# Micius quantum experiments in space

Chao-Yang Lu  Hefei National Laboratory for Physical Sciences at Microscale
and Department of Modern Physics, University of Science and Technology of
China, Hefei, Anhui 230026, China  CAS Center for Excellence and Synergetic
Innovation Center in Quantum Information and Quantum Physics, University of
Science and Technology of China, Shanghai, 201315, China  Yuan Cao  Hefei
National Laboratory for Physical Sciences at Microscale and Department of
Modern Physics, University of Science and Technology of China, Hefei, Anhui
230026, China  CAS Center for Excellence and Synergetic Innovation Center in
Quantum Information and Quantum Physics, University of Science and Technology
of China, Shanghai, 201315, China  Cheng-Zhi Peng  Hefei National Laboratory
for Physical Sciences at Microscale and Department of Modern Physics,
University of Science and Technology of China, Hefei, Anhui 230026, China  CAS
Center for Excellence and Synergetic Innovation Center in Quantum Information
and Quantum Physics, University of Science and Technology of China, Shanghai,
201315, China  Jian-Wei Pan<EMAIL_ADDRESS>Hefei National Laboratory for
Physical Sciences at Microscale and Department of Modern Physics, University
of Science and Technology of China, Hefei, Anhui 230026, China  CAS Center for
Excellence and Synergetic Innovation Center in Quantum Information and Quantum
Physics, University of Science and Technology of China, Shanghai, 201315,
China

###### Abstract

Quantum theory has been successfully validated in numerous laboratory
experiments. But would such a theory, which excellently describes the behavior
of microscopic physical systems, and its predicted phenomena such as quantum
entanglement, be still applicable on very large length scales? From a
practical perspective, how can quantum key distribution—where the security of
establishing secret keys between distant parties is ensured by the laws of
quantum mechanics—be made technologically useful on a global scale? Due to
photon loss in optical fibers and terrestrial free space, the achievable
distance using direct transmission of single photons has been limited to a few
hundred kilometers. A promising route to testing quantum physics over long
distances and in the relativistic regimes, and thus realizing flexible global-
scale quantum networks is via the use of satellites and space-based
technologies, where a significant advantage is that the photon loss and
turbulence predominantly occurs in the lower ~10 km of the atmosphere, and
most of the photons’ transmission path in the space is virtually in vacuum
with almost zero absorption and decoherence. In this Article, we review the
progress in free-space quantum experiments, with a focus on the fast-
developing Micius satellite-based quantum communications. The perspective of
space-ground integrated quantum networks and fundamental quantum optics
experiments in space conceivable with satellites are discussed.

###### Contents

  1. I Introduction
  2. II Small-scale quantum communications
    1. II.1 First proof-of-concept demonstrations
    2. II.2 Early efforts toward longer distances
      1. II.2.1 Quantum key distribution
      2. II.2.2 Entanglement distribution
      3. II.2.3 Quantum teleportation
  3. III Challenges in practical and large-scale applications
    1. III.1 Security loopholes
    2. III.2 Long distances
  4. IV Quantum repeater and its progress
  5. V Satellite-based free-space channels
    1. V.1 Analysis of space-ground links
    2. V.2 Feasible channel parameters for the low-Earth orbit satellite
  6. VI Ground-based feasibility studies and key technologies
    1. VI.1 Overcoming the effective atmospheric thickness
    2. VI.2 Feasibility of satellite-to-ground one and two-downlink channels, and ground-to-satellite uplink channel
    3. VI.3 Testing with moving and vibrating objects
    4. VI.4 Time synchronization
    5. VI.5 Polarization maintenance and compensation
    6. VI.6 Other parallel ground-based free-space experiments
  7. VII Developing and testing of the satellite payloads
    1. VII.1 Payload design
    2. VII.2 Testing the payload under various conditions
  8. VIII Construction of cooperative ground stations
  9. IX Satellite-based quantum experiments with Micius
    1. IX.1 Satellite-to-ground quantum key distribution
    2. IX.2 Satellite-based entanglement distribution
    3. IX.3 Entanglement-based quantum key distribution
    4. IX.4 Ground-to-satellite quantum teleportation
    5. IX.5 Satellite-relayed intercontinental quantum key distribution
    6. IX.6 Probing gravity-induced decoherence
  10. X Other quantum satellite projects
  11. XI Outlook
    1. XI.1 Daytime quantum communications
    2. XI.2 Satellite-constellation-based quantum networks
    3. XI.3 Fundamental test of quantum physics at space scale
  12. XII Acknowledgement

##  I Introduction

Privacy and security are rooted in human beings since ancient times. They
underpin human dignity and are among the most important human rights. With the
exponential growth of the Internet and the use of e-commerce, it is critically
important to establish a secure global network. Cryptography, the use of codes
and ciphers to protect secrets, began thousands of years ago. Traditional
public-key cryptography usually relies on the perceived computational
intractability of certain mathematical functions. However, history shows that
many advances in classical cryptography were subsequently defeated by advances
in cracking. Thus it has even been suggested that “human ingenuity cannot
concoct a cipher which human ingenuity cannot resolve” [157].

It might come as a surprise that the very fundamental principle of quantum
mechanics was exploited to solve this long-standing problem on information
security that mathematicians struggled with for centuries. The first idea
along these lines was proposed in the 1970s by Stephen Wiesner who designed
quantum banknotes using quantum two-state systems and conjugate encoding,
which would be impossible to counterfeit. The principal drawback of Wiesner’s
idea was that it would require quantum information in superposition states to
be held captive and kept coherent for long periods of time, which appears to
be beyond even the technological capability of today, 50 years later. Inspired
by Wiesner’s idea, in the 1980s, Charles Bennett and Gilles Brassard put
forward a feasible protocol of quantum key distribution (QKD) known as BB84
[16]. This protocol permits two distant communicating parties to produce a
common, random string of secret bits, called a secret key. This key can then
be used alongside the one-time pad encryption which, as strictly proven by
Shannon in 1949 [188], is an unconditionally secure method to encrypt and
decrypt a message.

A remarkable surge of interest in the international scientific and industrial
community has propelled quantum cryptography into mainstream computer science
and physics in the past few years. Particularly after the invention of Shor’s
quantum factoring algorithm in 1994, an important goal of the field is to
transform the beautiful idea of QKD into a practically useful technology.
While significant progress has been made in small-scale demonstrations [17,
24], the real challenge is to increase the communication range to large
distances, eventually to a global scale. Due to photon loss in the channel,
the range of secure QKD via direct transmission of single photons is limited
to a few hundred kilometers (see Section II and III). Unlike classical bits,
the quantum signal of QKD cannot be noiselessly amplified due to the
implications of the quantum non-cloning theorem [230], where the security of
the QKD is rooted [71].

One potential solution to this notorious scalability problem is via the use of
quantum repeaters [27]. However, the current state of quantum memories [237]
and quantum repeaters remains far from practical applications in realistic
long-distance quantum communications (see Section IV).

A more promising solution for global-scale QKD is to utilize satellites, which
can conveniently connect two distant locations on Earth. An important
advantage of satellite-based free-space quantum communications is that the
photon loss induced by atmospheric absorption and scattering predominantly
occur only in the lower $\sim$10 km of the atmosphere, with about a 3 dB loss
on a clear day. Most of the photon transmission is across a near-vacuum
environment, with almost no absorption and decoherence. The loss caused by
beam diffraction is approximately proportional to the square of distance. By
contrast, the losses in fiber channels are predominantly due to the absorption
and scattering of the fiber medium, which is proportional to the exponent of
the distance. Thus, for long communicating distances (typically hundreds to
thousands of kilometers) the satellite-ground free-space channels will have
advantages over fiber-based channels, in terms of channel losses (for more
details, see section V).

In addition to QKD, the use of quantum communication in space would be
beneficial for the testing of fundamental principles of quantum physics on a
large scale. The confirmation of the laws of physics is restricted by the
boundaries of our experimental observations. For instance, quantum mechanics
predicts that it is possible to observe quantum entanglement over any
distance; however, it is necessary to confirm such a prediction and verify
whether unexpected effects (such as the influence of gravitational fields)
place some bound on such distances [156]. New satellite-based laboratories in
space would create vast platforms for fundamental experiments in quantum
optics at distances that are previously inaccessible on the ground, such as
long-range Bell tests [14] with human’s free will [80, 36, 45], and the
probing of the interaction of quantum mechanics with general relativity [172].

Due to the low-gravity and ultra-stable conditions in space, many experiments
related to quantum physics that cannot be undertaken on the ground can be
achieved in space. High-precision measurements on quantum systems, especially
those involves matter waves, in the presence of a gravitational field could
challenge our understanding of general relativity and quantum mechanics.
Researchers from Germany, France, and the United States created Bose-Einstein
condensate in space and conducted 110 experiments central to matter-wave
interferometry, as part of the sounding-rocket mission MAIUS-1 in 2017 [11].

Exploiting the persistent free fall condition of a low Earth orbit, cold atom
systems can take advantage of microgravity, which is high on the to-do-list in
the next-generation experiments. The Cold Atom Lab (CAL) is designed to
provide the first ultracold quantum gas experiment aboard the ISS utilizing an
apparatus developed, assembled, and qualified by NASA’s Jet Propulsion
Laboratory (JPL); this facility was successfully launched on 21th May, 2018
[56] and has been installed on the ISS. Recently, a proposal for the mission
“Space Atomic Gravity Explorer” (SAGE) was presented to the European Space
Agency. It has the scientific objective to investigate gravitational waves,
dark matter, and other fundamental aspects of gravity, alongside investigating
the connection between gravitational physics and quantum physics using new
quantum sensors, namely, optical atomic clocks and atom interferometers based
on ultracold strontium atoms [206]. The successful operation of LISA
Pathfinder [3] paves the way for the space optical Laser Interferometer Space
Antenna (LISA), which will observe gravitational waves at low frequencies,
with a peak sensitivity in the range 1-10 mHz. In the SAGE proposal, by using
the atomic sensors, the observation of gravitational waves in the low
frequency range (from $10^{-3}$ Hz to 10 Hz) is possible. This proposal will
complement the LISA as an alternative technology, and more importantly, it
will provide a measurement method in the range between those of the LISA and
terrestrial detectors [101].

Figure 1: Overview of the distance scales and the corresponding conceived
quantum experiments [172].

Using satellite-based free-space channels can be regarded as extending the
space scale of quantum experiments from several meters to the magnitude of
thousands of kilometers or more, as shown in Fig.1 [172], which allows us to
explore the nature of the quantum world at increasingly large length scales.
It is of great interest to carry out quantum experiments on such a large space
scale in terms of fundamental scientific interest as well as practical
applications.

The focus of this article is to review the developments in satellite-based
quantum communications and fundamental tests of quantum physics using the
Micius satellite. This review begins by introducing early ideas [164, 90] and
preliminary tests [33, 5, 103]. To envision a practically working low-earth-
orbit satellite under feasible budget, serious numerical analysis and
engineering considerations were put forward and summarised in Section III and
V. Step-by-step ground-based feasibility studies [151, 216, 221, 96, 243, 122,
242, 37, 226, 137] and developments of the key technologies required are
reviewed in Section VI. For example, entanglement distribution over a
terrestrial free-space channel with a length of 13 km was demonstrated in
[151], proving that the entanglement can extend over distances greater than
the effective atmospheric thickness. Bidirectional distribution of entangled
photons [243] was later performed over a distance of 102 km with an $\sim$80
dB effective channel loss, which was comparable to that of a two-downlink
channel from a satellite to the ground. Finally, the full verification, in
conditions of rapid motion and random movement of satellites, attitude change,
vibration, and a high-loss regime, addressing a wide range of all parameters
relevant to low-Earth orbit satellites, has been carried out [226]. During
these feasibility studies, the necessary toolbox for satellite-based long-
distance quantum communications has been gradually developed, including robust
and compact quantum light sources, narrow beam divergence, time
synchronization, and rapid acquiring, pointing, and tracking (APT)
technologies, which are the key to the optimization of the link efficiency and
overcoming the atmospheric turbulence. This body of work was sufficient
groundwork to permit the funding of the Micius satellite project for quantum
experiments in the framework of Chinese Academy of Sciences Strategic Priority
Program.

The satellite, which is dedicated to quantum science experiments, named after
the 4th century BCE Chinese philosopher Micius, was launched from China in
August 2016. Within a year of the launch, three key milestones for a global-
scale quantum communication network were achieved: (1) satellite-to-ground
decoy-state QKD with KHz rate over a distance of up to 1200 km [107] and
satellite-replayed intercontinental key exchange [106], (2) satellite-based
entanglement distribution to two locations on the Earth separated by 1205 km
and subsequent Bell test [240], and (3) ground-to-satellite quantum
teleportation [167]. These experiments established the possibility of
effective link efficiencies through satellite of 12-20 orders of magnitudes
greater than direct transmission through optical fibers over a distance of
$\sim$1200 km. A comprehensive survey and an analysis of these works are
presented in Section VII, VIII, and IX.

Meanwhile, with the success of the Micius satellite, an international race
related to quantum communication experiments in space is predicted to start.
Many satellite projects designed for quantum communications have been approved
and funded, such as the Quantum Encryption and Science Satellite (QEYSSat)
project in Canada [94], and the CubeSat Quantum Communications Mission
(CQuCoM) undertaking by a joint research team [141]. Meanwhile, more extensive
studies of quantum physics in space, including matter-wave in the presence of
a gravitational field, are also being implemented or in the planning stages
(more details can be found in Section X).

This review ends with an outlook on the future work that needs to be done to
eventually build a global-scale practical quantum networks. Outstanding
challenges include enabling daytime operation of QKD [109], increasing time
and area coverage through the use of higher-orbit satellites, and constructing
satellite constellations; these challenges are being considered and addressed
by the ongoing research efforts in this emerging field.

##  II Small-scale quantum communications

###  II.1 First proof-of-concept demonstrations

Quantum superposition is one of the fundamental principles of quantum
mechanics; this property distinguishes a quantum state from a classical one.
In a classical two-value system, for example a coin, we find it in either one
of its two possible states, that is, either heads or tails. In its quantum
counterpart, however, a two-state quantum system can be found in any
superposition of the two possible basis states, e.g.,
$|\Psi\rangle=(1/\sqrt{2})(|0\rangle+|1\rangle)$, where the two orthogonal
basis states are denoted by $|0\rangle$ and $|1\rangle$. In the classical
world, two coins can be found in one of the states heads/heads, heads/tails,
tails/heads, or tails/tails, and we can identify these four possibilities with
the four quantum states $|0\rangle_{1}|0\rangle_{2}$,
$|0\rangle_{1}|1\rangle_{2}$, $|1\rangle_{1}|0\rangle_{2}$, and
$|1\rangle_{1}|1\rangle_{2}$, which describes the two-state quantum systems.

The superposition principle applies also to more than one quantum system; the
two quantum particles are no longer restricted to the four “classical” basis
states above, but it can be found in any superposition, for instance in the
following four entangled states

$|\Psi^{\pm}\rangle=\frac{1}{\sqrt{2}}(|0\rangle_{1}|1\rangle_{2}\pm|1\rangle_{1}|0\rangle_{2}),$
(1)
$|\Phi^{\pm}\rangle=\frac{1}{\sqrt{2}}(|0\rangle_{1}|0\rangle_{2}\pm|1\rangle_{1}|1\rangle_{2}).$
(2)

These entangled states are referred to as “Bell state” since they maximally
violate a Bell inequality [14, 43], showing a stark contradiction between
classical local hidden variable theory and quantum mechanics [29]. Quantum
entanglement describes a physical phenomenon whereby the quantum states of a
many-particle system cannot be factorized into a product of single-particle
wave functions; this applies even when these particles are separated by large
distances. It was first recognized by [54] and [185], and experimentally
generated by [231] in the annihilation radiation; it was then applied to the
Bell test [62, 4].

Note that both single-particle and entangled-two-particle states can be
applied to QKD. Single-particle states represent the prepare-and-measure
scheme, such as BB84 [16], in which Alice sends each quantum bit (qubit) in
one of four states of two complementary bases; B92 [15] where Alice sends each
qubit in one of two non-orthogonal states; six-state [30] in which Alice sends
each qubit in one of six states of three complementary bases. A detailed
description of the BB84 protocol is given in Fig. 2(a). The security of QKD is
ensured by the no-cloning theorem [230] which prohibits the precise copying of
an unknown quantum state. The no-cloning theorem prevents the eavesdropper
from copying Alice’s qubits; information gain is only possible at the expense
of introducing disturbance to the signal in any attempt to distinguish between
the two non-orthogonal quantum states. Entanglement-based QKD, including
schemes such as Ekert91 [55] in which entangled pairs of qubits are
distributed to Alice and Bob, who then extract key bits by measuring their
qubits, as shown in Fig. 2(b); BBM92 [19] where each party measures half of
the EPR pair in one of two complementary bases. Note that in Ekert91, Alice
and Bob estimate the Eve’s information based on the Bell’s inequality test;
whereas in BBM92, as in the case of BB84, Alice and Bob make use of the
privacy amplification to eliminate Eve’s information regarding the final key
[112].

Figure 2: Quantum cryptographic protocols. (a)The BB84 Protocol. The aim of
this protocol is for the sender (Alice) to send secret key to the receiver
(Bob) by transferring single photons, encoding the information in the quantum
states. This protocol exploits four polarization states of photons which span
two bases (eg., the horizontal polarization $|H\rangle$ and vertical
polarization $|V\rangle$, and the diagonal polarization
$\left|45^{\circ}\right\rangle$ and anti-diagonal polarization
$\left|-45^{0}\right\rangle$). In information encoding, they use $|H\rangle$
and $\left|-45^{\circ}\right\rangle$ represent bit $0,$ and $|V\rangle$ and
$\left|45^{\circ}\right\rangle$ represent bit 1. The operation steps are as
follows. (1) Alice chooses a group of bit sequence, and encodes these bits in
the polarization of photons with random choice of encoding basis. (2) Alice
sends the photons to Bob. (3) Bob randomly chooses the detection scheme to
measure the state and obtains the raw key. (4) Bob broadcasts his choice of
measurement bases for each photon through a classical information channel. (5)
Alice responds yes or no for the same or different basis that they use for
encoding and measurement for each photon. (6) They discard the events in which
different bases were used and keep the remained data for private key (any
eavesdropping in step (2) could be alerted in this final check). (b) The
Ekert91 Protocol. This protocol operated for sharing secret keys between Alice
and Bob by distributing EPR pairs. (1) Alice and Bob firstly share an
entangled photon pair in the singlet state $|\Psi^{-}\rangle$. (2) Alice and
Bob receive the photon then randomly and independently choose their
measurement bases, obtained by rotating the $\\{|H\rangle,|V\rangle\\}$ basis
with angle from the set $\\{0,\pi/4,\pi/8\\}$ for Alice and
$\\{0,-\pi/8,\pi/8\\}$ for Bob. (3) They measure and register a series of
photon pairs, after that, broadcast the measurement bases they have used,
while keeping the outcomes in secret. (4) They use the measurement outcomes
with the same angles as raw keys and use the others for Bell inequality test.
(5) If the Bell inequality is violated, the eavesdropping is excluded
therefore the keys are safe (their keys are anti-aligned). Otherwise, they
discard all the keys.

After proposing the BB84 protocol, Charles Bennett and his colleagues
performed the first proof-of-concept test in 1989 [17]. A light emitting diode
(LED) and photomultipliers fixed at two ends of the table represent the sender
Alice and receiver Bob, i.e., the photon source and detectors, respectively
(see Fig. 3). Pumped by current pulses, the LED emitted green light pulses,
which were subsequently filtered by a 550 $\pm$ 20 nm bandpass filter and
initialized in a horizontal polarization state. For the encoding, the
polarization of each light pulse was rotated to either a horizontal, vertical,
left-circular or right-circular polarized state, randomly and independently,
via the use of two Pockels cells to which modulated voltages were applied. A
circular basis was exploited instead of the diagonal basis, so that a lower
voltage, quarter-wave voltage, was required to operate the Pockels cells.
After transmission through a 32-cm-long free-space quantum channel from Alice
to Bob, each encoded pulse was then projected in either a rectilinear or
circular basis randomly and independently, by another Pockels cell and a
calcite Wollaston prism, depending on whether the applied quarter-wave voltage
was turned on or off. The calcite Wollaston prism was made of birefringent
crystals, through which horizontally and vertically polarized light diverged
onto two distinct paths, and could then be detected by one of two
photomultipliers, one placed in each path.

In principle, a bit of key was successfully distributed when Alice encoded the
bit and Bob measured it in the same basis. Nevertheless, due to experimental
imperfections, such as dark counts and differences in the basis alignment
between Alice and Bob, errors still could exist after basis announcement.
Therefore, reconciliation, e.g., permutation and parity check, was performed
on Alice’s and Bob’s bit sequence in order to discover and discard errors.
According to the error rate, in a conservative sense that all errors were
induced by Eve, who might intercept/resending or beamsplit photons in the
quantum channel, the number of bits of information leaked to Eve can be
estimated. By privacy amplification, shared consistent bits were compression
encoded. Although, fewer bits of shared secret key were left, the amount of
information potentially leaked to Eve was decreased by several orders of
magnitude. As an example of data from their experiment, Alice sent Bob 715,000
pulses with the mean photon number of each pulse set to 0.12. 754 bits of
secret key was finally shared between Alice and Bob. The experiment was very
preliminary as noted by one of the authors who recalled that they “could
literally hear the photons as they flew, and zeroes and ones made different
noises” [25].

Figure 3: Photograph of the apparatus used in Bennett, et al. (1989).

While the QKD is for the secure transmission of a classical message, another
important aspect of quantum communications is quantum teleportation [18],
which is a way to faithfully transfer quantum states. Quantum teleportation
relies on both a classical channel and a quantum channel—entanglement—that are
shared between the two communication parties (see Fig. 4(a)). The quantum
state to be teleported, for example, can be the polarization of a single
photon, which can be written as:
$|\chi\rangle_{1}=\alpha|H\rangle_{1}+\beta|V\rangle_{1}$, where $\alpha$ and
$\beta$ are two unknown, complex numbers satisfying
$|\alpha|^{2}+|\beta|^{2}=1$, and $|H\rangle$ and $|V\rangle$ denote the
horizontal and vertical polarization states, respectively, which can be used
to encode the basic logic $0$ and $1$ for a qubit. The entangled state of a
pair of photons can be written as
$\left|\phi^{-}\right\rangle_{23}=\left(|H\rangle_{2}|H\rangle_{3}-|V\rangle_{2}|V\rangle_{3}\right)/\sqrt{2}$,
one of the four maximally entangled two-qubit Bell states. Alice performs a
joint measurement on the to-be-teleported photon 1 and the photon 2 from the
entangled pair, projecting them into one of the four Bell states. Then the
joint three-photon system is in the product state,

$|\psi\rangle_{123}=|\chi\rangle_{1}\otimes|\phi^{-}\rangle_{23},$ (3)

which can be decomposed into

$\displaystyle|\psi\rangle_{123}=\frac{1}{2}[-|\psi^{-}\rangle_{12}(\alpha|H\rangle_{3}+\beta|V\rangle_{3})-|\psi^{+}\rangle_{12}(\alpha|H\rangle_{3}$
(4)
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}-\beta|V\rangle_{3})+|\phi^{-}\rangle_{12}(\alpha|V\rangle_{3}+\beta|H\rangle_{3})$
$\displaystyle~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}+|\phi^{+}\rangle_{12}(\alpha|V\rangle_{3}-\beta|H\rangle_{3})].$

Bob is then informed about the outcome of the Bell-state measurement (BSM) via
classical communication, and accordingly applies a Pauli correction to the
photon 3. It should be noted that quantum teleportation does not violate the
no-cloning theorem. After successful teleportation, photon 1 is not available
in its original state any longer, and therefore photon 3 is not a clone but
instead the result of teleportation. Furthermore, the quantum state can only
be recovered after Bob receives the classical information sent by Alice.
According to relativity, the speed of the transmission of the classical
information cannot exceed the speed of light. Thus, superluminal communication
cannot occur as a result of quantum teleportation.

Figure 4: (a) Principle of quantum teleportation. (b) Setup of the Innsbruck
teleportation experiment (Bouwmeester et al., 1997). A pulse of ultraviolet
light passing through a non-linear crystal creates an ancillary pair of
entangled photons 2 and 3 in a polarization state $|\psi^{-}\rangle_{12}$. The
pulse is reflected, and during its second passage through the crystal another
pair of photons can be created.

The first faithful demonstration of quantum teleportation was reported using
the setup shown in Fig. 4(b) [24]. The work developed a method for coherently
controlling two independent pairs of down-converted entangled photons. Double
passing the $\beta$-barium borate (BBO) crystal, the pulsed pump created two
pairs of entangled photons. One pair (2-3) was used as the entanglement
channel, whereas the photon 1 is heralded prepared in the to-be-teleported
state. The BSM of photons 1 and 2 was achieved using a beam splitter, which,
upon a coincidence detection of a single photon in each output of the beam
splitter, unambiguously projected the two independent photons into the
spatially asymmetric Bell state
$|\psi^{-}\rangle_{12}=\left(|H\rangle_{1}|V\rangle_{2}-|V\rangle_{1}|H\rangle_{2}\right)/\sqrt{2}$.
An essential prerequisite to this method is to make the independently
generated single photons 1 and 2 indistinguishable in their temporal, spatial,
and spectral degrees of freedom. To do so, the two pairs of entangled photons,
pumped by a femtosecond laser, were time synchronized, spectrally narrowband
filtered, and coupled into single-mode fibers to ensure a sufficient wave
function overlap. The verification of the success of teleportation was then
done using a four-photon coincidence detection.

Due to its capacity to faithfully transfer of quantum states from one particle
to another at a distance, quantum teleportation has been recognized as an
important and elegant tool for long-distance quantum communication and
distributed quantum networks.

###  II.2 Early efforts toward longer distances

After the first proof-of-principle demonstrations, naturally, early efforts
were made to extend the implementations to longer distance, with the aim of
transforming the schemes into practical applications.

####  II.2.1 Quantum key distribution

Optical fibers are convenient, commercially available, and widely used in
telecommunications, which was a straightforward way to extend the experimental
range beyond that achieved in the initial table-top free-space 32-cm-distance
experiment. Experimental groups from the British Telecom (BT) laboratories in
the UK [212, 211, 210] used phase encoding to demonstrate quantum cryptography
over a 10-km-long optical fiber, which was later [124] extended to 30 km with
raw key rate of 260 bits/s and an error rate of 4$\%$ (see Fig. 5). Later, a
Swiss group [132] exploited polarization encoding to test quantum cryptography
over 1.1-km optical fiber. To overcome the time-dependent polarization changes
during the transmission of photons in optical fibers, methods were developed
[61].

The research efforts continued toward field tests using installed optical
fibers in real-world environments. The first step in this direction was taken
by researchers at Los Alamos National Laboratory, who used the minimal Bennett
protocol [15] to perform quantum key distribution over 14-km-long underground
optical fiber [87] with an error rate of 1.2$\%$; the same group later
increased this distances to 48 km [88] with an error rate of 9$\%$. The Swiss
group [133] exploited a 23-km-long standard telecom optical fiber installed
under a lake and demonstrated a quantum cryptography with an error rate of
3.4$\%$. Note that there were serious practical security loopholes associated
with these early QKD experiments, as discussed in Sec. III. For example, the
photon-number-splitting (PNS) attack [26, 118] was proposed to target
imperfect single-photon sources. Thus, these early implementations of QKD
couldn’t be used for real-life applications with realistic devices.

Figure 5: Phase-encoding quantum cryptography scheme over 30 km fiber [124].
The experimental system is based on a Mach-Zehnder interferometer. The source
is a 1.3-$\mu$m-wavelength semiconductor laser with a pulse duration of 80 ps
and repetition rate of 1 MHz. The laser output is strongly attenuated so that
the average photon number of the pulse pairs entering the transmission fiber
is $\sim$0.1. The received photons are detected by a liquid-nitrogen-cooled
germanium avalanche photodiode.

Jacob and Franson considered another propagation medium: free space, which has
the advantage of negligible birefringence, thus permitting the faithful
transmission of the photon polarization states. The first attempt [92] was
over a 150 m hallway illuminated with fluorescent light, and over 75 m
outdoors in bright daylight conditions. Also under fluorescent lighting
conditions, Buttler et al. performed the experiment over a 205-m indoor
optical path, which was achieved by sending the emitted beam up and down a
17.1-m-long laboratory hallway 6 times via the use of 10 mirrors, and a corner
cube [32]. These preliminary tests suggested that the signal-to-noise ratio in
free-space transmissions could be improved using a combination of detection
timing, narrowband filters, and spatial filtering. Further experiments
extended the work to outdoor environments with point-to-point free-space
transmission of attenuated laser pulses over distances of 0.5 km [86], 1.6 km
[34], 10 km [89](see Fig. 6), and 23.4 km [103].

Figure 6: The polarization optics of the QKD transmitter and receiver used in
[89]. The lasers in the transmitter are attenuated to have an average photon
number less than 1. The multi-detection events due to multi-photon component
in the weak coherent pulse are recorded but not used for key generation.

The straightforward method of directly sending signals (photons) through
optical fibers or terrestrial free-space suffers from two fundamental
problems. First, channel losses cause a decrease in the transmitted photons
that scales exponentially down with the length (see Sec. III B). Second, there
are additional problems associated with the security of these the practical
implementations due to the imperfect single-photon source and detectors (see
Sec. III A).

####  II.2.2 Entanglement distribution

The experiments described above used attenuated laser pulses to approximate
the single photons. Such laser pulses have a non-vanishing probability of
containing two or more photons per pulse, leaving the system susceptible to
the PNS attack, see [233] for details. Remarkably, Ekert (1991) proposed
entanglement-based quantum cryptography using Bell’s inequality to establish
security, which results in an inherent source-independent security. In
addition to its use in quantum cryptography, distributed entanglement is an
essential resource in fundamental studies, such as tests of Bell’s inequality
[14] as well as in many quantum information tasks, such as quantum
teleportation [18], distributed quantum networks for computing [73], and
metrology [209].

Producing (see Fig. 7) and distributing entangled photons over long distances
is of great importance both for fundamental understanding and for possible
applications. In 2000, three independent groups simultaneously reported
implementation of the Ekert-91 protocol, two using polarization encoding [95,
136] and one using time encoding [208].

The experimental arrangement of the Vienna experiment [95] is shown in Fig. 7.
In this work, the entangled photons were produced by type-II spontaneous
parametric down-conversion [104]. As shown in Fig. 7(a), pumped by a 351 nm
laser, a BBO crystal produced entangled photons at a wavelength of 702 nm with
a two-photon coincidence rate of $\sim$1700 Hz. The photons were coupled into
500 m long optical fiber and transmitted to Alice and Bob, respectively, who
were physically separated by 360 m (Fig. 7(b)). Jennewein et al. utilized
Wigner’s inequality to establish the security of the quantum channel, which
has higher efficiency than the original Ekert’s protocol. The two
communication parties varied their analyzers randomly between two settings,
Alice: $-30^{\circ}$, $0^{\circ}$ and Bob: $0^{\circ}$, $30^{\circ}$. The two-
photon coincidence counts of the combinations of the settings of
($-30^{\circ}$, $30^{\circ}$), ($-30^{\circ}$, $0^{\circ}$), ($0^{\circ}$,
$30^{\circ}$) were used to derive a violation of Wigner’s inequality, thus
ensuring the security of the key distribution. The coincidence detection
obtained at the parallel settings ($-30^{\circ}$, $0^{\circ}$), which occurred
in a quarter of all events, were used to generate keys. Over a fiber distance
of 500 m, the raw key rate was 420 bits/s and the quantum bit error rate was
3.4$\%$.

Figure 7: (a) The experimental configuration to produce entangled photon pairs
using spontaneous parametric down-conversion [104]. Type-II non-collinear
phase matching in a $\beta$-barium borate (BBO) produces high-fidelity
polarization entanglement. The extra birefringent crystals C1 and C2 along
with the half-wave plate (HWP) are used to compensate the birefringent walk-
off effect in the crystal. (b) The first full implementation of entanglement-
based quantum cryptography over a distance of 360 m. The polarization-
entangled photon pairs are transmitted via optical fibers which are then
analyzed and detected.

The entanglement-based quantum cryptography was later extended to a distance
of 8.5 km using an optical fiber inside a laboratory [171]. This work utilized
a time-bin encoding and at a wavelength of 1550 nm, the experiment generated a
raw key rate of 134 Hz with an error rate of 8.6$\%$. Poppe et al.
demonstrated a successful run of the entanglement-based quantum cryptography
system where the produced key was directly handed over to an application that
was used to send a quantum secured online wire transfer from the City Hall to
the headquarters of Bank-Austria Creditanstalt over a physical distance of 650
m, showing a real-world application scenario outside ideal laboratory
conditions [159].

In 2003, entanglement distribution outside the laboratory over free space was
preformed in Vienna city over a physical separation of 600 m [5]. One of the
entangled photons was distributed over 150 m and the other one over 500 m, to
different sides of the Danube River. The 600-m free-space link attenuation was
estimated to be 12 dB. The two-photon count rate was measured to be 10 kHz
locally and 15 Hz after the free-space distribution. Nevertheless, the
survived two photons showed a state fidelity of $0.87\pm 0.03$ and a violation
of Bell’s inequality.

####  II.2.3 Quantum teleportation

The first demonstration of quantum teleportation of quantum states [24]
inspired many subsequent experiments, such as extending to continuous-variable
systems [64] and teleporting more complete photonic states [147, 201, 228], as
also covered in a recent review [155]. The restriction of post-selection,
where teleported photons have to be detected (i.e., destroyed) to verify the
success of the procedure in [24], was removed six years later by a new method
[147] reporting free propagating teleported single photons. The success
probability ($1/2$) of the Bell-state measurement using beam splitters was
improved to near unity using a hybrid technique combining both discrete
variable and continuous variable, resulting a deterministic quantum
teleportation of photonic quantum bits [201]. Quantum teleportation has also
been extended to the composite state of two photons [248], multiple degrees of
freedom [228], and high dimensions of a single photon [117].

In addition to photons, quantum teleportation has been demonstrated in other
physical systems, such as nuclear magnetic resonance [138], atomic ensembles
[190, 40], trapped atoms [10, 173], and various solid-state systems [197,
154]. Typically, in pure matter-based systems, such as trapped atoms [10,
173], teleportation is performed only over very short distances for atoms in
proximity to each other. One method to extend the distance of matter qubit
teleportation involves developing light-matter quantum interfaces. Using
light-to-matter teleportation [142], the flying photonic qubits can be stored
in stationary media, which is essential for the construction of a scalable
quantum network based on the quantum repeater scheme (more details in Section
IV). However, the achievable range of quantum teleportation is determined by
the distance across which the entanglement can be distributed. Thus, early
experiments suffered similar limitations as the QKD experiments. The early
experiments were limited to, for example, a 2-km-long optical fiber linking
two laboratories physically separated by 55 m [125], and over 600 m across the
Danube river [215].

The capability of multi-photon manipulation [146] opens the way to not only
quantum teleportation [24], but also entanglement swapping [145] and
entanglement purification [148], which, combined with quantum memory, are
important tools for quantum repeaters (see Section IV). Interestingly, quantum
teleportation can be considered as a method for probabilistic quantum non-
demolition measurement, which can be exploited as a quantum relay (a simpler
version of quantum repeater without quantum memory) to extend the distance of
quantum communications moderately [93, 222]. For example, using teleportation,
one can increase the distance by approximately three times that of the
direction transmission of a single photon at the same signal-to-noise ratio
[174].

##  III Challenges in practical and large-scale applications

###  III.1 Security loopholes

There are practical security limitations associated with the early
implementations using realistic QKD devices in Sec. II. Ideally, only when
perfect single-photon sources and detectors are utilized, will quantum
cryptography be secure. Unfortunately, ideal devices do not exist in practice.
In reality, the imperfections of realistic QKD implementations might introduce
deviations (or side channels) from the idealized models used for security
analysis. Eve might exploit these imperfections and launch quantum attacks.
For this reason, an arms race has been ongoing for more than 20 years in
quantum cryptography among quantum code-makers and quantum code-breakers. The
race participants aim to assess the deviations of the real system from the
ideal system, thus establishing the _practical security_ for QKD with
realistic devices [233].

Right after the security proofs have been established in the early 2000s [128,
112, 191], a well-known quantum hacking strategy was proposed—photon number
splitting (PNS) attack [26, 118], which targets on the practical laser source.
Since there would occasionally be two identical photon events in pulses from a
quasi-single-photon source, the so-called PNS attack allows Eve to selectively
suppress single-photon signals, and split two-photon signals by keeping one
copy for herself without being noticed by Alice and Bob. Due to this loophole,
the secure distance of QKD in optical fiber was limited to 10 km.

To resolve this problem, decoy-state QKD was theoretically proposed [90, 227,
114] and has been experimentally demonstrated [152, 184, 177] to increase the
practicality of QKD with standard weak coherent pulses (WCPs) generated by
attenuated laser pulses. Decoy-state QKD has become a standard technique in
current QKD experiments. After the decoy-state method, however, quantum code-
breakers turned to attack other components, particularly the imperfect single-
photon detectors [123]. For instance, one can use a specially tailored strong
light to “blind” the single-photon detectors. Thus, the detector can only
respond when the light intensity is greater than its threshold. If the
eavesdropper sends a light pulse with an intensity higher than the threshold,
the detector will only click when Bob’s measurement basis is the same as that
of the input light. Therefore, the eavesdropper can fully control the
detectors. Fortunately, measure-device-independent QKD was proposed
theoretically [113] and experimentally [111, 179, 203, 239, 38] to increase
the security of QKD against any detector imperfection. Measure-device-
independent QKD completely eliminates all security loopholes in detection
systems and allows QKD networks to be secure with _untrusted_ relays. See the
reviews for further details [85, 182, 146, 29, 166, 233]. Thus far, the
security of the quantum cryptographic system, combing measurement-device-
independent QKD and a self-calibrated homemade source, is believed to be
sufficient for practical QKD at the level of the theoretical unconditional
security.

###  III.2 Long distances

Having covered the typical early, small-scale experiments on quantum
communications, here we raise the question, “what limits the distance of
quantum communications?” In both the fiber optics and terrestrial free-space
channels, there are inevitable photon losses, which scale exponentially up
with the transmission length in optical fibers. Gisin et al. highlighted that
at 1000 km, even with a perfect single-photon source of 10 GHz, ideal photon
detectors, and 0.2 dB/km fiber losses, one would detect only 0.3 photons on
average per century [70]. In classical communications, it is possible to
amplify the signal 0 and 1. In contrast, an unknown quantum superposition
state cannot be noiselessly amplified. This is known as the quantum no-cloning
theorem, a fundamental no-go theorem in quantum mechanics. While it underpins
the security of QKD, it excludes the possibility of simply amplifying quantum
signals over long-distance quantum communications.

##  IV Quantum repeater and its progress

Figure 8:  Principle of quantum repeaters [27, 52]. (a) Dividing the
communication channel into N segments. (b) Using entanglement swapping to
establish entanglement between remote nodes. (c) Using entanglement
purification to distill highly entangled pairs between remote nodes. (d) Using
quantum memory to store single photons for a sufficiently long time and
retrieve the single photon for time synchronized two-photon interference.

One strategy for extending the distance of quantum communications is using the
divide-and-conquer strategy. Unlike classical repeaters that work only for
classical bits, quantum repeaters (see Fig. 8) combine entanglement swapping,
entanglement purification, and light storage, and in principle, can enable
quantum communication at arbitrarily large scales. This section will briefly
cover the principle and progress of quantum repeaters.

The key mechanism behind the extension of quantum communication distance by
quantum repeaters is to change the notorious exponential scaling of the photon
loss to a polynomial relation as a function of the channel length. To do so,
the whole channel must be divided into $N$ segments (see Fig. 8(a)), such that
within each segment, direct transmission can yield a reasonably good signal-
to-noise ratio. The problem now sits on how to efficiently connect these
segments in a quantum compatible way. It turns out that entanglement swapping
[247]—a variant of quantum teleportation, where the particle to be teleported
is itself part of an entangled pair—provides an ideal method for entangling
the remote particle without any direct interaction (see Fig. 8(b)). The key
step in entanglement swapping involves performing a Bell-state measurement for
two single photons, each from an entangled pair. The two photons should arrive
simultaneously through a beam spitter and must be quantum-mechanically
indistinguishable.

The first experimental demonstration of entanglement swapping was reported by
Pan et al., who showed the possibility of entangling two independent photons
without direction interaction [145], as shown in Fig. 9. The precision of
entanglement swapping was improved to be 0.98 in later experiments [148],
meeting the stringent requirement of fault-tolerant quantum repeaters [27].
Entanglement swapping has been used as an ubiquitous tool to entangle distant
qubits such as in trapped ions [127], cold atomic ensembles [246], and
nitrogen-vacancy centers in diamond [83], by the joint projection of two
flying photons. Furthermore, it has been extended to field tests over tens of
kilometers optical fibers by the fine synchronization of two arriving photons
[199, 245].

The quantum repeater protocol also considers the presence of noise and
decoherence as the entangled photons propagate through the channel (e.g.,
optical fibers that can induce undesired polarization rotation), which can
induce the degradation of the entanglement fidelity compared to those of
locally prepared ones. To overcome the decoherence, entanglement purification
[20] was proposed to distill highly entangled pairs remotely separated from an
ensemble of less entangled pairs. The protocol of entanglement purification
uses only local operation and classical communication.

In the protocol proposed, the local operations involved controlled-NOT (CNOT)
logic gates between the qubits. Due to the weak interaction between
independent photons, however, the CNOT gates were difficult to implement.
Although, eventually, there were some experimental demonstrations [140, 66,
251], the photonic CNOT gates required ancillary photons and exhibited only
moderate gate fidelity, as well as very low efficiency.

Using only linear optics, Pan et al. put forward a feasible scheme for
entanglement purification with high precision and efficiency. It was observed
that the CNOT gates were not necessary [149]. In fact, the polarizing beam
splitter (PBS), an off-the-shell high-precision linear optical element that
transmits horizontal polarization and reflects vertical polarization, was
exploited by Pan et al. to function as a parity checker that was sufficient to
perform entanglement purification. Interesting, the parity checking function
of the PBS was found to apply to resource-efficient linear optical quantum
computation [28]. Two years afterwards, Pan et al. experimentally demonstrated
entanglement purification, achieving an enhanced entanglement fidelity after
the purification [148]. Walther et al. further achieved the violation of
Bell’s inequality after the purification of two copies of less entangled pairs
that were insufficient to violate Bell’s inequality [223]. Late, Wineland’s
group used trapped ions to demonstrate entanglement purification [165].

Notably, the development of multiphoton interferometry and entanglement [24,
144] has also laid the technological foundation for entanglement swapping
[145], entanglement purification [148], and measurement-device-independent QKD
[111, 179], which are essential for long-distance quantum communications. In
fact, quantum teleportation and entanglement swapping can be considered
methods for probabilistic quantum nondemolition measurement, which can be
exploited to extend the distance of quantum communications by up to four
times. This can be viewed as a simplified version of a quantum repeater
without quantum memory, which has also been referred to as quantum relay
[174].

Figure 9:  Experimental scheme for entanglement swapping and purification with
high-precision polarization beam splitters (PBSs). (a) The PBS transmits
horizontally (H) polarized photons and reflects vertically (V) polarized
photons. Suppose two single photons are superposed on a PBS. If we postselect
the output case where there is one photon in each side, there are two quantum
mechanically indistinguishable possibilities: both photons are transmitted or
both photons are reflected. (b) Entanglement swapping by interfering two
photons on a PBS. The two distant photons become entangled upon the Bell-state
measurement on the PBS. (c) Entanglement purification by locally two-photon
interferences on the two PBSs. See [149] for details.

The last element of the quantum repeater [27] is the quantum memory [119, 1],
which can convert the quantum information carried in fast-flying photons into
stationary matter qubits, store it for a certain time, and convert it back
into photons on demand. Several physical systems [192] that have been
considered as candidates for quantum memory, such as cold atomic ensembles
[182], rare earth elements [207], single trapped atoms [166] and ions [53],
and color centers in diamond [65, 7]. These systems can be categorized into
single-particle approaches and ensemble approaches. With single particles, it
is advantageous to scale up to multiple qubits and perform gate operations.
Nevertheless, challenges still exist in improving the coupling with single-
photons by either employing a high finesse cavity or a high numerical-aperture
lens. Conversely, with atomic ensembles, it is much easier to achieve
efficient coupling with single photons because of the collectively enhanced
interaction from large number of atoms. Nevertheless, one must tackle
inhomogeneous decoherence. After many years of extensive experimental
investigations, the performance of each system was improved significantly. To
be employed in quantum repeaters, a quantum memory must possess many crucial
properties, such as a long lifetime and high storage efficiency. A system must
exhibit high values of these parameters simultaneously to be suitable for use
in quantum repeaters. As a milestone, the approach of utilizing cold atomic
ensembles afforded an efficient quantum memory with a sub-second lifetime in
2016, with the two parameters fulfilling the requirement of long-distance
quantum repeaters for the first time [237, 9, 249]. Further development needs
to incorporate efficient entanglement creation, telecom interface, multiqubit
storage, gate operation, etc.

Based on numerical analysis [178, 232, 195], achieving a 1000 km quantum
repeater requires demanding parameters that are still significantly beyond the
capabilities of the state-of-the-art, such as trapped ions and cold atomic
ensembles. Therefore, it is unlikely that quantum repeaters will become
practical within 10 years, so alternative and more efficient routes for
global-scale quantum communications are necessary. Note that new quantum
repeater concepts were developed recently, such as all-optical repeaters [8],
and repeaters that do not require two-way classical communications [135].

##  V Satellite-based free-space channels

Generally, the attenuation in free space is lower than that in fiber for
optical signals. For instance, values of 0.07 dB/km can be achieved at 2400 m
above sea-level [184] with high attenuations at relatively low altitudes and
negligible attenuations in the vacuum above the Earth’s atmosphere.
Furthermore, the almost nonbirefringent character of the atmosphere guarantees
the preservation of polarization state to a high degree. However, terrestrial
free-space channels alone are not enough. They suffer from obstruction by
objects in the line of sight, from possible strong attenuations due to weather
conditions and aerosols, as well as effects from the Earth’s curvature [6].
Therefore, to fully exploit the advantages of free-space links, it is
necessary to exploit space and satellite technologies. Furthermore, the
effective thickness of the atmosphere is approximately 5-10 km, and most of
the photon’s propagation path is in empty space with negligible absorption and
turbulence, which is crucial for transmitting single photons that cannot be
amplified. Therefore, in the application of QKD networking with global-scale
coverage, satellite-based free-space channels hold promise as a potential
route and a new platform for quantum optics experiments at an astronomical
scale. The attenuation of the fiber and free-space channel with distance is
simulated according to the parameters of the commercial fiber and the Micius
satellite, as shown in Fig. 10. We can see that for long-distance
communication, the satellite-based free-space channel is superior to the
fiber-based channel in terms of total losses.

Figure 10: Typical losses in fiber and free-space channels. The attenuation
parameter of fiber is $\sim 0.2~{}dB/km$. The parameters of free-space channel
are based on the design of Micius satellite. The free-space channel shows
advantage for a distance over $\sim$ 70 km

To build the QKD network, trusted-node topologies are being built for fiber
networks. However, ground-based nodes are at fixed locations, which lack
flexibility and are vulnerable to constant surveillance and probes. By placing
a satellite above the Earth’s atmosphere, direct links can be established
between ground stations and the satellite, thus enabling communication between
any distant points on the planet. Furthermore, many more network topologies
can be easily implemented with satellites by employing the downlink, uplink,
and intersatellite channels. Moreover, more ambitious projects aimed at
extending the network-scale to deeper space, such as to the Moon or planets in
the solar system, can be also realized with satellites.

Global-scale classical communications have already employed satellites to
conveniently cover the whole world. In principle, quantum communications have
a bright future, considering that the advantages of using satellites and free-
space channels are even more physically significant. There are enormous
challenges to actually move the quantum optics setup inside well-shielded
laboratories to space. To realize satellite-based quantum experiment platforms
in space, intensive engineering efforts should be devoted to its design and
strict step-by-step verifications. Considering a feasible low-Earth-orbit
satellite within a realistic budget, one should carefully analyze the link
efficiency and transmission fidelity of the free-space channels, and every
relevant parameter such as the designed quantum light sources, which will be
reviewed in this Section. The quantum science satellite, Micius, is within the
framework of Chinese Academy of Science (CAS) Strategic Priority Research
Program on space science. The major scientific goals include: (1) satellite-
to-ground QKD, (2) quantum entanglement distribution from satellite to two
ground stations, and (3) ground-to-satellite quantum teleportation. Strictly
following such engineering requirements for each of the three goals, ground-
based experimental tests of the feasibility of satellite-based quantum
communications were then carried out, as reviewed in Sec. VI.

###  V.1 Analysis of space-ground links

Several factors influence the attenuation of quantum communication channels
when photons propagate between a ground station and a satellite. The fixed
attenuations are affected mainly by the efficiencies of optical transmitting
system $\eta_{t}$ and receiving system $\eta_{r}$, including optical and
detection efficiencies. During transmission, the optical beam will be
broadened or deflected by diffraction, air turbulence and mispointing, which
will induce losses $\eta_{d}$, $\eta_{at}$, and $\eta_{p}$, respectively.
Atmospheric absorption brings the attenuation $\eta_{as}$ relay to photon
wavelength and air composition. Considering of all these factors, one-way
channel attenuation between a satellite and a ground station can be simulated
as follows:

$\eta={\eta_{t}}{\eta_{r}}{\eta_{d}}{\eta_{at}}{\eta_{p}}{\eta_{as}}.$ (5)

Beam diffraction. In free-space quantum communication, the diffraction of an
optical beam depends mainly on its spatial mode, wavelength, and the telescope
aperture. We generally assume that the beam from transmitting antenna is
Gaussian with waist radius of $\omega_{0}$. At a distance of $z$, the spot
radius $\omega_{d}(z)$, will be

$\omega_{d}(z)={\omega_{0}}\sqrt{1+{{(z/{z_{R}})}^{2}}},$ (6)

where Rayleigh range $z_{R}=\pi\omega_{0}^{2}/\lambda$ relays to the
wavelength $\lambda$. For a telescope with aperture radius $r$, the receiving
efficiency $\eta_{d}$ can be as high as:

$\eta_{d}(r)=1-\exp(-\frac{{2{r^{2}}}}{{\omega_{d}^{2}}}).$ (7)

Note that the spot radius $\omega_{d}(z)$ increases linearly with $z$ when the
distance $z\gg{z_{R}}$. The divergence half-angle of the beam far from the
waist is given by $\theta\approx\lambda{\rm{/}}(\pi\omega_{\rm{0}})$.
Therefore, the diffraction loss in long-distance quantum communications can be
mitigated by choosing relatively shorter photon wavelengths or a large waist
radius. But the transmitting antenna truncates the beam sent to ground,
causing significant losses if the beam waist is larger than the telescope
radius. For a downlink, it is recommended to set the full width at half
maximum (FWHM) beam waist to be half of the transmitting telescope diameter
[198].

Air turbulence Air turbulence is one of the main factors limiting the channel
efficiency in free-space quantum communication. It induces the atmospheric
refractive index inhomogeneity, which changes the direction of the propagating
beam. In terms of the beam size, larger-scale turbulent causes beam
deflection, while small-scale turbulence induces beam broadening [218]. For
the receiver, by accumulating the randomly moving spots, the average long-term
spot theoretically tends to follow a Gaussian intensity distribution [51]. The
equivalent radius of this spot is given by:

$\omega_{at}(z){\rm{=}}\omega_{d}(z)\sqrt{1+\omega_{a}}{\rm{=}}\omega_{d}(z)\sqrt{1+1.33\sigma_{R}^{2}\Lambda^{5/6}},$
(8)

where $\omega_{a}$ represents the effect of air turbulence on the optical
beam, $\sigma_{R}^{2}$ represents the Rytov variance for a plane wave, and
$\Lambda$ represents the Fresnel ratio of the beam at the receiver. More
details are provided in [2].

Pointing error To establish the link between the ground and the high-speed
moving satellite, a high-precision and high-bandwidth acquiring, pointing, and
tracking (APT) system should be developed, which generally consists of coarse
and fine tracking systems. The closed-loop coarse tracking usually works at a
frequency of several Hz, and the field of view (FOV) is relatively large,
which induces a large pointing error. A fine tracking system with a frequency
of up to kHz can point precisely, and the FOV is small. The combination of
coarse and fine tracking can provide a large FOV, high closed-loop bandwidth,
and pointing precision. The pointing error will induce spot jitter, where the
instantaneous spot can be described using the Rice intensity distribution. We
can define the $\eta_{p}$ as the expected value of the mispointing loss and
given by,

$\eta_{p}=\frac{{\omega_{at}^{2}}}{{\omega_{at}^{2}+4\sigma_{p}^{2}}}.$ (9)

where we assume the pointing probability density follows a Gaussian
distribution with variance $\sigma_{p}$ [213]. Atmosphere transmittance.
Atmospheric transmittance is reduced by the air absorption and the scattering
of the propagating beam. The atmospheric components mainly include gas
molecules and tiny particles (such as water droplets, dust and aerosols). The
gas molecules have certain specific absorption lines, and the scattering can
be described as Rayleigh scattering
$I\left(\lambda\right)\propto{I_{0}}\left(\lambda\right)/{\lambda^{4}}$ for
the incident light intensity ${I_{0}}(\lambda)$. The particles in the
atmosphere are mainly distributed on the ground surface, with a decreasing
concentration as the altitude increases. The transmittance is related to the
visibility. When the particle size is equivalent to or larger than the
wavelength, Mie scattering theory can be employed to describe the scattering
phenomenon. The scattering intensity is proportional to
${\lambda^{2}}/r_{p}^{2}$, where $r_{p}$ is the particle radius.

Figure 11:  The simulated atmospheric transmittance for zenith with different
wavelengths (left) and different altitude angles (right).

Software MODTRAN can be used to simulate and analyze the atmospheric
transmittance, which was developed by the Spectral Sciences Inc. and the Air
Force Research Laboratory. Figure. 11 shows the simulated atmospheric
transmittance in a rural sea-level location with 5-km visibility [22]. The
transmittance is good at a high altitude angle because of the relatively short
propagation time in the atmosphere.

Downlink and uplink channels. Satellite-based quantum science experiments can
be performed using two different channels, namely downlink (from the satellite
to the ground) and uplink (from the ground to the satellite). For downlink
transmissions, the beam reaches the air turbulence with a large size and is
received immediately after crossing the atmosphere, thus the impact are
marginal for the beam broadening and deflection induced by turbulence. On the
contrary, for the uplink, photons encounter air turbulence at the beginning of
propagation and subsequently transmit to the satellite. Therefore, turbulence
induced distortion will significantly increase the beam divergence angle and
result in a larger channel attenuation than that in the case of the downlink
transmission. Although the downlink channel has more advantages in terms of
efficiency, the uplink channel is still competitive in some cases, such as
when one wished simplify the payloads. Note that the effects of turbulence can
be partly compensated in theory, by using an adaptive optics system with
feedback devices.

###  V.2 Feasible channel parameters for the low-Earth orbit satellite

Typically, due to the low channel attenuation of downlink, the satellite-based
QKD and entanglement distribution are suitable for one-downlink and two-
downlink channels respectively. Conversely, considering the limitation of
satellite resources and the flexibility of the ground system, some experiments
may be more suitable for uplink transmission, such as quantum teleportation
based on a multiphoton entanglement source. Therefore, one-downlink, two-
downlink, and one-uplink channels would be the basic elements for constructing
a global-scale quantum network.

| One-downlink | Two-downlink | One-uplink
---|---|---|---
| for QKD |  for entanglement distribution |  for quantum teleportation
Geometry attenuation $\eta_{G}$ |  0.0128 |  0.000164 |  0.00045
Atmosphere attenuation: $\eta_{A}$ | 0.5 | 0.25 | 0.5
Transmitter efficiency: $\eta_{T}$ | 1 | 0.25 | 0.5
Receiver efficiency: $\eta_{R}$ | 0.4 | 0.16 | 0.4
Coupling efficiency: $\eta_{C}$ | 0.5 | 0.25 | 0.5
Detector efficiency: $\eta_{D}$ | 0.5 | 0.25 | 0.5
Mispointing: $\eta_{M}$ | 0.5 | 0.25 | 0.5
Total loss ($\eta_{G}\eta_{A}\eta_{T}\eta_{R}\eta_{C}\eta_{D}\eta_{M}$) | -35 dB | -75 dB | -53 dB
Table 1:  The estimated total loss for one and two downlink, and one-uplink
channels, respectively. In this estimation, the distance is set to 1000 km for
three types channels. The divergence angles of transmitter for down-link
channels are set to about 15 $\mu rad$, and for up-link channels will be
extended to 20 $\mu rad$ due to the stronger effect of turbulence. The
diameter of the receiving telescope is set to 1.2 m and 0.3 m for ground-based
and satellite-based respectively. The geometry attenuation is evaluated by the
distance, the divergence angle, and the diameter of the receiving telescope.

According to Eqs. (5)-(9) and using typical parameters, the expected total
loss of above three types of channels can be evaluated, as shown in Tab. 1.
When estimating the satellite-based channel loss, the relevant constrains,
including technology, resources, and cost, must be considered. Considering the
technology’s maturity and affordability, the 1-m-diameter ground-based
telescope and the satellite-borne transmitter with a divergence angle of 15
$\mu rad$ and central wavelength of 850 nm is reasonable. For the QKD based on
one-downlink channel, the distance (Z) is 500 km to 1200 km, the optical
diameter of the receiving telescope (D) on the ground is 1.2 m, the efficiency
of optical transmitting system can be set to 100% only for QKD based on the
weak coherent state source (approximately 25% for the two-downlink
entanglement distribution); the efficiency of the optical receiving system
(including optical, filter and detection efficiencies) is approximately 0.2,
the effective divergence angle of the transmitter ($\theta$) after considering
the effect of diffraction and atmospheric turbulence is $\sim$ 15 $\mu rad$
(approximately 20-30 $\mu rad$ for uplink channels), the atmospheric
transmittance is typically 0.5, and the mispointing loss is 0.5. The geometry
attenuation can be evaluated to about 19 dB when Z = 1000 km, through the
approximation formula, $2({D}/{(\theta\cdot Z}))^{2}$. Thus, the total channel
loss is estimated to be -35 dB. Similarly, for the entanglement distribution
based on two-downlink channels and the quantum teleportation based the on one-
uplink channel, the total channel losses are expected to be approximately -75
dB and -53 dB, respectively, as shown in Tab. 1.

Using the estimated total channel loss and the requirements of the satellite
mission as the input condition, one can output the specifications of key
technologies. For example, when considering the mission of a satellite-based
entanglement distribution with the two-downlink channels, the total
experimental time will be limited by the conditions of satellite altitude
angle and the weather of the two ground stations. If the total experimental
time is set to 10,000 s, according to the total loss of -75 dB, the output
brightness of satellite-borne entangled photon source must be over $2\times
10^{6}$ pair/s to obtain more than 1000 coincidence events. Furthermore, to
achieve the raw key rate of 1 kbps, the repetition frequency of the satellite-
borne decoy state source must be at least 100 MHz when the channel loss is
approximately -35 dB. The mispointing value of 0.5 indicates the tracking
accuracy of the APT system should be achieved to 4 $\mu rad$.

Furthermore, Fig. 12 shows the complete evaluation of the total required
experimental time and effective fidelity of the received entangled photon
pairs on the ground with different total channel losses, when we consider the
specific parameters of the background noise, the target detected coincident
events on the ground, the fidelity of the satellite-borne entangled photon
source, and the time synchronization accuracy. According to this estimation,
we can conclude further that the fidelity of the satellite-borne entangled
photon source should be larger than 95%, and the total channel loss should be
less than 80 dB (naturally it will be 40 dB for the one-downlink channel) when
the total experimental time is limited to $<$ 10,000 s.

Figure 12: The effective fidelity and total experimental time with different
two-downlink channel loss. The original state fidelity of the entangled photon
source is 95%, which will degrade with the increase of channel loss due to the
inevitable noise. The lower bound of fidelity is defined as the minimum value
for a violation of Bell inequality. The time coordinate represents the total
required experimental time of accumulating 1000 coincident events on the
ground.

Regarding ground-to-satellite quantum teleportation, a similar simulation
study is shown in Fig. 13. To realize the mission target of 400 coincident
counts, the total channel loss should be less than 55 dB and the fidelity
should be more than 75%, when the total experimental time is limited to $<$
40,000 s.

Figure 13: The effective fidelity and total experimental time with different
one-uplink channel loss. The lower bound of fidelity is the classical limit of
fidelity on a single copy of qubit. The time coordinate represents the total
required experimental time of accumulating 400 coincident events.

Finally, based on the above analysis and simulation of the feasible channel
parameters, we can summarize the main requirements of satellite-based quantum
science experiments, as shown in Tab. 2. These specific technical indicators
can be directly used as verification targets for the ground-based feasibility
studies (see Section VI), and the design input can be employed to develop
payloads (see Section VII). Furthermore, we would like to emphasize that only
when we have performed this comprehensive analysis can we conduct the ground-
based feasibility study and the develop key technologies following a
systematic approach.

List of feasible design baseline:
---
Satellite operating lifetime |  $\geqslant$ 2 years
Time synchronization accuracy |  $\leqslant$ 1 ns (1 $\sigma$)
Satellite-to-ground QKD
Raw key rate |  $\geqslant$ 1 kbps
QBER |  $\leqslant$ 3.5%
Total experimental time |  $\geqslant$ 20000 s
Total Channel loss |  $\leqslant$ 40 dB
Satellite-based entanglement distribution
Received coincident count |  $\geqslant$ 1000
Effective fidelity |  $\geqslant$ 85%
Total experimental time |  $\geqslant$ 10000 s
Total Channel loss |  $\leqslant$ 80 dB
Ground-to-satellite quantum teleportation
Received coincident count |  $\geqslant$ 400
Effective fidelity |  $\geqslant$ 75%
Total experimental time |  $\geqslant$ 40000 s
Total Channel loss |  $\leqslant$ 55 dB
Table 2:  Main practical requirements of satellite-based quantum science
experiments.

##  VI Ground-based feasibility studies and key technologies

This section reviews the systematic ground-based feasibility studies and key
technologies based on the requirements for the three Micius satellite missions
as specified in Section V.

Before constructing and launching a costly satellite, thorough preliminary
studies and simulations on the ground must be systematically performed to
verify the scientific possibilities, evaluate the risks, and develop the
technologies. The key questions of interest include, “Can the single and
entangled photons pass through the effective thickness (which is about 10 km)
of the atmosphere?”, “Can the quantum optics experiments be performed (with a
sufficient count rate and signal-to-noise ratio) under the conditions of large
attenuations and various turbulence on moving platforms?” The ground-based
feasibility demonstration and the development of key technologies cover the
following five aspects: overcoming the effective atmospheric thickness,
testing the feasibility of satellite-ground channels, testing moving objects,
time synchronization, and polarization maintenance and compensation.
Emphatically, only after developing all these technologies and combining them
together compatibly, the Micius program was officially approved and the
construct of the satellite started.

###  VI.1 Overcoming the effective atmospheric thickness

The first step involves verifying if the effective atmospheric thickness is
favorable for the passage of single and entangled photons. In 2005, entangled
photon pairs were bidirectionally distributed over Hefei city, one arm across
5.3 km and the other across 7.7 km, conclusively exceeding the effective
atmospheric thickness [151], as shown in Fig. 14. Narrowband (2.8 nm)
filtering and time synchronization (with a precision of 20 ns) were employed
to reduce the background counts from the noisy city environment. The two-
photon count rates were 10 kHz and 150-300 Hz at the sender and the receivers,
respectively. This corresponded to channel attenuation values in the range of
15.2-18.2 dB, depending on the weather conditions. The physical separation
between the two receivers was 10.5 km, which enabled the performance of a
space-like Bell test with a measured $S$ value of $2.45\pm 0.09$. Three years
later, single photons were transmitted over the Great Wall of China with an
optical free-space distance of 16 km [96]. These studies demonstrated that
entanglement can still survive after both entangled photons have passed
through the noisy ground atmosphere with a distance beyond the effective
thickness of the aerosphere. This is a step towards low-Earth-orbit satellite-
to-ground downlink quantum experiments.

Figure 14: Overview of the Hefei 13 km entanglement distribution experiment.
[151]

###  VI.2 Feasibility of satellite-to-ground one and two-downlink channels,
and ground-to-satellite uplink channel

To experimentally verify the feasibility of satellite-based quantum key
distribution (QKD) through one-downlink channel, Wang et al. conducted a full
verification study of the decoy-state QKD over the 97-km free-space link and
demonstrated the possibility of achieving a high signal-to-noise ratio and
overcoming the obstacle of a high-loss environment [226]. The total loss
achieved in the experiment was over 50 dB, which is more than the expected
value of $\sim$ 35 dB with the one-downlink channel mentioned in Section V.

Two-downlink channels are required for the satellite-to-ground entanglement
distribution, both of which require two independent channels between three
different locations. From 2008 to 2010, a ground-based feasibility study was
performed in Qinghai Lake, China [243]. In the study, entangled photon pairs
were distributed over a two-link free-space channel with distances of 51.2 km
and 52.2 km to two receivers separated by 101.8 km (Fig. 15). For the study, a
crucial enabling technology was developed, i.e., closed-loop tracking, which
was operated with a bandwidth and precision of 150 Hz and 3.5 $\mu$rad,
respectively. This tracking bandwidth was sufficient to overcome most of the
atmospheric turbulence. The authors obtained a two-photon rate of 6.5 MHz and
measured two-photon correlation functions, violating Bell’s inequality by 2.4
standard deviations. The average two-link overall attenuation was measured to
be 79.5 dB, which is higher than the estimated two-downlink loss
(approximately 75 dB, as mentioned in Sec. V) based on the LEO satellite.

Going beyond the above mentioned up to two-photon experiments, multi-photon
platform can be employed to test more sophisticated experiment on the quantum
teleportation of independent single photons. In terms of satellite-based
teleportation over the one-uplink channel, more tolerance for the channel
attenuation is required. Yin et al. investigated quantum teleportation through
a free-space channel over 97 km in Qinghai Lake, China [243]. Employing a
high-brightness multi-photon interferometry [238] with a four-photon count
rate of 2 kHz, after transmitting the teleported photon over 97 km with a
channel loss of 35-53 dB, a final count rate of 0.08 Hz was obtained.

For the three missions, the total channel attenuation in these works was
higher than the estimated values in Sec. V, which provided the sufficient
verification for three types of quantum channels.

Figure 15: Bidirectional two-link entanglement distribution over Qinghai Lake
with a distance of 101.8 km. [243]

Figure 16: (a) The QKD transmitter is mounted on a turntable which has
approximate dimensions of 500 mm$\times$450 mm$\times$600 mm (but 500
mm$\times$500 mm$\times$1,000 mm including the supporting metal frame). This
is used for simulation of satellite orbiting. When the turntable undergoes a
complex motion, the transmitter terminal will move accordingly. The simulation
was done with an angular velocity and angular acceleration larger than that in
a typical LEO. (b) Photo of the rising and erupting hot-air balloon in the
floating platform experiment. (c) Tracking error in the hot-air balloon
simulation. Long-time fine tracking error with the beacon light sometimes out
of the field of view. Inset: Fine tracking error in the stabilized time area.
When the beacon light is in the tracking field, tracking accuracy is about 5
$\mu$rad. [226]

###  VI.3 Testing with moving and vibrating objects

Real implementations of satellite-based quantum communications require high-
bandwidth and high-accuracy acquiring, pointing, and tracking (APT). All the
ground-based feasibility studies mentioned thus far are based on stationary
systems. For eventual satellite-based quantum communications, one should
consider that the satellite performs rapid, relative angular motions with
respect to the ground stations, which may include unwanted random motion. For
a typical LEO satellite at an altitude of 400-800 km, the angular velocity can
reach 20 mrad/s and the angular acceleration can reach 0.23 mrad/s2. A
verification environment that incorporates all possible motion modes and
simulations of extreme events, including vibration, random motion, and
attitude change, is highly desirable.

To this end, Wang et al. carried out two other experiments, in addition to the
97-km high loss one mentioned in Subsection VI-B, for the direct and full-
scale experimental verifications towards satellite-ground QKD [226].
Simulation experiments with a turntable and a hot-air balloon were implemented
to simulate the platform in a rapidly moving orbit as well as the vibration,
random motion and attitude change related to the LEO satellite. The turntable
(see Fig. 16(a)) provides motion with a maximum angular velocity of 21 mrad/s
and a maximum angular acceleration of 8.7 mrad/s2. With a distance of 40 km
between the transmitter and receiver, such a motion regime completely covers
the possible range of motion parameters for a 400-800 km LEO satellite. The
floating hot air balloon (see Fig. 16(b)), with a distance of 20 km from the
ground receiver, was employed as a randomly vibrating and floating platform,
which afforded an average angular velocity of 10.5 mrad/s and an average
angular acceleration of 1.7 mrad/s2 owing to its random motion. The balloon
could perform random and dramatic motions, which positioned it out of the view
of the field. This motivated the researchers to recapture the target rapidly,
typically within 3-5 s (see Fig. 16(c)). The performance of the acquiring,
tracking and positioning system, including both coarse control and fine
control, is summarized in Tab. 3. These verification environments incorporate
more extreme events, including vibration, random movement, and attitude
change, compared to what would suffer from an actual LEO satellite.

On the other hand, by utilizing the cube-corner retrorefector on satellites to
simulate the quasi-single-photon source, one can verify the feasibility of
establishing a quantum signal link between the satellite and the ground
station [221]. Yin et al. performed an experimental simulation of a quasi-
single-photon transmitter on the satellite with an average photon number of
0.85 per pulse and a full divergence angle of 38 $\mu rad$ sending to the
ground [242].

Components |  | Transmitter terminal | Receiver terminal
---|---|---|---
Telescope diameter |  | 200 mm | 300 mm
Coarse pointing | Type | Two-axis gimbal | Two-axis
mechanism |  | mount | gimbal mirror
| Tracking range | Azimuth:$\pm 45^{\circ}$ | Both:$\pm 5^{\circ}$
|  | Elevation:$\pm 70^{\circ}$ |
Coarse camera | Field of view | $2^{\circ}$ | $1^{\circ}$
| Size | $1000\times 1000$ | $640\times 480$
|  | pixels | pixels
Fine pointing | Type | Fast steering | Fast steering
machanism |  | mirror | mirror
| Tracking range |  $\pm 0.7$ mrad |  $\pm 0.7$ mrad
Fine camera | Field of view | $512~{}\mu rad$ | $512~{}\mu rad$
| size&frames |  $128\times 128$ & |  $128\times 128$ &
| per second | 2300 Hz | 2300 Hz
Tracking errors | Coarse | $\pm 200~{}\mu rad$ |
| tracking error |  |
| Fine tracking | $\pm 5~{}\mu rad$ |
| error |  |

Table 3: The parameters of APT system. [226]

###  VI.4 Time synchronization

Figure 17:  A typical recorded arrival time of the 1064 nm laser signals at
both stations. Synchronization accuracy of 788 ps was observed [243].

Since the transmitter and receiver are separated by a large distance and have
independent reference clocks, time synchronization is conducted to determine
the absolute photon number and distinguish the signal photons from the noise.
As the distance between the transmitter and receiver changes all the time when
the satellite passes over the ground station, both the GPS pulse-per-second
(PPS) signal and an assistant pulse laser are employed in the typical
synchronization scheme. From the works of [151] to [243], this synchronization
method has been continuously developed and improved.

In the experiment of [243], a pulsed laser (1064 nm, 10 kHz, 50 mW, 200
$\mu$rad) is employed for time synchronization. A pulse length of this laser
was 2.65 ns (full width at half maximum), with a rising edge of 2 ns. The GPS
PPS is added to synchronize the starting time. They addressed the forefront of
the detected signals with the constant fraction discriminator technique and
utilized a high-accuracy time-to-digital converter (TDC) with a time
resolution of 100 ps to record the arrival time of the synchronization signals
at both Alice’s and Bob’s stations. Through the above methods, in most cased,
the jitter caused by the laser pulse itself and energy shaking is reduced.
Finally, the time synchronization of better than 1 ns for the quantum channel
is achieved, as shown in Fig. 17. The technique of time synchronization
developed in these works can be applied directly in satellite-based quantum
science experiments.

###  VI.5 Polarization maintenance and compensation

Polarization encoding is employed in the long-distance free-space quantum
communication experiments. The relative motion of the satellite and the ground
station can induce a time-dependent rotation of the photon polarization
observed by the receiver. Thus, the polarization maintenance and compensation
are necessary. Wang et al. developed the following methods to improve a
system’s polarization visibility: (1) all the reflection mirrors are coated
with tailored films to maintain high polarization ($\geq$ 1,000:1), (2) using
two mirrors for phase matching in polarization deflection, and (3) other
optical elements (PBS and so on) are custom-made with a high extinction ratio
[226]. When all the above features were considered when setting up the optical
system, a polarization extinction ratio of 200:1 was obtained for both
transmitter and receiver systems. Further, when the transmitter and receiver
were connected during an experiment, the total polarization extinction ratio
was as high as 100:1, which meets the requirements of the satellite-based QKD.

Another crucial challenge associated with satellite-ground quantum
communication, attributed to the kinematical reference system, is the
polarization compensation in real-time. While the satellite reference frame
keeps changing during the satellite motion, the satellite and ground are
relatively static when the two sides face each other at any specific time in
this frame. In most cases, the polarization state changes over time because of
the two-dimensional rotation of the telescope. Following the telescope azimuth
or elevation rotation, a pair of mirrors changes its position, which leads to
changes in polarization. This problem can be solved by inputing the real-time
data of the orbit prediction into an auto-rotatable half-wave plate (HWP) for
polarization tracking, which has been verified by [242] and later employed by
ground stations for the Micius satellite. The extinction rate of the
polarization under tracking was tested to be more than 100:1 with this method.

###  VI.6 Other parallel ground-based free-space experiments

In parallel to the above-reviewed, comprehensive and systematic ground-based
verification works dedicated to the Micius satellite, many other experiments
were implemented around the world, and the scientific conclusions have been
consolidated. In the experiment [169] performed in Vienna, one of the
entangled photons was detected locally, while the other one was sent through
free space across 7.8 km. A new testbed for free-space quantum
communications—the link between the Canary islands of La Palma and
Tenerife—was employed by [184] for testing decoy-state QKD over a distance of
144 km. Later, Ursin et al. adopted the same experimental configuration as in
[169] to send triggered single photons across a distance of 144 km (one link)
using a free-space link between the Canary Islands La Palma and Tenerife
[216]. Due to the various atmospheric influences at such a long distance
scale, the apparent bearing of the receiver station varied in tens of seconds
to minutes. To maximize and stabilize the link efficiency, an active
stabilization of the optical link was implemented via a closed-loop tracking
system to correct the beam drifts induced by atmospheric changes, reducing the
beam drift from 70 $\mu$rad (10 m) to 7 $\mu$rad (1 m). Using this one-link
free-space channel, quantum teleportation has also been demonstrated [122]
with a channel attenuation of approximately 30 dB. A further experiment from
the same group upgraded the BBO crystal into a more efficient down-conversion
crystal, i.e., periodically poled KTiOPO4, which generated entangled photons
at $\sim$1 MHz and sent the two photons through the free-space channel across
144 km [59, 60].

To test the APT with moving objects, Nauerth et al conducted a QKD experiment
from an airplane to the ground [137]. The airplane was moving at a speed of
290 km/h, at a distance of 20 km, which corresponds to an angular velocity of
4 mrad/s. The transmitting beam was narrowed by a divergence of 180 $\mu$rad.
To establish a stable link with this divergence, fine-pointing assemblies were
implemented and optimized on both sides, with a precision upper bound of 150
$\mu$rad. With these efforts, the experiment yielded an asymptotically secure
key at a rate of 7.9 bit/s.

In addition to employing moving platforms to demonstrate the feasibility of
downlink channels, uplink channels were verified by the research team from
Canada with a truck and airplane. In 2015, they reported the first
demonstration of QKD from a stationary transmitter to a receiver platform
located on a moving truck [23]. In this experiment, QKD was implemented with a
moving receiver at an angular speed similar to that of a satellite at an
altitude of 600 km. Furthermore, they equipped a receiver prototype on an
airplane to demonstrate QKD via an uplink channel [162]. They specifically
designed the receiver prototype to consist of many components that were
compatible with the environment and resource constraints of a satellite. Their
above ground-based feasibility experiments on uplink channels with moving
platforms provided solid technical support for the follow-up satellite
project—QEYSSat.

In 2017, [202] used a classical laser source on the LEO satellite SOCRATES to
test the feasibility of the satellite-to-ground quantum-limited link.
Additionally, [79] completed a similar experiment using the classical laser
source from a geostationary satellite.

##  VII Developing and testing of the satellite payloads

The Micius program was officially approved in 2011. Construction of the first
prototype satellite started in 2012, and was completed in 2014. Thereafter,
the project turned to build the flight model of the satellite, which was
completed in November, 2015. After a series of environmental tests, including
thermal vacuum, thermal cycling, shock, vibration, and electromagnetic
compatibility tests, etc., the Micius satellite, weighing 635 kg, was well-
prepared and ready to be launched. On August 16, 2016, the Micius satellite
was successfully launched by the Long March-2D rocket, from the Jiuquan
Satellite Launch Centre, China. The orbit was circular and sun-synchronous
with an altitude of 500 km.

Figure 18:  The full view of the Micius satellite and main payloads. (a) The
photograph of the Micius satellite before launching. (b) The transmitter 1 for
QKD, entanglement distribution and teleportation. (c) The transmitter 2
specially for entanglement distribution. (d) The experimental control box. (e)
The entangled-photon source.

###  VII.1 Payload design

The Micius satellite has a double-decker design (see Fig. 18). The payloads
for the science experiments are composed of two optical transmitters
(transmitter 1 & 2), a space-borne entangled photon source (the upper layer of
the satellite), an experimental control processor, and two APT control boxes
(the lower layer of the satellite), as shown in Fig. 18(a).

The dimension of the experimental control box, as shown in Fig. 18(d), is
$280~{}\textrm{mm}\times 264~{}\textrm{mm}\times 150~{}\textrm{mm}$, weighing
7.5 kg. The experimental control box has six main functions: experimental
process management, random-number generation and storage, modulation of the
decoy-state photon source, synchronization-pulse recording, QKD post-
processing (including raw-key sifting, error correction and privacy
amplification to obtain the secure final keys), and encryption management.

Transmitter 1, with a diameter of 300 mm and a total weight of 115 kg, as
shown in Fig. 18(b), is involved in all the three main scientific goals. It
comprises eight laser diodes with drivers, a BB84 polarization encoding
module, a telescope, a receiving module (including a QWP, HWP, PBS, and two
single-photon detectors), and the APT system (including a beacon laser, a
coarse camera, two-axis mirror, a fine camera, a fast steering mirror (FSM),
etc.), as shown in Fig. 19(a). Transmitter 2, with a diameter of 180 mm and a
total weight of 83 kg, as shown in Fig. 18(c), is specially designed for the
quantum entanglement distribution from the satellite to two separate ground
stations. Further, it can serve as transmitter 1’s backup for the satellite-
based QKD. Both transmitters contain a telescope and an optical box. To reduce
the emission loss, an off-axis telescope design is employed in transmitter 2.
The optical box mainly consists of a fine tracking system, an integrated
receiving module for sampling measurement, and a motorized wave-plate
combination for polarization correction, as shown in Fig. 19(b).

Figure 19:  The top view of transmitter’s optics head. [107] The collimated
beam from the entangled-photon source, passes through a motorized wave-plates
combination, a beam expander, and then is combined with the 850 nm
synchronization laser by a dichroic mirror. (a) The transmitter 1’s optics
head. (b) The transmitter 2’s optics head.

Additionally, both transmitters contain a multistage APT system. The first
stage involves satellite attitude control, where the system keeps the photons
pointing to the ground station with an error less than 0.5 degree. The second
stage is the coarse control loop involving the two-axis gimbal mirror for
transmitter 1 and the two-dimensional rotatable telescope for transmitter 2.
The third stage is the fine control loop, involving a FSM driven by
piezoceramics and a camera.

The space-borne entangled-photon source (SEPS) is an optomechatronics
integration payload with a dimension of $430~{}\textrm{mm}\times
355~{}\textrm{mm}\times 150~{}\textrm{mm}$ and a total weight of 23.8 kg, as
shown in Fig. 18(e). The schematic of SEPS is shown in Fig. 20. A continuous-
wave laser diode with a central wavelength of 405 nm and a linewidth of 160
MHz was employed to pump a periodically poled KTiOPO4 (PPKTP) crystal inside a
Sagnac interferometer. The pump laser, split by a PBS, passes through the
nonlinear crystal in clockwise and anticlockwise directions simultaneously,
producing down-converted photon pairs at a wavelength of 810 nm, as
polarization-entangled states close to the form
($|H\rangle_{1}|V\rangle_{2}+|V\rangle_{1}|H\rangle_{2})/\sqrt{2}$, where $H$
and $V$ denote the horizontal and vertical polarization states, respectively,
and the subscripts 1 and 2 denote the two output spatial modes. This source is
robust against various vibrations, temperatures, and electromagnetic
conditions. With a pump power of 30 mW, the source emits 5.9 million
entangled-photon pairs per second, with a state fidelity of 0.907 $\pm$ 0.007.

Figure 20:  The schematic of the satellite-borne entangled-photon source.
[240] The entangled-photon source in Micius satellite is based on type-II
PPKTP (periodically poled $KTiOPO_{4}$) crystal and the Sagnac interferometer.
PL, pump laser; DM, dichromatic mirror; PI, piezo steering mirror; QWP,
quarter-wave plate; HWP, half-wave plate; PBS, polarizing beam splitter.

The optical elements are mounted and glued on the both sides of a 40 mm-thick
optical bench. The optical bench is composed of titanium alloy, which has a
good balance of rigidity, thermal expansion, and density. The most sensitive
structure of SEPS, the Sagnac interferometer, is integrated into a palm-sized
invar material plate with a thickness of 15 mm and thermo-insulated embedded
into the titanium plate to achieve an optimal stability when the satellite is
launched and in orbit. The input and output beams of the Sagnac interferometer
are collimated because of the confocal design, which relaxes the requirement
of a high mounting accuracy for the couplers. In addition, two piezo steering
mirrors (PI) are employed to correct the pointing offset of the beam. The
Sagnac interferometer module in the SEPS has passed a series of space
environment adaptability tests, such as the thermal-vacuum and vibration
tests, which help release thermodynamic stress in advance and enhance system
stability. The SEPS is guided to two optical transmitters through two single-
mode fibers with lengths of 280 mm and 410 mm, respectively. After utilizing a
5$\times$ beam expander, a mirror is placed at the edge of the beam to sample
the entangled photons by $1\%$. An integrated BB84 receiving module,
consisting of two Wollaston prisms and one beam splitter, realized a random
measurement of four polarizations (0, 90, 45 and 135 degree). Through the
$1\%$ sampling in both entangled-photon transmitters, the source brightness
can be estimated in orbit.

The APT control box dimension is $326~{}\textrm{mm}\times
244~{}\textrm{mm}\times 242~{}\textrm{mm}$ with a weight of 10 kg, and it
mainly contains the control electronics for the coarse tracking loop and the
fine tracking loop. Its functions specifically as a motor driver, FSM driver,
coarse feedback loop controller and fine feedback loop controller.

###  VII.2 Testing the payload under various conditions

For the design of the payloads, besides the functional requirements, it is
also very important to ensure adaptability in space environment. In general,
there are three main types of space environment tests: vibration, thermal, and
vacuum tests. The vibration test can be subdivided into sinusoidal, random
vibration, and impact test. The thermal and vacuum tests include thermal
vacuum, thermal cycling, and thermo-vacuum-optical measurements. Considering
all the payloads described in subsection VII.A, each payload must be subjected
to these three space environmental simulation tests. After every payload has
passed the test separately, all the payloads are combined for the final test
in the thermal-vacuum environment. During the development of the Micius
satellite, two integral space environment tests for the payload combination,
thermal-vacuum-optical measurement and the thermal balance testing for the
whole satellite, are implemented (see the Fig. 21).

Figure 21: The thermal-vacuum-optical measurement (a) and the thermal
balancing testing (b) for payload combination.

For the thermal-vacuum-optical measurement, as shown in Fig. 21(a), the
integration of all the scientific payloads are integrated into a thermal-
vacuum chamber. The special design of this type thermal vacuum chamber is the
optical window connected with large aperture collimator, which can provide
measurement on the optical parameters in real time in various thermal vacuum
environments. The divergence angle is one of the key typical optical
parameters for the two satellite-based transmitters, and it directly affects
the channel loss. The test results of the divergence angles are shown in Fig.
22. The figure shows the optimum operating temperature of the two transmitters
at 810 nm and 850 nm, respectively. Furthermore, for transmitter 1 and 2, the
divergence angle meets the requirement of $<$ 15 $\mu rad$ when the
temperature ranges from 18∘C to 22∘C.

Figure 21(b) shows the photo of the whole system of the Micius satellite when
carrying out the thermal-balance testing, which is typically a part of the
whole system thermal vacuum testing. It mainly has two objectives: obtaining
thermal data for analytic thermal model correlation and verifying the function
of the thermal control of the whole system or the subsystems. The test for the
whole system of the Micius satellite lasted for 18 days, and six thermal
balance operating conditions and four thermal cyclings were completed in
total.

Figure 22: Test results of divergence angles in thermal vacuum conditions

In addition to the above three types of space environmental tests, the
radiation test is also very important. The Micius satellite contains the
silicon avalanche photodiodes (Si APD) in both transmitters for implementing
the experiment of the ground-to-satellite quantum teleportation, and for
sampling the entangled photons to test the in-orbit performance of the
satellite-borne entangled photon source. The Si APD is the radiation-sensitive
device; thus, radiation degrades their performance by increasing dark
currents, as well as decreasing responsivity and gain. The radiation test was
performed to the space-borne Si APDs of the Micius satellite, using 50 MeV
proton source, which effectively penetrates the APD package front glass
window. According to the results of the radiation test, the in-orbit
radiation-induced dark count rate (DCR) increment of the silicon APD increased
by $\sim$219 cps/day. To mitigate the APD radiation-induced DCR increment rate
and guarantee the detector reliability, several solutions were developed,
including multistage cooling technologies and specialized driver electronics
for the space-borne, low-noise detectors. Through these solutions, the
expected detector in-orbit DCR increment rate can be reduced to less than 1
cps/day, satisfying the requirement of satellite-based quantum science
experiments [236, 167].

##  VIII Construction of cooperative ground stations

To coordinate with the quantum science satellite in implementing the
experiments, new ground stations need to be built or existing ones upgraded.
There are totally five ground stations in China: four of them are for
receiving via downlink channels, while one single station for transmitting via
uplink channels. The receiving ground stations, each with a large-diameter
telescope, i.e., the 1-meter-diameter telescope at the Xinglong Station of
National Astronomical Observatories, CAS/NAOC (upgraded and rebuilt) for the
satellite-to-ground QKD, the 1.8-meter-diameter telescope at Lijiang Station
of Yunnan Astronomical Observatory/YAO (upgraded and rebuilt) for the
entanglement distribution experiment, the 1.2-meter-diameter telescope at the
Nanshan Observatory of Xinjiang Astronomical Observatory/XAO (newly built) for
the entanglement distribution and QKD experiments, the 1.2-meter-diameter
telescope at the Qinghai Station of Purple Mountain Observatory/PAO (newly
built) for the entanglement distribution and QKD experiments (see Fig. 23).

The transmitting station with three small transmitter telescopes located in
Ngari (Ali) was specially constructed for the quantum teleportation experiment
from the ground to the satellite, as shown in Fig. 25.

The ground station in Xinglong was upgraded and rebuilt in 2014 for satellite-
to-ground QKD experiments. As shown in Fig. 23(b), it consists of a Ritchey-
Chretien telescope, a red beacon laser (671 nm, 2.7 W, 0.9 mrad), a coarse
camera (field of view (FOV): $0.33^{\circ}\times 0.33^{\circ}$, pixels of
$512\times 512$, frames-per-second (FPS) of 56 Hz), and an optical receiver
box which is installed on the arm of the gimbal. A two-axis gimbal in a
control loop with a coarse camera is employed to realize the coarse tracking
function. The 532 nm beacon laser coming from the satellite is detected by the
coarse camera. Guided by the 532 nm beacon laser, the 671 nm beacon laser
transmitted from the ground telescope can point to the satellite precisely.
The fine tracking system and the BB84 measurement module are mounted in the
receiver box. The fine tracking system mainly includes a FSM based on voice-
coil and a fine camera (FOV: 1.3 $\times$ 1.3 mrad, pixels: 128 $\times$ 128,
FPS: 212 Hz). A dichroic mirror was used to separate the 850 nm photons from
the 532 nm beam. A beam splitter (BS) was used to divide the 532 nm beam into
two parts: one was detected by the fine camera for tracking, while the other
was coupled into the fiber linked to a single-photon detector for the time
synchronization. The 850 nm photons are measured by a customized BB84
polarization analysis module, after passing through a beam expander, a
motorized HWP and an interference filter. The detectors’ electric output
pulses and the GPS PPS signal are fed into a time-to-digital convertor (TDC),
which records the detection time and the channel number of the detectors.

Figure 23:  The typical receiving ground station for the Micius satellite.
[107] (a) The two-axis gimbal telescope. (b) Beacon laser and coarse camera.
(c) One of the two layers of the optical receiver box. (d) The typical optical
design of the receiver, including the receiving telescope, the ATP system, and
the QKD-detection module.

For the mission of the satellite-based entanglement distribution, three ground
stations located respectively in Delingha, Urumqi, and Lijiang, are involved.
The distance between Delingha and Lijiang (Nanshan in Urumqi) is approximately
1203 km (1120 km). Two new telescopes (with a diameter of 1.2 m) with the same
design were built in Nanshan and Delingha in 2015, mainly for entanglement
distribution experiments, as well as satellite-to-ground QKD experiments. All
the optical elements in two telescopes have a polarization-maintaining
property. The measurement boxes are installed on one of the rotating arms, and
they rotate along with the telescopes, as shown in Fig. 23(a). The Lijiang
ground station was upgraded in 2016 specially for the satellite-based quantum
entanglement distribution experiments. In the Lijiang station, the original
telescope with a large diameter of 1.8 m was modified for the quantum
satellite-based experiments. The designs of the measurement boxes in these
three stations are similar (see Fig. 24).

Figure 24:  The photograph of the measurement box at Lijiang station, which
represents the typical design for the satellite-based entanglement
distribution. [240]

Typically, the FSM and the camera are combined to construct a close-loop fine
tracking system. The 850 nm and 532 nm photons are coupled into multimode
fibers with $320~{}\mu m$ core for the synchronization. Together with a Pockel
Cell, an integrated 810 nm module with PBS inside achieved a random
polarization analysis of signal photons. For the Bell test, quantum random
number generators (RNG) were employed to afford the random measurement bases
choice.

The Ali ground station was completed in 2016, and it has the highest altitude
(5100 m) among the five stations. Three optical telescopes with a diameter of
130 mm were employ as the transmitting antennas for the ground-to-satellite
teleportation, as shown in Fig. 25(a). To improve the transmitting efficiency,
a double off-axis parabolic structure is employed in these telescopes (see
Fig. 25(b)). All the optical components in the transmitting antenna have
polarization-maintaining capabilities. The wave-plates combinations are
employed to correct the unknown transformations applied by the SMFs and
automatically compensate for the deviation of the polarized base vector,
caused by the movement of the satellite. The polarization fidelity of the
whole system exceeded $99.5\%$. The FSM and a high-speed CCD constitute the
ground fine tracking system, which realizes the pointing and tracking for the
satellite with high accuracy. The tracking accuracy of the whole system is
less than 3 $\mu$rad (1 $\sigma$). Two 671 nm beacon lasers (power: 2 W,
divergence angle: 1.2 mrad) are installed on the top of the two transmitting
telescopes, respectively, for satellite tracking on the ground.

For time synchronization, the 532 nm beacon laser in the satellite-based
transmitter is designed as a pulse laser to perform synchronization; it is a
passive Q-switching type laser with a repetition frequency of $\sim$ 10 kHz
and an optical pulse width of 0.88 ns. A part of the laser is guided into a
fast photodiode to convert it into an electrical pulse signal. Both the pulse
signal and the GPS PPS signal from the satellite are fed into the time-to-
digital convertor (TDC) module of the transmitter. The acquired data are
stored in the memory for further processing. In the ground station, a part of
the 532 nm laser beam is sent to a single-photon detector. The output signal
of the single-photon detector, together with the four single-photon detectors’
electrical output pulses and the GPS-PPS signal, is fed into a TDC. The time
synchronization process between the satellite and the ground can be divided
into two steps. First, according to the predicted light-flight-time and the
GPS-PPS signal, the received synchronization laser pulse sequence on the
ground can be matched with the satellite. Second, based on the results of step
1, the time between the satellite and the ground will be synchronized.
Finally, a typical temporal distribution of QKD photons with a standard
deviation is obtained around 529 ps, with a signal time window of 2 ns [107].

Figure 25:  The transmitting telescope and optical design. [167] (a) The
photograph of transmitting optical antennas, which are placed side by side on
a platform and backup each other. Quantum signals generated from the lab at
floor 1 are transmitted to three telescopes. The beacon lasers and sync. laser
are equipped on the top of the transmitting antennas. (b) The optical design
of the transmitting telescope, which comprises a scanning head, a transmitting
telescope, and an optical module.

##  IX Satellite-based quantum experiments with Micius

After the full verification of the feasibility of satellite-based quantum
communication, we review in this section the development of a sophisticated
satellite named after an ancient Chinese scientist, Micius. It was
successfully launched in August 16, 2016, in Jiuquan, China, orbiting at an
altitude of $\sim$ 500 km. Coordinating ground observatory stations have been
built worldwide to conduct the designed experiments for QKD, entanglement
distribution, quantum teleportation, and foundational tests in quantum
physics.

###  IX.1 Satellite-to-ground quantum key distribution

Figure 26:  Establishing a reliable space-to-ground link for the quantum state
transfer. [107] (a) Overlaid and time-lapse photographs of the beacon lasers
for tracking when the satellite flies over the Xinglong ground station. The
red and green lasers are sent from the ground and the satellite, respectively,
with a divergence angle of 0.9-1.25 mrad. (b) Distribution of long-time
tracking error (shown as the number of detected events normalized by the
maximum count in each bin) of the X and Y axes extracted from the real-time
images read out from the fast camera.

After launching satellite Micius, the first goal was to establish a space-
ground quantum link and perform QKD from satellite to ground [107]. The
Chinese team observed the first “handshake” between the satellite and Xinglong
ground station near Beijing ten days after the launch (see Fig. 26(a) for an
overlaid and time-lapse photographs of tracking laser as the satellite flies
over a ground staton). As discussed in Sec. V. A, the downlink has reduced
beam spreading compared to the uplink because the beam wandering occurs at the
end of the transmission path, which is typically smaller than the effect from
the beam diffraction. The 300-mm-aperture telescope equipped in the satellite
produced a near-diffraction-limited far-field divergence of about 10 $\mu$rad.
Such a narrow divergence beam from the fast-travelling satellite (with a speed
of about 7.6 km/s) requires a fast and precise APT. Tracking accuracy of
approximately 1.2 $\mu$rad (see Fig. 26b) was achieved, which is much smaller
than the beam divergence. It should be noted that due to the quiet environment
in out space, the tracking accuracy is better than the previous ground tests,
which deliberately set a more stringent condition. A diffraction loss of
approximately 22 dB was obtained at 1200 km, whereas the loss due to pointing
error was below 3 dB. Additionally, the loss due to atmospheric absorption was
3-8 dB.

The satellite passes each ground station with a sun-synchronous orbit every
midnight local time for a duration of about 5 minutes. Figure 27 shows an
experimental procedure for the satellite-to-ground QKD. First, the Scientific
Experiment Plan Center arranged the experiment, if the calculated maximum
elevation angle of the satellite to the ground station is greater than 30∘
(based on predicted satellite orbits) and the weather is forecasted to be
clear in the night. If so, instruction sequence files for the satellite are
made and sent to the ground support center Then, the instruction file, which
is translated to a coding file is executed. The attitude of the satellite is
adjusted to point at the ground station 10 min before the satellite enters the
shadow zone. When the satellite’s angle of elevation exceeds 5∘, its attitude
control system ensures that the transmitter is pointing to the ground station
with a coarse orientation accuracy of better than 0.5∘. Then, the closed-loop
APT systems start bidirectional tracking and pointing, ensuring that the
transmitter and receiver are robustly locked with a tracking accuracy of
$\sim$1.2 $\mu$rad through the whole orbit (see Fig. 26(b)). From a 15∘
elevation angle, the decoy-state QKD transmitter sends signal and decoy
photons together, which are received and decoded by the ground station, until
the satellite reaches an angle of elevation of 10∘ in the other end when a
single-orbit experiment ends.

Figure 27:  Tracking and QKD processes during an orbit. [107]

Figure 28:  Performance of satellite-to-ground QKD during one orbit. [107] (a)
The trajectory of the Micius satellite measured from Xinglong ground station.
(b) The sifted key rate as a function of time and physical distance from the
satellite to the station. (c) Observed quantum bit error rate. (d) The
attenuation of the down-link channel with different distances between the
satellite and the ground. (e) Summary of the QKD data obtained for 23
different days. The x axis is the shortest satellite-to-station distance,
which occurs at the highest elevation angle and varies for different days. The
y axis is the average sifted key rate.

Figure 29: Link efficiencies are shown for direct transmission through
telecommunication optical fibers (red) and the satellite-to-ground approach
(blue). The link efficiencies for the latter were calculated by dividing the
photon intensity that arrived in front of the detectors at the ground station
by that at the output of the satellite’s transmitter. [107]

Apart from being used in the APT, the beacon laser also serves for obtaining
the arrival time of the single photons in order to compensate for the space-
ground clock drift. The obtained time synchronization jitter is 0.5 ns, which
is useful for filtering the background noise. Additionally, a spectral
bandpass filter is used in the receiver to reduce the background scattering.
Finally, a motorized half-wave plate is used to dynamically compensate for the
time-dependent photon polarization rotation during the satellite passage.

In the experiment, we employed the decoy-state BB84 protocol, a form of QKD
that uses weak coherent pulses at high channel loss and is immune to photon-
number-splitting eavesdropping. Since September 2016, QKD has been performed
routinely under good atmospheric conditions. An example of the relevant QKD
data obtained on 19th December 2016 is shown in Fig. 28. The satellite-
observatory separation ranged from 645-1200 km. The experiment collected
3,551,136 detection events in the ground station after 273 s and 1,671,072
bits of sifted keys. From Fig. 28(b), the sifted key rate was about 12 kbits/s
at 645 km and 1 kbits/s at 1200 km. This was mainly due to the increase in
both the physically separated distance and the effective thickness of the
atmosphere near the earth at smaller elevation angles. The observed bit error
rate had an average of 1.1$\%$. By performing error correction and privacy
amplification, the secure final key was 300,939 bits when the statistical
failure probability was set to be 10-9, corresponding to a key rate of 1.1
kbits/s.

Meanwhile, similar QKD experiments were routinely performed with other ground
stations, such as Delingha. The typical LEO satellite-to-ground channel
attenuation was calibrated during one orbit, which varies from 29 dB at 530 km
to 44 dB at 1600 km, as plotted in Fig. 28(d). Figure 28(e) shows a summary of
the QKD experiments performed for 23 days, where the physical distance between
the satellite and the ground station varied each day.

The performance of the satellite-based QKD can then be compared with the
conventional method of direct transmission through telecommunication fibers.
Figure 29 shows the extracted link efficiency at the distance from 645 km to
1200 km from the observed count rate, with the theoretically calculated link
efficiency using fibers with 0.2 dB/km loss. At 1200 km, the satellite-based
QKD within the 273 s coverage time demonstrated a channel efficiency of about
20 orders of magnitudes higher than using the optical fiber. Compared with the
data in Fig. 29, using a 1200 km fiber, even with a perfect 10-GHz single-
photon source, and the ideal single-photon detectors with no dark count, we
can obtain only 1-bit sifted key over six million years.

Improving the final key rate is always one of main goals for the practical
QKD. Recently, about three years after the first satellite-to-ground QKD was
implemented, it achieved an average secret key rate of 47.8 kbps for a typical
satellite pass, which is more than 40 times higher than previous results
[107], as shown in Fig 30. Such great improvement of the final key rate is due
to the following: 1) the signal state ratio, increased from 0.5 to 0.72, the
Z-base ratio increased from 0.5-0.889 at the satellite and 0.5-0.9 on the
ground station, thereby enhancing the key rate by 2.34 times; 2) the
repetition frequency increased from 100-200 MHz; 3) the ground telescope
increased from 1-1.2 m, corresponding to an increment about 1.5 times; 4) the
QBER is reduced and the raw key size increased to about 2 times; 5) the ground
coupling efficiency increased from 14%-40%, corresponding to an increment of
about 3 times [41].

Figure 30:  Performance of high-speed satellite-to-ground QKD. [41] (a) The
sifted key rate and observed QBER as a function of physical distance from the
satellite to the Nanshan station.(b) The test for long-distance satellite-to-
ground QKD. Sifted key rate and observed QBER at a distance beyond 1200 km.

###  IX.2 Satellite-based entanglement distribution

The second planned mission of the Micius satellite was a bidirectional
distribution of its space-borne entangled photons to two distant locations on
the earth [240]. Long-distance entanglement distribution is essential for both
foundational tests of quantum physics and scalable quantum networks. Owing to
channel loss, however, the previously achieved distance was limited to $\sim$
300 km [91]. This is mainly due to the photon loss in the channel (optical
fibers or terrestrial free space), which normally scales exponentially with
the channel length. For example, using a bidirectional distribution of an
entangled source of photon pairs with 10-MHz count rate directly through two
600-km telecommunication fibers with a loss of 0.2 dB/km, we can only obtain
10-17/s two-photon coincidence events.

For the mission of entanglement distribution, three ground stations are
cooperating with the satellite, located at Delingha in Qinghai, Nanshan in
Urumqi, Xinjiang, and Gaomeigu Observatory in Lijiang, Yunnan. The physical
distance between Delingha and Lijiang (Nanshan) is 1203 km (1120 km). The
separation between the orbiting satellite and these ground stations varies
from 500 km to 2000 km. At Delingha, Lijiang and Nanshan station, the
receiving telescopies has diameters of 1200 mm, 1800 mm, and 1200 mm,
respectively. The entanglement distribution was achieved both between Delingha
and Lijiang, and between Delingha and Nanshan. The experiment involving
Delingha and Lijiang is described below. Figure 31(a) plots the physical
distances from the satellite to Delingha and Lijiang during one orbit, and the
sum channel length of the two downlinks.

The satellite (Fig. 20) emits 5.9 million entangled photon pairs per second,
which are then sent out using two telescopes. Cascaded multi-stage close-loop
APT systems are designed in both the transmitters and receivers, establishing
two independent satellite-to-ground quantum links simultaneously. Using a
reference laser on the satellite, the overall two-downlink channel attenuation
can be measured in real time, which varies from 64 dB to 82 dB (Fig. 31(b)). A
slight asymmetry is observed in the attenuation curve–when the satellite moves
closer to Lijiang. Furthermore, the link efficiency is higher because Lijiang
station has a larger-size aperture telescope.

The experiment observed an average two-photon count rate of 1.1 Hz, with a
signal-to-noise ratio of 8:1. Compared to the previous entanglement
distribution method by direct transmission of the same two-photon source using
the common commercial telecommunication fibers with a loss of 0.2 dB/km (the
best performance fiber with a loss of 0.16 dB/km), the effective link
efficiency of the satellite-based approach within the 275 s coverage time is
17 (12) orders of magnitude higher than the one with the same transmission
distance in fibers.

The received photons were analyzed by a half-wave plate, a polarizing beam
splitter, and a Pockel cell controlled by 4 Mbits/s random numbers. To verify
whether both photons are still entangled after passing an overall distance
ranging from 1600 km to 2400 km, we obtained 134 coincidence counts during an
effective time of 250 s in satellite-orbit shadow time. From the H/V and
diagonal basis measurements, the state fidelity of the two photons distributed
over 1203 km was estimated to be 0.869 $\pm$ 0.085.

Figure 31:  (a) A typical two-downlink transmission from the satellite to
Delingha and Lijiang that lasted for about 275 s in one orbit. The distance
from the satellite to Delingha varies from 545 to 1680 km. The distance from
the satellite to Lijiang varies from 560 to 1700 km. The overall length of the
two-downlink channel varies from 1600 to 2400 km. (b) The measured two-
downlink channel attenuation in one orbit, using the high-intensity reference
laser co-aligned with the entangled photons. The highest loss is 82 dB at the
total distance of 2400 km, when the satellite has just reached a 10∘ elevation
angle observed from Lijiang station. Since its telescope has a diameter of 1.8
m (the largest) and thus has a higher receiving efficiency than other
stations, when the satellite flies over Lijiang at an elevation angle of more
than 15∘, the channel loss remains relatively stable, from 64 to 68.5 dB.
[240]

Figure 32:  (a) Normalized two-photon coincidence counts in the measurement
setting of the H/V basis. (b) Normalized counts in the diagonal basis. (c)
Correlation functions of a CHSH-type Bell inequality for entanglement
distribution. Error bars are one standard deviation, calculated from
propagated Poissonian counting statistics of the raw photon. [240]

The distributed entangled two photons were then employed for a Bell test. The
experimental configuration and Pockels cells used were fast enough to close
the locality and freedom-of-choice loopholes. The Bell test ran 1167 trials
during an effective time of 1059 s, with the observed data summarized in Fig.
32. A violation of the Bell inequality of 2.374 $\pm$ 0.093 by 4 standard
deviations was obtained. The result again confirms the nonlocal feature of
entanglement and excludes the models of reality, which sits on the notions of
locality and realism, in a new space scale with thousands of kilometers.

###  IX.3 Entanglement-based quantum key distribution

In the experiment of entanglement distribution between Lijiang and Delingha
over 1200 km, the observed two-photon count rate of 1.1 Hz and signal to noise
ratio of 8:1 was sufficient for violating Bell’s inequality. However, there
the key rate and the quantum bit error rate (8.1$\%$) were insufficient for
performing the entanglement-based quantum cryptography [55]. Entanglement-
based QKD is particularly attractive because of its inherent source-
independent security [100, 121] where the security can be established without
any assumption on trusted relay.

Inside laboratories, the record length of QKD was about 500 km in coiled fiber
[239, 21, 39]. The satellite-to-ground decoy-state QKD reviewed in Section
IX.A achieved a point-to-point distance of 1200 km [107], which, however, was
not for two ground users. Without using trusted replays, the QKD distance for
two ground users was about 100 km over terrestrial free space [216, 243].

After the first satellite-based entanglement distribution [240, 241], a later
experiment [244] performed between the ground station of Delingha and Nanshan
with a physical separation of 1120 km. The receiving efficiencies were
considerably improved using a higher efficiency telescope and follow-up
optics. Both ground stations used newly built telescopes with diameters of 1.2
m. In the telescopes, the main lens was re-coated and the beam expander was
re-designed. In the follow-up optics, the collection efficiency was enhanced
by optical pattern matching, particularly, through shortening the optical path
by reducing spectral splitting to avoid the beam spread. With these technical
improvements, the authors observed an average two-photon count rate of 2 Hz
(corresponding to an increase of the two-photon link efficiency by a factor of
4), which significantly increased the obtained key rate and decreased the
quantum bit error rate from 8.1$\%$ to 4.5$\%$.

A special effort of [244] was made to ensure its implementation is practically
secure against all known side channels. Due to the source-independent nature
of the entanglement-based QKD, the system was immune to any loophole in the
source, and all left is to ensure the security on the detection sides in both
ground stations. In general, the side channels, known and to be known, on the
detection primarily violate the assumption of fair-sampling. Note that the
concept of “fair-sampling” here refers to the consistency of different
receiving detectors on spatial and spectral freedom of the arrival beams,
which differs from the experimental requirement of addressing the “fair-
sampling loophole” of the Bell test. Experimentally, Yin et al. ensured the
validity of the fair-sampling by filtering in different degrees of freedom,
including frequency, spatial and temporal modes. Also, countermeasures were
taken for the correct operation of the single-photon detectors, as shown in
Fig. 33. They considered all known detection attacks, including the detector-
related attacks [250, 120, 229], wavelength-dependent attack [105], spatial-
mode attack [181], and other possible side-channels. For example, for the side
channels targeting at the operation of detectors, such as blinding attacks
[120], additional monitoring circuits were used to monitor the anode of the
load resistance in the detection circuit to counter the blinding attack. For
the time-shift attack [250] and the dead-time attacks [229], the
countermeasure was to operate the detector in free-running mode, in which the