Quantum key distribution (QKD) employs the laws of quantum physics to provide information-theoretical security for key exchange.1^–5 Despite the substantial progress in the past 35 years, practical implementations of QKD still deviate from ideal descriptions in security proofs, mainly due to potential side-channel attacks. For instance, a series of loopholes have been identified due to the imperfections of measurement devices.6^–9 Inspired by the time-reversed entanglement-based QKD, measurement-device-independent QKD (MDI-QKD), which removes all detector side attacks, has been proposed.10^,11 Instead of relying on the trusted nodes of traditional QKD protocols, MDI-QKD requires only a central node (Charlie) to perform a Bell-state measurement (BSM). The correlations between the two senders (Alice and Bob) can be obtained from the BSM results. Importantly, even if Charlie is not trusted, one can still guarantee the security of the MDI-QKD as long as Charlie can project his two photons onto Bell states. The outstanding features of MDI-QKD invite global experimental efforts, which are mainly based on bulk/fiber components.12^–20 Despite the additional BSM by Charlie, the key rate17 and the communication distance18 of MDI-QKD can be comparable with those of traditional QKD. Furthermore, the star-like topology of the MDI-QKD quantum network is naturally suited for the metropolitan network with multiple users.21^–23 Recently, the generalization of the MDI protocol to multipartite schemes has been investigated.24^–26 It has been shown that the performance of the multipartite schemes can be advantageous to iterative use of independent bipartite protocols.26

From the perspectives of hardware, recent developments involve particular integrated photonic devices for QKD, including on-chip encoders based on silicon modulators,27^–31 on-chip transmitters including lasers, photodiodes, modulators based on indium phosphide,32^,33 and decoders based on silicon oxynitride34 and silicon dioxide,35 as well as integrated silicon-photonic chips for continuous-variable (CV) QKD.36^,37 The notion of MDI has also been extended to CV protocols38 and can be applied for multipartite metropolitan networks with a considerable rate.39 Most of the components used in QKD, including lasers, modulators, and passive components [such as beam splitters (BSs) and attenuators] are widely used in classical optical communication systems and are not specifically designed for QKD. In addition, single-photon detectors are indispensable for discrete-variable QKD systems, because the senders’ pulses have to have a mean photon number of <1 to guarantee communication security. So far, a single-photon detector integrated chip platform has not been employed in an MDI-QKD system. In this work, we report the realization of a heterogeneously integrated, superconducting silicon-photonic chip, and its application for MDI-QKD.

We use time-bin qubits to encode bit information, which are well suited for fiber-based quantum communication due to their immunity to random polarization rotations in fibers. The conceptual scheme of our experiment is shown in Fig. 1(a). Alice and Bob encode keys with time-bin qubits using modulated weak coherent pulse sets. In Pauli Z-basis, the time-bins are encoded as the early |e⟩ and the late |l⟩ for bit values of 0 and 1, respectively. The temporal separation between |e⟩ and |l⟩ is Δt. In Pauli X-basis, the keys are encoded as the coherent superposition states between |e⟩ and |l⟩: |+⟩=(|e⟩+|l⟩)/2 and |−⟩=(|e⟩−|l⟩)/2, representing bit values of 0 and 1, respectively. The Z-basis code is used for key exchange, and the X-basis code is for error detection. These encoded time-bin qubits are then sent to Charlie, who performs the BSM on the incoming time-bin qubits using a BS and two single-photon detectors (D1 and D2).10^,11 Using linear optical elements, the success probability of BSM is bounded by 50%.40 For projective measurements, optimal BSM corresponds to distinguish two out of four Bell states. Although time-bin qubits are well suited for fiber-based quantum communication, optimal BSM for time-bin qubits has yet to be realized. The bottleneck so far has been the lack of high-speed single-photon detectors.33^,41^,42 The BSM scheme for time-bin qubits is shown in the inset of Fig. 1(a). The coincidence counts between two different detectors at different time bins correspond to coincidence counts between |e⟩D1 (D1 detects a photon at an early bin, red) and |l⟩D2 (D2 detects a photon at a late bin, red), or coincidence counts between |l⟩D1 and |e⟩D2. Such coincidence detection projects two photons onto |Ψ−⟩=(|el⟩−|le⟩)/2, which is the common scenario realized in most of the time-bin BSM schemes.14^,33^,42 In order to achieve optimal BSM, we also need to detect |Ψ+⟩=(|el⟩+|le⟩)/2 by measuring the coincidence counts of one detector at different time bins, corresponding to the coincidence detection between |e⟩D1 and |l⟩D1, or |e⟩D2 and |l⟩D2. This particular BSM requires high-speed single-photon detection, able to detect consecutive photons separated by Δt. The unique design of the waveguide-integrated superconducting nanowire single-photon detector (SNSPD) provides a short recovery time (<10ns) for single-photon detection, enabling us to perform time-bin-encoded optimal BSM between two independent lasers for the first time. Note that if we only use one set of time-bin qubits, the system repetition rate will be limited to 1/(2Δt). In order to maximize the channel efficiency, we use time-multiplexed encoding to insert independent sets of bins (ISB2A,…,ISBnA and ISB2B,…,ISBnB) between the |e⟩ and |l⟩ bins of ISB1A and ISB1B. Therefore, the system repetition rate will be greatly increased to 1/(2τR), where τR is the time difference between t1 and t2. By harnessing the optimal BSM and time-multiplexing, the key rate generation is enhanced by an order of magnitude compared to the system without using these two techniques. Consequently, our key rate is comparable to the state-of-the-art MDI-QKD experimental results with a GHz clock rate, as detailed later.

Our heterogeneously integrated, superconducting silicon-photonic platform provides a server architecture for realizing a multiple-user trust-node-free quantum network with a fully connected bipartite-graph topology. As shown in Fig. 1(b), modulated weak coherent pulses are prepared by Alices (A1,A2,…,An) and Bobs (B1,B2,…,Bn) and are sent to the routers. Two routers select the pair of the communicating Alice and Bob and send their pulses to an untrusted relay server controlled by Charlie. At Charlie’s station, a chip with multiple low-dead-time,43 low-timing-jitter,44 and high-efficiency detectors in conjunction with low-loss silicon photonics45 is used to realize the BSM. This configuration allows any user at Alice’s side to communicate with any user at Bob’s side and hence to realize a fully connected bipartite quantum network.

The schematic of our experimental setup is shown in Fig. 2(a). Alice (Bob) chops the CW laser operated at about 1536.47 nm into the desired pulse sequences. The pulse is about 370 ps wide and separated by 12 ns at a rate of 41.7 MHz rate (1/24 ns). Z-basis (X-basis) states are generated by chopping the laser into |e⟩ or (and) |l⟩ states with intensity modulators (IMs). The average photon numbers per pulse in the two bases are about the same. The resulting pulses are sent into a phase modulator (PM) with (without) π-phase shift for the generation of |−⟩ (|+⟩) states. The electrical signals applied to the modulators are generated by an arbitrary waveform generator [not shown in Fig. 2(a)]. An additional 50:50 BS combined with a power sensor (PS) is employed to monitor the long-term stability of laser power in each encoder.

One of the most important requirements of MDI-QKD is to obtain high-quality two-photon Hong–Ou–Mandel (HOM) interference on the integrated relay server. To achieve that, it is necessary for Alice and Bob to generate indistinguishable weak-coherent pulses. The interfering pulses have to be indistinguishable in all degrees of freedom (DOFs), including spectrum, time, and polarization. For the spectrum DOF, Alice’s and Bob’s unmodulated pulses pass through polarization beam splitters (PBSs), with one of the outputs connected with a 50:50 BS for frequency beating. From the beating signal, we feedback onto one of the lasers and regulate the frequency difference of these two lasers to be within 10 MHz (see Supplementary Material for details). For the polarization DOF, two electrical polarization controllers (EPCs) are used to optimize the polarization of both pulses before they are coupled into Charlie’s chip. For the temporal DOF, we adjust the relative electrical delay between Alice’s and Bob’s IMs to ensure that their pulses arrive at the chip simultaneously. Attenuators are used to adjust the average photon number per pulse and simulate the loss of the communication channels.

These pulses are then sent to Charlie’s relay server chip, which is mounted on a nanopositioner in a closed-cycle cryostat with a base temperature of 2.1 K. We show the U-shape waveguide-integrated SNSPD in Fig. 2(b) in which the superconducting nanowire (80-nm-wide, 80-μm-long) is highlighted in red and the silicon optical waveguide (500 nm-wide) is shown in blue. Figure 2(c) shows the scanning electron microscope image of the photonic-crystal grating coupler,46^,47 which couples light from the fiber array to the chip. We obtain coupling loss from the reference device, which is at the right side of the main device.48 The grating coupler with a back-reflected mirror offers a coupling loss of ∼2.24dB at a wavelength of 1536 nm. The main device has two identical grating couplers, coupling Alice’s and Bob’s pulses from fiber to chip. Silicon optical waveguides guide the pulses to a multi-mode interference (MMI) coupler, which acts as a 50:50 BS. At the output of the MMI, two waveguide-integrated SNSPDs work simultaneously for detecting photons. Both SNSPDs are biased with constant voltage sources and connected with electronic readout circuitries. In Fig. 2(d), we show the electrical signals of waveguide-integrated SNSPDs with different nanowire lengths. The decay time of SNSPD is directly proportional to the kinetic inductance of the nanowire. Shorter detectors exhibit lower kinetic inductance and therefore have shorter decay times, resulting in faster detector recovery.49 However, for traditional normal-incidence SNSPDs, the shorter nanowire length leads to lower detection efficiency, because it is necessary to fabricate large-area meander nanowire to match the optical modes from fibers to obtain high detection efficiency. Therefore, it is hard to simultaneously obtain low dead time and high detection efficiency with the traditional design. In our work, we use the evanescent coupling between the optical waveguide and superconducting nanowire to circumvent this trade-off. Therefore, we are able to obtain low dead time as well as high on-chip detection efficiency. To further quantitatively characterize the efficiency of our SNSPDs for projecting two photons onto |Ψ+⟩, we measure the normalized coincidence counts of one detector consecutively detecting both early and late time bins as a function of the time separation Δt between them. The experimental results are shown in Fig. 2(e). The detection probability is significantly decreased when the time separation is smaller than the dead time and is fully recovered for separation larger than 12 ns. Based on these results, the dead time of the SNSPD we use in our QKD system is about 3.4 ns for the 1/e-delay time, and we set the time separation between |e⟩ and |l⟩ to be 12 ns. This short time separation not only allows high-speed detection but also greatly simplifies frequency stabilization of the light source (LS). For a traditional normal-incidence SNSPD that limits 75 ns time-bin separation,50 a 185-kHz frequency difference between two lasers can result in a 5-deg phase error, which is technologically challenging and not practical. By contrast, for our waveguide-integrated SNSPD, the frequency-stabilization requirement is only 1.2 MHz for achieving the same phase error, which is significantly more feasible in practice.

In Figs. 3(a) and 3(b), we show the two-photon coincidence counts with optimal BSM as a function of the relative electronic delays between Alice’s and Bob’s pulse sequence in which Charlie projects the two photons sent by Alice and Bob onto |Ψ−⟩ and |Ψ+⟩, respectively. The dependence of the coincidence counts on the delay is a result of BSM, showing the coherent two-photon superposition. Due to the symmetry of |Ψ−⟩ and |Ψ+⟩, when Alice and Bob send the same states in X-basis, |++⟩ or |--⟩, we obtain the destructive/constructive interference patterns for the BSM results of |Ψ−⟩/|Ψ+⟩, as shown by the blue dots in Figs. 3(a) and 3(b). When Alice and Bob send the orthogonal states in X-basis, |+−⟩ or |−+⟩, we obtain the inverse results, as shown by the red dots in Figs. 3(a) and 3(b). [The logic of coincidence detection for |Ψ−⟩ and |Ψ+⟩ is shown in the inset of Fig. 1(a).]

We obtain secure keys from the Z-basis measurements and verify the reliability of the QKD system in X-basis.18 To quantify the performance of the system, we analyze the quantum bit error rate (QBER). For instance, Alice and Bob exchange their keys conditionally on Charlie obtaining |Ψ−⟩/|Ψ+⟩ from his BSM, when Alice and Bob send the same/orthogonal states. For X-basis, the probability of Charlie obtaining a coincidence at two subsequent time bins with time separation Δt is PX−(t,t+Δt)/PX+(t,t+Δt). We then obtain the QBER in X-basis (QBERX|Ψ−⟩/QBERX|Ψ+⟩) based on51QBERX|Ψ−⟩=PX−(t,t+Δt)PX+(t,t+Δt)+PX−(t,t+Δt),(1)QBERX|Ψ+⟩=PX+(t,t+Δt)PX+(t,t+Δt)+PX−(t,t+Δt),(2)QBERZ|Ψ±⟩=PZ−(t,t+Δt)PZ+(t,t+Δt)+PZ−(t,t+Δt).(3)

In addition, the phase difference of two subsequent time bins induced by frequency difference is θ=2πΔωΔt=2π(ωa−ωb)Δt=2πcΔt|λa−λb|λaλb,(4)where c is the speed of light and ωa (ωb) and λa (λb) are the laser’s frequency and wavelength of Alice (Bob), respectively.

PX−(t,t+Δt)/PX+(t,t+Δt) can be written as PX±(t,t+Δt)=1±Vexp[−τ2(c|λa−λb|λaλb)2]cosθ,(5)where V is the visibility and τ is the coincidence window.

As for Z-basis, QBERZ always have the same formula for |Ψ−⟩/|Ψ+⟩. In Figs. 3(c) and 3(d), we show the measured QBERX|Ψ−⟩ and QBERX|Ψ+⟩ (blue) as functions of time delays between Alice and Bob, which show the minimum close to 0.25 at the zero time delay. For Z-basis, the measured QBERZ|Ψ±⟩ (red) are close to zero, showing the high quality of our system. In Figs. 3(e) and 3(f), we vary the relative central wavelength between Alice’s and Bob’s lasers. Also, we show the results for QBERX|Ψ−⟩ and QBERX|Ψ+⟩ as functions of the relative wavelength, respectively. The experimental data (blue dots) agree well with the theoretical prediction (blue curves).

Although the full-recovery time of the detector determines the time-bin separation to be 12 ns, we can harness the time-multiplexed technique by inserting more pairs of time-bin pulses to enhance the key rate. This is particularly useful in high-loss communication applications. As shown in the insets of Fig. 4(a), we insert up to five bins within 12 ns with an equal temporal separation of 2 ns. By combining this time-multiplexed technique and optimal BSM, we enhance the sifted key rate by almost an order of magnitude. At the same time, these two techniques have little impact on QBERX and QBERZ, as shown in Fig. 4(b).

We demonstrate a complete MDI-QKD system including decoy states and phase randomization for guaranteeing the security13^–20^,52^,53 with our heterogeneously integrated, superconducting silicon-photonic platform. We use a four-intensity encoding protocol52 with three intensities (μ, ν, o) in the X-basis for decoy-state analysis and one intensity (s) in the Z-basis for key generation. Finite-key effects are considered in the secure-key-rate analysis with a failure probability of 10−10.54 For statistical fluctuations, we use the joint constraints where the same observables are combined and treated together52 (see Supplementary Material for details).

In this part of the experiment, we evenly insert two more pairs of time-bin qubits within 12 ns separation. Therefore, the effective clock rate of our system is tripled to 125 MHz (1/8 ns). The secure key rates for different losses are shown in Fig. 5. With the 125 MHz clock rate, we obtain the key rate of 6.166 kbps at the loss of 24.0 dB. This loss includes chip insertion loss ∼4.5dB. The actual transmission loss is about 19.5 dB, which corresponds to 98 km standard fiber. To the best of our knowledge, this is the highest secure key rate obtained experimentally with ∼20dB transmission loss in MDI-QKD, which is highly relevant in the context of a metropolitan quantum network without detector vulnerabilities. Furthermore, we obtain the secure key rates of 170 and 34 bps with total losses of about 35.0 and 44.0 dB. We emphasize that our secure key rates with the 125 MHz clocked system are very close to the best MDI-QKD experiments with a GHz clock rate.31^,56 In contrast with the GHz clock rate MDI-QKD experiments, our system does not require the complicated injection locking technique, which significantly reduces the complexity of the transmitter (see Table S1 in the Supplementary Material for detailed comparison).

We have demonstrated the first integrated relay server for MDI-QKD with a heterogeneous superconducting silicon-photonic chip. The excellent optical and electronic performance of this chip not only facilitates the experimental high-visibility HOM interference and low QBER, but also allows us to perform optimal BSM for time-bin qubits for the first time. Our work shows that integrated quantum-photonic chips provide not only a route to miniaturization but also significantly enhance the system performance more than traditional platforms. Our chip-based relay server can also be employed in twin-field QKD (TF-QKD),57 which can overcome the rate-distance limit of QKD without quantum repeaters. TF-QKD is indispensable in long-distance intercity communication links. Moreover, the chip-based relay server with the MDI-QKD protocol presented in this work could be an ideal solution for a scalable trust-node-free metropolitan quantum network. Using more advanced waveguide-integrated SNSPDs,45 one can further improve the integrated server with a high detection efficiency, low timing jitter, and high repetition rate. Combined with photonic-chip transmitters,31^,33 a fully chip-based, scalable, and high-key-rate MDI-QKD metropolitan quantum network should be realized in the near future.

Xiaodong Zheng is a PhD student working under the supervision of Xiao-Song Ma at the School of Physics of Nanjing University (NJU). Currently, he is working on superconducting nanowire single-photon detection and quantum key distribution.

Peiyu Zhang received her MS degree from NJU in 2020. Currently, she is working on optical communication.

Renyou Ge received his PhD from Sun Yat-sen University in 2021. Currently, he is working on integrated optical devices.

Liangliang Lu received his BS degree from Guangzhou University in 2009 and his PhD from NJU in 2015. He worked as a researcher at the School of Physics of NJU from 2017 to 2020 and joined the School of Physical Science and Technology at Nanjing Normal University in November 2020. His research area is integrated photonic quantum information processing, including quantum simulation, quantum key distribution, and nonlinear optics.

Guanglong He is a PhD student working under the supervision of Labao Zhang at the School of Electronic Science and Engineering of NJU. Currently, he is working on superconducting nanowire single-photon detectors.

Qi Chen is a PhD student working under the supervision of Labao Zhang at the School of Electronic Science and Engineering of NJU. Currently, he is working on superconducting nanowire single-photon detectors.

Fangchao Qu received his MS degree from NJU in 2020. Currently, he is working on integrated circuits.

Labao Zhang received his PhD from NJU, Nanjing, China, in 2010. He is currently a professor at NJU. His current research interests include the phenomena and the physics of nanostructured superconductors.

Xinlun Cai received his PhD in electrical and electronics engineering from the University of Bristol, Bristol, UK, in 2012. He is currently a professor at the School of Electronics and Information Technology, Sun Yat-sen University, Guangzhou, China. His research is mainly focused on optical communication and photonic integrated devices.

Yanqing Lu received his BS and PhD degrees from NJU, Nanjing, China, in 1991 and 1996, respectively. He has 5 years of experience in the U.S. and China telecom industries. He designed and developed a serial of liquid-crystal-based fiber-optic devices with his colleagues, which include variable optical attenuators, variable Mux/Demux, and DWDM wavelength blockers. He is currently a Changjiang distinguished professor at NJU. His research interests include liquid crystal photonics, nonlinear optics, and quantum optics.

Shining Zhu is a professor at the School of Physics and a principal investigator at the National Laboratory of Solid State Microstructures, NJU, Nanjing, China. He is an academician of the Chinese Academy of Sciences (CAS) and a fellow of Optical Society of America, Chinese Optical Society, and American Physical Society, respectively. His research interests include microstructured functional materials, nonlinear optics, laser physics, quantum communication, and integrated quantum optics.

Peiheng Wu received his PhD in physics from NJU, Nanjing, China, in 1961. He has been a professor at NJU, since 1985 and an academician at the CAS, Beijing, China, since 2005. From January 2001 to July 2001, he was a professor with RIEC, Tohoku University, Sendai, Japan. His research interests include superconducting electronics, high-frequency techniques, and their applications.

Xiao-Song Ma received his BS degree from NJU in 2003 and his PhD from the University of Vienna in 2010. He worked as a postdoc fellow at the University of Vienna and Yale University from 2010 to 2015. He joined the School of Physics at NJU as a professor in 2015. His research interests include quantum communication, quantum network, quantum simulation and computation, solid-state quantum memory, and integrated photonic quantum technologies.