Rate compatible reconciliation for continuous-variable quantum key distribution using Raptor-like LDPC codes

Quantum key distribution (QKD) pirandola2019advances ; RevModPhys.92.025002 ; diamanti2016practical enables two spatially separated parties—named Alice and Bob—for extracting a symmetrical string of secret keys using the fundamental properties of quantum mechanics. Currently, there are two mainstream schemes for QKD research, namely, discrete-variable QKD (DV-QKD)bennett2014quantum ; gisin2002quantum ; scarani2009security and continuous-variable QKD (CV-QKD) grosshans2002continuous ; grosshans2003quantum ; braunstein2005quantum ; weedbrook2012gaussian . In DV-QKD systems, the polarization or phase of a single-photon state is encoded by key information, whereas in CV-QKD systems, the amplitude and phase quadrature of quantum states are encoded. The CV-QKD system offers good application prospects for the implementation of classical telecom components, thus attracting considerable research attention. Research activities have primarily focused on extending the transmission distance and improving secret key rate between two parties in the CV-QKD systemsjouguet2013experimental ; Zhang_2019 ; zhang2020PRL ; GUO2021 .

A typical CV-QKD system consists of two phases. First, Alice prepares a quantum state and transmits it to Bob through a quantum channel; Bob uses a homodyne or heterodyne detector to measure the raw data. Second, both parties extract the secret key by performing postprocessing through a classical channel. In postprocessing, the information reconciliation step, particularly the performance of error correction, will limit the transmission distance and secret key rate of the system. Currently, commonly used reconciliation methods are slice reconciliation PhysRevA.90.042329 and multidimensional reconciliation leverrier2008multidimensional ; jouguet2011long . The slice reconciliation method is more suitable for short-distance transmission systems and can extract multiple bits of information from a single pulse. The multidimensional reconciliation method provides an effective way to correct low signal-to-noise ratio (SNR) Gaussian continuous variables using classical error correction codes zhaoshenmei ; baizengliang . Increased reconciliation efficiency, which can be achieved using near-Shannon-limit error correction codes with low rates in the information reconciliation step, is a technical challenge in extending transmission distance and improving secret key rate of CV-QKD systems milicevic2018quasi ; zhou2019 .

Multi-edge type low-density parity-check (MET-LDPC) codes richardson2002multi exhibiting low rates combined with the reverse multidimensional reconciliation scheme can achieve excellent correction performance in the CV-QKD system. The SNR of an optical quantum channel is low in such a long-distance transmission, thus requiring a low code rate and long code block length. For example, when the SNR is less than -15 dB, the code rate is less than 0.02 and the block length has an order of $10^{6}$ leverrier2009unconditional . However, designing a parity-check matrix with good performance is complex, and it is extremely complicated to design all matrices for different SNRs wang2017efficient . Therefore, to improve the reconciliation efficiency, the system must change the modulation variance at Alice’s side to ensure the receiving variables achieve the target SNR. The frame error rate and postprocessing speed must also be considered in the practical application of the CV-QKD system 9057665 ; li2020high . Multiple interactions and decoding steps of Alice and Bob in the information reconciliation step will increase system delay. This paper focuses on a method achieving good error correction performance that can be flexibly implemented in different scenarios in the practical system.

Further, we introduce Raptor-like LDPC (RL-LDPC) codes 6744572 into the CV-QKD system. These codes possess a rateless Raptor code property as well as good error correction performance of MET-LDPC codes under a low SNR. The raptor-like structure is important for providing rate compatibility and obtaining capacity-approaching performance, particularly at low code rates 7045568 ; LIU20151582 . The generator matrix of the Raptor codes is randomly generated; thus, it is impossible to remove all short cycles in the matrix, and the error correction performance is unstable. Unlike the Raptor codes 1638543 ; zhou2019 , the structure of each additional parity bit is explicitly designed through density evolution in the RL-LDPC codes. Currently, the RL-LDPC code is mainly used in wireless broadcast communications. We simply design a RL-LDPC code with a rate of 0.02 and adjust this code rate. Numerical results show good performance of the RL-LDPC codes, which are designed to meet the requirements of the practical CV-QKD system in real-time and realize high-speed processing in different application scenarios.

The remaining of this paper is organized as follows: In Sec. II, the structure of RL-LDPC codes is briefly introduced and its application to the postprocessing of the CV-QKD system is provided. In Sec. III, we describe the construction of low-rate RL-LDPC codes and realize rate compatibility. In Sec. IV, several simulations are performed to show the good performance of the RL-LDPC codes. Finally, the conclusions of this paper are summarized in Sec. V.

In this section, we introduce the RL-LDPC codes into the CV-QKD system. First, we provide additional details about the RL-LDPC codes. As the name implies, such codes are special LDPC codes with the structure of the Raptor code. Raptor codes are the first rateless codes with linear time encoding and decoding, and they have been used in several applications with large data transmissions. The RL-LDPC codes retain the characteristics of Raptor codes to some extent.

In this section, we show the construction of a low-rate RL-LDPC code. In the information reconciliation step of the CV-QKD system, the MET-LDPC codes are combined with multidimensional reconciliation owing to their capacity-approaching performance, particularly in the low code rate regime. First, we construct a base matrix of the RL-LDPC code with a rate of 0.02 based on the degree distribution of MET-LDPC codes.

Usually, parity-check matrices are used to represent MET-LDPC codes. The rows of matrices represent check nodes, and the columns represent variable nodes. Here, let $\mathbf{d}:=(d_{1},d_{2},...,d_{n_{e}})$ be a multi-edge degree, and let $\mathbf{x}:=(x_{1},x_{2},...,x_{n_{e}})$ denote (vector) variables. Each element $d_{i}$ of $\mathbf{d}$ indicates the number of edges of type $i$ incident to a node. The sum of these elements in $\mathbf{d}$ is referred to as the degree of $\mathbf{d}$. We use $\mathbf{x}^{\mathbf{d}}$ to denote $\prod_{i=1}^{n_{e}}x_{i}^{d_{i}}$. Two multivariate polynomials are used to determine the degree distribution of the MET-LDPC codes; they are as defined

where coefficient $\nu_{\mathbf{d}}$ ($\mu_{\mathbf{d}}$) is the proportion of variable nodes (check nodes) of the multi-edge degree $\mathbf{d}$. In eq.(2), $\nu(x)$ and $\mu(x)$ are called the degree distributions of variable and check nodes, respectively. The rate of MET-LDPC codes is expressed as

For an unpunctured ensemble, the sum of $\nu_{\mathbf{d}}$ is 1 and the sum of $\mu_{\mathbf{d}}$ is $1-R$. Here, the codeword length of the MET-LDPC codes is $N$, and $\nu_{\mathbf{d}}\times N$ ($\mu_{\mathbf{d}}\times N$) is the number of variables (check) nodes with edge type $\mathbf{d}$. The threshold of a code is defined as the maximum standard deviation of the noise channel that can be corrected when the code length is infinite and the maximum number of iterations is sufficiently large. The threshold can be estimated using the density evolution method. Table 1 presents the degree distributions for the MET-LDPC code rates of 0.05 and 0.02 wang2017efficient . The two MET-LDPC codes exhibit excellent error correction performance and are usually used in long-distance CV-QKD systems. The degree distributions possess three edge types, and the multinomial $\nu(x)$ ($\mu(x)$) can be partitioned into three (two) multinomials.

Next, we consider the MET-LDPC code in Table 1 as an example to design a RL-LDPC code, as shown in Figure 1. The code length $N$ is $10^{6}$. For convenience, we consider the submatrices $\mathbf{A}$ and $\mathbf{B}$ as one matrix, denoted by $\mathbf{AB}$, and $\mathbf{C}$ and $\mathbf{D}$ as one matrix, denoted by $\mathbf{CD}$. The base matrix of the RL-LDPC code can be obtained by concatenating the submatrices $\mathbf{AB}$, $\mathbf{CD}$, and $\mathbf{I}$. In this MET-LDPC code, there are large numbers of variable nodes with degrees of 1, which are represented by the degree distribution $\nu_{t3}(x)=0.96x_{3}^{1}$ and $\mu_{t3}(x)=0.96x_{3}^{1}$, corresponding exactly to the identity matrix $\mathbf{I}$, with a size of $960000\times 960000$. Thus, we only need to design $\mathbf{AB}$ and $\mathbf{CD}$ according to the multinomials. Ref. richardson2002multi shows that the concatenation of a high-rate code and a large number of single parity-check codes can achieve a threshold close to the Shannon limit. The submatrix $\mathbf{AB}$ comprising edge type-1 can be represented by the degree distribution $\nu_{t1}(x)=0.0225x_{1}^{2}+0.0175x_{1}^{3}$ and $\mu_{t1}(x)=0.010625x_{1}^{3}+0.009375x_{1}^{7}$. This matrix $\mathbf{AB}$ of size $20000\times 40000$ can also be expressed using the following polynomials according to its row and column weights:

The above equation shows that there are 22500 columns with a weight of 2, 17500 columns with a weight of 3, 10625 rows with a weight of 3, and 9375 rows with a weight of 7 in matrix $\mathbf{AB}$. Similarly, the submatrix $\mathbf{CD}$ comprising edge type-2 can be represented as

The random construction method PEG2005 can be employed to construct the parity-check matrices using the parameters of the above two matrices. Finally, we must concatenate the submatrices simply to achieve the base matrix with a code rate of 0.02. To obtain a high secret key rate in the long-distance CV-QKD system, high reconciliation efficiency under a low SNR is required. Reconciliation efficiency is a significant parameter for evaluating the performance of the information reconciliation step. In the CV-QKD system, reconciliation efficiency can be expressed as

where $R$ is the code rate, which equals $(N-M)/N$, $C(s)$ is the Shannon capacity, and $C(s)={1}/{2}\mathrm{log}(1+s)$ at SNR $s$ of the additive white Gaussian noise (AWGN) channel. From eq.(6), we know that one code with a fixed rate cannot maintain high reconciliation efficiency under different SNRs.

The introduced RL-LDPC codes exhibit rate compatibility similar to the Raptor codes. Figure 3 shows the method for generating different code rates using the designed base matrix. The same length of the base matrix is cut from the right and bottom sides, and the upper left corner of the base matrix is retained. The dotted lines represent the boundary of the target matrices. Assume that the punctured length is $p$; then, the code rate of the target matrix is modified by

Although rate compatibility can be easily achieved, the error correction performance of the target matrix is still a challenge. The code rate of the target matrix gradually increases as the base matrix is cut continuously, and its degree distribution also changes. The selection of the degree distribution is an important factor affecting the code performance; thus, the design of the submatrix $\mathbf{CD}$ must satisfy certain rules. In other words, after it is cut, the degree distribution will be changed according to a higher code rate than 0.02. In this work, we selected the code of rate as 0.05 in Table 1 for reference. Let ${\mu}^{\prime}_{t2}(x)$ denote the check node degree distribution of submatrix $\mathbf{CD}$ in reference codes. When the code rate of the target matrix gradually increases, ${\mu}^{\prime}(x)$ must satisfy

where ${\mu}^{\prime}(x)$ denotes the check node degree distribution of submatrix $\mathbf{CD}$ in target codes and $R_{t}$ is the rate of reference codes.

However, it can be seen from eq.(7) that puncture can only increase the code rate of the designed base matrix. When the SNR reduces, the error correction performance will deteriorate; thus, it is necessary to determine a way to reduce the code rate of the designed base matrix. Fortunately, we can simply reduce the code rate of the RL-LDPC codes and maintain promising performance. Figure 4 shows the schematic diagram of extending the base matrix. We must only fill in some data on the right and bottom sides of the designed base matrix. More simply, only the extended matrix $\mathbf{C^{\prime}}$ needs to be designed here. Assume the extended length is $e$; the code rate of the target matrix is modified by

In theory, ${\mu}^{\prime}(x)$ will change with an increase in $e$ according to eq.(8). A lower rate code than 0.02 should be selected as a reference, and ${\mu}^{\prime}_{t2}(x)$ denotes its degree distribution. At the time of writing this paper, no degree distribution of code rate less than 0.02 for long-distance CV-QKD systems has been reported and the focus of this paper is not to design it. Thus, we use $\mu_{t2}(x)$ to construct matrix $\mathbf{C^{\prime}}$. The code rate of the extended matrix is 0.016. Using the above simple steps, we can achieve matrices with code rates between 0.016 and 0.034 based on the designed RL-LDPC code.

In this section, we show the performance of the low rate RL-LDPC code in CV-QKD system. First, we simulate a Gaussian variable with different SNRs in the AWGN channel. Then, the error correction performance is analyzed based on the log-likelihood ratio belief propagation (LLR-BP) using multidimensional reconciliation. Here, we adopt an eight-dimensional reconciliation because it shows the highest performance compared with other dimensions (details for Appendix. A.1). Figure 5 shows the $\mathrm{FER}$ of the designed RL-LDPC code. From this figure, we can observe that with increasing $p$, when $\mathrm{FER}=10^{-2}$, the gap from the Shannon limit becomes larger, which implies that the error correction performance is worse. We can conclude that the performance of the smallest two submatrices tends to decrease further because when the size of the matrix becomes smaller, the length of the code becomes shorter as well as the degree distribution of the matrix changes. The error correction performance of the extended matrix with a code rate of 0.016 is slightly better than that of the base matrix, mainly because of the long code length of the former.

Figure 6 shows the $\mathrm{FER}$ performance of the RL-LDPC code at reconciliation efficiency $\beta=96\%$. Here, the LLR-BP decoding algorithm is employed using an eight-dimensional reconciliation method. Although the SNR fluctuates significantly, the decoding success rate of the RL-LDPC codes can still be kept stable. These codes can significantly reduce the complexity of constructing a matrix while maintaining the $\mathrm{FER}$ performance.

The decoding latency of the RL-LDPC code on the GPU platform is tested to meet the real-time processing requirements of the CV-QKD system. We use the parallel decoding method of ref. wang2018high00 on a single NVIDIA TITAN Xp GPU. Table 2 presents the test results for fore codes. The number of codewords refers to the number of code blocks decoded in parallel using the same block length and code rate. By reducing the maximum iterations, both the decoding speed and $\mathrm{FER}$ can be improved. The lower the SNR, the higher the required reconciliation efficiency. Therefore, low-rate codes need more iterations to be decoded. In comparison, the maximum iterations of high-rate code can be appropriately reduced to improve the decoding speed. For a submatrix with a code rate of 0.0304, the total number of edges is one-third less than that of the base matrix. Although more codewords can be processed simultaneously, the decoding speed cannot improve significantly. Thus, the decoding speed is linearly related to the number of iterations when the GPU memory is fully utilized.

In Ref. zhou2019 , it is shown that the optimal modulation variance can further improve the secret key rate. Our work also allows the system to maintain the optimal modulation variance without sacrificing the target SNR. According to eq.(1), the tradeoff between $\mathrm{FER}$ and $\beta$ is considered to obtain high secret key rate. Furthermore, we can use all the data to estimate the channel parameter and extract the secret keys Wang2019 .

Figure 7 shows the finite-size secret key rate of the designed RL-LDPC codes with the transmission distance. The eight triangles are the simulation results of seven designed matrices under different $\beta$. Here, we consider that the selection of $\mathrm{FER}$ and $\beta$ will maximize the results, and the block length is $10^{10}$. The yellow and blue triangles represent the extended matrix with a code rate of 0.016 at $\beta=96\%$ and $\beta=98\%$, respectively. Notably, the secret key rate can be extracted at high speed when the SNR is as low as 0.0226 (-16.45 dB). Although a high reconciliation efficiency is suitable for long distances, the low $\mathrm{FER}$ can significantly improve the secret key rate. The system repetition rate is not considered in this simulation result. Other experimental results jouguet2013experimental ; wang201525 ; huang2016long with the standard loss of a single-mode optical cable are also shown in Figure 7. Here, we also compared the key rate with the PLOB bound pirandola2017fundamental , i.e., the fundamental limit of repeaterless quantum communications. The RL-LDPC codes offer the advantages of practical applications in the CV-QKD system.

The practical application of the CV-QKD system is increasingly urgent and requires high -performance postprocessing, particularly in terms of reconciliation efficiency, frame error rate, and processing speed. Error correction steps are the key to restrict the above factors. This paper introduces RL-LDPC codes into the CV-QKD system. These codes exhibit the rateless property of Raptor codes as well as good error correction performance of MET-LDPC codes under a low SNR. We design the RL-LDPC matrix with a code rate of 0.02 and randomly select six target rates as reference. The seven designed matrices show positive performance and can meet the system requirements. Furthermore, our work allows the system to operate under the optimal modulation variance to improve the secret key rate. Our work can promote the application of the CV-QKD system in a practical environment.

In our work, we do not consider designing a matrix in the lower-triangular form to reduce encoding complexity because the improvement in encoding is not significant on the GPU platform. If the application is considered in a small integrated system, such as a field-programmable gate array platform, the lower-triangular form will be a good choice. Using quasi-cyclic codes to construct the RL-LDPC matrix can reduce memory usage and decoder implementation complexity.

This work was supported by the Key Program of National Natural Science Foundation of China (Grant No. 61531003), the National Natural Science Foundation of China (Grant No. 62001041), and the Fund of State Key Laboratory of Information Photonics and Optical Communications.