# A cost-efficient quantum access network with qubit-based synchronization

Chunfeng Huang1, Ye Chen1, Tingting Luo1, Wenjie He1, Xin Liu1, Zhenrong
Zhang2, and Kejin Wei1,∗ 1Guangxi Key Laboratory for Relativistic
Astrophysics, School of Physical Science and Technology, Guangxi University,
Nanning 530004, China
2Guangxi Key Laboratory of Multimedia Communications and Network Technology,
School of Computer Electronics and Information, Guangxi University, Nanning
530004, China
∗Corresponding author<EMAIL_ADDRESS>
###### Abstract

Quantum Key Distribution (QKD) is a physical layer encryption technique that
enables two distant parties to exchange secure keys with information-theoretic
security. In the last two decades, QKD has transitioned from laboratory
research to real-world applications, including multi-user quantum access
networks (QANs). This network structure allows users to share single-photon
detectors at a network node through time-division multiplexing, thereby
significantly reducing the network cost. However, current QAN implementations
require additional hardware for auxiliary tasks such as time synchronization.
To address this issue, we propose a cost-efficient QAN that uses qubit-based
synchronization. In this approach, the transmitted qubits facilitate time
synchronization, eliminating the need for synchronization hardware. We tested
our scheme by implementing a network for two users and successfully achieved
average secure key rates of $53.84$ kbps and $71.90$ kbps for each user over a
50-km commercial fiber spool. In addition, we investigated the capacity of the
access network under cross-talk and loss conditions. The simulation results
demonstrate that this scheme can support a QAN with 64 users with key rates up
to 1070 bps. Our work provides a feasible and cost-effective way to implement
a multi-user QKD network, further promoting the widespread application of QKD.

##  I Introduction

The security of information exchange is of great significance to human
society. Quantum key distribution (QKD) allows two authorized users to
exchange keys with information-theoretical security, and the security of the
key bits is guaranteed by the laws of quantum physics [1, 2, 3, 4]. Since
Bennett and Brassard proposed the first QKD scheme [1], known as the BB84
protocol, QKD has rapidly matured through various theoretical schemes [5, 6,
7, 8, 9, 10, 11] and continuous technological innovations [12, 13, 14, 15, 16,
17, 18, 19]. Recently, the secure key rate of QKD implementations has reached
several dozen megahertz [17, 18], and the record-breaking distance has been
extended to 1000 km [19]. Many multi-user QKD networks have been reported,
including metropolitan networks [20, 21, 22, 23, 24], integrated space-to-
ground quantum communication networks [25], and networks with untrusted relays
[26, 27].

The quantum access network (QAN) is a well-known QKD network structure that
provides last-mile services for multiple users to access the QKD
infrastructure [28, 29, 30, 31, 32, 33, 34, 35]. In general, there are two
configurations of an access network. The first, termed a “downstream network,”
involves placing the QKD transmitter on the network node, and each user has a
QKD receiver [33, 34, 35]. The second configuration, known as the “upstream
network,” involves each user having a transmitter, and the receiver is located
at a network node [28, 29, 30, 31, 32]. In a downstream access network, the
cost of a single-photon detector is usually beyond users’ affordability. In
addition, detectors with complex designs are the most frequently attacked
devices [36, 37, 38], requiring further consideration of detection security in
the network. In contrast, users of the upstream access network require only a
transmitter, and the detectors are provided by the node, which greatly reduces
the network cost [29]. Furthermore, upgrading the security of the network is
easier in a network structure that is independent of the measurement device
[39, 40, 41, 42, 43]. Owing to their cost advantages and upgrade flexibility,
QANs have gained widespread attention and have been validated in a
metropolitan network [44].

Even so, in existing upstream networks, each transmitter not only must possess
quantum state preparation equipment but also requires additional optical
synchronization devices to ensure that photons fall into predetermined time
slots. This makes the transmitter equipment more complex. Furthermore,
previous studies have shown that in co-fiber transmission schemes, the use of
additional optical synchronization devices introduces Raman scattering, which
severely impairs the transmission of quantum signals [28, 30]. Therefore, it
is necessary to add additional devices, such as filters, to improve the
performance of quantum signal transmission. This further increases
construction costs and network complexity.

In this study, we propose and demonstrate a cost-efficient QAN scheme that
exploits a recently reported qubit-based frame synchronization method [45]. In
our scheme, we implement time synchronization between each transmitter and the
node by relying on the flying qubits, thereby eliminating the need for
additional synchronization hardware. This approach further reduces the network
cost because each transmitter requires only devices for qubit generation. To
verify the feasibility of the network scheme, we implemented a polarization-
coding QAN with two users. Experimental results show that the two users on the
network achieved secure key rates of $53.84$ kbps and $71.90$ kbps,
respectively, over $56$-km commercial fiber spool. Additionally, we analyze
the capacity of the access network in the presence of cross-talk and loss
using the parameters of the cross-talk noise measured in our setup. Simulation
results show that the network can support up to $64$ users with key rates up
to 1070 bps. Our work provides a feasible and cost-effective way to implement
a multi-user QKD network, further promoting the widespread application of QKD.

##  II Qubit-based access network architecture

###  II.1 Network architecture

First, we briefly introduce a typical QAN. As shown in Figure 1, each user has
a transmitter, where some devices are used to prepare quantum signals, and an
additional synchronization system is used to achieve time synchronization with
the network node. The signals emitted by each user are coupled through dense
wavelength-division multiplexers and sent to the network node. With the help
of synchronization devices for each user, quantum signals can accurately fall
into pre-set time slots, ensuring that the QKD receivers in the node can
accurately detect the quantum signals from each user.

Figure 1: Each QKD transmitter prepares and sends quantum signals in different
time slots, which are transmitted to the QKD receiver using a dense wavelength
division multiplexer (DWDM). (a) A typical quantum access network
architecture. The orange arrows represent classical synchronization optical
signals. They are coupled with the quantum signals through a multiplexing
module (MUL). (b) Our access network scheme. The colored-filled positions
include the quantum signals used for time synchronization.

Figure 1 shows the proposed QAN scheme. Our architecture is identical to that
of a traditional QAN, except that we removed the synchronization devices and
retained only the devices for preparing quantum states. To achieve an accurate
key distribution with the network node, in addition to sending completely
random BB84 quantum signals, as in traditional network methods, we also
periodically insert publicly known synchronization quantum signals
(represented by yellow, blue, or red squares in the figure). These states are
then coupled together and sent to the network node. The network node uses a
receiver to detect and analyze these states, recording their arrival times
using its local clock. The data are then processed using synchronization
algorithms that enable the generation of raw secure keys for each user.

Figure 2: Schematic of the operation of access network using a qubit-based
synchronization method.

Figure 2 illustrates the entire operation of our network using qubit-based
synchronization, which can be divided into the following steps:

1) Each user first generates a unique publicly known synchronization string of
length $L$, and then generates a string of completely random bits used to
modulate the four states of BB84. The synchronization string generated by each
user can be regarded as the user’s identifier. The user then divides this
string into $L$ individual bits and periodically inserts these into the bits
used for random modulation to construct a bit frame. The frame is used to
encode a sequence of quantum signals based on the transmitter’s local clock.
Considering the slight time bias between the transmitters’ clocks, the time
interval $\tau_{i}$ between two consecutive qubits is determined by the local
clock of transmitter-$i$. In addition, device calibration is necessary before
performing key distribution. This process ensures that only qubits from one
transmitter reach the receiver simultaneously. Qubits from different
transmitters are coupled and sent using time-division over a lossy channel.

2) The receiver measures the quantum signals from different transmitters and
analyzes their states, recording time-of-arrival measurements using its local
clock $\tau^{R}$. The receiver’s main goal is to determine the sources of the
qubits within the detection time slots and identify the positions of the
received bits in the transmitter’s random bit string. These operations are
critical for the accurate generation of raw key bits between each transmitter
and receiver and for effective sifting of key bits. To achieve this, the
receiver must accomplish three tasks: $i$) Recover the clock $\tau^{R}$ from
the detection events. $ii$) Separate the qubits from different detection time
slots. $iii$) Derive the corresponding transmitters for the time slots and
calculate the time delay between the received and sent strings. Below, we
explain how to use the transmitted quantum states to accomplish these three
tasks, enabling QANs without the need for additional synchronization hardware.

###  II.2 User identification and time recovery using qubit states

Here we describe the construction of the transmitted bit frames. For example,
transmitter-$1$ generates a synchronization bit string $S_{1}^{t}$ of length
$L$ and a random bit string of length $M\times L$. The string $S_{1}^{t}$ is
decomposed into individual bits and uniformly inserted with a preset bit
interval $M$ into the random bit string, constructing a bit frame of length
$(M+1)\times L$, as shown in Figure 2. Similar to previously described methods
[45, 46], $S_{1}^{t}$ exhibits periodic correlations and is publicly disclosed
to the receiver, whereas the random bit string is used to generate secure keys
and must be kept secret. Similarly, the synchronization strings are encoded on
two orthogonal bases; for example, the horizontal and vertical polarizations
of the $z$-basis are assigned as $+1$ and $-1$. At the same time, there is no
correlation between $S_{1}^{t}$ and the synchronization string $S_{i}^{t}$ of
transmitter-$i$, enabling the receiver to identify the source of qubits
through the specific string.

The receiver measures quantum signals from different transmitters and records
their arrival times $t_{a}^{m}$ using its local clock $\tau^{R}$. Owing to
channel losses and detection noise, the receiver cannot determine the delay of
the detection time slot and thus cannot identify the source of the quantum
signals. Subsequently, we describe how the receiver achieves time recovery
based on the measurements and autocorrelation properties of the
synchronization bit string.

Our method first recovers the clock $\tau^{R}$, enabling the receiver to
accurately reconstruct the bit intervals in the raw key between consecutive
detections. The receiver initially estimates a clock $\tau_{0}^{R}$ from the
arrival time based on the Fourier transform, and then refines it using the
least-squares algorithm to obtain an accurate value. To separate the detection
time slots, the receiver employs the recovered clock $\tau^{R}$ to calculate
the modulo of the quantum signal’s arrival time. This procedure effectively
segregates qubits into distinct time slots. Nevertheless, owing to channel
losses and detection noise, the receiver faces difficulty in determining the
source of qubits accurately within these time slots. In other words, the
demarcated slots may deviate from the slots pre-designated by the calibration
process. Consequently, the receiver must identify the transmitters associated
with each time slot before calculating the time offset between the measured
string and the transmitter’s raw string.

Based on the above, the receiver can extract a received frame from each time
slot. Guided by the transmitted frame structure of periodically inserted
synchronization bits, the receiver translates the received frame into a
synchronization qubit string of length $L$, and $M$ sets of random qubit
strings each of length $L$. Considering that the send synchronization string
is encoded only on the $z$-basis, the receiver similarly assigns the values
$+1$ and $-1$ to the two orthogonal states in the $z$-basis, whereas received
qubits that are either undetected or collapsed into the $x$-basis are assigned
a value of $0$. The receiver then associates the strings from different time
slots with $S_{1}^{t}$. Exploiting the autocorrelation property of the
synchronization string $S_{1}^{t}$, as the maximum cross-correlation value
emerges, the receiver can determine the corresponding time slot for
transmitter-$1$ and associate received bits with the bits in the transmitter’s
raw string. A detailed description of the synchronization method is given in
Appendix A.

##  III Experiments

Figure 3: Schematic diagram of our experimental setup for the upstream quantum
access network. LD: commercial laser diode; BS: beam splitter of 75:25; PM:
phase modulator; CPM: customized polarization module; ATT: optical attenuator;
PC: polarization controller; DWDM: dense wavelength division multiplexing;
PAM: polarization analysis module; SNSPDs: superconducting nanowire single
photon detectors; TDC: time-to-digital converter. CMP: a computer performing
time synchronization algorithm.

To validate the feasibility of the proposed scheme, we conducted a QAN
experiment with two users. The experimental setup of our network is
illustrated in Figure 3. Each user adopts a polarization-coding QKD
transmitter [47] running the decoy-state BB84 protocol. The transmitter uses a
commercial laser (LD, WT-LD200-DL, Qasky Co., Ltd.) to generate light pulses
with a pulse width of $200$ ps and a repetition rate of $50$ MHz. The center
wavelengths of the light pulses are $1549.44$ nm and $1551.03$ nm. The light
pulses are fed into a Sagnac-based intensity modulator, which produces signal
and decoy pulses with a fixed intensity ratio. The intensity modulator
contains a fixed $75:25$ beam splitter (BS) and a phase modulator (PM). Then,
the light pulse is coupled into a Sagnac-based polarization modulator which
comprises a customized polarization module (CPM) and PM to prepare four BB84
polarization states
$|\psi\rangle=(|H\rangle+e^{i\theta}|V\rangle)/\sqrt{2},\theta\in\\{0,\pi/2,\pi,3\pi/2\\}$,
where $\theta\in\\{0,\pi\\}$ $(\theta\in\\{\pi/2,3\pi/2\\})$ represents the
$z(x)$-basis. Subsequently, the light pulses enter an optical attenuator (ATT)
to be attenuated to the single-photon level and are sent to the receiver over
a fiber spool with a length of $50$ km.

The quantum signals pass through a lossy channel to reach the receiver, which
includes a customized passive polarization analysis module (PAM). This module
serves as a polarization reference for multiple transmitters. The coupling
ratio of the two measurement basis of the PAM is set to $9:1$. Each user uses
a polarization controller (PC) to calibrate their reference frame
independently with respect to the receiver. Two users are connected to a
$100$G $1\times 4$ dense wavelength division multiplexer (DWDM) via a $50$ km
fiber. We add a $6$ km optical fiber between the DWDM and the network node,
similar to the QAN of Fröhlich et al. [29], where the passive optical
component and receiver are not co-located. The QKD receiver, located at the
network node, includes four superconducting nanowire single-photon detectors
(SNSPDs, Photon Technology Co., Ltd.) with $50\%$ detection efficiency and
$50$ Hz dark count. Photon detection events are recorded using a high-speed
time-to-digital converter (TDC, Timetagger20, Swabian Instruments). The
detection data are input into the time synchronization algorithm, which is
executed on a computer.

##  IV Results

Figure 4: A quantum access network with two transmitters for about one hour of
stable operation. The quantum bit error rate (QBER) (filled green diamonds,
transmitter-1; filled blue triangles, transmitter-2) and secure key rate (open
green squares, transmitter-1; open blue circles, transmitter-2) for each $z$
basis sifted key block with a size of $10^{7}$. Figure 5: (a) The relative
increase in count rate caused by cross-talk. The cross-talk caused by the
adjacent time slot are $0.43\%$ and $0.55\%$, respectively. The error bars
correspond to one standard deviation of measurements. (b) The secure key rate
of a single user in a $64$-user quantum access network with different number
of active users.

We implemented a QAN with qubit-based synchronization accommodating two users
over commercial optical fibers. The channel transmission losses of
transmitter-1 and transmitter-2 were $12.164$ dB and $12.131$ dB,
respectively. We numerically optimized the secure key rate for the channel
transmittance of these links by selecting appropriate parameters. Owing to the
similar channel transmittance for both users, their parameters were set as
follows: the intensities of the signal and decoy states were $\mu=0.52$ and
$\nu=0.13$, respectively. The probabilities of preparing the signal and decoy
states were $P_{\mu}=0.69$ and $P_{\nu}=0.31$, respectively. Additionally, the
probability of preparing the state in the $z$-basis was $0.9$, and that in the
$x$-basis was $0.1$. The bit frame used to modulate the quantum states had a
length of $2\times 10^{5}$, and the synchronization string had a length of
$L=10^{5}$. Thus, the ratio $M$ is equal to $1$. The lower bound of the secure
key rate is given by

$\displaystyle R\geqslant$
$\displaystyle(s_{z,0}^{L}+s_{z,1}^{L}(1-h\left(e_{z,1}^{ph}\right))-\lambda_{EC}$
(1)
$\displaystyle-6\log_{2}\frac{19}{\varepsilon_{sec}}-\log_{2}\frac{2}{\varepsilon_{cor}})\cdot
f\cdot M/N,$

where $s_{z,0}^{L}$ represents the lower bound of vacuum events in the
$z$-basis, $s_{z,1}^{L}$ represents the lower bound of single-photon events in
the $z$-basis, and $e_{z,1}^{ph}$ is the phase error rate of single-photon
events. $\lambda_{EC}=n_{z}f_{e}h(e_{z})$ represents the number of announced
bits in the error-correction stage, where $e_{z}$ denotes the quantum bit
error rate (QBER), and $f_{e}=1.16$ is the error correction factor. The term
$h(x)$ represents the binary Shannon entropy. $\varepsilon_{sec}$ and
$\varepsilon_{cor}$ are the secrecy and correctness criteria, equal to
$10^{-9}$ and $10^{-15}$, respectively. $f$ is the repetition frequency and
$N$ represents the total number of optical pulses, including synchronization
and random pulses.

We conducted time recovery on approximately $1$ s of detection data per
iteration. For the finite-size analysis, we consider sifted keys with a size
of $n_{z}=10^{7}$, accumulating approximately $50$ s of raw key data. As shown
in Figure 4, the average QBER for transmitter-1 (transmitter-2) was
$0.69\%(0.91\%)$. Average secure key rates for transmitter-1 and transmitter-2
were $53.84$ kbps and $71.90$ kbps, respectively.

To estimate the capacity of our scheme, we conducted a detailed analysis of
the network’s performance with an increasing number of users, considering our
system parameters. As the number of users increased, cross-talk between users
and increased loss lead to a reduction in the signal-to-noise ratio of the
received frame. These effects negatively affect network time synchronization
and operation. Similar to the analysis conducted by Fröhlich et al. [29], we
assessed the performance of each transmitter’s secure key rate in the presence
of cross-talk and loss. Initially, we evaluated the cross-talk introduced for
the time slot of transmitter-1 by measuring the excess counts introduced from
different time slots. The cross-talk for transmitter-1 was determined by
recording the increasing counts both with and without the presence of signals
from transmitter-2.

Based on the distribution of detection events in the clock window, we set the
width of the detection time slot to $1$ ns. For different transmitters with a
repetition rate of $50$ MHz, this allows up to $20$ users to access the
network simultaneously. Figure 5 (a) shows the relative increase in count rate
introduced by transmitter-2 at different time slots. Because there are
statistical fluctuations in transmitter-1’s signal, the effect of cross-talk
due to the remaining time slots was not considered.

The performance of users in an access network can be simulated based on cross-
talk test data. Figure 5 (b) shows the secure key rate of a single user in a
$64$-user network with varying numbers of active users and channel loss. The
channel loss includes losses from the fiber spool and a $1\times 64$ splitter,
which has a splitting ratio of $19.5$ dB, as obtained from a typical QAN
experiment [29].

For a small number of users, the transmission distance can reach $60$ km,
enabling each user to achieve a secure key rate of approximately $10^{4}$ bps.
If the transmission distance is limited to the maximum distance for a gigabit
passive optical network (GPON) of $20$ km, the network scheme can accommodate
64 users simultaneously. Under these conditions, the overall transmittance was
$27.6$ dB, and each user could achieve a secure key rate of $1070$ bps. The
simulation, which considers cross-talk, is detailed in Appendix B.

##  V Conclusion

We proposed and experimentally demonstrated a cost-efficient QAN that
eliminates the need for additional synchronization hardware. Our network
design benefits from qubit-based synchronization, enabling user access to QKD
using simple, cost-effective devices. We evaluated the network’s performance
with varying user capacities under system cross-talk through a simulation. The
results demonstrate that our network can support up to 64 users with key rates
up to 1070 bps.

Our design shows promise for building quantum infrastructure for a large user
base. In addition, benefitting from qubit-based synchronization, it naturally
removes the effect of Raman scattering of synchronous light on quantum signals
and is a promising new candidate for integrated quantum networks [34, 48],
which sacrifice channel spacing to mitigate the impact of strong light on
quantum signals. Our network can further reduce costs using a silicon-based
transmitter chip[49, 50, 51, 52, 53]. Furthermore, in addition to secure key
distribution, our scheme can apply to other cryptographic protocols, such as
secret sharing [54, 55] and digital signatures [56, 57].

## Acknowledgment

This study was supported by the National Natural Science Foundation of China
(Nos. 62171144 and 11905065), Guangxi Science Foundation
(Nos.2021GXNSFAA220011 and 2021AC19384), Open Fund of IPOC (BUPT) (No.
IPOC2021A02), and Innovation Project of Guangxi Graduate Education
(No.YCSW2022040).

##  Appendix A Time synchronization method

Here, we describe qubit-based synchronization in the QAN. Transmitter-$i$
performs periodic correlation encoding on the synchronization string
$S_{i}^{t}$, splits it into single bits, and periodically embeds each bit in a
random string to form a bit frame $F_{i}$, as shown in Figure 6(a). We define
$L$ as the length of the synchronization string, where $L_{1}$ is the length
of the small period and $N_{1}$ is the number of periodic peaks. The length of
a bit frame is $2L$, that is, each synchronization bit is followed by a random
bit. The number of random bits can be adjusted to increase the effective
secure key rate. For example, each synchronization bit connects $M$ random
bits to form a bit frame of length $(M+1)L$. The frame is used to modulate a
sequence of quantum signals based on the transmitter’s local clock $\tau_{i}$,
where the synchronization string is reused.

Each transmitter sends qubits frame by frame. These qubits are sent to the
receiver via a lossy channel. The receiver performs time synchronization based
on the measured qubits. For transmitter-$i$, the receiver must determine the
expected time of arrival $t_{i,a}^{e}$, which can be expressed as

$\displaystyle t_{i,a}^{e}$
$\displaystyle=t_{i,0}+n_{i,a}\tau^{R}+\epsilon_{i,a},\quad
n_{i,a}\in\mathbb{N},$ (2)

where $n_{i,a}$ is the order number of the qubit in the qubit string sent by
transmitter-$i$, $a$ denotes the $a$-th detection, and $t_{i,0}$ is the
absolute time offset between transmitter-$i$ and the receiver. $n_{i,a}$ is a
variable that satisfies the normal distribution, with expected value zero and
variance $\sigma^{2}$.

Figure 6: (a) Synchronization string $S_{i}^{t}$ of length $L$ is
reconstructed into the matrix $M_{i}$, where $L_{1}$ is the length of the
small period and $N_{1}$ is the number of periods. (b) Received qubit frame
$r_{n}$ of length $2L$ comes from a detection slot. The string is divided into
two strings: one containing synchronous qubits and the other containing random
qubits. Two strings are reshaped into two matrices $C_{n}$ and subjected to
the cross-correlation operation with the public synchronization matrix
$M_{i}$.

We first describe how the receiver recovers the clock $\tau^{R}$ from the
measured signals. The clock is initially estimated based on the time-of-
arrival signals by applying a fast Fourier transform. We sample the time of
the measured signal at a sampling rate of $4/\tau_{i}$. The number of samples
$N_{f}$ used to perform the Fourier transform is set to $10^{6}$. Then, the
least trimmed square algorithm is applied to these sampled signals to obtain a
more precise clock satisfying

$\displaystyle\frac{1}{D}\sum_{b=1}^{D}\left|\mathcal{E}_{a}^{I}(b)\right|^{2}\simeq\sigma^{2},$
(3)

where $\mathcal{E}_{a}=t_{a}^{m}-t_{a}^{e}$ denotes the error between the
measured and expected times of arrival for all transmitter signals, and
$t_{a}^{m}$ is the measured time-of-arrival of signals with $a\geq 1$.
$\mathcal{E}_{a}^{I}(b)=\mathcal{E}_{a+b}-\mathcal{E}_{a}$ indicates the time
interval error between two different detection events $a$ and $a+b$.The
detection time slot $T_{n}$ in the clock window $\tau^{R}$ can be determined
by

$\displaystyle T_{n}=mod_{\tau^{R}}(t_{a}^{m}).$ (4)

The arrival time $t_{n,a}^{m}$ of the different transmitters’ detection events
can be correctly divided from $t_{a}^{m}$ based on the recovered clock
$\tau^{R}$. Owing to channel loss and background noise, the demarcated slots
may deviate from the slots pre-designated by the calibration process.
Therefore, the receiver must identify the transmitter corresponding to the
time slot.

To determine which time slot transmitter-$i$ corresponds to and to recover the
time offset $t_{i,0}$, the receiver calculates the correlation between the
received frame and the public synchronization string $S_{i}^{t}$. The
synchronization string is encoded on the $z$-basis and we label the
quadrature-encoded qubits as $+1$ and $-1$. In Figure 6(a), to reduce the
complexity of the cross-correlation algorithm, the string $S_{i}^{t}$ with
periodic correlation is converted into the matrix $M_{i}$, where $L_{1}$ is
the length of the small period and $N_{1}$ is the number of periodic peaks.

We extract the received qubit frame from each detection time slot. As shown in
Figure 6(b), the receiver extracts a received qubit frame $r_{n}$ of length
$2L$, in which the qubits not detected are recorded as $0$, as are those
clicked on the $x$-basis detector. The qubits that click the $z$-basis
detector are assigned +$1$ and -$1$, consistent with the encoding definition
of the synchronization string. Based on the structure of the bit frame sent by
the transmitter, the received qubit frame $r_{n}$ can be divided into two
strings, one for key generation and the other for synchronization. The two
strings are reconstructed into two matrices $C_{n}$ following the rule of
matrix $M_{i}$. By exploiting the correlation between the first column of
matrices $C_{n}$ and the public matrix $M_{i}$, the maximal correlation helps
identify the synchronization qubit string and the corresponding time slot.
Finally, according to the maximum correlation position between the received
matrix $C_{i}$ and the public matrix $M_{i}$, the time offset $t_{i,0}$
between the received frame and sent by transmitter-$i$ can be recovered.

##  Appendix B Channel model with cross-talk

We simulate the secure key rate per user based on the measured cross-talk
result. Intuitively, cross-talk leads to an increase in the gain and error
rate. The gain and quantum bit error rate are similar to those of the model
considered by Fröhlich et al. [29], except for excluding the after-pulse of
the detector. Here, we use an SNSPD to detect quantum signals. The SNSPD is
also possibly subject to after-pulsing that arises not from the SNSPD itself,
but rather from the electronic readout module [58, 59, 60]. Marsili et al.
[59] showed that this after-pulsing can be eliminated with appropriate
treatment. Thus, the gain and QBER for intensity $k\in\\{\mu,\nu\\}$ in
$z$-basis are given by

$\displaystyle Q_{z,k}$
$\displaystyle=k\eta(1+\frac{p_{T}}{N_{c}-1}(n-1))+p_{dc},$ (5) $\displaystyle
E_{z,k}$
$\displaystyle=\frac{k\eta(p_{opt}+\frac{1}{2}\frac{p_{T}}{N_{c}-1}(n-1))+\frac{p_{dc}}{2}}{Q_{z,k}},$

where $N_{c}$ is the network capacity, $n$ is the number of active users,
$p_{dc}$ is the dark count rate, and $p_{opt}$ is the optical error owing to
misalignment. The overtransmittance $\eta$ of the system is given by
$\eta=\eta_{ch}\eta_{spl}\eta_{r}$, which includes the channel, splitter
transmittance, and the entire receiver transmittance. The channel
transmittance is $\eta_{ch}=10^{-\alpha L/10}$, where $L$ is the fiber length
and $\alpha$ is the loss coefficient of standard fiber. The splitter
transmittance $\eta_{spl}$ can be calculated using the splitter parameters of
a typical QAN experiment [29]. The splitting ratio of a $1\times 64$ splitter
is $19.5$ dB. The count increase rate $p_{T}$ can be extracted from the cross-
talk data shown in Figure 5. The specific values of these parameters are
listed in Table 1. Finally, the QBER in the $z$-basis is given by

$\displaystyle e_{z}$
$\displaystyle=\frac{P_{\mu}E_{z,\mu}+P_{\nu}E_{z,\nu}}{P_{\mu}Q_{z,\mu}+P_{\nu}Q_{z,\nu}}.$
(6)

Table 1: Practical parameters for numerical simulations, including the optical misalignment $p_{opt}$, dark count rate $p_{dc}$ and total receiver transmittance $\eta_{r}$. The count increase rate caused by cross-talk is represented by $p_{T}$. $\alpha$ denotes the loss coefficient of standard fiber. $p_{opt}$ | $\eta_{r}$ | $p_{dc}$ | $p_{T}$ | $\alpha$
---|---|---|---|---
$1\%$ | $38.8\%$ | $6\times 10^{-8}$ | $0.98\%$ |  $0.2$ dB/km

## References

  * Bennett and Brassard [1984] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, in  _Proceedings of IEEE International Conference on Computers, Systems and Signal Processing_ (IEEE, New York, Bangalore, India, 1984) pp. 175–179.
  * Lo and Chau [1999] H.-K. Lo and H. F. Chau, Unconditional security of quantum key distribution over arbitrarily long distances, Science 283, 2050 (1999).
  * Shor and Preskill [2000] P. W. Shor and J. Preskill, Simple proof of security of the bb84 quantum key distribution protocol, Phys. Rev. Lett. 85, 441 (2000).
  * Gottesman  _et al._ [2004] D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, Security of quantum key distribution with imperfect devices, Quant. Inf. Comput. 4, 325 (2004).
  * Lo  _et al._ [2005] H.-K. Lo, X. Ma, and K. Chen, Decoy state quantum key distribution, Phys. Rev. Lett. 94, 230504 (2005).
  * Wang [2005] X.-B. Wang, Beating the photon-number-splitting attack in practical quantum cryptography, Phys. Rev. Lett. 94, 230503 (2005).
  * Lo  _et al._ [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Lucamarini  _et al._ [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Ma  _et al._ [2018] X. Ma, P. Zeng, and H. Zhou, Phase-matching quantum key distribution, Phys. Rev. X 8, 031043 (2018).
  * Wang  _et al._ [2018] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Twin-field quantum key distribution with large misalignment error, Phys. Rev. A 98, 062323 (2018).
  * Zeng  _et al._ [2022] P. Zeng, H. Zhou, W. Wu, and X. Ma, Mode-pairing quantum key distribution, Nat. Commun. 13, 3903 (2022).
  * Boaron  _et al._ [2018] A. Boaron, G. Boso, D. Rusca, C. Vulliez, C. Autebert, M. Caloz, M. Perrenoud, G. Gras, F. Bussières, M.-J. Li, D. Nolan, A. Martin, and H. Zbinden, Secure quantum key distribution over 421 km of optical fiber, Phys. Rev. Lett. 121, 190502 (2018).
  * Grünenfelder  _et al._ [2020] F. Grünenfelder, A. Boaron, D. Rusca, A. Martin, and H. Zbinden, Performance and security of 5 ghz repetition rate polarization-based quantum key distribution, Appl. Phys. Lett. 117, 144003 (2020).
  * Wei  _et al._ [2020] K. Wei, W. Li, H. Tan, Y. Li, H. Min, W.-J. Zhang, H. Li, L. You, Z. Wang, X. Jiang, T.-Y. Chen, S.-K. Liao, C.-Z. Peng, F. Xu, and J.-W. Pan, High-speed measurement-device-independent quantum key distribution with integrated silicon photonics, Phys. Rev. X 10, 031030 (2020).
  * Paraiso  _et al._ [2021] T. K. Paraiso, T. Roger, D. G. Marangon, I. De Marco, M. Sanzaro, R. I. Woodward, J. F. Dynes, Z. Yuan, and A. J. Shields, A photonic integrated quantum secure communication system, Nature Photon. 15, 850 (2021).
  * Zhou  _et al._ [2023] L. Zhou, J. Lin, Y. Jing, and Z. Yuan, Twin-field quantum key distribution without optical frequency dissemination, Nature Commun. 14, 1 (2023).
  * Grünenfelder  _et al._ [2023] F. Grünenfelder, A. Boaron, G. V. Resta, M. Perrenoud, D. Rusca, C. Barreiro, R. Houlmann, R. Sax, L. Stasi, S. El-Khoury, _et al._ , Fast single-photon detectors and real-time key distillation enable high secret-key-rate quantum key distribution systems, Nat. Photon. , 1 (2023).
  * Li  _et al._ [2023] W. Li, L. Zhang, H. Tan, Y. Lu, S.-K. Liao, J. Huang, H. Li, Z. Wang, H.-K. Mao, B. Yan, _et al._ , High-rate quantum key distribution exceeding 110 mb s-1, Nat. Photon. 17, 416 (2023).
  * Liu  _et al._ [2023] Y. Liu, W.-J. Zhang, C. Jiang, J.-P. Chen, C. Zhang, W.-X. Pan, D. Ma, H. Dong, J.-M. Xiong, C.-J. Zhang, H. Li, R.-C. Wang, J. Wu, T.-Y. Chen, L. You, X.-B. Wang, Q. Zhang, and J.-W. Pan, Experimental twin-field quantum key distribution over 1000 km fiber distance, Phys. Rev. Lett. 130, 210801 (2023).
  * Chen  _et al._ [2010] T.-Y. Chen, J. Wang, H. Liang, W.-Y. Liu, Y. Liu, X. Jiang, Y. Wang, X. Wan, W.-Q. Cai, L. Ju, L.-K. Chen, L.-J. Wang, Y. Gao, K. Chen, C.-Z. Peng, Z.-B. Chen, and J.-W. Pan, Metropolitan all-pass and inter-city quantum communication network, Opt. Express 18, 27217 (2010).
  * Sasaki  _et al._ [2011] M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, and A. Zeilinger, Field test of quantum key distribution in the tokyo qkd network, Opt. Express 19, 10387 (2011).
  * Bunandar  _et al._ [2018] D. Bunandar, A. Lentine, C. Lee, H. Cai, C. M. Long, N. Boynton, N. Martinez, C. DeRose, C. Chen, M. Grein, D. Trotter, A. Starbuck, A. Pomerene, S. Hamilton, F. N. C. Wong, R. Camacho, P. Davids, J. Urayama, and D. Englund, Metropolitan quantum key distribution with silicon photonics, Phys. Rev. X 8, 021009 (2018).
  * Avesani  _et al._ [2021] M. Avesani, L. Calderaro, G. Foletto, C. Agnesi, F. Picciariello, F. B. Santagiustina, A. Scriminich, A. Stanco, F. Vedovato, M. Zahidy, _et al._ , Resource-effective quantum key distribution: a field trial in padua city center, Opt. lett. 46, 2848 (2021).
  * Chen  _et al._ [2021a] T.-Y. Chen, X. Jiang, S.-B. Tang, L. Zhou, X. Yuan, H. Zhou, J. Wang, Y. Liu, L.-K. Chen, W.-Y. Liu, _et al._ , Implementation of a 46-node quantum metropolitan area network, Npj Quantum Inf. 7, 134 (2021a).
  * Chen  _et al._ [2021b] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. Zhang, K. Chen, J. Yin, J.-G. Ren, Z. Chen, _et al._ , An integrated space-to-ground quantum communication network over 4,600 kilometres, Nature 589, 214 (2021b).
  * Zhong  _et al._ [2022] X. Zhong, W. Wang, R. Mandil, H.-K. Lo, and L. Qian, Simple multiuser twin-field quantum key distribution network, Phys. Rev. Appl. 17, 014025 (2022).
  * Fan-Yuan  _et al._ [2022] G.-J. Fan-Yuan, F.-Y. Lu, S. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, Z. Zhou, Z.-H. Wang, J. Teng, G.-C. Guo, and Z.-F. Han, Robust and adaptable quantum key distribution network without trusted nodes, Optica 9, 812 (2022).
  * Choi  _et al._ [2010] I. Choi, R. J. Young, and P. D. Townsend, Quantum key distribution on a 10gb/s wdm-pon, Opt. Express 18, 9600 (2010).
  * Fröhlich  _et al._ [2013] B. Fröhlich, J. Dynes, M. Lucamarini, A. Sharpe, Z. Yuan, and A. Shields, A quantum access network, Nature 501, 69 (2013).
  * Fröhlich  _et al._ [2015] B. Fröhlich, J. Dynes, M. Lucamarini, A. Sharpe, S. Tam, Z. Yuan, and A. Shields, Quantum secured gigabit optical access networks, Sci. Rep. 5, 10.1038/srep18121 (2015).
  * Liu  _et al._ [2022a] A. Liu, X. Yu, Q. Zhu, Y. Zhao, A. Nag, and J. Zhang, Sync-sequence based synchronization scheme in qkd-secured access networks, in  _2022 20th International Conference on Optical Communications and Networks (ICOCN)_ (IEEE, 2022) pp. 1–3.
  * Wang  _et al._ [2023] X. Wang, Z. Chen, Z. Li, D. Qi, S. Yu, and H. Guo, Experimental upstream transmission of continuous variable quantum key distribution access network, Opt. Lett. 48, 3327 (2023).
  * Sun  _et al._ [2018] W. Sun, L.-J. Wang, X.-X. Sun, Y. Mao, H.-L. Yin, B.-X. Wang, T.-Y. Chen, and J.-W. Pan, Experimental integration of quantum key distribution and gigabit-capable passive optical network, J. Appl. Phys. 123, 043105 (2018).
  * Wang  _et al._ [2021] B.-X. Wang, S.-B. Tang, Y. Mao, W. Xu, M. Cheng, J. Zhang, T.-Y. Chen, and J.-W. Pan, Practical quantum access network over a 10 gbit/s ethernet passive optical network, Opt. Express 29, 38582 (2021).
  * Huang  _et al._ [2021] Y. Huang, T. Shen, X. Wang, Z. Chen, B. Xu, S. Yu, and H. Guo, Realizing a downstream-access network using continuous-variable quantum key distribution, Phys. Rev. Appl. 16, 064051 (2021).
  * Sauge  _et al._ [2011] S. Sauge, L. Lydersen, A. Anisimov, J. Skaar, and V. Makarov, Controlling an actively-quenched single photon detector with bright light, Opt. Express 19, 23590 (2011).
  * Qian  _et al._ [2018] Y.-J. Qian, D.-Y. He, S. Wang, W. Chen, Z.-Q. Yin, G.-C. Guo, and Z.-F. Han, Hacking the quantum key distribution system by exploiting the avalanche-transition region of single-photon detectors, Phys. Rev. Appl. 10, 064062 (2018).
  * Wei  _et al._ [2019] K. Wei, W. Zhang, Y.-L. Tang, L. You, and F. Xu, Implementation security of quantum key distribution due to polarization-dependent efficiency mismatch, Phys. Rev. A 100, 022325 (2019).
  * Tang  _et al._ [2016] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, T.-Y. Chen, and J.-W. Pan, Measurement-device-independent quantum key distribution over untrustful metropolitan network, Phys. Rev. X 6, 011024 (2016).
  * Yin  _et al._ [2017] H.-L. Yin, W.-L. Wang, Y.-L. Tang, Q. Zhao, H. Liu, X.-X. Sun, W.-J. Zhang, H. Li, I. V. Puthoor, L.-X. You, E. Andersson, Z. Wang, Y. Liu, X. Jiang, X. Ma, Q. Zhang, M. Curty, T.-Y. Chen, and J.-W. Pan, Experimental measurement-device-independent quantum digital signatures over a metropolitan network, Phys. Rev. A 95, 10.1103/PhysRevA.95.042338 (2017).
  * Wang  _et al._ [2019] W. Wang, F. Xu, and H.-K. Lo, Asymmetric protocols for scalable high-rate measurement-device-independent quantum key distribution networks, Phys. Rev. X 9, 041012 (2019).
  * Fan-Yuan  _et al._ [2021] G.-J. Fan-Yuan, F.-Y. Lu, S. Wang, Z.-Q. Yin, D.-Y. He, Z. Zhou, J. Teng, W. Chen, G.-C. Guo, and Z.-F. Han, Measurement-device-independent quantum key distribution for nonstandalone networks, Photon. Res. 9, 1881 (2021).
  * Park  _et al._ [2022] C. H. Park, M. K. Woo, B. K. Park, Y.-S. Kim, H. Baek, S.-W. Lee, H.-T. Lim, S.-W. Jeon, H. Jung, S. Kim, _et al._ , 2 $\times$ n twin-field quantum key distribution network configuration based on polarization, wavelength, and time division multiplexing, npj Quantum Information 8, 1 (2022).
  * Dynes  _et al._ [2019] J. Dynes, A. Wonfor, W.-S. Tam, A. Sharpe, R. Takahashi, M. Lucamarini, A. Plews, Z. Yuan, A. Dixon, J. Cho, _et al._ , Cambridge quantum network, Npj Quantum Inf. 5, 101 (2019).
  * Chen  _et al._ [2023] Y. Chen, C. Huang, S. Huang, Z. Zhang, and K. Wei, Qubit-based distributed frame synchronization for quantum key distribution (2023), arXiv:2308.13154 [quant-ph] .
  * Calderaro  _et al._ [2020] L. Calderaro, A. Stanco, C. Agnesi, M. Avesani, D. Dequal, P. Villoresi, and G. Vallone, Fast and simple qubit-based synchronization for quantum key distribution, Phys. Rev. Appl. 13, 054041 (2020).
  * Ma  _et al._ [2021] D. Ma, X. Liu, C. Huang, H. Chen, H. Lin, and K. Wei, Simple quantum key distribution using a stable transmitter-receiver scheme, Opt. Lett. 46, 2152 (2021).
  * Geng  _et al._ [2021] J.-Q. Geng, G.-J. Fan-Yuan, S. Wang, Q.-F. Zhang, Y.-Y. Hu, W. Chen, Z.-Q. Yin, D.-Y. He, G.-C. Guo, and Z.-F. Han, Coexistence of quantum key distribution and optical transport network based on standard single-mode fiber at high launch power, Opt. Lett. 46, 2573 (2021).
  * Ma  _et al._ [2016] C. Ma, W. D. Sacher, Z. Tang, J. C. Mikkelsen, Y. Yang, F. Xu, T. Thiessen, H.-K. Lo, and J. K. S. Poon, Silicon photonic transmitter for polarization-encoded quantum key distribution, Optica 3, 1274 (2016).
  * Liu  _et al._ [2022b] Q. Liu, Y. Huang, Y. Du, Z. Zhao, M. Geng, Z. Zhang, and K. Wei, Advances in chip-based quantum key distribution, Entropy 24, 1334 (2022b).
  * Sax  _et al._ [2023] R. Sax, A. Boaron, G. Boso, S. Atzeni, A. Crespi, F. Grünenfelder, D. Rusca, A. Al-Saadi, D. Bronzi, S. Kupijai, H. Rhee, R. Osellame, and H. Zbinden, High-speed integrated qkd system, Photon. Res. 11, 1007 (2023).
  * Wei  _et al._ [2023] K. Wei, X. Hu, Y. Du, X. Hua, Z. Zhao, Y. Chen, C. Huang, and X. Xiao, Resource-efficient quantum key distribution with integrated silicon photonics, Photon. Res. 11, 1364 (2023).
  * Du  _et al._ [2023] Y. Du, X. Zhu, X. Hua, Z. Zhao, X. Hu, Y. Qian, X. Xiao, and K. Wei, Silicon-based decoder for polarization-encoding quantum key distribution, Chip 2, 100039 (2023).
  * Wei  _et al._ [2013] K. Wei, H. Ma, and J. Yang, Experimental circular quantum secret sharing over telecom fiber network, Opt. Express 21, 16663 (2013).
  * Shen  _et al._ [2023] A. Shen, X.-Y. Cao, Y. Wang, Y. Fu, J. Gu, W.-B. Liu, C.-X. Weng, H.-L. Yin, and Z.-B. Chen, Experimental quantum secret sharing based on phase encoding of coherent states, Sci. China-Phys. Mech. Astron. 66, 260311 (2023).
  * Roberts  _et al._ [2017] G. L. Roberts, M. Lucamarini, Z. L. Yuan, J. F. Dynes, L. C. Comandar, A. W. Sharpe, A. J. Shields, M. Curty, I. V. Puthoor, and E. Andersson, Experimental measurement-device-independent quantum digital signatures, Nat. Commum. 8, 1098 (2017).
  * Yin  _et al._ [2022] H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quantum secure network with digital signatures and encryption, Natl. Sci. Rev. 10, 10.1093/nsr/nwac228 (2022).
  * Fujiwara  _et al._ [2011] M. Fujiwara, A. Tanaka, S. Takahashi, K. Yoshino, Y. Nambu, A. Tajima, S. Miki, T. Yamashita, Z. Wang, A. Tomita, and M. Sasaki, Afterpulse-like phenomenon of superconducting single photon detector in high speed quantum key distribution system, Opt. Express 19, 19562 (2011).
  * Marsili  _et al._ [2012] F. Marsili, F. Najafi, E. Dauler, R. J. Molnar, and K. K. Berggren, Afterpulsing and instability in superconducting nanowire avalanche photodetectors, Appl. Phys. Lett. 100, 112601 (2012).
  * Burenkov  _et al._ [2013] V. Burenkov, H. Xu, B. Qi, R. H. Hadfield, and H.-K. Lo, Investigations of afterpulsing and detection efficiency recovery in superconducting nanowire single-photon detectors, J. Appl. Phys. 113, 213102 (2013).