Quantum internet protocol for two clients

To obtain our bound, we need to define a general paradigm of two-party communication over the quantum internet (Fig. 1a). In the quantum internet, there are a variety of quantum channels connecting nodes, for example, depending on the lengths of optical channels. This necessitates to generalize the paradigm14,15 of Takeoka et al. for the point-to-point communication, where it has been enough to treat only one optical channel between Alice and Bob. For instance, we need to allow the choice of which channel to use in the next round to depend on the outcomes of LOCC operations in previous rounds, in contrast to the paradigm of Takeoka et al.14,15.

To make this more precise, let us define the most general protocol. We assume that any classical communication over the network is freely usable. Suppose that Alice (A) and Bob (B) call a quantum internet protocol to share a resource for quantum communication, a secret key or quantum entanglement, over the quantum network. Accordingly, the quantum internet protocol determines a subnetwork to supply the resource to Alice and Bob. The subnetwork is characterized by a directed graph G=(V, E) with a set V of vertices and a set E of edges, where the vertices of G represent Alice’s node, Bob’s node and intermediate nodes {Cj} j =1,2,…,n in the subnetwork, that is, V={A, B, C1, C2, …, Cn}, and an edge =v 1 →v 2 ∈E of G for v 1 , v 2 ∈V specifies a quantum channel to send a quantum system from node v 1 to node v 2 in the subnetwork. Then, the most general protocol proceeds in an adaptive manner as follows (cf. Fig. 1b, which exemplifies a linear network with n=4). The protocol starts by preparing the whole system in a separable state and then by using a quantum channel with e 1 ∈E. This is followed by arbitrary LOCC among all the nodes, which gives an outcome k 1 and a quantum state with probability . In the second round, depending on the outcome k 1 , a node may use a quantum channel with , followed by LOCC among all the nodes. This LOCC gives an outcome k 2 and a quantum state with probability . Similarly, in the i-th round, according to the previous outcomes k i−1 :=k i−1 … k 2 k 1 (with k 0 :=1), the protocol may use a quantum channel with , followed by LOCC providing a quantum state with a new outcome k i with probability . After a number of rounds, say after an l-th round, the protocol must present close to a target state in the sense of for >0, from which Alice and Bob can distil secret bits or ebits. After all, the protocol results in presenting secret bits or ebits with probability by using quantum channels , where .

Fundamental limitation on the quantum internet protocol

For the general adaptive quantum internet protocol, our main result is described as follows. Let us divide set V into two disjoint sets, V A including A and V B including B, satisfying V A =V\V B (and V B =V\V A ) (see Fig. 1 for the examples). For given k i , if the protocol uses a quantum channel between a node in V A and a node in V B , we write k i ∈ . For example, k 1 ∈ in Fig. 1b. Then, for any choice of V A (or V B ), the most general protocol has a limitation described by

where g is a continuous function14,38 with the property of and is the squashed entanglement14,15 of channel . This bound is reduced to for →0. The bound (1) is obtained by regarding the general protocol as bipartite communication between V A and V B and by applying the TGW bound to the bipartite one (see Supplementary Note 1 for the proof). Since the bound holds for any choice of V A , the bound shows that the average of the obtained secret bits or ebits is most tightly bounded by the choice of V A minimizing the right-hand side of equation (1). Again, note that our bound (1) is applicable to any quantum network composed of arbitrary quantum channels, in contrast to Pirandola’s one37 with the assumption of the teleportation stretchability for quantum channels.

Application to general linear networks

As an instructive application of the bound (1), we first derive an upper bound for a general linear network as in Fig. 1b, which includes intercity QKD protocols and quantum repeater protocols as special cases. Here the goal of Alice and Bob is to share secret bits or ebits by using a quantum internet protocol with help of intermediate nodes {Cj} j =1,2,…,n . Suppose that the nodes A, C1, C2, …, Cn and B line in order (Fig. 1b), and nearest-neighbouring nodes are connected by quantum channels , respectively. For clarity, if an edge e associated with a quantum channel is v 1 →v 2 or v 2 →v 1 for v 1 , v 2 ∈V, we refer to the edge as v 1 ↔v 2 . Nodes A and B are dubbed C0 and Cn+1, respectively (that is, A=:C0 and B=:Cn+1). Then, as shown in Methods, from equation (1), we obtain a bound for the protocol

where represents the average of function over k l and is the average total number of channel uses. The first term of the right-hand side in this inequality is proportional to the harmonic mean of the squashed entanglement of channels . Also, note that the left-hand side quantity—which is the average obtained secret bits or ebits per average total channel use—is different from Pirandola’s measure37 for the performance (see Methods).

Optimal scaling for intercity QKD and quantum repeaters

To show how good the bound (2) is, let us start by comparing it with the performance of intercity QKD protocols and quantum repeater protocols. For simplicity, suppose that all the nodes {Cj} j =0,1,…,n+1 are located at regular intervals between Alice and Bob separated over distance L and they are connected with optical fibres with transmittance for attenuation length l att and L 0 :=L/(n+1) with each other. Then, all the channels must be the same lossy optical channel with transmittance , for which Takeoka et al.14,15 have already derived an upper bound on the squashed entanglement of the channel. This implies for any j=0, 1, …, n, where the factor 2 in the front comes from the fact that a single use of an optical channel for transmission of an optical pulse corresponds to the sending of two optical modes associated with its polarization degrees of freedom. Then, the bound (2) is reduced to

In particular, this bound shows that the average secret bits or ebits per average total channel use, , are upper bounded by for →0, which is approximated to be 4[(n+1)ln2]−1 for L 0 ≫1. The bound (3) is strong enough to show that the existing intercity QKD protocols and quantum repeater protocols are pretty good in the sense that they have the same scaling with this simple bound.

Let us first compare the bound (3) with the intercity QKD protocols19,20,21. This class of QKD protocols leads to a square root improvement in the secret key rate over conventional QKD schemes (without quantum repeaters) bounded by the TGW bound. Nonetheless, it is implementable21 without the need of matter quantum memories or quantum error correction, which is in a striking contrast to quantum repeaters18,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36. In particular, those intercity QKD protocols are modifications of the measurement-device-independent QKD39 (mdiQKD), and all of them use a single (untrusted) intermediate node C in the middle of communicators Alice and Bob. Node C shares optical channels with Alice and Bob, whose transmittance is described by η L/2 . By using these channels, Alice and Bob send single photons to the node C. Then, using matter quantum memories19,20 or using optical devices alone21, the middle node C performs the Bell measurement only on pairs of photons that have successfully survived the loss during the transmission from Alice and Bob. Since the success of the Bell measurement provides secret bits, the average secret bits of these protocols per total channel use are in the order of the survival probability of photons, that is, η L/2 . However, this is exactly the same scaling of the bound (3), because the bound (3) is proportional to for n=1, →0 and L 0 ≫1. In fact, this is easily confirmed by seeing Fig. 2a. Therefore, it is concluded that the intercity QKD protocols19,20,21 have no scaling gap with the upper bound (3).

Figure 2: Performance and upper bounds of protocols based on linear lossy optical channel networks. The performance is measured in terms of secret bits or ebits per average total channel use, , for the distance L between Alice and Bob. As in Fig. 1b, the protocols use intermediate nodes {C1, C2, …, Cn} connected by optical fibres with transmittance for attenuation length l att =22 km with each other and located at regular intervals, say L 0 =L/(n+1). The solid curves represent achievable performance, while the dashed curves are the upper bounds in equation (3) for the linear network, for various n. In a, we provide the performance of mdiQKD protocols21,39 using only a single intermediate node (n=1) equipped with feasible optical devices. In particular, lines (II) and (IV) represent the all-photonic intercity QKD protocol21 and the original mdiQKD protocol39, respectively. These lines just refer to the performance given in Fig. 3 of ref. 21 (see ref. 21 for the detail of the assumed optical devices). The key rate scales linearly with η L for the mdiQKD39, but it scales linearly with η L/2 for the all-photonic intercity QKD21. We also show our bound (3) for n=1 as line (I) and the TGW bound14 (corresponding to our bound with n=0) as line (III). Comparing lines (I) and (II), we can see that the all-photonic intercity QKD protocol has the same scaling with our bound (3) for n=1. In b, for various n, we provide the performance of the idealized qubit-based quantum repeater protocol, , as solid lines and our bound (3) as dashed curves. We can see that there is essentially no scaling gap between our bound (3) and the idealized qubit-based protocol. Full size image

Next, let us compare the bound (3) with the performance of achievable quantum repeater protocols. Actually, there are many quantum repeater schemes18,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36, depending on the assumed devices of the repeater nodes {C1, C2, …, Cn}. For instance, a protocol assumes repeater nodes equipped with atomic-ensemble quantum memories as well as optical devices18,23. To obtain better scaling, instead of the atomic-ensemble quantum memories, another protocols22,27,28,29,32,34 use matter qubits satisfying35,36 all the criteria given by DiVincenzo40. Moreover, there is even an all-photonic scheme35 that does not use matter quantum memories at all and works by using only optical devices. However, since our aim here is to show the existence of a quantum repeater protocol that has the same scaling with the bound (3) in principle, let us introduce an idealized qubit-based protocol that uses a noiseless quantum computer with the function of the perfect coupling with single photons at each repeater node. This protocol is conceptually simple. But it gives a good lower bound of the secure key rate or the entanglement generation rate in the sense that it has the same scaling behaviour as the bound (3).

In the idealized qubit-based protocol, (i) node Cj (j=0, 1, …, n) begins by producing a single photon, which is in maximally entangled state |Φ+〉=(|0〉|H〉+|1〉|V〉)/ with a qubit of a local quantum computer, where {|H〉, |V〉} is an orthonormal basis for the polarization degrees of freedom of the single photon and {|0〉, |1〉} is a computational basis of the qubit. (ii) Then, the node Cj sends its right-hand-side adjacent node Cj+1 the single photon through the optical fibre with transmittance . (iii) On receiving the photon from the node Cj, the node Cj+1 performs a quantum non-demolition measurement to confirm the successful arrival of the single photon, and announces the measurement outcome to node Cj via a heralding signal. If this quantum non-demolition measurement proves the successful arrival of the single photon, the node Cj+1 transfers the quantum state of the received photon into a qubit of the local quantum computer faithfully, establishing a maximally entangled state between quantum computers in the node Cj and in the node Cj+1. (iv) If the node Cj is informed of the loss of the sent photon in the transmission by the heralding signal from the right-hand-side adjacent node Cj+1, the nodes Cj and Cj+1 repeat steps (i)–(iii). (v) If every node shares a maximally entangled state with the adjacent nodes, all the repeater nodes {C1, C2, …, Cn} apply the Bell measurement to a pair of local qubits that have been entangled with qubits in the adjacent repeater nodes. This gives Alice and Bob a pair of qubits in a maximally entangled state.

Let us estimate the performance of this idealized qubit-based protocol. Since the entanglement generation process (i)–(iii) is repeated until a single photon sent in step (ii) survives over the fibre transmission with transmittance , the average of the number m of channel uses to obtain the entanglement between adjacent nodes in step (iii) is . Hence, the idealized qubit-based protocol presents Alice and Bob a pair of qubits in a maximally entangled state by using times of optical channels in total on average. Therefore, the average secret bits or ebits of the idealized qubit-based protocol per average total channel use is (n+1)−1 , which is exactly the same scaling of the bound (3). This fact is also easily confirmed by seeing Fig. 2b.

Since the existing quantum repeater protocols18,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36 are based on more practical devices than the idealized qubit-based protocol, they would be less efficient than the idealized qubit-based protocol, owing to more imperfections caused by the practical devices. However, there are schemes27,28,29,32,34,35 whose performance is essentially determined by distance L 0 even under the use of such more practical devices similarly to the idealized qubit-based protocol as well as our bound (3). This implies that the quantum repeater protocols27,28,29,32,34,35 have no scaling gap with our bound (3).

Upper bounds for DLCZ-type quantum repeaters

The bound (3) has been shown to be useful for understanding the ultimate performance of intercity QKD protocols and quantum repeater protocols. However, the original bound (2) for the general linear networks should have another fascinating applications beyond the purely lossy optical channel network. To show this, as an example, here we apply our bound to an exponential scaling problem35,41 of the DLCZ-type quantum repeater protocols18,23,24,30 with time-dependent decay of matter quantum memories. This problem was first pointed out by Razavi et al.41 by considering the practice of the matter quantum memories (although the DLCZ scheme was initially introduced23 as a protocol with polynomial scaling by assuming infinite coherence time of atomic-ensemble quantum memories). More precisely, Razavi et al. show that for the matter quantum memory with finite coherence time and no fault-tolerant protection the performance of the DLCZ-type protocols degrades exponentially with , regardless of the used distillation scheme. However, we can obtain a more general and stronger result by using our bound (2). That is, from the bound (2), we can derive ultimate upper bounds on more general DLCZ-type quantum repeater protocols where even any single-shot quantum error correction for the matter quantum memories is allowed to be used in contrast to the paradigm of Razavi et al. Nonetheless, our bounds show that the coherence time of the matter quantum memories should be, at least, larger than 100 μs—which are comparable even with the up-to-date experimental result42 with retaining the coupling efficiency with photons—for enjoying the blessing of the DLCZ-type quantum repeaters.

Although the details can be found in Supplementary Note 2, here we present the main observation used to derive the upper bound for the DLCZ-type schemes. Conventionally, these schemes use the set of repeater nodes {Cj} j=1,2,…,2n+1 —which is composed of source repeater nodes {C2j} j=1,2,…,n and receiver repeater nodes {C2j+1} j=0,1,…,n —between Alice A(=:C0) and Bob B(=:C2n+2), where n=2s−1 for s∈{0, 1, 2, …}. The source repeater nodes and the receiver repeater nodes are located alternately and at regular intervals, and the adjacent source nodes (adjacent receiver nodes) are separated over distance L 0 =L/(n+1). The unique feature of the DLCZ-type schemes is to use only probabilistic Bell measurements not only for the entanglement generation but also for the entanglement swapping, because the schemes adopt their implementation with linear optical elements and photon detectors by respecting the simplicity and practicality18,23,24,30. In particular, the schemes (Supplementary Fig. 1) begin with independent and parallel entanglement generation processes between adjacent source repeater nodes C2j and C2j+2. These are accomplished by performing the Bell measurements at receiver node C2j+1 on pairs of optical pulses—each of which has been entangled with a matter quantum memory—from the adjacent nodes C2j and C2j+2 over lossy optical channels a transmittance η. Then, entangled pairs connecting source repeater nodes separated by 2iL 0 are converted to ones separated by 2i+1L 0 recursively (i=0, 1,…,s−1), until Alice and Bob share entangled pairs. This is done by sequential applications of the entanglement swapping to matter quantum memories in a knockout tournament manner over source repeater nodes {C2j} j=1,2,…,n . Here to perform the entanglement swapping as a step, source repeater node C2j necessitates to receive heralding signals from distant repeater nodes to know which pairs of its own matter quantum memories should be subjected to the Bell measurements for the swapping. Hence, during the time t 2j from the beginning of entanglement generation to the arrival of the heralding signals, this repeater node C2j needs to store entanglement in matter quantum memories with time-dependent decay modelled by a noisy qubit channel . If we also respect the independence of the entanglement generation processes, as well as availability of only single-shot quantum error correction for matter quantum memories, the repeater node C2j can thus be considered to be composed of three nodes , and . Here and are connected to C2j−1 and C2j+1 by the lossy optical channel for the entanglement generation processes, respectively, and they are also linked by the noisy qubit channels to to perform the Bell measurements. Therefore, we can regard the DLCZ-type schemes as protocols working over a linear network (Supplementary Fig. 2) in the spacetime that is composed of vertices V={A, C1, , , , C3, …, B} connected by the lossy optical channels and the noisy qubit channels . Since the minimum required memory time t 2j is determined by the location of the repeater node C2j and the signalling time of the heralding signals, we can derive an upper bound on this linear network from equation (2) by deeming it as living merely in the space, rather than in the spacetime (Supplementary Note 2). Note that this implies that the upper bound may overestimate the performance of the DLCZ-type schemes, because the linear network over the space does not have any restriction43 coming from the arrow of time in contrast to that in the spacetime.

In Fig. 3, we show the upper bounds on the linear network associated with the DLCZ-type quantum repeaters for the applications to the secret-key and entanglement generation between Alice and Bob. The difference between Fig. 3a and Fig. 3b stems from the fact that Alice and Bob need matter quantum memories for the case of the entanglement generation, while they do not for the case of the secret-key generation (see ref. 35 for instance). For the calculation of Fig. 3, the noisy qubit channel for the matter quantum memory is assumed to be modelled by a phase-flip channel with coherence time . In addition, we suppose that the transmittance η of the lossy optical channel is described by with the coupling efficiency η c and the velocity of the heralding signals is equivalent to the speed v of light in optical fibres. Under these conditions, in Fig. 3, the number n associated with the number of repeater nodes is optimized to maximize the upper bounds. The existence of optimal n here—which is in contrast to the case for upper bounds for purely optical channel networks as in Fig. 2—stems from the existence of local errors/loss in the repeater nodes.

Figure 3: Upper bounds for DLCZ-type quantum repeaters with time-dependent memory decay. The performance of the protocols18,23,24,30 is measured in terms of the secret bits or ebits per average total channel use, , for the distance L between Alice and Bob. The protocols use repeater nodes {Cj} j=1,2,…,2n+1 located at regular intervals and connected by optical fibres with transmittance (l att =22 km) with each other, as in Fig. 1b. We assume that the coupling efficiency to the fibres is η c =0.9 and the speed of light in the fibres is v=2.0 × 108 m s−1. The source nodes {C2j} j=1,2,…,n are assumed to be equipped with matter quantum memories with dephasing, whose coherence time is (i) =1.0 × 10−2 s, (ii) =5.0 × 10−3 s, (iii) =2.5 × 10−3 s, (iv) =1.0 × 10−3 s, (v) =5.0 × 10−4 s and (vi) =1.0 × 10−4 s. The upper bounds for the protocols are obtained via being maximized over possible n. In a (In b), we show the upper bounds on the performance of the protocols for the application to QKD (for the application to entanglement distribution), where Alice and Bob do not need (Alice and Bob necessitate) to use matter quantum memories35. In a (In b), the upper bound (vi) is the same scaling of the intercity QKD protocols19,20,21 with the performance in the order of η L/2 (a point-to-point entanglement distribution protocol with the performance in the order of η L ), implying that ≤100 μs spoils the benefit to use the DLCZ-type quantum repeaters. Although these figures indicate that the upper bounds drastically improve with the coherence time (>100 μs), this does not necessarily mean that there is a DLCZ-type scheme with similar performance, owing to the overestimation of the upper bounds. Full size image

Despite these optimistic assumptions, Fig. 3 shows that even the upper bounds on the DLCZ-type quantum repeater schemes decay exponentially with the communication distance L for ≤100 μs, although the threshold is comparable to the achieved coherence time in the up-to-date experiment42. This result may be reasonable by considering35 that the transmission time of the heralding signal over, for example, 100 km is already in the order of 100 μs. Although Fig. 3 indicates that the upper bounds drastically improve with the coherence time (≥100 μs), this does not necessarily mean that there is a DLCZ-type quantum repeater scheme with similar performance, owing to the overestimation of the upper bounds.

Of course, if we are allowed to repeat quantum error correction on the matter quantum memories while waiting for the heralding signals to arrive, then the coherence time of the matter quantum memories is not an issue. However, such a scheme to use such repeated quantum error correction cannot be called anymore the DLCZ-type quantum repeater protocols18,23,24,30 respecting the practical simplicity.