Fundamental rate-loss trade-off for the quantum internet

The quantum internet holds promise for achieving quantum communication—such as quantum teleportation and quantum key distribution (QKD)—freely between any clients all over the globe, as well as for the simulation of the evolution of quantum many-body systems. The most primitive function of the quantum internet is to provide quantum entanglement or a secret key to two points efficiently, by using intermediate nodes connected by optical channels with each other. Here we derive a fundamental rate-loss trade-off for a quantum internet protocol, by generalizing the Takeoka–Guha–Wilde bound to be applicable to any network topology. This trade-off has essentially no scaling gap with the quantum communication efficiencies of protocols known to be indispensable to long-distance quantum communication, such as intercity QKD and quantum repeaters. Our result—putting a practical but general limitation on the quantum internet—enables us to grasp the potential of the future quantum internet.

In the conventional Internet, if a client, Alice, wants to communicate with another client, Bob, an Internet protocol determines the path that the data follows to travel across multiple networks from Alice to Bob.Analogously, in the future, according to a request for performing quantum communication between Alice and Bob, a quantum internet protocol will supply the resources for quantum communication, such as unconditionally secure key and quantum entanglement, to Alice and Bob by utilizing proper intermediate nodes connected by optical fibres with each other [1] [c.f.Fig. 1 (a)].To such an optical network, photon loss in optical fibres is the dominant impediment in general [2].Nonetheless, as long as Alice and Bob are not too far away from each other, say over a couple hundred kilometres, the intermediate nodes would not be necessary, because the current point-to-point quantum communication has already been very efficient as well as ready for practical use [3].Besides, in terms of the communication efficiency for the distance, known schemes [4][5][6][7][8][9][10][11] for the point-to-point links have no scaling gap with a general upper bound on quantum communication capacity and secret key agreement capacity of any memoryless lossy channel (which may or may not be noisy) under the use of unlimited forward and backward classical communication, called Takeoka-Guha-Wilde (TGW) bound [12,13] (see also subsequent important improvements [14,15] to the TGW bound).Hence, there remains not much room to improve those schemes for point-to-point links further.Nevertheless, the point-to-point communication is not efficient enough to achieve the quantum internet.For example, the point-to-point quantum communication over 1,000 km needs to take almost one century to provide just one bit of secure key or one ebit for them under the use of a typical standard telecom optical fibre with loss of about 0.2 dB/km [16].Therefore, for the request from far distant Alice and Bob, the quantum internet necessitates long-distance quantum communication schemes utilizing intermediate nodes, such as intercity QKD protocols [17][18][19] and quantum repeaters [20][21][22][23][24][25][26][27][28][29][30][31][32][33][34].In particular, these schemes would be in greater demand for the quantum internet than the point-to-point quantum communication, analogously to the current Internet where a client communicates with a far distant client via repeater nodes commonly and even unconsciously.Therefore, besides the TGW bound for the point-to-point links, it is important to find out a similarly fundamental and general limitation on the long-distance quantum communication schemes, which results in understanding the full potential of the future quantum internet.However, it remained open to determine this limitation due to the complex nature of those schemes coming from the use of many intermediate nodes as well as a large variety of combinations of different elements such as quantum memories and quantum error correction and of different primitives such as entanglement generation, entanglement swapping and entanglement purification.
The main point of this paper is to present a fundamental and practical limitation on the quantum internet.In particular, we derive rate-loss tradeoffs for any two-party quantum communication-composed of the use of optical fibres connecting nodes as well as arbitrary local operations and unlimited forward and backward (public) classical communication (LOCC)-over the quantum internet, by tailoring the TGW bound to being applicable to any network topology.The key insight is reduction.Given any quantum network (which might be a subnetwork of a quantum internet), Alice's node A and Bob's node B, we can consider any bipartition of the nodes in the quantum network, V A including node A and V B containing node B [c.f.Fig. 1 (a)].By regarding all nodes at V A as local at A and all nodes at V B as local at B-which could never increase the difficulty of quantum communication between A and B, one could reduce any network flow as a flow between a point-to-point link between A and B only.Therefore, an upper bound on the key rate or distillable entanglement for a point-to-point link automatically carries over to an upper bound to the quantum network.As this upper bound for point-to-point links, we simply use the TGW bound [12].Our reduction idea is a simple observation.Nonetheless, rather remarkably, we will show here that the obtained bounds are excellent in the sense that they have no scaling gap with achievable quantum communication efficiencies of known protocols for intercity QKD and quantum repeaters, in terms of rate-loss tradeoffs.This is brought by the fact that our bounds essentially depend only on the number of the channel uses to establish a quantum communication resource for Alice and Bob and the squashed entanglement [12,13] of the used optical channels.
To obtain our bound, we need to define a general paradigm of two-party communication over the quantum internet [c.f.Fig. 1 (a)].In the quantum internet, there are a variety of optical channels connecting nodes, for example depending on those lengths.This necessitates to generalize the paradigm [12,13] of Takeoka et al. for the point-topoint communication where it has been enough to treat only one optical channel between Alice and Bob.For instance, we need to allow the choice of which channel to use in the next round to depend on the outcomes of LOCC operations in previous rounds, in contrast to the paradigm of Takeoka et al. [12,13].
To make this more precise, let us define the general protocol.We assume that any classical communication over the network is freely usable.Suppose that Alice (A) and Bob (B) call a quantum internet protocol to share a resource for quantum communication, unconditionally secure key or quantum entanglement, over the quantum network.Accordingly, the quantum internet protocol determines a subnetwork to supply the resource to Alice and Bob.The subnetwork is characterized by a directed graph G = (V, E) with a set V of vertices and a set E of edges, where the vertices of G represent Alice's node, Bob's node and intermediate nodes {C k } k=1,2,...,n in the subnetwork, i.e., V = {A, B, C 1 , C 2 , . . ., C n }, and an edge to send a quantum system from node v 1 to node v 2 in the subnetwork.Then, the most general protocol proceeds in an adaptive manner as follows [c.f.Fig. 1 (b) which exemplifies a linear network with n = 4].The protocol starts by preparing the whole system in a separable state ρABC 1 C 2 ...C n 1 and then by using a quantum channel N e1 with e 1 ∈ E. This is followed by arbitrary LOCC among all the nodes, which gives an outcome k 1 and a quantum state ρABC 1 C 2 ...C n k1 with probability p k1 .In the second round, depending on the outcome k 1 , a node uses a quantum channel N e k 1 with e k1 ∈ E, followed by LOCC among all the nodes.This LOCC gives an outcome k 2 and a quantum state ρABC 1 C 2 ...C n k2k1 with probability p k2|k1 .Similarly, in the i-th round, according to the previous outcomes , the protocol uses a quantum channel N e k i−1 with e ki−1 ∈ E, followed by LOCC providing a quantum state ρABC 1 C 2 ...C n ki with a new outcome k i with probability p ki|ki−1 .After a finite number of rounds, say after an l-th round, the protocol must present ρAB || 1 ≤ ǫ for ǫ > 0, from which Alice and Bob can distil log 2 d k l secret bits for the purpose of the unconditionally secure communication or log 2 d k l ebits for the purpose of the quantum teleportation.After all, the protocol results in presenting log 2 d k l secret bits or ebits with probability p k l by using quantum channels {N e k i } i=0,1,...,l−1 , where p ki := p ki|ki−1 . . .p k3|k2 p k2|k1 p k1 .
For this general adaptive protocol, our main result is described as follows.Let us divide set V into two disjoint sets, V A including A and V B including B, satisfying Then, for any choice of V A and V B , the most general protocol has a limitation described by where h is the binary entropy function with a property of lim x→0 h(x) = 0 and E sq (N ) is the squashed entanglement of channel N [12,13].This bound is reduced to p ki E sq (N e k i ) for ǫ → 0. The bound (1) is obtained by regarding the general multi-party protocol as bipartite communication between V A and V B and by applying the TGW bound to the bipartite one (see Appendix for the proof).Since the bound holds for any choice of V A , the bound shows that the average of the obtained secret bits or ebits is most tightly bounded by the choice of V A that minimizes the right-hand side of Eq. (1).
As an instructive application of the bound (1), we first derive an upper bound for a linear optical network, which includes intercity QKD protocols and quantum repeater protocols.Here the goal of Alice and Bob, separated over distance L, is to share secret bits or ebits by utilizing intermediate nodes {C j } j=1,...,n .For simplicity, suppose that they are located at regular intervals and connected with optical fibres with transmittance η L0 := e −L0/latt for attenuation length l att and L 0 := L/(n + 1) with each other.Then, since they can use only the same optical channel connecting the adjacent nodes at best, all the channels {N e k i } i=0,1,...,l−1 must be the same lossy channel with transmittance η L0 , for which Takeoka et al. have already derived an upper bound on the squashed entanglement of the channel [12,13].
for any of the channels {N e k i } i=0,1,...,l−1 , where the factor 2 in the front comes from the fact that a single use of an optical channel for transmission of an optical pulse corresponds to the sending of two optical modes associated with its polarization degrees of freedom.Then, the bound (1) is reduced to where f k l k l represents the average of function k l ) of times the optical channel between Alice and node C 1 (between node C n and Bob) is used.Similarly, for the choice of V A = {A, C 1 , . . ., C j } and V B = {C j+1 , . . ., C n , B} for j = 1, 2, . . ., n−1, p ki describes the average number m C j ↔C j+1 k l k l of channel uses between node C j and node C j+1 .Hence, Eq. (2) gives Since In particular, this bound shows that the average secret bits or ebits per channel use, log The bound ( 4) is tight enough to show that the existing intercity QKD protocols and quantum repeater protocols are pretty good in the sense that they have the same scaling with this simple bound.
To show this, let us first compare the bound (4) with the intercity QKD protocols [17][18][19].This class of QKD protocols leads to a square root improvement in the secret key rate over conventional QKD schemes (without quantum repeaters) bounded by the TGW bound.Nonetheless, it can be obtained without the need of matter quantum memories or quantum error correction [19], which is in a striking contrast to quantum repeaters [20][21][22][23][24][25][26][27][28][29][30][31][32][33][34].In particular, those protocols are modifications of the measurement-device-independent QKD (mdiQKD) [35] and all of them use a single untrusted intermediate node C in the middle of communicators Alice and Bob.Node C shares optical channels with Alice and Bob, whose transmittance is described by η L/2 .Then, using matter quantum memories at node C [17,18] or using only optical devices at node C [19], the protocols present a secret bit per about η −1 L/2 uses of optical channels between Alice and node C and between Bob and node C.This implies that the average secret bits of these protocols per channel use are in the order of η L/2 .However, this is exactly the same scaling of the bound (4), because the bound ( 4) is proportional to η L0 = η L/2 for n = 1, ǫ ≃ 0 and L 0 ≫ 1.In fact, this is easily confirmed by seeing Fig. 2 (a).
Next, let us compare the bound (4) with the performance of achievable quantum repeater protocols.Actually, there are many quantum repeater schemes [20][21][22][23][24][25][26][27][28][29][30][31][32][33][34], depending on the assumed devices of the repeater nodes {C 1 , C 2 , . . ., C n }.For instance, a protocol assumes repeater nodes equipped with atomic-ensemble quantum memories as well as optical devices [21,27].To obtain better scaling, instead of the atomic-ensemble quantum memories, another protocols [20,25,26,30,32] use matter qubits satisfying not only DiVincenzo's five criteria for a universal quantum computation but also his extra criterion on the efficient coupling with single photons [36].Moreover, recently, there is even an all-photonic scheme [33] that does not use matter quantum memories at all and works by using only optical devices.However, since our aim here is to show the existence of a quantum repeater protocol that has the same scaling with the bound (4) in principle, let us introduce an idealized qubit-based protocol which uses a noiseless quantum computer with the function of the perfect coupling with single photons at each repeater node.
In the idealized qubit-based protocol, (i) a node X ∈ V except for B begins by producing a single photon which is in maximally entangled state 2 with a qubit of the local quantum computer, where {|H , |V } is an orthonormal basis for the polarization degrees of freedom of the single photon and {|0 , |1 } is a computational basis of the qubit.(ii) Then, the node X except for B sends its right-hand-side adjacent node the single photon through the optical fibre with transmittance η L0 .(iii) On receiving the photon from the left-hand-side adjacent node, the node X except for A performs a quantum non-demolition (QND) measurement to confirm the successful arrival of the single photon, and announces the measurement outcome via a heralding signal.If this QND measurement proves the successful arrival of the single photon, the node X transfers the quantum state of the photon into a qubit of the local quantum computer faithfully, establishing a maximally entangled state between the node X and the left-hand-side adjacent node.(iv) If the node X except for B is informed of the loss of the sent photon in the transmission by the heralding signal from the right-hand-side adjacent node, the node X and its right-hand-side adjacent node repeat steps (i)-(iii).(v) If every node shares a maximally entangled state with the adjacent nodes, all the repeater nodes {C 1 , C 2 , . . ., C n } apply the Bell measurement to a pair of local qubits that have been entangled with qubits in the adjacent repeater nodes.This gives Alice and Bob a pair of qubits in a maximally entangled state.
Let us estimate the performance of this idealized qubit-based protocol.Since the entanglement generation process (i)-(iii) is repeated until a single photon sent in step (ii) survives over the fibre transmission with transmittance η L0 , the average of the number m of the channel uses to obtain the entanglement between adjacent nodes in step (iii) is L0 .If we regard the entanglement generation process (i)-(iii) as a single round of In panel (a), we provide the performance of mdiQKD protocols [19,35] using only a single intermediate node (n = 1) equipped with feasible optical devices.Lines (II) and (IV) represent the all-photonic intercity QKD protocol [19] and the original mdiQKD protocol [35], respectively.These lines just refer to the performance given in Fig. 3 of Ref. [19], where a collection of the state-of-art optical devices such as single-photon sources, active feedforward technique with an optical switch and single-photon detectors is assumed to be used (c.f.[19] for the details).The key rate scales linearly with ηL (i.e., the transmittance over distance L) for the mdiQKD [35], but it scales linearly with the square root of ηL for the all-photonic intercity QKD [19].In addition, we show our general bound (4) for n = 1 as line (I) and the TGW bound [12] (corresponding to our bound with n = 0) as line (III).Comparing lines (I) and (II), we can see that the all-photonic intercity QKD protocol has the same scaling with our general bound (4) for n = 1.
In panel (b), for various n, we provide the performance of the idealized qubit-based quantum repeater protocol introduced in the main text, (n + 1) −1 ηL 0 = (n + 1) −1 η L/(n+1) , as solid lines and our bound (4) as dashed curves.We can see that there is essentially no scaling gap between our bound (4) and the idealized qubit-based protocol.
the protocol and the process is executed between adjacent repeater nodes in parallel independently, the idealized qubit-based protocol should present a pair of qubits in a maximally entangled state for the total number l of the rounds with l = (n + 1)η −1 L0 in a manner arbitrary close to a deterministic process.Therefore, the average secret bits or ebits of the idealized qubit-based protocol per channel use is (n + 1) −1 η L0 , which is exactly the same scaling of the bound (4).This fact is also easily confirmed by seeing Fig. 2 (b).
We have seen that our bound (1) is simple but powerful enough to derive rate-loss tradeoffs (4) with the same scaling with existing intercity QKD protocols and quantum repeaters.Note that we have assumed that the intermediate nodes {C 1 , C 2 , . . ., C n } are located at regular intervals, but this assumption is unnecessary.In particular, similarly to the derivation of Eq. ( 4), from our bound (1), it is not difficult to obtain rate-loss tradeoffs for any linear optical network where the intermediate nodes are not necessarily positioned at regular intervals, and the existing intercity QKD protocols and quantum repeater protocols are still shown to have the same scaling with the tradeoffs.Moreover, if the future quantum internet protocol was programmed to always find out a linear network as the subnetwork G over the quantum internet by using an algorithm for the shortest path problem, our bound for the linear network would help to run the algorithm via determining the weights for all the edges associated with optical channels.This application will also hold even if the quantum internet protocol uses tree networks as the subnetwork G instead of linear networks.More generally, the quantum internet protocol prefers to use a more general network topology as the subnetwork G.Even in this case, our bound is useful to determine the obtainable secret bits or ebits because they are always upper bounded by Eq. ( 1) for the minimum bipartition given by choosing V A and V B properly.
Although we have just considered only the lossy channels as the examples of the applications of our bound (1), this is, of course, not only the case as long as the squashed entanglement of the channel in Eq. ( 1) can be estimated for given channels.Even though in Fig. 2, we have plotted only the results for a linear chain of pure-loss channels, it should be noted that the TGW bound is very general and applies to any memoryless lossy channels (which may or may not be noisy) and, with the observation made in the present paper, to any network topology.While we have employed mainly the TGW bound in our paper, it should be noted that our reduction idea may be useful to derive a good bound for a general network topology from a bound for point-to-point quantum communication generally.We have just begun to grasp full implications of our bound: For instance, its applications to the many-body physics regarded as a quantum network and to a more complicated quantum communication protocol-such as a multi-party protocol like Ref. [39]-will be in a fair way to appear.
We thank S. Guha, S. Pirandola, M. Takeoka and M. M. Wilde for valuable discussions about their papers [12][13][14][15]37].K.A. thanks support from the Project UQCC by the National Institute of Information and Communications Technology.H.-K.L. acknowledges financial support from NSERC and CRC program.
Note added.-During the preparation of this paper, Pirandola uploaded a related paper [37] on the arXiv, based on their recent papers [14,15].Our results do not subsume, nor are they subsumed by the results in Ref. [37].Pirandola assumed that the channels are stretchable whereas we do not make such an assumption [38].On the other hand, for the specific case of a purely lossy channel that is used in generating the simulation results in Fig. 2, Pirandola's result gives a better bound than ours.
Appendix A: Proof for the main result (1) Here we provide the proof for the main result, that is, Eq. ( 1).Although here we focus on deriving the bound (1) for QKD protocols between Alice and Bob, the same technique can be applied for protocols to share entanglement between them, similarly to the TGW bound [12,13].
Suppose that, with the help of other parties {C k } k=1,2,...,n in a quantum network, Alice and Bob share physical systems In particular, Alice and Bob obtain a private state through the following most general adaptive protocol: (i) Alice, Bob and parties {C k } k=1,2,...,n begin by preparing their physical systems H 0 in a separable state ρABC 1 C 2 ...C n

FIG. 1 :
FIG.1:Quantum internet and the most general protocol.Panel (a) depicts a general quantum internet where Alice and Bob request its internet protocol to supply them with the resources for quantum communication, such as unconditionally secure key and quantum entanglement.Accordingly, the quantum internet protocol considers any quantum network G (which might be a quantum subnetwork of a quantum internet) associated with a directed graph G = (V, E).The set V of vertices is composed of the nodes as V = {A, B, C 1 , C 2 , . . ., C n } (n = 9 in this panel) and the set E of edges specifies quantum channels {N e }e∈E in such a way that a quantum channel to send a quantum system from node v1 ∈ V to node v2 ∈ V is represented by N v 1 →v 2 .The quantum internet protocol can combine given quantum channels {N e }e∈E with LOCC arbitrarily, to provide the required resources for Alice and Bob.However, our bound suggests that the obtainable secret bits or ebits are upper bounded by a bound for the point-to-point communication between a single parity having nodes VA ⊂ V with A and another party having VB(= V \ VA) with B. In panel (b), we describe the paradigm of the most general two-party communication protocols, by exemplifying a linear network with n = 4.In the i-th round (i = 1, 2, . . ., l), according to the previous outcomes ki−1 = ki−1 . . .k2k1, the protocol uses a quantum channel N e k i−1 with e k i−1 ∈ E, followed by LOCC providing a quantum state ρABC 1 C 2 ...C n k i

10 FIG. 2 :
FIG.2: Secret bits or ebits per channel use, G k l k l /l with G k l := log 2 d k l , for protocols based on a linear network with total distance L. The protocols use intermediate nodes {C 1 , C 2 , . . ., C n } connected by optical fibres each other and located at regular intervals, say L0 = L/(n + 1).The solid curves represent achievable performance, while the dashed curves are our general upper bounds (4) for the linear network, 2(n + 1) −1 log 2 [(1 + ηL 0 )/(1 − ηL 0 )], for various n.In panel (a), we provide the performance of mdiQKD protocols[19,35] using only a single intermediate node (n = 1) equipped with feasible optical devices.Lines (II) and (IV) represent the all-photonic intercity QKD protocol[19] and the original mdiQKD protocol[35], respectively.These lines just refer to the performance given in Fig.3of Ref.[19], where a collection of the state-of-art optical devices such as single-photon sources, active feedforward technique with an optical switch and single-photon detectors is assumed to be used (c.f.[19] for the details).The key rate scales linearly with ηL (i.e., the transmittance over distance L) for the mdiQKD[35], but it scales linearly with the square root of ηL for the all-photonic intercity QKD[19].In addition, we show our general bound (4) for n = 1 as line (I) and the TGW bound[12] (corresponding to our bound with n = 0) as line (III).Comparing lines (I) and (II), we can see that the all-photonic intercity QKD protocol has the same scaling with our general bound (4) for n = 1.In panel (b), for various n, we provide the performance of the idealized qubit-based quantum repeater protocol introduced in the main text, (n + 1) −1 ηL 0 = (n + 1) −1 η L/(n+1) , as solid lines and our bound (4) as dashed curves.We can see that there is essentially no scaling gap between our bound (4) and the idealized qubit-based protocol.