the synchronization channel(s) is (are) typically allocated with significantly more power. Therefore, the sub-carrier(s) loaded with quantum signals always have to be guarded with empty sub-carriers in the OFDM setup.

Advantageously, the processing circuitry is further configured to generate a plurality of data blocks, wherein each data block includes respective raw key data, in a first subset of the plurality of data blocks, the respective raw key data is post- or pre-pended by a predetermined sequence, and in a second subset of the plurality of data blocks, the respective raw key data is not post- or pre-pended by a predetermined sequence.

In general, it is possible to limit or even drop the training sequence (pilot(s)) in the quantum channel, which would increase the efficiency of the communication (e.g., the spectral efficiency). This may be then compensated for so that the phase relation between the quantum channel and the synchronization channel is calibrated and well known.

In general, the data frames of the quantum channel may be created only from data symbols (they may still match the frame length of the synchronization channel), but a calibration frame may be inserted from time to time in the quantum and/or synchronization channel(s). These calibration frames can be used to estimate the phase relation between the synchronization and quantum channel(s).

An example therefore is shown in Fig. 10. In particular, Fig. 10 shows data frames 1020_#i that include only data symbols (i.e., raw key data 1025_#i). The length of the data frames 1020_#i is the same as the length of the corresponding control frames 1010_#i. Each control frames 1010_#i, include a respective frame identifier 1015_#i (possibly scrambled) related to the corresponding data frame 1020_#i (and/or related to the corresponding raw key data 1025_#i). It is noted that this is only an example and, in other exemplary implementations, other control data may be scrambled and transmitted in this channel. Alternatively, only a predetermined sequence may be transmitted without control data.

Furthermore, in the control channel, there are calibration frames 1022_#i that include only a respective synchronization sequence 1002_#i and are inserted after N (N may be

predefined/predetermined, e.g., according to channel conditions) consecutive control frames 1010_#i. Likewise, in the quantum channel, there are calibration frames 1033_#i that include only a respective synchronization sequence 1003_#i and are inserted after N consecutive data frames 1020_#i.

Furthermore, in the present example, the calibration frames 1022_#i and the calibration frames 1033_#i are aligned (e.g., for the same“i”, the calibration frames 1022_#i starts at the same time as the calibration frames 1033_#i). Likewise, the data frames 1020_#i and control frames 1010_#i are aligned.

Synchronization channel supported CFO (carrier frequency offset) locking and phase noise compensation may be employed at the receiver to correctly recover the phase. A possible implementation is that the initial stream of data is correlated with the root-raised-cosine shape in the frequency domain for a rough carrier frequency offset estimate. This value can be used for a rough down-conversion and filtering before a phase noise estimation is done. The phase noise estimation can be performed by comparing the known training sequence in time domain with the received data stream. This can be supported by other symbols in the synchronization channels, since their modulation format is known. For QPSK, e.g., the fourth power (x⁴) of each symbol (x) can be taken, which rotates any QPSK modulated point into the first quadrant. The phase difference to 1 + i can be measured and used for phase noise

compensation. As soon as the data in the synchronization channel is decoded, this information can be used to update the phase noise estimation by comparing the incoming signal with the now known information. This allows to do phase noise compensation also for samples between symbols, since the pulse shape is also known. This updated information can then be used for phase noise compensation in the quantum channel(s).

Furthermore, comparing estimates from many consecutive frames may reveal slow phase and frequency drifts, which may also be compensated. It is noted that, in some embodiments, all synchronization tasks are done completely with the modulated synchronization channel(s) and, therefore, the pilot tones can/is dropped. In other words, the provision of the service channel may allow to perform all synchronization tasks even without the pilot (which is therefore no longer needed).

Advantageously, the apparatus is configured to operate in a continuous variable quantum key distribution system.

According to another aspect of the present invention, an apparatus 190 is provided for receiving an optical signal, the apparatus 190 being configured to operate in a quantum key distribution system and comprising an optical detector 150 for generating a multiplexed signal from the optical signal; and a processing circuitry 160 configured to generate, by de multiplexing from the multiplexed signal, a data block including raw key data and control information related to the data block, which are multiplexed in frequency domain.

Fig. 1 further illustrates an exemplary high level structure of the processing circuitry 160. In particular, the processing circuitry 160 embodies a de-multiplexer 155 which obtains, from the optical channel 130, a multiplexed signal and de-multiplexes therefrom a quantum signal and service channel data (e.g., control information) for further processing. The de

multiplexing may be performed by some of frequency multiplex approaches such as FDMA or OFDM A or DFT-FDMA or the like.

The receiver side analog processing is described using an example of Figure 5(c). After the signal propagation over the channel, a heterodyne detection. This detection scheme as defined in the communications community is shown in Figure 5(c). The receiver side laser or LO is set to a frequency outside of the signal band. In the detection, this down-converts the signal to an intermediate frequency (here: 50MHz for the quantum channel, 85.375MHz for the key-id channel, 100MHz for the transmit side laser frequency, and 125MHz for the pilot tone). Both signal quadratures are preserved and can be recovered through subsequent electrical and digital down conversion. The cost for this reduced complexity is that the signal is

superimposed with the image band in the optical down-conversion process, effectively doubling the noise bandwidth. The LO has an output power of 7dBm and the signal is detected with a balanced detector 523 where the ratio of the shot noise with respect to the electronic noise exceeds 20dB. It has been confirmed with online measurements of the excess noise that this is the dominant noise source in the system at hand. The amplified output of the balanced detector 523 is DC blocked and demodulated electronically from an intermediate frequency (here 100MHz with a bandwidth of 160MHz and subsequently converted with a sampling rate of 200MS/s into in-phase and quadrature components.

An exemplary de-multiplexing, which is performed as part of the digital signal processing on the receiver side (“DSP” in Fig. 5(c)) is described below with reference to Fig. 4.

Digital signal-processing steps are then performed for correcting in-phase and quadrature imbalance, frequency dependent attenuation, carrier-frequency offset, phase noise, phase offset, and clock skew. Most of the steps are here performed in the frequency domain in a windowed overlap-and-save fashion. They can be seen as the reverse processing with regard to the digital processing described with reference to Figure 2.

In step 400, N samples Jt[n] are obtained from the analog to digital converter.

In step 405, the transformation into frequency domain is done with a discrete Fourier transformation (size 4096, overlap 603). More specifically, the signal x is transformed from the time domain into frequency time domain, e.g. by applying an FFT or DFT:

Xf = Wx.

A feedback may be provided to the analog receiver part and also to the receiver in step 415.

One of the first steps in the digital signal processing, step 410, is to identify the total received mean-squared value and the frequency at which this value is maximal. In frequency domain, the total mean-squared value can be calculated block wise for B FFT blocks d² =

^{~ x}f,b^xf,b - The frequency bin with the largest mean-squared value can be identified according to the largest absolute bin value. In the presence of a pilot tone, the identified bin represents the frequency of the pilot tone. The carrier frequency offset can be calculated by comparing the found bin with the target bin.

The values of the estimated variance and/or carrier frequency offset may be continuously fed back 415 to the analog domain to perform two tasks. First, for coarse frequency locking by frequency modulating the laser to the wanted frequency. Second, to align the polarization of the incoming signal to the polarization of the receiver side laser by maximizing the total mean-squared value. In a setup where both polarizations are detected, the second step becomes obsolete and is replaced by a digital separation of the two polarizations. The coarse frequency locking can be supported by an estimate from the synchronization channels.

Receiver side shot noise estimation and normalization 420 may be performed as the next step: Before the data is processed, it is normalized with the root-mean-squared value of the shot noise. In this exemplary embodiment this is performed in the frequency domain for each frequency bin individually. The normalization values are timely calculated during calibration routines, which are continuously interleaved with data reception (10s of calibration, 10s of reception in a loop implemented with optical switches):

^Xf = D^^Xf

Here, matrix D is a diagonal matrix with the root-mean-squared shot-noise estimates per bin on its diagonal.

After the normalization, in step 425, the channels are separated, i.e. demultiplexed in the frequency domain. The result is separated quantum channel q_k, raw key data channel k_f and pilot channel p_f.

Then the receiver side phase noise estimation and compensation may be performed. The pilot tone p_f, which typically has a high SNR as it has a higher power than the quantum signal, is filtered out S430 with a Wiener filter that is continuously adapted according to the estimated PSD (power spectra density) around the pilot tone frequency:

Pf=H_ppf

In time domain, i.e. after performing the IFFT of the corresponding raw data key channel, service channel and pilot signals in step 435, the filtered pilot tone is compared to an ideal pilot tone. The found error is used as phase noise estimate as is shown in step 440, which is then used to compensate, in step 445, the phase noise in the quantum and synchronization channel(s). After this step, all recoverable energy should be in a well-defined frequency range for each channel (unless there are large sampling clock frequency differences). The phase noise estimation can be supported by an estimate from the synchronization channels.

In step 450, the raw key data signal and the service channel signal are transformed back into frequency domain: q_f = Wq, k_f = Wk Then, matched RRC (root-raised-cosine, advantageously corresponding to the RRC applied at the transmitter) filter is applied to the frequency domain signal in step 455: q_f=Hq_f, k_f=Hk_f

In step 460, the sampling clock phase estimation is performed based on the synchronization signal received. In particular, the service channel (sequence used to scramble the coded key- id, or in general the control data) may be advantageously used for this purpose as it is multiplexed within the same time with the raw key data channel. The sampling clock phase compensation is performed in step 465 based on the estimated phase:

In particular, the decoding of the synchronization channel(s) can be done jointly with carrier and sampling clock frequency and phase estimation 460 and correction 465 leading to significantly improved synchronization. The structure of the data modulation can be used for improved estimation and correction (e.g. clock recovery with Godard algorithm). Based on these estimates from the synchronization channel(s), a highly accurate synchronization of carrier and sampling clock frequency and phase in the quantum channel(s) is possible (same clocks). The inter-channel interference from the synchronization signal(s) to the quantum channel(s) can be controlled. This interference depends on the frequency separation of the channels and the power in the synchronization channel(s).

Receiver side clock-skew compensation may also be performed. The key-id (synchronization) channel at the receiver is down-converted to the base band and filtered with a matched root- raised-cosine filter ( b = 0.35). The clocks for digital-to-analog conversion at the transmitter and analog-to-digital conversion at the receiver need to be aligned in frequency and phase for maximum performance. A delay or phase between these two clocks is a phase ramp in frequency domain. Here, this delay may be estimated with the Godard algorithm. After the matched filtering, the key-id channel is shaped with a raised-cosine. By mixing both raised- cosine tails of the detected synchronization channel, the fractional delay between the two clocks can be identified in step 460. This delay can be compensated by multiplying the frequency domain representation with a phase ramp compensating this delay in step 465. The delay used for compensation is a low-pass filtered version of the estimated delays from consecutive blocks of data. Since the quantum channel is processed with the same clocks and both channels are only separated by tens of megahertz and, therefore, do not suffer from chromatic dispersion, the delay in the quantum channel is the same as the delay in the key- id channel. The fractional delay in the quantum channel can be compensated with the delay estimated in the key-id channel.

Receiver side frame synchronization 475 and phase offset compensation is then performed. The key-id (synchronization) channel received is correlated with the known training sequence with which the key-id channel was scrambled at the transmitter to identify the frame start and find the remaining phase offset between the transmitted and received data. If a previous frame start is known, it is sufficient to correlate the training sequence with the part of the data where the next training sequence is expected, check for continuous locking, and calculate the phase offset. The phase offset used for compensation is a low-pass filtered version of the estimated phase offsets from consecutive blocks of data. Slow phase and frequency drifts between continuous blocks of data can also be estimated and compensated.

In general, frame synchronization 475 may, in addition to or jointly with the correlation of the scrambling sequence, also involve correlation of the pre-/post-pended synchronization sequence in the quantum channel and/or correlation of the pre-/post-pended synchronization sequence in the synchronization channel.

Receiver side frame id decoding and evaluation is then performed in step 480. Now the frame id in the key-id (synchronization) channel can be decoded. Here it needs to be descrambled, the 64 repetitions (in this example) are super imposed (in general, the key-id is decoded), and a majority decision for the individual bits is taken to recover the integer representing the frame. At this point it can be checked that the frame id follows a given pattern, e.g., it is a growing number. A missing frame id or a frame id which is out of order can trigger an exception supporting channel parameter estimation.

The quantum channel is also corrected with the shot noise normalization, the phase noise estimates from the pilot tone, a matched root-raised-cosine filter and the fractional delay estimate from the synchronization channel. The frame start in the quantum channel is derived from the synchronization channel, but the remaining phase offset is estimated from the training sequence in the quantum channel. The reoccurrence of the training sequence in the quantum channel might be reduced significantly since the phase offset can also be derived from the synchronization channel. The recovered symbols are handed over to the post- processing stage together with the key- id identifying the block of data.

The electrical down-conversion from the intermediate frequency at the receiver might be omitted. As a consequence, only one real valued signal at the sampling rate is available at the receiver. The quantum and synchronization channel(s) and the pilot tone have to fit into the available bandwidth.

Figure 11 is a block diagram illustrating the exemplary structure of a transmitter according an embodiment and indicates how a frame including a quantum band and a service band is processed by the transmitter. In particular, in the example shown in figure 11 , the training sequence in the quantum band (channel) consists of 1024 QPSK symbols, and the training sequence in the service band (channel) also consists of 1024 QPSK symbols. These lengths are only exemplary and may in general have a different value (not even limited to powers of two) and the quantum band training sequence may also differ from the service band training sequence by length and/or modulation order. Furthermore, as described above, quantum band includes quantum signal - here in Gaussian modulation and service band includes a service information which in this example is an individual frame number.

The service information may be further encoded (including forward error detection and/or correction code), modulated (e.g. into BPSK, QPSK, 16QAM or other modulation order or modulation symbols), and scrambled by a PN sequence which is performed in the coding block. Scrambling in the coding block may apply the same sequence as one of the training sequences or a different one. The encoding may be a simple repetition code, a CRC or a more efficient block codes or other codes. The modulation may also include scaling. The training sequences and the quantum signal are also scaled in this example in the respective scaler blocks denoted as“scale”. The scaling is a power scaling which sets the relative power between the training sequences, service information and the quantum signal. In particular, the quantum signal power may be lower than the service band power. The training sequence power may be equal to or larger than the service band power. The quantum signal is then converted from a serial stream to a parallel stream of 1024 symbols (denoted as“S/P 1024” block). In this example, the training sequences, the service information after scrambling and the quantum signal have the same length of 1024 (modulation) symbols.

Then, the 2048 modulation symbols of the quantum band (including training sequence and quantum signal) as well as the 2048 modulation symbols of the service band (including training sequence and service information) are respectively serialized in the blocks denoted as “P/S”. Both the quantum band and the service band then undergo (in parallel as shown in Figure 11 , or possibly in series) a chain of operations including transformation into Fourier (frequency) domain, up-sampling and RRC. The chain includes the Fourier transformation which, in this example, is performed using a 256 (2^L8) Fast-Fourier Transformation (FFT) block preceded by a serial to parallel conversion block (denoted as“S/P”) and an overlap part which forms from the serial quantum band (or service band) stream portions of 256 including a certain overlap, i.e. symbols belonging to two consecutive portions of 256 symbols. In this example, the number of overlapped symbols per output 4096 symbols is 603 symbols which is not an integer number of symbols per 256 symbols and thus, the overlap in some of the 256-symbol portions differ. This configuration corresponds to the configuration described above with reference to the flow diagrams. It is noted that the numbers such as size of the portions, overlap and FFT size are only exemplary and that they may be selected in another manner. The transformation implementation is not necessarily FFT, it may be DFT or the like.

After the transformation, the transformed signal is up-sampled by 2 and pulse shaping is performed in the“RRC and phase tracking” block. Each of the quantum band and the service band outputs thus 512 frequency domain samples, which are combined into a frequency- multiplexed, zero-padded array of 4096 frequency domain samples which are then inverse transformed. Here by the block“2^Am IFFT” where m = n+4 = 12 and thus the IFFT has the size of the 4096 symbols, the IFFT has 603 overlap samples. There may be, in addition, a pilot tone band, in which a pilot signal is transmitted. After the IFFT, the signal in the time domain is serialized again in the block“P/S” and converted from digital to analogue domain by the digital to analog converter (DAC). Then, the front end transmission processing is performed, which may include gain control (amplification / attenuation) and carrier modulation.

The above mentioned processing chain or its parts may be implemented by processing circuitry including or corresponding to a digital signal processor, FPGA, ASIC or the like, with the corresponding programming/design.

Figures 12 and 13 illustrate the corresponding exemplary receiver implementation. The received analog signal is converted to the digital domain by an analog to digital converter (ADC) and parallelized (corresponding to the 4096 time domain samples of the frequency domain representation) in the block“S/P” in an overlap and save fashion. The inverse transform 2^Am FFT transforms the time domain samples into the frequency domain, in which the noise variance and carrier frequency offset estimation takes place and may also provide feedback to the analog (front end) part.

Shot noise normalization block then normalizes the signal by the estimated (may be a fixed or variable) shot noise. The pilot tone band is then prepared to perform phase-noise estimation. This is performed by Wiener filter. However, it noted that the estimation may be performed according to any of the known estimation methods.

All three bands namely the quantum band, service band and pilot tone band signals are than back-transformed with an 2^L(h+1) large IFFT to the time domain again. It is noted, that in general, it is possible that there are multiple quantum, service, and/or pilot tone bands, respectively. The term“n+1” is the consequence of an intermediate up-sampling ratio of 2. In the time domain then, phase noise estimation and compensation is performed. This phase noise estimation may be based only on the pilot detection, i.e. on the difference between the known (transmitted) pilot and the received pilot. The Wiener filter which may be used to estimate the phase noise may be adapted according to the power density spectra received in the pilot band. However, in addition to the classical pilot based estimation, in an exemplary embodiment the phase noise estimation is supported by the synchronization channel based estimation. It may be performed by comparing a known sequence in time domain with the received data stream. In other words, after the data in the service channel is decoded (or predicted for the next frame), the ideal transmit signal in the service channel can be reconstructed. The difference between the ideal reconstructed signal and the received signal in the service channel can be used as an error estimate for the quantum channel. The error estimation may then be performed similarly as in the pilot based estimation. It is noted that the training and/or synchronization sequences may be used for phase noise estimation and the pilot channel do not have to be present at all in some embodiments.

After compensating the quantum band and service band signals based on the estimated phase noise, the frequency selective equalization is then again performed in the frequency domain into which the quantum band and the service band are transformed again in the respective blocks“2^L(h+1) FFT”. RRC processing and fractional delay estimation and compensation is performed in different bands. In particular, the estimation is performed in the service channel and correction in both service and quantum channel. Then the signals are down-sampled by 2. Figure 13 shows continuation of Figure 12. The down-sampling by two in Figure 13 illustrates the same down-sampling by 2 shown in Figure 12. The resulting 256 samples per quantum band and service band respectively are transformed back into the time domain (with dropped overlapping) and the training-based frame synchronization is performed. This synchronization aims at finding the frame start which may be performed by correlating the received data with the training sequence. The implementation efficiency may be improved if the correlation is performed within a smaller correlation window, which may be achieved, for example by predicting a frame start based on previously detected frames.

It is noted that the above exemplary embodiments were described based on QKD-CV.

However, the concepts described in the present disclosure may also be applied to QKD-DV in principle. After frame synchronization the training sequences, quantum signal and frame id data (service information) are parallelized (“S/P” blocks) and the quantum channel as well as the service channel are equalized based on the channel estimation performed by using the respective training sequences. Typically only the phase is corrected in the quantum channel. It is possible to monitoring phase and/or frequency drifts in the service channel and thereon estimate the current phase error also in the quantum channel more precisely. The quantum channel is then further processed by the applied protocol (including, e.g. the sifting, reconciliation, privacy amplification or the like) while the service channel is descrambled, demodulated, and decoded to obtain the carried information, e.g. the frame number.

The above exemplary processing circuitry structure and functionality is only exemplary. In general, the“P/S” and“S/P” blocks which serialize or parallelize data are only shown for completeness. However, the processing may be also organized in a different manner.

Furthermore, according to yet another aspect of the present invention, a method for receiving an optical signal is provided. The method is for quantum key distribution and includes the step of generating a multiplexed signal from the optical signal, and the step of generating, by de multiplexing from the multiplexed signal, a data block including raw key data and control information related to the data block, which are multiplexed in frequency domain.

Furthermore, according to yet another aspect of the present invention a method for

transmitting an optical signal is provided. The method is for quantum key distribution and includes the step of generating a data block including raw key data, control information related to the data block, and, by multiplexing the data block and the control information in frequency domain, a multiplexed signal. The method also includes the step of transmitting the multiplexed signal within the optical signal.

The above mentioned methods may be performed by electric circuitry with any hardware structure. For example, the processing may be performed by a single DSP with the appropriate software implementing the above methods. Alternatively, a combination of an ASIC, an FPGA and/or a DSP may be used. Other configurations are possible and the present disclosure is not limited to any particular structure.

Claims

1. An apparatus for receiving an optical signal, the apparatus being configured to operate in a quantum key distribution system and comprising: an optical detector (150) for generating a multiplexed signal (600) from the optical signal; and a processing circuitry (160) configured to generate, by de-multiplexing from the multiplexed signal (600), a data block (620) including raw key data (625) and control information (610) related to the data block (620), which are multiplexed in frequency domain.

2. An apparatus for transmitting an optical signal, the apparatus being configured to operate in a quantum key distribution system and comprising: a processing circuitry (100) configured to generate a data block (620) including raw key data (625), control information (610) related to the data block (620), and, by multiplexing the data block (620) and the control information (610) in frequency domain, a multiplexed signal (600); and an optical transmitter (110) for transmitting the multiplexed signal (600) within the optical signal.

3. The apparatus according to any of the claims 1 to 2, wherein a starting position of the data block (620) in time domain is arranged in a predefined manner relatively to the control information (610).

4. The apparatus according to claim 1 to 3, wherein the control information (610) includes information (615) identifying the data block (620).

5. The apparatus according to claim 4, wherein the information (615) identifying the data block (620) is a sequence number of the data block (620).

6. The apparatus according to claim 4 or 5, wherein the information (615) identifying the data block (620) is scrambled with a first sequence.

7. The apparatus according to claim 6, wherein the first sequence is a predetermined pseudo-noise, PN, sequence.

8. The apparatus according to any of the claims 1 to 7, wherein the control information (610) further includes a second predetermined sequence (602), which is post- or pre-pended to the information (615) identifying the data block (620).

9. The apparatus according to any of the claims 1 to 8, wherein the data block (620) further includes a third predetermined sequence (603), which is post- or pre-pended to the raw key data (625).

10. The apparatus according to claim 4 or 5, wherein the information identifying the data block is scrambled with a first sequence; the control information (610) further includes a second predetermined sequence (602), which is post- or pre-pended to the information (615) identifying the data block (620); and the data block (620) further includes a third predetermined sequence (603), which is post- or pre-pended to the raw key data (625).

11. The apparatus according to claim 10, wherein two or more sequences of the first sequence, the second predetermined sequence (602), and the third predetermined sequence (603) are identical.

12. The apparatus according to any of the claims 1 to 11, wherein the processing circuitry is further configured to generate a plurality of data blocks (1020_#i), wherein each data block (1020_#i) includes respective raw key data (1025_#i), in a first subset of the plurality of data blocks(1020_#i), the respective raw key data (1025_#i) is post- or pre-pended by a predetermined sequence (1003_i), and in a second subset of the plurality of data blocks (1020_#i), the respective raw key data is not post- or pre-pended by a predetermined sequence (1003_i).

13. The apparatus according to any of the claims 1 to 12, wherein the apparatus is further configured to operate in a continuous variable quantum key distribution system.

14. A method for receiving an optical signal, the method being for quantum key distribution and including the steps of: generating a multiplexed signal (600) from the optical signal; and generating, by de-multiplexing from the multiplexed signal (600), a data block (620) including raw key data (625) and control information (610) related to the data block (620), which are multiplexed in frequency domain.

15. A method for transmitting an optical signal, the method being for quantum key distribution and including the steps of: generating a data block (620) including raw key data (625), control information (610) related to the data block (620), and, by multiplexing the data block (620) and the control information (610) in frequency domain, a multiplexed signal (600); and transmitting the multiplexed signal (600) within the optical signal.

16. A computer program product including program code for performing the method according to claim 14 or 15, when the program code is run by a processor.