The Evolution of Quantum Secure Direct Communication: On the Road to the Qinternet

Communication security has to evolve to a higher plane in the face of the threat from the massive computing power of the emerging quantum computers. Quantum secure direct communication (QSDC) constitutes a promising branch of quantum communication, which is provably secure and overcomes the threat of quantum computing, whilst conveying secret messages directly via the quantum channel. In this survey, we highlight the motivation and the status of QSDC research with special emphasis on its theoretical basis and experimental verification. We will detail the associated point-to-point communication protocols and show how information is protected and transmitted. Finally, we discuss the open challenges as well as the future trends of QSDC networks, emphasizing again that QSDC is not a pure quantum key distribution (QKD) protocol, but a fully-fledged secure communication scheme.

The widespread application of communicating computers and mobile devices has changed our daily life beyond recognition.However, retaining the confidentiality of sensitive information is of crucial importance for individuals, enterprises, and governments in our information age.Cryptography is used for maintaining the confidentiality, integrity, and authenticity of information for the authorized users in the face of the malicious activities of third-party adversaries [1].The operational cryptographic systems tend to rely on carrying out mathematical operations, that are hard to 'decypher' with the aid of state-of-the-art computers.In other words, practical computer science offers what is termed as computational security, which is practically unbreakable within a relatively short space of time by using practical computational resources.However, this conventional cryptography faces challenges imposed by the evolution of ever more powerful computing hardware.

A. Cryptosystems in the quantum world
Asymmetric cryptography 1 primarily relies on excessivecomplexity calculations.Such as factoring large prime numbers in Rivest-Shamir-Adleman cryptosystems [3], and solving discrete logarithmic problems.However, at the time of writing, the security of asymmetric cryptography is facing increasing threats from quantum computers [5]- [8], which are capable of factoring large primes.In contrast to classical computers, which tend to rely on Boolean logic and on exploiting that the classical bits can only be in one of two states, namely 0 or 1, the basic variable of quantum computers -namely the qubit -exhibits entirely different properties.It is not confined to the two states, but can exist in their superposition [9]- [11].Information encoding, storing and processing may be carried out more efficiently in quantum computers than in its classical counterpart, when relying on superimposed quantum states.Explicitly, massive parallel computations are facilitated by quantum computers.Shor's algorithm [12] shows that a quantum computer is capable of efficient factorization of large 1 Asymmetric cryptography is also known as public-key cryptography, which is an approach that uses a pair of related keys called public key and private key to encrypt and decrypt a secret plaintext, respectively, which protects the plaintext from eavesdropping.Correspondingly, symmetric cryptography usually uses the same cryptographic keys for the process of encryption and decryption.
prime numbers and of solving elliptic curve based problems.Similarly, quantum annealing computers are equally powerful [13].The noisy intermediate-scale quantum computers may challenge the Rivest-Shamir-Adleman cryptosystems by using a hybrid quantum-classical algorithm [14].Thus, the abovementioned commonly used cryptographic algorithms are no longer secure in the quantum era [15].
Another well-known algorithm running on a quantum computer is Grover's search algorithm [16]- [20], which is capable of finding a known entry in unsorted databases [21], [22].Grover's algorithm is eminently suitable for analyzing symmetric encryption systems, such as the Data Encryption Standard and the Advanced Encryption Standard [2], [23].These cryptographic protocols are generally analyzed using 'brute force' search in the space of all legitimate keys.Specifically, the 56-bit keys of the Data Encryption Standard [2] may be cracked by Grover's algorithm, which will use on the order of hundred million search steps, which is much lower than that of the number of operations to be carried out by a classical computer [24].Furthermore, the hash function SHA-2 (Secure Hash Algorithm) and SHA-3 [2] are facing the same threats in symmetric encryption systems, since their security relies on the difficulty of finding two different messages that map to the same fixed length.However, Grover's algorithm provides an improvement to this problem [25], although an exponential speed-up in the database search problem is infeasible even for Grover's optimal algorithm [20], [26]- [28].Cryptologists believe that the Advanced Encryption Standard, SHA-2, and SHA-3 are relatively secure even in a quantum world, but defense mechanisms should nonetheless be conceived to guard against quantum search attacks [29].It is believed that doubling the key size of a symmetric encryption system or that of the output length of a hash function is urgently needed.
Large-scale quantum computers are expected to have farreaching influence on the existing cryptographic solutions as reported by the National Institute of Standards and Technology [30].Table I summarizes these impacts, indicating that the progress of quantum computation tends to threaten the security of modern cryptosystems.Although it has been argued that public-key cryptosystems will only be broken when practical quantum computers have been built for handing thousands quantum bits and can perform thousands of quantum gate operations [31]- [33], it is time for the research community to conceive new cryptosystems, which remain secure in the quantum era.
Ensuring the privacy and security of our communication in the quantum era is the major task of cryptography.There are two different alternative candidate families, namely postquantum cryptography and quantum cryptography or quantum communication.Post-quantum cryptography is also based on solving challenging mathematical problems, but they rely on other problems than the factoring of large numbers.Instead, they rely on discrete logarithms [34], on lattice-based cryptography [35], and on code-based cryptography [36].Quantum cryptography or quantum communication is another securecommunication solution that exploits the properties of quantum mechanics itself, which additionally has the capability of detecting eavesdropping.The roots of quantum cryptography or quantum communication can be traced back to the idea of Wiesner in the late 1960s, who proposed the concept of unforgeable quantum money by relying on quantum physics.Similarly to many other radical concepts, he had difficulty in publishing his paper, but finally his much-delayed paper was published in 1983 [37], where he described how information may be stored and conveyed with the aid of polarized photons.In 1984 [38], enlightened by Wiesner's idea, Bennett and Brassard discovered that a pair of communicating parties can generate a cryptographic key over an insecure channel by using appropriately polarized single photons [39].It is what we know today as the Bennett-Brassard 84 (BB84) quantum key distribution (QKD) protocol, marking the beginning of quantum cryptography.The security of quantum-domain cryptosystems is based on the laws of quantum mechanics rather than on conceiving mathematically challenging problems, which enables the legitimate commu-nicating parties to have unconditionally secure links.As a benefit, communication systems become secure even in the presence of an eavesdropper who has unlimited computational power, which is an explicit benefit of exploiting the laws of physics.
Hence numerous quantum cryptographic or quantum communication protocols have been proposed, which can be classified into four main branches: quantum key distribution (QKD) [38], quantum teleportation [40], quantum secret sharing [41], and quantum secure direct communication (QSDC) [42], [43], as shown in Fig. 1.Bennett et al. [40] introduced quantum teleportation in 1993, showing how to send an unknown quantum state to a remote receiver, with the assistance of classical communication and pre-shared entangled photons.Hillery et al. [41] proposed quantum secret sharing in 1999, which is a scheme using entangled quantum states for sharing a random bit among several parties so that no subset of them is able to reconstruct a shared ramdom bit -all of them have to work together [44].As a further development, in 2000, a QSDC protocol was proposed by Long and Liu [42], [43] for transmiting a predetermined information.QSDC is a beneficial secure communication technique, where secret information can be transmitted directly through the quantum channel without a pre-distributed cryptographic key.Fig. 2 portrays the different models of secure communications.Fig. 2 (a) highlights the secure communication structure commonly used at the time of writing.It relies on a pair of channels: the ciphertext channel and the key distribution channel.The transmitter of Alice first transforms a plaintext  into a ciphertext using a secret key  1 and an encryption algorithm  (,  1 ), and she sends the ciphertext to the receiver -namely to Bob -through the ciphertext channel.Bob uses the secret key  2 and the decryption algorithm  (,  2 ) to recover the ciphertext for accessing the plaintext  upon receipt [45].Depending on whether the keys used by the communicating parties in Fig. 2 (a) are the same, the classical secure communication systems can be divided into two broad categories, one being symmetric cryptosystems, typically with  1 =  2 , while the other being asymmetric cryptosystems for  1 ≠  2 .The ciphertext is communicated through a public channel (ciphertext channel), which is usually insecure.Hence the ciphertext can in principle be intercepted by an eavesdropper, Eve, without detection.The key is distributed through another classical channel, for example, using the asymmetric Rivest-Shamir-Adleman scheme [2], [3].During the key distribution, the key is also encrypted and the ciphertext representing the encrypted key can also be intercepted by Eve.Key management is at the heart of this secure communication infrastructure, because the cryptographic key must be generated, exchanged, stored, and finally disposed of in a secure manner.It is clear that the adversary, Eve, can readily steal the ciphertext representing the message during its transmission over the public channel, and the ciphertext conveying the key during the key exchange process without being detected by either of the legitimate communication parties.If the key were stolen, Eve would be able to decrypt all the communications between the legitimate users.

Late 1960s
At the time of writing, only the one-time-pad has been proven to be perfectly secure [46].The one-time-pad protocol applies the exclusive OR logic operation between the plaintext message and a pre-shared key to generate the ciphertext.The length of the random key string has to be at least as high as that of the plaintext, and should never be reused.Even though this long key represents a 100% transmission overhead, no other cryptographic protocols relying on shorter keys have been proven to be perfectly secure.Thus, for practical applications, the repeated use of the cryptographic key in a cryptographic system should be avoided, and the length of the key should be set sufficiently high -depending on the computational power available.
The model of an unconditionally secure end-to-end cryptosystem can be constructed by combining QKD and the classical one-time pad, which is shown in Fig. 2 (b).QKD allows two parties to agree on a secret key by exchanging qubits over a quantum channel [38], [47], [48].An authenticated public channel is also required in support of the associated sifting, parameter estimation, reconciliation, privacy amplification.More explicitly, at least one additional classical information bit is required for each qubit for key sifting in QKD.The malicious action of Eve would perturb the state of the qubits, hence the communicating parties can discover Eve through parameter estimation, for example estimating quantum bit error rate (QBER).Any potential errors imposed by imperfections of hardware and channel are mitigated by reconciliation.Furthermore, privacy amplification is used for ensuring that Eve has only negligible information about the final secret key which is achieved by compressing the key [49].Eve has almost no information about the secret key shared between two legitimate users via QKD.In the following process, the encryption, transmission and decryption of data are identical to the aforementioned classical secure communication systems.
It is observed from Fig. means of transmitting the actual messages directly over a quantum channel, rather than only managing the negotiation of secret keys, as in QKD.More explicitly, the plaintext messages are mapped to quantum bits at Alice's station before transmitting them to Bob.No additional classical information is required for decoding the data.Therefore, QSDC does not use cryptographic keys, encryption algorithms, and decryption algorithms.Hence it does not have ciphertext either.Nonetheless, a classical authenticated channel is also needed in QSDC, but only for parameter estimation of detecting eavesdroppers as well as for encoder and decoder, which includes the required service communication for forward error correction and secure coding based on the universal hashing families [50].The encoder is composed of secure coding encoder, error correction code encoder, and anti-loss encoder, while the decoder includes secure coding decoder, error correction code decoder, and anti-loss decoder [50].Note that the authentication seen both in Fig. 2 (b) and Fig. 2 (c) can be moved from the classical domain to the quantum domain, which has been an important research topic since its seminal source appeared [51].This will be discussed in Section IV-C.In general, the theoretically unbreakable classical cryptosystem developed by Shannon is based on the utilization of secret keys [46].However, conceiving efficient key management is a challenging task.QKD provides a way for a pair of communicating parties to rely on a common secret key for supporting unconditional security, but only the key establishment takes place in the quantum domain, while the messages are sent by a conventional technique over the classical domain.A common feature of both the classical cryptosystems and of QKD seen in Fig. 2 (a) and (b), is that both of them face a security problem in terms of potential key leakage to malicious insiders and outside hackers.QSDC offers an entirely new way of solving all privacy problems.These benefits accrue from QSDC, because the process of communication takes place in the quantum domain, where the actual messages are transmitted through the quantum channel between end users.Hence no information leakage is possible, as guaranteed by applying the laws of quantum mechanics.Without relying on key encryption, no resources are required at all for key management [52].

C. Article structure
This article is organized as seen in Fig. 3.As we have discussed in Section I, quantum communication guarantees cryptographic security against quantum computation attacks, even when quantum computing becomes the norm in the post-quantum era.QSDC, as one of the prominent branches of quantum communication supports the confidential transmission of information via quantum channels.In Section II, the development of QSDC is surveyed by presenting its milestones.In Section III, we will introduce the fundamental theory and experimental techniques of quantum communication.We will only rely on modest theoretical background for understanding QSDC, followed by some practical guidelines.In Section IV, the salient QSDC protocols are introduced step by step to present the basic principles of QSDC, highlighting how the secret messages can be directly transmitted over the quantum channel.We will consider both point-to-point scenarios and networking issues.Topics such as their cryptographic applications, security proof and recent experimental advances are also covered.The long-term evolution of QSDC, its research directions and challenges are discussed in Section V. Finally, we conclude in Section VI.

COMMUNICATION
Again, QSDC was originally proposed by Long and Liu in 2000 [42], [43] and in these seminal contributions, it was pointed out that a key was produced by Alice before transmission took place [42] (versions 1 and 2).The terminology of 'quantum secure direct communication' was introduced for the first time in the two-step QSDC paper [53], where the definition of QSDC was also put forward.Since its conception in 2000, it has evolved into a fully-fledged communications protocol, as seen in Fig. 4 and Fig. 5.The early research of QSDC has been focused on the construction of physical schemes, and many QSDC protocols were invented for different information carriers, such as entangled states [43], [53], single photons [54], and Greenberger-Horne-Zeilinger (GHZ) states [55], [56].Recently significant breakthroughs have been made in the experimental demonstration of QSDC protocols [57], [58], which paved the way for their practical application [59], [60].
The lack of practical quantum memory has been a serious obstacle for the evolution of quantum communication, because the employment of relaying requires memory.Hence, practical QKD has remained confined to intra-city distances.For intercity applications of QKD, so-called trusted relays are used as temporary replacements for perfectly reliable quantum repeaters.Satellite relays provide a promising technique for global quantum key distribution [99], [100].But for QSDC even over short distances, quantum memory has remained indispensable, until quite recently, because the associated block-based transmission requires the quantum states to be stored before their security is assured.However, quite recently, a quantum-memory-free QSDC protocol [45], [80], [85] was designed, where the plaintext was encrypted using a pre-shared random key and then the ciphertext was used to distill secret keys for encrypting later message blocks.This development has finally made QSDC applicable for intercity distances [89].Furthermore, combining QSDC and post-quantum cryptography enables the construction of a secure repeater, which can establish a large-scale quantum communication network using existing technology [91].This approach avoids the security risks that arise from relying on trusted relays.
Many QKD protocols [38], [47], [48], [101] have a probabilistic nature, since an uncontrolled key sequence is established between two users, who randomly choose their so-called rectilinear or diagonal quantum basis to measure the qubits and the key is produced on the basis of random instances, where the pair of communicating users choose the same bases on a probabilistic basis.Here we emphasize that this probabilistic random sequence should NOT contain any meaningful information, just a sequence of random bits, not a key.It is essentially used for eavesdropper detection and if an eavesdopper is detected during its transmission, this random sequence can be discarded.There are several examples of deterministic quantum key distribution (DQKD) protocols.Briefly, DQKD is a protocol designed for handing over the above-mentioned deterministic key to the intended receiver and no basis reconciliation is required for decoding.To exemplify the DQKD protocols, Goldenberg and Vaidman proposed such a scheme in 1995 using a Mach-Zehnder interferometer [102], while Boström et al. [103] conceived a QKD protocol using EPR pairs, which has the fond connotation of the Ping-Pong protocol.The two-way QKD protocols of [104]- [106] are also prominent examples of DQKD.An essential feature of QKD is that the transmitted data may become fully or partially leaked to Eve.Fortunately, QKD is capable of detecting eavesdropping, but it cannot prevent the leakage of the transmitted data.This is why QKD has to resort to the transmission of meaningless random sequences for Eve-detection, and again, if eavesdropping is detected, the transmitted data will be discarded.It is apparent that the Ping-Pong protocol [103] cannot convey secret messages over the quantum channel due to its QKD nature.Although the original Ping-pong protocol of [103] is insecure even for QKD, later it has been rendered secure and has been generalized to numerous applications [107]- [111].As a result, a simple way of distinguishing a QSDC protocol from a DQKD protocol [112] is to check whether the transmitted data would or would not be leaked to Eve.For QSDC, the transmitted confidential information would not be leaked, because the eavesdropper would only be able to acquire completely random information, whereas the data transmitted in DQKD would be partially or completely leaked to Eve.It is worth pointing out that classical communications cannot detect eavesdropping.
There is a particular variant of DQKD, which is also mistakenly referred to as QSDC by some authors.To elaborate a little further, normally QKD is performed first to establish a shared key between Alice and Bob.The key is then used for encrypting the message into the related ciphertext, which is then transmitted through a classical channel [45].For DQKD, the procedure can be appropriately modified, where Alice can choose a random sequence as her key to encrypt her message into the ciphertext, which is then transmitted to Bob through a quantum channel.Then they assess the grade of security during the ciphertext transmission, for example by estimating the error rate.If they are sure that the security has not been compromised, implying that tempering by Eve has not affected the ciphertext, then Alice sends the key through a classical channel to Bob.This variant of DQKD is usually termed as deterministic secure quantum communication (DSQC) [112], [113].A simple rule to judge whether a protocol belongs to the family of DSQC is to ask the question: is there any need for classical communication for announcing the key rather than for basis choice reconciliation and eavesdropping detection in the protocol?If the answer is affirmative, we can conclude that it is indeed a DSQC protocol.In the DSQC protocol the receiver cannot directly read the secret message, unless it receives one bit of additional classical information from the transmitter for reading the secret message.In 2001, Beige et al. [114] proposed a DSQC protocol, which also needs additional classical communication.Their protocol became insecure, when an adversary acquired the secret information by applying a so-called quantum non-demolition measurement.As a further advance, DSQC has also been extended to entanglement distribution [115], [116] and to continuous variable based implementations [117].Pan et al. [50] identified the essential characteristics that a point-to-point QSDC protocol should possess.If a protocol fails to satisfy these criterias, but nevertheless transmits information directly through a quantum channel, it is referred to as a quasi-QSDC protocol in their work.
Long and Liu [42] proposed an effiicent QSDC protocol using the block transmission of Einstein-Podolsky-Rosen (EPR) pairs.Deng et al. [53] constructed the two-step QSDC protocol and the standard criterion of QSDC was discussed.
Deng and Long [54] presented the DL04 QSDC protocol with single photons.
Wang et al. [61] utilized the source of -dimension Bell states to realize a high-dimension two-step QSDC protocol.
Wang et al. [55] created the multi-step QSDC scheme by using GHZ-state dense coding.
Zhang et al. [62] proposed a scheme of multiparty quantum secret sharing based on the DL04 QSDC protocol [54].
Jin et al. [56] conceived the three-party simultaneous QSDC based on GHZ states.
Lee et al. [63] constructed a QSDC protocol with authentication relying on GHZ states.
Deng et al. [64] proposed a QSDC network enabling any one of the authorized users can communicate another one on the network.
Deng et al. [65] proposed the QSDC network with entanglement and decoy photons.
Pirandola et al. [67] constructed a continuous-variable quantum direct communication protocol.
Gao et al. [69] analyzed the security of a multi-party controlled QSDC protocol based on GHZ state.
Lu et al. [70] provided the unconditional security proof of the four-state quantum communication which is suit for DL04 protocol.
Sun et al. [71] proposed a QSDC protocol with cluster state.
Chang et al. [72] proposed a QSDC protocol with authentication using single photons.
Yadav et al. [73] proposed a two-step QSDC with the help of order rearrangement .Shapiro et al. [74], [75] proposed a QSDC protocol based on quantum illumination.Farouk et al. [76] designed a  -party QSDC protocol with authentication.
Hu et al. [57] designed and experimentally demonstrated a single-photon frequency coded DL04 QSDC protocol.
Lum et al. [77] showed that quantum data locking can be applied in QSDC.
Zhang et al. [58] employed the state-of-art atomic quantum memory and demonstrated the principles of the efficient QSDC and the two-step QSDC protocol for the first time.
Zhang et al. [59] realized long-distance QSDC using the efficient QSDC and the two-step QSDC protocols.Sun et al. [80] designed a QSDC protocol that does not require quantum mempery, overcoming a bottleneck obstacle of practical QSDC.
Qi et al. [60] implemented a practical QSDC system with the security analysis of the Wyner wiretap channel theory.2019 Shapiro et al. [81] proposed that the quantum low probability of perception protocol can be viewed as an example of QSDC.
Qi et al. [87] demonstrated a 15-user QSDC network based on entanglement distribution.

2021
Vázquez-Castro et al. [88] utilized a quantum version of on-off keying modulation to directly transmit confidential information over a quantum channel.

2022
Wu et al. [90] proved the security of QSDC considering the finite-size effect.
Long et al. [91] proposed a secure repeater network and experimental demonstrated it.
Liu et al. [92] reported a proof-of-principle QSDC experiment over a 5 km fiber channel.
Panda et al. [93] presented a QSDC protocol by utilizing quantum walks on orbital angular momentum (OAM) states.
Li et al. [95], [96] propounded a single-photon-memory MDI QSDC protocol and deduced its secrecy capacity.Sun et al. [97] relaxed the requirement for state preparation in MDI QSDC and determined the practical secrecy capacity of the protocol by integrating customized decoy-state methods.
Xu et al. [98] proposed a quantum blockchain scheme relying on QSDC.Thus based on the above paragraph, it should be born in mind that the above statements regarding QSDC are not applicable to the DSQC family, whose members are essentially of DQKD nature.The nature of some of the popular communication protocols is summarized at a glance in Table II.It is clear that only QSDC is capable of avoiding the leakage of transmitted data, when Eve intercepts the transmission.

III. ELEMENTS OF QUANTUM COMMUNICATION
A. Basics 1) Quantum states and qubits: In quantum mechanics, the state of a physical system is described by a state vector in the Hilbert space ℋ [118].The so-called 'ket' notation describing a vector in the complex number space C  representing a pure quantum state is mathematically denoted as where the symbol '|•⟩' is the Dirac notation [119] of a symbol  for a vector and we have   ∈ C  associated with The 'ket' notation simply represents the second half of the word 'Dirac-ket'.This unit vector can also be written in the form of the superposition |⟩ =  =1   |  ⟩, where   is the amplitude of the vector in an orthonormal basis |  ⟩.The conjugate transpose of |⟩ is ⟨|, which is called a bra vector, formulated as: The combined bra and ket notations ⟨|⟩, and |⟩⟨| represent the inner product and the outer product of the vectors, respectively.But in some cases a quantum system cannot be described by a single vector, it is rather described by a probability distribution, which may be in the state |  ⟩ with probability   .Such a quantum system is said to be in a mixed state, which corresponds to a probabilistic mixture of pure quantum states.A pure state is a particular case of a mixed state associated with   = 1 and   = 0 ( ≠ ).A commonly adopted way of describing mixed states in quantum mechanics is to use the so-called density matrix, which is the weighted sum of pure states in the form of [120], [121] The basic element of quantum information processing is a qubit formulated in the two-dimensional Hilbert space C2 as [9], where The state of a qubit can be geometrically represented by a vector in a Bloch sphere, shown in Fig. 6, where  (0 ⩽  ⩽ ) and  (0 ⩽  < 2), correspond to the polar angle and azimuthal angle, respectively.A pure qubit state can be represented by a point on the surface of the Bloch sphere, while mixed states are the points inside the Bloch sphere.The basis state |0⟩ is located at the North pole, while |1⟩ at the South pole.Observe from Fig. 6 that in addition to the {|0⟩, |1⟩} basis, two other important states are, which are the eigenstates of   , and the states which are the eigenstates of   .
2) Quantum entanglement: The concept of entanglement originates from the influential argument of Einstein et al. [122] intended to question the completeness of quantum mechanics.Here, let us define it by using the modern terminology of qubits.Let us consider a composite Hilbert space ℋ  ⊗ ℋ  .Then there is a state of the composite system, which cannot be written as a tensor product 2 of the states of the individual subsystems, Such a state is called an entangled state.For example, the most commonly used entangled states are the four Bell states, also termed as the EPR pairs or EPR states, We have no way of expressing the four Bell states as tensor products.By contrast, the state Now, the family of entangled states plays a key role both in the protocol design and in the security proof of quantum cryptography.Apart from the Bell states of Eq. ( 9), other members of the entangled state family include the GHZ states [123], [124] defined as: and the W-state [125] They have been widely used in quantum communication protocols.Loosely speaking, entangled states exhibit 'perfect' correlation, which is consistent with the nature of quantum communication, namely sending messages from the transmitter to the receiver is to correlate them [126].Anecdotally, Einstein referred to the phenomenon of entanglement as a 'spooky action at a distance', because flipping one of the entangled bits instantaneously flips its entangled pair, regardless of their physical distance.Having said that, the speed of light cannot be exceeded, because before this 'spooky action' can take place, some preparatory classical domain operations are required, which do obey the speed of light.
3) Unitary operation and measurement: A quantum system in the process of quantum communication usually undergoes unitary operations and measurement, which carry out information/data encoding and decoding, as well as the observation of the result, respectively.The terminologies of 'observation' and 'measurement' are used as synonyms and upon measurement a qubit could be converted into a classical bit.A unitary operation is represented by a complex-valued matrix  that satisfies the condition of  †  = , and transforms a state vector into another state vector, which is formulated as: It is also often written in terms of a sum-of-outer-products given by where    = ⟨  ||  ⟩ is the matrix element of  between the two basis states.
The most commonly used unitary operations of the quantum cryptographic protocols, which transform single-qubit states are as follows, They play quite different roles.Specifically,  0 is an identity transform that has no effect on the state, while  1 represents the phase flip of |0⟩ In entanglement-based quantum crytography, we can apply any of the operations  0 ,  1 ,  2 , or  3 to one of the particles of an EPR pair while keeping the other particle untouched, the original Bell state can be turned into another Bell state.The transformation between them is described in Table III.
Quantum measurements are described by a collection of measurement operators {  } that act on the quantum state, and the index  identifies one of the legitimate outcomes of the measurement.If the system to be measured is in state |⟩, then the probability of obtainng the result  is given by After measurement, the system collapses to the state The set of measurement operators {  } must satisfy the completness relationship of   †    = , which results from the fact that the sum of the probabilities  ( | |⟩) is equal to 1.
When we invoke a measurement in the process of quantum communication, we always use sets composed of orthonormal computational bases and the measurement operator is constructed from them.There is a very useful rule of thumb: the measurement operators can be produced in the form of according to a set of orthonormal states {|  ⟩} [118].This is a special kind of projective measurement, which is also commonly referred to as the von Neumann measurement [9].For example, when aiming for determining whether a qubit is in state |0⟩ or |1⟩, the corresponding measurement operators are { 0 = |0⟩⟨0|,  1 = |1⟩⟨1|}, respectively.According to Eq. ( 15), the result |0⟩ will appear with the probability of The positive-operator-valued measurement defined in [9] is another commonly used notion in quantum information processing, which represents a generalized measurement, because the operators are not necessarily orthogonal.It is described by a set of positive operators {  }, formulated as, which satisfy the completeness condition of    = .Therefore, we only care about the probability of getting the specific results , which is given by because we are unable to predict the post-measurement state of the system after carrying out the positive-operator-valued measurement.Fortunately, the post-measurement state is of limited interest in quantum information processing, since most applications are more concerned with the measurement outcomes and with their specific probabilities.
Let us briefly consider an example of using the positiveoperator-valued measurement as a means of distinguishing a pair of nonorthogonal states |0⟩ and |+⟩.We start by constructing a positive-operator-valued measurement containing three operators , and Then |0⟩ is easy to distinguish from |+⟩ with the aid of the measurement outcomes of ⟨0| 1 |0⟩ = ⟨+| 2 |+⟩ = 0 and ⟨+| 1 |+⟩ as well as ⟨0| 2 |0⟩ being nozero: upon measuring a state |⟩ with the aid of  1 and  2 , the result will be state |0⟩ if the results are ⟨| 1 |⟩ = 0 and ⟨| 2 |⟩ nonzero.By contrast, it will be state |+⟩, if the result of ⟨| 1 |⟩ is nonzero and ⟨| 2 |⟩ = 0. To elaborate, if we carry out the positive-operator-valued measurement and obtain a result for  1 , the outcome is state |+⟩, while it will be state |0⟩ if the result is obtained in  2 .Finally,  3 is needed due to the completeness condition, although the mesurement result of  3 is useless: both ⟨0| 3 |0⟩ and ⟨+| 3 |+⟩ are nozero, hence we cannot tell whether the state is |0⟩ or |+⟩ from the  3 positive-operator-valued measurement.Note that the physical laws tell us that nonorthogonal quantum states cannot be distinguished with perfect reliability, but it is possible to distinguish the states some fraction of the time [127]- [129].Therefore, both the legitimate users [130] and the attackers [131] can employ this tool for exacting information.By applying positive-operator-valued measurements to quantum cryptography, the security of QKD was analyzed in the face of certain eavedropping strategies related to positive-operatorvalued measurement [132]- [134], and the maximum attainable information rate was calculated in [135], [136].

4) No-cloning theorem:
In contrast to classical communication where information can in principle be copied perfectly without limits, an eavesdropper is incapable of copying quantum signals in quantum cryptography, thanks to the no-cloning theorem [137]- [139].
Let us assume that there exists a quantum cloning device capable of perfectly duplicating the arbitrary quantum states |⟩ and |⟩, where the cloning can be realized by a unitary operation where |0⟩ is the initial state of the cloning device.The inner product between the right-hand sides of Eq. ( 20) is while for the left-hand side we obtain where the relationships of  †    =  and ⟨0|0⟩=1 are exploited.Finally, we arrive at: which implies that a cloning device can only clone |⟩ that is orthogonal to |⟩.
As a conclusion, it is claimed in [137] that unknown quantum states cannot be cloned (copied) perfectly.This argument has also been extended to mixed states in [140].However approximate cloning, or probabilistic cloning is possible for an arbitrary state [141]- [146].Therefore, one cannot gain full information about an unknown quantum state without perturbing it.
5) Entanglement resources for information transmission: Superdense coding [147], quantum teleportation [40], [148], and entanglement swapping [149] are important quantumdomain operations that rely on EPR pairs.These quantum techniques can be employed for the design of quantum communication protocols as exemplified in [150]- [155].We will therefore focus our attention on the basic principles of these approaches for highlighting some of the pivotal protocols.Entanglement purification is another salient quantum communications technique conceived for mitigating the degradation of entanglement, thereby guaranteeing security.been shared by Alice and Bob, so both of them hold one of the particles representing the state | − ⟩.Table III suggests that all four Bell states may be gleaned from either one of them by applying only local operations to one of the particles of Bell states.Consequently, Alice is able to encode two bits of classical information onto a single qubit by applying the unitary operator  of Fig. 8 according to the following coding rules: She then sends her qubit to Bob through the quantum channel of Fig. 8 and Bob combines the two qubits of the EPR pair considered to perform Bell-state measurement (BSM).The pair of original classical bits of Fig. 8 are then reconstructed deterministically 3 , because the measurement result will unambiguously reveal the state.For quantum teleportation, the aim is to faithfully deliver an arbitrary qubit |⟩ 0 = |0⟩ + |1⟩ between two distant parties, as seen in Fig. 9.As in the superdense coding scenario of Fig. 8, an EPR pair must be shared by Alice and Bob in advance.Without loss of generality, we assume that the shared EPR state is So the resultant 3-qubit state here is initially |⟩ 0 | − ⟩  , which can be regrouped and written as If Alice performs a BSM on qubits 0 and  at her side, the measurement will project these two qubits onto one of the four Bell states of Table IV with an equal probability of 1/4.The measurement outcome is then sent to Bob over a classical channel, hence he will get to know the state of his qubit instantly.Depending on the relationship in Table IV, Bob selects the specific unitary operation that transforms the state of qubit  into the teleported state |⟩ 0 .Thus, the qubit containing the quantum information has been teleported from Alice to Bob.Observe the dual relationship between superdense coding and quantum teleportation by comparing Fig. 8 and Fig. 9.More formally, Werner's proof [157] shows that two parties can swap their equipment to convert quantum teleportation into superdense coding under certain conditions, and vice versa.
Entanglement swapping has the capability of entangling a pair of distant quantum syestems that have never been connected in the past [158].Figure 10 shows the process of entanglement swapping.Consider a pair of entangled states , which are generated simultaneously.We may then pick one photon from each of the 3 The four Bell states encoding 2 bits of classical information can be distinguished by nonlinear optics based BSM [156].two entangled states to make a BSM.As a result, we can immediately see in Fig. 10 that the measurement of particles 2 and 3 projects the original non-entangled particles 1 and 4 into an EPR state.This can be formally expressed as Note that the state of newly generated entangled pair is decided by the measurement result, so for example, | + ⟩ 23 yields | + ⟩ 14 .
The quality of entangled states decays exponentially upon encountering the unavoidable noise of a quantum channel.This result is absolutely against the original intention of distributing entanglement between a pair of distant nodes without contaminating them.Entanglement purification offers a way of mitigating this deleterious effect by extracting a small number of almost perfectly entangled pairs from many poor-quality entangled states with the aid of local operations and classical communications.Figure 11 shows the original entanglement purification scheme introduced by Bennett et al. [159].Let us assume having two imperfectly entangled pairs shared by Alice and Bob as seen in Fig. 11.One of them is the source pair, which has higher-quality entanglement than the target pair to be purified.Both Alice and Bob apply the Controlled-NOT gate 4 to the particles in their hand.Subsequently, they both measure the qubits of the target pair using the measurement of Z and compare their measurement outcome by relying on classical communication, as seen in Fig. 11.The source pair will be retained as is, because it has a higher degree of entanglement than the original target pair, if their Controlled-NOT outputs shared over the classical channel are the same.Otherwise, the source pair will be discarded.However, since the Controlled-Not gate is difficult to realize experimentally, Pan et al. came up with a simpler solution by harnessing a polarizing beam splitter [160], [161].The benefits of this solution were also demonstrated subsequently in [162].Some further improved schemes, such as the determinstic entanglement purification protocol were proposed in [163]- [165].

B. Experimental fundamentals
1) Light source and detector: In physical implementations, qubits have been realized with the aid of many different systems [166], but for quantum communications the most popular qubit carriers are photons.However, the unconditional security of single-photon based quantum communication requires a perfect source [167], which is difficult to produce.In the experimental implementation, the pragmatic solution is to use a weak coherent pulse as a near-perfect practical single-photon source.The state of a photon emitted by a laser is described by the coherent state |⟩, which is a superposition of Fock states |⟩ [168], wherein  = √    , √  represents the intensity associated with the average number of photons  per pulse and with the phase .The probability that a laser pulse contains  photons obeys the Poisson distribution of [168].In other words, the practical light source is in a mixture of states |⟩ with a probability of   (), rather than obeying the perfect desired single photon Fock state associated with | = 1⟩ (this should not be confused with one of the two states of a qubit).It is plausible that the main components of this state of the laser pulse are the zerophoton vacuum state | = 0⟩ and the single-photon state of | = 1⟩, when the intensity of the laser pulse is attenuated to be sufficiently low.Such a practical source has also been proved secure [169].However, the transmission distances attained remain limited, and the contributions of a fraction of the photons emitted by the laser pulses have to be deleted because they are insecure in the face of the photon number splitting attacks [170].To elaborate a little further, in the photon number splitting attack, Eve captures a photon from each pulse that contains several photons for further eavesdropping action.The attainable distance can be substantially increased by using the so-called decoy state technique [171]- [173], which improves the overall performance of QKD systems.After the modification, this technique is also applicable to QSDC, enabling resistance to photon number splitting attack and enhancing communication performance [86], [97], [174]- [177].Therefore, combining the weak coherent pulse based and decoy state based solution having the optimal average number of photons  constitutes a beneficial practical method for light sources.
At the time of writing, ideal single-photon sources are not yet available [178].Alternatively, deterministic single-photon sources and probabilistic single-photon sources are capable of dramatically reducing the relative frequency of vacuum states and multi-photons.Deterministic single-photon sources, as exemplified by quantum dots [179]- [181] and color centers as detailed in [182]- [184], usually result in a higher energy level first and then emit a single-photon.By contrast, probabilistic single-photon sources, which are also referred to as heralded single-photon sources [185], generate single photons by measuring one of the photons in an entangled photon pair, which then serves as reference for the generation of a single photon [186], [187].These two kinds of single-photon sources have the potential of realizing higher information bit rates or longer transmission distances than the weak coherent pulse source [97].
The entangled two-photon state is the fundamental resource of many entanglement-based quantum communications techniques.The efforts of generating entanglement originally relied on the so-called atomic system concept of [188], [189].As the developments continued, the physical process of spontaneous parametric down-conversion [190] and spontaneous four-wave mixing [190] have been frequently used as the entangled resources.Spontaneous parametric down-conversion is a process of nonlinear interaction, in which a high-frequency pump photon   is converted into a pair of lower-frequency photons  1 and  2 (termed as the signal and idler photons), where the pump light illuminates a nonlinear optical crystal characterized by its second-order nonlinear susceptibility  (2)  as discussed in [191]- [193], and shown in Fig. 12 (a).Various types of entanglement, such as OAM entanglement [194], time-energy entanglement [195], and polarization entanglement [196], can be generated with the aid of spontaneous parametric down-conversion, which constitute a popular choice for preparing entanglement, since they are relatively simple to construct and hence inexpensive.They have been used as light sources in quantum communications including QKD [197] over 140 kilometers, and even for 100+ kilometers for quantum teleportation [198], [199].However, the energy conservation constraints of spontaneous parametric downconversion formulated as ℏ  = ℏ 1 +ℏ 2 and the momentum conservation (also termed as phase-matching) expressed as ℏk  = ℏk 1 + ℏk 2 results in the phenomenon that the emitted down-converted photons generated by conventional bulk crystal sources have a cone-shaped spatial multi-mode structure surrounding the pump laser.Hence it is quite challenging to collect and guide the light into single-mode fibers for quantum information processing and transmission [200].To circumvent this problem, waveguide based spontaneous parametric downconversion schemes [201]- [203] have also been developed.The spontaneous four-wave mixing sources have also received much attention as another popular candidate for directly generating entangled photons in a single-mode waveguide [204]- [207].As shown in Fig. 12 (b), a pair of two pump photons is annihilated and a pair of correlated photons is created in the process of spontaneous four-wave mixing by a nonlinear optical medium, characterized by its 3rd-oder nonlinear susceptalibity  (3) in which both energy conservation 2ℏ  = ℏ 1 + ℏ 2 and momentum conservation 2ℏk  = ℏk 1 + ℏk 2 are observed.This process has some distinct advantages over spontaneous parametric down-conversion.Firstly, the resultant entangled pairs are generated in a single spatial mode, making their collection and delivery quite efficient.Hence they can be directly integrated with existing optical-fiber communication networks [204].Secondly, spontaneous four-wave mixing exhibits a high brightness facilitated by its long interaction duration and high transverse mode confinement as a benefit of its limited cross-section [206].However, spontaneous fourwave mixing requires higher pump power than spontaneous parametric down-conversion because its  (3) nonlinearity is weaker than  (2) .The Raman scattering noise inflicted by its strong pump field must be mitigated in the spontaneous four-wave mixing source, for example by cooling the fiber in liquid nitrogen [208].Thus the experimental difficulties increase accordingly.
The single-photon detector constitutes the link between the quantum domain and classical domain, which converts the quantum signals into electrical signals for information detection.At the time writting three popular detectors are used extensively in the experimental implementation of quantum communication: InGaAs avalanche photodiodes, Si avalanche photodiodes, and superconducting single-photon detectors.Six key parameters are routinely used for characterizing the performance of single-photon detectors, including their detection efficiency, dark count rate, dead time, spectral range, time jitter and the ability to distinguish the number of photons [209].In a certain spectral range, a perfect single-photon detector must have 100% detection efficiency, the ability to determine the number of impinging photons, while having all the remaining parameters mentioned above as 0. InGaAs avalanche photodiodes are typically used for detection at telecom wavelengths [210] (typically in 1550 nm and 1310 nm).However, they tend to have a relatively low detection efficiency of around 10%.Naturally, the designer has to strike tradeoffs amongst the key parameters of practical InGaAs avalanche photodiodes.For example, increasing the bias will increase the detection efficiency, but it will also exacerbate the dark count rate [211].Having said that, InGaAs avalanche photodiodes exceeding 50% detection efficiency are becoming available, which are capable of striking much improved performance tradeoffs [212], [213].
By contrast, Si avalanche photodiodes attain a detection efficiency of more than 60% at a low dark count rate at specific wavelengths of the visible and near-infrared domain [214], which are eminently suitable for free-space quantum communication [215], [216].Finally, superconducting single-photon detectors also perform well in the visible to mid-infrared wavelength domain.Specifically, they exhibit a high detection efficiency (>90%) and very low dark count rate (<1 cps), low timing jitter (<100 ps) and short reset time (<100 ns) [217].Unpon considering each of the above parameters individually an even better performance may be attained [218]- [220].Hence they have become one of the most sought after devices for high-performance QSDC [89].However, superconducting single-photon detector may be deemed excessively costly for conventional applications, because they must be operated at an extremely low temperature of a few Kelvin.
The quantum channel is a link between Alice and Bob provided for the transmission of quantum information.Basically, there are two popular choices of transmission channels, namely optical fibers and free-space optical channels 5 .Optical fiber links have a very low channel loss of about 0.2 dB/km for photons at the 1550 nm wavelength and even 0.16 dB/km [221], [222], and approximately at 0.3 dB/km for photons at 1310 nm wavelength.QKD transmission has been demonstrated over 421 km of optical fiber [222], and it is not confined to this distance, when using new mechanisms [223].In the absence of perfectly secure quantum repeaters, several hundreds of kilometers are feasible for single photon transmission, which is predominantly limited by the inherent path loss and by the environmental factors of temperature as well as stress.
Free-space optical (FSO) transmission is known as a very promising design alternative for quantum communications, which has a wide transmission window in the vicinity of ∼800 nm, which conveniently corresponds to the detection range of efficient yet inexpensive Si-avalanche photodiode detectors [50].Moreover, there is only negligible dispersion, but the atmospheric turbulence effects may become hostile, as detailed in [224].Further challenges of free-space-based quantum communication are due to the scattered sunlight.
To overcome the background noise in FSO scenarios, substantial efforts have been made to use filtering techniques and optimized single-photon detection with remarkable results [225], [226].The total attenuation  of the free-space channel can be evaluated by the contributions of two main effects: diffraction and atmospheric attenuations, including absorption, scattering, and atmospheric turbulence, which may be formulated as  atm = abs  scatt  turb .As shown in Table V, several theoretical models have been established for calculating the channel loss that results from the above-mentioned effects.Diffraction, also known as geometric loss, will result in beam divergence, hence some fraction of the beam energy cannot be collected by the receiver.A plausible, but costly method of tackling this problem is to increase the telescope aperture [227], which is more realistic for the ground-station than for a compact solar-charged satellite.Nguyen et al. [228] applied network coding in a free-space QKD system and studied the diffraction effects.In the process of evaluating the QBER, Shapiro theoretically quantified the diffraction loss [229].Absorption and scattering are also inevitable phenomena in the process of FSO propagation through the atmosphere, where they interact with various gasses and particles.Surprisingly, their influence on the channel attenuation tends to remain modest, apart from adverse weather conditions.The atmospheric refractive index tends to fluctuate randomly due to the temperature, pressure, and humidity variations in the air, which is the source of atmospheric turbulence.As a result, typically the probability distribution of transmittance is adopted for characterizing the beam wandering, broadening, and deformation after the laser beam undergoes atmospheric turbulence [230]- [233].Then the mean attenuation is given by where  = √   , is the intensity transmittance,   is the transmissivity, while the maximum value of  is  0 , and () is the probability distribution of transmittance.
3) Quantum random number generator: Truely random numbers are considered as an essential part of maintaining the security of quantum communication [238].As for QSDC systems, the state preparation, state sampling strategies of some protocols, and classical coding [50] rely on a random number generator producing samples at a high rate and 'highquality' randomness.Normally, the procedure of designing a quantum random number generator is divided into four steps, as seen in Table VI.First the specific source of quantum randomness will be selected, from which we can extract the raw random number sequence using measurement.The resultant raw random number sequence then undergoes postprocessing, a step of distillation, to remove the classical sources of contamination (typically appears as bias and redundancy in the sequence) that originates from the imperfection of the devices.Finally, the quality of the random number sequence will be tested either with the aid of statistical analysis or physical certification.The source of quantum randomness falls into two basic categories: discrete and continuous, which depends on the specific source of randomness.The discrete source of quantum randomness has a simple model, but its output rate is usually low.By contrast, the continuous source has a high output rate, but the inevitable classical contamination has to be carefully mitigated.
4) Bell-state measurement: This is one of the key ingredients in quantum information processing, as surveyed in Section III-A5.Entanglement generation was detailed in Section III-B1.Again, the BSM allows us to distinguish the four Bell states of Eq. ( 9) when we want to exploit entangled resources.If we are restricted to using only linear optical devices, such as beam splitters, polarization beam splitters and single-photon detectors, the BSM will be unable to distinguish each of the four Bell-states with 100% certainty, as shown in [261].More explicitly, in this case, only two of the four Bell states | ± ⟩ can be reliably discriminated [261].In other words, the success rate of BSM using linear optics is limited to 50%.Although the four Bell states cannot be distinguished unambiguously by using linear optical devices, these are easier to implement than a complete BSM relying on nonlinear optical components [156].Hence, some QSDC protocols [45], [78] tend to only choose the pair Bell state | ± ⟩  of Eq. ( 9) to transmit information for the sake of simplifing the measurement system.Let us rewrite the Bell states | ± ⟩  of Eq. ( 9) in the form of polarization-entangled photonic states, namely, This BSM, which purely relies on linear optical components for discriminating these two polarization-entangled photonic states is shown in Fig. 13 (a).These two devices allow us to identify the incoming Bell state by the so-called click patterns of the single-photon detectors [262]- [264], as shown

Type of channel loss References Contributions
Diffraction [229] The bounds of the sift and error probabilities of a freespace QKD was deduced from the extended Huygens-Fresnel principle by considering the diffraction effects.[234] The additional attenuation caused by diffraction was taken into consideration in the analysis of key-rate performance in earthsatellite QKD.
Absorption and scattering [235], [224] The propagation loss of adverse weathers conditions was quantified.[236] A quantum theory of nonclassical light propagation under different weather conditions, including rain or haze, was developed, which agrees well with the data collected from experiments.Atmospheric turbulence [237] Introducing three models to calculate the probability distribution of transmittance when facing the different propagation distances and optical turbulence strengths.Attenuated coherent light [245], [246] Quantum tunneling effect [247], [248] Device-independent selftesting [249], [250] Statistical analysis ENT, Diehard, National Institute of Standards and Technology statistical test suite [251], [252] Continuous Laser phase fluctuations [253], [254], Vacuum fluctuation [255] Shot noise [256], [257] Super-luminescent diode [258] Detection varies with dfferent quantum randomness source Randomness extractors [259] Physical certification Bell's theorem [260] in Fig. 13 (b) and (c A complete BSM is possible by using hyper-entanglement with only linear elements.Hyper-entanglement is a state that is entangled in more than one degrees of freedom and the extra degrees of freedom allows for secondary interferometry, so that the remaining two Bell states can be distinguished [265]- [267].If nonlinear elements are added, all four Bell states can be discriminated with a success probability of 100% [156].Additional auxiliary degrees of freedom in hyper-entanglement can also be distinguished by the nonlinearity devices of [268].

5) Photonic modulation technologies:
In QSDC, the information can be conveyed by different fundamental resources, as shown in Fig. 14, namely polarization [58], [59], phase [60], [80], [85], [86], [89], time-bin [89], operation frequency [57], orbital angular momentum (OAM) [269], quadrature components [67], [270], [271], coherent optical filed [88], and spatial mode [272].Some of these have shown promising potential QSDC.In the following, we will briefly highlight these in the context of QSDC.Some new modulation techniques of QKD will also be mentioned, in order to pave the way for their QSDC counterparts in the future.We mainly focus our attention on the field of the discrete variables, while the quadrature components of light based solutions belong to the family of continuous variables [224], [273], which will be touched upon in less detail.The polarization of a single-photon may be decribed by its state vector [274], [275]: the state of |1⟩ stands for the vertically polarized photon | ↑⟩ = |⟩ also seen in the Bloch sphere of Fig. 6.Analogously, we have Furthermore, for entangled states, we have . These states represent the information carrier of the classical bits in many quantum communications protocols.They also constitute a natural choice for experimental implementations [58], [59], because they may be readily generated by the polarization based modulation of a laser source [276] or polarizing multiple lasers [216], [277] 6 .Based on the characteristics of the quantum channels described in Section III-B2, we know that the polarization of photons is more suitable for FSO channels than for fiber, because the fiber channel tends to perturb the polarization of photons [278].Furthermore, photon polarization based FSO transmission designed for satellites requires some reference frames for the accurate alignment of measurement bases [279], unless a specifically designed reference-frame-independent protocol is used [280].At the measurement stage, the receiver can separate the orthogonal states and forward them to the single-photon detectors for determining, whether they are constituted by |⟩ or |⟩.The diagonally polarized states can also be readily identified in a similar way.
Phase encoding maps information onto the relative phase difference between two consecutive pulses.Typically, after modulation by an unbalanced Mach-Zehnder interferometer, the form of the weak coherent state becomes [281], [282] √︂  2 where  is the average photon numbers,  is the initial random phase,  is the modulated phase encoding information bits.Furthermore, the subscripts  and  denote the short arm and long arm of an unbalanced Mach-Zehnder interferometer.The discrete phases of  ∈ {0,  2 , , 3  2 } which are prepared by Alice as the initial states and then Bob randomly applies the phase shifts of either 0 or  2 for performing demodulate measurement [283], [284] in BB84 QKD.This scheme may also be readily adapted for QSDC as detailed in [60], [86].
where the subscripts  and  denote the temporal modes early and late, respectively.It can be prepared by emitting a pulse which has to pass through an unbalanced interferometer.Thus the computational basis |⟩ indicates that the photon takes a short path and arrive early, while |⟩ represents the long arm, hence its photon arrives late.After preparation, if this timebin based state goes through a nonlinear crystal, eventually a time-bin entanglement can be created [285].The phase and time-bin based qubits are more robust than the polarization based qubits, when performing quantum communication via fiber [89].Hence the former are is popular in quantum communication.
Operation frequency based encoding applies the same unitary operation to a single-photon block periodically to encode secret messages, and the receiver of this single-photon block is capable of decoding the secret messages through the discrete time Fourier transform [57].
Orbital angular momentum [286], [287] is another quantity that may be conveniently carried by a laser beam upon exploiting the so-called azimuthal angular dependence of  −  , where  is the azimuthal index assuming an unbounded integer and  is the azimuthal angle in the beam's crosssection [288], [289].For a given azimuthal index , the orbital angular momentum has the discrete value of  = ℏ, indicating that the beam carries ℏ amount of orbital angular momentum per photon.It has been demonstrated that orbital angular momentum states can be used for conveying information at a capacity beyond one bit per photon both for QSDC [269], [290] and DQKD [291].Additionally, a high-dimensional system 'qudit' (a unit of information in a  dimension space) typically has a superior security level in quantum cryptography protocols [292], [293].
In 2021, a protocol called quantum keyless private communication was proposed in [88], which uses the quantum-domain version of on-off keying modulation to transmit information, where the coherent state |⟩ represents information bit 1 and the vacuum state |0⟩ represents information bit 0. Singlephoton detectors are used for detection.We refer to this as modulation based on coherent optical fields.
The spatial-mode is a frequently used degree of freedom exploited for information transfer, when combined with other degrees of freedom, it enables the design of high-capacity QSDC protocols [272], [300], [301].
The family of hybrid methods combining different modulation techniques which complement each other is also often used for the sake of combining their different benefits.For instance, combined polarization-orbital angular momentum states are rotationally invariant and exhibit high robustness against spatial perturbations.Hence they are eminently suitable for mitigating the frame-misalignment problems encountered in free-space quantum communication [227], [302].Modulation techniques relying on high-dimensional states that can be used for high-rate and high-security quantum communication are also available at the time of writing, but they are limited to short distances [293], [303].
By contrast, there are many other mature modulation methods in QKD, but their feasibility in QSDC still needs to be studied.Examples of practical phase-encoding related QKD systems include the differential phase shift aided schemes of [304].In differential phase shift aided QKD, the information bits are mapped to the phase difference between the adjacent pulses.It has been shown that it is feasible to realize a high-speed clock frequence of 10 GHz using the simple experimental setup of [305], which achieves a 12.1 bit/s secure key rate over 200 km of optical fibre.In coherent one-way QKD, the bit string is carried by the coherent one-way pulse of |0⟩|⟩ for bit 0 and by |⟩|0⟩ for bit 1.Then the receiver can detect them with the aid of time-of-arrival measurements.In 2015, the coherent one way technique attained a long-distance record of 307 km for QKD [306].Both the differential phase shift and the coherent one-way techniques use weak coherent pulses as the light source, but they are immune to photon number splitting attacks [307], [308].
A range of early contributions relied on single-sideband modulation, where the informtion bits are mapped to one of the two sidebands surrounding a central frequency [309]- [312].Bloch et al. [313] conceived a frequency-encoding QKD scheme, while its improved version was proposed by Zhang et al. [314] a year later.In frequency-modulated QKD, Alice can generate four states by using the modulator, which can be formulated as follows, where |⟩  represents the number of photons in mode .Those four states constitute a pair of bases given by {|+; 1⟩, |−; 1⟩} and {|+; 2⟩, |−; 2⟩}, which is equivalent to the rectilinear and diagonal orthogonal basis sets of the BB84 QKD protocol [38] and thus this modulation scheme may be readily used for implementing QKD.No unbalanced interferometers are required for frequency encoding, which has the advantage of avoiding stabilization.The status of these photonic modulation techniques in the context of QSDC is summarized in Table .VII.

A. Point-to-point communication protocols
A point-to-point QSDC protocol is defined as a sequence of steps with associated quantum operations and rules that control the communications with the goal of securing communication between two users.In this section, we will highlight some of the typical QSDC protocols step by step and show how these protocols facilitate for two parties to transmit confidential messages directly through the quantum channel [43], [53], [54], [61], [78], [117], rather than simply exchanging secret keys.We will introduce the QSDC protocol and DSQC protocol, which enable secure communication over a quantum channel.The processes of these protocols are illustrated in Fig. 15.
1) High-capacity QSDC protocol [42], [43]: Alice and Bob have the two-bit classical messages 00, 01, 10, 11 corresponding to | + ⟩  , | − ⟩  , | + ⟩  , | − ⟩  , respectively.An ordered set of  EPR pairs is denoted by (1) ,   (2)]}, where   (1) is the EPR partner particle of   (2) and vice versa.Then an ordered EPR partner particle sequence  [ chooses a sufficiently large fraction of the samples representing the check bits from the EPR parter sequence stored in her memory and performs measurement on these samples by randomly using either the Z-basis or the X-basis.Naturally, she will get the result of either 0 or 1.Again, the rest of the EPR parter sequence is stored by Alice as seen in Fig. 16.She then informs Bob through an authenticated classical channel -which may of course be mapped to another wavelength in the same wavelength division multiplex aided fiber linkof the positions of the specific samples measured by her.Based on the information received from Alice, Bob measures the corresponding EPR sample particles in his hand.Then Alice and Bob publicly compare the results of their measurement to detect eavesdropping.If their results are the 'same' [42], [43], they conclude that there is no eavesdropping.If there is no eavesdropping, they proceed to the next step.Otherwise, they terminate the communication.This is the first eavesdropping detection opportunity during the transmission of   (2).In Fig. 16, the pair of dashed hollow circles represent the checking qubits.• Step 4, second transmission, measurement, and second eavesdropping detection.Alice sends the remaining EPR partner particle sequence ] to Bob, which does not include the particles that have been choosen for detecting a potential eavesdropper.For instance,  3 (1) in Fig. 16 has been measured by Alice and thus was not transmitted.Bob performs the BSM on every EPR pair [  (1) ,   (2)] in order to decode the confidential message and records the measurement results after receiving the rest of the sequence from Alice.The remaining check bits are announced by Alice, whose BSM results are selected to determine whether the QSDC process is successful.As shown in Fig. 16, the EPR pair [ 7 (1) ,  7 (2)] represents the second set of check qubits.If the error rate is deemed to be below a certain threshold, the remaining results of the BSM are deemed to represent the transmitted confidential messages.The second eavesdropping detection opportunity is included here for estimating the reliability of the communication.

Alice
Bob Alice Bob Alice Bob Alice Bob

Pi(1)
Step 1 Step 2 Step 3 Step 4 Pi( 2) Pi( 1) Pi( 2) Pi( 1) Pi( 2) Pi( 1) Pi( 2) To elaborate a little further, there are two eavesdropping detections, which allows the QSDC protocol to guard against eavesdropping.On the one hand, an eavesdropper cannot steal the confidential messages without being detected, when she adopts the intercept-and-resend attack strategy.Eve has no access to both parts of the EPR pairs at the same time, since the ordered  EPR pair sequence is sent from Alice to Bob in two staggered intervals.In order to obtain the other EPR partner particle sequence Eve first has to intercept the EPR partner particle sequence ] and then a fake particle sequence ] of her has to be sent to Bob.However, this attack can be easily detected by the above first eavesdropping detection in Step 4, because Alice randomly chooses some EPR partner particles in her hand to perform measurements and asks Bob to do the same.Alice and Bob will discover that half of their measurement results are conflicting because there is no quantum correlation between   (1) and  *  (2).As a further measure, the malicious nature of direct measurement by Eve may be readily spotted by the second eavesdropping detection.If Eve applies direct measurement to the EPR partner particle sequence and resends it, a high error rate will be experienced in Step 4 for the reason that the Bell states will collapse.This is the basic principle of QSDC which has the beneficial feature of high capacity, since the four legitimate states of the EPR pair can carry two classical bits of information.This represents a higher capacity than that of other protocols that make use of EPR pairs as their information carrier [47], [48], [126].Bob can decode the information directly without the exchange of classical bits.The protocols of [42], [43] use block transmission of quantum states to prevent the leakage of confidential messages and detect eavesdropping via random sampling tests.The idea that quantum mechanics could be beneficially exploited for direct communication over quantum channels has evolved substantially further after its conception [42], [43], which was originally proposed for deterministic key distribution.As a next evolutionary step, let us now consider the following two-step QSDC protocol.

Alice
Bob Alice Bob Alice Bob Alice Bob

Pi(M)
Step 1 Step 2 Step 3 Step 4 The subscript  represents the index of the EPR pair in the sequence, while C and M represent the pair of particles in the EPR pair.Alice then divides the ordered sequence of  EPR pairs into two EPR partner particle sequences.One of them is which is called the checking sequence or C sequence for short.The other is the remaining EPR partner particle sequece which is termed as the message-coding sequence or M sequence, as seen in Fig. 17  partner particles in the M sequence.She will get the complete opposite results compared to Bob, provided that no eavesdropper contaminates the quantum channel: Alice gets 0 (1), Bob gets 1 (0).If the error rate is below the tolerance threshold, Alice and Bob conclude that there is no eavesdropper and proceed to next step.By contrast, in the presence of eavesdropping they curtail their communication.• Step 3, information encoding.As seen in Fig. 17, Alice performs one of the four unitary operations ( 0 ,  1 ,  2 and  3 ) on each of the particles in the M sequence to encode her confidential messages.In the process of encoding, Alice has to apply an 'encoding-trick' to the M sequence.Explicitly, she randomly chooses some EPR partner particles in the M sequence as the samples to perform one of the four unitary operations, but no valuable payload information is mapped to them.Only Alice knows the position of these particles and she keeps it secret until the M sequence is transmitted to Bob.The number of these particles must be sufficiently high for estimating the error rate, and all the remaining particles are used for encoding confidential payload messages.• Step 4, second transmission, measurement, and second eavesdropping detection.Once Bob receives the M sequence, Alice tells him the position of the samples and the specific unitary operations applied to them.Bob performs the BSM on each and every EPR pair [  (C) ,   (M)] to decode the confidential payload messages.By checking the measurement results, Bob will then get an estimate of the error rate within the current M sequence transmission.
In fact, Eve is capable of perturbing the qubits, but cannot steal the confidential payload messages because she can only get one of the partner particles from an EPR pair in the second transmission.If the error rate of the Evechecking pairs is reasonably low, Alice and Bob can then trust the process, and may proceed to correct the errors in the confidential payload messages using a classicaldomain error correction method.Otherwise, they have to abandon this particular transmission session and go back to Step 1 of Fig. 17.
Let us now continue our journey through QSDC history by considering the DL04 protocol.
3) DL04 QSDC protocol: As Fig. 18 shows, single photons are used as carriers of confidential messages in the DL04 protocol, which relies on the following two steps [54].
• Step 1, the secure postal pigeon sending stage.As seen in Fig. and This operation offers the option of deterministically detecting confidential messages for Bob.To guarantee the security of the second transmission, Alice has to randomly choose some photons in the A-batch as Evechecking samples.We refer to them as the C 2 -batch and Alice maps random bits to them.These instances are marked in gray in Table VIII.She publicly announces the positions of these photons and of the coded random bits after Bob receiving the returned photons.Armed with the knowledge of his preparation bases and original quantum states, Bob directly decodes the confidential payload messages and random bits by using the same preparation bases to measure the returned photons.Then the error rate is estimated to assess if there has been any eavesdropping attack from Eve.
By now the confidential payload messages have been transmitted directly over the quantum channel.In addition to the capability of detecting the presence of an eavesdropper, the communicating parties must ensure that the secret messages are unlikely to be leaked to an eavesdropper before she is detected.Therefore, eavesdropping detection is necessary before mapping the secret messages to the single photons.Although the eavesdropper can intercept the quantum states carrying the confidential messages in the second transmission, she can only infer random results by measuring them, since she is unaware of the original quantum state.Alice encodes the confidential message in Step 2 just like in the onetime pad encryption.The quantum batch C 2 is then inserted  randomly into the secret message encoding sequence in this QSDC protocol, which encrypts the transmitted messages to ciphertext.A QSDC protocol relying on single photons was presented in [272], where every qubit can carry 2 bits of information, as the transmitter can map messages both to the polarization states and to the spatial-mode states of single photons completely independently.
4) High-dimensional two-step QSDC protocol: Consider a quantum system relying on a -dimensional Hilbert space [315], where a set of maximally -dimensional Bell states can be defined as follows where we have , ,  = 0, 1 Now, let us describe the detailed steps of the high-dimensional two-step QSDC protocol of [61] with the aid of Fig. 19.[316], the high-dimensional two-step QSDC provides better security than that obtainable with the aid of two-dimensional Bell states [53].Furthermore, the protocol has the advantage of high capacity [317], where a particle can carry log 2  2 bits of classical information.
5) Measurement-device-independent QSDC protocol: In theory, the quantum cryptographic protocols are unconditionally secure as guaranteed by the laws of quantum physics.However, the practical devices suffer from inevitable imperfec-tions that can be exploited by the eavesdropper to infer some confidential information, especially when using single-photon detectors.For example, Huang et al. [318] showed that QSDC systems may be compromised by detector blinding attacks [319].As a remedy, measurement-device-independent (MDI) protocols were proposed for protecting practical quantum cryptographic systems against the detector side channel attacks [78], [79].In the MDI protocol, the measurement-device is under the control of an untrusted party called Charlie who performs a BSM.Note that even if an adversary controls the measurement-device, he would not gain any useful information about the confidential message.Hence MDI protocols can remove all security loopholes from the measurement unit.More significantly, the realization of MDI protocols is entirely feasible at the time of writing.Recently, Gao et al. [320] proposed a long-distance MDI QSDC protocol by relying on ancillary entangled sources, which were located in the middle of the link by adding an extra relay node.
The measurement-device-independent QSDC protocol is illustrated in Fig. 20 • Step 1, state preparation.Alice prepares a queue of  +  0 EPR pairs, all of which are in the state | − 12 ⟩.Then the EPR pair sequence is separated into two parts: S Ah and S At , each of which includes one of the particles in the EPR pair.She also generates a sequence of  1 single photons, each randomly representing one of the four states {|0⟩, |1⟩, |+⟩, |−⟩}.These single photons are then randomly inserted into the EPR partner particle sequence S At .Therefore an ordered qubit sequence   is prepared by Alice, as seen in Fig. 20 Alice announces publicly the index and states of the  1 single photons.Bob also publishes the state of the corresponding single photon in the sequence   .They then compare the BSM results, where they employ the same bases.The method of eavesdropping detection is identical to that in the MDI QKD [321].A BSM will project the incoming two photons that were prepared by the same two bases into one of the two Bell states, formulated as, Charlie has a 50% probability to obtain the other two Bell-states in the face of eavesdropping attacks, so the error rate is increased.Nonethless, if the error rate remains below the maximum tolerable level, they proceed to the next step.Otherwise, they decide to abort the communication session.• Step 4, confidential message encoding.As her next action, Alice applies one of two unitary operators {,   } to the particles in her hand where the unitary operation   =  represents 0 and the operation   =   corresponds to 1.To provide an integrity check for the confidential message,  0 EPR pair partner particles are randomly positioned to encode random bits.Then Bob publishes his preparation bases of the remaining single photons.• Step 5, qubit transmission and measurement.Alice sends the qubits to Charlie after encoding.Charlie measures the qubits by using the bases that Bob has published in Step 4 and announces the measurement results.
• Step 6, decoding and integrity check.Bob decodes Alice's bits by combining his initial states with the measurement results of Step 2 and Step 5. Alice discloses the index of the  0 EPR pair partner particles selected as well as the random bits mapped to them.If no perturbation is imposed by Eve and the direct communication is deemed to be secure, the error rate will be below the maximum tolerable threshold.Then Bob obtains the confidential payload message bits.
The MDI QSDC protocol has the same security level as the MDI QKD protocol in Step 3 and the teleportation process of Bob's state is also secure after the eavesdropping detection.= /2 for single photons.Hence Eve cannot differentiate between the EPR pair particles and single photons.Secondly, Bob knows the initial state |⟩ 3 , but it is sealed to others, so only he can infer the unitary encoding operation   of Alice, even though both Alice and Charlie know the result of   |⟩ 3 .

6) Continuous variable DSQC protocol:
The DSQC protocol has also been extended to the continuous-variable (CV) domain related to infinite-dimensional Hilbert spaces [67], [117], [224], [270], [273].The continuous variable DSQC scheme uses the squeezing phase of a two-mode squeezed state, as detailed in [117].The characteristics of the twomode squeezed state are eminently suitable for quantum direct communication and the associated communication protocol is shown in Fig. 21.The whole process can be divided into the following 6 steps: • Step 1, state preparation and transmission.Alice generates and distributes the two-mode squeezed state, keeping one of the modes at her side and sending the other mode to Bob over a quantum channel as indicated by Fig. 21.A coherent-state local oscillator LO 2 is also sent to Bob by Alice together with the transmitted mode by using a polarizing beam splitter for combining them.• Step 2, encoding.Alice mapps the confidential messages to her part of the two-mode squeezed state by imposing a phase shift on the LO 1 and then carries out homodyne detection.She also inserts check bits at random time slots throughout the message encoding process, so that the communicating parties can detect eavesdropping.• Step 3, measurement.Bob splits the incoming beam in half at his polarizing beam splitter, which are then distributed to the separate parties, namely to LO 2 and to the squeezed mode.Then, they are combined in a balanced beam splitter to perform homodyne detection and the phase of LO 2 is kept constant during the measurement.

• Step 4, repeated transmission. Alice and Bob repeat
Step 1 to Step 3 until the secret messages have been completely encoded.• Step 5, eavesdropping detection.Alice informs Bob of the time slot of her Eve-check bits and of the corresponding measurement results.Alice and Bob publicly compare the Eve-check bits to evaluate the error rate and confirm whether an eavesdropper is present.If the channel's integrity has been verified, they continue to the next step.Otherwise, they restart their communication session over a different quantum channel.• Step 6, message decoding.Alice sends the measurement results of the confidential messages to Bob.Once the two local measurement results are combined by Bob, he will have a signal whose variance fluctuates between two different levels, which represent the confidential information of Alice.Hence, Bob can retrieve the entire confidential message.This protocol is immune to the intercept and resends attacks.Eve may intercept the mode sent to Bob.If this occurs, then she can extract the information of squeezing degree and she can then resend a new mode at the same squeezing degree to Bob.This fraudulent action can be easily detected from the new mode sent by Eve, because it is not entangled with the mode retained by Alice.More explicitly, this will result in increased noise and no pair of distinct variance in the combined signal of Bob.As for the partial interception strategy, Eve can acquire part of the beam and combine it with the published measurement results of Alice to steal information.However, this will result in a reduction of the squeezing degree, making it easy to detect.
7) ZXFZ DSQC protocol: In 2003, a specific encryption scheme was invented [322], which was subsequently adopted also to design a DSQC protocol by Zhu, Xia, Fan, and Zhang (ZXFZ) [116], [323].Below we summarize the ZXFZ DSQC protocol, which is based on a secret transmission order of EPR pairs [116].To elaborate, Alice and Bob exploit that the unitary operations of A sufficiently large subset is selected for the Eve-checking set (C set) and the rest of the EPR pairs serve as the confidential message set (M set).The basic elements of the C set or M set are EPR pairs, rather than being a single photon of an EPR pair.Alice uses the above four unitary operations for encoding the confidential message onto the M set, while random bits are mapped to the C set.Taking the C set as an example, Alice's random bits are (0100101101• • • ) and she chooses the first 50 EPR pairs as the C set.So she maps 01 to  1 (1, 1 ′ ), 00 to  2 (1, 1 ′ ), 10 to  3 (3, 3 ′ ),• • • , by applying the four unitary operations to one of the particles in each EPR pair.
• Step 2, transmission.Given a secret transmit order of particles, Alice sends these particles to Bob one by one.A partner particle in the EPR pair is taken as the minimal transmitted unit.For instance, Alice sends the particles in the order of  1 (2),  2 (1),  3 (51),  4 (5 ′ ),  5 (2 ′ ),  6 (60),  7 (10), This means that Alice sends the original particle  at the  − th output index.• Step 3, announcing correlation.Bob confirms to Alice that he has recieved all the 2 particles.Alice then announces the exact quantum correlation of two particles that pertain to the C set over a public channel as exemplified by The security of this protocol is ensured by the secret order of the particles.Even if Eve captures all the particles, she cannot glean any useful message without knowing the correct order.But this scheme becomes insecure, if an eavesdropper steals the secret message by relying on Trojan horse attack strategies, hence it has been improved in Ref [324].
8) Other protocols for QSDC or DSQC: As detailed above, numerous theoretical proposals have been conceived for QSDC or DSQC, in which the communication security is guaranteed by encrypting information using quantum states [67], [77], [270], [325] or by denying eavesdroppers access to the entirety of correlated quantum states [75], [81].To achieve confidential direct communication, Alice can also map the secret message to a coherent state |  ⟩ and add a random amplitude   chosen from a Gaussian-distribution for ensuring that an encrypted quantum state of |  +   ⟩ is used for conveying confidential information along with random bits, which will be revealed to Bob for assisting his message decoding via the classical authentication channel [67], [270].The technique of quantum data locking [77] provides a new way of realizing QSDC under the realistic practical assumption that Eve can only access quantum memories having limited coherence time.The secret messages are encoded onto a quantum state and locked by a random unitary operation applied to it.Then the locked quantum state containing messages is transmitted from Alice to Bob. Bob can unlock the original message by using an inverse unitary operation.The choice of the unitary operations between Alice and Bob depends on a pre-shared key, which could be generated using QKD.Both the protocols in [67], [270] and in [77] required only the transmission of quantum states over a quantum channel once, thus they were less corrupted by channel impairments.By contrast, a pair of transmission is required in conventional QSDC protocols [42], [53], [54], [61].
Additionally, both the quantum illumination [74], [75] and quantum low probability of intercept techniques [81] exhibit impressive potential for realizing QSDC at Gigabits per second communication rates only using single-wavelength operations over metropolitan-area fiber channels.In these two schemes, a spontaneous parametric down-conversion operation emits entangled signals and idler beams.Then the signal beam is transmitted to the transmitter of information for message encoding, while the idler beam is retained by the receiver of information.The receiver can recover transmitter's message by combining her idler beam and the returned signal beam as a benefit of their initial entanglement.
The above examples of QSDC or DSQC protocols include both discrete variable and continuous variable systems, proposing new techniques for realizing point-to-point quantum communication, where confidential messages can be transmitted directly through the quantum link between a pair of legitimate users.The most striking contrast is in the additional classical communication step of Fig 15 .Explicitly, DSQC protocols need the transmitter's additional classical information for message decoding, whereas for QSDC there is no need to do this.This transmission from Step 6 of the continuous variable DSQC protocol relies on two-mode squeezed states, where Alice reveals her measurement results, and she also announces the matching information in Step 5 of the ZXFZ DSQC protocol.
• (b) The encoded information can be read out deterministically by the receiver without a basis reconciliation step, and hence in principle there is no additional classical bit exchange between the transmitter and the receiver, except for the process of eavesdropping detection and error rate estimation.• (c) Eve will be detected by the legitimate users in realtime.Protocols that do not meet the above three characteristics are typically referred to as quasi-QSDC protocols [50].
The most appealing feature of QSDC protocols is that a pair of legitimate users can prevent information leakage before eavesdropper detection.The eavesdropper can be detected by sampling the measurements of quantum cryptographic protocols, but information leakage cannot be avoided.To elaborate a little further, QKD is developed for transmitting a cryptographic key.If the eavesdropping detection of QKD discovers the presence of Eve, even if the encoded information has already been unveiled to Eve, the key is simply discarded.However, when the confiential message itself is transmitted directly, the legitimate users cannot throw away the message.Thus some new concepts were created: block based transmission and transmission order rearrangement.
In block based transmission, Alice and Bob have to transmit a batch of quantum states and for the sake of preventing the leakage of a secret message they must carry out an Eve-check procedure to ascertain the absence or presence of an eavesdropper.By contrast, in case of order rearrangement Alice first encodes the confidential message and then reorganizes the position of the particles within a block, while keeping the order secret.However, the secret transmit order of particles may be announced publicly, provided that security of the channel has been confirmed.The above block transmission and order rearrangement methods are popularly used for constructing quantum communication protocols [73], [324], [334]- [338].

B. Advances in security analysis
Classified by Eve's powers, three different types of attacks are commonly considered in QSDC's security analysis: • individual attack: Eve prepares separate ancilla states, each of which is used as a probe to interact independently with qubits and these probes are measured one after the other; • collective attack: Eve independently attaches probes to each qubit, but she stores these ancilla states in the quantum memory to perform an optimal collective measurement at any later time; • coherent attack: Eve prepares a global ancilla state to be used as a probe for interacting with all qubits.Then the ancilla state is stored and collectively measured.This is the strongest class of attacks that Eve could carry out.
Individual attacks are the only ones that are feasible with the aid of existing quantum technologies, while both collective attacks and coherent attacks rely on quantum memories having long coherence time and coherent quantum operations associated with high fidelity, which are unavailable at the time of writing.However, despite the unavailability of quantum memory, the eavesdropper is assumed to have full access to the quantum channel and have all quantum technologiessome of which are unavailable at the time of writing -at her disposal, while operating without violating the laws of quantum mechanics.Cleraly, sustaining confidentiality even under these worst-case assumptions would make the security of quantum communication 'unconditional'.Additionally, it is assumed that Eve can monitor the classical authentication channel, but cannot tamper with it.A quantum communication scheme cannot be generally regarded as being informationtheoretically secure until it is proven to be secure against coherent attacks [170].
The security proof of QSDC protocols is still considered to be work in progress.The challenge in this context is that Eve can attack the qubits traveling along the two-way channel.Similarly, the above three different types of attacks can also be considered in the security analysis QSDC.The security analysis of the initial QSDC protocols focused on tackling individual attacks was given in [53], followed by that of collective attacks in [60].
QSDC protocols can be changed to the DQKD protocols, when dispensing with block transmissions, that is, when the number of qubits  is reduced to 1.The paradigmatic examples of DQKD are the Ping-Pong protocol of [103] and the LM05 protocol of [105].In [105], Bob randomly produces a photon polarized in one of the four states {|0⟩, |1⟩, |+⟩, |−⟩} and he transmits it to Alice.When this particle reaches Alice, she measures it with a probability of  with the objective of eavesdropping detection (checking mode), or she uses it for conveying a secret key bit with probability 1 −  (encoding mode).After encoding the particle it is sent back to Bob.The above steps are repeated until all key bits are transmitted.Then Bob can deterministically access the secret key as well as an estimate of the error rate experienced during transmission over the forward quantum channel (Bob-Alice) after Alice revealing the index of Eve-checking bits.Alice will also publish some part of the key bits for estimating the error rate in the backward quantum channel (Alice-Bob).If entanglement is used, one particle of the entangled state will travel in a forward-backward manner for supporting the information flow [103].There is no block based transmission in DQKD protocols, so they are similar to the DL04 or to the two-step QSDC protocol when  = 1.The security of DQKD protocols has been analyzed in [70], [339]- [348].Some of them are analyzed under the scenario of Alice and Bob using QSDC protocols to distribute the cryptographic key, but they are appropriate for the security analysis of QSDC.To elaborate a little further, diverse individual attack strategies are discussed in Ref. [344] and the upper bound of the amount of information stolen by Eve has also been given.A pair of legitimate communication parties can also benefit from encountering a scenario in that Eve attacks both the forward and the backward channel, because these correlated attacks may be more easily detected [345].Eve can only access the confidential information probabilistically by combining a photon number splitting attack with methods of state discrimination, even if a weak coherent pulse source is adopted [339], [348].In 2011, Lu et al. [70] proved that the DL04 protocol is secure against collective attacks, when the secret key is transmitted by QSDC while relying on idealized perfect devices.In their proof, Eve attaches separable ancilla states to each qubit and applies a unitary operation to the joint state.She keeps the ancilla states in a quantum memory until receiving the qubit from Alice after encoding.In order to infer the maximal possible amount of information from a secret message, the optimal measurement is performed by combining the encoded state and her ancilla state.The the joint state of Bob's initial state, Alice's encoded state, and Eve's attack were used for estimating the maximal possible amount of information that Eve can extract.On this basis, Lu et al. [342] assumed that Eve controls the detector and performs measurements by exploiting the measurement bases Bob has passed to her.The results showed that all detectorside-channel attacks are futile in the channel of Alice-Bob.Moreover, Beaudry et al. [343] and Henao et al. [347] also gave the security proof of two-way protocol.
In the framework of taking collective attacks into consideration, the security of practical QSDC systems may be analyzed from an information theoretical point of view by relying on Wyner's wiretap channel theory [349].The mutual information  (  : ) quantifies the information rate at which Bob can reliably receive from Alice.By comparison, the channel quality of the eavesdropper link and the maximum attainable information rate of a malicious Eve is given by  (  : ).The lower bound of the secrecy capacity of the DL04 protocol can be expressed as [60], [86], [350] where  Bob is the reception rate of Bob,  Eve is the maximum rate Eve can access the qubits,  is the quantum bit error rate,   and   is the error rate under X-basis and Z-basis of the first eavesdropping-check,  is the gap between  Eve and  Bob , and finally ℎ() = −log 2  − (1 − )log 2 (1 − ) is the binary entropy function.By contrast, the lower bound of the secrecy capacity of the two-step protocol is given by [350] where ℎ 4 (e) is the 'four-array' Shannon entropy and e is error distribution.
A promising solution capable of increasing the channel capacity using masking was proposed in [351], where Eve's effective reception rate is limited to  Eve =  Bob , namely  = 1.Therefore, the secrecy capacity limits the maximum rate at which Alice can directly convey confidential messages to Bob through the quantum channel under the guarantee that Eve has no useful information about the confidential message.The secrecy capacity of MDI QSDC was given in [96], [97], [352].In addition, the finite-length security analysis of QSDC is currently under investigation [90].In order to obtain the real-life secrecy capacity of QSDC, some of its practical influencing factors are starting to be taken into account, such as the detector efficiency mismatch [353], sidechannel effects [353], source imperfections [97], [353], and so on.

C. The cryptographic applications of point-to-point QSDC protocols
The blueprint of managing security in communication has been proposed in [354], where end-users of communications networks utilize specific quantum communication systems having different security levels.QSDC constitutes an important fundamental communication protocol capable of supporting high-level security.Hence, numerous quantum cryptographic solutions have been derived from QSDC, as seen in Table X and Table XI.Based on the DL04 QSDC protocol, a single photon is harnessed by Alice and Bob during their one-way [355] or two-way transmission [356], where both of them deduce their secret messages after the announcement of measurement results.The role of Alice and Bob is symmetric.Explicitly, when Bob receives the sequence of  photons, as shown in Fig. 17 of the two-step QSDC protocol, Alice and Bob hold half of every EPR pair in the state | − ⟩.They both are able to encode their secret messages and speak to each other (dialogue) [357].This makes it natural to apply QSDC for the design of the quantum dialogue protocols of [337], [358].
In 2005, the new concept of quantum secret sharing under QSDC was presented in Ref. [62], where the advantages of both QSDC and quantum secret sharing are combined.This allows Alice to transmit a secret message to different agents, where no single person is capable of reconstructing the complete original message, unless the users cooperate.Such protocols can be classified based on their information carriers.Some of them are based on single photons [62], [360]- [362] and rely on the character of 'DL04'.Others employ entangled states [363], [364] and exhibit a 'two-step' or 'high-dimensional' character.In the protocols using a single photon, a batch of  initial single photons is prepared by the first agent, and then the next agents apply the unitary operations 9 to each and every photon to encrypt them.These photons will be transmitted to Alice after the last agent completes the encryption.Then eavesdropping detection and the encoding of secret messages is carried out followed by return to the last agent.If all agents act in concert, all of them can acquire the secret message by applying their repective preparation bases and encryption operations.However, the process is slightly different, when it comes to entanglementbased protocols, where Alice first prepares an EPR photon pair sequence according to her secret message and randomly 9 The unitary operation set is different from that of the encoding operation set in the QSDC protocol.For instance, an additional Hadamard gate operator is brought into the original encoding operation set.It is carefully picked by the agents for avoiding that a single agent intercepts and recovers the whole message independently.
inserts some checking photon pairs into it.A partner EPR particle sequence is encrypted by the agents alternately, and Alice sends the retained sequence to the last agent for their cooperation to decrypt the secret message in the event of having no eavesdroppers.
QSDC schemes associated with authentication are composed of two parts: one of them is for an authentication process and the other is for direct communication [63], [365], [366], [388].These protocols are able to resist man-in-the-middle attacks.Commencing from the principles of three-party QSDC associated with GHZ states [56], the authors of [367]- [370] put forward the concept of quantum sealed-bid auction.The auctioneer, say Alice, prepares a set of  groups of -particle GHZ states and then she distributes each -particle GHZ state to  bidders.These bidders encode their own bid information and return the corresponding particles to Alice for an -particle GHZ-basis measurement.After this, the winner of the auction will be revealed to all bidders.Of course, both EPR pairs [371], [372] and single-photon schemes [373] can also be used as the basic resources of quantum sealed-bid auction.
By combining the two-step QSDC protocol and ping-pong protocol, the quantum steganography philosophy was is proposed in [374], [375].Explicitly, a pair of users employ block transmission to prevent information disclosure.Accordingly, first Bob prepares a large number of entangled states.Then the first layer of secret information is transmitted in the same way as in the ping-pong protocol, but auxiliary Bell states are introduced for capacity improvement.Then two adjacent BSM results are picked by Alice to act as the second secret information, which can be read out by the process of entanglement swapping as detailed in [374], [375].This is how the hidden secret message is embedded.As a further advance, another 'hidden rule' was conceived based on the tensor product of Bell states and unitary transformations for employment in quantum steganography [376].Inspired by quantum steganography, the hidden layer of secret messages was also exploited for quantum watermaking [377], [378].The covert quantum channel is established by changing the secret message encoding rule of QSDC, which can also be used for the transmission of confidential messages [379].
In the protocol of quantum domain anonymous ranking, each user can acquire the correct rankings of his/her data, but nobody else can infer it [380].An ordered sequence of  twoqudit entangled pairs is grouped into a pair of sequences and one of the sequences will visit the station of every users one by one to register their data, while the other sequence is kept at its source.According to the measurement results announced in the final stage, each of the  users can get anonymously the ranking of his/her own data.Decoy qudits are required in some random positions of the photon sequence for detecting eavesdroppers and hence to secure the quantum channel.In [381], [382], the decoy photons are randomy inserted into the sequence of photons of the GHZ states similarly to the procedure of quantum one-time pad in DL04, where the decoy photons are prepared for authenticating users, while the GHZ states can be used for QSDC broadcasting to -receivers.
In [383], the authors proposed a quantum version of the process of arbitrated signature between two users and a trust

DL04
Quantum dialogue To realize bidirectional QSDC, in which both legitimate users are the sender of the secret message as well as the receivers, and their secret message can be exchanged simultaneously.
[355], [356] Two-step [358], [359] DL04 Quantum secret sharing of secure direct communication A dealer wants to share his secret message directly with a group of agents, but the secret message can only be obtained by all the agents if they collaborate.
[62], [360], [361], [362] Two-step [363] High-dimension two-step [364] QSDC with GHZ states [63] Quantum authentication Verifying the identity of communication participants to prevent a malicious eavesdropper from pretending to be a legitimate user, where a sender can simultaneously transmit a secret message over the quantum channel to the receiver.
[63] Two-step [365] DL04 [366] Three-party QSDC with GHZ states [56] Quantum sealed-bid auction Allowing all bidders to submit their own bids, where the auctioneer makes all the bids public and determines the winning bidder.The honesty of auction must be pledged, and no malicious bidders can collide with the auctioneers.
[374], [375], [376] Two-step Quantum watermarking Quantum watermarking is utilized to embed owner identification into quantum multimedia, which is difficult to remove.
[377], [378] High-dimension two-step Quantum covert channel To send secret messages over a covert channel which is established within the normal quantum channel. [379]

Two-step Quantum anonymous ranking
To allow users to attend a privacy-preserving ranking activity whereby each of the participants involved can anonymously infer his/her ranking information, but cannot get that of others. [380]

Quantum broadcast communication
Transmitting secret messages from a sender to a dynamically changing group of receivers, where only the authenticated users can decode the relevant information and others obtain nothing.
[381], [382]  To guarantee the security of digital signatures for two participants, so that the message cannot be forged by the receiver or a possible attacker. [383]

Two-step
Quantum key agreement To permit each participant to equally contribute to the generation of a shared key, which cannot be determined fully by any of the parties alone.Hence others cannot get the key through illegal means.
[384], [385] Three-party QSDC with GHZ states [56] [386], [387] center.Accordingly, the users sign the public message by using a pre-shared key 10 and the unitary operation of a quantum search algorithm [16], [20].Then the signed message qubits are transmitted by two-step QSDC.By this means, the message receiver can confirm that the transmitter signed the message legitimately, while the attacker cannot identify the signature and cannot forge it, because QSDC secures the quantum channel.Similarly, if the particles of each entangled states are held by two different users [384] or even more than two users [385]- [387], then every one in the group has the right to modify a key by applying his/her operation to the qubits in hand and the final key is jointly determined by all members.
As seen from the literature, QSDC is indeed capable of high-security communication.Thus QSDC is eminently suitable for a wide variety of quantum cryptographic tasks, which require a direct transport of deterministic information over the quantum channel.Both block transmission and the random decoy photon insertion techniques constitute powerful countermeasures against eavesdropping attacks.

D. Networking schemes
The topology of a hypothetical any-to-any multi-user QSDC system can be of a loop or star structure as shown in Fig. 22, similar to QKD networks [389], [390].The nodes assume one of three roles: the server, the transmitter (Tx) and receiver (Rx).The server prepares qubits and receives classical requests from all the users on the network.It responds to them over the quantum channel and the classical channel in a different slot.Controllable switches are used for constructing the quantum link between a pair of communicating parties [391].
A multi-user QSDC network can be reduced to that seen in Fig. 23.If two users are not in the same loop or branch, the server of the loop supporting a Tx or Rx will carry out the tasks of qubit preparation, while the other servers will offer the quantum link for their communication.In this case, we assume that only a single subsystem can use the same quantum channel and classical channel simultaneously [64], [392].The server prepares a set of EPR pairs in the same quantum state | − ⟩   , and divides them into two parts, S T and S R .The S T sequence is composed of all the particles marked by  and  in every EPR pair | − ⟩   , respectively.They will be distributed to two different users.Then a subset of particles is selected randomly to detect eavesdroppers by applying the unitary operation   or   to them, similarly to the process in the two-step QSDC protocol [53].If the transmission of qubits is deemed to be secure, the transmitter maps its secret message onto the particles of the sequence S T by applying one of the unitary operations { 0 ,  1 ,  2 ,  3 }, and then randomly picks some particles for the next eavesdropping detection action.The receiver also uses the sequence S R for conveying information, where all bit values are randomly set to 0 or 1.The transmitter and receiver transmit the sequence S T and S R respectively back to the server.The server applies the BSM to each and every EPR pair received and publishes the outcomes given by   =   ⊗   .Then the receiver checks the security and deduces the transmitter's secret messages by applying   =   ⊗  .At this stage communication between the network users is completed.
Diverse QSDC networks relying on entanglement [64], [65], [393], on single photon based regimes [394], and on hyperentanglement [395]- [397] have been conceived, providing an important step forward in terms of achieving any-to-any multiusers QSDC connectivity.Furthermore, the authentication process or identity verification between a quantum server and the users can be validated by entangled EPR pairs and controlled NOT gates [76].Some of the QSDC features have also been introduced into classical optical virtual private networks and into quantum virtual private networks with the objective of enhancing the security of passive optical networks [398].To fit into the operational mobile communication framework and allow telecom companies to provide secure communication, a controlled bidirectional QSDC protocol based on the properties of GHZ-states was invented and applied in mobile networks [399].Some techniques of the network layer, such as quantum multiple access techniques and routing have also been considered in multi-user QSDC networks [400], [401].Indeed, we may view the overall communication networks as a hybrid one relying on a quantum and a classical channel, where the confidential messages are transmitted directly over the quantum channels and the classical channels simply assist in eavesdropping detection.
Constrained by the capabilities of the state-of-the-art technologies at the time of writing, quantum communication relies on classical trusted nodes in networking applications [402]- [407], which have to be hosted in secure premises.Unless these premises are protected from potential eavesdroppers, the information security at the relay nodes potentially faces challenges.The secure repeaters of the near future will have to utilize QSDC and post-quantum cryptography for hopby-hop relaying, while ensuring reliable and secure information transfer even in the presence of realistic eavesdroppinginfested quantum channels, while protecting the information security at the classical relay nodes using post-quantum cryptography [91].Hence again, the relay nodes are not required to be trusted, as shown in Fig. 24.This dual protection scheme solves a major challenge in quantum communication and networking.This approach enhances the transmission distance of QSDC, potentially supporting large-scale secure networking applications, while additionally promoting the organic fusion of quantum communications and post-quantum cryptography.A secure relay has been experimentally characterized by combining 10 kilometers of optical fiber and shortdistance free-space transmission for supporting relay-based image transmission [91].This near-term quantum network supports both connection-oriented and connectionless network protocols in classical networks.A seven-stage evolutionary roadmap of constructing a perfectly quantum Internet based on secure relays has been proposed in [91], but again, the ultimate solution hinges on the introduction of fully-fledged entanglement-based relaying.

E. Experimental progress
Substantial efforts have been invested into realizing DQKD [210], [408]- [412], which has the potential of preparing the groundwork for QSDC experiments.At the time of writing QSDC has evolved from its theoretical protocol development phase to experimental demonstrations over the past few years.Both the DL04 [57], [60] and the two-step QSDC protocol [58], [59] have been realized by dedicated experimentalists.Below, the associated experimental results are reviewed in a little more detail.Table XII  The information carriers inevitably suffer from the impairments of the quantum channel, such as its thermal effects, nonlinearities and dispersion.Therefore, quantum error correction codes [413], [414] and the decoherence-free subspace technique [415]- [417] have been developed for protecting QSDC.In 2016, Hu et al. [57] proposed the so-called singlephoton frequency coding technique for the DL04 protocol, which is different from the frequency encoding technique of Section III-B5.The receiver of the resultant single-photon block is capable of detecting the confidential messages by the discrete time Fourier transform.Even if not all the photons can be detected by the receiver owing to optical loss and due to the limited quantum efficiency of the associated single photon detector, reliable information transimission may still be achieved at a low signal-to-noise ratio.
Figure 25 (a) shows the fiber-optic QSDC system designed by Hu et al [57].Their system had an operating frequency   [170] and photon-numbersplitting attack [101] were considered in this experiment, when calculating the number of secure information bits versus the communication distance.
Qi et al. [60] described the practical QSDC of Fig. 25  (b), including both its optical and electronic part.Motivated readers are referred to [60] for the detailed portrayal of this practical circuit.The QSDC system of Fig. 25 (b) was also concatenated with a low-density parity check coding scheme [60] for enhancing its performance.This practical QSDC experiment conducted over 1.5 km fiber attained a secure communication rate of 50 bps at a quantum bit error rate of 0.6%, and both pictures and audio were successfully transmitted by this system.Nonetheless, the rate vs. distance performance of the system requires further improvement.
The full implementation of typical QSDC protocols [43], [53], [54], [61], [78], [116] requires block-based transmission, where a large number of quantum states have to be processed, which requires quantum memory.However, at the time of writing quantum memory has a rather limited coherence time.A compelling solution is to use an ingenious coding method to reduce the reliance on quantum memory [80], [85], which was hence termed as quantum-memory-free scheme.
In quantum-memory-free QSDC [80], [85], the forward error correction codeword is divided into several data frames for transmission, as seen in Fig. 25 (c).Alice extracts a secure sequence from the previously sent data frame and encrypts the current secret message by using this sequence to obtain the ciphertext.Then, she utilizes the channel's secrecy capacity estimated during the previously sent data frames as the upper limit of the encoding rate representing the maximum normalized throughput for transmitting the current data frame, encoding the ciphertext into a forward-error-correction codeword.This system achieved an information transmission rate of 100 bps over an 18.5 km optical fiber channel.
Pan et al. [86] experimentally demonstrated single-photon based QSDC in a free-space channel, for a transmission over a distance of 10 m at an information transmission rate of 500 bps.In 2022, the communication distance of QSDC was extended to 100 km [89].Hence QSDC is indeed capable of supporting an entire metropolitan area, providing secure communication.As a further advance, Liu et al. [92] constructed a robust optical fiber QSDC system sucessfully operating without active polarization compensation.
Experimentalists often store the photons by using a delay line, such as a fiber loop [408], [418] and optical fiber delay line [57], [59], [60], [409] as a simple design alternative.As a further advance, Zhang et al. [58] opened the door for storing the entangled photons in QSDC using state-of-the-art atomic quantum memory.The detailed components of the QSDC system relying on quantum memory are shown in Fig. 26 (a).A bit rate of 2.5 bps was achieved at the error rate of 10% in this quantum-memory-assisted QSDC system.Additionally, another practical challenge in the implementation of entanglement-based QSDC is to perform high-fidelity Bell-state discrimination.Zhang et al. [58] applied so-called quantum state tomography [9] to discriminate the polarization of entangled states instead of applying the BSM mentioned above.Zhu et al. [59] replaced the quantum state tomography by the BSM using only linear optical elements.In their experiment the Bell states | + ⟩ and | − ⟩ were discriminated successfully with a fidelity of 88% and 91%, respectively.Fig. 26 (b) shows their experimental setup, where the communicating parties are linked by 0.5 km of optical fiber.The entangled photons were generated by spontaneous fourwave mixing [419], and this fiber-based source is conveniently compatibile with the transmission medium.Recently, Qi et al. [87] experimentally demonstrated a 15-user QSDC network based on entanglement distribution, achieving an information transmission rate of 1 kbps between any pair of users separated by a distance as high as 40 km.
At the time of writing many of the grave QSDC impediments have indeed been overcome, despite relying on offthe-shelf optoelectronic devices.An information rate of a few dozens of kbps has been achieved over several tens of kilometers, impressive achievement likely to be followed by more practical high-performance implementations in the near future.

V. OPEN CHALLENGES AND FUTURE RESEARCH
Looking back over the twenty year history of QSDC, several stages of development appear prominently before our eyes, as seen in Fig. 27.From these the following lessons can be derived.
Starting from 2000 when the QSDC philosophy was conceived, researchers have endeavoured to construct point-to-point communication protocols.Then the early QSDC protocols were further developed for solving diverse quantum cryptographic tasks, including quantum dialogues, quantum signatures, and quantum steganography, which opened the way for the extensive application of QSDC.The security of QSDC is provable in theory: the QSDC protocols are informationtheoretically secure.Recent engineering efforts completed the proof-of-principle experiment and took a step toward practical field-operation.Nonetheless, numerous open problems and challenges exist, hence substantial further research is needed.

A. Designing QSDC protocols
As it transpires from the literature we have reviewed, QSDC protocols have mainly been studied in the discrete variable domain.But, the continuous-variable schemes are potentially more compatible with current telecom equipment, and have the advantage of cost-effective detectors, as well as higher rates than discrete-variable protocols.Hence there have been some initial QSDC studies in the continuousvariable domain [67], [117], [270], [325].However, all of them belong to the family of DSQC or quasi-QSDC [50], because additional communication is a prerequisite for the final information decoding, which reduces the efficiency of communication.Thus, one of the open problems is that of designing the family of continuous-variable QSDC protocols, whose receiver can detect information without the assistance of additional communication.Traditional QSDC protocols require round-trip transmission of quantum states.Designing one-way QSDC protocols would be beneficial both in terms of reducing channel losses and system complexity.The rate vs. distance performance has to be improved by harnessing novel physical resources [223], for breaking the theoretical limits [420].In the transmission of confidential information over quantum channels with noise, loss, and eavesdropping, excellent forward error correction codes are required [50], such as polar codes [421], low density parity check codes [60], and so on.A particularly promising technique is to design error correction codes for QSDC schemes.

B. Security proof of QSDC
Historically speaking, the security proof of BB84 QKD has been carried out from a range of different perspectives [422]- [425].The security proof QSDC still requires further research.One of the challenges is that the two-way transmission is vulnerable to attacks by quantum hackers.The security analysis of imperfect devices is also urgently needed.The secrecy capacity considering finite-length effects and practical system parameters has to be determined.

C. Experimental implementations of QSDC
Optimizing the parameters of devices and improving the performance of practical QSDC systems represents ongoing challenges on the experimental side.Intuitively, the communication distance of single-photon QSDC may approach a half of QKD's distance at the same information rate, bearing in mind that QSDC requires two-way block based transmission.Combining quantum memory with QSDC is conducive to the further improvement of the communication distance and in support of QSDC with block based transmission [58].Furthermore, the investigation of free-space optical QSDC (a) QSDC with the quantum memory [58] (b) entanglement-based long-distance QSDC [60].

D. Hybrid QSDC-classical network
In closing we note that most of the cryptographic tasks considered operated in the quantum domain.However, it is also feasible to integrate QSDC into high-security classical communication network.Specially, the secure repeater network is compatible with the existing Internet [91], but additional efforts are needed to design its architecture and establish the interface with the classical network.The classicalcryptography assured imperfect device QSDC proposed in [50] combines classical cryptographic techniques with QSDC using existing technology, enabling confidential communication at an improved security level.

VI. CONCLUSIONS AND LESSONS LEARNED
Following our tour of quantum signal processing with a view to inspire a community-wide effort in the interest of filling the open challenges detailed in the previous section, we conclude by listing a few crisp lessens learned: • The main benefit of communicating in the quantumdomain is that eavesdropping may be detected, which is not the case in the classical domain.Hence if a QKD process is perturbed by an eavesdropper, any further proceedings are curtailed and the key-negotiation is recommenced.Once the key is determined, it may be used exactly in the same way as in classic encryption.• In contrast to the family of QKD solutions, which constitute a family of pure secret key-negotiation protocols, QSDC supports secure communication without requiring a cryptographic key for encryption and decryption.
• Dispensing with a secret key is possible, because in QSDC the confidential messages are directly embedded into the quantum system and transmitted between the communicating parties via a quantum channel.• The QSDC protocols are also eminently suitable for diverse cryptographic tasks, and a large number of cryptographic protocols beyond QSDC have been constructed.• The recent experimental progress was reviewed in Section IV-E highlighting the associated technological challenges.It is clear that the performance of QSDC in terms of its information rate and communication distance is still very limited at the time of writing.
quantum key distribution to quantum secure direct communication

Fig. 2 .
Fig. 2. Different models of communication systems: (a) classical cryptosystem.(b) QKD system.Key agreement is carried out by QKD, and information is transmitted via classical communication, the same as in (a); and (c) QSDC system.No key distribution, no key management and no ciphertext are required in QSDC.

Fig. 3 .
Fig.3.The structure of this survey article.

Fig. 4 .
Fig.4.Timeline of important milestones in quantum secure direct communication.

Fig. 5 .
Fig. 5. Timeline of important milestones in quantum secure direct communication.

Fig. 7 .
Fig. 7.The trajectory examples of quantum state under the specific unitary operation on the Bloch sphere.The red squares represent the initial states and the blue circles represent the final states, while the blue solid lines are the trajectories.

Fig. 8 Fig. 8 .
Fig. 8. Communication model of superdense coding, where the dashed line indicates entanglement and BSM represents the Bell-state measurement.

Fig. 10 .
Fig.10.Entanglement swapping process.The BSM applied to particles 2 and 3 immediately projects particles 1 and 4 into an EPR pair.
).If two clicks happen in D 1H and D 1V or D 2H and D 2V , the measurement result is | + ⟩  .These two click patterns are shown in Fig. 13 (b).Furthermore, the measurement result is | − ⟩  if two clicks D 1H and D 2V or D 1V and D 2H are obeserved, as shown in Fig. 13 (c).

Fig. 13 .
Fig. 13.(a) Setup to perform BSM; (b) The click patterns of Bell state |  + ⟩  .(c) The click patterns of Bell state |  − ⟩  .BS: beam splitters; PBS: polarizing beam splitters; D: single-photon detectors; the A and B represent two inputs.The single-photon detectors labeled by purple means that this detector is clicked by photons.

Fig. 17
Fig.17.The two-step QSDC protocol.Two hexagons linked with a line are in a Bell-state.The pentagons, the rhombuses, the hexagons, and the circles represent the Bell state |  + ⟩  , |  − ⟩  , |  + ⟩  , and |  − ⟩  , respectively.The blank symbols linked with a dashed line are the EPR pairs to do encoding-trick which is used for eavesdropping detection, it also in the one of the four Bell states while no secret message is carried.
Fig.17.The two-step QSDC protocol.Two hexagons linked with a line are in a Bell-state.The pentagons, the rhombuses, the hexagons, and the circles represent the Bell state |  + ⟩  , |  − ⟩  , |  + ⟩  , and |  − ⟩  , respectively.The blank symbols linked with a dashed line are the EPR pairs to do encoding-trick which is used for eavesdropping detection, it also in the one of the four Bell states while no secret message is carried.
. • Step 2, first transmission and first eavesdropping detection.The C sequence [ 1 (C),  2 (C),  3 (C), • • • ,   (C)] of Fig. 17 is sent from Alice to Bob.Alice and Bob then detect eavesdropping through the following actions: (a) Bob randomly selects some EPR partner particles in the C sequence and tell Alice the position of these particles; (b) Bob randomly chooses one of the unitary operations {  ,   } to measure the EPR partner particles selected; (c) Bob tells Alice which of the two unitary operations he has performed on each particles and additionally informs her of the outcome of his measurement; (d) Alice chooses the same unitary operation as Bob to measure the corresponding EPR
eavesdropping detection.Bob performs a BSM based on the pairs Alice has told him, and then the measurement results are published subsequently.Upon comparing the measurement results with her original information, Alice estimates the error rate and detects the presence or absence of eavesdroppers.• Step 5, announcing correlation.When Alice can ascertain that no eavesdropper is present, she classically informs Bob of the matching information of two particles in the M set.If Alice finds an unacceptably high error rate, she curtails the communication session and starts a new one from the Step 1. • Step 6, measurement.Finally, Bob decodes the confidential messages by performing the BSM.

TABLE II COMPARISONS
OF DIFFERENT COMMUNICATION PATTERNS.PQKD, PROBABILISTIC QKD; LEAKAGE, LEAKAGE OF TRANSMITTED DATA IF EVE

TABLE III THE
RELATIONSHIP BETWEEN THE INITIAL BELL STATES, THE FINAL BELL STATES AND THE CORRESPONDING UNITARY OPERATOR.
while the result |1⟩ will appear with probability || 2 .The state will collapse to the new state of either |0⟩ or |1⟩.

TABLE V MAJOR
PROPAGATION PHENOMENA CHARACTERIZING THE FREE-SPACE CHANNEL.

TABLE VI THE
DESIGN PROCESS OF QUANTUM RANDOM NUMBER GENERATOR.
The two-step QSDC protocol.Two hexagons linked with a line are in a Bell-state.The pentagons, the rhombuses, the hexagons, and the circles represent the Bell state |  + ⟩  , |  − ⟩  , |  + ⟩  , and |  − ⟩  , respectively.The blank symbols linked with a dashed line are the EPR pairs to do encoding-trick which is used for eavesdropping detection, it also in the one of the four Bell states while no secret message is carried.
• Step 1, state preparation.Alice and Bob agree on the specific mapping between the four Bell states | − ⟩, | + ⟩, | − ⟩, | + ⟩ and the two-bit classical information as 00, 01, 10, 11, respectively.Observe in Fig. 17 that Alice prepares an ordered sequence of  EPR pairs all in the state |⟩ CM 18,  single photons are prepared by Bob and each of them is randomly mapped to one of the four states {|0⟩ , |1⟩ , |+⟩ , |−⟩}, as shown in Table VIII.These single photons are called B-batch photons, and they are Alice randomly chooses either the measurement basis Z or X for measuring each photon in the C 1 batch and then publishes both the position of these photons as well as the measurement bases applied to them and the measurement results; (c) Bob then calculates the error rate to estimate the probability of eavesdropping.More specifically, Bob compares the measurement results of Alice to his original quantum states to obtain the error rate, when Alice has chosen the same measurement basis as the preparation basis of Bob.If the error rate is lower than a pre-determined threshold, the transmission of the B batch through the quantum forward channel is considered to be secure and they proceed to the next step.Otherwise, the communication is aborted.• Step 2, the message coding and postal pigeon returning stage.Alice decides either to perform the operation  = |0⟩⟨0| + |1⟩⟨1| to encode the information 0 or to perform the operation  =   = |0⟩⟨1| − |1⟩⟨0| to encode the message 1 7 .Observe that the unitary operation  acts as flipping the state in both measuring bases, hence we can obtain transmitted directly to Alice after preparation.Upon receiving the batch of single photons, Alice and Bob check the presence of eavesdropping by the following actions: (a) Sufficient single photon samples are picked randomly from the B batch.This fraction is termed as the C 1 batch, which is marked in gray in Table VIII, leaving behind the other photons forming the B batch having a cardinality of A = B − C 1 ; (b) [61]me showing principles involved in the high-dimension twostep QSDC of[61].The connected circles represent an EPR pair.The bottle green circle is the EPR partner particle that belongs to what we refer to as T-sequence, while the light green one belongs to the H-sequence.  is the unitary transformation used for encoding.Bob prepares a sequence of -dimensional Bell states |Ψ 00 ⟩  .The subscripts  and  serve as the labels of the two particles in the EPR pairs.This queue may be referred to as the travel sequence or T-sequence.The subscript  refers to the EPR pair index in the sequence.• Step 2, first transmission and first eavesdropping detection.Bob sends the T-sequence to Alice, and then they carry out the following substeps to finish the first eavesdropping detection.(a) Alice randomly selects one of several conjugate single-particle measurement bases to measure each of the sample particles, which are randomly picked from the -sequence; (b) Alice then publishes the index of sample particles and also the choice of the measurement bases applied to them; (c) Bob applies measurements to the EPR partner particles of those that are Alice's sample particles; (d) both Alice and Bob disclose their own measurement results, hence Bob compares his measurement results to those of Alice to check whether or not an eavesdropper attack perturbs the quantum states.If their results are highly correlated, they continue to the next step.Otherwise, the first transmission of particles is insecure and they have to abandon this communication session and restart from Step 1. • Step 3, information encoding.Alice maps her secret message bits to the photons of the T-sequence with the aid of the unitary operation   , but excludes the specific sample particles that have been chosen in Step 2. In addition, Alice and Bob have to detect the presence of the eavesdropper by comparing their appropriately selected particles for estimating the error rate.To do this, Alice randomly chooses some photons of the T-sequence for conveying random bits during the process of secret message encoding.She will not expose the position and the encoding bases   of these sample particles before Bob receives the T-sequence.Since the encoding bases of the secret message and random bits are   , the eavesdropper does not know, which particles carry the message and which convey random bits.This is beneficial for confidentiality.Bob applies a joint BSM to every EPR pair after receiving the T-sequence from Alice.At this time, he has both the H-sequence and T-sequence again, except for the sample particles that have been used for the first eavesdropping detection.• Step 5, second eavesdropping detection.After Alice sends the index of the sample particles and the type of unitary operation in Step 4 as classical information to Bob, he carries out the second eavesdropping detection by combining his own measurement results.If the error rate is too high, Alice and Bob must abandon this transmission session and restart it from the beginning.As discussed in Ref.
• Step 1, state preparation.Explicitly,  represents the home particle of Bob while the -particle will be transmitted by Alice to Bob and returned to Alice later.Bob selects one of the particles in each EPR pair to construct a partner particle queue, i.e., [ 1 (H),  2 (H),  3 (H), • • • ,   (H)], termed as the home sequence or H-sequence for short.Thus the other new queue of [ 1 (T),  2 (T),  3 (T), • • • ,   (T)] is composed of the remaining partner particles of each and every EPR pair.• Step 4, measurement.
. In the meantime, Bob produces a sequence of  +  0 +  1 single photons, which are randomly in one of the four states {|0⟩, |1⟩, |+⟩, |−⟩}.This sequence is denoted by P B in Fig. 20.• Step 2, qubit transmission and measurement.Alice sends the sequence P A to an untrusted relay termed as Charlie and located in the middle, while Bob sends the sequence P B to Charlie.Charlie then performs a BSM that projects the incoming qubits into a Bell state, and he publishes the measurement results.Once a partner particle from an EPR pair of   and a single photon from   are projected into a Bell state, the other partner particle of Alice is instantaneously collapsed into one of the four states {|0⟩, |1⟩, |+⟩, |−⟩} with equal probabilities 8 , as shown in Table IX.The state after BSM can be deduced by Bob according to Table IX, but it is unknown to anyone else.For example, Alice's state is |0⟩ 1 for | − 12 ⟩|1⟩ 3 if the BSM result of Charlie is | + 23 ⟩.

TABLE X AN
OVERVIEW OF THE STUDIES ON DIFFERENT TYPES OF QUANTUM CRYPTOGRAPHIC PROTOCOLS BASED ON QSDC.

TABLE XI AN
OVERVIEW OF THE STUDIES ON DIFFERENT TYPES OF QUANTUM CRYPTOGRAPHIC PROTOCOLS BASED ON QSDC.
and Table XIII provide a summary of the most representative QSDC experiments (N.A. represents not available).These experiments were conducted to demonstrate and test a range of QSDC protocols in realworld conditions.

TABLE XII SUMMARY
OF REPRESENTATIVE QSDC EXPERIMENTS BASED ON SINGLE PHOTON.25 to 400 kHz and a channel spacing of 25 kHz.So there are 16 frequency bands and an information transmission rate of 4 kbps was achieved.Both the common intercept-resend attack

TABLE XIII SUMMARY
OF REPRESENTATIVE QSDC EXPERIMENTS BASED ON ENTANGLEMENT.ITU, INTERNATIONAL TELECOMMUNICATION UNION Group & year Zhang et al., 2017 [58] Zhu et al., 2017 [59] Qi et al., 2021 [87] • In conclusion, there are significant untapped opportunities and numerous open problems for a strongly interdisciplinary research community to solve, including numerous open problems in quantum information and communication theory, in quantum physics, in numerous aspects of quantum engineering.These include, but are no means limited to quantum error mitigation, quantum coding, quantum channel modelling and transmission techniques.•A compelling direction is to further explore the potential of wireless QSDC both in the context of free-space optical satellite communication and terrestrial scenarios relying on both visible-light communications and potentially even on THz wireless communications.
• Join this exhilarating research momentum valued Colleague!