Measurement-device-independent quantum key distribution for nonstandalone networks

Guan-Jie Fan-Yuan; Feng-Yu Lu; Shuang Wang; Zhen-Qiang Yin; De-Yong He; Zheng Zhou; Jun Teng; Wei Chen; Guang-Can Guo; Zheng-Fu Han

doi:10.1364/PRJ.428309

Abstract

Untrusted node networks initially implemented by measurement-device-independent quantum key distribution (MDI-QKD) protocol are a crucial step on the roadmap of the quantum Internet. Considering extensive QKD implementations of trusted node networks, a workable upgrading tactic of existing networks toward MDI networks needs to be explicit. Here, referring to the nonstandalone (NSA) network of 5G, we propose an NSA-MDI scheme as an evolutionary selection for existing phase-encoding BB84 networks. Our solution can upgrade the BB84 networks and terminals that employ various phase-encoding schemes to immediately support MDI without hardware changes. This cost-effective upgrade effectively promotes the deployment of MDI networks as a step of untrusted node networks while taking full advantage of existing networks. In addition, the diversified demands on security and bandwidth are satisfied, and network survivability is improved.

1. INTRODUCTION

Quantum key distribution (QKD) [1 –3] can share a private key securely between two authorized parties, Alice and Bob. This private key can establish unconditional secure communication combined with a one-time pad [4]. The security of QKD relies on the principles of quantum physics, with any eavesdropping on a quantum channel being detected inevitably by extra signal disturbance [5 –8]. Compared with classical cryptography, the security of QKD is independent of computation complexity. Therefore, QKD is counted among the solutions to secure communication in the quantum age.

For large-scale applications, networking is imperative for QKD, which can provide secure commutation service for numerous users [9,10]. In recent years, many influential networks [11 –19] have been conducted, including mature demonstrations for real-life applications. These works mark the achievement of the trusted node network and take the initial step toward the quantum Internet [20].

The trusted node network cannot provide end-to-end QKD services without the credibility of intermediary nodes. This limitation lowers the survivability of networks, which means the ability of the network to provide secure key-distribution service if there are trusted nodes is controlled by eavesdroppers. In trusted-node-based networks, if the loss of credibility happens to one node due to attacks, large parts of the network may be paralyzed (full connection is a solution but with high cost and low feasibility; Ref. [21] provides a practical and detailed analysis for the scenario). For example, an untrusted central node can deprive the star topology of function, and losing credibility of a relay node can split a line-topology network, where the star topology and the link topology are normally used to construct a quantum network [10,19] in metropolitan and wide areas, respectively. Therefore, upgrading such networks to untrusted-node-based networks for moving away from dependence on node credibility is necessary.

Sign up for Photonics Research TOC. Get the latest issue of Photonics Research delivered right to you！Sign up now

Any schemes that support an untrusted node can be theoretically employed in untrusted-node-based networks, such as quantum repeaters [22 –25], measurement-device-independent QKD (MDI-QKD) [26 –28], twin-field QKD (TF-QKD) [29 –32], and device-independent QKD (DI-QKD) [33 –37]. Compared with other schemes, MDI-QKD, the scheme that can completely remove all detector side-channel attacks and whose measurement unit can be regarded as an untrusted node, is the most mature and easiest one to implement [38 –41] and initially shows the capability of networking [42]. Therefore, MDI-QKD is an immediate object of network upgrade [20].

Although upgrading to MDI networks can improve survivability, the cost and demand must be emphasized in network upgrades. On the cost side, the main protocol in existing networks is the BB84 protocol; however, it is incompatible with the MDI protocol. One major difference is the measurement mechanism. MDI-QKD requires a Bell state measurement (BSM) in the measurement unit, but BB84 does not need that [43]. Therefore, the measurement unit of the BB84 protocol cannot be used in the MDI protocol. The other difference is in the encoder of the transmitter. The bases of state preparation in QKD are X, Y, and Z, which correspond to Pauli matrices $σ_{x}$ , $σ_{y}$ , and $σ_{z}$ , respectively. Consider the example of phase encoding in fiber-based QKD. In the BB84 protocol, all three bases can reach a low error rate, and any two of them can be used. However, in MDI protocol, only Z basis (time-bin basis) can reach a low error rate, two employed bases must contain the Z basis, and the other basis is X or Y. Although the difference in encoder can be harmonized by constraining the basis choice of BB84 protocol or postselection technique [44], the minimum requirement of the upgrade is to replace all QKD receivers, which is still a significant expenditure for device manufacturers and users. On the demand side, the requirements of two types of communication channels, control channel and data channel, in security and bandwidth are different. The control channel, which transfers command messages between devices, requires high security but low bandwidth. By contrast, the data channel requires high bandwidth but a relatively low security level. These two channel scenarios are suitable for MDI-QKD and BB84 protocols, respectively, because the former is more secure than the latter but with a lower secure key rate [45]. Therefore, considering the cost and demand, the hasty upgrade of existing networks is inadvisable, and a workable road map toward MDI networks needs to be explicit.

A viable solution to the cost and demand issues is the nonstandalone (NSA) network in 5G [46]. In the deployment of 5G, the devices of 4G also face the problem of being replaced. In addition, the few user devices that support 5G mode require a balance between the progress of the deployment and the demand. The NSA architecture is a step-by-step transition from 4G to 5G. By changing parts of devices, the 5G technology can be initially supported in 4G networks. As a result, the 5G network will be established completely as all old devices are replaced. Contrasted with the standalone (SA) network, the NSA upgrades 4G networks while taking full advantage of them, which is the most economical evolution path. Therefore, the NSA can be transplanted to QKD networks.

The central feature of the NSA is supporting a new protocol on almost-old facilities. Regardless of the NSA, the presses have reported supporting MDI on polarization-encoding SARG04 [47] and BB84 [48] and demonstrating the polarization-encoding reconfigurable network of QKD and quantum digital signature (QDS) [49]. However, the solution for phase-encoding systems is still missing, which is probably more relevant because the phase encoding has an advantage of tolerance to channel disturbance, which helps it to be widely deployed in established QKD networks [11 –14,16 –18] and become a mature commercialized solution. Therefore, the issues of the upgrade are imperative to phase-encoding networks, and the NSA can be harnessed in the upgrade toward MDI networks.

Here we propose an NSA-MDI scheme as the evolution of existing phase-encoding BB84 networks which harmonizes BB84 and MDI protocols in a single system. In our design, the MDI protocol can be implemented based on existing phase-encoding BB84 networks with few hardware changes. The barrier to the deployment of MDI networks is lowered, and the maximum utilization of existing networks shows the cost-effective side of this design. In addition, the supportability of MDI and BB84 protocols not only enables the utilization of the high key rate of BB84 and the high practical security of MDI in a single network for various application scenarios but protects existing trusted-node-based BB84 networks from paralysis when the credibility of some nodes is lost. Such advantages over cost and demand benefit the manufacturers, the service providers, and the users, and then promote the deployment of MDI networks.

To achieve that, the incompatibilities of encoding and measurement between MDI and BB84 protocols must be removed. Here we redesign the optical structure of the BSM unit in MDI protocol by introducing the same structure as original BB84 systems, which is not limited to a specific realization of phase encoding. In this paper, an asymmetric Mach–Zehnder (MZ) structure [50 –52] and an asymmetric Faraday–Michelson (FM) structure [18,53,54] are adopted as an example shown in the Protocol section and the Experimental System section, respectively. The new BSM of the MDI protocol is identical to the decoder of the BB84 protocol. Only a polarization controller is added to realize polarization indistinguishability for MDI protocol if it does not exist in the BB84 system using, for example, FM structures. Therefore, our evolution path can offer existing BB84 networks the capacity of MDI protocol with little hardware cost. In addition, the theoretical error rate of X basis can be low in our scheme (detailed theoretical proof is shown in Appendix A), which avoids the need for optical switch [55] or phase-postselection techniques [44]. To show the superiority of our evolution path, we experimentally demonstrate the BB84 protocol between Alice and Charlie, Bob and Charlie, and the MDI protocol between Alice and Bob, respectively. The experimental results are shown in the Experimental Results section. A summary is provided in the Discussion section.

2. PROTOCOL

Our MDI-QKD system is based on phase encoding and is schematically shown in Fig. 1. Structurally, an asymmetric Mach–Zehnder interferometer (AMZI) is placed on Charlie to harmonize the MDI protocol with the BB84 protocol. This additional structure helps him not only communicate with Alice and Bob as a legal user using BB84 protocol, respectively, but also play the untrusted relay of MDI-QKD between Alice and Bob. It also can reduce the theoretical error rate of the X basis in phase-encoding decoy-state MDI-QKD, which avoids extra payments of fast optical switch and phase-postselection techniques that the previous phase-encoding MDI-QKD schemes are needed to realize a phase shift compensation or a conversion from phase information to polarization information in Ref. [55] and reduce the error rate in the decoy-state protocols in Ref. [44], respectively.

Schematic diagram of the nonstandalone MDI protocol. PM, phase modulator; Laser, pulsed weak-coherent source; BS, beam splitter; SPD, single-photon detector.

Figure 1.Schematic diagram of the nonstandalone MDI protocol. PM, phase modulator; Laser, pulsed weak-coherent source; BS, beam splitter; SPD, single-photon detector.

In our system, the basis is chosen from $ℬ = {X, Y}$ . The X basis consists of $| + ⟩ = \frac{1}{\sqrt{2}} (s + | l ⟩)$ and $| - ⟩ = \frac{1}{\sqrt{2}} (| s ⟩ - | l ⟩)$ , and the Y basis consists of $| + i ⟩ = \frac{1}{\sqrt{2}} (| s ⟩ + i | l ⟩)$ and $| - i ⟩ = \frac{1}{\sqrt{2}} (| s ⟩ - i | l ⟩)$ , where $| s ⟩$ and $| l ⟩$ represent the time-bin states traveling along the short and long arm of AMZI, respectively. In addition, the three-intensity-decoy-state schemes [56,57] are adopted in both BB84 and MDI protocols. Specifically, the intensity of each laser pulse is randomly chosen from $I = {μ, ν, ω}$ , and the intensities satisfy $μ > ν + ω$ and $ν > ω \geq 0$ . We use $P_{ι}^{β}$ to denote the probability that a laser pulse is prepared at a basis of $β \in ℬ$ and an intensity of $ι \in I$ , respectively. For each instance of protocols, the intensities, $I$ , and the probabilities, $P_{ι}^{β}$ , are optimized for the maximum secure key rate.

A. MDI

For the MDI protocol, Alice and Bob randomly prepare their quantum state on bases $β_{a}$ and $β_{b}$ , respectively. Each inceptive pulse is divided into two adjacent pulses by their AMZIs. A relative phase is introduced by the phase modulator of AMZI according to the selected basis and key. The relations of the modulated phase to basis and key are listed in Table 1, where $θ_{a}$ and $θ_{b}$ represent the relative phase modulated by Alice and Bob, respectively. In addition, the intensities of their laser pulses are modulated as $ι_{a}$ and $ι_{b}$ , respectively, and the corresponding probabilities are $P_{ι_{a}}^{β_{a}}$ and $P_{ι_{a}}^{β_{a}}$ , respectively.Table 1.

Code Table in MDI Protocol

	$\| + ⟩$	$\| - ⟩$	$\| + i ⟩$	$\| - i ⟩$
$θ_{a}$	0	$π$	$\frac{π}{2}$	$\frac{3 π}{2}$
$θ_{b}$	0	$π$	$\frac{π}{2}$	$\frac{3 π}{2}$

Then Alice and Bob send their pulses to Charlie for BSM. For each pair of quantum states, unlike the original, the Charlie’s AMZI further divides the incident pulses into three states of time stamps, $| s s ⟩$ , $| s l (l s) ⟩$ , and $| l l ⟩$ . Charlie detects the middle one with two single-photon detectors (SPDs) because it contains the phase information of Alice and Bob. After basis sifting, the coincidence counting is retained, which represents a successful BSM, and other events are discarded. Here we briefly show the probabilities of valid responses, $Q$ , on the conditions that $θ_{a} = θ_{b}$ and $θ_{a} \neq θ_{b}$ and the error rates, $E$ , $Q_{ι_{a} ι_{b}}^{X} |_{θ_{a} = θ_{b}} = \frac{ι_{a} ι_{b}}{2}, Q_{ι_{a} ι_{b}}^{X} |_{θ_{a} \neq θ_{b}} = 0, E_{ι_{a} ι_{b}}^{X} = \frac{Q^{X} |_{θ_{a} \neq θ_{b}}}{Q^{X} |_{θ_{a} = θ_{b}} + Q^{X} |_{θ_{a} \neq θ_{b}}} = 0, Q_{ι_{a} ι_{b}}^{Y} |_{θ_{a} = θ_{b}} = \frac{{(ι_{a} + ι_{b})}^{2} - 2 ι_{a} ι_{b}}{8}, Q_{ι_{a} ι_{b}}^{Y} |_{θ_{a} \neq θ_{b}} = \frac{{(ι_{a} + ι_{b})}^{2} + 2 ι_{a} ι_{b}}{8}, E_{ι_{a} ι_{b}}^{Y} = \frac{Q^{Y} |_{θ_{a} = θ_{b}}}{Q^{Y} |_{θ_{a} = θ_{b}} + Q^{Y} |_{θ_{a} \neq θ_{b}}} = \frac{ι_{a}^{2} + ι_{b}^{2}}{2 {(ι_{a} + ι_{b})}^{2}} \overset{ι_{a} = ι_{b}}{=} \frac{1}{4} .$ (1)

In these equations, for simplification, the dark-count rate and afterpulse probability of the detector are neglected, the detection efficiency and transmittance are regarded as 100%, and the reference frames of Alice and Bob are aligned, which means $θ_{c} = 0$ . The realistic version is shown in detail in Appendix A. Note that because $Q^{X} |_{θ_{a} \neq θ_{b}} = 0$ , we regard the responses under $θ_{a} = θ_{b}$ and $θ_{a} \neq θ_{b}$ as correct and error responses of the X basis, respectively. On the contrary, for the Y basis, the responses under $θ_{a} \neq θ_{b}$ are regarded as correct responses for a low error rate.

According to Eq. (1), the error rate of the X basis can be very low, which reflects the same characteristic as the Z basis used in the original scheme [39,40,57]. Therefore, our scheme can realize a phase-encoding MDI protocol by only modulating the phase. Neither optical switch nor the phase-postselection technique is required. Such an encoding scheme is also consistent with the phase-encoding BB84 protocol.

Finally, with the data of $Q_{ι_{a} ι_{b}}^{β}$ and $E_{ι_{a} ι_{b}}^{β}$ , the secure key can be extracted from the data when both Alice and Bob encode their bits using signal states ( $μ$ ) on the X basis. The single-photon yield and error yield can be estimated by the rest of the data and engaged in the calculation of the secure key rate [57]. The SKR is given by $R = P_{μ}^{X^{2}} (μ^{2} e^{- 2 μ} Y_{11}^{X, L} (1 - H_{2} (e_{11}^{Y, U})) - Q_{μ_{a} μ_{b}}^{X} f_{e} H_{2} ((E_{μ_{a} μ_{b}}^{X}))),$ (2)where $Y_{11}^{X, L}$ is the lower bound of the yield of single-photon pairs, $e_{11}^{X, U}$ is the upper bound of the phase-flip error rate, $H_{2} (x) = - x \log_{2} (x) - (1 - x) \log_{2} (1 - x)$ is the binary Shannon entropy function, and $f_{e}$ is the error correction efficiency. The calculation of secure key rate is also shown in detail in Appendix B.

B. BB84

For BB84 protocol, both Alice and Bob can communicate with Charlie. Here we provide a detailed description of the protocol by the example of the communication between Alice and Charlie. Alice first prepares her quantum state at a basis $β_{a}$ and an intensity $ι_{a}$ with probabilities $P_{ι_{a}}^{β_{a}}$ . The AMZI also divides each laser pulse into two adjacent pulses. The phase modulators modulate the relative phase, $θ_{a}$ , between them according to the random basis and key Alice selected. The relations of the modulated phase to basis and key are listed in Table 2.Table 2.

Code Table in BB84 Protocol

	$\| + ⟩$	$\| - ⟩$	$\| + i ⟩$	$\| - i ⟩$
$θ_{a} (θ_{b})$	$0$	$π$	$\frac{π}{2}$	$\frac{3 π}{2}$
$θ_{c}$	$0$	$0$	$\frac{π}{2}$	$\frac{π}{2}$

Then Alice sends her quantum state to Charlie. Charlie selects a basis $β_{c}$ with probabilities $P_{c}^{β}$ by modulating the relative phase, $θ_{c}$ . The relation between $θ_{c}$ and basis is also listed in Table 2. After the transmission along Alice’s and Charlie’s AMZIs, the original pulse is split into three parts according to different paths: two short arms ( $| s s ⟩$ ), one short and one long arms ( $| s l (l s) ⟩$ ), or two long arms ( $| l l ⟩$ ). Charlie detects the $| s l (l s) ⟩$ with two SPDs. In all possible outcomes, no detection events are discarded, and the others are counted as valid responses if the bases of Alice and Charlie are identical. Specifically, due to the random assignment of a bit value, the double-click events cause 50% of the error rates [58]. Then, the yield, $Q_{ι}^{β}$ , and error rate, $E_{ι}^{β}$ , of a basis $β$ and an intensity $ι$ can be obtained from statistics.

Finally, with the data of $Q_{ι}^{β}$ and $E_{ι}^{β}$ , the parameters that are required in the calculation of the secure key rate can be estimated and bounded by decoy technology [56]. The secure key rate can be obtained by $R = \frac{1}{N} (s_{0}^{X} + s_{1}^{X} (1 - H_{2} (e_{1, p}^{X})) - λ_{EC} - 6 \log_{2} \frac{21}{ε_{\sec}} - \log_{2} \frac{2}{ε_{cor}}),$ (3)where $s_{0}$ is the number of vacuum events, $s_{1}$ is the number of single-photon events, $e_{1, p}$ is the phase error rate, $N$ is the total number of pulses (sent by Alice or Bob), $H_{2} (x) = - x \log_{2} (x) - (1 - x) \log_{2} (1 - x)$ is the binary Shannon entropy function, $λ_{EC} = n^{β} f_{e} H_{2} (E^{β})$ is the consumption of the information in error correction, $f_{e}$ is the efficiency factor of the error-correction method used, and $ε_{cor}$ and $ε_{\sec}$ are secure parameters. The details of the calculation of the secure key rate are shown in Appendix C.

3. EXPERIMENTAL SYSTEM

The experimental setup is schematically introduced, as shown in Fig. 2. The laser and intensity modulator (IM) 1 of Alice and Bob compose the weak coherent pulse source. The laser is a frequency-locked continuous-wave source whose central wavelength is locked to a molecular absorption line at 1542.38 nm, with a precision of 0.0001 nm, corresponding to an approximately 10 MHz accuracy in the spectrum domain. Then, IM1 chops the continuous-wave laser into pulses with a 2.5 ns temporal width and 40 MHz repetition rate.

Figure 2.Experimental setup for the nonstandalone MDI-QKD system. Alice and Bob can implement phase-encoding MDI-QKD and generate secure key with Charlie via BB84. Laser, frequency-locked lasers; IM1, intensity modulator as pulse generator; IM2, intensity modulator as decoy state generator; BS, beam splitter; PM, phase modulator; PS, phase shifter; FM, Faraday mirror; EVOA, electronic variable optical attenuator; EPC, electronic polarization controller; Circ, circulator; SPD, single-photon detector. For Alice, Bob, and Charlie, the combination of one BS, one phase controller, and two FMs constitutes their own AFMI; the other PM is used for phase randomization.

IM2 and an electronic variable optical attenuator (EVOA) of Alice and Bob modulate the intensity of pulses for decoy-state technology [59 –62]. In our system, the three-intensity decoy-state method is used, and these three intensities are denoted by $μ, ν, ω$ , respectively. IM2 modulates the intensity according to the decoy-state method. The EVOA enables single-photon attenuation of the modulated pulses.

The asymmetric Faraday–Michelson interferometers (AFMIs) replace the AMZIs for robustness and are used for the phase-encoding quantum state preparation. The two arms of an AFMI are called the short arm ( $s$ ) and the long arm ( $l$ ), respectively. Specifically, for each AFMI, each laser pulse is split into two adjacent pulses by the beam splitter (BS). Then the phase modulator (PM) modulates the relative phase between them. Here the modulated relative phases of Alice, Bob, and Charlie are denoted by $θ_{a}$ , $θ_{b}$ , and $θ_{c}$ , respectively, and $θ \in {0, π, π / 2, 3 π / 2}$ , which correspond to $| + ⟩, | - ⟩, | + i ⟩, | - i ⟩$ , respectively. The Faraday mirror (FM) rotates the polarization to compensate for the disturbances caused by birefringence within the asymmetric Faraday–Michelson interferometer (FMI).

Charlie is linked to Alice and Bob by a 10 km long optical fiber, respectively, corresponding to 1.96 dB of loss for each link. Charlie’s electronic polarization controller (EPC) is used to guarantee the polarization indistinguishability of Alice’s and Bob’s states in the MDI protocol. A dual-EPC configuration [42] or polarization scrambling method [57] is more efficient in a field environment, which is a trade-off between performance and cost. After the decoding of Charlie’s FMI, the laser pulses become a superposition of three time stamps state corresponding to the paths of laser pulses. In both BB84 and MDI protocols, the middle pulses are detected for Mach–Zehnder interference and BSM, respectively, by two InGaAs/InP SPDs (Qasky WT-SPD300-LN [63]) with a detection efficiency of 25% and an averaged dark count rate of $7.5 \times 10^{- 6}$ per gate. Moreover, the internal transmittance of Charlie’s optical components is 4.2 dB.

In electronics, all intensity modulators and phase modulators are driven by homemade digital-to-analog converters (DACs). Their modulating voltages are found by scanning the outputs of the DACs. Specifically, for the three AFMIs, the voltages of the modulated relative phases can be obtained by alternately modulating two different codes of the phase modulator while maintaining the voltages of other modulators. Scanning the voltage difference between the two coding modes and recording the counts’ curves of one detector in the two coding modes, the phase difference between the curves is the differential phase to which the differential voltage corresponds. Especially when conducting the MDI protocol, the phase modulator of Charlie can be used as a phase shifter to compensate reference-frame misalignment between Alice and Bob by scanning the voltage to minimize the coincidence counts when they select different phase in the X basis or the same phase in the Y basis. The system is controlled by an FPGA module (NI PCIe-7852R). The FPGA module converts the random information of basis and key to digital signals and then sends them to the DACs for encoding. The FPGA module also implements basis sifting and data collection according to the encoding information and responses of the SPDs.

4. EXPERIMENTAL RESULTS

A. MDI-QKD

We first test the system’s performance by measuring the visibility of Hong–Ou–Mandel (HOM) interference on Charlie’s side. We obtain a visibility of 47.8% over 20 km of single-mode fiber, which approaches the theoretical limit of 50% for weak coherence sources.

For high performance, we optimize the parameters of our system before key distribution using particle swarm optimization (PSO) [64]. Specifically, $μ = 0.284$ , $ν = 0.057$ , $ω = 0$ , $P_{μ}^{X} = 0.466$ , $P_{μ}^{Y} = 0.035$ , $P_{ν}^{X} = 0.076$ , $P_{ν}^{Y} = 0.293$ , $P_{ω} = 0.130$ .

Figure 3.Virtual network topology and link rates of our system.

B. BB84 QKD

Similarly, we test the system’s performance by measuring the visibility of the MZ interferometer. We obtain the visibilities of 99.7% (Alice-Charlie) and 99.5% (Bob-Charlie) over 10 km of single-mode fiber which approaches the theoretical limit of 100% for weak coherence sources.

Also, we first optimize the parameters of BB84 systems. For simplicity, the parameters of the Alice-Charlie system are the same as Bob-Charlie system. Specifically, $μ = 0.538$ , $ν = 0.063$ , $ω = 0.003$ , $P_{μ}^{X} = 0.531$ , $P_{μ}^{Y} = 0.110$ , $P_{ν}^{X} = 209$ , $P_{ν}^{Y} = 0.043$ , $P_{ω}^{X} = 089$ , $P_{ω}^{Y} = 0.018$ .

Then, for a higher practical security, we implement the security analysis in Ref. [56] and three-intensity decoy-state method. The Hoeffding’s inequality [66] is used for our fluctuation analysis. In our calculation of secure key rate, the failure probability of parameter estimation, $ε_{\sec}$ , is equal to $10^{- 9}$ , and the failure probability of error-verification step, $ε_{cor}$ , is equal to $10^{- 15}$ . In addition, the total number of sifted pulse pairs $N_{t} = 1.16 \times 10^{9}$ .

Finally, we obtain the secure key rates of $6.289 \times 10^{- 3}$ (Alice-Charlie) and $6.155 \times 10^{- 3}$ (Bob-Charlie) for transmission distance of 10 km, as shown in Fig. 3. The gains and QBERs of our BB84 QKD systems are shown in Table 4. The method to calculate the secure key rate is shown in Appendix C.Table 4.

Experimental Gains and Quantum Bit Error Rates of Our BB84 QKD Systems

$μ_{a}$	$Q^{X}$	$E^{X}$	$Q^{Y}$	$E^{Y}$
$μ$	$3.10 \times 10^{- 2}$	0.39%	$3.09 \times 10^{- 2}$	0.28%
$ν$	$3.67 \times 10^{- 3}$	0.38%	$3.71 \times 10^{- 3}$	0.29%
$ω$	$1.96 \times 10^{- 4}$	2.66%	$1.93 \times 10^{- 4}$	1.82%
$μ_{b}$	$Q^{X}$	$E^{X}$	$Q^{Y}$	$E^{Y}$
$μ$	$3.13 \times 10^{- 2}$	0.38%	$3.14 \times 10^{- 2}$	0.34%
$ν$	$3.69 \times 10^{- 3}$	0.50%	$3.71 \times 10^{- 3}$	0.48%
$ω$	$1.95 \times 10^{- 4}$	1.89%	$1.98 \times 10^{- 4}$	2.09%

C. Summary

According to the results shown in the section MDI-QKD and section BB84 QKD, we summarize the performance of our system as network link rates in Fig. 3.

In summary, our system implements a compatibility between two distinct protocols: BB84 and MDI. The finite-sized effect is included in our analysis for the requirement of practical security. Moreover, the three-intensity decoy-state method is used. Based on the FM structure, our BB84 subsystems can automatically compensate for the channel polarization disturbance. The secure key rate is about 250 kbps at 10 km of fiber. Also, our new scheme can realize low-error-rate phase-encoding MDI-QKD without the optical switch and phase-postselection techniques. The system complexities of Alice and Bob are reduced, whose sensitivity to cost is higher than Charlie’s. And we obtain 410 bps of secure key rate with a high level of practical security.

5. DISCUSSION

In conclusion, with the help of our new scheme, the incompatibilities between phase-encoding MDI and BB84 protocols are removed. These protocols are integrated into a single system to introduce the advantages of the NSA network so that our system can switch the engaged protocol between them as required and further bridges the gap between existing phase-encoding BB84 networks and MDI networks.

BB84 is one of the most widely used protocols in trusted node networks, and MDI is an ideal candidate for the untrusted-node-based network. These features certainly show an evolution path toward MDI networks. The NSA-MDI scheme can immediately make the phase-encoding BB84 networks support MDI and is not limited to a specific realization of phase encoding. The dependence of networks on node credibility is also lowered; thus the network survivability is improved. Moreover, various requirements of different application scenarios, especially the requirements of high key rate or high security level can be satisfied in one network. More importantly, all these advantages can be obtained without hardware cost, which benefits from the coordination of our scheme.

The network is the final form of QKD application and the first step toward the quantum Internet. During the popularization and upgrade of QKD, the cost needs to be lowered. Our NSA network scheme provides an evolution path that targets both cost and demand. Existing phase-encoding BB84 networks and production lines are fully exploited, and the lower threshold and higher usability can quicken the construction of MDI-QKD networks.

APPENDIX A: MDI-QKD WITH PHASE-RANDOMIZED COHERENT STATES

In this section, we show in detail the evolution of the quantum state in our system according to the checkpoints marked in Fig. 4 .

Figure 4.Schematic diagram of the nonstandalone MDI protocol with checkpoints.

μ_{a}

{| e^{i ϕ_{a}} \sqrt{\frac{μ_{a}}{2}} ⟩}_{a_{l}} {| e^{i (ϕ_{a} + θ_{a})} \sqrt{\frac{μ_{a}}{2}} ⟩}_{a_{s}} {| e^{i ϕ_{b}} \sqrt{\frac{μ_{b}}{2}} ⟩}_{b_{l}} | e^{i (ϕ_{b} + θ_{b})} {\sqrt{\frac{μ_{b}}{2}} ⟩}_{b_{s}},

{| e^{i ϕ_{a}} \sqrt{\frac{μ_{a} η_{a}}{2}} ⟩}_{a_{l}} | e^{i (ϕ_{a} + θ_{a})} {\sqrt{\frac{μ_{a} η_{a}}{2}} ⟩}_{a_{s}} \otimes {| e^{i ϕ_{b}} \sqrt{\frac{μ_{b} η_{b}}{2}} ⟩}_{b_{l}} {| e^{i (ϕ_{b} + θ_{b})} \sqrt{\frac{μ_{b} η_{b}}{2}} ⟩}_{b_{s}},

| e^{i ϕ_{a}} \sqrt{\frac{μ_{a} η_{a}}{2}} - e^{i ϕ_{b}} {\sqrt{\frac{μ_{b} η_{b}}{2}} ⟩}_{l l} \otimes | e^{i (ϕ_{a} + θ_{a} + θ_{c})} \sqrt{\frac{μ_{a} η_{a}}{2}} + {e^{i (ϕ_{b} + θ_{b} + θ_{c})} \sqrt{\frac{μ_{b} η_{b}}{2}} ⟩}_{s s} \otimes | e^{i (ϕ_{a} + θ_{c})} \sqrt{\frac{μ_{a} η_{a}}{2}} + e^{i (ϕ_{b} + θ_{c})} {\sqrt{\frac{μ_{b} η_{b}}{2}} ⟩}_{l s} \otimes | e^{i (ϕ_{a} + θ_{a})} \sqrt{\frac{μ_{a} η_{a}}{2}} - e^{i (ϕ_{b} + θ_{b})} {\sqrt{\frac{μ_{b} η_{b}}{2}} ⟩}_{s l},

{| \frac{\sqrt{μ_{a} η_{a}}}{2 \sqrt{2}} (e^{i (ϕ_{a} + θ_{c})} + e^{i (ϕ_{a} + θ_{a})}) + \frac{\sqrt{μ_{b} η_{b}}}{2 \sqrt{2}} (e^{i (ϕ_{b} + θ_{c})} - e^{i (ϕ_{b} + θ_{b})}) ⟩}_{D_{1}} \otimes {| \frac{\sqrt{μ_{a} η_{a}}}{2 \sqrt{2}} (e^{i (ϕ_{a} + θ_{c})} - e^{i (ϕ_{a} + θ_{a})}) + \frac{\sqrt{μ_{b} η_{b}}}{2 \sqrt{2}} (e^{i (ϕ_{b} + θ_{c})} + e^{i (ϕ_{b} + θ_{b})}) ⟩}_{D_{2}} .

{| ψ_{1} ⟩}_{D_{1}}

D_{1}

A = \frac{\sqrt{μ_{a} η_{a}}}{2}, B = \frac{\sqrt{μ_{b} η_{b}}}{2} .

θ_{c} = 0

Detection Intensities on X and Y Basis

$θ_{a}$	$θ_{b}$	${\| ψ \|}^{2}$
0	0	${\| ψ_{1} \|}^{2} = 2 A^{2}$
		${\| ψ_{2} \|}^{2} = 2 B^{2}$
$π$	$π$	${\| ψ_{1} \|}^{2} = 2 A^{2}$
		${\| ψ_{2} \|}^{2} = 2 B^{2}$
0	$π$	${\| ψ_{1} \|}^{2} = 2 A^{2} + 2 B^{2} + 4 A B \cos (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = 0$
$π$	0	${\| ψ_{1} \|}^{2} = 0$
		${\| ψ_{2} \|}^{2} = 2 A^{2} + 2 B^{2} + 4 A B \cos (ϕ_{a} - ϕ_{b})$
$\frac{π}{2}$	$\frac{π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} - 2 A B \sin (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} + 2 A B \sin (ϕ_{a} - ϕ_{b})$
$\frac{3 π}{2}$	$\frac{3 π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} + 2 A B \sin (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} - 2 A B \sin (ϕ_{a} - ϕ_{b})$
$\frac{π}{2}$	$\frac{3 π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$
$\frac{3 π}{2}$	$\frac{π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$

D_{1}

Q_{μ}^{X} = Q_{μ}^{X} |_{θ_{a} = θ_{b}} + Q_{μ}^{X} |_{θ_{a} \neq θ_{b}}, E_{μ}^{X} Q_{μ}^{X} = e_{d} Q_{μ}^{X} |_{θ_{a} = θ_{b}} + (1 - e_{d}) Q_{μ}^{X} |_{θ_{a} \neq θ_{b}},

Q_{μ}^{Y} |_{θ_{a} = θ_{b}} = \sum_{θ_{a} = θ_{b} \in {\frac{π}{2}, \frac{3 π}{2}}} \frac{1}{4 π^{2}} \int_{0}^{2 π} \int_{0}^{2 π} p_{μ}^{D_{1}} p_{μ}^{D_{2}} d ϕ_{a} d ϕ_{b} = 2 (1 - (1 - Y_{0}) (1 - P_{ap}) (2 - 2 A^{2} - 2 B^{2}) + {(1 - Y_{0})}^{2} {(1 - P_{ap})}^{2} ({(1 - A^{2} - B^{2})}^{2} - 2 A^{2} B^{2})), Q_{μ}^{Y} |_{θ_{a} \neq θ_{b}} = \sum_{θ_{a} \neq θ_{b} \in {\frac{π}{2}, \frac{3 π}{2}}} \frac{1}{4 π^{2}} \int_{0}^{2 π} \int_{0}^{2 π} p_{μ}^{D_{1}} p_{μ}^{D_{2}} d ϕ_{a} d ϕ_{b} = 2 (1 - (1 - Y_{0}) (1 - P_{ap}) (2 - 2 A^{2} - 2 B^{2}) + {(1 - Y_{0})}^{2} {(1 - P_{ap})}^{2} ({(1 - A^{2} - B^{2})}^{2} + 2 A^{2} B^{2})),

θ_{a} \neq θ_{b}

APPENDIX B: CALCULATION OF SECURE KEY RATE FOR MDI-QKD

R

Y_{11}^{X, L} = \frac{1}{(μ_{a} - ω_{a}) (μ_{b} - ω_{b}) (ν_{a} - ω_{a}) (μ_{b} - ω_{b}) (μ_{a} - ω_{a})} \times ((μ_{a}^{2} - ω_{a}^{2}) (μ_{b} - ω_{b}) (Q_{ν_{a} ν_{b}}^{X, L} e^{(ν_{a} + ν_{b})} + Q_{ω_{a} ω_{b}}^{X, L} e^{(ω_{a} + ω_{b})} - Q_{ν_{a} ω_{b}}^{X, U} e^{(ν_{a} + ω_{b})} - Q_{ω_{a} ν_{b}}^{X, U} e^{(ω_{a} + ν_{b})}) - (ν_{a}^{2} - ω_{a}^{2}) (ν_{b} - ω_{b}) (Q_{μ_{a} μ_{b}}^{X, U} e^{(μ_{a} + μ_{b})} + Q_{ω_{a} ω_{b}}^{X, U} e^{(ω_{a} + ω_{b})} - Q_{μ_{a} ω_{b}}^{X, L} e^{(μ_{a} + ω_{b})} - Q_{ω_{a} μ_{b}}^{X, L} e^{(ω_{a} + μ_{b})})),

Q_{α_{a} α_{b}}^{β, U} = Q_{α_{a} α_{b}}^{β} (1 + \frac{f ((ε {/ 2)}^{4} / 16)}{\sqrt{N_{α_{a} α_{b}}^{β} Q_{α_{a} α_{b}}^{β}}}) Q_{α_{a} α_{b}}^{β, L} = Q_{α_{a} α_{b}}^{β} (1 - \frac{f ((ε {/ 2)}^{3 / 2})}{\sqrt{N_{α_{a} α_{b}}^{β} Q_{α_{a} α_{b}}^{β}}}) E Q_{α_{a} α_{b}}^{β, U} = E Q_{α_{a} α_{b}}^{β} (1 + \frac{f ((ε {/ 2)}^{4} / 16)}{\sqrt{N_{α_{a} α_{b}}^{β} E Q_{α_{a} α_{b}}^{β}}}) E Q_{α_{a} α_{b}}^{β, L} = E Q_{α_{a} α_{b}}^{β} (1 - \frac{f ((ε {/ 2)}^{3 / 2})}{\sqrt{N_{α_{a} α_{b}}^{β} E Q_{α_{a} α_{b}}^{β}}}),

The parameters used to calculate the secure key are shown in Table 6 . Table 6.

Parameters of Secure Key Calculation in Our MDI-QKD System

$f_{e}$	$Y_{0}$	$η_{d}$	$ε$	$μ$	$ν$	$ω$
1.16	$7.5 \times 10^{- 6}$	25%	$10^{- 10}$	0.284	0.057	0

APPENDIX C: CALCULATION OF SECURE KEY RATE FOR BB84 QKD

R

μ, ν_{1}, ν_{2}

β

n_{α}^{β, U} = n_{α}^{β} + \sqrt{\frac{n^{β}}{2} \ln \frac{21}{ε_{\sec}}}, n_{α}^{β, L} = n_{α}^{β} - \sqrt{\frac{n^{β}}{2} \ln \frac{21}{ε_{\sec}},} m_{α}^{β, U} = m_{α}^{β} + \sqrt{\frac{m^{β}}{2} \ln \frac{21}{ε_{\sec}},} m_{α}^{β, L} = m_{α}^{β} - \sqrt{\frac{m^{β}}{2} \ln \frac{21}{ε_{\sec}}},

The parameters used in our secure key calculation are shown in Table 7 . Table 7.

Parameters of Secure Key Calculation in Our BB84 QKD System

$f_{e}$	$Y_{0}$	$η_{d}$	$ε_{\sec}$	$ε_{cor}$	$μ$	$ν$	$ω$
1.16	$7.5 \times 10^{- 6}$	25%	$10^{- 9}$	$10^{- 15}$	0.538	0.063	0.003

References

[1] C. H. Bennett, G. Brassard. Quantum cryptography: public key distribution and coin tossing. Conference on Computers, Systems and Signal Processing, 175-179(1984).

[2] A. K. Ekert. Quantum cryptography based on Bell’s theorem. Phys. Rev. Lett., 67, 661-663(1991).

[3] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, P. Wallden. Advances in quantum cryptography. Adv. Opt. Photon., 12, 1012-1236(2020).

[4] G. S. Vernam. Cipher printing telegraph systems: for secret wire and radio telegraphic communications. J. AIEE, 45, 109-115(1926).

[5] N. Gisin, G. Ribordy, W. Tittel, H. Zbinden. Quantum cryptography. Rev. Mod. Phys., 74, 145-195(2002).

[6] D. Gottesman, H.-K. Lo, N. Lutkenhaus, J. Preskill. Security of quantum key distribution with imperfect devices. International Symposium on Information Theory (ISIT), 136(2004).

[7] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, M. Peev. The security of practical quantum key distribution. Rev. Mod. Phys., 81, 1301-1350(2009).

[8] S. Pirandola, R. Laurenza, C. Ottaviani, L. Banchi. Fundamental limits of repeaterless quantum communications. Nat. Commun., 8, 15043(2017).

[9] C. Elliott. Building the quantum network. New J. Phys., 4, 46(2002).

[10] B. Fröhlich, J. F. Dynes, M. Lucamarini, A. W. Sharpe, Z. Yuan, A. J. Shields. A quantum access network. Nature, 501, 69-72(2013).

[11] C. Elliott, A. Colvin, D. Pearson, O. Pikalo, J. Schlafer, H. Yeh. Current status of the DARPA quantum network. Proc. SPIE, 5815, 138-149(2005).

[12] M. Peev, C. Pacher, R. Alléaume, C. Barreiro, J. Bouda, W. Boxleitner, T. Debuisschert, E. Diamanti, M. Dianati, J. F. Dynes, S. Fasel, S. Fossier, M. Fürst, J.-D. Gautier, O. Gay, N. Gisin, P. Grangier, A. Happe, Y. Hasani, M. Hentschel, H. Hübel, G. Humer, T. Länger, M. Legré, R. Lieger, J. Lodewyck, T. Lorünser, N. Lütkenhaus, A. Marhold, T. Matyus, O. Maurhart, L. Monat, S. Nauerth, J.-B. Page, A. Poppe, E. Querasser, G. Ribordy, S. Robyr, L. Salvail, A. W. Sharpe, A. J. Shields, D. Stucki, M. Suda, C. Tamas, T. Themel, R. T. Thew, Y. Thoma, A. Treiber, P. Trinkler, R. Tualle-Brouri, F. Vannel, N. Walenta, H. Weier, H. Weinfurter, I. Wimberger, Z. L. Yuan, H. Zbinden, A. Zeilinger. The SECOQC quantum key distribution network in Vienna. New J. Phys., 11, 075001(2009).

[13] W. Chen, Z.-F. Han, T. Zhang, H. Wen, Z.-Q. Yin, F.-X. Xu, Q.-L. Wu, Y. Liu, Y. Zhang, X.-F. Mo, Y.-Z. Gui, G. Wei, G.-C. Guo. Field experiment on a ‘star type’ metropolitan quantum key distribution network. IEEE Photon. Technol. Lett., 21, 575-577(2009).

[14] S. Wang, W. Chen, Z.-Q. Yin, Y. Zhang, T. Zhang, H.-W. Li, F.-X. Xu, Z. Zhou, Y. Yang, D.-J. Huang, L.-J. Zhang, F.-Y. Li, D. Liu, Y.-G. Wang, G.-C. Guo, Z.-F. Han. Field test of wavelength-saving quantum key distribution network. Opt. Lett., 35, 2454-2456(2010).

[15] T.-Y. Chen, J. Wang, H. Liang, W.-Y. Liu, Y. Liu, X. Jiang, Y. Wang, X. Wan, W.-Q. Cai, L. Ju, L.-K. Chen, L.-J. Wang, Y. Gao, K. Chen, C.-Z. Peng, Z.-B. Chen, J.-W. Pan. Metropolitan all-pass and inter-city quantum communication network. Opt. Express, 18, 27217-27225(2010).

[16] D. Stucki, M. Legré, F. Buntschu, B. Clausen, N. Felber, N. Gisin, L. Henzen, P. Junod, G. Litzistorf, P. Monbaron, L. Monat, J.-B. Page, D. Perroud, G. Ribordy, A. Rochas, S. Robyr, J. Tavares, R. Thew, P. Trinkler, S. Ventura, R. Voirol, N. Walenta, H. Zbinden. Long-term performance of the SwissQuantum quantum key distribution network in a field environment. New J. Phys., 13, 123001(2011).

[17] M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, A. Zeilinger. Field test of quantum key distribution in the Tokyo QKD network. Opt. Express, 19, 10387-10409(2011).

[18] S. Wang, W. Chen, Z.-Q. Yin, H.-W. Li, D.-Y. He, Y.-H. Li, Z. Zhou, X.-T. Song, F.-Y. Li, D. Wang, H. Chen, Y.-G. Han, J.-Z. Huang, J.-F. Guo, P.-L. Hao, M. Li, C.-M. Zhang, D. Liu, W.-Y. Liang, C.-H. Miao, P. Wu, G.-C. Guo, Z.-F. Han. Field and long-term demonstration of a wide area quantum key distribution network. Opt. Express, 22, 21739-21756(2014).

[19] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. Zhang, K. Chen, J. Yin, J.-G. Ren, Z. Chen, S.-L. Han, Q. Yu, K. Liang, F. Zhou, X. Yuan, M.-S. Zhao, T.-Y. Wang, X. Jiang, L. Zhang, W.-Y. Liu, Y. Li, Q. Shen, Y. Cao, C.-Y. Lu, R. Shu, J.-Y. Wang, L. Li, N.-L. Liu, F. Xu, X.-B. Wang, C.-Z. Peng, J.-W. Pan. An integrated space-to-ground quantum communication network over 4,600 kilometres. Nature, 589, 214-219(2021).

[20] S. Wehner, D. Elkouss, R. Hanson. Quantum internet: a vision for the road ahead. Science, 362, eaam9288(2018).

[21] H. Zhou, K. Lv, L. Huang, X. Ma. Security assessment and key management in a quantum network(2019).

[22] H.-J. Briegel, W. Dür, J. I. Cirac, P. Zoller. Quantum repeaters: the role of imperfect local operations in quantum communication. Phys. Rev. Lett., 81, 5932-5935(1998).

[23] L.-M. Duan, M. Lukin, J. I. Cirac, P. Zoller. Long-distance quantum communication with atomic ensembles and linear optics. Nature, 414, 413-418(2001).

[24] N. Sangouard, C. Simon, H. De Riedmatten, N. Gisin. Quantum repeaters based on atomic ensembles and linear optics. Rev. Mod. Phys., 83, 33-80(2011).

[25] S. Bäuml, M. Christandl, K. Horodecki, A. Winter. Limitations on quantum key repeaters. Nat. Commun., 6, 6908(2015).

[26] S. L. Braunstein, S. Pirandola. Side-channel-free quantum key distribution. Phys. Rev. Lett., 108, 130502(2012).

[27] H.-K. Lo, M. Curty, B. Qi. Measurement-device-independent quantum key distribution. Phys. Rev. Lett., 108, 130503(2012).

[28] M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, H.-K. Lo. Finite-key analysis for measurement-device-independent quantum key distribution. Nat. Commun., 5, 3732(2014).

[29] M. Lucamarini, Z. L. Yuan, J. F. Dynes, A. J. Shields. Overcoming the rate–distance limit of quantum key distribution without quantum repeaters. Nature, 557, 400-418(2018).

[30] X. F. Ma, P. Zeng, H. Y. Zhou. Phase-matching quantum key distribution. Phys. Rev. X, 8, 031043(2018).

[31] X. B. Wang, Z. W. Yu, X. L. Hu. Twin-field quantum key distribution with large misalignment error. Phys. Rev. A, 98, 062323(2018).

[32] C. H. Cui, Z. Q. Yin, R. Wang, W. Chen, S. Wang, G. C. Guo, Z. F. Han. Twin-field quantum key distribution without phase postselection. Phys. Rev. Appl., 11, 034053(2019).

[33] D. Mayers, A. Yao. Quantum cryptography with imperfect apparatus. 39th Annual Symposium on Foundations of Computer Science, 503-509(1998).

[34] L. Masanes, S. Pironio, A. Acín. Secure device-independent quantum key distribution with causally independent measurement devices. Nat. Commun., 2, 238(2011).

[35] B. W. Reichardt, F. Unger, U. Vazirani. Classical command of quantum systems. Nature, 496, 456-460(2013).

[36] U. Vazirani, T. Vidick. Fully device-independent quantum key distribution. Phys. Rev. Lett., 113, 140501(2014).

[37] R. Arnon-Friedman, F. Dupuis, O. Fawzi, R. Renner, T. Vidick. Practical device-independent quantum cryptography via entropy accumulation. Nat. Commun., 9, 459(2018).

[38] L. Comandar, M. Lucamarini, B. Fröhlich, J. Dynes, A. Sharpe, S.-B. Tam, Z. Yuan, R. Penty, A. Shields. Quantum key distribution without detector vulnerabilities using optically seeded lasers. Nat. Photonics, 10, 312-315(2016).

[39] C. Wang, X.-T. Song, Z.-Q. Yin, S. Wang, W. Chen, C.-M. Zhang, G.-C. Guo, Z.-F. Han. Phase-reference-free experiment of measurement-device-independent quantum key distribution. Phys. Rev. Lett., 115, 160502(2015).

[40] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, J.-W. Pan. Measurement-device-independent quantum key distribution over a 404 km optical fiber. Phys. Rev. Lett., 117, 190501(2016).

[41] X.-Y. Zhou, H.-J. Ding, C.-H. Zhang, J. Li, C.-M. Zhang, Q. Wang. Experimental three-state measurement-device-independent quantum key distribution with uncharacterized sources. Opt. Lett., 45, 4176-4179(2020).

[42] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, T.-Y. Chen, J.-W. Pan. Measurement-device-independent quantum key distribution over untrustful metropolitan network. Phys. Rev. X, 6, 011024(2016).

[43] H.-K. Lo, M. Curty, K. Tamaki. Secure quantum key distribution. Nat. Photonics, 8, 595-604(2014).

[44] X. Ma, M. Razavi. Alternative schemes for measurement-device-independent quantum key distribution. Phys. Rev. A, 86, 062319(2012).

[45] Z. Yuan, A. Plews, R. Takahashi, K. Doi, W. Tam, A. W. Sharpe, A. R. Dixon, E. Lavelle, J. F. Dynes, A. Murakami, M. Kujiraoka, M. Lucamarini, Y. Tanizawa, H. Sato, A. J. Shields. 10-Mb/s quantum key distribution. J. Lightwave Technol., 36, 3427-3433(2018).

[46] P. Nikolich, C. Lin, J. Korhonen, R. Marks, B. Tye, G. Li, J. Ni, S. Zhang. Standards for 5G and beyond: their use cases and applications. IEEE 5G Tech Focus, 1, 1(2017).

[47] A. Mizutani, K. Tamaki, R. Ikuta, T. Yamamoto, N. Imoto. Measurement-device-independent quantum key distribution for Scarani-Acin-Ribordy-Gisin 04 protocol. Sci. Rep., 4, 5236(2014).

[48] B. Qi, H. Lo, C. C. W. Lim, G. Siopsis, E. A. Chitambar, R. Pooser, P. G. Evans, W. Grice. Free-space reconfigurable quantum key distribution network. IEEE International Conference on Space Optical Systems and Applications (ICSOS), 1-6(2015).

[49] G. L. Roberts, M. Lucamarini, Z. L. Yuan, J. F. Dynes, L. C. Comandar, A. W. Sharpe, A. J. Shields, M. Curty, I. V. Puthoor, E. Andersson. Experimental measurement-device-independent quantum digital signatures. Nat. Commun., 8, 1098(2017).

[50] C. Gobby, Z. L. Yuan, A. J. Shields. Quantum key distribution over 122 km of standard telecom fiber. Appl. Phys. Lett., 84, 3762-3764(2004).

[51] Z. L. Yuan, A. W. Sharpe, A. J. Shields. Unconditionally secure one-way quantum key distribution using decoy pulses. Appl. Phys. Lett., 90, 011118(2007).

[52] C.-H. Zhang, X.-Y. Zhou, H.-J. Ding, C.-M. Zhang, G.-C. Guo, Q. Wang. Proof-of-principle demonstration of passive decoy-state quantum digital signatures over 200 km. Phys. Rev. Appl., 10, 034033(2018).

[53] X.-F. Mo, B. Zhu, Z.-F. Han, Y.-Z. Gui, G.-C. Guo. Faraday–Michelson system for quantum cryptography. Opt. Lett., 30, 2632-2634(2005).

[54] J.-Y. Liu, H.-J. Ding, C.-M. Zhang, S.-P. Xie, Q. Wang. Practical phase-modulation stabilization in quantum key distribution via machine learning. Phys. Rev. Appl., 12, 014059(2019).

[55] K. Tamaki, H.-K. Lo, C.-H. F. Fung, B. Qi. Phase encoding schemes for measurement-device-independent quantum key distribution with basis-dependent flaw. Phys. Rev. A, 85, 042307(2012).

[56] C. C. W. Lim, M. Curty, N. Walenta, F. Xu, H. Zbinden. Concise security bounds for practical decoy-state quantum key distribution. Phys. Rev. A, 89, 022307(2014).

[57] C. Wang, Z.-Q. Yin, S. Wang, W. Chen, G.-C. Guo, Z.-F. Han. Measurement-device-independent quantum key distribution robust against environmental disturbances. Optica, 4, 1016-1023(2017).

[58] N. Jain, C. Wittmann, L. Lydersen, C. Wiechers, D. Elser, C. Marquardt, V. Makarov, G. Leuchs. Device calibration impacts security of quantum key distribution. Phys. Rev. Lett., 107, 110501(2011).

[59] H.-K. Lo, X. Ma, K. Chen. Decoy state quantum key distribution. Phys. Rev. Lett., 94, 230504(2005).

[60] X.-B. Wang. Beating the photon-number-splitting attack in practical quantum cryptography. Phys. Rev. Lett., 94, 230503(2005).

[61] X. Ma, B. Qi, Y. Zhao, H.-K. Lo. Practical decoy state for quantum key distribution. Phys. Rev. A, 72, 012326(2005).

[62] G.-J. Fan-Yuan, Z.-H. Wang, S. Wang, Z.-Q. Yin, W. Chen, D.-Y. He, G.-C. Guo, Z.-F. Han. Optimizing decoy-state protocols for practical quantum key distribution systems. Adv. Quantum Technolog., 4, 2000131(2021).

[63] http://www.qasky.com/en/default.asp. http://www.qasky.com/en/default.asp

[64] J. Kennedy. Particle swarm optimization. Encyclopedia of Machine Learning, 760-766(2010).

[65] H. Chernoff. A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations. Ann. Math. Stat., 23, 493-507(1952).

[66] W. Hoeffding. Probability inequalities for sums of bounded random variables. The Collected Works of Wassily Hoeffding, 409-426(1994).

[67] G.-J. Fan-Yuan, C. Wang, S. Wang, Z.-Q. Yin, H. Liu, W. Chen, D.-Y. He, Z.-F. Han, G.-C. Guo. Afterpulse analysis for quantum key distribution. Phys. Rev. Appl., 10, 064032(2018).

$θ_{a}$	$θ_{b}$	${\| ψ \|}^{2}$
0	0	${\| ψ_{1} \|}^{2} = 2 A^{2}$
		${\| ψ_{2} \|}^{2} = 2 B^{2}$
$π$	$π$	${\| ψ_{1} \|}^{2} = 2 A^{2}$
		${\| ψ_{2} \|}^{2} = 2 B^{2}$
0	$π$	${\| ψ_{1} \|}^{2} = 2 A^{2} + 2 B^{2} + 4 A B \cos (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = 0$
$π$	0	${\| ψ_{1} \|}^{2} = 0$
		${\| ψ_{2} \|}^{2} = 2 A^{2} + 2 B^{2} + 4 A B \cos (ϕ_{a} - ϕ_{b})$
$\frac{π}{2}$	$\frac{π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} - 2 A B \sin (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} + 2 A B \sin (ϕ_{a} - ϕ_{b})$
$\frac{3 π}{2}$	$\frac{3 π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} + 2 A B \sin (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} - 2 A B \sin (ϕ_{a} - ϕ_{b})$
$\frac{π}{2}$	$\frac{3 π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$
$\frac{3 π}{2}$	$\frac{π}{2}$	${\| ψ_{1} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$
		${\| ψ_{2} \|}^{2} = A^{2} + B^{2} + 2 A B \cos (ϕ_{a} - ϕ_{b})$