Heterogeneously integrated, superconducting silicon-photonic platform for measurement-device-independent quantum key distribution

Integrated photonics provides a route both to miniaturize quantum key distribution (QKD) devices and to enhance their performance. A key element for achieving discrete-variable QKD is a single-photon detector. It is highly desirable to integrate detectors onto a photonic chip to enable the realization of practical and scalable quantum networks. We realize an integrated heterogeneous superconducting-silicon-photonic chip. Harnessing the unique high-speed feature of our optical waveguide-integrated superconducting detector, we perform the first optimal Bell-state measurement (BSM) of time-bin encoded qubits generated from two independent lasers. The optimal BSM enables an increased key rate of measurement-device-independent QKD, which is immune to all attacks against the detection system, and hence provides the basis for a QKD network with untrusted relays. Together with the time-multiplexed technique, we have enhanced the sifted key rate by almost one order of magnitude. With a 125 MHz clock rate, we obtain a secure key rate of 6.166 kbps over 24.0 dB loss, which is comparable to the state-of-the-art MDI-QKD experimental results with GHz clock rate. Combined with integrated QKD transmitters, a scalable, chip-based and cost-effective QKD network should become realizable in the near future.

on indium phosphide (InP) [32,33], and decoders based on silicon oxynitride [34] and silicon dioxide [35], as well as integrated silicon-photonic chips for continuous-variable (CV) QKD [36,37]. The notion of MDI has also been extended to CV protocols [38] and can be applied for multipartite metropolitan network with considerable rate [39]. Most of the components used in QKD, including lasers, modulators and passive components (such as beam splitters and attenuators) are widely used in classical optical communication systems and are not specifically designed for QKD. In addition, single-photon detectors are indispensable for discrete-variable (DV) QKD system, because the senders' pulses have to have a mean photon number of less than 1 to guarantee communication security. So far, single-photon detector integrated chip platform has not been employed in a MDI-QKD system. In this work, we report the realization of a heterogeneous superconducting-silicon-photonic chip and its application for MDI-QKD. Alice and Bob send time-bin encoded qubits to Charlie for exchanging keys. By detecting the coincidence (red) between the early (e) and late (l) pulses with two detectors (D1 and D2), or with one detector (D1 or D2). Charlie projects two incoming photons onto |Ψ − or |Ψ + to facilitate the key exchanges between Alice and Bob. The full-recovery time of the single-photon detector sets the lower limit of the temporal separation (∆t) between e and l pulses for realizing optimal BSM. We insert independent sets of bins (ISB) between e and l for realizing time-multiplexing and hence increase the key rate by reducing the bin separation from ∆t to τR. (b) A star-like MDI-QKD network with the untrusted relay server. A series of Alice (A1, A2, . . ., An) and Bob (B1, B2, . . ., Bn) prepare modulated weak coherent pulses and send to the routers. Two routers select a pair of Alice and Bob and send their pulses to an untrusted relay server controlled by Charlie.
We use time-bin qubits to encode bit information, which are well suited for fibre-based quantum communication due to their immunity to random polarization rotations in fibres. The conceptual scheme of our experiment is shown in Fig. 1(a). Alice and Bob encode keys with time-bin qubits by using modulated weak coherent pulse sets. In Pauli Z-basis, the time-bins are encoded as the early, |e , and the late, |l , for bit values of 0 and 1, respectively. The temporal separation between |e and |l is ∆t. In Pauli X-basis, the keys are encoded as the coherent superposition states between |e and |l : |+ = (|e + |l )/ √ 2 and |− = (|e −|l )/ √ 2, representing bit values of 0 and 1, respectively. The Z-basis code is used for key exchange, and the X-basis code is for error detection. These encoded time-bin qubits are then sent to Charlie, who performs the BSM on the incoming time-bin qubits by using a beam splitter (BS) and two single-photon detectors (D 1 and D 2 ) [10,11]. By using linear optical elements, the success probability of BSM is bounded by 50% [40]. For projective measurements, optimal BSM corresponds to distinguish two out of four Bell states. Although time-bin qubits are well suited for fibre-based quantum communication, optimal BSM for time-bin qubits has yet to be realized. The bottleneck so far has been the lack of high-speed single-photon detectors [33,41,42]. The BSM scheme for time-bin qubits is shown in the inset of Fig. 1(a). The coincidence counts between two different detectors at different time bins, corresponding to coincidence counts between |e D1 (D 1 detects a photon at an early bin, red) and |l D2 (D 2 detects a photon at a late bin, red), or coincidence counts between |l D1 and |e D2 . Such a coincidence detection projects two photons onto |Ψ − = (|el − |le )/ √ 2, which is the common scenario realized in most of the time-bin BSM schemes [14,33,42]. In order to achieve optimal BSM, we also need to detect |Ψ + = (|el + |le )/ √ 2 by measuring the coincidence counts of one detector at different time bins, corresponding to the coincidence detection between |e D1 and |l D1 , or |e D2 and |l D2 . This particular BSM requires high-speed single-photon detection, capable to detect consecutive photons separated by ∆t. The unique design of the waveguide-integrated SNSPD provides a short recovering time (<10 ns) for singlephoton detection, enabling us to perform time-bin-encoded optimal BSM between two independent lasers for the first time. Note that if we only use one set of time-bin qubits, the system repetition rate will be limited to 1/(2∆t). In order to maximize the channel efficiency, we use time-multiplexed encoding to insert independent sets of bins (ISB A 2 , ..., ISB A n and ISB B 2 , ..., ISB B n ) between the |e and |l bins of ISB A 1 and ISB B 1 . Therefore, the system repetition rate will be greatly increased to 1/(2τ R ), where τ R is the time difference between t 1 and t 2 . By harnessing the optimal BSM and time-multiplexing, the key rate generation is enhanced by an order of magnitude compared to the system without using these two techniques. Consequently, our key rate is comparable to the state-of-the-art MDI-QKD experimental results with GHz clock rate, as detailed later.
Our integrated heterogeneous superconducting-silicon-photonic platform provides a server architecture for realizing a multiple-user trust-node-free quantum network with a fully-connected bipartite-graph topology. As shown in Fig. 1(b), modulated weak coherent pulses are prepared by Alices (A 1 , A 2 , . . ., A n ) and Bobs (B 1 , B 2 , . . ., B n ), and are sent to the routers.
Two routers select the pair of the communicating Alice and Bob, and send their pulses to an untrusted relay server controlled by Charlie. At Charlie's station, a chip with multiple low-dead-time [43], low-timing-jitter [44] and high-efficiency detectors in conjunction with low-loss silicon photonics [45] are used to realize the BSM. This configuration allows any user at Alice's side to communicate with any user at Bob's side and hence to realize a fully-connected bipartite quantum network.
The schematic of our experimental setup is shown in Fig. 2 Z-basis (X-basis) states are generated by chopping the laser into |e or (and) |l states with intensity modulators (IMs). The average photon numbers per pulse in the two bases are about the same. The resulting pulses are sent into a phase modulator (PM) with (without) π-phase shift for the generation of |− (|+ ) states. The electrical signals applied to the modulators are generated by an arbitrary waveform generator (AWG, not shown in Fig. 2(a)). An additional 50:50 beam splitter (BS) combined with a power sensor (PS) is employed to monitor the long-term stability of laser power in each encoder.
One of the most important requirements of MDI-QKD is to obtain high-quality two-photon Hong-Ou-Mandel (HOM) interference on the integrated relay server. To achieve that, it is necessary for Alice and Bob to generate indistinguishable weak- for details). For the polarization DOF, two electrical polarization controllers (EPC) are used to optimize the polarization of both pulses before they are coupled into Charlie's chip. For the temporal DOF, we adjust the relative electrical delay between Alice's and Bob's IMs to ensure that their pulses arrive at the chip simultaneously. Attenuators are used to adjust the average photon number per pulse and simulate the loss of the communication channels.
These pulses are then sent to Charlie's relay server chip which is mounted on a nano-positioner in a closed-cycle cryostat with a base temperature of 2.1 K. We show the U-shape waveguide-integrated superconducting nanowire single-photon detector (SNSPD) in Fig. 2(b), in which the superconducting nanowire (80 nm-wide, 80 µm-long) is highlighted in red and the silicon optical waveguide (500 nm-wide) is shown in blue. Fig. 2(c) shows the scanning electron microscope image of the photoniccrystal grating coupler [46,47], which couples light from the fibre array to the chip. We obtain coupling loss from the reference device, which is at the right side of the main device [48]. The grating coupler with back-reflected mirror offers a coupling loss of ∼2.24 dB at a wavelength of 1536 nm. The main device has two identical grating couplers, coupling Alice's and Bob's pulses from fibre to chip. Silicon optical waveguides guide the pulses to a multi-mode interference (MMI) coupler, which acts as a 50:50 beam splitter. At the output of the MMI, two waveguide-integrated SNSPDs work simultaneously for detecting photons.
Both SNSPDs are biased with constant voltage sources and connected with electronic readout circuitries. In Fig. 2(d), we show the electrical signals of waveguide-integrated SNSPDs with different nanowire length. The decay time of SNSPD is directly proportional to the kinetic inductance of the nanowire. Shorter detectors exhibit lower kinetic inductance and therefore have shorter decay times, resulting in faster detector recovery [49]. However, for traditional normal-incidence SNSPDs, the shorter nanowire length leads to lower detection efficiency, because it is necessary to fabricate large-area meander nanowire to match the optical modes from fibres to obtain high detection efficiency.Therefore, it is hard to simultaneously obtain low dead time and high detection efficiency with the traditional design. In our work, we use the evanescent coupling between optical waveguide and superconducting nanowire to circumvent this trade-off. Therefore, we are able to obtain low dead time as well as high on-chip detection efficiency. To further quantitatively characterize the efficiency of our SNSPDs for projecting two photons onto |Ψ + , we measure the normalized coincidence counts of one detector consecutively detecting both early and late time bins as a function of time separation ∆t between them. The experimental results are shown in Fig. 2(e). The detection probability is significantly decreased when the time separation is smaller than the dead time, and is fully recovered for separation larger than 12 ns. Based on these results, the dead time of the SNSPD we use in our QKD system is about 3.4 ns for the 1/e-decay time, and we set the time separation between |e and |l to be 12 ns. This short time separation not only allows high-speed detection, but also greatly simplifies frequency stabilization of the light source. For a traditional normal-incidence SNSPD which limits 75 ns timebin separation [50], a 185 kHz frequency difference between two lasers can result in 5 o phase error, which is technologically challenging and not practical. By contrast, for our waveguide-integrated SNSPD, the frequency-stabilization requirement is only 1.2 MHz for achieving the same phase error, which is significantly more feasible in practice.
In Fig. 3(a) and (b), we show the two-photon coincidence counts with optimal BSM as a function of relative electronic delays between Alice's and Bob's pulse sequence, in which Charlie projects the two photons sent by Alice and Bob onto |Ψ − and |Ψ + , respectively. The dependence of the coincidence counts on the delay is a result of BSM, showing the coherent two-photon superposition. Due to the symmetry of |Ψ − and |Ψ + , when Alice and Bob send the same states in X-basis, |++ or |−− , we obtain the destructive/constructive interference patterns for the BSM results of |Ψ − /|Ψ + , as shown by the blue dots in Fig.   3(a) and (b). When Alice and Bob send the orthogonal states in X-basis, |+− or |−+ , we obtain the inverse results, as shown by the red dots in Fig. 3(a) and (b). (The logic of coincidence detection for |Ψ − and |Ψ + is shown in the inset of Fig. 1(a).) We obtain secure keys from the Z-basis measurements and verify the reliability of the QKD system in X-basis [18]. To quantify the performance of the system, we analyze the quantum bit error rate (QBER). For instance, Alice and Bob exchange their keys conditionally on Charlie obtaining |Ψ − /|Ψ + from his BSM, when Alice and Bob send the same/orthogonal states.
For X-basis, the probability of Charlie obtaining a coincidence at two subsequent time bins with time separation ∆t is P − X (t, t + ∆t)/P + X (t, t + ∆t). We then obtain the QBER in X-basis (QBER ) based on [51]: . (1) . (2) Relative Wavelength (pm)

QBER
In addition, the phase difference of two subsequent time bins induced by frequency difference is where c is the speed of light, ω a (ω b ) and λ a (λ b ) are the laser's frequency and wavelength of Alice (Bob), respectively.
P − X (t, t + ∆t)/P + X (t, t + ∆t) can be written as: where V is the visibility, τ is the coincidence window.
As for Z-basis, QBER Z always have the same formula for |Ψ − /|Ψ + . In Fig. 3(c) and ( Although the full-recovery time of the detector determines the time-bin separation to be 12 ns, we can harness the timemultiplexed technique by inserting more pairs of time-bin pulses to enhance the key rate. This is particularly useful in high-loss communication applications. As shown in the insets of Fig. 4(a), we insert up to five bins between 12 ns with equal temporal separation of 2 ns. By combining this time-multiplexed technique and optimal BSM, we enhance the sifted key rate by almost an order of magnitude. At the same time, these two techniques have little impact on QBER X and QBER Z , as shown in Fig.   4(b).
We demonstrate a complete MDI-QKD system including decoy states and phase randomization for guaranteeing the security [13-20, 53, 54] with our integrated heterogeneous superconducting-silicon-photonic platform. We use a four-intensity encoding protocol [53] with three intensities (µ, ν, o) in the X-basis for decoy-state analysis and one intensity (s) in the Z-basis for key generation. Finite-key effects are considered in the secure-key-rate analysis with a failure probability of 10 −10 [55].  In this part of the experiment, we evenly insert two more pairs of time-bin qubits between 12 ns separation. Therefore, the effective clock rate of our system is tripled to 125 MHz (1/8 ns). The secure key rates for different losses are shown in Fig.   5. With 125 MHz clock rate, we obtain the key rate of 6.166 kbps at the loss of 24.0 dB. This loss includes chip insertion loss ∼ 4.5 dB. The actual transmission loss is about 19.5 dB, which corresponds to 98 km standard fibre. To the best of our knowledge, this is the highest secure key rate obtained experimentally with ∼20 dB transmission loss in MDI-QKD, which is highly relevant in the context of a metropolitan quantum network without detector vulnerabilities. Furthermore, we obtain the secure key rates of 170 bps and 34 bps with the total losses of about 35.0 dB and 44.0 dB. We emphasize that our secure key rates with 125 MHz clocked system are very close to the best MDI-QKD experiments with GHz clock rate [31,56]. In contrast with GHz clock rate MDI-QKD experiments, our system doesn't require complicated injection locking technique, which significantly reduces the complexity of the transmitter. See the table in Supplementary Material for detailed comparison.
In conclusion, we have demonstrated the first integrated relay server for MDI-QKD with a heterogeneous superconductingsilicon-photonic chip. The excellent optical and electronic performance of this chip not only facilitates the experimental highvisibility HOM interference and low QBER, but also allows us to perform optimal BSM for time-bin qubits for the first time.
Our work shows that integrated quantum-photonic chips provides not only a route to miniaturization, but also significantly enhance the system performance than traditional platforms. Our chip-based relay server can also be employed in Twin-Field QKD (TF-QKD) [57] which can overcome the rate-distance limit of QKD without quantum repeaters. TF-QKD is indispensable in long-distance intercity communication link. Moreover, the chip-based relay server with MDI-QKD protocol presented in this work could be an ideal solution for a scalable trust-node-free metropolitan quantum network. By using more advanced waveguide-integrated SNSPDs [45], one can further improve the integrated server with high detection efficiency, low timing jitter, and high repetition rate. Combined with photonic-chip transmitters [31,33], a fully chip-based, scalable and high-key-rate

SUPPLEMENTARY INFORMATION
The heterogeneous superconducting-silicon-photonic chip In this section, we introduce the fabrication and characterization of the heterogeneous superconducting-silicon-photonic chip, including high-efficiency grating couplers, optical waveguides, multimode interference (MMI) couplers and waveguideintegrated superconducting nanowire single-photon detectors (SNSPDs).
The six fabrication steps of the high-efficiency grating couplers are shown in Fig. 6.  The fabrication steps of waveguide-integrated SNSPD are shown in Fig. 8 and explained in its caption. We use the setup in side of fibre array, a RF probe is used to obtain the detectors' response signal.
After cooling the sample stage temperature down to 2.1 K, we perform further low-temperature measurements, such as critical current, temporal response, OCDE and DCR. In Fig. 10, the I-V curves are measured by sweeping the voltage source between -1 V and 1 V. Each nanowire exhibits a superconducting state along the zero-voltage and abruptly transits to a normal-conducting state once the current is higher than critical current. It is clear to see that as the width of nanowire increases, the critical current increases.
As shown in Fig. 9, the OCDE of SNSPD is characterized by sending an attenuated continuous wave (CW) laser and the DCR is measured when laser is turn-off. A fiber polarization controller (PC) is used to maximize the input power. First, we characterize the coupling efficiency of the reference grating coupler. After the photon flux is guided to fiber array in the cryostat, we measure the input power P in and output power P out with the attenuator is set at 0 dB. The efficiency of the grating coupler can be calculated by the following formula where η in and η out are the efficiency of the incidence grating coupler and emergent grating coupler, respectively. We neglect the on-chip propagation loss, so η in = η out = η. As derived from Fig. 7, η = -2.24 dB (1536nm). We also assume that the coupling efficiency of the main device's and the reference device's grating couplers are same. By adjusting the attenuator, we can find the photon number N arriving at the detector in a similar way, with where r is the splitting ratio of MMI. We assume that the splitting ratio of multi-mode interference (MMI) is 50:50 in the following calculation. When the attenuation is A, with N in = N * A, the on-chip detection efficiency (OCDE) can be written as where C is OCCR (on-chip count rate) and C d is DCR. We can get the value of C and C d by using a timetagger (UQD). DCR is the count per second when we turn off the laser. We characterize the performance of our SNSPDs including OCDE and DCR with various bias currents at the wavelength of interests (1536nm). The results are shown in Fig. 11. We change the bias current of our SNSPDs and obtain the OCDE and DCR as a function of normalized bias current. Saturation of count rate means that the internal quantum efficiency is close to 100 %. In our QKD experiment, SNSPD#1 is biased at 7.  frequency difference between these two lasers by beat measurement and employ a feedback system to regulate Bob's laser's frequency. The maximum frequency difference is less than 10 MHz over about 15 hours with the help of the feedback system, as shown in Fig. 12.
For each encoder module, we use one intensity modulator to chop out the required short pulses with about 370 ps full-width at half maximum (FWHM). Then we use another intensity modulators to modulate the mean photon number per pulse for decoy states (µ and ν) and vacuum state (o). In Fig. 13, we show the results of weak coherent pulses measured by our SNSPDs, in which a >20 dB extinction ratio has been obtained.

Four intensity decoy-state analysis
We use the four-intensity decoy-state protocol 46   where p s p s is the probability of both Alice and Bob sending signal states. h(·) is the Shannon binary entropy function, and f = 1.16 is the efficiency of error correction. y ss and E ss denote the gain and QBER for ss source, which can be directly obtained in experiments.

Experimental results
As shown in Fig. 14, we obtain a HOM interference visibility of V=48.1%± 0.5% with 4 ns time-bin separation at a rate of 250 MHz, indicating the high quality of our integrated chip for MDI-QKD. The blue dots are the experimental data and the red curve is a fit. We employ our system to implement a complete MDI-QKD system including four intensity decoy states and phase randomization.In Table I, we show the mean photon number and proportion of different states and the sent total pulse pairs number at different loss. In Table II, we show detailed experimental results. The system has a 125 MHz repetition rate. The system is run for 6.68 hours at total attenuations of 24.0 dB (including chip insertion loss ∼ 4.5 dB, the actual transmission loss corresponds to 98 km standard fibre), and a total of 3 × 10 12 pulse pairs are sent from each sender. The key rate is 6166 bps. The system is also run for 6.68 hours at total attenuations of 35.0 dB (including chip insertion loss ∼ 4.5 dB, the actual transmission loss corresponds to 153 km standard fibre), and a same total of 3 × 10 12 pulse pairs are sent from each sender. The key rate is 170 bps. As for higher attenuation, 44.0 dB (including chip insertion loss ∼ 4.5 dB, the actual transmission loss corresponds to 198 km standard fibre), the run time is increased by one order (66.8 hours). So the sent pulse pairs number becomes 3 × 10 13 . The key rate is 34 bps. In Table III, We show the comparison of state-of-the-art MDI-QKD experiments. We emphasize that our secure key rates with 125 MHz clocked system are very close to the best MDI-QKD experiments with GHz clock rate 17,31,56 .