# Passive decoy-state quantum secure direct communication with heralded
single-photon source

Jia-Wei Ying,1,2 Peng Zhao,1,2 Wei Zhong,2 Ming-Ming Du,1, Xi-Yun Li,3, Shu-
Ting Shen,1 An-Lei Zhang,3 Lan Zhou,3<EMAIL_ADDRESS>Yu-Bo Sheng1,2
<EMAIL_ADDRESS>1College of Electronic and Optical Engineering and
College of Flexible Electronics (Future Technology), Nanjing University of
Posts and Telecommunications, Nanjing, 210023, China
2Institute of Quantum Information and Technology, Nanjing University of Posts
and Telecommunications, Nanjing, 210003, China
3College of Science, Nanjing University of Posts and Telecommunications,
Nanjing, 210023, China

###### Abstract

Quantum secure direct communications (QSDC) can directly transmit secret
messages through quantum channel without keys. The imperfect photon source is
a major obstacle for QSDC’s practical implementation. The unwanted vacuum
state and multi-photon components emitted from imperfect photon source largely
reduce QSDC’s secrecy message capacity and even threaten its security. In the
paper, we propose a high-efficient passive decoy-state QSDC protocol with the
heralded single-photon source (HSPS). We adopt a spontaneous parametric down-
conversion source to emit entangled photon pairs in two spatial modes. By
detecting the photons in one of the two correlated spatial modes, we can infer
the photon number distribution of the other spatial mode. Meanwhile, our
protocol allows a simple passive preparation of the signal states and decoy
state. The HSPS can effectively reduce the probability of vacuum state and
increase QSDC’s secrecy message capacity. Meanwhile, the passive decoy-state
method can simplify the experimental operations and enhance QSDC’s robustness
against the third-party side-channel attacks. Under the communication distance
of 10 km, the secrecy message capacity of our QSDC protocol can achieve 81.85
times (average photon number of 0.1) and 12.79 times (average photon number of
0.01) of that in the original single-photon-based QSDC protocol without the
HSPS. Our QSDC protocol has longer maximal communication distance (about
17.975 km with average photon number of 0.01). Our work serves as a major step
toward the further development of practical passive decoy-state QSDC systems.

††preprint: APS/123-QED

##  I Introduction

Quantum communication has emerged as a promising avenue, owing to its
unconditional security guaranteed by the principles of quantum mechanics. The
pioneering quantum communication protocol, known as quantum key distribution
(QKD) [1, 2], which can share random keys between two distant users. Over the
past years, QKD has achieved significant advancements in both theoretical [3,
4, 5, 6, 7, 8, 9] and experimental aspects [10, 11, 12, 13]. Another
remarkable branch of quantum communication is the quantum secure direct
communication (QSDC), which was first proposed by Long [14]. Unlike QKD, QSDC
allows the direct transmission of secure messages without sharing keys in
advance. In 2003 and 2004, entanglement-based (two-step QSDC) and single-
photon-based (DL04) QSDC protocols were proposed [15, 16]. The two-step QSDC
protocol utilizes dense coding method, which can transmit two bits of messages
with one pair of entangled Bell state. The DL04 QSDC protocol can transmit one
bit of message using a single photon. QSDC also has gained significant
development in recent years [17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28,
29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39]. The DL04 QSDC protocol and two-
step QSDC protocol were realized in experiment in 2016 and 2017, respectively
[18, 19]. Later, some important QSDC experiments have been reported, such as
the QSDC network experiment [27], 100km fiber QSDC experiment [29], and
continuous-variable QSDC experiment [33]. In the theoretical aspect, the
device-independent (DI) QSDC protocol and measurement-device-independent (MDI)
QSDC protocol have been proposed to resist the potential attacks focusing on
imperfect experimental equipment [21, 22, 35]. Recently, one-step QSDC based
on polarization-spatial-mode hyperentanglement was proposed [28]. Compared to
traditional two-step QSDC, the one-step QSDC protocol requires only one round
of photon transmission, which can simplify the experimental operation and
significantly reduce the message loss caused by the photon transmission loss.
Later, the DI one-step QSDC protocol [30] and MDI one-step QSDC protocol [31]
were successively proposed, which can enhance one-step QSDC’s security under
practical experimental condition.

Single-photon source plays an important role in both QKD and QSDC [1, 16].
Unfortunately, ideal single-photon source is not available under current
experimental conditions. Current available single-photon source is the phase
randomized weak coherent pulse (WCP) source, which can emit vacuum state,
single-photon state, and multi-photon state with different probabilities.
Imperfect single-photon source not only decreases the communication efficiency
of quantum communication, but also introduces security loophole. An
alternative approach is to use the device-independent (DI) type protocols,
i.e., DI-QKD protocols [3, 40, 41, 42] and DI-QSDC protocols [21, 30, 34].
However, these protocols are limited by the short communication distances.
Moreover, they are also hard to realize in experiment. DI-QKD has been
experimentally demonstrated until 2022 [43, 44, 45] and DI-QSDC has not
obtained experimental demonstration yet. Another alternative approach is to
use the heralded single-photon source (HSPS) [46, 47, 48, 49, 50, 51, 52].
Suppose a spontaneous parametric down-conversion (SPDC) source emits entangled
photon pairs in two spatial modes. By detecting the photons in one of the two
correlated spatial modes, it is possible to infer the photon number statistics
of the other spatial mode. This approach can significantly reduce the
probability of the vacuum state occurrence. Furthermore, the multi-photon
components in the WCP may provide the eavesdropper (Eve) an opportunity to
exploit the photon number splitting (PNS) attack [53, 54]. Fortunately, the
PNS attack in QKD and QSDC can be effectively resisted by the decoy-state
methods [55, 56, 57, 58, 59]. However, the decoy-state method necessitates
active modulation of light intensity, which could potentially be exploited by
Eve for a side-channel attack. Passive schemes are more resistant to side-
channel attacks than active systems [60, 61, 62, 63]. In the passive schemes,
two phase-randomized WCPs interfere at a beam splitter (BS), which makes the
photon number statistics of the outcome signals classically correlated. By
measuring one of the two outcome signals of the BS, we can passively obtain
the conditional photon number distribution of the other signal mode.

In this paper, we introduce the passive decoy-state method and the HSPS into
the single-photon-based QSDC, and propose a passive decoy-state QSDC protocol
with the HSPS. Comparing with the original DL04 QSDC protocol with the WCP
source, this passive decoy-state QSDC protocol has two attractive advantages.
First, using the passive decoy-state method, this QSDC protocol has strong
robustness against the side-channel attack. Second, with HSPS, this protocol
can largely reduce the influence from the vacuum state, and thus the secrecy
message capacity and maximal communication distance can be increased. This
paper is organized as follows. In Sec. II, we explain the passive decoy-state
QSDC protocol with the HSPS in detail. In Sec. III, we analyze its secrecy
message capacity under practical experimental conditions in theory and perform
the numerical simulation. In section IV, we provide a conclusion.

##  II The passive decoy-state QSDC protocol with the HSPS

Figure 1: The structure of the passive decoy-state QSDC protocol with the
HSPS. In the diagram, the yellow lines represent the spatial pathes of the
photons, while the orange lines represent the quantum channels used for
communication. The red lines indicate the input laser, which is used as a
source to pump a nonlinear crystal or a calibration tool to assist Alice’s and
Bob’s memory devices to store photons. The black lines represent the detector
response signals, which prompt Alice or Bob to perform a series of operations,
including encoding, decoding, storing, and sending the indication laser.
Overall, this process involves two rounds of security checking to ensure the
security and integrity of the transmitted messages.

In this section, we explain our passive decoy-state QSDC protocol with the
HSPS. As shown in Fig. 1, the passive decoy-state QSDC protocol can be
described as follows.

Step 1: The message receiver Bob passes a WCP in $|H\rangle$ to pump an SPDC
crystal, splitting a single photon to two correlated photons in $|HH\rangle$
probabilistically. One photon is in the heralded path and the other photon is
in the signal path. The photon in the heralded path passes through a $t:(1-t)$
BS and the output photon will be detected by two photon detectors $D_{1}$ and
$D_{2}$. In this way, the responses of $D_{1}$ and $D_{2}$ will herald the
existence of the photon in the signal path. When only $D_{1}$ or $D_{2}$
responds, the pulse in the signal path will be used as signal states. When
$D_{1}$ and $D_{2}$ both respond, the pulse in the signal path will be used as
the decoy state. When neither $D_{1}$ nor $D_{2}$ clicks, the pulse in the
signal path would be discarded.

Step 2: Based on the detector responses, Bob performs the randomly encoding
operation to generate one of the four polarization states, i. e., $|H\rangle$,
$|V\rangle$, $|+\rangle$, $|-\rangle$. Here, $|H\rangle$ (horizontal
polarization) and $|V\rangle$ (vertical polarization) belong to the
rectilinear (Z) basis and $|+\rangle=\frac{1}{\sqrt{2}}(|H\rangle+|V\rangle)$
and $|-\rangle=\frac{1}{\sqrt{2}}(|H\rangle-|V\rangle)$ belong to the diagonal
(X) basis. Bob sends the randomly encoded signal photons and decoy-state
photons to the message sender Alice through the quantum channel.
Simultaneously, Bob also sends an indication laser pulse to prompt Alice to
perform the storage operation.

Step 3: Alice stores the signal states and decoy states in the quantum memory
if she receives the indication laser pulse. Then, she performs the first round
of security checking, which is similar as that of the decoy-state QKD
protocols [55, 56]. After the security checking, the communication parties
calculate the quantum bit error rate $E1$. If $E1$ is below the tolerate
threshold, the communication continues. Otherwise, the parties have to discard
the communication.

Step 4: Alice extracts the remaining signal photons from the quantum memory
and encodes her messages by performing $I$ or $Y$ operation on each photon,
where $I=|H\rangle\langle H|+|V\rangle\langle V|$ and
$Y=i\sigma_{y}=|H\rangle\langle V|-|V\rangle\langle H|$. $I$ and $Y$ represent
the classical messages 0 and 1, respectively. Meanwhile, Alice also randomly
encodes a part of photons as the second round of security checking photons.
After encoding, Alice sends all the encoded photons to Bob through the quantum
channel. Meanwhile, she sends a new indication laser pulse to ask Bob to
receive the signal states.

Step 5: After receiving the transmitted photons, Bob stores the photons in
quantum memory and Alice announces the positions and encoding operations of
the security checking photons. Bob extracts the security checking photons and
measures them with the same basis as he prepared the initial photons. After
the measurement, Bob calculates the quantum bit error rate $E2$ combined with
Alice’s announcement and his initial photon states. If $E2$ is below the
threshold, the communication continues. Otherwise, the parties have to discard
the communication.

Step 6: Bob extracts the remaining signal photons from the quantum memory and
measures the photons with the same basis in which he prepared the initial
photons. After the measurements, Bob can deduce Alice’s operation by comparing
the initial quantum state and the encoded quantum state, and thus obtain
Alice’s transmitted messages.

As shown in Fig. 1, in step 1, we suppose that the SPDC source emits two
photon pulses in the signal path and heralded path with the probability of
$P_{\mu}(k)$, which satisfies the Poisson distribution ($\mu$ is the average
photon number) [64, 65, 66]. There are four possible combinations of detector
responses after the photons in the heralded path passing through the $t:(1-t)$
BS. We note them as four events $x_{i}$ $(i=1,2,3,4)$, where
$x_{1}=\bar{D}_{1}\bar{D}_{2}$, $x_{2}=D_{1}\bar{D}_{2}$,
$x_{3}=\bar{D}_{1}D_{2}$, $x_{4}=D_{1}D_{2}$. $D_{j}$ represents the photon
detector $D_{j}$ has a response and $\bar{D}_{j}$ represents that the detector
$D_{j}$ has no response. We define $\gamma_{x_{i}}(k)$ as the probability of
$k$ photons in the heralded path leading to the event $x_{i}$. Hence, in the
signal path, the photon number distribution function $q_{x_{i}}(n)$ after the
heralded generation is

$\displaystyle q_{x_{i}}(n)$ $\displaystyle=$
$\displaystyle\sum_{k=n}^{\infty}P_{\mu}(k)\gamma_{x_{i}}(k)S(k,n),$
$\displaystyle P_{\mu}(k)$ $\displaystyle=$ $\displaystyle
e^{-\mu}\frac{\mu^{k}}{k!},$ $\displaystyle S(k,n)$ $\displaystyle=$
$\displaystyle C^{n}_{k}\eta_{x}^{n}(1-\eta_{x})^{k-n}.$ (1)

Here, $S(k,n)$ is the probability that the emitted $k$ photons turn to $n$
photons due to the photon loss with the transmission efficiency of $\eta_{x}$.
This process can be understood as the source emits $k$ photons which are
successfully detected in the heralded path. Then, after a series of losses,
the photon number in the signal path is reduced to $n$.

$\gamma_{x_{i}}(k)$ ($i=1,2,3,4$) varies depending on the responses of the
detectors, which is shown as

$\displaystyle\gamma_{x_{1}}(k)$ $\displaystyle=$
$\displaystyle(1-d_{1})(1-d_{2})f^{k},$ $\displaystyle\gamma_{x_{2}}(k)$
$\displaystyle=$ $\displaystyle(1-d_{2})f_{1}^{k}-\gamma_{x_{1}}(k),$
$\displaystyle\gamma_{x_{3}}(k)$ $\displaystyle=$
$\displaystyle(1-d_{1})f_{2}^{k}-\gamma_{x_{1}}(k),$
$\displaystyle\gamma_{x_{4}}(k)$ $\displaystyle=$ $\displaystyle
1-\gamma_{x_{1}}(k)-\gamma_{x_{2}}(k)-\gamma_{x_{3}}(k).$ (2)

Here $f$, $f_{1}$ and $f_{2}$ represent the photon loss probabilities in the
heralded path, while $d_{1}$ ($d_{2}$) is the dark count rates of Alice’s
detector $D_{1}$ ($D_{2}$).

We define the coefficients $\eta_{h}$ as the transmission efficiency in the
heralded path, and define $\eta_{1}$ ($\eta_{2}$) as the detection efficiency
of the detector $D_{1}$ ($D_{2}$). In this way, we can obtain $f$, $f_{1}$ and
$f_{2}$ as

$\displaystyle f$ $\displaystyle=$
$\displaystyle\eta_{h}[t(1-\eta_{1})+(1-t)(1-\eta_{2})]+1-\eta_{h},$
$\displaystyle f_{1}$ $\displaystyle=$
$\displaystyle\eta_{h}[1-(1-t)\eta_{2}]+1-\eta_{h},$ $\displaystyle f_{2}$
$\displaystyle=$ $\displaystyle\eta_{h}(1-t\eta_{1})+1-\eta_{h}.$ (3)

By substituting the parameters in Eq. (2) and Eq. (3) into Eq. (II), we can
further derive $q_{x_{i}}(n)$ $(i=1,2,3,4)$ as

$\displaystyle q_{x_{1}}(n)$ $\displaystyle=$
$\displaystyle(1-d_{1})(1-d_{2})\frac{(\mu\eta_{x}f)^{n}}{n!}e^{\mu[f(1-\eta_{x})-1]},$
$\displaystyle q_{x_{2}}(n)$ $\displaystyle=$
$\displaystyle(1-d_{2})\frac{(\mu\eta_{x}f_{1})^{n}}{n!}e^{\mu[f_{1}(1-\eta_{x})-1]}-q_{x_{1}}(n),$
$\displaystyle q_{x_{3}}(n)$ $\displaystyle=$
$\displaystyle(1-d_{1})\frac{(\mu\eta_{x}f_{2})^{n}}{n!}e^{\mu[f_{2}(1-\eta_{x})-1]}-q_{x_{1}}(n),$
$\displaystyle q_{x_{4}}(n)$ $\displaystyle=$
$\displaystyle\frac{(\mu\eta_{x})^{n}}{n!}e^{-\mu\eta_{x}}-q_{x_{1}}(n)-q_{x_{2}}(n)-q_{x_{3}}(n).$
(4)

Here, the detector response $x_{1}$ indicates the heralded failure. In this
case, Bob will discard the photon pulse in the signal path, so that
$q_{x_{1}}(n)$ should also be discarded. The detector responses $x_{2}$ and
$x_{3}$ enable Bob to obtain two different distributed signal states
$q_{x_{2}}(n)$ and $q_{x_{3}}(n)$ in the signal path. If the detector response
$x_{4}$ is obtained, the pulse in the signal path is used as the decoy state.
It can be found that by adopting the heralded generation method, the ratio
corresponding to the vacuum state event in the signal path can be greatly
reduced, which can effectively reduce the influence of the dark count on the
photon number distribution in the signal path.

##  III Security analysis

###  III.1 The theoretical secrecy message capacity of the single-photon-based
QSDC

According to the Wyner’s wiretap channel theory [67], the secrecy message
capacity of the single-photon-based QSDC can been calculated as

$\displaystyle C_{s}=\max_{P_{A}}\\{I(A:B)-I(A:E)\\},$ (5)

where $I(A:B)$ is the mutual information between Alice and Bob, and $I(A:E)$
is the mutual information between Alice and Eve. We define $P_{A}$ as the
probability distribution of Alice’s encoding operations. In general, we
consider the case that the messages 0 and 1 sent by Alice are equally
distributed, that is, $P(A0)=P(A1)=0.5$.

In the single-photon-based QSDC protocol, two rounds of quantum transmission
are needed. We denote the photon transmission from Bob to Alice as BA, and the
photon transmission from Bob to Alice and then back to Bob after Alice’s
encoding as BAB. $I(A:B)$ can be calculated as

$\displaystyle I(A:B)=Q_{\mu}^{BAB}[1-h(E_{\mu}^{BAB})],$ (6)

where $Q_{\mu}^{BAB}$ is the overall gain of a photon traveling from Bob to
Alice and then back to Bob, and $E_{\mu}^{BAB}$ is the total QBER after two
rounds of photon transmission. The function $h(x)$ is the binary Shannon
entropy with the form of $h(x)=-x\log_{2}(x)-(1-x)\log_{2}(1-x)$.

The mutual information $I(A:E)$ between Alice and Eve can be considered as the
message leakage rate through imperfect quantum channels and devices. Due to
the inherent characteristics of QSDC, Eve can steal the encoded messages only
when he can steal the corresponding photons in both photon transmission
processes. If Eve only steals some encoded photons in the second round of
photon transmission, he is unable to decode the encoded messages without
knowing the initial quantum states of the photons. Consequently, Eve’s message
interception rate is upper bounded by his photon interception rate in the
first photon transmission round.

For Eve, there are many strategies he can adopt to maximize his photon
interception rate. We first consider the one-photon case, say, the signal
pulse contains exactly one photon. Here, we consider a common approach, say,
the collective attack, which has been considered in many works [68, 69, 58].
In the collective attack, Eve sets up an auxiliary quantum system and makes a
joint operation on his intercepted photon and the auxiliary system. It is
generally assumed that Eve can perform an optimal unitary operation to
maximize the amount of messages he can steal. According to Holevo’s theorem
[70], we can deduce that the maximal photon interception rate that Eve can
obtain from a single photon pulse is $h(e_{X}^{BA}+e_{Z}^{BA})$, where
$e_{X}^{BA}$ and $e_{Z}^{BA}$ represent the error rates in the X-basis and
Z-basis after the first photon transmission process, respectively. From the
analysis in Ref. [58], if the signal pulse contains two or more photons, Eve
can perform the PNS attack and the collective attack. In detail, when the
signal pulse contains two photons, Eve steals one photon with the PNS attack,
and performs collective attack on the other photon. The maximal message
interception rate that Eve can obtain from the two photon pulse can be
calculated as $\frac{1}{2}h(2e_{2}^{BA})+\frac{1}{2}$ with the Holevo bound.
When the signal pulse contains three or more photons, the photons emitted by
Bob can be unambiguously discriminated by Eve [71], and thus the encoded
messages can be completely stolen. As a result, $I(A:E)$ can be calculated as

$\displaystyle I(A:E)$ $\displaystyle=$
$\displaystyle\sum_{n=0}^{\infty}Q_{\mu,n}^{BAE}*H_{n}$ (7) $\displaystyle=$
$\displaystyle
Q_{\mu,n=1}^{BAE}*h(2e_{1}^{BA})+Q_{\mu,n=2}^{BAE}*[\frac{1}{2}h(2e_{2}^{BA})$
$\displaystyle+\frac{1}{2}]+Q_{\mu,n\geq 3}^{BAE}*1,$

where $Q_{\mu,n}^{BAE}$ is the gain of the n-photon event from Eve, and
$H_{n}$ is the contribution of the n-photon event to $I(A:E)$. The 1-photon
event’s contribution for $H_{n}$ is $h(e_{X}^{BA}+e_{Z}^{BA})$. Here, we
assume that $e_{X}^{BA}$=$e_{Z}^{BA}$=$e_{1}^{BA}$. $e_{2}^{BA}$ represents
the total error rate after the first photon transmission caused by the
2-photon event.

In this way, we can obtain the secrecy message capacity as

$\displaystyle C_{s}$ $\displaystyle=$ $\displaystyle
Q_{\mu}^{BAB}[1-h(E_{\mu}^{BAB})]-\\{Q_{\mu,n=1}^{BAE}*h(2e_{1}^{BA})+$ (8)
$\displaystyle
Q_{\mu,n=2}^{BAE}*[\frac{1}{2}h(2e_{2}^{BA})+\frac{1}{2}]+Q_{\mu,n\geq
3}^{BAE}*1\\}.$

###  III.2 System Model

In order to analyze the secrecy message capacity of our passive decoy-state
QSDC protocol with the HSPS, we establish a QSDC system simulation model
including the source, channel, detector, and yield.

As shown in Sec. II, Eq. (II) provides the photon number distributions of two
signal sources ($q_{x_{2}}$ and $q_{x_{3}}$) and a decoy state source
($q_{x_{4}}$). The channel transmission efficiency is shown as

$\displaystyle t^{chan}$ $\displaystyle=$ $\displaystyle
10^{-\frac{\alpha^{chan}}{10}},$ (9)

where $\alpha^{chan}$ is the loss of quantum channel and
$chan\in\\{BA,BAB\\}$.

In this situation, the overall transmission efficiency $\eta^{chan}$ of the
signal state and decoy state can be expressed as

$\displaystyle\eta^{chan}$ $\displaystyle=$ $\displaystyle
t^{chan}\eta_{opt}^{chan}\eta_{d}^{par},$ (10)

where $\eta_{opt}^{chan}$ is the intrinsic optical efficiency of the device,
and $\eta_{d}^{par}$ is the detection efficiency of Alice or Bob
($par\in\\{A,B\\}$).

In order to calculate the secrecy message capacity, we need to obtain the
yield and gain of the channel. Let $Y_{n}^{A}$ and $Y_{n}^{B}$ denote the
yields of the n-photon signal at Alice’s and Bob’s locations, respectively.
They can be calculated as

$\displaystyle Y_{n}^{par}=1-(1-Y_{0}^{par})(1-\eta^{chan})^{n},$ (11)

where $Y_{0}^{par}$ is the background detection rate. The item
$(1-Y_{0}^{par})(1-\eta^{chan})^{n}$ can be understood as the probability that
no background detection event occurs and all the $n$ photons are lost in the
quantum channel.

Through the system model described above, we can estimate both the overall
gain and the error rate. The formula of the overall gain can be written as

$\displaystyle
Q_{x_{i}}^{chan}=\sum_{n=0}^{\infty}Q_{x_{i},n}^{chan}=\frac{1}{P_{x_{i}}}\sum_{n=0}^{\infty}q_{x_{i}}(n)Y_{n}^{par},$
(12)

where $P_{x_{i}}$ is the total probability of event $x_{i}$ and
$P_{x_{i}}=\sum_{n=0}^{\infty}q_{x_{i}}(n)$. We can further derive
$Q_{x_{1}}^{chan}$ as

$\displaystyle
Q_{x_{1}}^{chan}=\sum_{n=0}^{\infty}Q_{x_{1},n}^{chan}=\frac{1}{P_{x_{1}}}\sum_{n=0}^{\infty}q_{x_{1}}(n)Y_{n}^{par}$
$\displaystyle=$
$\displaystyle\frac{1}{P_{x_{1}}}\sum_{n=0}^{\infty}q_{x_{1}}(n)[1-(1-Y_{0}^{par})(1-\eta^{chan})^{n}]$
$\displaystyle=$
$\displaystyle\frac{1}{P_{x_{1}}}\sum_{n=0}^{\infty}q_{x_{1}}(n)-\frac{1}{P_{x_{1}}}\sum_{n=0}^{\infty}q_{x_{1}}(n)(1-Y_{0}^{par})(1-\eta^{chan})^{n}$
$\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{1}}}\sum_{n=0}^{\infty}(1-d_{1})(1-d_{2})\frac{(\mu\eta_{x}f)^{n}}{n!}e^{\mu[f(1-\eta_{x})-1]}$
$\displaystyle\ast$ $\displaystyle(1-Y_{0}^{par})(1-\eta^{chan})^{n}$
$\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{1}}}\sum_{n=0}^{\infty}(1-d_{1})(1-d_{2})\frac{[\mu\eta_{x}f(1-\eta^{chan})]^{n}}{n!}$
$\displaystyle*$ $\displaystyle
e^{-\mu\eta_{x}f(1-\eta^{chan})}e^{\mu[f(1-\eta_{x})-1]+\mu\eta_{x}f(1-\eta^{chan})}(1-Y_{0}^{par})$
$\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{1}}}(1-Y_{0}^{par})(1-d_{1})(1-d_{2})e^{-\mu\eta_{x}f\eta^{chan}+\mu
f-\mu}.$

For simplicity, we rewrite

$\displaystyle Q_{x_{1}}^{chan}$ $\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{1}}}(1-Y_{0}^{par})(1-d_{1})(1-d_{2})g(f),$ (14)
$\displaystyle g(f)$ $\displaystyle=$ $\displaystyle e^{-\mu
f\eta_{x}\eta^{chan}+\mu f-\mu},$ (15)

where $g(f)$ is a substitute function for aesthetics. In addition, note that
$Q_{x_{1}}^{chan}$ here is only a computational example, and we do not need to
calculate $Q_{x_{1}}^{chan}$ in practical experiment or simulations.
Similarly, we can obtain the overall signal gains of the three kinds of
heralded states (two signal states and one decoy state) as

$\displaystyle Q_{x_{2}}^{chan}$ $\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{2}}}(1-Y_{0}^{par})(1-d_{2})[g(f_{1})-(1-d_{1})g(f)],$
$\displaystyle Q_{x_{3}}^{chan}$ $\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{3}}}(1-Y_{0}^{par})(1-d_{1})[g(f_{2})-(1-d_{2})g(f)],$
$\displaystyle Q_{x_{4}}^{chan}$ $\displaystyle=$ $\displaystyle
1-\frac{1}{P_{x_{4}}}(1-Y_{0}^{par})[g(1)-(1-d_{1})g(f_{2})$ (16)
$\displaystyle-(1-d_{2})g(f_{1})+(1-d_{1})(1-d_{2})g(f)].$

According to Ref. [58], the overall signal gain of Eve can be calculated as

$\displaystyle Q_{x_{i}}^{BAE}$ $\displaystyle=$
$\displaystyle\sum_{n=0}^{\infty}Q_{x_{i},n}^{BAE}$ $\displaystyle\leq$
$\displaystyle\sum_{n=0}^{\infty}[Q^{BA}_{x_{i},n}-\frac{q_{x_{i}}(n)}{P_{x_{i}}}Y_{0}^{A}]max\\{1,\frac{\gamma^{E}}{\gamma^{A}}\\},$

where $\gamma^{E}$ is the overall transmission efficiency of Eve after Alice
encodes her receiving photons, and $\gamma^{A}$ is the overall transmission
efficiency for photons received and then measured by Alice.

Similarly, we can also calculate the total error rate of our QSDC protocol as

$\displaystyle
E_{x_{i}}^{chan}=\frac{\sum_{n=0}^{\infty}q_{x_{i}}(n)e_{n}Y_{n}^{par}}{Q_{x_{i}}^{chan}P_{x_{i}}}.$
(18)

Here, we construct the error model $e_{n}Y_{n}^{par}$ as

$\displaystyle
e_{n}Y_{n}^{par}=e_{0}^{par}Y_{0}^{par}+e_{d}^{par}[1-(1-\eta)^{n}],$ (19)

where $e_{d}$ is detector error rate and $e_{0}^{par}$ is the error rate
caused by the dark count. $e_{0}^{par}$ is equal to 0.5, which means when no
photon is arrived, the dark count from one of the two detectors may cause the
error with the probability of 0.5.

Here, we also take the calculation of the total error rate $E_{x_{1}}^{chan}$
as an example. In detail, we can obtain

$\displaystyle
E_{x_{1}}^{chan}=\frac{\sum_{n=0}^{\infty}q_{x_{1}}(n)e_{n}Y_{n}^{par}}{Q_{x_{1}}^{chan}P_{x_{1}}}$
$\displaystyle=$
$\displaystyle\frac{1}{Q_{x_{1}}^{chan}P_{x_{1}}}\sum_{n=0}^{\infty}q_{x_{1}}(n)\\{e_{0}^{par}Y_{0}^{par}+e_{d}^{par}[1-(1-\eta)^{n}]\\}$
$\displaystyle=$
$\displaystyle\frac{1}{Q_{x_{1}}^{chan}P_{x_{1}}}[\sum_{n=0}^{\infty}q_{x_{1}}(n)(e_{0}^{par}Y_{0}^{par}+e_{d}^{par})$
$\displaystyle-$
$\displaystyle\sum_{n=0}^{\infty}q_{x_{1}}(n)e_{d}^{par}(1-\eta)^{n}]$
$\displaystyle=$
$\displaystyle\frac{e_{0}^{par}Y_{0}^{par}+e_{d}^{par}}{Q_{x_{1}}^{chan}}-\frac{e_{d}^{par}}{Q_{x_{1}}^{chan}P_{x_{1}}}(1-d_{1})(1-d_{2})g(f).$

Similarly, we can calculate the total error rate of the two signal states and
one decoy state as

$\displaystyle E_{x_{2}}^{chan}$ $\displaystyle=$
$\displaystyle\frac{1}{Q_{x_{2}}^{chan}}(e_{0}^{par}Y_{0}^{par}+e_{d}^{par})$
$\displaystyle-\frac{e_{d}^{par}}{Q_{x_{2}}^{chan}P_{x_{2}}}(1-d_{2})[g(f_{1})-(1-d_{1})g(f)],$
$\displaystyle E_{x_{3}}^{chan}$ $\displaystyle=$
$\displaystyle\frac{1}{Q_{x_{3}}^{chan}}(e_{0}^{par}Y_{0}^{par}+e_{d}^{par})$
$\displaystyle-\frac{e_{d}^{par}}{Q_{x_{3}}^{chan}P_{x_{3}}}(1-d_{1})[g(f_{2})-(1-d_{2})g(f)],$
$\displaystyle E_{x_{4}}^{chan}$ $\displaystyle=$
$\displaystyle\frac{1}{Q_{x_{4}}^{chan}}(e_{0}^{par}Y_{0}^{par}+e_{d}^{par})$
(21)
$\displaystyle-\frac{e_{d}^{par}}{Q_{x_{4}}^{chan}P_{x_{4}}}[g(1)-(1-d_{1})g(f_{2})$
$\displaystyle-(1-d_{2})g(f_{1})+(1-d_{1})(1-d_{2})g(f)].$

In this way, we can estimate $I(A:B)$ based on Eq. (III.2) and Eq. (III.2).

According to Eq. (7), for estimating $I(A:E)$, we need to estimate the single-
photon error rate $e_{1}^{BA}$ and two-photon bit error rate $e_{2}^{BA}$.
Here, we adopt the decoy-state method to estimate $e_{1}^{BA}$ and
$e_{2}^{BA}$. In Sec. II, we generate three types of heralded states through
the heralded operation. After Alice receives the transmitted photons, Bob
announces the type of each photon pulse, and selects a part of pulses for
security checking. If Eve performs the PNS attack during the photon
transmission, he will inevitably change the photon distribution, and thus be
detected by the parties. After the first round of security checking, we have

$\displaystyle P_{x_{2}}Q_{x_{2}}^{BA}$ $\displaystyle=$ $\displaystyle
q_{2}^{0}Y_{0}^{A}+q_{2}^{1}Y_{1}^{A}+q_{2}^{2}Y_{2}^{A}+\sum_{n=3}^{\infty}q_{2}^{n}Y_{n}^{A},$
$\displaystyle P_{x_{3}}Q_{x_{3}}^{BA}$ $\displaystyle=$ $\displaystyle
q_{3}^{0}Y_{0}^{A}+q_{3}^{1}Y_{1}^{A}+q_{3}^{2}Y_{2}^{A}+\sum_{n=3}^{\infty}q_{3}^{n}Y_{n}^{A},$
$\displaystyle P_{x_{4}}Q_{x_{4}}^{BA}$ $\displaystyle=$ $\displaystyle
q_{4}^{0}Y_{0}^{A}+q_{4}^{1}Y_{1}^{A}+q_{4}^{2}Y_{2}^{A}+\sum_{n=3}^{\infty}q_{4}^{n}Y_{n}^{A},$
(22) $\displaystyle P_{x_{2}}Q_{x_{2}}^{BA}E_{x_{2}}^{BA}$ $\displaystyle=$
$\displaystyle
q_{2}^{0}e_{0}Y_{0}^{A}+q_{2}^{1}e_{1}Y_{1}^{A}+q_{2}^{2}e_{2}Y_{2}^{A}$
$\displaystyle+$ $\displaystyle
q_{2}^{3}e_{3}Y_{3}^{A}+\sum_{n=4}^{\infty}q_{2}^{n}e_{n}Y_{n}^{A},$
$\displaystyle P_{x_{3}}Q_{x_{3}}^{BA}E_{x_{3}}^{BA}$ $\displaystyle=$
$\displaystyle
q_{3}^{0}e_{0}Y_{0}^{A}+q_{3}^{1}e_{1}Y_{1}^{A}+q_{3}^{2}e_{2}Y_{2}^{A}$
$\displaystyle+$ $\displaystyle
q_{3}^{3}e_{3}Y_{3}^{A}+\sum_{n=4}^{\infty}q_{3}^{n}e_{n}Y_{n}^{A},$
$\displaystyle P_{x_{4}}Q_{x_{4}}^{BA}E_{x_{4}}^{BA}$ $\displaystyle=$
$\displaystyle
q_{4}^{0}e_{0}Y_{0}^{A}+q_{4}^{1}e_{1}Y_{1}^{A}+q_{4}^{2}e_{2}Y_{2}^{A}$ (23)
$\displaystyle+$ $\displaystyle
q_{4}^{3}e_{3}Y_{3}^{A}+\sum_{n=4}^{\infty}q_{4}^{n}e_{n}Y_{n}^{A},$

where $q_{i}^{n}$ is the short for $q_{x_{i}}(n)$. Note that the parameters
used in the parameter estimation are all from the first round of photon
transmission, and we have omitted the superscript BA of Q and E below.

Here, $Y_{0}^{A}$ is the background detection rate which we consider as an
inherent property of the detector. Then, based on Eq. (III.2), we can
eliminate $Y_{2}^{A}$ and calculate $Y_{1}^{A}$ as

$\displaystyle Y_{1}^{A}$ $\displaystyle=$
$\displaystyle\frac{q_{i}^{2}P_{x_{j}}Q_{x_{j}}-q_{j}^{2}P_{x_{i}}Q_{x_{i}}-(q_{i}^{2}q_{j}^{0}-q_{j}^{2}q_{i}^{0})Y_{0}^{A}}{q_{i}^{2}q_{j}^{1}-q_{j}^{2}q_{i}^{1}}$
(24) $\displaystyle-$
$\displaystyle\frac{\sum_{n=3}^{\infty}(q_{i}^{2}q_{j}^{n}-q_{j}^{2}q_{i}^{n})Y_{n}^{A}}{q_{i}^{2}q_{j}^{1}-q_{j}^{2}q_{i}^{1}}.$

According to Ref. [52], we have

$\displaystyle\frac{q_{4}^{n}}{q_{3}^{n}}\geq\frac{q_{4}^{2}}{q_{3}^{2}}\geq\frac{q_{4}^{1}}{q_{3}^{1}},\qquad\frac{q_{3}^{n}}{q_{2}^{n}}\geq\frac{q_{3}^{2}}{q_{2}^{2}}\geq\frac{q_{3}^{1}}{q_{2}^{1}}.$
(25)

and

$\displaystyle\frac{(q_{i}^{2}q_{j}^{n}-q_{j}^{2}q_{i}^{n})}{q_{i}^{2}q_{j}^{1}-q_{j}^{2}q_{i}^{1}}\leq
0.$ (26)

As a result, we have the lower bound ($Y_{1}^{l}$) of $Y_{1}^{A}$ as

$\displaystyle Y_{1}^{A}$ $\displaystyle\geq$
$\displaystyle\frac{q_{i}^{2}P_{x_{j}}Q_{x_{j}}-q_{j}^{2}P_{x_{i}}Q_{x_{i}}-(q_{i}^{2}q_{j}^{0}-q_{j}^{2}q_{i}^{0})Y_{0}^{A}}{q_{i}^{2}q_{j}^{1}-q_{j}^{2}q_{i}^{1}},$
$\displaystyle Y_{1}^{l}$ $\displaystyle=$ $\displaystyle\\!\\!\\!\max_{i\neq
j\&i,j\atop\in\\{2,3,4\\}}\\!\\!\\!\\{\frac{q_{i}^{2}P_{x_{j}}Q_{x_{j}}-q_{j}^{2}P_{x_{i}}Q_{x_{i}}-(q_{i}^{2}q_{j}^{0}-q_{j}^{2}q_{i}^{0})Y_{0}^{A}}{q_{i}^{2}q_{j}^{1}-q_{j}^{2}q_{i}^{1}}\\}.$

where the superscript l means the lower bound.

Similarly, the lower bound ($Y_{2}^{l}$) of $Y_{2}^{A}$ is shown as

$\displaystyle Y_{2}^{A}$ $\displaystyle\geq$
$\displaystyle\frac{q_{i}^{1}P_{x_{j}}Q_{x_{j}}-q_{j}^{1}P_{x_{i}}Q_{x_{i}}-(q_{i}^{1}q_{j}^{0}-q_{j}^{1}q_{i}^{0})Y_{0}^{A}}{q_{i}^{1}q_{j}^{2}-q_{j}^{1}q_{i}^{2}}$
$\displaystyle Y_{2}^{l}$ $\displaystyle=$ $\displaystyle\\!\\!\\!\max_{i\neq
j\&i,j\atop\in\\{2,3,4\\}}\\!\\!\\!\\{\frac{q_{i}^{1}P_{x_{j}}Q_{x_{j}}-q_{j}^{1}P_{x_{i}}Q_{x_{i}}-(q_{i}^{1}q_{j}^{0}-q_{j}^{1}q_{i}^{0})Y_{0}^{A}}{q_{i}^{1}q_{j}^{2}-q_{j}^{1}q_{i}^{2}}\\}.$

According to Eq. (III.2), we can estimate $e_{1}^{BA}$ and $e_{2}^{BA}$ as

$\displaystyle e_{1}^{BA}$ $\displaystyle=$
$\displaystyle\frac{(q_{4}^{3}q_{3}^{2}-q_{3}^{3}q_{4}^{2})P_{x_{2}}Q_{x_{2}}E_{x_{2}}+(q_{2}^{3}q_{4}^{2}-q_{4}^{3}q_{2}^{2})P_{x_{3}}Q_{x_{3}}E_{x_{3}}+(q_{3}^{3}q_{2}^{2}-q_{2}^{3}q_{3}^{2})P_{x_{4}}Q_{x_{4}}E_{x_{4}}-\sum_{n=4}^{\infty}f_{q1}(n)e_{n}Y_{n}^{A}}{\\{q_{4}^{3}(q_{3}^{2}q_{2}^{1}-q_{2}^{2}q_{3}^{1})+q_{2}^{3}(q_{4}^{2}q_{3}^{1}-q_{3}^{2}q_{4}^{1})+q_{3}^{3}(q_{2}^{2}q_{4}^{1}-q_{4}^{2}q_{2}^{1})\\}Y_{1}^{A}}$
(29)
$\displaystyle-\frac{\\{q_{4}^{3}(q_{3}^{2}q_{2}^{0}-q_{2}^{2}q_{3}^{0})+q_{2}^{3}(q_{4}^{2}q_{3}^{0}-q_{3}^{2}q_{4}^{0})+q_{3}^{3}(q_{2}^{2}q_{4}^{0}-q_{4}^{2}q_{2}^{0})\\}e_{0}Y_{0}^{A}}{\\{q_{4}^{3}(q_{3}^{2}q_{2}^{1}-q_{2}^{2}q_{3}^{1})+q_{2}^{3}(q_{4}^{2}q_{3}^{1}-q_{3}^{2}q_{4}^{1})+q_{3}^{3}(q_{2}^{2}q_{4}^{1}-q_{4}^{2}q_{2}^{1})\\}Y_{1}^{A}}$
$\displaystyle\leq$
$\displaystyle\frac{(q_{4}^{3}q_{3}^{2}-q_{3}^{3}q_{4}^{2})P_{x_{2}}Q_{x_{2}}E_{x_{2}}+(q_{2}^{3}q_{4}^{2}-q_{4}^{3}q_{2}^{2})P_{x_{3}}Q_{x_{3}}E_{x_{3}}+(q_{3}^{3}q_{2}^{2}-q_{2}^{3}q_{3}^{2})P_{x_{4}}Q_{x_{4}}E_{x_{4}}}{\\{q_{4}^{3}(q_{3}^{2}q_{2}^{1}-q_{2}^{2}q_{3}^{1})+q_{2}^{3}(q_{4}^{2}q_{3}^{1}-q_{3}^{2}q_{4}^{1})+q_{3}^{3}(q_{2}^{2}q_{4}^{1}-q_{4}^{2}q_{2}^{1})\\}Y_{1}^{l}}$
$\displaystyle-\frac{\\{q_{4}^{3}(q_{3}^{2}q_{2}^{0}-q_{2}^{2}q_{3}^{0})+q_{2}^{3}(q_{4}^{2}q_{3}^{0}-q_{3}^{2}q_{4}^{0})+q_{3}^{3}(q_{2}^{2}q_{4}^{0}-q_{4}^{2}q_{2}^{0})\\}e_{0}Y_{0}^{A}}{\\{q_{4}^{3}(q_{3}^{2}q_{2}^{1}-q_{2}^{2}q_{3}^{1})+q_{2}^{3}(q_{4}^{2}q_{3}^{1}-q_{3}^{2}q_{4}^{1})+q_{3}^{3}(q_{2}^{2}q_{4}^{1}-q_{4}^{2}q_{2}^{1})\\}Y_{1}^{l}}$
$\displaystyle=$ $\displaystyle e_{1}^{u},$ $\displaystyle e_{2}^{BA}$
$\displaystyle=$
$\displaystyle\frac{(q_{4}^{3}q_{3}^{1}-q_{3}^{3}q_{4}^{1})P_{x_{2}}Q_{x_{2}}E_{x_{2}}+(q_{2}^{3}q_{4}^{1}-q_{4}^{3}q_{2}^{1})P_{x_{3}}Q_{x_{3}}E_{x_{3}}+(q_{3}^{3}q_{2}^{1}-q_{2}^{3}q_{3}^{1})P_{x_{4}}Q_{x_{4}}E_{x_{4}}-\sum_{n=4}^{\infty}f_{q2}(n)e_{n}Y_{n}^{A}}{\\{q_{4}^{3}(q_{3}^{1}q_{2}^{2}-q_{2}^{1}q_{3}^{2})+q_{2}^{3}(q_{4}^{1}q_{3}^{2}-q_{3}^{1}q_{4}^{2})+q_{3}^{3}(q_{2}^{1}q_{4}^{2}-q_{4}^{1}q_{2}^{2})\\}Y_{2}^{A}}$
(30)
$\displaystyle-\frac{\\{q_{4}^{3}(q_{3}^{1}q_{2}^{0}-q_{2}^{1}q_{3}^{0})+q_{2}^{3}(q_{4}^{1}q_{3}^{0}-q_{3}^{1}q_{4}^{0})+q_{3}^{3}(q_{2}^{1}q_{4}^{0}-q_{4}^{1}q_{2}^{0})\\}e_{0}Y_{0}^{A}}{\\{q_{4}^{3}(q_{3}^{1}q_{2}^{2}-q_{2}^{1}q_{3}^{2})+q_{2}^{3}(q_{4}^{1}q_{3}^{2}-q_{3}^{1}q_{4}^{2})+q_{3}^{3}(q_{2}^{1}q_{4}^{2}-q_{4}^{1}q_{2}^{2})\\}Y_{2}^{A}}$
$\displaystyle\leq$
$\displaystyle\frac{(q_{4}^{3}q_{3}^{1}-q_{3}^{3}q_{4}^{1})P_{x_{2}}Q_{x_{2}}E_{x_{2}}+(q_{2}^{3}q_{4}^{1}-q_{4}^{3}q_{2}^{1})P_{x_{3}}Q_{x_{3}}E_{x_{3}}+(q_{3}^{3}q_{2}^{1}-q_{2}^{3}q_{3}^{1})P_{x_{4}}Q_{x_{4}}E_{x_{4}}}{\\{q_{4}^{3}(q_{3}^{1}q_{2}^{2}-q_{2}^{1}q_{3}^{2})+q_{2}^{3}(q_{4}^{1}q_{3}^{2}-q_{3}^{1}q_{4}^{2})+q_{3}^{3}(q_{2}^{1}q_{4}^{2}-q_{4}^{1}q_{2}^{2})\\}Y_{2}^{l}}$
$\displaystyle-\frac{\\{q_{4}^{3}(q_{3}^{1}q_{2}^{0}-q_{2}^{1}q_{3}^{0})+q_{2}^{3}(q_{4}^{1}q_{3}^{0}-q_{3}^{1}q_{4}^{0})+q_{3}^{3}(q_{2}^{1}q_{4}^{0}-q_{4}^{1}q_{2}^{0})\\}e_{0}Y_{0}^{A}}{\\{q_{4}^{3}(q_{3}^{1}q_{2}^{2}-q_{2}^{1}q_{3}^{2})+q_{2}^{3}(q_{4}^{1}q_{3}^{2}-q_{3}^{1}q_{4}^{2})+q_{3}^{3}(q_{2}^{1}q_{4}^{2}-q_{4}^{1}q_{2}^{2})\\}Y_{2}^{l}}$
$\displaystyle=$ $\displaystyle e_{2}^{u}.$

Here, $f_{q1}(n)$ ($f_{q2}(n)$) is a coefficient of order n, and its value is
proved to be positive [52]. By eliminating the positive term through scaling,
we can estimate the upper bound of $e_{1}^{BA}$ and $e_{2}^{BA}$ as
$e_{1}^{u}$ and $e_{2}^{u}$, respectively.

###  III.3 Numerical simulation

Figure 2: Comparison between the photon distribution of the HSPS and the Poisson distribution, where $\mu=0.1$ and the other parameters are shown in Tab. 1. Notice that the curves $q_{x_{2}}(n)$ and $q_{x_{3}}(n)$ almost overlap.  Table 1: Parameters used in the numerical simulation. $\eta_{1},\eta_{2},\eta_{h},\eta_{x},t$ are the parameters that we model for the HSPS distribution, and the other parameters are from Pan’s experiments [58]. $\eta_{x}$ | $\eta_{1}$ | $\eta_{2}$ | $\eta_{h}$ | $\eta_{d}^{A(B)}$ | t
---|---|---|---|---|---
0.8 | 0.6 | 0.8 | 0.9 | 0.7 | 0.4
$d_{1(2)}$ | $Y_{0}^{A(B)}$ | $\eta_{opt}^{BA}$ | $\eta_{opt}^{BAB}$ | $e_{d}^{A}$ | $e_{d}^{B}$
$8\times 10^{-8}$ | $8\times 10^{-8}$ | 0.21 | 0.088 | 0.0131 | 0.0026

In our QSDC protocol, we utilize the HSPS to generate three types of sources
with the photon number distributions of $q_{x_{2}}(n)$, $q_{x_{3}}(n)$, and
$q_{x_{4}}(n)$, corresponding to three response events $x_{2}$, $x_{3}$, and
$x_{4}$, respectively. Each of these three photon number distributions as a
function of the photon number $n$ is depicted in Fig. 2. The parameters used
in the numerical simulation are shown in Tab. 1. Meanwhile, we also show the
photon number distribution of the WCP which follows the Poisson distribution.
It can be found that the vacuum state accounts for a large proportion (90.4%)
in the WCP, while the single-photon state only accounts for 9.0%. On the
contrary, by adopting the HSPS, the proportions of vacuum state in
$q_{x_{2}}(n)$ and $q_{x_{3}}(n)$ largely reduce to about 19.3% and 19.1%, and
the proportions of the single-photon state increase to about 77.8% and 77.3%,
respectively, which will greatly benefit the gain. Although the proportions of
multi-photon events slightly increase in $q_{x_{2}}(n)$ and $q_{x_{3}}(n)$,
their contribution can be negligible compared to the amplified single-photon
component. The photon number distribution $q_{x_{4}}(n)$ does not meet the
ideal standard since the two-photon event accounts for a high proportion
(about 60%). However, we only use $q_{x_{2}}(n)$ and $q_{x_{3}}(n)$ to
transmit messages, but use $q_{x_{4}}(n)$ for the decoy state.

Therefore, the secrecy message capacity of our passive decoy-state QSDC
protocol with the HSPS is written as

$\displaystyle C_{s}$ $\displaystyle=$ $\displaystyle
C_{sq_{x_{2}}}+C_{sq_{x_{3}}}$ $\displaystyle=$ $\displaystyle
Q_{x_{2}}^{BAB}[1-h(E_{x_{2}}^{BAB})]-\\{Q_{x_{2},n=1}^{BAE}*h(2e_{1}^{BA})$
$\displaystyle+Q_{x_{2},n=2}^{BAE}*[\frac{1}{2}h(2e_{2}^{BA})+\frac{1}{2}]+Q_{x_{2},n\geq
3}^{BAE}*1\\}$
$\displaystyle+Q_{x_{3}}^{BAB}[1-h(E_{x_{3}}^{BAB})]-\\{Q_{x_{3},n=1}^{BAE}*h(2e_{1}^{BA})$
$\displaystyle+Q_{x_{3},n=2}^{BAE}*[\frac{1}{2}h(2e_{2}^{BA})+\frac{1}{2}]+Q_{x_{3},n\geq
3}^{BAE}*1\\}.$

Fig. 3 illustrates $C_{s}$ of our passive decoy-state QSDC protocol with the
HSPS and that of the DL04 QSDC protocol without HSPS [58] under the mean
photon numbers $\mu=0.1$ and $0.01$, respectively. Consistent with traditional
GLLP [72] and decoy-state theories [55, 56], the maximum communication
distances (channel attenuation) of both QSDC protocols decrease with the
growth of the average photon number $\mu$, due to the increased susceptibility
to PNS attacks. To achieve longer communication distance, it is necessary to
reduce the average photon number. However, in the DL04 QSDC protocol without
HSPS, reducing the average photon number results in a large decrease in the
secrecy message capacity. However, in our QSDC protocol with HSPS, the
situation is somewhat different. The reduction in the average photon number
does not lead to a significant decline in the secrecy message capacity. In
fact, the secrecy message capacity corresponding to $\mu=0.01$ is comparable
to that corresponding to $\mu=0.1$. This advantage can be attributed to two
factors. Firstly, the lower average photon number yields a lower $I(A:E)$.
Secondly, the heralded operation decreases the influence from the vacuum
state, thereby effectively enhancing the gain and reducing errors caused by
dark counting. As depicted in Fig. 3, the adoption of HSPS can effectively
increase the secrecy message capacity. Comparing with the DL04 QSDC protocol
without the HSPS, at a fixed channel attenuation of 4 dB (communication
distance of about 10 km), $C_{s}$ of our QSDC protocol can be increased to
81.85 times at $\mu=0.1$ and 12.79 times at $\mu=0.01$. Meanwhile, the maximal
communication distance of our passive QSDC protocol with HSPS is also superior
to that of the DL04 QSDC protocol without HSPS. When $\mu=0.01$, the maximal
communication distance of our QSDC protocol can achieve 17.975 km (channel
attenuation 7.19 dB), which is slightly longer than that of the DL04 QSDC
(17.8 km, channel attenuation 7.12 dB). When $\mu=0.1$, our passive QSDC
protocol can achieve the maximal communication distance of about 14.6 km
(channel attenuation 5.84 dB), while the DL04 QSDC protocol can only achieve
the maximal communication distance of 12.9 km (channel attenuation 5.16 dB).

Figure 3: The secrecy message capacity of our passive decoy-state QSDC
protocol with the HSPS and the DL04 QSDC protocol without HSPS [58]. The
parameters used in our QSDC protocol is also shown in Tab. 1.

##  IV Conclusion

In conclusion, we propose a high-efficient passive decoy-state QSDC protocol
with the HSPS. Heralded by the detector responses in the HSPS, the input
photon pulse can be passively divided as two kinds of high-quality signal
single-photon sources, and a decoy-state source. When neither of two detectors
response, the input photon pulse in the signal path should be discarded. In
this way, the probability of the vacuum state in the signal state and decoy
state can be largely reduced. The adoption of the passive method enables our
QSDC protocol to have strong robustness against the side-channel attack. In
the security analysis, we consider that Eve performs the PNS attack combined
with the collective attack and calculate the theoretical secrecy message
capacity. The simulation results show that our passive decoy-state QSDC
protocol with the HSPS is superior to the original DL04 QSDC protocol without
HSPS in both secrecy message capacity and maximal communication distance. For
a fixed channel attenuation of 4 dB (communication distance of about 10 km),
$C_{s}$ of our QSDC protocol can achieve 81.85 times ($\mu=0.1$) and 12.79
times ($\mu=0.01$) of the corresponding values in the original DL04 QSDC
protocol without the HSPS. In the high average photon number condition
($\mu=0.1$), our passive decoy-state QSDC protocol can achieve the maximal
communication distance of about 14.6 km, about 1.7 km longer than that of the
original DL04 QSDC protocol, while in the low average photon number condition
($\mu=0.01$), the maximal communication distance can reach 17.975 km.
Benefiting from the HSPS and the passive decoy-state method, our passive
decoy-state QSDC protocol has application potential to realize practical high-
capacity QSDC in the future.

## Acknowledgement

We would like to thank Dong Pan for his generous providing of the comparison
data in Fig. 4. This work is supported by the National Natural Science
Foundation of China under Grant Nos. 12175106 and 92365110, and the
Postgraduate Research $\&$ Practice Innovation Program of Jiangsu Province
under Grand No. KYCX22-0963.

## References

  * [1] C.H. Bennett, and G. Brassard. Quantum cryptography: public key distribution and coin tossing. Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing (IEEE, New York), 175 (1984).
  * [2] A.K. Ekert. Quantum cryptography based on Bell’s theorem. Phys. Rev. Lett. 67, 661 (1991).
  * [3] A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani. Device-independent security of quantum cryptography against collective attacks. Phys. Rev. Lett. 98, 230501 (2007).
  * [4] H.K. Lo, M. Curty, and B. Qi. Measurement-device-independent quantum key distribution. Phys. Rev. Lett. 108, 130503 (2012).
  * [5] F.H. Xu, X.F. Ma, Q. Zhang, H.K. Lo, and J.W. Pan. Secure quantum key distribution with realistic devices. Rev. Mod. Phys. 92, 025002 (2020).
  * [6] P. Ye, W. Chen, G.W. Zhang, _et al._ Induced-photorefraction attack against quantum key distribution. Phys. Rev. Appl. 19, 054052 (2023).
  * [7] D. Tupkary and N. Lütkenhaus, Using cascade in quantum key distribution. Phys. Rev. Appl. 20, 064040 (2023).
  * [8] B. Liu, S. Xia, D. Xiao, W. Huang, B.J. Xu, and Y. Li. Decoy-state method for quantum-key-distribution-based quantum private query. Sci. China Phys. Mech. & Astron. 65, 240312 (2022).
  * [9] Y.M. Xie, Y.S. Lu, C.X. Weng, X.Y. Cao, Z.Y. Jia, Y. Bao, Y. Wang, Y. Fu, H.L. Yin, and Z.B. Chen. Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference. PRX Quant. 3, 020315 (2022).
  * [10] S. Wang, Z.Q. Yin, D.Y. He, W. Chen, R.Q. Wang, P. Ye, Y. Zhou, G.J. Fan-Yuan, F.X. Wang, W. Chen, Y.G. Zhu, P. V. Morozov, A. V. Divochiy, Z. Zhou, G.C. Guo, and Z.F. Han. Twin-field quantum key distribution over 830-km fibre. Nat. Photon. 16, 2 (2022).
  * [11] Z.Q. Yin, F.Y. Lu, J. Teng, S. Wang, W. Chen, G.C. Guo, and Z.F. Han. Twin-field protocols: Towards intercity quantum key distribution without quantum repeaters. Founda. Res. 1, 93-95 (2021).
  * [12] Y.A. Chen, Q. Zhang, T.Y. Chen, W. Q. Cai, S. K. Liao, J. Kai, _et al._ An integrated space-to-ground quantum communication network over 4,600 kilometres. Nature 589, 214-219 (2021).
  * [13] W. Li, L.K. Zhang, Y.C. Lu, Z.P. Li, C. Jiang, Y. Liu, J. Huang, H. Li, Z. Wang, X.B. Wang, Q. Zhang, L.X. You, F.H. Xu, and J.W. Pan. Twin-field quantum key distribution without phase locking. Phys. Rev. Lett. 130, 250802 (2023).
  * [14] G.L. Long, and X.S. Liu. Theoretically efficient high-capacity quantum-key-distribution scheme. Phys. Rev. A 65, 032302 (2002).
  * [15] F.G. Deng, G.L. Long, and X.S. Liu. Two-step quantum direct communication protocol using the Einstein-Podolsky-Rosen pair block. Phys. Rev. A 68, 042317 (2003).
  * [16] F.G. Deng, and G.L. Long. Secure direct communication with a quantum one-time pad. Phys. Rev. A 69, 052319 (2004).
  * [17] C. Wang, F.G. Deng, Y.S. Li, X.S. Liu, and G.L. Long. Quantum secure direct communication with high-dimension quantum superdense coding. Phys. Rev. A 71, 044305 (2005).
  * [18] J.Y. Hu, B. Yu, M.Y. Jing, L.T. Xiao, S.T. Jia, G.Q. Qin, and G.L. Long. Experimental quantum secure direct communication with single photons. Light: Sci. & Appl. 5, e16144 (2016).
  * [19] W. Zhang, D.S. Ding, Y.B. Sheng, L. Zhou, B.S. Shi, and G.C. Guo. Quantum secure direct communication with quantum memory. Phys. Rev. Lett. 118, 220501 (2017).
  * [20] F. Zhu, W. Zhang, Y.B. Sheng, and Y.D. Huang. Experimental long-distance quantum secure direct communication. Sci. Bull. 10, 1519-1524 (2017).
  * [21] L. Zhou, Y.B. Sheng, and G.L. Long. Device-independent quantum secure direct communication against collective attacks. Sci. Bull. 65, 12-20 (2020).
  * [22] Z.R. Zhou, Y.B. Sheng, P.H. Niu, L.G. Yin, G.L. Long, and L. Hanzo. Measurement-device-independent quantum secure direct communication. Sci. China: Phys. Mech. & Astron. 63, 230362 (2020).
  * [23] P.H. Niu, Z.R. Zhou, Z.S. Lin, Y.B. Sheng, L.G. Yin, and G.L. Long. Measurement-device-independent quantum communication without encryption. Sci. Bull. 63, 1345-1350 (2018).
  * [24] T. Li and G.L. Long. Quantum secure direct communication based on single-photon Bell-state measurement. New J. Phys. 22, 063017 (2020).
  * [25] G.L. Long, and H. Zhang. Drastic increase of channel capacity in quantum secure direct communication using masking. Sci. Bull. 66, 1267-1269 (2021).
  * [26] Z.L. Cao, L. Wang, K.X. Liang, G. Chai, and J.Y. Peng. Continuous-variable quantum secure direct communication based on Gaussian mapping. Phys. Rev. Appl. 16, 024012 (2021).
  * [27] Z.T. Qi, Y.H. Li, W.Y. Huang, J. Feng, Y.L. Zheng, and X.F. Chen. A 15-user quantum secure direct communication network. Light: Sci. & Appl. 10, 183 (2021).
  * [28] Y.B. Sheng, L. Zhou, and G.L. Long. One-step quantum secure direct communication. Sci. Bull. 67, 367-374 (2022).
  * [29] H.R. Zhang, Z. Sun, R.Y. Qi, L.G. Yin, G.L. Long, and J.H. Lu. Realization of quantum secure direct communication over 100 km fiber with time-bin and phase quantum states. Light: Sci & Appl. 11, 83 (2022).
  * [30] L. Zhou and Y.B. Sheng. One-step device-independent quantum secure direct communication. Sci. China: Phys. Mech. & Astron. 65, 250311 (2022).
  * [31] J.W. Ying, L. Zhou, W. Zhong, and Y.B. Sheng. Measurement-device-independent one-step quantum secure direct communication. Chin. Phys. B 31, 120303 (2022).
  * [32] J.W. Wu, G.L. Long, and M. Hayashi, Quantum secure direct communication with private dense coding using a general preshared quantum state. Phys. Rev. Appl. 17, 064011 (2022).
  * [33] I. Paparelle, F. Mousavi, F. Scazza, A. Bassi, M. Paris, and A. Zavatta, Practical quantum secure direct communication with squeezed states, arxiv: 2306.14322 (2023).
  * [34] L. Zhou, B.W. Xu, W. Zhong, and Y.B. Sheng. Device-independent quantum secure direct communication with single-photon sources. Phys. Rev. Appl. 19, 014036 (2023).
  * [35] Y.P. Hong, L. Zhou, W. Zhong, and Y.B. Sheng. Measurement-device-independent three-party quantum secure direct communication. Quant. Inform. Process. 22, 111 (2023).
  * [36] Y.X. Xiao, L. Zhou, W. Zhong, M.M. Du, and Y.B. Sheng. The hyperentanglement-based quantum secure direct communication protocol with single-photon measurement. Quant. Inform. Process. 22, 339 (2023).
  * [37] Z.W. Cao, Y. Lu, G. Chai, H. Yu, K.X. Liang, and L. Wang. Realization of quantum secure direct communication with continuous variable. Research 6, 0193 (2023).
  * [38] H. Zeng, M.M. Du, W. Zhong, L. Zhou, and Y.B. Sheng. High-capacity device-independent quantum secure direct communication based on hyper-encoding. Funda. Res. https://doi.org/10.1016/j.fmre.2023.11.006 (2023).
  * [39] Q. Zhang, M.M. Du, W. Zhong, Y.B. Sheng, and L. Zhou. Single-photon based three-party quantum secure direct communication with identity authentication. Ann. Phys. (Berlin, Ger.) https:// doi.org/10.1002/andp.202300407 (2023).
  * [40] S. Pironio, A. Acín, N. Brunner, N. Gisin, S. Massar and V. Scarani. Device-independent quantum key distribution secure against collective attacks. New J. Phys. 11, 045021 (2009).
  * [41] J. KołodyŃski, A. Máttar, P. Skrzypczyk, E. Woodhead, D. Cavalcanti, K. Banaszek, and A. Acín. Device-independent quantum key distribution with single-photon sources. Quantum 4, 260 (2020).
  * [42] Q. Zeng, H. Wang, H. Yuan, Y. Fan, L. Zhou, Y. Gao, H. Ma and Z. Yuan. Controlled entanglement source for quantum cryptography. Phys. Rev. Appl. 19, 054048 (2023).
  * [43] D.P. Nadlinger, P. Drmota, B.C. Nichol, G. Araneda, D. Main, R. Srinivas, D.M. Lucas, C.J. Ballance, K. Ivanov, and E.Z. Tan. Experimental quantum key distribution certified by Bell’s theorem. Nature 607, 682-686 (2022).
  * [44] W. Zhang, T. van Leent, K. Redeker, R. Garthoff, R. Schwonnek, F. Fertig, S. Eppelt, W. Rosenfeld, V. Scarani, and C.C.W. Lim, A device-independent quantum key distribution system for distant users. Nature 607, 687-691 (2022).
  * [45] W.Z. Liu, Y.Z. Zhang, Y.Z. Zhen, M.H. Li, Y. Liu, J.Y. Fan, F.H. Xu, Q. Zhang, and J.W. Pan. Toward a photonic demonstration of device-independent quantum key distribution. Phys. Rev. Lett. 129, 050502 (2022).
  * [46] S.A. Castelletto and R.E. Scholten. Heralded single photon sources: A route towards quantum communication technology and photon standards. Eur. Phys. J. Appl. Phys. 41, 181-194 (2008).
  * [47] X. Cao, M. Zopf, and F. Ding. Telecom wavelength single photon sources. J. Semicond. 40, 071901 (2019).
  * [48] S. Signorini and L. Pavesi. On-chip heralded single photon sources. AVS Quantum Sci. 2, 041701 (2020).
  * [49] C. Zhang, Y.F. Huang, B.H. Liu, C.F. Li, and G.C. Guo. Spontaneous parametric down-conversion sources for multiphoton experiments. Adv. Quantum Technol. 4, 2000132 (2021).
  * [50] S.H. Wei, B. Jing, X.Y. Zhang, J.Y. Liao, C.Z. Yuan, B.Y. Fan, C. Lyu, D.L. Zhou, Y. Wang, G.W. Deng, H.Z.Song, D. Oblak, G.C. Guo, and Q. Zhou. Towards realworld quantum networks: A review. Laser Photon. Rev. 16, 2100219 (2022).
  * [51] X.H. Zhan, S. Wang, Z.Q. Zhong, Z.Q. Yin, W. Chen, D.Y. He, G.C. Guo, and Z.F. Han. Quantum Key Distribution with a Continuous-Wave-Pumped Spontaneous-Parametric-Down-Conversion Heralded Single-Photon Source. Phys. Rev. Appl. 19, 034027 (2023).
  * [52] Q. Wang, C.H. Zhang, and X.B. Wang. Scheme for realizing passive quantum key distribution with heralded single-photon sources. Phys. Rev. A 93, 032312 (2016).
  * [53] B. Huttner, N. Imoto, N. Gisin, and T. Mor. Quantum cryptography with coherent states. Phys. Rev. A 51, 1863 (1995).
  * [54] G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders. Limitations on practical quantum cryptography. Phys. Rev. Lett. 85, 1330 (2000).
  * [55] W.Y. Hwang. Quantum key distribution with high loss: toward global secure communication. Phys. Rev. Lett. 91, 057901 (2003).
  * [56] H.K. Lo, X.F. Ma, and K. Chen. Decoy state quantum key distribution. Phys. Rev. Lett. 94, 230504 (2005).
  * [57] X.F. Ma, B. Qi, Y. Zhao, and H.K. Lo. Practical decoy state for quantum key distribution. Phys. Rev. A 72, 012326 (2005).
  * [58] D. Pan, Z.S. Lin, J.W. Wu, H.R. Zhang, Z. Sun, D. Ruan, L.G. Yin, and G.L. Long. Experimental free-space quantum secure direct communication and its security analysis. Photon. Res. 8, 1522-1531 (2020).
  * [59] X. Liu, Z.J. Li, D. Luo, C.F. Huang, D. Ma, M.M. Geng, J.W. Wang, Z.R. Zhang, and K.J. Wei. Practical decoy-state quantum secure direct communication. Sci. China: Phys. Mech. & Astron. 64, 120311 (2021).
  * [60] M. Curty, T. Moroder, X. F. Ma, and N. Lütkenhaus. Non Poissonian statistics from Poissonian light sources with application to passive decoy state quantum key distribution. Opt. Lett. 34, 3238-3240 (2009).
  * [61] M. Curty, X.F. Ma, B. Qi, and T. Moroder. Passive decoy-state quantum key distribution with practical light sources. Phys. Rev. A 81, 022310 (2010).
  * [62] W.Y. Wang, R. Wang, C.Q. Hu, V. Zapatero, L. Qian, B. Qi, M. Curty, and H.K. Lo. Fully passive quantum key distribution. Phys. Rev. Lett. 130, 220801 (2023).
  * [63] F.Y. Lu, Z.H. Wang, V. Zapatero, _et al._ Experimental demonstration of fully passive quantum key distribution. Phys. Rev. Lett. 131, 110802 (2023).
  * [64] H. D. Riedmatten, V. Scarani, I. Marcikic, A. Acín, W. Tittel, H. Zbinden, and N. Gisin. Two independent photon pairs versus four-photon entangled states in parametric down conversion. J. Mod. Opt. 51, 1637 (2004).
  * [65] B. Blauensteiner, I. Herbauts, S. Bettelli, A. Poppe, and H. Hubel. Photon bunching in parametric down-conversion with continuous-wave excitation. Phys. Rev. A 79, 063846 (2009).
  * [66] W. Mauerer, M. Avenhaus, W. Helwig, and C. Silberhorn. How colors influence numbers: Photon statistics of parametric down-conversion. Phys. Rev. A 80, 053815 (2009).
  * [67] A.D. Wyner. The wire-tap channel. Bell System Tech. J. 54, 1355-1387 (1975).
  * [68] R.Y. Qi, Z. Sun, Z.S. Lin, P.H. Niu, W.T. Hao, L.Y. Song, Q. Huang, J.C. Gao, L.G. Yin, and G.L. Long. Implementation and security analysis of practical quantum secure direct communication. Light Sci. Appl. 8, 22 (2019).
  * [69] J.W. Wu, Z.S. Lin, L.G. Yin, and G.L. Long. Security of quantum secure direct communication based on Wyner’s wiretap channel theory. Quant. Eng. 1, e26 (2019).
  * [70] A.S. Holevo. Bounds for the quantity of information transmitted by a quantum communication channel. Probl. Inf. Trans. 9, 177-183 (1973).
  * [71] Y. Feng, R. Duan, and M. Ying. Unambiguous discrimination between mixed quantum states. Phys. Rev. A 70, 012308 (2004).
  * [72] D. Gottesman, H.K. Lo, N. Lutkenhaus, and J. Preskill. Security of quantum key distribution with imperfect devices. Quant. Inf. Comput. 4, 325-360 (2004).