Private and secure communication is of fundamental importance in the modern world. Traditional public-key cryptography relies on the computational intractability of certain mathematical functions. In contrast, QKD 1 -which was proposed in the mid-1980s and is the best known example of a task involving quantum cryptography-provides an information-secure solution to the key exchange problem, ensured by the laws of quantum physics. QKD enables two distant users who do not initially share any information to produce a common, random string of secret bits, called a secret key. Using one-time-pad encryption, this key provides a provably secure 2 way of encrypting (and decrypting) a message, which can then be transmitted over a standard communication channel. In QKD, the information is encoded in the superposition states of physical carriers at the single-quantum level; as the fastest-travelling qubits, and owing to their intrinsic robustness to decoherence and the ease with which they can be controlled, photons are usually used as the physical carriers. Any eavesdropper on the quantum channel attempting to gain information about the key will inevitably introduce disturbances into the system, and so can be detected by the communicating users. Since the first table-top QKD experiment 3 in 1989, with a quantum channel distance of 32 cm, much research has been devoted to achieving secure QKD over long distances, with the ultimate aim being global-scale secure QKD for practical use. The most straightforward method of QKD is sending single photons through optical fibres or terrestrial free-space directly. However, in both of these cases channel loss causes a decrease in the number of transmitted photons that scales exponentially with the length over which they are transmitted. Unlike classical telecommunications, the quantum signal in QKD cannot be noiselessly amplified, owing to the quantum non-cloning theorem 4 , limiting the maximum distance for secure QKD to a few hundred kilometres 5 . Beyond this length scale, quantum communications become extremely challenging 6 . One solution to this problem is to use quantum repeaters 7 that combine entanglement swapping 8 , entanglement purification 9 and quantum memories 10 . But despite remarkable progress in demonstrations of the three building blocks 11-13 and even prototype quantum repeater nodes [14] [15] [16] [17] [18] , these laboratory technologies are still far from being applicable in practical long-distance quantum communications. A more direct and promising solution for global-scale QKD involves satellites in space. Compared with terrestrial channels, the satellite-to-ground connection has greatly reduced losses 19 . This is mainly because the effective thickness of the atmosphere is only about 10 km, and most of the propagation path of the photons is in empty space with negligible absorption and turbulence. A ground test 20 in 2004 demonstrated the distribution of entangled photon pairs over a noisy near-ground atmosphere of 13 km-greater than the effective thickness of the atmosphere-and showed the survival of entanglement and a violation of Bell's inequality. Under the simulated conditions of huge attenuation and various types of turbulence, the feasibility of satellite-based QKD has been further verified over even longer distances [21] [22] [23] , on rapidly moving platforms 24,25 and using satellite corner-cube retroreflectors 26, 27 . We developed a sophisticated satellite, 'Micius' , dedicated for quantum science experiments, which was successfully launched on 16 August 2016 from Jiuquan, China, and now orbits at an altitude of about 500 km ( Fig. 1a; see Methods for the project timeline and design details). Using one of the satellite payloads-a decoy-state QKD transmitter at a wavelength of 850 nm-and cooperating with Xinglong ground observatory station (near Beijing, 40° 23′ 45.12″ N, 117° 34′ 38.85″ E, altitude of 890 m), we establish decoy-state QKD with Quantum key distribution (QKD) uses individual light quanta in quantum superposition states to guarantee unconditional communication security between distant parties. However, the distance over which QKD is achievable has been limited to a few hundred kilometres, owing to the channel loss that occurs when using optical fibres or terrestrial free space that exponentially reduces the photon transmission rate. Satellite-based QKD has the potential to help to establish a global-scale quantum network, owing to the negligible photon loss and decoherence experienced in empty space. Here we report the development and launch of a low-Earth-orbit satellite for implementing decoy-state QKD-a form of QKD that uses weak coherent pulses at high channel loss and is secure because photon-number-splitting eavesdropping can be detected. We achieve a kilohertz key rate from the satellite to the ground over a distance of up to 1,200 kilometres. This key rate is around 20 orders of magnitudes greater than that expected using an optical fibre of the same length. The establishment of a reliable and efficient space-to-ground link for quantum-state transmission paves the way to globalscale quantum networks. © 2017 Macmillan Publishers Limited, part of Springer Nature. All rights reserved. 4 4 | N A t U r e | V O L 5 4 9 | 7 s e p t e m b e r 2 0 1 7 polarization encoding from the satellite to the ground with a kilohertz key rate over a distance of up to 1,200 km. Robust and efficient satellite-to-ground QKD places a more stringent requirement on the efficiency of the link than do conventional satellite-based classical communication systems. To obtain a high signal-to-noise ratio, one cannot increase the signal power, only reduce the channel attenuation and background noise. In our experiment, several effects contribute to channel loss, including beam diffraction, pointing error, atmospheric turbulence and absorption. In our QKD experiment, we adopt the downlink protocol-from the satellite to the ground (see Fig. 1a ). In the downlink, beam wandering caused by atmospheric turbulence occurs at the very end of the transmission path (near the surface of Earth), where the beam size due to diffraction is typically much larger than the beam wandering. Therefore, the downlink has reduced beam spreading compared to the uplink and thus higher link efficiency. The beam diffraction depends mainly on the size of the telescope. To narrow the beam divergence, we use a 300-mm-aperture Cassegrain telescope in the satellite (Fig. 1b) , optimized to eliminate chromatic and spherical aberrations; this telescope sends the light beam with a near-diffraction-limited far-field divergence of about 10 μ rad. After travelling a distance of 1,200 km, we expect that the beam diameter expands to about 12 m. At the ground station, a Ritchey-Chretien telescope with an aperture of 1 m and a focal length of 10 m (Fig. 1c ) is used to receive the QKD photons (see Methods). The diffraction loss is estimated to be 22 dB at 1,200 km. The narrow divergence beam from the fast-moving satellite (speed of about 7.6 km s −1 ) necessitates a high-bandwidth and high-precision acquiring, pointing and tracking (APT) system to establish a stable link. We designed cascaded multi-stage APT systems in the transmitter (Fig. 1b) and the receiver (Fig. 1c) . Initial coarse orientation of the telescope is based on the forecasted orbital position of the satellite, with an uncertainty of less than 200 m. The satellite's attitude control system ensures that the transmitter is pointing to the ground station with a precision of approximately 0.5°. The satellite and the ground station send beacon lasers to each other with a divergence of 1.25 mrad (satellite to ground) and 0.9 mrad (ground to satellite) (Fig. 2a) . The coarse pointing stage in the satellite transmitter consists of a two-axis gimbal mirror (with a range of 10° in both azimuth and elevation) and a complementary metal-oxide semiconductor (CMOS) camera with a field-of-view of 2.3° × 2.3° and frame rates of 40 Hz. The fine pointing stage uses a fast-steering mirror driven by piezo ceramics (with a tracking range of 1.6 mrad) and a camera with a field-of-view of 0.64 mrad × 0.64 mrad and frame rates of 2 kHz. Similar coarse and fine APT systems are also installed in the ground station (see Extended Data Table 1 for details). Using closed-loop feedback, the transmitter achieves a tracking accuracy of approximately 1.2 μ rad (Fig. 2b) , much smaller than the beam divergence. We estimate that at 1,200 km the loss due to atmospheric absorption and turbulence is 3-8 dB and that due to pointing error is less than 3 dB. . The Micius satellite, weighing 635 kg, flies along a Sun-synchronous orbit at an altitude of around 500 km. It is equipped with three payloads, designed and tested to be suitable for operation in low-Earth orbit and to enable a series of space-to-ground-scale quantum experiments including QKD, a Bell test and teleportation. b, Schematic of the decoy-state QKD transmitter, one of the satellite's payloads. Attenuated laser pulses (with wavelengths of about 850 nm) from eight separate laser diodes (LD1-LD8) pass through a BB84 encoding module, which consists of two polarizing beam splitters (PBSs), a half-wave plate (HWP) and a beam splitter (BS). The resultant beam is then co-aligned with a green laser beam (LA1; 532 nm) for system tracking and time synchronization, and sent out through a 300-mm-aperture Cassegrain telescope. After the BB84 module, an approximately 5-μ W laser is used as a polarization reference. A two-axis gimbal mirror (GM1) in the output of the telescope and a large-field-of-view camera (CAM1) are combined to control the coarse-tracking loop. Two fast steering mirrors (FSM1s) and a fast camera (CAM2) are used for fine tracking. ATT, attenuator; POL, polarizer; RLD, polarization reference laser diode; both cameras (CAM1 and CAM2) detect 671-nm light. c, Schematic of the decoy-state QKD decoder at the Xinglong ground station, which is equipped with a 1,000-mm-aperture telescope. The received 532-nmwavelength laser is separated by a dichromic mirror (DM) and split into two paths: one is imaged by a camera (CAM3, which detects 532-nm light) for tracking and the other is detected for time synchronization. The 850-nm-wavelength decoy-state photons are analysed by a BB84 decoder, which consists of a beam splitter and two polarizing beam splitters, and detected by four single-photon detectors (SPD1-SPD4 We use temporal and spectral filtering to suppress the background noise. The beacon laser, with a pulse width of 0.9 ns and a repetition rate of about 10 kHz, is used for both APT and synchronization. In good co-alignment with the QKD photons, the beacon laser can be separated by a dichroic mirror and detected by a single-photon detector in the ground station to obtain timing information. We thus avoid the space-ground clock drift, obtaining a synchronization jitter of 0.5 ns, which is used to tag the received signal photons within a 2-ns time window and filter out the background noise. In addition, we use a bandwidth filter in the receiver to reduce the background scattering. In the current experiment, we limit ourselves to night-time operation to avoid sunlight. Finally, the relative motion of the satellite and the ground station induces a time-dependent rotation of the photon polarization seen by the receiver. We predict theoretically that the polarization contrast ratio would decrease from 150:1 to 0 during one orbit (Fig. 2c) . To solve this problem, we calculate rotation angle offset by taking into account the relative motion of the satellite and the ground station and all of the birefringent elements in the optical path. Using a motorized half-wave plate for dynamical polarization compensation during the satellite passage, the average polarization contrast ratio increases to 280:1 (Fig. 2c) . We use the decoy-state 28,29 Bennett-Brassard 1984 (BB84) 1 protocol for QKD, which can detect photon-number-splitting eavesdropping and thus enable secure QKD using weak coherent pulses over very large distances and with very high key rates. The main idea is to use multiple intensity levels at the source of the transmitter: one signal state (the mean photon number μ s ) and several randomly interspersed decoy states (μ 1 , μ 2 , …). Here we use a protocol with three intensity levels: high μ s , moderate μ 1 and zero μ 2 (vacuum), sent with probabilities of 50%, 25% and 25%, respectively. These intensity levels are optimized by performing simulations to maximize the secret bit rate for the satellite-to-ground channel. For downlink QKD, a transmitter (designed and tested to be suitable for operation in low-Earth orbit) is integrated in the satellite (see Fig. 1b ). Eight fibre-based laser diodes-four used as signal and four as decoy states-emit laser pulses (848.6 nm, 100 MHz, 0.2 ns). The output power of the eight laser didoes is monitored in real time by internal integrated photodetectors and controlled remotely by closedloop systems, which precisely set the required intensity of the signal and decoy states and stabilize with less than 5% variation. In-orbit measurements show that with independent temperature tuning of the eight lasers their wavelengths are matched to within 0.006 nm, much smaller than their intrinsic bandwidth (about 0.1 nm). The lasers are synchronized to be within < 10 ps, much smaller than their pulse duration of around 200 ps. The output beams are coaligned to ensure that both concentricity and coaxiality are better than 95%. The light beams are then sent to a BB84-encoding module consisting of a half-wave plate, two polarizing beam splitters and a beam splitter, which randomly prepares the emitted photons in one of the four polarization states: horizontal, vertical, linear + 45° or linear − 45°. A physical thermal noise device generates a 4-bit random number for each run that drives the eight lasers and determines the output polarization and intensity levels. Independent electric control of the eight lasers and adjustment of the attenuation allow us to accurately obtain the average photon number in the output of the telescope: μ s = 0.8, μ 1 = 0.1 and μ 2 = 0. In the ground station, a compact decoding set-up consisting of a beam splitter, two polarizing beam splitters and four single-photon detectors (efficiency, 50%; dark counts, < 25 Hz; timing jitter, 350 ps) is used for polarization-state analysis (see Fig. 1c and Methods). The overall optical efficiency, including the receiving telescope and the fibre coupling on the ground station, is approximately 16%. The satellite uses a radio-frequency channel for classical communication with the ground station (with an uplink and downlink bandwidth of 1 Mbit s , respectively), and its experimental control-box payload to perform the sifting, error correction and privacy amplification. The satellite passes Xinglong ground station along a Sunsynchronous orbit once every night starting at around 00:50 local time, for a duration of about 5 min. About 10 min before the satellite enters the shadow zone, its attitude is adjusted to point at the ground station. When the satellite exceeds an elevation angle of 5° from the horizon (shown as the number of detected events normalized by the maximum count in each bin) of the X and Y axes extracted from the real-time images read out from the fast camera. c, Polarization contrast ratio with (corresponding to our experiment) and without (determined theoretically) dynamical compensation during one orbit. © 2017 Macmillan Publishers Limited, part of Springer Nature. All rights reserved. 4 6 | N A t U r e | V O L 5 4 9 | 7 s e p t e m b e r 2 0 1 7 plane of the ground station, a pointing accuracy of better than 0.5° is achieved. The APT systems then start bidirectional tracking and pointing to guarantee that the transmitter and receiver are robustly locked throughout the orbit. From an elevation angle of about 15°, the QKD transmitter sends randomly modulated signal and decoy photons, together with the beacon laser for timing synchronization, which are received and detected by the ground station. A single-orbit experiment ends when the satellite again reaches an elevation angle of 10°, this time on its descent (see Methods). Since September 2016, we have routinely been able to successfully perform QKD under good atmospheric conditions. In Fig. 3a we show the data for the orbit on 19 December 2016, with a minimal (maximal) separation of 645 km (1,200 km). Within a duration of 273 s for the QKD data collection, the ground station collected 3,551,136 detection events, corresponding to 1,671,072 bits of sifted keys (see Fig. 3b ). The sifted key rate decreases from about 12 kbit s −1 at 645 km to 1 kbit s −1 at 1,200 km, owing to the increase both in the physical separation distance and in the effective thickness of the atmosphere near Earth at smaller elevation angles. The time trace of the sifted key rate in Fig. 3b demonstrates that we are reliably able to obtain the keys throughout the duration of the data collection. However, more pronounced fluctuation in the key rate is observed near the central points of the orbit, when the satellite passes directly over the ground station and its effective angular velocity reaches its maximum (about 1° s ), thus placing stringent demands on the APT system. In Fig. 3c we show the observed quantum bit error rate, with an average of 1.1%, consistent with the expected error rate due to background noise and polarization visibility. The quantum bit error rates are slightly higher in the second half of the orbit, when the ground telescope faces towards Beijing and so there is more background light from the city. We then perform error correction and privacy amplification to obtain the final keys. After randomly shuffling the sifted key, a hamming algorithm is used for error correction. We perform privacy amplification to reduce the possible knowledge of an eavesdropper by applying a random matrix over the corrected keys. Moreover, we take into account the intensity fluctuations for the signal and decoy states (< 5%) and, when the statistical failure probability is set to 10 24, 25 , here the key analysis does not consider information leakage due to possible side channels from the imperfect spatial, temporal and spectral overlap of the quantum light sources. The use of multiple laser diodes for different (signal and decoy) states and intensities can cause small (a few per cent here), non-ideal state overlap, which can be straightforwardly mitigated in future work by using narrowband spectral filtering or by adopting decoy-state QKD transmitters with only a single laser diode and modulating the created state externally. The QKD experiments performed on 23 different days, with different physical distances between the satellite and the ground station, are summarized in Extended Data Table 2 and Extended Data Fig. 1 . The shortest satellite-to-station distance depends on the highest altitude angle of the day, and varies from 507.0 km at 85.7° to 1,034.7 km at 25.0°. The sifted key that is obtained has a peak key rate of 40.2 kbit s −1 at 530 km and decreases for larger distances, for instance to 1.2 kbit s −1 at 1,034.7 km. From Extended Data Fig. 1 , we also observe the fluctuation in the key rate due to different weather conditions. The quantum bit error rates are measured to be 1%-3%. We compare the performance of our satellite-based QKD with that expected from the conventional method of direct transmission through optical telecommunication fibres. In Fig. 4 we show the link efficiency over distances of 645-1,200 km extracted from the observed count rate, together with theoretically calculated link efficiency assuming fibres with loss of 0.2 dB km −1 . Despite the short coverage time using the Micius satellite (273 s per day) and the need for reasonably good weather conditions, we observe an enhancement in efficiency compared to telecommunication fibres, which increases for larger distances; at 1,200 km, the channel efficiency of the satellite-based QKD over the 273-s coverage time is 20 orders of magnitudes higher than that achieved using the optical fibre. As a comparison with our data in Fig. 3b , over a distance of 1,200 km, even with a perfect 10-GHz single-photon source and ideal single-photon detectors with no dark count, transmission through optical fibres would result in only a 1-bit sifted key over six million years. We have reported satellite-to-ground quantum communication over a distance scale of 1,200 km. Our satellite can be further used as a Table 2 and Extended Data Fig. 1 for additional data on different days. © 2017 Macmillan Publishers Limited, part of Springer Nature. All rights reserved. 7 s e p t e m b e r 2 0 1 7 | V O L 5 4 9 | N A t U r e | 4 7 reliable relay to conveniently connect any two points on Earth for highsecurity key exchange. For example, we can first implement QKD in Xinglong, after which the key is stored in the satellite for 2 h until it reaches Nanshan station near Urumqi, a distance of about 2,500 km from Beijing. By performing another QKD between the satellite and the Nanshan station and using one-time-pad encoding, a secure key between Xinglong and Nanshan can be established. Future experimental plans include intercontinental secure-key exchanges between China and Austria, Italy and Germany. Thus far, the shortcomings of the low-Earth-orbit satellite are limited coverage area and amount of time spent within range of each ground station. To increase the coverage, we plan to launch satellites with higher orbits and to construct a satellite constellation, requiring the development of new techniques to increase the link efficiency, including larger telescopes, better APT systems and wave-front correction through adaptive optics. However, higher-orbit satellites will spend less time in Earth's shadow; daytime QKD can be implemented using telecommunication-wavelength photons and improved spatial and spectral filtering 30 . The satellite-based QKD can be linked to metropolitan quantum networks, in which fibres are sufficient and convenient to connect numerous users in a city over distance scales of approximately 100 km (ref. 31). We thus envision a space-ground integrated quantum network, enabling useful quantum cryptography-probably the first commercial application of quantum information-at the global scale. Online Content Methods, along with any additional Extended Data display items and Source Data, are available in the online version of the paper; references unique to these sections appear only in the online paper.
In REF , a satellite-to-ground QKD system over 1,200 kilometres has been demonstrated.
Satellite‐to‐ground quantum key distribution
Nature
Physics Medicine