Trusted HAP Relaying for Decoy-State Finite-Key QKD in Satellite–Ground Networks: Channel Modeling, Security, and Availability

1. Introduction

Quantum key distribution (QKD) allows two endpoints to establish shared secret material by combining quantum transmission with an authenticated classical channel. Decoy-state BB84 makes weak-coherent-pulse implementations more robust to photon-number-splitting attacks, while finite-key analysis accounts for the statistical uncertainty and security penalties that arise when only a limited number of detections is available [1,2]. These finite-resource effects are particularly important for satellite QKD: a low-Earth-orbit terminal is visible from a ground site for only a bounded interval, and diffraction, pointing, atmospheric loss, and background counts reduce the detection sample accumulated during that interval [3,4,5]. Consequently, a positive instantaneous or asymptotic rate does not by itself determine how much composably secure key a pass can deliver.

Satellite experiments have demonstrated that a trusted mobile node can establish separate keys with remote ground stations and combine them through an authenticated exclusive-or record [6]. A high-altitude platform (HAP) offers a different placement for such a trusted endpoint. Operating in the stratosphere can shorten one terrestrial optical path and place a receiving terminal above much of the dense lower atmosphere; feasibility studies have therefore examined HAP-to-ground QKD link budgets at approximately 20 km altitude [7]. A composable trusted-relay architecture placing the XOR combination at the HAP, together with a preliminary link-level feasibility case for satellite–HAP key sharing, was proposed by the present authors [8]. More recent aerial-network work has modeled balloon-to-ground, ground-to-balloon, and balloon-to-balloon channels and explored the resulting QKD network architectures [9]. These studies motivate HAP-assisted QKD, but none of them — including our own preceding proposal — established under which hardware configuration a relay is actually beneficial: the received aperture, pointing residual, background, contact window, and trust and resource costs remain decisive, and were not previously evaluated together in one accounting.

The architectural comparison must also extend beyond optical transmittance. In a trusted two-hop relay, each released end-to-end bit consumes one unused bit from each hop, and authenticated public communication consumes additional secret material. Post-processing delays when newly generated bits become usable, while application requests can be served only from key that has already reached the relevant inventory. An architectural study therefore needs to distinguish the secret key produced by each link, the authenticated end-to-end supply available after hop pairing, and the fraction of application demand served over a sequence of passes. Improving the first quantity does not guarantee the other two when the hop inventories or release times are unequal. Standards for QKD key delivery explicitly separate network key generation from application retrieval and identify key-management entities, key identifiers, and stored key pools [10]. This separation makes application availability a distinct question from whether either optical link produces a nonzero key.

This study asks the following scoped question: under the declared optical, finite-key, authentication, trust, and service assumptions, when does a trusted HAP relay deliver more usable key than a direct satellite–ground downlink, and how much application-buffer capacity is required for a fixed demand profile? The direct SG comparator is deliberately modeled as the favorable S→G downlink. It uses the same satellite-originating transmission direction as the SH relay hop, while retaining its own receiver, range, atmospheric path, elevation mask, and contact duration. A direct G→S uplink is outside the evaluated scope and is not inferred from the downlink results. Accordingly, all reported relay/SG performance margins in this study apply only to the modeled S→G downlink benchmark and should not be interpreted as performance relative to a direct uplink.

The paper makes the following contributions:

• It integrates a pass-dependent free-space channel surrogate with three-intensity decoy-state finite-key BB84, explicit authentication-resource debits, trusted-relay inventory pairing, post-processing timing, and application-key buffering. The contribution is this scoped system evaluation, extending the composable XOR-relay architecture of [8] with a full finite-key, authentication-accounted, and service-level numerical analysis; no new QKD security proof or relay protocol is claimed.
• It compares six controlled cases that separate HAP receive-aperture effects from contact-window and elevation-mask effects. Both a 0.20 m reference HAP receive radius and a 0.50 m matched radius are evaluated against the S→G downlink using full and common temporal supports. These controls isolate aperture, contact-window, and elevation-mask effects within the downlink comparison; they do not evaluate the propagation-direction effect associated with a direct G→S uplink.
• It connects weather-conditioned per-pass key production to a 200-pass service experiment with fixed workloads, finite buffers, authentication reserves, and no-backlog accounting. An equal-budget protocol search over the decoy intensities and basis probability (simulated annealing against grid and random-search baselines) shows that protocol tuning alone raises the 0.20 m relay yield by 36.74%, and one-factor sensitivity analyses identify which declared hardware and channel parameters most strongly affect the modeled relay supply.

The numerical results are conditional rather than universal. With the 0.20 m HAP radius, the full-contact relay produces 13.175 Mbit/pass, only 15.65% of the 84.185 Mbit/pass SG yield. With the 0.50 m matched radius, the relay produces 116.981 Mbit/pass and exceeds its 84.298 Mbit/pass SG comparator by 38.77% under the modeled full contacts. The common-window and equal-mask controls preserve a smaller advantage. These results identify aperture collection as the principal modeled condition separating the two outcomes; they do not establish hardware feasibility or performance under unmodeled cloud blockage, calibrated turbulence, or a direct uplink.

The remainder of the article is organized as follows. Section 2 positions the study relative to satellite and aerial-platform QKD, atmospheric channel models, finite-key analyses, and key management. Section 3, Section 4, Section 5 and Section 6 define the architecture, implemented channel and detection model, finite-key and authentication accounting, relay release, service process, and protocol search. Section 7 reports the configuration, numerical checks, key yields, availability, optimization, and sensitivity results. Section 8 discusses their interpretation and limitations, and Section 9 concludes the study.

2. Related Work

2.1. Satellite QKD and Trusted Relaying

Low-Earth-orbit (LEO) satellite QKD has been demonstrated experimentally, including intercontinental key exchange in which a satellite acts as a trusted node that establishes separate keys with two distant ground stations and combines them through a public exclusive-or record [6], and the state of satellite QKD technology, missions, and open engineering challenges has been reviewed in [11]. Link-budget and mission-design studies of this kind established the diffraction-, pointing-, and atmosphere-limited character of a single LEO pass and the resulting design trade-offs among transmitter divergence, receiver aperture, and orbit selection [3]. The composable exclusive-or relay used in this paper follows the same trusted-node principle, applied instead to a stratospheric platform rather than to a second satellite pass, as we first proposed in [8]; the present paper supplies the finite-key, authentication, and service-level analysis that proposal did not include.

2.2. High-Altitude and Balloon Platforms

A high-altitude platform positioned near 20 km places a receiving terminal above much of the dense lower atmosphere while remaining far closer to the ground than any satellite orbit. Feasibility analyses of HAP-to-ground QKD have quantified the resulting link-budget advantage for that geometry and identified the residual pointing and background requirements it still imposes on the airborne terminal [7]. More recent work has extended this aerial-node concept to high-altitude balloons, modeling balloon-to-ground, ground-to-balloon, and balloon-to-balloon channels together with candidate QKD network architectures built from them [9]. These studies, together with our own earlier composable-relay proposal [8], motivate HAP- and balloon-assisted QKD as a placement strategy, but none of them evaluates whether a specific relay configuration actually outperforms a direct downlink once receiver aperture, authentication cost, and two-hop inventory pairing are all accounted for together, which is the gap this paper addresses.

2.3. Free-Space Channel Models

Atmospheric transmittance for terrestrial and slant free-space optical links is commonly modeled through a visibility-dependent extinction coefficient with a wavelength-dependent size-distribution exponent [12]; fog, rain, and snow attenuation measured on hybrid free-space optical/radio-frequency (FSO/RF) links shows that low-visibility weather, particularly fog, is a principal limitation of the optical path [13], consistent with current ITU-R propagation guidance [14]; we have previously used the same visibility-conditioned extinction approach to evaluate an FSO link under varying atmospheric visibility in a terrestrial high-speed-train scenario [15], and the present paper adopts the same discrete-visibility-category treatment for the satellite and HAP links. Turbulence-induced fading of a free-space quantum channel has been modeled in more physical detail through Rayleigh-distributed beam-centroid displacement combined with atmospheric structure parameters [16], a law-of-total-probability treatment of the resulting transmittance distribution [17], and direct numerical propagation simulation of the atmospheric channel [18]. Fundamental point-to-point capacity bounds for a lossy bosonic channel, used here only as an implementation diagnostic rather than as a claimed achievability result, were established in [19] (the Pirandola–Laurenza–Ottaviani–Banchi, PLOB, bound), and satellite-specific fundamental bounds encompassing both uplink and downlink configurations were derived in [20]. The present paper uses a declared, fixed-width Gaussian centroid-displacement surrogate rather than any of these more complete propagation models, trading physical fidelity for a channel that is exactly integrable and therefore auditable end to end; Section 4.2 states this scope explicitly.

2.4. Finite-Key Satellite Performance

Because a satellite pass supplies only a finite detection sample, an asymptotic key rate can substantially overstate the secret key a single contact can certify. This has been quantified directly for representative LEO passes [4], extended to a systematic finite-resource performance analysis across several proposed small-satellite QKD missions [5], and further developed into a practical-constraint performance model that incorporates engineering limitations such as bounded in-orbit parameter tunability and finite random-number generation and storage rates [21]. The three-intensity decoy-state protocol and its associated finite-key security bounds, which this paper adopts for every simulated link [1,2], originate in the same finite-block regime that these satellite-specific studies analyze. Unlike [4,5,21], which characterize single-link satellite-to-ground performance, this paper applies the same finite-key discipline to a two-hop trusted relay, where the accounting must additionally track authentication debits and inventory pairing across both hops before an end-to-end key length is defined.

2.5. Trust and Application-Key Availability

Trusted relays and untrusted measurement nodes represent different security architectures. In measurement-device-independent (MDI) QKD, an untrusted measurement station does not expose detector side channels [22]; MDI-QKD is not the protocol evaluated here. The HAP is instead an endpoint of both QKD sessions, learns both hop keys, and must remain trusted. service boundary, the European Telecommunications Standards Institute (ETSI) specification GS QKD 014 defines a REST-based application programming interface (API) through which key-management entities deliver identified blocks of key material to applications; it assumes secure operation of trusted nodes and leaves the internal generation and relaying of key material outside its scope [10]. This paper does not implement that API. It models the preceding resource process: generation, authentication reservation, one-time hop pairing, delayed release, bounded storage, and request service. The resulting availability metric therefore complements physical and finite-key link analyses without being interpreted as an optical-channel availability measurement. The one-time-pad exclusive-or combination used to publish the relay record is information-theoretically hiding for independent uniform operands under the classical secrecy argument of [23], provided a consumed mask is never reused, as enforced by the provenance check in Section 5.3. Authentication of every classical message in this accounting is represented through the universal-hashing construction of [24], and the composable security statement combining the finite-key, authentication, and relay parameters follows the general composability framework of [25]. The protocol-search procedure, defined in Section 6.3 and evaluated in Section 7.7, uses simulated annealing [26] together with grid and random-search baselines at equal evaluation budget, following standard practice for comparing a stochastic search against transparent baselines rather than claiming global optimality.

Taken together, the literature provides mature components for satellite link analysis, aerial-platform feasibility, finite-key estimation, trusted relaying, and application key delivery. The contribution here is to place selected components in one reproducible, explicitly bounded simulation and to expose when a favorable atmospheric location is outweighed by aperture collection or by two-hop inventory constraints. The conclusions remain tied to the modeled parameters and trust assumptions.

3. System, Protocol, and Trust Model

3.1. Architecture and Common Geometry

We consider a ground station G, a trusted high-altitude platform H, and a low-Earth-orbit satellite S. The reference HAP altitude is 20 km; satellite altitudes of 500–1200 km are scenario parameters, not inferred operating optima. The HAP reference is motivated by [7]. Both the assisted and direct architectures use the same satellite trajectory and ground location. The baseline quantum transmissions are G→H (GH uplink), S→H (SH downlink), and S→G (SG reference downlink). Thus, the HAP has two separate receiving terminals and the satellite transmitter can be matched between the SH and SG comparisons. Reversing the direct SG link to G→S requires recomputing its direction-specific propagation and receiver model; therefore, the simulated S→G downlink results are not reused as estimates of direct-uplink performance, and no G→S key yield is reported in this study. Figure 1(a) summarizes these nodes and link directions. The direct SG downlink is evaluated as a separate comparator scenario, not as a pulse stream shared simultaneously with SH, and all reported numerical cases use the 500 km satellite and 20 km HAP shown there.

The satellite follows a circular orbit arranged as an overhead pass of the ground station at latitude ${\varphi }_G$ and longitude ${\lambda }_G$ with inclination i: the initial argument of latitude is $u_0=\arcsin (\sin {\varphi }_G/\sin i)$ and the right ascension of the ascending node is $\Omega ={\lambda }_G-atan2(\sin u_0\cos i,\cos u_0)$, while the ground station and HAP rotate with the Earth.

Let ${\mathbf{r}}_a\left(t\right)$ be the Earth-centered position of node $a\in \{\mathrm{G},\mathrm{H},\mathrm{S}\}$, expressed in one common coordinate frame. For nodes $a,b$, define

$$L_{ab}=\parallel {\mathbf{r}}_b-{\mathbf{r}}_a\parallel ,E_{a\to b}=\arcsin {\displaystyle \frac{({\mathbf{r}}_b-{\mathbf{r}}_a)·{\widehat{\mathbf{r}}}_a}{L_{ab}}},{\widehat{\mathbf{r}}}_a={\displaystyle \frac{{\mathbf{r}}_a}{\parallel {\mathbf{r}}_a\parallel }}.$$

(1)

For propagation from transmitter a to receiver b, the altitude along the ray is

$$h_{ab}(s,t)=∥{\mathbf{r}}_a\left(t\right)+{\displaystyle \frac{s}{L_{ab}\left(t\right)}}\left({\mathbf{r}}_b\left(t\right)-{\mathbf{r}}_a\left(t\right)\right)∥-R_{\oplus },0\le s\le L_{ab}\left(t\right).$$

(2)

Ground elevation masks, HAP field of regard, Earth occultation, and tracking acquisition define each usable contact interval ${\mathcal{T}}_j$. The HAP is fixed relative to the ground over one pass; its horizontal offset is specified as well as its altitude. Earth rotation must be included when positions are transformed from an orbital frame. All link calculations use Eqs. (1)–(2).

Comparisons report both each architecture’s full usable contact and a common contact window. Matching geometry does not match resources: the assisted architecture adds two optical terminals, a trusted site, and a second QKD session. Apertures, detector characteristics, pulse budgets, authentication budgets, and initial key inventories are therefore disclosed for every comparison. A HAP does not remove cloud blockage on the GH hop; adverse weather remains part of its availability model [3,7].

3.2. Trust, Authentication, and Relay Operation

The security claim concerns an external adversary controlling both quantum channels and observing or modifying public traffic, subject to authenticated communication and the characterized-device assumptions below. The HAP is an endpoint of both QKD sessions and knows both link keys. Consequently, an honest-but-curious HAP knows the relayed key, and a malicious or compromised HAP is outside the single-relay secrecy guarantee. This is the trusted-relay setting used in satellite key distribution [6]; it differs from MDI-QKD, whose measurement node need not be trusted [22].

Classical transcripts, key identifiers, sequence numbers, and relay messages are authenticated with a specified universal-hashing construction [24]. Each adjacent node pair starts with a secret authentication reserve. Tag-mask consumption, hash-key refresh or recycling, and rejected-message costs follow that construction; tag length alone is not the total authentication cost. Authentication keys and application keys use disjoint bit ranges.

Let ${\ell }_j$ be the unused link-key bits remaining after the reserves defined in Section 5.3 have been allocated. For one relay operation, the HAP selects disjoint, unused strings ${\tilde{K}}_{\mathrm{GH}}$ and ${\tilde{K}}_{\mathrm{SH}}$ of length

$$u\le \min \{{\ell }_{\mathrm{GH}},{\ell }_{\mathrm{SH}}\}$$

and transmits

$$C_{\mathrm{R}}={\tilde{K}}_{\mathrm{GH}}\oplus {\tilde{K}}_{\mathrm{SH}},K_{\mathrm{e}2\mathrm{e}}=C_{\mathrm{R}}\oplus {\tilde{K}}_{\mathrm{GH}}={\tilde{K}}_{\mathrm{SH}}.$$

(3)

G reconstructs the SH string, while S already holds it. Both endpoints verify the relay record before releasing the key; Figure 1(b) traces this sequence from the two hop inventories to the application buffers. The public XOR reveals no individual operand for ideal independent uniform keys [23]. Both selected link-key segments are retired from their link inventories; the SH segment is transferred to the end-to-end inventory. Previously unused surplus bits may be buffered and used once later. Reusing a consumed GH mask would expose

$$C_{\mathrm{R}}^{\left(1\right)}\oplus C_{\mathrm{R}}^{\left(2\right)}=K_{\mathrm{SH}}^{\left(1\right)}\oplus K_{\mathrm{SH}}^{\left(2\right)}.$$

3.3. Per-Link Protocol and Block Definition

Each link runs polarization-encoded, phase-randomized, three-intensity decoy-state BB84 [1,2,27]. The transmitter chooses $k\in \{\mu ,\nu ,0\}$ with

$$\mu >\nu >0,p_{\mu },p_{\nu },p_0>0,p_{\mu }+p_{\nu }+p_0=1.$$

Transmitter and receiver independently choose the key basis X with probability $p_X>1/2$ and the test basis Z with probability $p_Z=1-p_X$ [28]. Matching-basis probabilities are therefore $p_X^2$ and $p_Z^2$. All intensities contribute to the X-basis raw key, as in [2]. Parameters may differ between links. The reference wavelength is 1550 nm. The satellite source used in the SH and SG scenarios operates at 500 MHz, a repetition rate also used in the HAP QKD feasibility analysis of [7]; the 10 MHz GH source rate is an assumed study input. A pulse clock is not a detector count rate.

For bit a and basis b, the source state is

$${\rho }_{k,a,b}={\displaystyle \sum _{n=0}^{\infty }}{e}^{-k}{\displaystyle \frac{k^n}{n!}}|n;a,b\rangle \langle n;a,b|.$$

(4)

Conditioned on the photon number $n\in \{0,1,2,\dots \}$, encoding and other emitted degrees of freedom are assumed independent of the intensity label. Bits and settings are generated with private randomness; single-photon basis states and receiver responses satisfy the adopted security theorem. An active two-detector receiver assigns a random bit to double clicks. Accepted detections must not introduce an unmodeled basis-dependent efficiency or setting-dependent postselection.

Each block has a predetermined transmitted-pulse budget $N_j^{★}$ and a scheduled contact window. Settings and block boundaries are fixed before quantum transmission; basis information is disclosed after collection. Finite contact windows motivate pass-level evaluation [4]. A predeclared final, shortened contact block is processed if it passes the finite-key tests; otherwise, it is discarded. Thus, $n_{X,j}$ is an observed detection count, not an independently chosen deterministic input. This fixed-window baseline avoids an unspecified rule for repeatedly testing and stopping on favorable statistics. Parameters are optimized offline; adaptation within a block or data-selected time filtering requires a separate analysis. In the numerical evaluation of Section 7, each usable contact is processed as exactly one such block.

4. Channel and Detection Model

4.1. Diffraction and Atmospheric Extinction

For a Gaussian beam launched at its waist, $w_{0,j}$ denotes the $1/e^2$ intensity radius and ${\mathcal{M}}_j^2\ge 1$ its beam-quality factor. The diffraction-broadened beam radius $w_{\mathrm{dif},j}$, divergence angle ${\theta }_j$, and centered aperture collection fraction $T_j^{\left(0\right)}$ are

$$w_{\mathrm{dif},j}^2=w_{0,j}^2+{\left({\theta }_j{L}_j\right)}^2,{\theta }_j={\displaystyle \frac{{\mathcal{M}}_j^2\lambda }{\pi w_{0,j}}},T_j^{\left(0\right)}=1-\exp \left(-{\displaystyle \frac{2a_{\mathrm{r},j}^2}{w_{\mathrm{dif},j}^2}}\right),$$

(5)

where $a_{\mathrm{r},j}$ is the receiver-aperture radius.

Finite launch apertures and beam truncation must be consistent with $w_0$ and ${\mathcal{M}}^2$. Divergence is not varied independently of these quantities without an explicit optical model. No additional $1/L^2$ loss is applied [29].

Let ${\alpha }_{\mathrm{ext}}(h,\lambda ,t)$ be a power-extinction coefficient in ${\mathrm{m}}^{-1}$. With s in meters,

$${\eta }_{\mathrm{atm},j}\left(t\right)=\exp \left[-{\int }_0^{L_j\left(t\right)}{\alpha }_{\mathrm{ext}}(h_j(s,t),\lambda ,t)\mathrm{d}s\right],{\gamma }_{\mathrm{ext}}[\mathrm{dB}/\mathrm{km}]={\displaystyle \frac{{10}^4}{\ln 10}}{\alpha }_{\mathrm{ext}}\left[{\mathrm{m}}^{-1}\right].$$

(6)

For visibility V in km defined at a 2% contrast threshold, the near-ground aerosol approximation is

$${\alpha }_{\mathrm{vis}}\left[{\mathrm{km}}^{-1}\right]={\displaystyle \frac{-\ln \left(0.02\right)}{V}}{\left({\displaystyle \frac{\lambda }{550\mathrm{nm}}}\right)}^{-q\left(V\right)},{\gamma }_{\mathrm{vis}}[\mathrm{dB}/\mathrm{km}]\simeq {\displaystyle \frac{17}{V}}{\left({\displaystyle \frac{\lambda }{550\mathrm{nm}}}\right)}^{-q\left(V\right)}.$$

(7)

The Kim exponent is

$$q\left(V\right)=\left\{\begin{array}{cc}1.6,\hfill & V>50,\hfill \\ 1.3,\hfill & 6<V\le 50,\hfill \\ 0.16V+0.34,\hfill & 1<V\le 6,\hfill \\ V-0.5,\hfill & 0.5<V\le 1,\hfill \\ 0,\hfill & 0<V\le 0.5.\hfill \end{array}\right.$$

The model follows [12,14]. The coefficient $-\ln \left(0.02\right)/V\approx 3.912/V$ in Eq. (7) is an extinction coefficient in natural-logarithm units (${\mathrm{km}}^{-1}$); its decibel counterpart ${\gamma }_{\mathrm{vis}}\simeq 17/V$ dB/km follows from the conversion in Eq. (6). Visibility reported using a different contrast threshold must first be converted consistently.

The altitude profile separates molecular and aerosol terms, for example,

$${\alpha }_{\mathrm{ext}}={\alpha }_{\mathrm{mol}}+{10}^{-3}{\alpha }_{\mathrm{vis}}g(h,t),$$

(8)

where ${\alpha }_{\mathrm{mol}}$ is the molecular extinction coefficient and $g(h,t)$ is a specified dimensionless aerosol-layer profile with ground value one. The factor ${10}^{-3}$ converts ${\alpha }_{\mathrm{vis}}$ from ${\mathrm{km}}^{-1}$ to ${\mathrm{m}}^{-1}$. The chosen layer depth or decay scale is a model input. A separately modeled cloud-occultation state sets the affected quantum link to unavailable; the visibility formula is not a universal cloud or precipitation model. Aerosol extinction is not added again if already contained in a measured or radiative-transfer extinction profile.

Writing

$${\eta }_{\det ,j}={\eta }_{\mathrm{tx},j}{\eta }_{\mathrm{atm},j}{\eta }_{\mathrm{rx},j},$$

where ${\eta }_{\mathrm{tx},j}$ and ${\eta }_{\mathrm{rx},j}$ denote the transmitter and receiver optical throughputs, respectively, the instantaneous channel and signal-detection efficiencies are

$${\eta }_{\mathrm{ch},j}={\eta }_{\det ,j}{T}_j,0\le T_j\le 1,{\eta }_{\mathrm{sig},j}={\eta }_{\mathrm{ch},j}{\eta }_{\mathrm{d},j}{\eta }_{\mathrm{gate},j}.$$

(9)

Here, $T_j$ is the instantaneous aperture-collection fraction, ${\eta }_{\mathrm{d},j}$ is the detector efficiency, and ${\eta }_{\mathrm{gate},j}$ is the fraction of the photon arrival-time distribution accepted by the gate. Detector efficiency and temporal acceptance are excluded from reported optical channel transmittance.

4.2. Turbulence and Collected-Power Statistics

The reference Hufnagel–Valley (HV) profile for the refractive-index structure parameter $C_n^2\left(h\right)$ is

$$C_n^2\left(h\right)=0.00594{\left({\displaystyle \frac{v}{27}}\right)}^2{\left({10}^{-5}h\right)}^{10}{e}^{-h/1000}+2.7\times {10}^{-16}{e}^{-h/1500}+A{e}^{-h/100},$$

(10)

where h is the altitude in meters, v is the wind-speed parameter, and $C_n^2\left(h\right)$ is expressed in ${\mathrm{m}}^{-2/3}$ [30]. The HV-5/7 reference uses $v=21$ m/s and $A=1.7\times {10}^{-14}{\mathrm{m}}^{-2/3}$, where A is the coefficient of the near-ground turbulence term. The exact profile value at $h=0$ is therefore $A+2.7\times {10}^{-16}$ rather than A alone. The altitude definition is consistent with Eq. (2).

For link j, let $L_j$ denote the transmitter-to-receiver propagation distance and let s denote the position along that path, with $0\le s\le L_j$. The corresponding plane-wave and spherical-wave weak-fluctuation diagnostics are

$$\begin{array}{cc}\hfill {\sigma }_{R,\mathrm{plane},j}^2& =2.25k_0^{7/6}{\int }_0^{L_j}{C}_n^2\left(h_j\left(s\right)\right){(L_j-s)}^{5/6}\mathrm{d}s,\hfill \\ \hfill {\sigma }_{R,\mathrm{sph},j}^2& =2.25k_0^{7/6}{\int }_0^{L_j}{C}_n^2\left(h_j\left(s\right)\right){\left[{\displaystyle \frac{s(L_j-s)}{L_j}}\right]}^{5/6}\mathrm{d}s,\hfill \end{array}$$

(11)

where $h_j\left(s\right)$ is the altitude along link j and $k_0=2\pi /\lambda$ is the optical wavenumber. The plane-wave and spherical-wave expressions are used only as diagnostics for their respective illumination limits and are not interchangeable Gaussian-beam propagation models. A diagnostic value below 0.3 is used only as a conservative weak-regime screen; it does not validate an aperture-transmittance model.

The aperture-collected power fraction for link j is defined from the normalized receiver-plane irradiance $I_j(\mathbf{r},t)$ as

$$T_j\left(t\right)={\int }_{\parallel \mathbf{r}\parallel \le a_{\mathrm{r},j}}{I}_j(\mathbf{r},t){\mathrm{d}}^2\mathbf{r},{\int }_{{\mathbb{R}}^2}{I}_j(\mathbf{r},t){\mathrm{d}}^2\mathbf{r}=1,$$

(12)

where $\mathbf{r}$ is the two-dimensional position in the receiver plane and $a_{\mathrm{r},j}$ is the receiver-aperture radius. The normalization makes $T_j\left(t\right)$ the fraction of the incident optical power collected by the receiver aperture.

For the implemented surrogate model, the beam-centroid displacement ${\mathbf{r}}_c$ is modeled as a Gaussian random displacement with per-axis variance ${\sigma }_{c,j}^2$, while the short-term beam radius $W_{\mathrm{ST},j}$ is fixed. Defining $r_c=\parallel {\mathbf{r}}_c\parallel$, the collected fraction for a given centroid displacement is

$$T_j\left(r_c\right)=1-Q_1\left({\displaystyle \frac{2r_c}{W_{\mathrm{ST},j}}},{\displaystyle \frac{2a_{\mathrm{r},j}}{W_{\mathrm{ST},j}}}\right),$$

(13)

where $Q_1(·,·)$ is the first-order Marcum Q-function. Equation (13) gives the exact circular-aperture integral for this fixed-width Gaussian beam profile; it is not an exact description of an arbitrary turbulent beam. No calibrated elliptic-beam or scintillation model, and no extra log-normal or Gamma–Gamma multiplier, is applied to this surrogate; a validated alternative would require calibration data that $C_n^2\left(h\right)$ and a Rytov value alone do not supply [16,18].

4.3. Residual Pointing and Temporal Dependence

For one angular pointing axis, let f denote temporal frequency, $G\left(f\right)$ the open-loop gain of the tracking loop, $S_{\theta ,d}\left(f\right)$ the angular-disturbance power spectral density (PSD), and $S_{\theta ,n}\left(f\right)$ the equivalent angular sensor-noise PSD. For uncorrelated disturbance and sensor-noise inputs, the residual angular-error PSD is

$$S_{\theta ,\mathrm{res}}\left(f\right)={\left|{\displaystyle \frac{1}{1+G\left(f\right)}}\right|}^2{S}_{\theta ,d}\left(f\right)+{\left|{\displaystyle \frac{G\left(f\right)}{1+G\left(f\right)}}\right|}^2{S}_{\theta ,n}\left(f\right),{\sigma }_{\theta }^2={\int }_0^{\infty }{S}_{\theta ,\mathrm{res}}\left(f\right)\mathrm{d}f.$$

(14)

Here, $S_{\theta ,\mathrm{res}}\left(f\right)$ is the residual pointing-error PSD after tracking correction, and ${\sigma }_{\theta }^2$ is the corresponding per-axis angular-error variance. The one-sided PSDs have units ${\mathrm{rad}}^2/\mathrm{Hz}$, so ${\sigma }_{\theta }$ has units of radians. Bandwidth alone does not determine $G\left(f\right)$; loop gain, delay, sensor filtering, stability, and finite noise bandwidth must also be specified [31,32]. A tracking-bandwidth ($f_{\mathrm{BW}}$) sweep of 50–700 Hz used in Section 7.8 is a design study, not a measured HAP capability. Satellite pointing demonstrations provide context, not transferable HAP disturbance spectra [33,34].

In the numerical study, the loop is a modeled first-order tracking response with $G\left(f\right)=f_{\mathrm{BW}}/\left(\mathrm{i}f\right)$, so that ${|1+G|}^{-2}=f^2/(f^2+f_{\mathrm{BW}}^2)$ and ${|G/(1+G)|}^2=f_{\mathrm{BW}}^2/(f^2+f_{\mathrm{BW}}^2)$, with a baseline closed-loop bandwidth $f_{\mathrm{BW}}=200$ Hz. The assumed spectra are $S_{\theta ,d}\left(f\right)=4\times {10}^{-11}/\{1+{[f/\left(5\mathrm{Hz}\right)]}^2\}{\mathrm{rad}}^2$/Hz and $S_{\theta ,n}\left(f\right)={10}^{-15}{\mathrm{rad}}^2$/Hz. The integral in Eq. (14) is evaluated over 0.01–2000 Hz with 400 logarithmically spaced nodes and trapezoidal quadrature, giving a baseline per-axis residual ${\sigma }_{\theta }\approx 2.731\mu$rad. These spectra are study assumptions, not a measured HAP controller.

For transmitter angular error, the received pointing, acquisition, and tracking (PAT) displacement is ${\mathbf{r}}_{\mathrm{PAT},j}\simeq L_j{\theta }_{\mathrm{res},j}$. For link j, let ${\sigma }_{c,j}^2$ denote the per-axis variance of the Gaussian beam-centroid displacement used in the surrogate model above. Assuming that residual atmospheric centroid wander and residual pointing error are independent, this variance is

$${\sigma }_{c,j}^2={\sigma }_{\mathrm{BW},\mathrm{res},j}^2+L_j^2{\sigma }_{\theta ,j}^2,$$

(15)

where ${\sigma }_{\mathrm{BW},\mathrm{res},j}$ is the per-axis residual atmospheric centroid-wander standard deviation, ${\sigma }_{\theta ,j}$ is the per-axis residual angular pointing-error standard deviation defined from Eq. (14), and $L_j{\sigma }_{\theta ,j}$ converts the angular pointing error to a receiver-plane displacement.

In the baseline model, ${\sigma }_{\mathrm{BW},\mathrm{res},j}=0$ for all links, so the centroid-displacement variance is due entirely to residual pointing. Averaging Eq. (13) over the resulting Rayleigh-distributed centroid offset gives the mean aperture-collection fraction $\mathbb{E}\left[T_j\right]$; its integral form and closed-form expression are given in Appendix A, and it is the quantity plotted in Figure 3(c) and Figure 4. A marginal probability distribution of transmittance (PDT) does not specify fade; independent samples are used only for bins explicitly assumed decorrelated, and the implementation does not simulate correlated within-pass fading trajectories.

4.4. Receiver Counts and Block Statistics

For an active receiver with two symmetric detectors, let $d_j$ denote the dark-count rate of each detector and let ${\mathcal{L}}_{\lambda ,j}$ denote the spectral radiance incident at the receiver entrance aperture, in $\mathrm{W}{\mathrm{m}}^{-2}{\mathrm{sr}}^{-1}{\mathrm{nm}}^{-1}$. A single baseline radiance is assumed for all links, with sensitivity to this value examined in Section 7.8, rather than using a calibrated day/night radiance model.

The aggregate mean background-photon count admitted during one detection gate is

$${\overline{n}}_{\mathrm{bg},j}={\eta }_{\mathrm{rx},\mathrm{bg},j}{\eta }_{\mathrm{d},j}{\displaystyle \frac{{\mathcal{L}}_{\lambda ,j}{A}_{\mathrm{r},j}{\Omega }_j\Delta {\lambda }_j{\tau }_{g,j}}{h_{\mathrm{P}}c/\lambda }},p_{n,j}=1-\exp \left[-d_j{\tau }_{g,j}-{\displaystyle \frac{{\overline{n}}_{\mathrm{bg},j}}{2}}\right],$$

(16)

where ${\eta }_{\mathrm{rx},\mathrm{bg},j}$ is the receiver throughput for background light, ${\eta }_{\mathrm{d},j}$ is the detector efficiency, $A_{\mathrm{r},j}$ is the receiver-aperture area, ${\Omega }_j$ is the receiver field-of-view solid angle (sr), $\Delta {\lambda }_j$ is the optical filter bandwidth (nm), and ${\tau }_{g,j}$ is the detection-gate duration. Here, $h_{\mathrm{P}}$ is Planck’s constant, c is the speed of light, and $h_{\mathrm{P}}c/\lambda$ is the photon energy at wavelength $\lambda$. The quantity $p_{n,j}$ is therefore the noise-click probability of one detector during one gate. The factor $1/2$ accounts for the equal sharing of unpolarized background light between the two detectors.

For the circular receiver aperture used here, $A_{\mathrm{r},j}=\pi a_{\mathrm{r},j}^2$. Following [3,35], the corresponding aggregate vacuum yield, i.e., the probability that at least one of the two detectors clicks in the absence of signal photons, is

$$Y_{0,j}=1-{(1-p_{n,j})}^2.$$

Conditioned on a matched basis and an encoded bit, let $e_{d,j}$ denote the intrinsic optical-error probability for link j. The symmetric error model directs fractions $1-e_{d,j}$ and $e_{d,j}$ of the signal to the correct and wrong detectors, respectively. For compactness, the link index j is suppressed in the following detector-response expressions, so that $p_n\equiv p_{n,j}$ and $e_d\equiv e_{d,j}$. Defining

$$x=k{\eta }_{\mathrm{sig},j},$$

where x is the mean detected signal-photon number for intensity setting k, the correct- and wrong-detector click probabilities are

$$\begin{array}{cc}\hfill p_c& =1-(1-p_n)e^{-(1-e_d)x},p_w=1-(1-p_n)e^{-e_{d}x},\hfill \\ \hfill Q_{b,k}& =p_c+p_w-p_c{p}_w,\hfill \\ \hfill H_{b,k}& =p_w(1-p_c)+{\displaystyle \frac{1}{2}}{p}_c{p}_w,E_{b,k}={\displaystyle \frac{H_{b,k}}{Q_{b,k}}}.\hfill \end{array}$$

(17)

Here, $p_c$ and $p_w$ are the click probabilities of the correct and wrong detectors, respectively; $Q_{b,k}$ is the total detection probability (gain), $H_{b,k}$ is the error gain, and $E_{b,k}$ is the corresponding quantum bit error rate for basis b and intensity setting k. The term $\frac{1}{2}{p}_c{p}_w$ assigns a random bit to a double-click event, consistent with the receiver rule specified in Section 3.3. This conditional Poisson model therefore treats double clicks explicitly.

This is a performance model; the security estimator uses the actual accepted counts without assuming that Eve follows this channel law. The analytic baseline is valid in the low-occupancy regime with negligible afterpulsing, requiring

$${\tau }_{g,j}\le {\displaystyle \frac{1}{f_{\mathrm{rep},j}}},R_{\mathrm{click},j}{\tau }_{\mathrm{dead},j}\ll 1$$

for each detector, where $f_{\mathrm{rep},j}$ is the transmitted-pulse repetition rate, $R_{\mathrm{click},j}$ is the detector click rate, and ${\tau }_{\mathrm{dead},j}$ is the detector dead time. Section 7.1 reports the maximum realized value of the click-rate–dead-time product across the numerical study. With fixed settings, the planning means are

$$\begin{array}{cc}\hfill \mathbb{E}\left[n_{b,k}\right]& ={\int }_{{\mathcal{I}}_j}{f}_j{p}_{b,j}^2{p}_{k,j}\int Q_{b,k}(\eta ,t)P_j(\eta ;t)\mathrm{d}\eta \mathrm{d}t,\hfill \\ \hfill \mathbb{E}\left[m_{b,k}\right]& ={\int }_{{\mathcal{I}}_j}{f}_j{p}_{b,j}^2{p}_{k,j}\int H_{b,k}(\eta ,t)P_j(\eta ;t)\mathrm{d}\eta \mathrm{d}t.\hfill \end{array}$$

(18)

Average gains and error gains are accumulated before forming the quantum bit error rate (QBER); in general $\mathbb{E}\left[Q\right(\eta \left)\right]\ne Q\left(\mathbb{E}\right[\eta \left]\right)$. Expected-count optimization (used for the planning objective of Section 7.7 and the diagnostic of Section 7.4) is a planning approximation; finite-block distributions require integer count realizations, which are what the main numerical results of Section 7 use.

5. Finite-Key Security and Trusted-Relay Composition

5.1. Count Bounds and Phase-Error Estimation

We adopt the three-intensity finite-key estimator of [2,36]. For clarity, the link index is omitted. Let $n_{b,k}$ and $m_{b,k}$ denote the observed detection and error counts, respectively, for basis $b\in \{X,Z\}$ and intensity k, with

$$n_b=\sum _k{n}_{b,k},m_b=\sum _k{m}_{b,k},{\tau }_n=\sum _k{p}_k{e}^{-k}{\displaystyle \frac{k^n}{n!}},$$

where ${\tau }_n$ is the overall probability of emitting n photons. With the statistical failure-budget share ${ϵ}_s={\epsilon }_{\sec }/21$,

$$\begin{array}{cc}\hfill {\Delta }_n\left(b\right)& =\sqrt{{\displaystyle \frac{n_b}{2}}\ln (1/{ϵ}_s)},{\Delta }_m\left(Z\right)=\sqrt{{\displaystyle \frac{m_Z}{2}}\ln (1/{ϵ}_s)},\hfill \\ \hfill {\tilde{n}}_{b,k}^{\pm }& ={\displaystyle \frac{e^k}{p_k}}\left[n_{b,k}\pm {\Delta }_n\left(b\right)\right],\hfill \\ \hfill {\tilde{m}}_{Z,k}^{\pm }& ={\displaystyle \frac{e^k}{p_k}}\left[m_{Z,k}\pm {\Delta }_m\left(Z\right)\right].\hfill \end{array}$$

(19)

Negative lower bounds are clipped at zero. For the vacuum-plus-weak setting,

$$\begin{array}{cc}\hfill s_{b,0}^{\mathrm{L}}& ={\tau }_0{\tilde{n}}_{b,0}^{-},\hfill \\ \hfill s_{b,1}^{\mathrm{L}}& ={\left[{\displaystyle \frac{{\tau }_1\mu }{\nu (\mu -\nu )}}\left\{{\tilde{n}}_{b,\nu }^{-}-{\tilde{n}}_{b,0}^{+}-{\displaystyle \frac{{\nu }^2}{{\mu }^2}}\left({\tilde{n}}_{b,\mu }^{+}-{\displaystyle \frac{s_{b,0}^{\mathrm{L}}}{{\tau }_0}}\right)\right\}\right]}_{+},\hfill \\ \hfill v_{Z,1}^{\mathrm{U}}& ={\displaystyle \frac{{\tau }_1}{\nu }}\left({\tilde{m}}_{Z,\nu }^{+}-{\tilde{m}}_{Z,0}^{-}\right),\hfill \end{array}$$

(20)

where ${\left[x\right]}_{+}=\max (0,x)$; $s_{b,0}^{\mathrm{L}}$ and $s_{b,1}^{\mathrm{L}}$ are lower bounds on the vacuum and single-photon detections, and $v_{Z,1}^{\mathrm{U}}$ is an upper bound on the single-photon Z-basis errors. Inconsistent or empty confidence regions cause an abort. Setting $e=v_{Z,1}^{\mathrm{U}}/s_{Z,1}^{\mathrm{L}}$,

$$\begin{array}{cc}\hfill {\varphi }_X^{\mathrm{U}}& =e+\gamma \left({\epsilon }_{\sec },e,s_{Z,1}^{\mathrm{L}},s_{X,1}^{\mathrm{L}}\right),\hfill \\ \hfill \gamma (a,b,c,d)& =\sqrt{{\displaystyle \frac{(c+d)b(1-b)}{cd\ln 2}}{\log }_2\left[{\displaystyle \frac{(c+d){21}^2}{cdb(1-b)a^2}}\right]}.\hfill \end{array}$$

(21)

Here, ${\varphi }_X^{\mathrm{U}}$ is the upper bound on the single-photon X-basis phase-error rate. We use the convention of [2], retaining the full secrecy parameter and the factor 21. The block is aborted if $s_{X,1}^{\mathrm{L}}\le 0$, $s_{Z,1}^{\mathrm{L}}\le 0$, $e\notin (0,1/2)$, the logarithm is outside its domain, or ${\varphi }_X^{\mathrm{U}}\ge 1/2$. Zero observed errors do not imply zero phase error. A tighter Chernoff estimator [37] is not used here.

5.2. Per-Block Key Length and Security Meaning

For reconciled X-basis strings, the extracted key length is

$${\ell }_j^{\mathrm{QKD}}={⌊s_{X,0,j}^{\mathrm{L}}+s_{X,1,j}^{\mathrm{L}}\left[1-h_2\left({\varphi }_{X,j}^{\mathrm{U}}\right)\right]-{\Lambda }_{\mathrm{EC},j}-6{\log }_2{\displaystyle \frac{21}{{\epsilon }_{\sec ,j}}}-{\log }_2{\displaystyle \frac{2}{{\epsilon }_{\mathrm{cor},j}}}⌋}_{+},$$

(22)

where $h_2$ is the binary entropy function, ${\Lambda }_{\mathrm{EC},j}$ is the error-correction leakage, and ${\lfloor x\rfloor }_{+}=\max (0,\lfloor x\rfloor )$. With the link index omitted, planning calculations use ${\Lambda }_{\mathrm{EC}}=\lceil f_{\mathrm{EC}}{n}_X{h}_2\left(E_X\right)\rceil$, $E_X=m_X/n_X$, for specified $f_{\mathrm{EC}}\ge 1$ [38,39].

Correctness and secrecy are specified by $Pr[K_A\ne K_B\mathrm{and}\mathrm{accept}]\le {\epsilon }_{\mathrm{cor}}$ and ${\displaystyle \frac{1-p_{\mathrm{abort}}}{2}}{\parallel {\rho }_{KE}-{\tau }_K\otimes {\rho }_E\parallel }_1\le {\epsilon }_{\sec }$, where $K_A$ and $K_B$ are the accepted endpoint keys, $p_{\mathrm{abort}}$ is the abort probability, and ${\rho }_{KE}$ and ${\tau }_K\otimes {\rho }_E$ denote the actual and ideal key–adversary states, respectively. These are composable distinguishing guarantees, not per-bit compromise probabilities [25].

For a stationary, infinite-data reference using all intensities, the corresponding rate in bits per emitted pulse is

$$\begin{array}{cc}\hfill r^{\infty }& =p_X^2{\left[{\tau }_0{Y}_0^{\mathrm{L}}+{\tau }_1{Y}_1^{\mathrm{L}}\left(1-h_2\left(e_1^{\mathrm{ph},\mathrm{U}}\right)\right)-f_{\mathrm{EC}}{\overline{Q}}_X{h}_2\left({\overline{E}}_X\right)\right]}_{+},\hfill \\ \hfill {\overline{Q}}_X& =\sum _k{p}_k{Q}_{X,k},{\overline{E}}_X={\displaystyle \frac{{\sum }_k{p}_k{H}_{X,k}}{{\overline{Q}}_X}}.\hfill \end{array}$$

(23)

Here, $Y_0^{\mathrm{L}}$ and $Y_1^{\mathrm{L}}$ are the asymptotic lower bounds on the vacuum and single-photon yields, respectively, and $e_1^{\mathrm{ph},\mathrm{U}}$ is the corresponding upper single-photon phase-error rate. Equation (23) suppresses statistical deviations and additive finite-security penalties and is used only as the convergence reference in Section 7.4.

5.3. Authentication Accounting and Composition

Allocate disjoint QKD outputs to authentication replenishment and relay authentication on each hop. Let ${\kappa }_j$ denote their total allocation, with ${\kappa }_j\le {\ell }_j^{\mathrm{QKD}}$. The newly available relay inventory is

$${\ell }_j={\left[{\ell }_j^{\mathrm{QKD}}-{\kappa }_j\right]}_{+},u\le \min \{{\ell }_{\mathrm{GH}},{\ell }_{\mathrm{SH}}\}.$$

(24)

This is net-growth accounting. An aborted session can still consume pre-existing authentication bits; a separate reserve ledger tracks these debits, and operation stops when authentication cannot be funded. No application key is relayed until the required reserves are available. The implemented profile uses 128-bit tags and ${\epsilon }_{\mathrm{auth}}=2^{-128}$ as an idealized authentication abstraction; Section 8.3 states this limitation.

For one block pair and relay operation, a sufficient external-adversary security allocation is

$${\epsilon }_{\mathrm{e}2\mathrm{e}}\le \sum _{j\in \{\mathrm{GH},\mathrm{SH}\}}\left({\epsilon }_{\sec ,j}+{\epsilon }_{\mathrm{cor},j}+{\epsilon }_{\mathrm{auth},\mathrm{QKD},j}\right)+{\epsilon }_{\mathrm{auth},\mathrm{R}}.$$

(25)

Here, ${\epsilon }_{\mathrm{auth},\mathrm{QKD},j}$ and ${\epsilon }_{\mathrm{auth},\mathrm{R}}$ are the authentication failure parameters for QKD-link communication and the relay operation, respectively, and ${\epsilon }_{\mathrm{e}2\mathrm{e}}$ is the resulting end-to-end security parameter. Equation (25) follows from contractivity under classical processing and the triangle inequality [25]. Over multiple passes, the security parameters of all used QKD blocks and authentication operations are summed once toward the system-lifetime target.

6. Key Release, Availability, and Optimization

6.1. Block Completion and Release Latency

For a fixed emitted-pulse block on link j, let $t_{0,j}$ and $t_{\mathrm{end},j}$ denote the block start and acquisition-end times, respectively. For a sequential post-processing schedule, define

$$t_{\mathrm{ready},j}=t_{\mathrm{end},j}+T_{\mathrm{post},j},T_{\mathrm{post},j}=T_{\mathrm{comm},j}+T_{\mathrm{sift},j}+T_{\mathrm{PE},j}+T_{\mathrm{EC},j}+T_{\mathrm{EV},j}+T_{\mathrm{PA},j}+T_{\mathrm{auth},j}.$$

(26)

Here, $T_{\mathrm{comm},j}$, $T_{\mathrm{sift},j}$, $T_{\mathrm{PE},j}$, $T_{\mathrm{EC},j}$, $T_{\mathrm{EV},j}$, $T_{\mathrm{PA},j}$, and $T_{\mathrm{auth},j}$ are the communication, sifting, parameter-estimation, error-correction, error-verification, privacy-amplification, and authentication times, respectively.

For relay operation r, let $t_{\mathrm{request},r}$ denote the request time, with $t_{\mathrm{ready},\mathrm{GH},r}$ and $t_{\mathrm{ready},\mathrm{SH},r}$ the ready times of the associated GH and SH blocks. For parallel link processing,

$$t_{\mathrm{release},r}=\max \left(t_{\mathrm{request},r},t_{\mathrm{ready},\mathrm{GH},r},t_{\mathrm{ready},\mathrm{SH},r}\right)+T_{\mathrm{R},r},T_{\mathrm{e}2\mathrm{e},r}=t_{\mathrm{release},r}-t_{\mathrm{request},r}.$$

(27)

The relay duration $T_{\mathrm{R},r}$ includes transmitting the $u_r$-bit XOR record, identifiers, and authentication, where $u_r$ is the relayed key length for operation r; $T_{\mathrm{e}2\mathrm{e},r}$ is the corresponding request-to-release latency. Stored keys can satisfy a request without waiting for new quantum transmission. The numerical post-processing and relay-serialization parameters are listed in Table A1 (Appendix B).

6.2. Link Inventories and End-to-End Service

Let $I_{j,q}$ be the unused authenticated link inventory before update q, and $F_{j,q}$ the newly ready net link bits. With link capacity $I_{j,\max }$,

$$I_{j,q}^{+}=\min \{I_{j,\max },I_{j,q}+F_{j,q}\},0\le u_q\le \underset{j}{\min }{I}_{j,q}^{+},I_{j,q+1}=I_{j,q}^{+}-u_q.$$

(28)

Here, $I_{j,q}^{+}$ is the inventory after adding the newly ready bits and before relay pairing, and $u_q$ is the amount paired across the link inventories at update q.

For end-to-end capacity $B_{\max }$, let $B_q$ be the available application-key buffer before demand $D_q$, and let $A_q$ be the newly released end-to-end key arriving after that demand. Under a demand-before-arrival convention,

$$U_q={[D_q-B_q]}_{+},S_q=\min (D_q,B_q),B_{q+1}=\min \{B_{\max },B_q-S_q+A_q\}.$$

(29)

Here, $S_q$ is the served demand and $U_q$ the unmet demand; overflow is recorded, and queued-demand service, if used instead, requires its own queue state [10,40].

Let $p\left(r\right)$ denote the pass to which relay operation r is assigned and $t_{\mathrm{deadline},p}$ the deadline of pass p. Finite-block yield is attributed to the designated pass even if post-processing finishes later:

$$K_{\mathrm{pass},p}^{\mathrm{gen}}=\sum _{r:p\left(r\right)=p}{u}_r,K_p^{\mathrm{deadline}}=\sum _{r:p\left(r\right)=p}{u}_r\mathbf{1}\{t_{\mathrm{release},r}\le t_{\mathrm{deadline},p}\}.$$

(30)

Thus, $K_{\mathrm{pass},p}^{\mathrm{gen}}$ is the total generated relay key attributed to pass p, whereas $K_p^{\mathrm{deadline}}$ counts only key released by its deadline.

For a fixed observation horizon $\mathcal{Q}$, define

$$\begin{array}{cc}\hfill P_{\mathrm{starve}}& =Pr\left\{\exists q\in \mathcal{Q}:U_q>0\right\},{\mathcal{A}}_{\mathrm{horizon}}=1-P_{\mathrm{starve}},\hfill \\ \hfill {\mathcal{A}}_{\mathrm{request}}& =1-{\displaystyle \frac{{\sum }_{q:D_q>0}\mathbf{1}\{U_q>0\}}{\#\{q:D_q>0\}}}.\hfill \end{array}$$

(31)

Here, ${\mathcal{A}}_{\mathrm{horizon}}$ is the probability of no starvation over the full horizon, whereas ${\mathcal{A}}_{\mathrm{request}}$ is the fraction of demand-bearing updates served without starvation. Neither quantity is identical to optical-transmittance outage. Confidence intervals are reported across independent simulated schedules; zero observed starvation events do not establish zero risk, as discussed quantitatively in Section 7.6.

6.3. Constrained Design and Numerical Evaluation

For each link, the design vector in principle includes

$$\begin{array}{cc}\hfill {\mathbf{x}}_j=(& w_{0,j},a_{\mathrm{r},j},f_{\mathrm{BW},j},{\mu }_j,{\nu }_j,\hfill \\ & p_{\mu ,j},p_{\nu ,j},p_{X,j},N_j^{★}),\hfill \end{array}$$

and hardware may instead be fixed by a terminal design. Let $\mathbf{x}$ collect the design variables across the links and $\mathcal{X}$ denote their feasible design set. For stochastic channel scenarios, the primary design problem is

$$\underset{\mathbf{x}\in \mathcal{X}}{\max }\mathbb{E}\left[K_{\mathrm{pass}}^{\mathrm{gen}}\left(\mathbf{x}\right)\right]\mathrm{subject}\mathrm{to}\mathrm{the}\mathrm{fixed}\sec \mathrm{urity}\mathrm{and}\mathrm{hardware}\mathrm{budgets}.$$

(32)

Zero-key blocks and unsuccessful passes remain in this expectation. Given a selected design and declared initialization policy, buffer sizing is

$$B_{\mathrm{req}}=\inf \left\{B_{\max }\in [0,B_{\mathrm{cap}}]:P_{\mathrm{starve}}(\mathbf{x},B_{\max })\le 1-{\mathcal{A}}_{\mathrm{target}}\right\}.$$

(33)

Here, $B_{\mathrm{cap}}$ is the maximum candidate buffer capacity and ${\mathcal{A}}_{\mathrm{target}}$ is the required horizon availability. An empty feasible set is reported as infeasible. The pulse-budget variable is searched on a discrete grid; continuous variables are optimized with simulated annealing or another stated derivative-free method [26]. Candidates share channel realizations during optimization, after which the selected design is tested on independent realizations to expose selection bias. Coarse-grid and equal-budget random-search baselines separate joint-design gains from search effort; no global optimality or convexity is claimed. Section 7.7 restricts the evaluated design vector to $(\mu ,\nu ,p_X)$ with hardware, processing, and service settings fixed at the values of Table 1.

Before producing results, the implementation checks deterministic limits, extinction units, aperture bounds, PDT normalization and moments, count bookkeeping, finite-key abort rules, authentication reserves, and conservation of bits through both inventories, as summarized in Section 7.1 and listed individually in Table A2 (Appendix C).

7. Simulation Setup and Numerical Results

This section evaluates the trusted-relay architecture under the fixed numerical configuration summarized in Table 1. The comparisons use the same ground location and satellite trajectory while varying the HAP receive radius, HAP elevation mask, and temporal support of the calculation. Unless stated otherwise, results use a 500 km satellite altitude, a 20 km HAP vertically aligned with the ground station, and the full usable contact interval of each link. Confidence intervals quantify integer-count sampling uncertainty within the model; they do not include uncertainty in the assumed hardware or atmospheric parameters.

7.1. Configuration, Comparison Cases, and Numerical Checks

The scenario geometry consists of study assumptions rather than a specific mission. The ground station is located at $25.{29}^{\circ }$N, $51.{53}^{\circ }$E. The satellite follows a circular 500 km orbit with an inclination of $97.4^{\circ }$, typical of a sun-synchronous low-Earth orbit at this altitude. The ground elevation mask is ${20}^{\circ }$, which excludes low-elevation paths with long atmospheric propagation; the reference HAP mask is ${10}^{\circ }$ because the stratospheric terminal lies above most of the dense atmosphere, and the equal-mask cases of Table 2 test the effect of this choice. Optical transmission is modeled at 1550 nm. The GH source operates at 10 MHz, and the satellite source used in the separate SH and SG scenarios operates at 500 MHz. Each usable contact is processed as one predetermined finite-key block (Section 3.3). For every combination of case, link, and visibility, 64 integer-count realizations are generated after averaging the gain and error gain over the Gaussian centroid-displacement distribution (Eq. (18)). Counts are drawn separately in each integration bin i containing $N_i$ pulses. The six accepted detection classes $(X,\mu )$, $(X,\nu )$, $(X,0)$, $(Z,\mu )$, $(Z,\nu )$, $(Z,0)$ and a residual no-detection or basis-mismatch category are drawn jointly from a multinomial distribution with class probabilities $p_b^2{p}_k{Q}_{k,i}$, implemented as sequential conditional binomial draws; the six detection counts are therefore not independent. Conditional on each detection count $n_{b,k,i}$, the error count is binomial with parameters $n_{b,k,i}$ and $H_{k,i}/Q_{k,i}$, where $Q_{k,i}$ and $H_{k,i}$ are the radially averaged gain and error gain of Eq. (18). Bin counts are summed over the contact before finite-key estimation. A zero gain produces zero accepted detections and zero errors. Binomial variates use inversion when $n\min (p,1-p)<10$ and BTRD rejection sampling otherwise.

Table 2 defines the six evaluated cases. A full-contact case uses every link’s own valid interval. A common-window case restricts GH, SH, and SG to their temporal intersection so that the compared keys share the same temporal support. The equal-mask cases set the HAP mask to ${20}^{\circ }$ to separate the effect of the HAP’s lower reference mask from that of its receiver aperture. These controls do not make the two architectures resource-equivalent: the assisted architecture still uses a trusted platform, two QKD links, and additional optical and classical equipment.

For the service experiment, one modeled contact recurs every $T_{\mathrm{orb}}=5668.144$ s, the circular-orbit period at 500 km with the Earth constants of Table 1. The local pass origin is the start of the $[-450,450]$ s geometry span, 450 s before the overhead reference epoch. A first-order Markov chain selects the pass visibility with $P_{ik}=\rho {\delta }_{ik}+(1-\rho ){\pi }_k$, where ${\pi }_k$ are the stationary probabilities of Table 1; the chain starts from a stationary draw and undergoes 100 initialization transitions. GH, SH, and SG share the visibility state of a pass. Conditional on that state, each link independently selects one of its 64 stored integer-count realizations uniformly with replacement. The four requests of a pass occur at $m{T}_{\mathrm{orb}}/4$, $m=1,\dots ,4$, after the pass origin (approximately 1417.036, 2834.072, 4251.108, and 5668.144 s). Link, relay, and application payload inventories start empty after the weather initialization; each hop inventory has a capacity of ${10}^{12}$ bits. The end-to-end demand assigned to one pass is 50%, 90%, 105%, or 130% of the weather-weighted reference/full relay supply and is divided equally among four requests. The same absolute workloads are then applied to every hardware case. Unmet demand is partially served and discarded rather than queued, and generated keys do not expire within the 200-pass horizon.

The full numerical run passed all 40 mandatory numerical and accounting checks (Table A2). These checks are not prescribed by a standard; they were designed for this study to verify internal consistency of the implementation against analytic identities, conservation laws, and declared tolerances. They included probability and count consistency, contact-boundary and Earth-occultation checks, aperture-integral identities, finite-key abort behavior, authentication-reserve nonnegativity, one-time XOR provenance, inventory conservation, PLOB comparisons, time-step refinement, and reproducibility. The maximum detector click-rate–dead-time product was 0.0125, below the imposed 0.05 limit. Reducing the integration step from 5 to 2.5 s changed the reported quantities by at most $3.381\times {10}^{-5}$ in relative terms. A repeated full numerical study reproduced 801,266 numerical values byte-for-byte. These checks support computational consistency; they do not constitute independent physical calibration of the channel model.

7.2. Contact Geometry

Figure 2 shows the reference contact geometry. GH spans the complete $[-450,450]$ s simulation interval, giving a duration of 900 s and $9.0\times {10}^9$ emitted pulses. This duration is the selected simulation span for the vertically aligned ground–HAP pair, rather than a derived finite visibility interval. With the ${10}^{\circ }$ HAP mask, SH is available from $-212.721$ to $212.803$ s, or 425.524 s, containing approximately $2.128\times {10}^{11}$ emitted pulses. The ${20}^{\circ }$ ground mask limits SG to $-146.313$ to $146.352$ s, or 292.665 s, containing approximately $1.463\times {10}^{11}$ pulses.

The longer SH interval therefore arises partly from the lower reference HAP mask. The common-window cases remove that temporal advantage by restricting every link to the same overlap, whereas the equal-mask cases set both satellite-facing receivers to ${20}^{\circ }$. These controls are used below to distinguish contact-time effects from aperture-collection effects.

7.3. Optical Collection and Per-Link Finite-Key Yield

Figure 3 separates the principal terms in the reference link budget. The centered GH collection is high because of its 20 km range, whereas the much longer SH and SG paths are dominated by diffraction, aperture size, and residual pointing displacement. At $V=23$ km, SH experiences little extinction because most of the ray lies above the lower atmospheric layer, but its 0.20 m HAP receiver collects only a small fraction of the incident beam. SG crosses more of the lower atmosphere, although its 0.50 m ground receiver provides greater aperture collection than the reference HAP receiver. Consequently, low atmospheric extinction alone does not guarantee a large finite key.

Figure 3. Reference-hardware link budget and net finite key. (a) Centered Gaussian-aperture collection $T^{\left(0\right)}$, Eq. (5). (b) Atmospheric transmittance at $V=23$ km, Eq. (6). (c) Mean pre-detection optical-channel transmittance ${\eta }_{\mathrm{tx}}{\eta }_{\mathrm{atm}}{\eta }_{\mathrm{rx}}\mathbb{E}\left[T\right]$; detector efficiency and gate acceptance are excluded. (d) Net finite key per pass versus visibility; error bars are 95% Monte Carlo confidence-interval half-widths over 64 integer-count realizations (at most 0.5% of the mean) and are smaller than the markers.

Figure 3. Reference-hardware link budget and net finite key. (a) Centered Gaussian-aperture collection $T^{\left(0\right)}$, Eq. (5). (b) Atmospheric transmittance at $V=23$ km, Eq. (6). (c) Mean pre-detection optical-channel transmittance ${\eta }_{\mathrm{tx}}{\eta }_{\mathrm{atm}}{\eta }_{\mathrm{rx}}\mathbb{E}\left[T\right]$; detector efficiency and gate acceptance are excluded. (d) Net finite key per pass versus visibility; error bars are 95% Monte Carlo confidence-interval half-widths over 64 integer-count realizations (at most 0.5% of the mean) and are smaller than the markers.

The mean aperture-transmittance trajectories in Figure 4 reinforce this interpretation. The reference SH collection remains below that of SG throughout their contacts, while GH has a much larger and nearly constant value. The fixed-width Gaussian centroid-wander surrogate of Section 4.2 produces these means; they should not be interpreted as measured turbulence distributions. When the receiver and detection models are applied, SH becomes the limiting relay hop in the reference configuration, as shown by the net finite-key results in Figure 3(d).

Figure 4. Mean aperture transmittance $\mathbb{E}\left[T\right]$ of the fixed-width Gaussian centroid-displacement surrogate, Eq. (A1), over each reference contact. Dotted lines indicate the arithmetic mean over integration-bin centers for each link. Atmospheric extinction, transmitter and receiver throughput, detector efficiency, and gate acceptance are excluded from this plotted quantity.

Figure 4. Mean aperture transmittance $\mathbb{E}\left[T\right]$ of the fixed-width Gaussian centroid-displacement surrogate, Eq. (A1), over each reference contact. Dotted lines indicate the arithmetic mean over integration-bin centers for each link. Atmospheric extinction, transmitter and receiver throughput, detector efficiency, and gate acceptance are excluded from this plotted quantity.

7.4. Finite-Key Dependence on Emitted Block Size

Figure 5 isolates the finite-size penalty by applying the reference SH receiver model to stationary pre-detection losses of $-20$, $-25$, and $-30$ dB. It is a deterministic expected-count diagnostic (Eq. (18)) rather than a second pass simulation. On the logarithmic grid used in the figure, the first positive plotted key occurs at $4.642\times {10}^9$, $1.468\times {10}^{10}$, and $6.813\times {10}^{10}$ emitted pulses, respectively. The preceding plotted points at $3.162\times {10}^9$, $1.000\times {10}^{10}$, and $4.642\times {10}^{10}$ pulses yield zero key. These pairs bracket the grid-level transition but do not identify an exact analytical break-even threshold.

As the emitted block grows, the secret-key fraction approaches the asymptotic value computed from the same decoy bounds after suppressing statistical deviations and additive finite-security penalties (Eq. (23)). The slower convergence at larger loss reflects the smaller detection sample available for estimating the single-photon contribution and phase error. The largest plotted blocks are included to show convergence and need not fit within the modeled satellite contact; actual pass results use the emitted pulses available in the contact windows reported in Section 7.2.

7.5. End-to-End Relay Yield and the Direct Benchmark

Table 3 gives the weather-weighted net key per pass for all six cases. The reported link keys subtract the nominal 256-bit QKD authentication allocation for the two modeled directions (Eq. (24)). The relay result then pairs unused GH and SH inventories and allocates an additional 128 bits on each hop for the authenticated relay record (Eq. (3)). Because GH is larger than SH in every case, the end-to-end relay yield is effectively set by SH after these small authentication debits.

The reference/full relay produces 13.175 Mbit/pass, compared with 84.185 Mbit/pass for direct SG. It therefore provides 15.65% of the direct yield and falls short by approximately 84.35%. This negative result is consistent across all four visibility categories. As Figure 6(b) shows, the reference relay remains near 13.2 Mbit/pass while SG rises from 59.288 Mbit/pass at 5 km visibility to 95.265 Mbit/pass at 50 km. SH is weakly affected by near-ground visibility in this geometry, but its small reference aperture prevents that atmospheric advantage from becoming an end-to-end key advantage.

Increasing the HAP receive radius from 0.20 to 0.50 m changes the result relative to the modeled direct S→G downlink benchmark. The matched/full relay produces 116.981 Mbit/pass, exceeding the 84.298 Mbit/pass SG downlink by 32.683 Mbit/pass, or 38.77%. It remains above SG at every tested visibility, although its advantage narrows from 57.597 Mbit/pass at 5 km to 21.754 Mbit/pass at 50 km as the direct atmospheric channel improves. The matched/common case still exceeds SG by 29.57%, showing that the reversal is not solely due to the longer SH contact. With a ${20}^{\circ }$ HAP mask, the matched/full relay produces 108.144 Mbit/pass and remains 28.42% above SG. Thus, within the evaluated S→G downlink-comparator model, aperture collection is the principal condition that separates the unsuccessful reference design from the higher-yield matched design. These margins do not establish an advantage over a direct G→S uplink, which is not simulated and requires a separate direction-specific evaluation.

Small variations in the SG estimate among cases do not represent a physical response to the HAP aperture. The direct terminal is unchanged; the variations arise from independent integer-count streams and, in the equal-mask common case, a slightly different common temporal support. The matched/full and matched/equal-mask/full cases use identical GH hardware, contact support, and deterministic channel inputs; their GH means (459.874 and 460.027 Mbit/pass) differ only through the disjoint integer-count substreams used for the two cases.

7.6. Service Availability and Buffer Requirement

The service metric is the probability that at least one of 800 requests is not fully served during a 200-pass schedule (Eq. (31)). A pass’s total demand is divided equally across four requests, and the application buffer begins empty. The latest modeled relay release occurs 903.239 s after the pass origin, before the first request at 1417.0 s, so the selected request schedule tests storage and replenishment rather than waiting for same-pass post-processing. The assumed post-processing time is 2 s per block; relay-record serialization uses 100 Mbit/s plus a fixed 0.05 s overhead (Eqs. (26)–(27)); the serialized record carries $u_r$ payload bits, 2048 metadata bits, and two 128-bit tags, so $T_{\mathrm{R}}=0.05+(u_r+2304)/{10}^8$ s. These values are scenario inputs rather than measured processing benchmarks.

The tested application-buffer capacities are 0, 10, 30, 100, 300, 1000, and 3000 Mbit. For each demand, Table 4 reports the first tested capacity satisfying ${\widehat{P}}_{\mathrm{starve}}\le 0.01$ (Eq. (33)), where ${\widehat{P}}_{\mathrm{starve}}$ is the fraction of 10,000 schedules containing at least one incompletely served request. Selection uses this point estimate; 95% Clopper–Pearson intervals are reported separately, and no interpolation between tested capacities is performed. At 50% of reference supply the selected capacity is 10 Mbit, and at 90% it is 30 Mbit; every selected capacity in Table 4 also recorded zero starved schedules. For zero observed events among 10,000 schedules, the two-sided 95% Clopper–Pearson interval has an upper endpoint of $3.688\times {10}^{-4}$; this is evidence of low modeled risk rather than proof that the population probability is zero.

The 105% and 130% reference workloads exceed the long-term mean reference replenishment. Every reference schedule therefore starves even with the 3000 Mbit tested capacity because the buffer starts empty and cannot correct a sustained supply deficit. The matched relay succeeds under the same absolute demands because those demands were defined from the much smaller reference supply; even the 130% workload is only about 14.6% of the matched/full mean supply. The common 30 Mbit grid result consequently does not imply equal production capacity. At the primary operating point used for the case comparison (90% reference demand and a 100 Mbit buffer), all six cases recorded zero starved schedules.

7.7. Protocol-Parameter Search

The protocol search varies only $(\mu ,\nu ,p_X)$ for the reference/full relay (Eq. (32)). The bounds are $0.10\le \mu \le 0.90$, $0.01\le \nu \le 0.45$, and $0.55\le p_X\le 0.995$, subject to $\nu <\mu$. The intensity-selection probabilities remain fixed at $(0.60,0.30,0.10)$. Simulated annealing [26], an endpoint-inclusive $25\times 25\times 5$ grid, and uniform random search each receive 3125 objective calls. The grid contains 2545 feasible designs and 580 points violating $\nu <\mu$; in all three methods, an infeasible call receives zero objective and counts toward the budget. Random search draws uniformly within the bounds. Annealing starts at $(\mu ,\nu ,p_X)=(0.50,0.10,0.90)$ with temperature $T_c=0.35{\left(0.97\right)}^{c-2}$ at call $c=2,\dots ,3125$. Proposals add independent standard-normal steps scaled by $0.35(\mathbf{u}-\mathbf{l})\sqrt{T_c/0.35}$, where $\mathbf{l}$ and $\mathbf{u}$ are the lower and upper bounds; boundary violations are reflected up to four times and then clipped. A worse objective is accepted with probability $\exp [(J^{\prime }-J)/(T_c\max \left(\right|J_{\mathrm{best}}|,1)\left)\right]$, with J in bits. Their planning objective uses expected counts on a shared, unchanged pair of GH and SH channels. The selected designs are then reevaluated using disjoint integer-count streams.

The simulated-annealing candidate increases the independently reevaluated mean from 13.156 to 17.989 Mbit/pass, a 36.74% gain over the fixed default. Grid and random search obtain 17.983 and 17.974 Mbit/pass, respectively. Their agreement shows that the high-yield region is found consistently within the declared three-dimensional bounds and evaluation budget. The small differences between the three reevaluated values are comparable with their count-realization uncertainty, so the result does not establish that simulated annealing is statistically superior. It also does not prove global optimality or address hardware, service, block-size, or intensity-probability optimization.

7.8. Sensitivity and Design Implications

The one-factor sensitivity calculations use a count stream separate from both the master study and the fixed-default reevaluation of Table 5; their reference baseline is 13.156 Mbit/pass rather than the 13.175 Mbit/pass master estimate. The sensitivity baseline and the Table 5 fixed-default value are distinct estimates that coincide only after rounding. Service results in this subsection use the primary operating point of Section 7.6 (90% reference demand and a 100 Mbit buffer). Figure 7 shows the strongest hardware effect. The relay produces 0.783, 13.156, and 117.002 Mbit/pass for HAP receive radii of 0.10, 0.20, and 0.50 m. These three points bracket a relay–SG crossover. Linear interpolation in ${\log }_{10}\left(a_H\right)$ against the mean of the three sensitivity SG estimates (84.315 Mbit/pass) places the visual crossing near 0.375 m, but that value is neither a simulated design point nor a measured threshold and should not be used as a precise aperture requirement.

Figure 8 compares the remaining sensitivity ranges. Raising the modeled tracking bandwidth $f_{\mathrm{BW}}$ from 50 to 700 Hz changes the relay yield from 1.146 to 22.663 Mbit/pass. Lowering the background radiance from ${10}^{-6}$ to ${10}^{-7}$ W ${\mathrm{m}}^{-2}{\mathrm{sr}}^{-1}{\mathrm{nm}}^{-1}$ raises the relay yield from 13.156 to 19.856 Mbit/pass, whereas ${10}^{-5}$ W ${\mathrm{m}}^{-2}{\mathrm{sr}}^{-1}{\mathrm{nm}}^{-1}$ causes the relay finite-key calculation to abort and yields zero relay key, while SG retains 2.371 Mbit/pass. At the primary operating point, the 0.10 m radius, 50 Hz bandwidth, and ${10}^{-5}$ W ${\mathrm{m}}^{-2}{\mathrm{sr}}^{-1}{\mathrm{nm}}^{-1}$ cases each recorded 10,000 starved schedules out of 10,000. These quantities are assumed design inputs rather than measured properties of the target platform. Pointing-bandwidth changes also alter SG substantially, so a larger absolute relay yield does not by itself imply a larger relative architectural advantage.

Changing $f_{\mathrm{EC}}$ from 1.05 to 1.25 changes the relay yield from 13.938 to 12.515 Mbit/pass. At the upper value, 26 of 10,000 service schedules starve at the primary operating point, giving ${\widehat{P}}_{\mathrm{starve}}=0.0026$ with a 95% interval of approximately $[0.00170,0.00381]$; the declared 0.99 horizon-availability target is nevertheless met. Varying visibility alone from 5 to 50 km changes the reference-relay sensitivity mean only from 13.130 to 13.200 Mbit/pass, with small nonmonotonic differences attributable to count sampling. Weather persistence changes the ordering of visibility states but not their marginal probabilities or mean key by construction. For the selected 90% demand and 100 Mbit buffer, the tested persistence values 0, 0.80, and 0.95 also give the same observed starvation result; this does not show that temporal correlation is unimportant for other buffer and workload settings.

The physical and security checks remained consistent throughout the main case study. Every stored gross finite-key realization was below its per-hop PLOB ceiling (Appendix C). For each link and visibility, the integrated ceiling is $K_{\mathrm{PLOB}}={\sum }_i{N}_i\mathbb{E}[-2{\log }_2(1-{\eta }_{\mathrm{ch},i})]$, counting two polarization modes per emitted pulse, with ${\eta }_{\mathrm{ch}}$ excluding detector efficiency and gate acceptance. The margin $10{\log }_{10}(K_{\mathrm{PLOB}}/{\overline{\ell }}^{\mathrm{QKD}})$, using the mean gross finite key before authentication deductions, has a minimum of approximately 16.00 dB over relay hops, cases, and visibility strata. The assumed 200-pass composable budget gives ${\epsilon }_{\mathrm{life}}=4.004\times {10}^{-10}$, below the declared ${10}^{-9}$ target under the adopted 128-bit authentication profile. Authentication reserves remained nonnegative, link and application inventories conserved bits, and no GH or SH range selected for an XOR release was reused.

8. Discussion and Limitations

8.1. Interpretation of the Main Findings

The results show that placing a trusted receiver above the lower atmosphere does not by itself produce an end-to-end key advantage. In the reference design, SH experiences favorable atmospheric transmission but collects too little optical power at a 0.20 m HAP receive radius. Because every relayed bit consumes one GH bit and one SH bit (Eq. (3)), the large GH inventory cannot compensate for the weak SH inventory. The reference relay consequently produces only 15.65% of the direct SG yield. This outcome is a useful design result: two individually valid QKD links do not create a competitive relay unless their authenticated inventories are balanced at the system level.

The matched-aperture experiment identifies receiver collection as the dominant modeled design variable within the present S→G downlink comparison. With a 0.50 m HAP radius, the relay exceeds the modeled direct S→G downlink by 38.77% under full contacts, 29.57% under the common window, and 28.42% when both satellite-facing links use a ${20}^{\circ }$ mask. The common-window and equal-mask controls show that the reversal persists after removing the principal contact-window and elevation-mask advantages. They do not, however, test propagation-direction effects: a direct G→S uplink is not simulated, and its performance cannot be inferred from the SG downlink results. The benefit remains conditional on all other assumptions, including the deterministic beam width, residual-pointing spectrum, receiver noise, and absence of cloud blockage. The 0.50 m radius also corresponds to a 1.0 m diameter aperture; its mass, volume, structural dynamics, acquisition performance, and compatibility with a particular HAP were not evaluated.

These comparisons should also be interpreted as resource-aware scenarios rather than claims that the assisted and direct architectures use identical equipment. The relay adds a trusted site, two receiving terminals at H, two QKD sessions, authentication reserves, and a classical relay record. The study discloses these additions and compares their resulting key supply, but it does not optimize cost, mass, power, or terminal count. The direct and assisted cases are therefore alternatives under specified resources, not a proof that a HAP provides a free channel improvement.

8.2. From Per-Pass Key Production to Application Service

The buffer experiment connects physical-layer key generation to an application-facing service metric. A positive key per pass is insufficient if requests arrive before keys are released, if authentication reserves prevent payload growth, or if the buffer cannot retain enough material between requests. At the evaluated schedule, relay processing finishes before the first request, so 10–30 Mbit buffers are sufficient for the subcritical reference workloads. Once reference demand exceeds mean replenishment, increasing storage cannot restore uninterrupted service. This behavior is consistent with the inventory equations (Eq. (29)): storage redistributes supply in time but does not create long-term key capacity.

The matched relay succeeds at all four demand levels because those levels are fixed from the reference mean rather than recomputed as percentages of matched supply. This common-workload convention enables a fair service comparison, but it must accompany every interpretation of the matched results. It would be misleading to conclude that a 30 Mbit buffer generally supports 130% of the matched relay’s own supply. Future service studies should evaluate externally motivated traffic traces, variable request sizes, queueing or deferred service, key expiry, multiple daily contacts, and initial-inventory policies.

8.3. Security and Numerical Evidence

The end-to-end claim relies on a trusted HAP. H is an endpoint of both QKD sessions and has sufficient information to reconstruct the relayed key. The external-adversary composition of Eq. (25) and the XOR inventory rules therefore do not protect against an honest-but-curious or malicious HAP. The operational acceptability of this assumption depends on platform ownership, tamper protection, access control, compromise response, and the relationship between platform recovery time and key lifetime. An untrusted-relay objective would require a separately specified architecture, such as measurement-device-independent QKD [22], and a new rate and hardware analysis.

The simulation explicitly debits directional authentication reserves and prevents application and authentication bits from overlapping. This verifies the accounting rules implemented in the ledger. The numerical security budget should nevertheless be read under the declared authentication-resource abstraction. A deployment specification must identify the universal-hash family, maximum authenticated message lengths, tag-mask use, hash-key recycling or refresh conditions, rejected-message handling, and the exact number of authenticated messages represented by each debit. Tag length alone does not determine the complete authentication failure bound or key-consumption rule.

The small Monte Carlo intervals and the 40 passing tests establish internal numerical consistency under the model. They do not measure systematic uncertainty. In particular, the 10,000 service schedules resample from the finite set of 64 conditional key realizations for each link and visibility state; they are not 10,000 independent physical-channel experiments. The PLOB, conservation, refinement, and reproducibility checks are necessary implementation safeguards, while comparison with site measurements or an independently calibrated propagation model remains necessary for physical validation.

8.4. Model Limitations and Future Work

Several assumptions limit the quantitative reach of the results. The optical channel uses a deterministic Gaussian width and a Rayleigh centroid displacement. The baseline atmospheric beam-wander term is set to zero, and the pointing residual is produced from an assumed disturbance and sensor-noise spectrum rather than measurements from the target platform. Scintillation, beam-width and ellipticity fluctuations, adaptive optics, afterpulsing, cloud blockage, precipitation, and weather-dependent radiance are omitted. The four visibility probabilities and the shared baseline radiance are assumed rather than fitted to a site record. The vertically aligned HAP and ground station also create a particularly simple 20 km GH path. A further scope limitation is the direction of the direct benchmark: only the S→G downlink is simulated. A direct G→S uplink requires its own direction-specific propagation, receiver, and finite-key evaluation, so no uplink key yield or relay-over-uplink margin is inferred from the present results.

The temporal service model repeats one idealized contact every orbital period and uses a first-order visibility process between passes. It does not propagate an actual multi-day orbit schedule, model cross-link weather dependence from meteorological data, or generate correlated turbulence and pointing trajectories within a pass. Post-processing time and relay serialization rate are assumed. The availability results further depend on an empty initial buffer, four evenly spaced requests, partial service without backlog, and no key expiry. Changing any of these policies may change the required buffer without changing the optical key yield.

The most useful next step is to replace the placeholder pointing, receiver, processing, and background parameters with measured or vendor-supported values and rerun the same fixed accounting pipeline. Site-specific visibility, cloud, and sky-radiance records should then drive an actual pass schedule, with propagation or calibrated channel samples used to assess scintillation and aperture-coupling uncertainty. Hardware feasibility should be evaluated jointly with aperture diameter, payload mass, power, tracking bandwidth, and structural vibration. On the protocol side, the authentication construction should be instantiated completely, and protocol tuning can be extended to intensity probabilities and block design. These extensions would test whether the conditional aperture advantage and buffer requirements remain credible outside the present simulation assumptions.

9. Conclusions

This study evaluated a trusted HAP relay as an end-to-end key-supply system rather than as two independent optical links, completing the finite-key, authentication, and service-level analysis that our earlier architectural proposal [8] did not include. The framework combines pass-dependent GH, SH, and SG channels with three-intensity finite-key BB84, authentication-resource debits, one-time pairing of unused GH and SH inventories, post-processing and relay-release timing, and application-buffer service. The HAP is an endpoint of both QKD sessions and learns the relayed key; secrecy against a compromised HAP is outside the claim.

The comparison is conditional on receiver collection and on the direct benchmark being the S→G downlink. With the 0.20 m reference HAP receive radius, the full-contact relay yields 13.175 Mbit/pass, only 15.65% of the 84.185 Mbit/pass SG downlink yield. Increasing the HAP radius to 0.50 m raises the full-contact relay yield to 116.981 Mbit/pass, 38.77% above its 84.298 Mbit/pass SG downlink comparator. This percentage therefore characterizes the modeled relay-versus-downlink comparison and does not establish an advantage over a direct G→S uplink. The relay remains above SG in the common-window and equal-mask controls, by 29.57% and 28.42%, respectively, so the reversal is not an artifact of the longer reference HAP contact alone. In the fixed-workload service experiment, a 30 Mbit buffer records no starved schedules for the matched relay across all four demands in 10,000 simulations per operating point. For the reference relay, storage cannot compensate when demand exceeds mean replenishment: no buffer capacity in the tested sweep restores service once the 105% and 130% workloads exceed its mean supply.

Protocol tuning and hardware sensitivity reinforce the same conclusion. An equal-budget protocol search (simulated annealing compared against grid and random-search baselines) over the decoy intensities and basis probability raises the reference/full relay yield by 36.74%, from 13.156 to 17.989 Mbit/pass, yet it remains far below the direct downlink; protocol tuning therefore does not substitute for receive-aperture collection. Among the tested one-factor sensitivity ranges, tracking bandwidth and background radiance have the largest effects after aperture: a 50 Hz bandwidth reduces the reference/full relay to 1.146 Mbit/pass, and a radiance of ${10}^{-5}$ W ${\mathrm{m}}^{-2}{\mathrm{sr}}^{-1}{\mathrm{nm}}^{-1}$ suppresses its finite key entirely.

These findings do not establish a general HAP advantage or deployment readiness. The model omits cloud blockage, calibrated scintillation and beam-shape dynamics, measured pointing and background processes, realistic multi-day pass scheduling, hardware mass and power constraints, and a fully instantiated authentication construction. The direct comparator is deliberately restricted to the S→G downlink. A direct G→S uplink is not simulated, no uplink key yield is inferred from the downlink results, and determining whether the HAP relay retains, loses, or increases its margin relative to a direct uplink requires a separate direction-specific simulation. The trust boundary is likewise fixed by assumption: the HAP is treated as reliably trusted for the duration of the study, and the consequences of a compromised or coerced platform are not modeled.

Future work should therefore calibrate the channel and terminal parameters against published measurement data, incorporate site weather and actual pass schedules, and evaluate HAP payload feasibility for the 0.50 m receive radius, which was sufficient for a relay advantage among the tested values, before rerunning the same accounting pipeline to draw operational conclusions. Within that scope, the result that carries forward independently of any future recalibration is methodological rather than numerical: a positive per-link key rate does not by itself establish a beneficial relay, and an end-to-end evaluation must jointly account for receive-aperture collection, authenticated two-hop inventory pairing, and application-buffer service before a HAP-assisted architecture can be judged against its direct alternative.