A146 J. Opt. Soc. Am. B/Vol. 27, No. 6 /June 2010 J. Capmany and C. R. Fernández-Pousa
Optimum design for BB84 quantumkey distribution in tree-type
passive optical networks
José Capmany1,* and Carlos R. Fernández-Pousa2
1ITEAM Research Institute, Universidad Politécnica de Valencia, 46022 Valencia, Spain2Signal Theory and Communications, Department of Physics and Computer Science, Universidad Miguel
. INTRODUCTIONhe objective of the quantum key distribution (QKD) is torovide a unique way of sharing a random sequence ofits between users with a level of security not attainableith either public or secret-key classical cryptographic
ystems [1,2]. In essence, the QKD relies on exploiting theaws of quantum mechanics [3,4]. Most of the reported ex-erimental results on the long distance QKD rely on dif-erent photonic-based techniques and are based on theennet and Brassard 1984 protocol (BB84). For instance,
n 1992 Bennett and co-workers [5] proposed to exploithe polarization of photons to implement the four re-uired states by employing one circular polarization andne linear polarization basis. Later, Townsend and co-orkers [6–8] proposed the use of optical delays and bal-nced interferometers at the transmitter and the receiver.
third approach, based on the differential phase shiftKD [9] has enabled key generation and distributionlong distances over 100 km [10], although with limitedecurity [11]. Finally, a fourth approach [12], also knowns frequency coding, relies on encoding the informationits on the sidebands of either phase [13] or amplitude14] radio-frequency modulated light.
Much of the work reported in the literature has beenocused toward point-to-point key distribution but, asointed in [7,15], to find a truly widespread applicationKD techniques should be employed in communicationetworks where any-to-any and any-to-many transmis-ions can occur. In particular, a first scenario where thisay happen is in fiber based passive optical networks
PONs), where the passive nature (no optical amplifica-ion) and the limited distance range (up to 20 km) favorhe implementation of multiuser BB84 QKD systems. Inhis context, recent contributions [16] have addressed the
omparison of different multiuser QKD schemes overONs, paying especial emphasis on the attainable quan-
um bit error rate Q but not addressing the issue of com-ined Q or, even more important, the final secure key Rhat can be extracted from the sifted key [17] and the op-imization of resources which, even in the most simpleON configurations, cannot be considered as uncoupled
actors. Indeed the importance of this subject has been re-ently raised in an exhaustive review on the subject [18]n which it has been pointed out that in the practical QKDphysical” figures of merit, such as a secret key or a maxi-al achievable distance, are in competition with “practi-
al” figures of merit, such as stability and cost [19].To illustrate this point with an example, the upper part
f Fig. 1 shows a typical N-user tree-PON configurationhere Alice at the central office is connected via an opti-
al fiber link of length L1 to a 1�N passive splitter. Eachf the N outputs of the splitter connects to a different endser �Bobi , i=1,2, . . . ,N� via an optical fiber link of
ength L2 (we will assume that the length of anylice-Bobi connection is fixed and equal to L=L1+L2).ith the exception of Japan, where the very high and ho-ogeneous population density has dictated a point-to-
oint architecture from the central office, the typical fibero home access network scenario is formed by end users in
close geographical proximity which are grouped intolusters. Each cluster is served by a local star coupler tohich each user is connected by a short-length individualber [18]. As discussed elsewhere [15], the quantum levelehavior of the splitter enables the key distribution tasketween Alice and the different Bobs, since a single pho-on incident on the splitter cannot be divided, but it wille randomly (and unpredictably) routed to one (and onlyne) of the output paths, with a probability given by 1/N.
010 Optical Society of America
IpaeoTA(lLoi1bt=iiRrti8dimse
2DFooctlosl=
Bec
Ab
wfi
N=cNwiteo
titisrt
3OFdtsmilprt
FQeatQ
J. Capmany and C. R. Fernández-Pousa Vol. 27, No. 6 /June 2010/J. Opt. Soc. Am. B A147
f we assume that Alice and the different end users em-loy a BB84 protocol for the key distribution, based onny of the above reported photonic techniques, then it isasy to compute the end-to-end power transmission factorf a particular Alice-Bobi connection, which is given byL=e−�L /N, where � is the fiber attenuation constant.lso, we can have an estimation of the optical resources
i.e., network cost) employed by calculating the totalength of the deployed fiber in the PON, which is given byT=L1+NL2. To improve the power transmission factorne could think, for instance, including the 1�N splitternside the central office as shown in the lower part of Fig.. In this case, the power transmission factor is increasedy a factor of N, that is, TL=e−�L, but the total length ofhe deployed fiber in the PON is increased up to LTNL1+NL2=NL. Thus, as it can be appreciated, increas-
ng the end-to-end transmission factor (and thus decreas-ng its Q value and, as a consequence, the final secure key) of a given Alice-Bobi connection comes at the price of
equiring more fiber to be deployed in the outside plant. Iturns out that in the context of access networks the fibernstallation costs have a very significant impact (up to5%) on the total deployment costs [19]; thus, there is aesign trade-off between R and the deployed fiber lengthn the tree-type PON, for which we wish to find an opti-
um solution. The purpose of this paper is to find such aolution and discuss the effect of the different and rel-vant physical parameters of the BB84 QKD system on it.
. TREE-PON ARCHITECTUREESCRIPTIONigure 2 shows the proposed two-splitting-stage PON lay-ut that is an intermediate case between the two previ-usly discussed. Here, a first 1�N1 passive splitter is lo-ated inside the central office at the output of Alice’sransmitter and thus it does not contribute to the PON’soss. A different fiber link of length L1 connects each of theutputs from the 1�N1 splitter to an 1�N2 secondaryplitter which, in turn, is connected by different fiberinks of length L2 to N2 different final users �Bobi , i1,2, . . . ,N�. We assume that Alice’s transmitter and
ig. 1. (Color online) Two tree-PON configurations for BB84KD. In the upper configuration the 1�N splitter affects thend-to-end power transmission (and the QBER) between Alicend Bobi but minimum fiber resources need to be deployed. Inhe lower configuration the 1�N splitter does not affect theBER but maximum fiber resources need to be deployed.
obi’s �i=1,2, . . . ,N� are the required for the particularncoding method employed to implement the BB84 proto-ol (polarizations, phase, or frequency).
Referring to Fig. 2 the end-to-end transmission fromlice to a particular Bobi due to system’s losses is giveny
TL =e−��L1+L2�
N2=
TF
N2=
N1TF
N, �1�
hile the total length of the fiber employed to connect thenal users to Alice is given by
LT = N1L1 + NL2. �2�
ote that N1 and N2 are linked by the relationship NN1�N2, where N is the total number of end users. In-reasing the value of N1 (and thus decreasing the value of2) results in lower end-to-end transmission losses butith an increase in the total length of the deployed fiber
n the PON. Conversely, increasing the value of N2 (andhus decreasing the value of N1) results in higher end-to-nd transmission losses and a decrease in the total lengthf the deployed fiber in the PON.
The values given by Eqs. (1) and (2) lie in betweenhose of the two extreme cases that we considered in thentroduction section which optimize, respectively, the to-al length of the fiber deployed (the most important factorn the network cost) and the end-to-end loss (i.e., the finalecure key R). Since there is a trade-off between both pa-ameters it is our aim to find an optimum configurationhat can balance both contributions.
. QKD NETWORK FIGURE OF MERIT ANDPTIMIZATION
or the optimization of the PON configuration it would beesirable to define a figure of merit (FOM) which couldake into account both physical and practical aspects asuggested in [18]. From the previous discussion a suitableagnitude fulfilling this criterion could be one consider-
ng both the effects of transmission losses and the totalength of the fiber deployed. Since the first directly im-acts the QKD performance via the quantum bit errorate Q, and therefore the final secure key R, we proposehe following expression:
A148 J. Opt. Soc. Am. B/Vol. 27, No. 6 /June 2010 J. Capmany and C. R. Fernández-Pousa
FOM =R
LT. �3�
or the computation of the final secure key rate we con-ider a system subject to the photon number splittingPNS) attack and decoy state transmission. We assumehat there is a dominant decoy state whose average pho-on number is �, whereas the other decoy states are usedo probe the channel. Then, the final secure key rate R iselated to the quantum bit error rate by [17,18]
R � Rs�e−��1 − h�Q�� − h�Q��, �4�
here h�x�=−x log2�x�− �1−x�log2�1−x� is the binary en-ropy function and Rs= fs�TF� /N2 is the sifted key rate (fss the pulse repetition rate, TF /N2 is the total loss, includ-ng the splitting loss, and � is the detector efficiency).ere we assume that the value of Rs is fixed, as any
hange in the total loss induced by different networklans could be compensated for, at a low cost, by an ad-quate choice of the repetition rate as long as it is below aertain value (10 GHz) limited by currently available offhe shelf commercial devices. The quantity to be opti-ized per unit installed fiber’s length is therefore the
2 1
erm in brackets in Eq. (4), which is a measure of theostprocessing (error correction and privacy amplifica-ion) required to extract an unconditionally secure keyrom the sifted key.
From Eq. (4) it follows that an increase in Q results indecrease in R, and vice versa. The reader can check thatq. (3) is consistent with the trade-off previously de-cribed, since an increase in the total length of the de-loyed fiber reduces the FOM through the inverse depen-ence with LT but, at the same time, since end-to-endransmission losses are decreased (N2 decreases) then sooes the value of Q (and therefore R increases); hence, thefactor tends to increase the FOM. On the other hand, a
ecrease in the total length of the deployed fiber increaseshe FOM value through the �1/LT� factor, while the in-rease in N2 decreases the FOM through the R factor.
We can further develop the expression of the FOMhowing its explicit dependence on N1 by substitutingqs. (2) and (4) into Eq. (3) and using the standard Q ex-ression for BB84 systems which can be found elsewhere3,16],
FOM =e−��1 − h�Q�� − h�Q�
N1L1 + NL2,
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1 = 15Km, L2 = 5Km
tb= 1
dB= 10�5
N = 16
log2 (N1)
FOM
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1 = 15Km, L2 = 5Km
tb= 1
dB= 10�5
N = 32
log2 (N1)
FOM
(a)
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1 = 20Km, L2 = 5Km
tb= 1
dB= 10�5
N = 64
log2 (N1)
FOM
(b)
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1 = 15Km, L2 = 5Km
tb= 1
dB= 10�5
N = 128
log2 (N1)
FOM
(c) (d)
Fig. 3. (Color online) Evolution of the FOM in terms of log �N �, for a PON serving: (a) 16, (b) 32, (c) 64, and (d) 128 users.
Iac
b
Esrs
4Ttc(tLnmidsf7tiT
nltstfrvgswtct
af=�sB
mwtdtbA�sl=l
uopvts=aofvvgNcvEg
tvbh
pbtbt
Fi
J. Capmany and C. R. Fernández-Pousa Vol. 27, No. 6 /June 2010/J. Opt. Soc. Am. B A149
Q�N1� =��N1TF�1 − V� + NdB
2��N1TF=
1
2�1 − V� +
dB
2��TF
N
N1.
�5�
n the above expression V represents the optical visibilitychieved in the filtering process, � is the detector effi-iency, and dB is the dark count rate.
We can now optimize the FOM with respect to theranching ratio N1 in the central office splitter,
�FOM
�N1= 0 ⇒
NdB�N1L1 + NL2��1 + e−��
2��TFln�Q�N1��
+ N12L1�e−�ln�2� + �1 + e−���Q�N1�ln�Q�N1��
− Q�N1��� = 0. �6�
quation (6) is an implicit equation in N1 that must beolved numerically and from which we can analyze theole that the different parameters play on the network de-ign.
. RESULTS AND DISCUSSIONShe effects of the different physical parameters on the op-imum design of the branching ratios of the tree-PON ar-hitecture can be now investigated with the help of Eq.6). Unless stated otherwise, we have taken the followingypical values for �=1550 nm: dB=10−5, V=0.98, �=0.1,=L1+L2=20 km, and �=0.25 dB/km. A caveat is perti-ent at this point since although the link distance (20 km)ay seem to be short in terms of losses, it should be taken
nto account that we are considering PONs with typicalivision ratios of 1�16, 1�32, 1�128. In terms of in-ertion losses, for a given input-output connection, theormer ratios are equivalent to adding extra links of 60,5, and 105 km, respectively, at �=1550 nm. This implieshat the total transmission factor T=TFN1 /N correspond-ng to each point-to-point link Alice-Bobi lies in the range=10−1.6–10−2.5 or 16–25 dB.In order to estimate the value of the average photon
umber � under which the PON is to be operated, we ana-yze the two contributions (5) to the Q as follows. First,he visibility provides a constant value which, with thetandard values used here, gives QV=1%. This would behe only contribution to the QBER if the link is operatedar from the threshold value where the net secure keyate drops to zero. If this would be the case, the optimalalue of the average number of photons per pulse [18] isiven by �opt=0.5�1−2h�QV�� / �1−h�QV��=0.46, which islightly below the zero-QBER limit of 0.5. In practice, ase have already pointed out, the large equivalent point-
o-point link loss in certain PON implementations pre-ludes the use of these values without further justifica-ion.
The second term in Eq. (5) will be denoted by QD andccounts for the contribution of dark counts. It is straight-orward to check that, in the worst-case scenario with T25 dB the additional QBER due to dark counts is QD3% only for ��0.5. In this case the total QBER is 4%,
till far from the 11% limit of the unconditional security.ut the aforementioned optimal value of � for the trans-
ission with decoy states gives �opt=0.34, a contradictionhich simply shows that we have already reached the
ransmission threshold where the net security key raterops to zero. However, for a slighter lower value of theotal loss of T=23 dB we already obtain a consistentound ��0.34 for QD�3%. Assuming therefore that eachlice-Bobi link is operated with the QBER in the range4% we have chosen a value of �=0.40, which is repre-
entative of the range comprised of �opt=0.50 (zero-QBERimit), �opt=0.46 (visibility-dominated QBER), and �opt0.34 (optimal for 4% QBER) and is also consistent with
osses �23 dB.In addition, Eq. (6) itself does not render integer val-
es. Since optical splitters provide an integer number ofutput ports the results given by Eq. (6) have to be ap-roximated taking into account the type of division pro-ided by the splitters. Although 1�3, 1�5, 1�7 split-ers are commercially available, we have chosen for ourimulations splitters of the type 1�2I, where I0,1,2,3, . . . since these are the most commonly avail-ble in the market. Figures 3(a)–3(d) show the evolutionf the FOM versus the value of log2�N1� given by Eq. (6)or the case where L1=15 km and L2=5 km and differentalues of the overall network branching number N (thealues of the remaining parameters are those previouslyiven). Note that, for each value of N, we obtain a value of1 �N1
opt� that renders an optimum value of the FOM. Itan be observed that the value of N1
opt increases with thealue of N. This is because for a given N the structure ofq. (5) depends solely on the ratio N1 /N=1/N2 and, for aiven L, on the ratio L2 /L1.
For fixed values of N and L the value of N1opt depends on
he value of L1. This is shown in Fig. 4 where we plot thealue of N1
opt versus L1 for different values of N. A similarehavior is observed in all the cases with a decreasing be-avior as L1 is increased.Figure 5 shows as well the computed values for Q (up-
er) and R (lower) versus L1, for the case where the num-er of users is 64. Note that for this particular configura-ion despite the maximum Q values are comfortablyelow the 11% limit, reaching a maximum of around 3%,he value of R /Rs can considerably decrease up to 18%;
L1(Km)
log2N1
opt( )
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1+ L
2= 20Km
tb= 1
dB= 10
�5
N=128
N=64
N=32
N=16
ig. 4. (Color online) Evolution of the optimum value of log2�N1�n terms of L , for a PON serving: 16, 32, 64, and 128 users.
1
ttwfmoifsEnth
lfiitop
Tmn
5ItlwtwtofifPtfP
ATtm2PP
R
1
1
1
l
F(n
Q
F(C
A150 J. Opt. Soc. Am. B/Vol. 27, No. 6 /June 2010 J. Capmany and C. R. Fernández-Pousa
hus it is this performance quantity and not Q which haso be considered when addressing the design of the net-ork. For the sake of comparison and evaluation of the ef-
ect that the dark count rates have on the system perfor-ance, we have also included in Fig. 5 the same results
btained when considering 1 order of magnitude less, thats, dB=10−6 in the dark counts. The optimum system per-ormance is much less sensitive to losses, as expected,ince the second term in the QBER expression given byq. (5) which includes the effect of N1 is 1 order of mag-itude less significant. Furthermore, since the errors dueo dark counts are less significant, the value of R /Rs isigher.Figure 6 shows the evolution of the optimum value of
og2�N1� (upper) and R /Rs (lower) in terms of L1 for dif-erent values of �. For a given value of L1 Eq. (6) yields anncrease in the value of N1 for decreasing values of �. Thiss due to the fact that when � increases the end-to-endransmission factor increases (i.e., the QBER decreasesr, alternatively, R increases). Thus, the same end-to-enderformance can be achieved with a lower value of N .
L1(Km)
L1(Km)
R
Rs
og2N1
opt( )µ = 0.4
µ = 0.1
µ = 0.4
µ = 0.1
V = 0.98
� = 0.1
� = 0.2dB / Km
L1+ L
2= 20Km
tb= 1
dB= 10
�5
N = 64
V = 0.98
� = 0.1
� = 0.2dB / Km
L1+ L
2= 20Km
tb= 1
dB= 10
�5
N = 64
ig. 6. (Color online) Evolution of the optimum value of log2�N1�upper) and R (lower) in terms of L1, for different values of �. Theumber of users is 64.
L1(Km)
L1(Km)
BER(%)
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1+ L
2= 20Km
tb= 1
N = 64
µ = 0.4
V = 0.98
� = 0.1
� = 0.2dB / Km
L1+ L
2= 20Km
tb= 1
dB= 10
�5
N = 64
R
Rs
dB= 10
�5
dB= 10
�5
dB= 10
�6
dB= 10
�6
ig. 5. (Color online) Computed values for Q (upper) and Rlower) versus L1, for the case where the number of users is 64.urves are shown for dB=10−5 and 10−4.
1
he variations in the value of R increase with L1 withore prominent step changes as the value of the meanumber of photons � decreases.
. SUMMARY AND CONCLUSIONSn summary, we have shown that there is a trade-off be-ween the useful key distribution bit rate R and the totalength of a deployed fiber in tree-type passive optical net-orks for BB84 quantum key distribution (QKD) applica-
ions. We have proposed a two stage splitting architecturehere one splitting is carried in the central office and
herefore does not contribute to system’s loss and a secondne in the outside plant. We have proposed and justified agure of merit (FOM) to account for the trade-off andound that there is an optimum solution in the case ofNS attacks and decoy state transmission for the split-
ing ratios of both stages. We have then analyzed the ef-ects of the different relevant physical parameters of theON in the optimum solution.
CKNOWLEDGMENTShe authors wish to acknowledge the financial support of
he Spanish Government through Quantum Optical Infor-ation Technology (QOIT), a CONSOLIDER-INGENIO
010 Project, and the Generalitat Valenciana through theROMETEO research excellence award program GVAROMETEO 2008/092.
EFERENCES1. S. Wiesner, “Conjugate coding,” SIGACT News 15, 78–88
(1983).2. C. H. Bennett and G. Brassard, “Quantum cryptography:
public key distribution and coin tossing” in Proceedings ofthe IEEE International Conference on Computers, Systemsand Signal Processing (IEEE, 1984), pp. 175–179.
3. N. Gisin, G. Ribordy, W. Tittel, and H. Zbiden, “Quantumcryptography,” Rev. Mod. Phys. 74, 145–195 (2002).
4. W. K. Wootters and W. H. Zurek, “A single quantum cannotbe cloned,” Nature 299, 802–803 (1982).
5. C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J.Smolin, “Experimental quantum cryptography,” J. Cryptol-ogy 5, 3–28 (1992).
6. P. D. Townsend, J. G. Rarity, and P. R. Tapster, “Single-photon interference in a 10 km long optical fiber interfer-ometer,” Electron. Lett. 29, 634–635 (1993).
7. P. D. Townsend, D. J. D. Phoenix, K. J. Blow, and S. Cova,“Design of quantum cryptography systems for passive opti-cal networks,” Electron. Lett. 30, 1875–1876 (1994).
8. P. D. Townsend, “Quantum cryptography on optical fibernetworks,” Opt. Fiber Technol. 4, 345–370 (1998).
9. K. Inoue, E. Waks, and Y. Yamamoto, “Differential phaseshift quantum key distribution,” Phys. Rev. Lett. 89,037902 (2002).
0. H. Takesue, E. Diamanti, T. Honjo, C. Langrock, M. M. Fe-jer, K. Inoue, and Y. Yamamoto, “Differential phase shiftquantum key distribution over 105 km fibre,” New J. Phys.7, 232 (2005).
1. M. Curty, K. Tamaki, and T. Moroder, “Effect of detectordead times on the security evaluation of differential-phase-shift quantum key distribution against sequential attacks,”Phys. Rev. A 77, 052321 (2008).
2. J.-M. Mérolla, Y. Mazurenko, J. P. Goedgebuer, and W. T.Rhodes, “Single-photon interference in sidebands of phase-modulated light for quantum cryptography,” Phys. Rev.Lett. 82, 1656–1659 (1999).
1
1
1
1
1
1
1
J. Capmany and C. R. Fernández-Pousa Vol. 27, No. 6 /June 2010/J. Opt. Soc. Am. B A151
3. J.-M. Mérolla, Y. Mazurenko, J. P. Goedgebuer, H. Porte,and W. T. Rhodes, “Phase-modulation transmission systemfor quantum cryptography,” Opt. Lett. 24, 104–106 (1999).
4. O. Guerreau, J.-M. Mérolla, A. Soujaeff, F. Patois, J. P.Goedgebuer, and F. J. Malassenet, “Long distance QKDtransmission using single-sideband detection scheme withWDM synchronization,” IEEE J. Sel. Top. Quantum Elec-tron. 9, 1533–1540 (2003).
5. P. D. Townsend, “Quantum cryptography on multi-user op-tical networks,” Nature 385, 47–49 (1997).
6. P. D. Kumavor, A. C. Beal, S. Yelin, E. Donkor, and B. C.Wang, “Comparison of four multi-user quantum key distri-bution schemes over passive optical networks’,” IEEE J.
Lightwave Technol. 23, 268–276 (2005).7. D. Gottesman, H. K. Lo, N. Lutkenhaus, and J. Preskill,
“Security of quantum key distribution with imperfect de-vices,” Quantum Inf. Comput. 4, 325–360 (2004).
8. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M.Dusek, N. Lutkenhaus, and M. Peev, “The security of prac-tical quantum key distribution,” Rev. Mod. Phys. 81, 1301–1350 (2009).
9. R. E. Wagner, “Fiber based broadband access technologyand deployment,” in Optical Fiber Telecommunications, Vol.V.B of Systems and Networks, I. P. Kaminow, T. Li, and A.E. Willner, eds. (Academic, 2008).
