Linear programs for entanglement and key distribution in the quantum internet

Quantum networks will allow to implement communication tasks beyond the reach of their classical counterparts. A pressing and necessary issue for the design of quantum network protocols is the quantification of the rates at which these tasks can be performed. Here, we propose a simple recipe that yields efficiently computable lower and upper bounds on the maximum achievable rates. For this we make use of the max-flow min-cut theorem and its generalization to multi-commodity flows to obtain linear programs. We exemplify our recipe deriving the linear programs for bipartite settings, settings where multiple pairs of users obtain entanglement in parallel as well as multipartite settings, covering almost all known situations. We also make use of a generalization of the concept of paths between user pairs in a network to Steiner trees spanning a group of users wishing to establish Greenberger-Horne-Zeilinger states. The study of a quantum network becomes particularly challenging in the presence of multiple users that simultaneously access its resources. Using linear programming techniques, this work investigates upper and lower bounds to the communication rates that are achievable by remote users in the network per total number of channel uses.

Quantum entanglement allows for the implementation of communication tasks not possible by classical means.The most prominent examples are quantum key distribution and quantum teleportation between two parties [1][2][3], but there is a host of other tasks also involving more then two parties [4].An example of a protocol using multipartite entanglement is quantum conference key agreement [5], where multiple parties who trust each other need to establish a common key.Another example is quantum secret sharing [6], where multiple parties who do not trust each other wish to encrypt a message in such a way that it can only be decrypted if all parties cooperate.Multipartite entanglement can also be used for the synchronization of a network of clocks [7] and plays an important role in quantum computing [8].Quantum networks allow for the distribution of entanglement as a resource for such tasks among parties, which could, in principle, be spread out across different continents in an efficient manner.Whereas small-scale quantum networks can be designed in such a way that they perform optimally in distributing a particular resource to a particular set of users, a future quantum version of the internet will most likely grow to have a complex structure and involve a number of user pairs, or groups, requiring entangled resources for different tasks in parallel.
Recently, in light of the experimental promise of short-term quantum network deployment, the community has begun to devote attention to communication problems for networks of noisy quantum channels and their general structures.Arguably, the most important one is the computation of the maximum rates at which the different tasks can be performed.Given that, even in the case of point-to-point links, entanglement makes the characterization of capacities notably more complicated than its classical counterpart, with phenomena such as superactivation [9], it was unclear how much it would be possible to borrow from the theory of classical networks.Besides, the usage of a quantum channel is much more expensive than that of its classical counterpart.This motivates the introduction of different capacities which account for resources in different ways.The results of [10,11] introduced the quantum problem and successfully established upper and lower bounds on a capacity of a quantum network which quantifies the maximum size of bipartite maximally entangled states (for quantum teleportation) or private states (for quantum key distribution) per network use, as a generalization of the fundamental/established notion of classical network capacity [12].These upper and lower bounds coincide when the network is composed only of a very relevant class of quantum channels, called distillable channels.The results of [13][14][15] derive analogous bounds, alternatively defining the capacity of a quantum network per total number of channel uses (related with a cost) or per time, rather than per network use, for generality.In any case, rather surprisingly, the series of fundamental works [10,11,[13][14][15] have shown that these capacity of quantum networks for bipartite communication behave similar to that of classical networks.The distribution of bi-and multipartite entanglement in quantum networks has been in considered in a number of other works, including [16][17][18][19][20][21][22].These works differ from [10,11,[13][14][15] in that they are not concerned with networks of general noisy channels.
Namely, given a network of quantum noisy channels and bounds on their capacities satisfying certain properties, one can conceptually construct a classical version of the quantum network where each quantum channel is replaced by a perfect classical channel with a capacity given by the bound on the quantum channel capacity.Then, by considering cuts between two nodes in the induced 'classical' network, it is possible to obtain upper and lower bounds on a capacity of the network for distributing private keys or entanglement between two clients.The same techniques have found application for many user pairs [10,23,24] and for the distribution of multipartite entanglement among multiple users [24,25].While the early work has laid down extremely useful techniques to characterize quantum network capacities, it has either not focused on their computation [13,24] or left open the computability of several of the scenarios considered [11].However, this is rather important in practice, in the sense that the quantum network will be required to serve entanglement resources quickly according to the requests of clients, and, in so doing, efficient estimation of the quantum network capacities is a necessary basis for choosing a proper subnetwork to accomplish that.The goal of this paper is to provide a simple recipe to find such efficiently computable bounds for quantum network capacities.
In this paper, using the approach taken in [13][14][15]24], i.e., defining a network capacity as a rate per the total number of channel uses or per time, we introduce or generalize the capacities for private or quantum communication in the following scenarios: bipartite communication, concurrent communication between multiple user pairs with the objective of (1) maximizing the sum of rates achieved by the user pairs or (2) maximizing the worst-case rate that can be achieved by any pair, as well as multipartite state sharing where the goal is either to distribute Greenberger-Horne-Zeilinger (GHZ) or multipartite private states [5] for a group of network users.We then provide linear-program lower and upper bounds on the all these capacities.The size of the linear programs scales polynomially in the parameters of the network, making it computable in polynomial time by interior point algorithms [26].A central tool deriving In such a network there are many possible communication tasks.Some examples are the distribution of private states, Bell states and Greenberger-Horne-Zeilinger (GHZ) states.The first two are bipartite tasks.We study the implementation of these tasks between a single pair of users, for instance A and I, and between multi-pairs of users in parallel, for instance A and I, C and D and F and H.The last task, the distribution of GHZ states, is a multipartite user scenario, for instance A, B, E, G, I could distill a five-partite GHZ state.
upper bounds in the case of multiple user pairs are approximate min-cut max-flow theorems for multi-commodity flows [27][28][29].Up to a factor of the logarithmic order of the number of user pairs, these results link quantities that occur in the known upper bounds [24], such as the minimum cut ratio (i.e. the smallest ratio of the capacity of a cut and the demand across the cut) and the minimum capacity multicut (i.e. the smallest capacity set of edges whose removal disconnects all user pairs), both of which are NP-hard problems to calculate in general graphs [27,30], to multi-commodity flow maximizations that can be computed by linear programs (LPs).A challenge we address in this work is to find protocols that can achieve the upper bounds.In the bipartite case, protocols involving distillation of Bell pairs across all edges of a network, and entanglement swapping along paths have been used to provide lower bounds on the network capacities [10,11,14].Using such simple routing methods, it was shown in [10,11,14] that the bipartite upper bounds can be achieved for networks consisting of a wide class of channels, known as distillable channels [31], which include erasure channels, dephasing channels, bosonic quantum amplifier channels and lossy optical channels.Here, we extend the bipartite protocol presented in [14] to the case of many user pairs and to the distribution of GHZ states among a set of users.We do so by considering edge-disjoint Steiner trees spanning the set of users.

II. RESULTS
Our base setup is a network of nodes connected by noisy quantum channels (see Fig. 1).The nodes act either as end users or as repeater stations and have the ability to store and process quantum information locally.In addition, all nodes are connected by classical lines of communication, which can be used freely.
We are interested in the possibilities and limitations of quantum networks for different communication tasks and usage scenarios.Fortunately, most tasks of interest can be rephrased as the distribution of an entangled target state among users of the quantum network [32].Here, we consider the distribution of a bipartite entangled target state between a pair of users, of multiple bipartite entangled target states between multiple pairs of users in parallel as well as of a multipartite entangled target state among a group consisting of more than two users.The distribution of these states is known to be equivalent to the problems of quantum information transmission, private classical communication, quantum key distribution and quantum conference key agreement among others.
As we are interested in emergent, organically grown quantum networks, such as the classical internet, we do not make any assumptions on the structure of the network except that it can be described by a finite directed graph.Let the quantum network be given by the directed graph G = (V, E), where V denotes the set of the finite vertices and E the set of the finite directed edges, which represent quantum channels.Each directed edge e ∈ E has tail v ∈ V and head w ∈ V .We also denote e by vw.We can also assign a nonnegative edge capacity [33] c(e) to every edge.
Each edge vw corresponds to a channel N e = N vw with input in v and output in w.We assume that each vertex has the capability to store and process quantum information locally and that all vertices are connected by public lines of classical communication, the use of both of which is considered to be a free resource.Let us assume there is a subset U ⊂ V of the vertices, the users who wish to establish a target state containing the desired resource, whereas the remaining vertices serve as repeater stations.In the following section we will elaborate on the exact form of the target state.
We assume that initially there is no entanglement between any of the vertices.A target state can be distributed by means of an adaptive protocol, consisting of local operations and classical communication (LOCC) among the vertices in the network interleaved by channel uses [10,11,13].In this work we are not concerned with the inner workings of the protocol but describe a protocol only by the total number of channel uses, and usage frequencies of each channel.We describe a protocol as follows: Given upper bounds n e on the average of the number of uses of each channel N e , we define a set of usage frequencies {p e } e∈E of each channel N e as p e := n e /n(≥ 0).Here n can be regarded as time or n with e∈E p e = 1 can be considered to be an upper bound on the average of total channel uses (see [14]).Further, we introduce an error parameter such that after the final round of LOCC a state -close in trace distance to the target state is obtained.Depending on the user scenario, the target state can be a maximally entangled state, a tensor product of multiple maximally entangled states between multiple pairs of users or a GHZ state.By average we mean that parameters of a protocol are averaged over all possible LOCC outcomes.We call such a protocol an (n, , {p e } e∈E ) adaptive protocol.In the asymptotic limit where n → ∞ it then holds n e → ∞ for edge e with p e > 0 while {p e } e∈E remains fixed [14].
Note that whereas quantum channels are directed, the direction does not play a role when we use them to distribute entanglement under the free use of (two-way) classical communication.For example, once a channel has been used to distribute a Bell state, which is invariant under permutations of nodes across the channel.This motivates the introduction of an undirected graph G = (V, E ), where E is obtained from E as follows: For any edge vw ∈ E with wv ∈ E, the directed edges vw and wv are replaced by single undirected edge {vw} (or, equivalently {wv}) with c ({vw}) = c(vw) + c(wv), while, for any edge vw ∈ E with wv / ∈ E, the directed edge vw is replaced by undirected edge {vw} with c ({vw}) = c(vw).For more details about our notations see Supplementary Note 1.
Let us also note that whereas it is common from a quantum information theory point of view to allow for free LOCC operations, there are practical challenges to implement quantum memories with long storage times.By a slight abuse of our notation, however, it is possible to include such effects into our scenario, as well.Namely one could divide a vertex into a pre-and post storage vertex and add an additional noisy channel describing the noisy quantum memory (for instance, see [13]).

A. Bipartite user scenario
In this section we obtain linear-program upper and lower bounds on the entanglement and key generation capacities of a network for bipartite scenarios.While some of the discussion have been made implicitly in earlier results [10,11,14], it is worth giving an explicit formulation here, given its relevance.It will also serve as a good starting point to demonstrate our method and introduce some notation.Let us suppose that the set of users only contains two vertices, s ∈ E, a.k.aAlice, and t ∈ E, also known as Bob.A possible target state could be a maximally entangled state Φ |ii MsMt with log d ebits.We also use the notation In the case of d = 2, this state is called a Bell state.The target state could also be a general private state [34,35], which is of the form MsMt , in the limit n → ∞ and → 0 [maximized over all user frequencies p e ≥ 0 such that e p e = 1].Here k is a vector keeping the track of outcomes of the LOCC rounds and the notation • • • k corresponds to averaging over all LOCC outcomes.Similarly, we define a private network capacity P {pe} e∈E (G, {N e } e∈E ) per time [P(G, {N e } e∈E ) per total channel use] as the largest rate log d (k)  k /n achievable by an adaptive (n, , {p e } e∈E ) protocol such that after n uses the state ρ KsKtSsSt , in the limit n → ∞ and → 0 [maximized over all user frequencies p e ≥ 0 such that e p e = 1].
As the class of private states includes maximally entangled states, the private capacity is an upper bound on the quantum capacity [34,35].Our main results in this section will be efficiently computable upper and lower bounds on .The labels of the edges denote their edge capacities.The edges in dashed lines represent a source-sink cut, i.e. their removal completely disconnects the source from the sink.The capacity of the cut is given by the sum over the edge capacities in the cut, in this case equal to 1, which is the minimum capacity of all source-sink cuts in this network.In other words, the min-cut is equal to 1.Note that the minimizing cut is not unique.(b) Max-flow: By the max-flow min-cut theorem the min-cut is equal to the maximum flow from the source to the sink.Here we have provided an example of a flow from the source to the sink.The labels denote the directed edge flows fe.The flow from the source to the sink achieves the min-cut value of 1.
the private and quantum capacities, respectively.
In a number of recent works upper bounds on private network capacities have been obtained [11,13,15].The main idea behind those results is to assign nonnegative edge capacities to each edge e and to find the minimum edge capacity cut between s and t.By cut between s and t we mean a set of the edges whose removal disconnects s and t.The edge capacity of a cut can be defined as the sum of edge capacities of the edges in the cut.For details see the Methods section.If the edge capacity c(e) of an edge e is given by the usage frequency p e of channel N e , multiplied by an entanglement measure E(N e ) upper bounding the private capacity of N e , which is continuous near the target state and cannot be increased by amortization (see properties P1 and P2 of Ref. [15] or Supplementary Note 2), the minimum edge capacity cut provides an upper bound on the private network capacity.Examples of suitable quantities E(N e ) include the squashed entanglement E sq [36], the max-relative entropy of entanglement E max [37] and, for a particular class of so-called Choi-stretchable channels/teleportation-simulable [31,[38][39][40], the relative entropy of entanglement E R [41] of the channel.If we know such quantities for all channels constituting the network, all that is left to do is finding the minimum edge capacity cut, which is a well known problem in graph theory.However, it is not necessarily efficient to solve this optimization directly, because there is a case where we need to maximize further such a minimized edge capacity.For instance, it is not clear a priori how to maximize over channel frequencies the minimum edge capacity to find the capacity of the network per channel use.To tackle this issue we resort to the duality of the problem.
In particular, using the max-flow min-cut theorem [42,43], we rephrase the problem of finding the minimum edge capacity cut as a network flow maximization problem in the undirected graph G .Thanks to this, it becomes sufficient for us to consider maximization only, in every case.In a network flow maximization problem in an undirected graph, the idea is to assign a variable f vw and f wv to each undirected edge {vw} which can take non-negative values.f vw is interpreted as an abstract flow of some commodity from vertex v to vertex w.As such, it has to fulfill the following constraint: Interpreting the edge capacity c ({vw}) of an undirected edge {vw} as the capacity of its edge to transmit an abstract commodity, we require that the sum of edge flows f vw and f wv does not exceed the edge capacity c ({vw}).We call this the edge capacity constraint.
Having defined a flow of an abstract commodity through an edge, the obvious next step is to consider a flow through the entire network.Namely, we mark two vertices, the source s and the sink t and define a flow from s to t as the sum of all 'outgoing' flows f sv , where v is a vertex adjacent to s, such that for every edge the edge capacity constraint is fulfilled and that for every vertex w / ∈ {s, t} the sum over v of 'incoming' edge flows f vw is equal to the sum over v of 'outgoing' flows f wv , where v are the vertices adjacent to w, which is known as flow conservation constraint.If the graph is undirected, the roles of the source and the sink can be exchanged, without changing the value of the flow.As both the edge capacity and the flow conservation constraint are linear, the maximization of the flow from s to t can be efficiently computed by means of linear programming [44].The max-flow min-cut theorem now states that the minimum edge capacity cut that separates s and t is equal to the maximum flow from s to t. Figure 2 illustrates this with an example.For detailed definitions of cuts, flows and the max-flow min-cut theorem see the Methods section.
Precisely, we use the max-flow min-cut theorem to transform the min-cut upper bounds on the private network capacity given in [15] into an efficiently computable linear program.To do so we define directed edge capacities c(e) = p e E(N e ), for every directed edge e ∈ E. Thus, entanglement takes the role of the abstract commodity considered above.
The interpretation of entanglement as a commodity raises the question if there exists a protocol that can distribute entanglement in a way similar to the flow of a commodity through a network.Ideally, one could construct such a protocol using the edge flows obtained in the flow maximization.To some extend this can be achieved by a quantum routing protocol, such as the aggregated repeater protocol introduced in [14].The aggregated repeater protocol consists of two steps: First each channel is used to distribute Bell states at a rate p e R ↔ (N e ) such that R ↔ (N e ) reaches the quantum capacity Q ↔ (N e ) in the asymptotic limit of many channel uses.This results in a network of Bell states, which can be described by an indirected multigraph, where each edge corresponds to one Bell pair.The second step of the protocol is to find edge-disjoint paths from Alice to Bob and connect them by means of entanglement swapping.The number of Bell pairs is thus equal to the number of edge disjoint paths between Alice and Bob in the Bell network.Hence, in order to obtain a lower bound on the capacity, one would have to find the number of edge disjoint paths in the the multigraph corresponding to the Bell network.
Finding the maximum number of edge-disjoint paths between s and t in a multigraph is the same as maximizing the flow in a graph where the edge capacities are given by the number of parallel edges in the multigraph, however with the additional constraint that each edge flow takes integer values [45].Such an integer flow maximization can no longer be formulated as a LP.Physically, the integer constraint corresponds to the fact that there is no such thing as 'half a Bell state'.Hence, if a LP provides an edge flow of 0.5 for some edge and 1 for another, we cannot translate this into a protocol distributing half a Bell sate over the first edge and one Bell state over the other.What we can do, however, is to multiply all edge flows obtained in the optimization by a factor of 2, and distribute one Bell state along the edge where we have obtained flow 0.5 and two Bell states along the edge where we have obtained 1.For rational edge flows obtained in the optimization and finite graphs, we can always find a large enough number to multiply the edge flows with to obtain integer values associated with each edge that can be translated into a number of Bell pairs distributed along this edge.If the edge flows obtained are real numbers, we can approximate them by rational numbers with arbitrary accuracy.This allows us to compute lower bounds on the quantum network capacities by means of maximizing the flow over a network with edge capacities given by c(e) = p e Q ↔ (N e ), providing us with a lower bounds that can be efficiently computed by linear programming.Finally, we can include an optimization over usage frequencies p e into both LPs, providing us with: Theorem 1 For a network described by a finite directed graph G and an undirected graph G as defined above, the private and quantum network capacities per total channel use, P (G, {N e } e∈E ) and Q (G, {N e } e∈E ), satisfy where f s→t max is given by the linear program Eq. ( 12) in the Methods section.Further, E can be chosen to be the squashed entanglement E sq , the max-relative entropy of entanglement E max and, for a Choi-stretchable channels, the relative entropy of entanglement E R .
For the proof see Supplementary Note 2. As described in the Methods section, the LPs scale polynomially with the size of the network.
Note that for a subset of Choi-stretchable channels, known as distillable channels, which include erasure channels, dephasing channels, bosonic quantum amplifier channels and lossy optical channels, the relative entropy of entanglement of the channel N e (and its Choi state σ e ) is equal to the two-way classical assisted quantum capacity [31], E R (N e ) = E R (σ e ) = Q ↔ (N e ).Hence the bounds in Theorem 1 become tight.

B. Multiple pairs of users
We now move on to the scenario of multiple pairs of users (s 1 , t 1 ), • • • , (s r , t r ) who wish to establish maximally entangled states or private states concurrently, i.e. we have target states of the form This would be a typical scenario in a future 'quantum internet', where a number of user pairs might wish to perform QKD in parallel.In contrast to the bipartite scenario discussed in the previous section, where the goal is to simply optimize the rate at which entanglement is distributed between a user pair, there are a number of different figures of merit in the multi-pair scenario.We define the following three figures of merit: (1) a total multi-pair quantum (private) network capacity Q total (G, {N e } e∈E ) per total channel use [Q total {pe} e∈E (G, {N e } e∈E ) per time] (P total (G, {N e } e∈E ) per total channel use [P total {pe} e∈E (G, {N e } e∈E ) per time]), defined as the largest sum, over all user pairs, of the entanglement distribution rates achievable by an adaptive (n, , {p e } e∈E ) protocol such that after n uses we are -close to the target state, again taking the limit n → ∞ and → 0 [and maximizing over all user frequencies p e ≥ 0 such that e p e = 1].Whereas maximizing the sum of rates is a good approach when the goal is to distribute as much entanglement as possible, it has the drawback that the protocol can be unfair in the sense that some pairs might get more entanglement than others, while some might not get anything at all.This drawback can be overcome by using our second figure of merit: (2) a worst-case multi-pair quantum (private) network capacity Q worst (G, {N e } e∈E ) per total channel use [Q worst {pe} e∈E (G, {N e } e∈E ) per time] (P worst (G, {N e } e∈E ) per total channel use [P worst {pe} e∈E (G, {N e } e∈E ) per time]), i.e. the least entanglement distribution rate that can be achieved by any user pair [by maximizing over all user frequencies p e ≥ 0 with e p e = 1].This approach is good in a scenario where the goal is to distribute entanglement in a fair way, in the sense that the amount of entanglement that each user pair obtains is maximized.Finally we consider (3) the case where we assign weight q i to each user pair (s i , t i ).This approach can be used if user pairs are given different priorities.We call the corresponding figure of merit weighted multi-pair quantum (private) network capacity Q q1,• ) and define it as the largest achievable weighted sum of rates [with maximization over all user frequencies p e ≥ 0 with e p e = 1].We will now present our results for the total and worst-case scenario.For bounds on the weighted multi-pair network capacities see Supplementary Note 3.
Let us begin with scenario (1).As in the bipartite case, we can assign edge capacity c(e) = p e E sq (N e ) to each edge e in the graph corresponding to the network.From [24] we can obtain upper bounds on the total multi-pair private network capacity which are given the minimum capacity multicut.A multicut is defined as a set of edges whose removal disconnects all pairs.The capacity of a multicut is defined by summing over the edge capacities of all edges in the multicut.Whereas this is a straightforward generalization of the problem of finding the minimum capacity cut that separates a single pair, there is no exact generalization of the max-flow min-cut theorem to multicuts.In fact, finding the minimum multicut in a general graph has been shown to be NP-hard [30].
It is however possible to upper bound the minimum multicut by means of a total multi-commodity flow optimization, also known as total multi-commodity flow, up to a factor g t (r) of order O(log r) [29] .A multi-commodity flow is a generalization of a flow to more than one source-sink pair, each exchanging a separate abstract 'commodity'.In order to maximize the total multi-commodity flow one introduces separate edge flow variables f (i) e for each commodity i as well as each edge e and maximizes the sum of flows from s i to t i over all commodities i ∈ {1, ..., r}.In the optimization, one requires that for each commodity i the flow is conserved in all edges except at the corresponding source s i and sink t i , resulting in r separate flow conservation constraints.Thus, it is ensured that for each commodity the net flow leaving the source will reach the corresponding sink.A multi-commodity flow is concurrent if all commodities can be distributed in parallel without exceeding the edge capacities in any edge.In order to ensure this, one adds the constraint that for each undirected edge {vw} the sum of flows of all commodities passing through the edge, wv does not exceed the edge capacity c ({vw}).For details on multicuts and multi-commodity flows and the gaps that separate them see the Methods section.Figure 3 (a) shows an example of a minimum multicut separating all three source-sink pairs pairs.Figure 3 (b) shows a corresponding concurrent multi-commodity flow.The value of the minimum multicut is 3.5, which is equal to the sum of the three source-sink flows.So in this simple example there is no gap.
Applying the aggregated repeater protocol [14] to multiple user pairs and using the same reasoning as in the bipartite case, we also obtain lower bounds in terms of the maximum concurrent multi-commodity flows, providing us with the following efficiently computable bounds: Theorem 2 In a network described by a graph G with associated undirected graph G and a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ), the total multi-pair quantum and private network capacities per total channel use, Q total (G, {N e } e∈E ) and P total (G, {N e } e∈E ), satisfy where f total max is given by the polynomial sized linear program Eq. ( 19) presented in the Methods section and g t (r) is of order O(log r) as described in [29].
For the proof see Supplementary Note 3.
Let us now move on to scenario (2).Let us, again, describe the network by a capacitated graph with edge capacities c(e) = p e E(N e ), where E(N e ) can be chosen to be the squashed entanglement E sq , the max-relative entropy of entanglement E max and, for Choi-stretchable channels, the relative entropy of entanglement E R of the channel.Using the results of [15,24], it is possible to show that the worst-case multi-pair private network capacity is upper bounded by the so-called minimum cut ratio with unit demands of the capacitated graph.Given a (bipartite) cut, which separates the set of vertices into two subsets, the cut ratio is defined as its capacity of the cut, i.e. the sum over edge capacities of the edges, divided by the demand across the cut, in this case the number of pairs separated by the cut.The minimum cut ratio is obtained by a minimization over all bipartite cuts.See Figure 3 (c) for an example of a minimum cut ratio.As for the minimum multicut discussed above, the computation of the minimum cut ratio is an NP hard problem in general graphs [27].(d) Example of a multi-user scenario with source-sink pairs, denoted by the pairs of red, green and blue vertices respectively.(a) A multicut (dashed edges) that separates all three source sink pairs.The capacity of the multicut is equal to 7/2, which is the minimum value possible in this network.(b) A concurrent multi-commodity flow instance, with values 0, 5/2 and 1 for the red, green and blue pairs, respectively.The total multi-commodity flow is hence equal to minimum multicut capacity, however at the price that there is no flow for the red pair.(c) Same network and same edge capacities as in (a), with an example of a bipartite cut, denoted in dashed lines, with capacity 1 that separates two source-sink pairs, the red and the blue ones.Hence its cut ratio is given by 1/2, which is also the minimum cut ratio in this graph.(d) Example of a corresponding multi-commodity flow instance, with concurrent flows of values 1/2, 2 and 1/2 for the red, green and blue source-sink pairs.Hence, the worst-case multi-commodity flow is equal to 1/2, in this case matching the minimum cut ratio.Whereas the flows sum up to 3, which is less than the sum of flows in (b), this multi-commodity flow instance is fairer than the one in (b) as it also provides a flow for the red user pair.
Whereas, as in the case of multicuts, there is no exact version of the max-flow min-cut theorem for the minimum cut ratio, there is again a connection to concurrent multi-commodity flows up to a factor g w (r), which can be of order up to O(log r) [27].Namely, it has been shown that the minimum cut ratio is upper bounded by g w (r) times what we call the maximum worst-case multi-commodity flow, also known as maximum concurrent multi-commodity flow, which corresponds to the maximum flow that can be achieved by any of the commodities concurrently, with respect to the same edge capacity and flow conservation constraints as in the case of the total multi-commodity flow, discussed previously.Figure 3 (d) contains an example of a maximum worst-case multi-commodity flow that achieves the cut ratio in figure 3 (c).Note that this flow is different from the one achieving the minimum multicut in figure 3 (b).In particular it is 'fairer' in the sense that it also provides a flow for the red user pair (s 1 , t 1 ).See the Methods section for a detailed definition of the minimum cut ratio, the worst-case multi-commodity flow and the gap that separates them.
As in the previous scenarios, we can obtain a lower bound by application of the aggregated repeater protocol [14] to multiple user pairs and include an optimization over usage frequencies, resulting in the following result: Theorem 3 In a network described by a graph G with associated undirected graph G and a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ), the worst-case multi-pair quantum and private network capacities per total channel use, Q worst (G, {N e } e∈E ) and P worst (G, {N e } e∈E ), satisfy where f worst max is given by the polynomially sized linear program Eq. ( 21) presented in the Methods section.Further g w (r) is the flow-cut gaps described in the Methods section.E can be chosen to be the squashed entanglement E sq , the max-relative entropy of entanglement E max and, for a Choi-stretchable channels, the relative entropy of entanglement E R .
For the proof, see Supplementary Note 3. As a proof of principle demonstration, we have numerically computed (a) Example of a setting where a group of four user nodes (red, green, blue, yellow) wishes to establish a Greenberger-Horne-Zeilinger (GHZ) state.(a) The graph G with labeled edge capacities.The dashed edges correspond to a minimum Steiner cut with respect to the set of the four users, i.e. it is a smallest capacity cut that separates at least one pair of vertices in the set.In this case it separates the red-blue, green-blue and yellow-blue pairs and has capacity 1/2.In other words, the set of users is 1/2-connected.(b) Part of a flow instance corresponding to linear program (LP) given by Eq. ( 146)-Eq.( 150).
Here the flows from the red, green and yellow vertices to the blue vertex are shown in red, green and yellow, respectively.For simplicity, flows between other nodes are not shown in this picture.The directed edge-flows correspond to the variables f of the LP given by Eq. ( 146)-Eq.( 150).By providing flows of value of at least 1/2 between all pairs in the set of users, the LP shows that the set of users is 1/2-connected.(c) Aggregated Repeater Protocol: Assuming that the edges in (a) correspond to quantum channels (of some direction) and their capacities to non-asymptotic quantum capacities, one could, by using each channel (at most) 6 times, create a network of Bell states that is described by a 3-connected undirected multigraph.(d) Steiner Trees: In our example the multigraph contains two edge-disjoint Steiner trees, depicted in red and green.The Bell pairs forming the Steiner trees can then be connected by means of a generalized entangled swapping protocol to form 2 qubit GHZ states among the four users.
the worst-case and total multi-commodity flows for an example network.See Supplementary Note 5 for details and plots.

C. Multipartite target states
In this section we present our results on the distribution of multipartite entanglement.Let us consider a set of disjoint users S = {s 1 , ..., s l }, who wish to establish a multipartite target state, such as a GHZ state [46 , where σ Ss 1 ...Ss l is an arbitrary state and is a controlled unitary operation.The corresponding multipartite quantum and private network capacities Q S and P S are defined analogously to the bipartite case.As a consequence of [24], the private capacity is upper bounded by the connectivity of the set S of user vertices in the graph capacitated by p e E sq (N e ).By connectivity of the set S we mean the minimum edge capacity cut that separates any two vertices s i and s j (i = j) in S. Such a cut is also known as minimum S-cut or minimum Steiner cut with respect to S. See figure 4 (a) for an example of a minimum Steiner cut with respect to the set of the red, green, blue and yellow nodes.The computation of the connectivity consists of a minimization of all possible disjoint vertex pairs within S as well as a cut minimization.See Eq. ( 31) in the Methods section.Applying the max-flow min cut theorem for every possible pair s i and s j (i = j) in S, we can transform the computation of the connectivity of S into another linear program that upper bounds the multipartite network private capacity.See figure 4 (b) for an example.
Finding a lower bound on the multipartite network quantum capacity, i.e. the maximum rate at which we can distribute a GHZ state among S, is slightly more involved than in the previously considered scenarios.As we did in all previous scenarios, we begin by performing an aggregated repeater protocol to create a network of Bell states that can be described by an undirected multigraph.See figure 4 (c) for an example.Whereas it is possible to create a GHZ state locally in one of the nodes and use chains of Bell pairs to teleport the respective subsystems of the GHZ state to all other nodes in S, it is easy to find a network where this is not the optimal strategy.Instead, the idea is to generalize the concept of paths linking two nodes to Steiner trees spanning the set S of users.In an undirected multigraph, a Steiner tree spanning S, or short S-tree, is an acyclic subgraph that connects all nodes in S. See figure 4 (d) for an example of two edge disjoint Steiner trees spanning the set of the red, green, blue and yellow nodes.See the Methods section for more information on Steiner trees.
A Steiner tree spanning S in the network of (qubit) Bell states can be transformed into a (qubit) GHZ state among all nodes in S by means of a protocol introduced in [20], which can be seen as a generalization of entanglement swapping.Hence, the number of (qubit) GHZ states obtainable from the Bell state network is equal to the number of edge disjoint Steiner trees spanning S. Computing this number is a referred to as a Steiner tree packing, which is anther NP-complete problem [47].However, the number of edge-disjoint Steiner trees in a multigraph can be lower bounded by its S-connectivity up to constant factor 1/2 and an additive constant [48][49][50].Combining this with the max-flow min cut theorem, this allows us to derive a linear-program lower bound on the multipartite quantum network capacity.Hence we obtain the following: Theorem 4 In a network described by a graph G with associated undirected graph G and a scenario of a set S = {s 1 , ..., s r } of users, the quantum and private network capacities per total channel use, Q S (G, {N e } e∈E ) and P S (G, {N e } e∈E ), satisfy where f S max is given by the polynomially sized linear program Eq. ( 37) presented in the Methods section.
For the proof see Supplementary Note 4.

III. DISCUSSION
We have provided linear-program upper and lower bounds on the entanglement and key generation capacities in quantum networks for various user scenarios.We have done so by reducing the corresponding network routing problems to flow optimizations, which can be written as linear programs.The user scenarios we have considered are the distribution of Bell or private states between a single pair of users, the parallel distribution of such states between multi-pairs of users and the distribution of GHZ or multipartite private states among a group of multiple users.The size of the linear programs scales polynomially in the parameters of the networks, and hence the LPs can be computed in polynomial time.In order to perform the LPs, upper and lower bounds on the two-way assisted private or quantum capacities of all the channels constituting the network have to be provided as input parameters.Thus the problem of bounding capacities for the entire network is reduced to bounding capacities of single channels, as well as performing an LP which scales polynomially in the network parameters.
For a large class of practical channels, including erasure channels, dephasing channels, bosonic quantum amplifier channels and lossy optical channels, tight bounds can be obtained in the bipartite case.In the multi-pair case, however, there still remains a gap of order up to log r * between the upper and lower bounds.This gap, also known as flow-cut gap, is due to the lack of an exact max-flow min-cut theorem for multi-commodity flows.From a complexity theory standpoint, the flow-cut gap separates the NP-hard problem of determining the minimum cut ratio from the problem of finding the maximum concurrent multi-commodity flow, which can be done in polynomial time [27].From a network theoretic view the gap also leaves room for a possible advantage of network coding over network routing in undirected networks, which is still an open problem [51,52].Another gap, of value 1/2, occurs between our upper and lower bounds in the multi-pair case.As in the multiple-pair case, this gap is significant in terms of computational complexity, as it separates our polynomial LP from the problem of Steiner tree packing, which is NP-complete [47].
While our linear programs cover an important set of user scenarios and tasks, we believe that our recipe will find broader use.In the bipartite case, we could assign costs to the links and consider the problem of minimizing the total cost for a given set of user demands [53].In the multipartite case, we could apply it to the distribution of multipartite entanglement between multiple groups of users, for which one could leverage results connecting the minimum ratio Steiner cut problem and the Steiner multicut problem with concurrent Steiner flows [54].As another example, beyond network capacities, many algorithms for graph clustering and community detection in complex networks rely on the sparsest cut of graph [55,56].This quantity is bounded from below by the uniform multi-commodity flow problem, which is an instance of our multi-pair entanglement distribution maximizing the worst-case multi-commodity flow, and from above by the same quantity multiplied by a value that scales logarithmically with the number of nodes in the network.Hence, the direct solution of this instance could be used to solve the analogous problem in complex networks where the links are evaluated for their capability to transmit quantum information or private classical information.Although we have focused on a linear program to bound capacities, rather than actual rates in practical scenarios with other imperfections, such as storage limitation or overheads, we believe that our program could be the basis to develop an algorithm to treat such practical scenarios as well.

A. Bipartite user scenario
In this section we will explicitly define all quantities that occur in our result for bipartite user scenarios, Theorem 1, and briefly review the main ingredient in its proof, the max-flow min-cut theorem.Let us begin with the definition of the capacities: The quantum and private network capacities per total channel use that occur in Theorem 1 are defined as where the suprema are over all adaptive (n, , {p e } e∈E ) protocols Λ.Further k = (k 1 , . . ., k n+1 ) is a vector keeping the track of outcomes of the n + 1 LOCC rounds in Λ, the averaging, denoted by the parenthesis ... k , is over all those outcomes and ρ MsMt is the final state of Λ for given outcomes k.Let us discuss the difference between the above quantities and network capacities introduced in [10,11], which consider rates per network use.There are two strategies considered in [10,11], sequential (or single-path) routing and multi-path routing.Both strategies are adaptive in the same sense as defined above, i.e. the channel uses are interleaved by LOCC operations among all nodes, the number of LOCC rounds being equal to the total number of channel uses.
In the case of sequential (or single-path) routing, one use of the network involves usage of channels along a single path from Alice to Bob.The path, and its length, can change with every use of the network.This strategy could correspond to the external provider offering a path for the users (similar to the paradigm of circuit switching networks [57]) instead of allowing the users to precisely determine the usage frequencies of each channel.
In the case of multi-path routing, a flooding strategy is applied, where during each use of the network each channel is used exactly once.Hence the total number of channel uses is given by |E| times the number of network uses.As shown in [10,11], there are examples of networks, such as the so-called diamond network, for which such a strategy provides an advantage over single-path routing.The multi-path scenario could correspond to a private quantum network where the users are willing to use the whole of their resources each clock cycle to implement the desired communication task.
In the present paper, an alternative approach is taken.Instead of considering rates per use of the network, we consider rates per the total number of channel uses.By setting our usage frequencies p e constant for all nodes e ∈ E in the network, we can incorporate the flooding strategy used in the multi-path routing scenario of [10,11].Hence, although phrased with the channel use metric, our results also can be used for the network use metric generalizing the original results in [10,11] to multipartite settings.There is, however, no direct relation between our capacities and the single path capacities.In fact they can differ by a factor O(|E|), which is the order of the number of vertices in the network, as shown in figure 5.
We will now introduce the linear program that provides upper and lower bounds on the capacities Eq. ( 41) and Eq.(40), respectively.Let us consider undirected graph G = (V, E ), as defined at the beginning of the Result section, with edge capacities c ({vw}) for all {vw} ∈ E .We assume that we have two special nodes s, t ∈ V , which we call the source and the sink.As the entanglement across each edge can be used in both directions, we assign two edge flows f wv ≥ 0 and f vw ≥ 0 to each edge {wv} ∈ E , where f wv corresponds to a flow from w to v and f vw to a flow in the opposite direction.
The goal is now to maximize the flow from s to t over the graph G .In order to be a feasible flow, it should not exceed the capacity of each edge.Namely, for each edge {vw} we need Alice Bob 0.5 1 1 1 1 FIG. 5. Per-network-use versus per-channel-use capacities: Simple example of a network, where our capacity Eq. ( 41) can differ arbitrarily from the single-path capacity introduced in [10,11].The numbers refer to capacities of the single channel.When the goal is to maximize the transmission per total number of channel uses, the upper route is preferable.It can achieve a transmission of 0.5 using a single channel, i.e. a rate per channel use of 0.5.The lower route can achieve a transmission of 1 using n (greater than two) channels, i.e. a rate per channel use of 1/n.When the goal is to maximize the transmission per uses of the network over a single path as in [10,11], the lower route is preferable as it can achieve a transmission of 1 per use of the network, whereas the upper route can achieve 0.5.
We also need that for each edge w = s, t v:{vw}∈E which is known as flow conservation.By this flow conservation the flow from s to t is equal to the flow leaving the source minus the flow entering the source, In order to obtain the maximum flow from s to t over the graph G , we need to maximize Eq. ( 9) over edge flows with respect to constraints Eq. ( 7) and Eq. ( 8), which is a linear program: ∀{vw} ∈ E : In Theorem 1, we set the capacities c ({wv}) to where C = Q ↔ for the lower bound and C = E for the upper bound, respectively.In the case where wv ∈ E but vw / ∈ E, we set p vw C(N vw ) = 0. Further we add an optimization over the usage frequencies In the following we will make use of the max-flow min-cut theorem: Given a subset V ⊂ V we define a cut of G as the set If, for given vertices s and t, and a set V s;t ⊂ V , s ∈ V s;t and t ∈ V \ V s;t we call ∂(V s;t ) an st-cut.Let us note that the first and second indices in the subscript of V s;t have different meanings.The minimum st-cut of G is defined as min Vs;t {vw}∈∂(Vs;t) where the minimization is over all V s;t ⊂ V such that s ∈ V s;t and t ∈ V \ V s;t .By the max-flow min-cut theorem [42,58] it holds See figure 2 for an example illustrating the connection between cuts and flows.

B. Multiple pairs of users
In this section we will explicitly define all quantities that occur in our results for multiple pairs of users, Theorems 2 and 3. We also briefly introduce multi-commodity flows and the corresponding generalizations of the max-flow min-cut theorem, which are used in the proofs of Theorems 2 and 3.
We begin by defining a total multi-pair quantum network capacity and a worst-case multi-pair quantum network capacity per total channel use respectively as where the supremum is over all adaptive (n, , {p e } e∈E ) protocols Λ and k = (k 1 , . . ., k m+1 ) is a vector of outcomes of the m + 1 LOCC rounds in Λ, the averaging is over all those outcomes and ρ (n,k) is the final state of Λ for given outcomes k. in Eqs.Eq. ( 74) and Eq. ( 75).
The bounds on Eqs.Eq. ( 74) and Eq.(75) given in Theorems 2 and 3, respectively are in terms of multicommodity flow optimizations, which we will introduce in this section.A flow instance involving multiple sources and sinks s 1 , • • • , s r and t 1 , • • • , t r is known as a multi-commodity flow, each flow f (i) from s i to t i being considered to be a separate commodity.The the maximum total multi-commodity flow is then obtained by maximizing the sum over all single-commodity flows.Generalizing LP Eq. ( 10) accordingly, we obtain the following LP: ∀{vw} ∈ E : Again, we can define Further, the maximum worst-case multi-commodity flow is obtained by adding additional variable f and maximizing f , while demanding that every single-commodity flow is greater or equal to f .Hence f corresponds to the least flow between any source sink pair.This provides us with the following linear program [59]: Again, we can define Next, we will consider generalisations of the max-flow min-cut theorem to multiple source sink pairs: Given source sink pairs (s 1 , t 1 ), • • • , (s r , t r ), one can define a multicut {S} ↔ {T } as a set of edges in E whose removal disconnects all source sink pairs and the capacity of a multicut as the sum over the capacity of its edges {S} ↔ {T }, namely Whereas there is no known exact max-flow minimum cut-ratio theorem in the case of multiple flows, there exists a relation between the minimum multicut and the maximum total multi-commodity flow up to a factor g t (r) that scales as O(log r) [29].Namely it holds An example of the relation Eq. ( 23) is given in figure 3 (a) and (b).In the example g t (r) = 1.In the case of the maximum worst-case multi-commodity flow there exists a similar relation with the minimum cut ratio, which is defined as where the minimization is over (bipartite) cuts ∂V and describes the demand across a cut ∂V .Note that in the case of only one source sink pair the minimum cut ratio Eq. ( 24) reduces to the min-cut Eq. ( 14).Whereas there is no known exact max-flow minimum cut-ratio theorem in the case of multiple flows, there is a relation up to some factor g w (r) [60], An example of the relation Eq. ( 26) is given in figure 3 (c) and (d).In the example g w (r) = 1.The gap g w (r) is known as the flow-cut gap.In [60] it has been shown to be of O(log |E|).This was then improved to O(log r), where r is the number of source sink pairs, in [27,61].In the case of overlapping source and sink vertices, i.e. s i = s j , s i = t j , t i = s j or t i = t j for some i = j, the flow-cut gap has further been improved to O(log r * ), where r * is the size of the smallest set of vertices that contains at least one of such s i or t i for all i = 1, ..., r [28].For a number of particular classes of graphs, it has been shown that the flow-cut gap can even be of O(1) [62][63][64][65][66].

C. Multipartite target states
In this section we will explicitly define all quantities that occur in our result for multipartite target states, Theorem 4. We also briefly introduce the concept of Steiner cuts and Steiner trees, which are used in the proof of Theorem 4.
Again, we begin with the definition of the capacities: Given a set S ⊂ V of users that wish to establish a GHZ or multipartite private state, the multipartite quantum and private network capacities are defined as where the suprema are over all adaptive (n, , {p e } e∈E ) protocols Λ.As the class of multipartite private states includes GHZ states, the multipartite private capacity is an upper bound on the multipartite quantum capacity.Let us mow introduce the concept of Steiner cuts and Steiner trees: For a subset S ⊂ V of vertices in G we define a Steiner cut with respect to S, in short S-cut, as a cut ∂(V S ) with respect to a set V S ⊂ V such that there is at least one pair of vertices s i , s j ∈ S with s i ∈ V S and s j ∈ V \ V S .When considering a minimization of the capacity over all S-cuts, we can divide the minimization into a minimization over pairs of vertices in S and a minimization over cuts separating the pairs, min where min V S is a minimization over all V S ⊂ V such that there is at least one pair of vertices s i , s j ∈ S with s i ∈ V S and s j ∈ V \ V S .Further min Vs i ;s j is a minimization over all V si;sj ⊂ V such that s i ∈ V si;sj and s j ∈ V \ V si;sj .Note that, as min si,sj ∈S,si =sj min Vs i ;s j {vw}∈∂(Vs i ;s j ) c ({vw}) does not depend on the order, we can, without loss of generality restrict to disjoint s i and s j with j > i, reducing the number of resources needed in the outer minimization.We can then apply the max-flow min-cut theorem Eq. ( 15) to the inner minimization, min si,sj ∈S,si =sj min where f si→sj max (G , {c ({wv})} {wv}∈E ) is given by LP Eq. (10).As there are finitely many disjoint s i , s j -pairs in S, we could solve f si→sj max (G , {c ({wv})} {wv}∈E ) for every pair and then find the smallest solution.A more efficient way is to introduce flow variables f (ij) e for every disjoint s i , s j -pair (and every edge) and maximize a slack variable f , while requiring the flow value for every s i , s j -pair to be greater or equal than f and all other constraints of LP Eq. ( 10) to be fulfilled for every disjoint s i , s j -pair: min si,sj ∈S,si =sj j>i where Adding a maximization over usage frequencies, we obtain It will be convenient to introduce an undirected multigraph G c , by replacing each edge {vw} ∈ E with c ({vw}) identical edges with unit-capacity connecting v and w.An S-cut in an undirected unit-capacity multigraph G is defined as a set of edges whose removal disconnects at least two vertices in S. The size λ S (G ) of the minimum S-cut in G is called the S-connectivity of G .
In G we can also define a Steiner tree spanning S, in short S-tree, as a subgraph of G that contains all vertices in S and is a tree, i.e. does not contain any cycles.If S only consists of two vertices, we call an S-tree a path.We call two Steiner trees edge-disjoint, if they do not contain a common edge.The problem of finding the number t S (G ) of edge-disjoint Steiner trees in a general undirected multigraph is NP-complete [47].However, there is a connection between S-connectivity and the number of edge-disjoint S-trees in an undirected unit-capacity multigraph [48][49][50]: In [48] it has been conjectured that Eq. ( 38) holds for g 1 = 1 2 and g 2 = 0.In [49] it has been shown that the relation holds for g 1 = 1  26 and g 2 = 0, whereas the authors of [50] show that it holds for g 1 = 1 2 and g 2 = |V \S| 2 + 1, which is finite in the graphs we are considering.

D. On complexity
Let us briefly discuss the computational complexity of our linear programs Eq. ( 12), Eq. ( 19), Eq. ( 21) and Eq.(37).Using interior point methods, e.g.[26], a linear program in standard form min c T x (39) , can be solved using O( √ N L) iterations and O(N 3 L) total arithmetic operations.Here L is the size of the problem data, A, b, c, which scales as O(M N + M + N ) [67].If we assume A to be of full rank, it holds M ≤ N , and hence, L scales as O(N 2 ).Using slack variables [26], all inequality constraints in our linear programs can be converted into equality constraints.Linear equality constraints can be easily written in the form Ax = b.Hence N can be obtained by adding the number of variables and the number of inequality constraints in our linear programs.
For LP Eq. ( 12 for LP Eq. (37).Hence, all our linear programs, the number of iterations as well as the number of total arithmetic operations scale polynomially with the size of the network.

A. Preliminaries
Let a quantum network be given by a directed graph G = (V, E), where V denotes the set of the finite vertices and E the set of the finite directed edges, which represent quantum channels.Each directed edge e ∈ E has tail v ∈ V and head w ∈ V .We also denote e by vw.N e = N vw corresponds to a channel with input in v and output in w.We can also assign graph theoretic capacity functions c : E → R + 0 to each edge.We assume that each vertex has the capability to store and process quantum information locally and that all vertices are connected by public lines of classical communication, the use of both of which is considered to be a free resource.Let us assume there is a subset U ⊂ V of the vertices, the users who wish to establish a target state θ containing the desired resource, whereas the remaining vertices serve as repeater stations.In the following section we will elaborate on the exact form of θ.
We assume that initially there is no entanglement between any of the vertices.In order to obtain θ, all vertices apply an adaptive protocol consisting of (generally probabilistic) local operations and classical communications (LOCC) among the nodes in the network interleaved by channel uses.In particular, during each round of LOCC it is determined which channel is used next and which state is inserted into the channel [10,13].We describe a protocol by given upper bound n e on the average of the number of uses of each channel N e , which is associated with a set of usage frequencies {p e } e∈E , where p e := n e /n(≥ 0) of each channel N e for a single parameter n which can be regarded as time or an upper bound on the average of total channel uses with e∈E p e = 1 (see [14]), and an error parameter such that after the final round of LOCC a state -close in trace distance to θ is obtained.By average we mean that parameters of a protocol are averaged over all possible LOCC outcomes.We call such a protocol an (n, , {p e } e∈E ) adaptive protocol.In the asymptotic limit where n → ∞ it then holds n e → ∞ for edge e with p e > 0 while {p e } e∈E remains fixed [14].
Note that whereas quantum channels are directed, the direction does not play a role when we use them to distribute entanglement under the free use of (two-way) classical communication.For example, if a channel is used to distribute a Bell state, it is invariant under permutations of nodes across the channel.This motivates the introduction of an undirected graph G = (V, E ), where E is obtained from E as follows: For any edge vw ∈ E with wv ∈ E, the directed edges vw and wv are replaced by single undirected edge {vw} (or, equivalently {wv}) with c ({vw}) = c(vw) + c(wv), while, for any edge vw ∈ E with wv / ∈ E, the directed edge vw is replaced by undirected edge {vw} with c ({vw}) = c(vw).
In order to describe networks consisting only of Bell states, it will also be convenient to introduce an undirected unit-capacity multigraph G c = (V, E c ), which we derive from G by replacing every edge {vw} in G by c ({vw}) unit-capacity undirected edges linking v and w.See Supplementary Figure 6 for an example of the various graphs.

B. Bipartite user scenario
Let us suppose that the set U of users only contains two vertices, s ∈ E, called Alice, and t ∈ E, called Bob.We can now define a network capacity with respect to target state θ with fixed average usage frequencies {p e } e∈E as the maximum asymptotic average rate at which we can obtain the target state by means of adaptive operations, where the supremum is over all adaptive (n, , {p e } e∈E ) protocols Λ.Further k = (k 1 , . . ., k m+1 ) is a vector keeping track of outcomes of the m + 1 LOCC rounds in Λ, the averaging, denoted by the parenthesis ... k , is over all those outcomes and ρ XsXt is the final state of Λ for given outcomes k.A more general quantity will be the network capacity with respect to target state θ, which is obtained by maximizing Supplementary Equation ( 40) over the usage frequencies, If the target is a maximally entangled state Φ d MsMt , we refer to Supplementary Equations ( 40) and ( 41) as quantum capacities of the network, while if it is a private state γ d KsSsKtSt , we refer to them as private capacities of the network.Respectively, we also use the notation Q := C Φ and P := C γ .
Let us discuss the qualitative difference between the capacities given by Supplementary Equations ( 40) and ( 41).In the first scenario of Supplementary Equation (40), the channel frequencies are fixed.In this case the optimization task reduces to finding the protocol that achieves the largest rate per channel use while using the channels with the given frequencies.This could be, in practice, related with the rate of entanglement distribution per time n.In particular, in this scenario, p e represents how frequently the use of channel N e occurs for a given time n.In the scenario of Supplementary Equation ( 41), on the other hand, we allow the users to choose the frequency usage with e∈E p e = 1 for maximizing the rate at which the desired communication task can be performed.This would be meaningful whenever we want to minimize the total channel uses n = e n e to obtain one resource state.The number n of channel uses could be related with a cost (or usage fee), which has to be minimized.Note that, the solution for Supplementary Equation ( 41) is always achieved by a single path of repeaters with (in general) different frequencies on the path.Both scenarios could correspond to the implementation of a communication task over a quantum network that belongs to an external provider who charges per time or number of channel uses.

Upper bounding the capacity
We will now show that the capacities given by Supplementary Equations ( 40) and ( 41) can be upper bounded by linear programs.In [15], it has been shown that with any bipartite entanglement measure E that satisfies the properties 1. if ρ AB − θ d AB 1 = , there exist real functions f and g, satisfying lim →0 f ( ) = 0 and lim →0 g( where E(N ) = max ρ AA E(N A →B (ρ AA )), i.e.E cannot be increased by amortization [68], it is possible to upper bound the fixed usage frequencies the capacity given by Supplementary Equation ( 40) as follows: where the minimization is over all V s;t ⊂ V such that s ∈ V s;t and t ∈ V \ V s;t , and ∂(V s;t ) is an st-cut as defined in equations ( 13)-( 14) of the Methods section.In the case of private states, entanglement measures satisfying properties 1 and 2 include the squashed entanglement E sq [69][70][71], the max-relative entropy of entanglement E max [72] and, for a teleportation simulable/Choi-stretchable channels [31,[38][39][40], the relative entropy of entanglement E R [31,35].
Using the max-flow min-cut theorem (see the Methods sections for details), the question of finding an upper bound on the network capacity is reduced to analyzing the entangling properties of single channels combined with finding the maximum flow from s to t in the graph G , which can be formulated as a linear program (LP) of the form ∀{vw} ∈ E : where the maximization is over edge flows f vw ≥ 0 and f wv ≥ 0 for all edges {vw} ∈ E and c ({wv}) denotes an edge capacity of edge {wv}.Let us discuss the the LP given by Supplementary Equations ( 44)-( 46) in detail: The objective in Supplementary Equation ( 44) is the net sum of all outgoing flow at the source s.Namely, we maximize the sum over all vertices v, that are adjacent to the source vertex s, of the differences between the corresponding outgoing flows f sv and incoming flows f vs .The constraint given by Supplementary Equation ( 45) is the capacity constraint.Namely, for every undirected edge {vw} the sum of flows that pass through the edge in both directions have to be less than the capacity.The constraint given by Supplementary Equation ( 46) is the edge flow conservation constraint, ensuring that for every vertex other than the source or sink the sum of outgoing all flows is equal to the sum of all incoming flows.Because of the constraint given by Supplementary Equation ( 46), the net sum of outgoing flow at the source is equal to the flow from source to sink.Let us now set the edge capacities to c ({wv}) = c E ({wv}, p vw , p wv ) := p wv E(N wv ) + p vw E(N vw ), (47) for all {vw} ∈ E , where p vw E(N vw ) = 0 if vw / ∈ E. Note that Supplementary Equation ( 47) is a linear function in p vw and p wv .Hence, we can formulate the following result: Proposition 1 For any entanglement measure E satisfying properties 1 and 2, it holds In order to upper bound capacities of the form of Supplementary Equation ( 41), we can include an optimization over all usage frequencies p e into the optimization given by Supplementary Equations ( 44)- (46).To this end we treat the p e as variables, define and obtain Corollary 1 For a network described by a finite directed graph G and an undirected graph G as defined above, it holds for any entanglement measure E satisfying properties 1 and 2.

Lower bounding the capacity
For the lower bound, we set the edge capacities in the LP given by Supplementary Equations ( 44)- (46) to for all {vw} ∈ E , where p vw Q ↔ (N vw ) = 0 if vw / ∈ E. We can now show Proposition 2 For a network described by a finite directed graph G = (E, V ) it holds where G is defined above.
For distillable channels, which is a subclass of Choi-stretchable channels, it has been shown that

Hence combining Proposition 1 and Proposition 2 provides
Corollary 2 For a network described by a finite directed graph G = (E, V ) with distillable channels N e for e ∈ E it holds Before proving Proposition 2, we need to define a directed path from s to t in G as In a finite graph with nonzero flow f s→t , obtained from a solution {f vw , f wv } {vw}∈E of the LP given by Supplementary Equations ( 44)-( 46), we can always find a finite number N of paths P (1) s→t , ..., P s→t whose flow consists of path-flows f (1) , ..., f (N ) such that f s→t = N i=1 f (i) [43][73].It will be convenient to define for every path s→t and every edge vw ∈ E the quantity Note that an edge vw can be part of more than one paths.The sum of path-flows passing through the edge, however, has to be upper bounded by the edge flow f vw .Hence it holds The edge flow f vw , in turn, is constraint by the capacity the constraint given by Supplementary Equation ( 45) [43].If all f (i) take integer values, there exist f s→t = N i=1 f (i) edge-disjoint paths from s to t in the multigraph G c .We can now show: Lemma 1 Let us assume we have a finite undirected graph G and N the number of directed paths from s to t.Let k, m ∈ N and c ({vw}) capacities that can depend on m and k.Then we can obtain, in the unit-capacity multigraph G mkN c , F s→t edge-disjoint paths from s to t, where Proof.Let m, k ∈ N and {f vw } {vw}∈E be the set of edge flows maximizing the LP given by Supplementary Equations ( 44)-( 46) for G for capacities c ({vw}), which can depend on m and k.In particular all {f vw } {vw}∈E can depend on m and k.As G is finite, we can always find a finite number N of directed paths P s→t from s to t.For each path we can assign a path-flow [43].By Supplementary Equation ( 56) it holds for every edge {vw} ∈ E that vw is defined by Supplementary Equation (55) and Then for each f (i) ≥ 0 there exists n(i) ∈ N 0 such that Let us also define As the f vw are feasible solutions of the LP given by Supplementary Equations ( 44)- (46), from Supplementary Equations ( 58) and ( 59) it holds for any edge {vw} ∈ E that and for all w ∈ V with w = s, t that v:{vw}∈E To see the last equality, let us consider a path P s→t .If the path does not pass through vertex w, δ(i, vw) and δ(i, vw) vanish for all vertices v. Since w = s, t, if the path does pass through w, there will be two distinct vertices v 0 and v 1 such that δ(i, v 0 w) = 1 and δ(i, wv 1 ) = 1.By definition, the path can only pass through w once, and hence δ(i, vw) vanishes for all v = v 0,1 .Hence v:{vw}∈E (δ(i, vw) − δ(i, wv)) = 0 for every i and w = s, t.
Hence, {F vw } {wv}∈E is a feasible solution of the LP given by Supplementary Equations ( 44)-( 46) with capacities mkN c ({vw}) , providing a total flow of As any integer flow of value F (i) corresponds to F (i) edge-disjoint paths in G mkN c , we can conclude that there are F s→t edge-disjoint paths from s to t.
In order to prove Proposition 2, we will now show that, given the solution of the LP given by Supplementary Equations ( 44)-( 46), we can physically construct a network of Bell states corresponding to a graph where we can apply Lemma 1. Proof.(of Proposition 2) Let k, m ∈ N. Let G be the graph as defined above and N the number of directed paths P (i) s→t from s to t.Without loss of generality we can assume N ≥ 1.Following [14], we can employ the following aggregated repeater protocol : Across each channel N e , we perform Bell state generation protocols assisted two-way classical communication, using the channel mkN p e times.This provides us with states ρ e across e such that ρ e − Φ + e ⊗ mkN pe R ↔ (N e ) 1 ≤ , where Φ + e := Φ 2 Φ 2 e is a maximally entangled state across e and R ↔ (N e ) denotes the rate at which Bell states are generated across edge e with some error > 0. Hence for the entire network we have It further holds for any e ∈ E with p e > 0 and any k ≥ 1 that where we have defined m := max e∈E,pe>0 where we have defined c R ↔ by Supplementary Equation (47) with c(vw) = R ↔ (N vw ).Let us note that R ↔ (N vw ) can depend on m and k.By Lemma 1 there exist edge-disjoint paths from s to t in G (m− m)kN c R ↔ .Each edge-disjoint path corresponds to a chain of Bell states from s to t.By means of entanglement swapping, we can connect these chains, providing us with a rate of entanglement generation between s and t of Taking the limit of m → ∞ followed by the limit of → 0, it holds lim Note that the two-way assisted quantum capacities Q ↔ (N e ) no longer depend on m and k.Using the fact that the optimal value of the objective of a parametric linear program of the form of Supplementary Equations ( 44)-( 46) is a continuous function of the parameters [74], we can see that Taking the limit k → ∞ finishes the proof.In order to lower bound capacities of the form of Supplementary Equation ( 41), we can again include an optimization over all usage frequencies p e into the optimization given by Supplementary Equations ( 44)-( 46), defining Then we have the following: Corollary 3 For a network described by a finite directed graph G and an undirected graph G as defined above, it holds Hence, for distillable channels it holds

C. Multiple pairs of users
We now move on to the scenario of multi-pairs of users s 1 • • • s r and t 1 • • • t r who wish to establish maximally entangled states or private states concurrently.In this scenario the target state is of the form . The states θ di Xs i Xt i can be maximally entangled states or private states.There are several ways to measure the performance of a protocol performing concurrent entanglement distribution.We consider the following three figures of merit: (1) the total multi-pair capacity, i.e. the sum of achievable rates over all user pairs.The drawback of this approach is that it does not distinguish between fair protocols where each user pair gets a similar amount of the resource and unfair ones where some user pairs get more then others.This drawback can be overcome by using our second figure of merit: (2) worst-case multi-pair capacity, i.e. the least achievable rate that is guaranteed for any user pair.Finally we consider (3) the case where we assign weights to each user pair independently.
For case (1), we define the total multi-pair network capacity with respect to target state where, again, the supremum is over all adaptive (n, , {p e } e∈E ) protocols Λ and k = (k 1 , . . ., k m+1 ) is a vector of outcomes of the m + 1 LOCC rounds in Λ, the averaging is over all those outcomes and ρ (n,k) Xs 1 Xt 1 ...Xs r Xt r is the final state of Λ for given outcomes k.For case (2), we define the worst-case multi-pair network capacity with respect to target state θ d1•••dr Xs 1 Xt 1 •••Xs r Xt r with fixed average usage frequencies {p e } e∈E as In scenario (3), where some user pairs are more important than others, we can also assign nonnegative weights q 1 , • • • , q r , with i q i = 1, to user pairs (s 1 , t 1 ), • • • , (s r , t r ) and define a weighted multi-pair network capacity as ≤ .
(76) In the case where q i = 1/r for all i = 1, ..., r, Supplementary Equation ( 76) reduces to Supplementary Equation ( 74), up to a normalization factor.Again, we can optimize over usage frequencies as If the target state is a product of maximally entangled (or private) states, we use the notation C i Φi = Q (or C i γi = P) and speak of quantum (or private) multi-pair network capacities.

Upper bounding the capacity
Several upper bounds on various multi-user pair capacities have been obtained [10,13,24].In particular it follows as a special case of Theorem 2 in [24] (and also from equation ( 4) in [13]) that for an (m, , {p e } e∈E ) key generation protocol, it holds for every where b > 0, g( ) → 0 as → 0 and where × denotes a cartesian product.Using the same reasoning as in [13], it is also possible to extend the results of [15] to the multi-pair case, which includes the bound given by Supplementary Equation (80).Given a cut ∂(V ), we consider all user pairs (s i , t i ) such that (s i , t Assume that in the protocol, each such pair (s i , t i ) obtains log d (k) i k target bits.As the target states are invariant under permutation of the parties we can, without loss of generality, relabel the users in the following way: If (s i , t i ) ∈ (V × V \ V ), we define (s i , ti ) := (s i , t i ), while if (s i , t i ) ∈ (V \ V × V ), we define (s i , ti ) := (t i , s i ), such that it always holds (s i , ti ) ∈ (V × V \ V ).Let us now assume a hypothetical scenario where all si are in the same place and thus have the full control of their quantum systems, forming a 'superuser' s and similarly their partners ti in V \ V can form a 'superuser' t.By combining their outcomes the pair of superusers (s, t) can achieve at least target bits.As, by assumption, ∂(V ) separates superusers s and t, the total number of obtainable target bits between the pair (s, t) is upper bounded by e∈E:{e}∈∂(V ) p e E(N e ) for entanglement measures satisfying properties 1 and 2. Hence, we have where f ( ) → 0 and g( ) → 0 as → 0. Combining Supplementary Equation (82) with the results of [27], we can, up to a factor g w (r) = O(log r * ), upper bound the worst-case capacity using a worst-case multi-commodity flow optimization, which can be expressed as a linear program of the following form (see the Methods section for details): where the maximization is over edge flows f wv ≥ 0 for all edges {vw} ∈ E .In the LP given by Supplementary Equations ( 83)-(86) we have introduced an additional variable f , which we maximize under the constraint that it lower bounds the source-sink flows for all pairs i = 1, ..., r, as expressed in Supplementary Equation (84).This ensures that f is the 'worst-case' flow that can be achieved for any user pair.
This allows us to prove the following result: Proposition 3 In a network described by a graph G with associated undirected graph G it holds in a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ) for any entanglement measure with properties 1 and 2, where g w (r) = O(log r * ) and f worst max is given by the LP defined by Supplementary Equations ( 83)-(86).
Proof.It holds for any cut with δ i|∂(V ) > 0 for at least one user pair, Using Supplementary Equation (82) and taking the limit m → ∞ and → 0, we obtain where we have used that in the case of unit demands Application of the results of [27] (equation (26) in the Methods section) finishes the proof.
Let us now consider the total throughput scenario.It follows from Theorem 2 in [24] that for every multicut {S} ↔ {T } (See the Methods section for the definition) it holds [75] 1 m As was shown in [29], we can, up to a factor g t (r) of order O(log r), upper bound the minimum multicut by a multicommodity flow optimization, which can be formulated as a linear program of the following form (See the Methods section for details): ∀{vw} ∈ E : ∀i, ∀w ∈ V, w = s i , t i : Let us now describe the LP given by Supplementary Equations ( 91)-(93) in detail: The objective given by Supplementary Equation (91) is the sum of source-sink flows over all user pairs/commodities i = 1, ..., r.For each user pair, the source-sink flow is expressed analogously to Supplementary Equation (44).The edge capacity constraints given by Supplementary Equation (92) involve a summation over all commodities that pass through given edge in both directions.The flow conservation constraints given by Supplementary Equation (93) are of the same form as Supplementary Equation ( 46), but have to be observed for all commodities i = 1, ..., r.This allows us to show the following: Proposition 4 In a network described by a graph G with associated undirected graph G and a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ) where f total max is given by the LP defined by Supplementary Equations ( 91)-(93).Proof.Using Supplementary Equation (90) and taking the limit m → ∞ and → 0, we obtain Application of the results of [29] (equation (23) in the Methods section) finishes the proof.As in the case of a single pair of users we can include an optimization over all usage frequencies p e into the optimizations given by Supplementary Equations ( 83)-( 86) and ( 91 where E is an entanglement measure with properties 1 and 2 and f worst max and f total max are given by Supplementary Equations ( 83) and (92) with added optimization over usage frequencies, respectively.
Finally, let us consider the scenario of weighted user pairs.Given any subset U ⊂ {(s 1 , t 1 ), • • • , (s r , t r )}, we can define a LP ∀{vw} ∈ E : where For subset U , we can also define a multicut {S U } ↔ {T U } as a set of edges in E whose removal disconnects all source sink pairs in U .By [29], it then holds min , this reduces to the max-flow min-cut theorem.For every user pair (s i , t i ), where i ∈ {1, ..., r}, it holds by Corollary 1 that for all m ∈ N and > 0 where R m, i := log d (k) i k /m and E is an entanglement measure satisfying properties 1 and 2 and the r.h.s.given by the LP defined by Supplementary Equations ( 44)- (46).Further, by Corollary 4, it holds for any subset U ⊂ {(s 1 , t 1 ), • • • , (s r , t r )} with |U | ≥ 2 of user pairs that where the r.h.s. is given by the LP defined by Supplementary Equations ( 91)-(93), considering only user pairs in U and with added optimization over usage frequencies.As the inequalities given by Supplementary Equations ( 102) and ( 103), for all possible subsets U ⊂ {(s 1 , t 1 ), • • • , (s r , t r )}, define facets of a polytope Π m, in R r + .Let us also define the 'asymptotic' polytope Π := lim →0 lim m→∞ Π m, .Optimization over the polytope provides us with the following result: Proposition 5 In a network described by a graph G with associated undirected graph G and a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ) with weights q 1 , ..., q r it holds P q1,...,qr (G, {N e } e∈E ) ≤ max ( R1,..., Rr)∈Π which is a linear program.
Proof.This follows from the definition given by Supplementary Equation (76) of P q1,...,qr {pe} e∈E (G, {N e } e∈E ) as a weighted sum of asymptotic rates and the definition of the polytope Π.
Let us note that instead of the weighted sum of rates r i=1 q i R i , we could also maximize a general concave target function f (R 1 , ..., R r ) over a polytope, which would still a convex optimization problem.Let us also note that whereas the number of all possible subsets of U ⊂ {(s 1 , t 1 ), • • • , (s r , t r )} scales exponentially in r, we can also obtain upper bounds by using only a small number of subsets U ⊂ {(s 1 , t 1 ), • • • , (s r , t r )} or only the single-pair bounds given by Supplementary Equation (102) to define the polytope.
It is straightforward to extend our lower bound, Proposition 2, to multiple user scenarios: Proposition 6 In a network described by a graph G with associated undirected graph G it holds in a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ), where f worst max and f total max are given by the LP defined by Supplementary Equations ( 83)-( 86) and the LP given by Supplementary Equations ( 91)-(93), respectively.
Before proving Proposition 6, we need the following Lemmas: Lemma 2 Let us assume we have a finite undirected graph G with capacities c ({vw}) (that can in general depend on m and k) and r source-sink pairs (s 1 , t 1 ), ..., (s r , t r ).Let N := max i∈{1,...,r} N i , where N i are the numbers of directed paths from s i to t i that exist in G .Let further k, m ∈ N. Then we can, for any i ∈ {1, ..., r} concurrently, obtain, in G mkN c , F si→ti edge-disjoint paths from s i to t i , where Proof.Let m, k ∈ N and let {f (i) vw } i∈{1...r},{vw}∈E be the set of edge flows maximizing the LP given by Supplementary Equations ( 83)-( 86) for G with capacities c ({vw}), which in general can depend on m and k.As G is finite, we can, for any i ∈ {1, ..., r}, always find a finite number N i of directed paths P (ij) si→ti , where j ∈ {1, ..., N i }, from s i to t i .Hence N := max i∈{1,...,r} N i is finite.For each path P (ij) si→ti we can assign a path-flow f (ij) ≥ 0 such that for every (see also [43]).Let us define in analogy to Supplementary Equation ( 55) As in Supplementary Equation (56), it holds for every edge {vw} ∈ E that where Then for each f (ij) there exists n(ij) ∈ N 0 such that Let us also define F (ij) = mn (ij) and vw are feasible solutions of the LP given by Supplementary Equations ( 83)-(86), it holds for any edge {vw} ∈ E that r i=1 Further, for all i ∈ {1...r}, it holds for all w ∈ V with w = s i , t i that v:{vw}∈E where we use the same argument as explained after Supplementary Equation (63).It also holds v:{siv}∈E Hence {F vw } i∈{1...r},{vw}∈E is a feasible solution of the LP given by Supplementary Equations ( 83)-( 86) with capacities mkN c ({vw}) , providing, for any i ∈ {1, ..., r} concurrently, a flow of As any integer flow of value F (ij) corresponds to F (ij) edge-disjoint paths from s i to t i in G mkN c , we can conclude that, for all i ∈ {1, ..., r} concurrently, there are F si→ti edge-disjoint paths from s i to t i .
Lemma 3 Let us assume we have a finite undirected graph G with capacities c ({vw}) (that can in general depend on m and k) and r source sink pairs (s 1 , t 1 ), ..., (s r , t r ).Let N := r i=1 N i , where N i are the numbers of directed paths from s i to t i that exist in G .Let further k, m ∈ N. Then we can, for any i ∈ {1, .., r} concurrently, obtain, in G mkN c , F si→ti edge-disjoint paths from s i to t i , where r i=1 Proof.Let m, k ∈ N and let {f (i) vw } i∈{1...r},{vw}∈E be the set of edge flows maximizing the LP given by Supplementary Equations ( 91)-(93) for G with capacities c ({vw}), which in general can depend on m and k.As G is finite, we can, for any i ∈ {1, ..., r}, always find a finite number N i of directed paths P (ij) si→ti , where j ∈ {1, ..., N i }, from s i to t i .Hence N := r i=1 N i is finite.For each path P (ij) si→ti we can assign a path-flow f (ij) ≥ 0 such that for every i ∈ {1...r} it holds (see also [43]).Let us define f vw as in Supplementary Equation (109).As in Supplementary Equation ( 56), for every edge {vw} ∈ E Supplementary Equations ( 110)-(111) are fulfilled.Then for each f (ij) there exists n(ij) ∈ N 0 such that Let us also define F (ij) = mn (ij) and Hence {F (i) vw } i∈{1...r},{vw}∈E is a feasible solution of the LP given by Supplementary Equations ( 91)-( 93) with capacities mkN c ({vw}) , providing, for any i ∈ {1, ..., r} concurrently, a flow of F si→ti = Ni j=1 F (ij) .As any integer flow of value F (ij) corresponds to F (ij) edge-disjoint paths from s i to t i in G mkN c , we can conclude that, for all i ∈ {1, ..., r} concurrently, there are F si→ti edge-disjoint paths from s i to t i .Further it holds r i=1 edge-disjoint paths from s i to t i , corresponding to chains of Bell states.By means of entanglement swapping, we can connect these chains, providing us with concurrent rates of entanglement generation between each s i and t i of Going to the limit m → ∞ and → 0, the rates R ↔ (N e ) reach the two-way assisted quantum capacities Q ↔ (N e ).Hence we have Taking the limit k → ∞ finishes the proof of the worst-case scenario.The total throughput case works analogously: We define N := r i=1 N i and use Lemma 3 to show that in G (m− m)kN c R ↔ there exist F si→ti edge-disjoint paths for each source sink pair (s i , t i ) such that Connecting the corresponding chains of Bell states by entanglement swapping, we can obtain the rate Taking all the limits completes the proof.Again, we can include the optimization over usage frequencies into the optimization, yielding the following: Corollary 5 In a network described by a graph G with associated undirected graph G it holds in a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ), where f worst max and f total max are given by adding an optimization over usage frequencies to the LPs given by Supplementary Equation ( 83)-( 86) and ( 91)-(93), respectively.
As for the scenario of weighted user pairs, let us note that by Corollary 3, we can for every user pair (s i , t i ) alone, for i = 1, ..., r, achieve a rate where the r.h.s.given by the LP defined by Supplementary Equations ( 44)-( 46).In the space R r + of single-pair rates, this corresponds to a set of asymptotically achievable points By means of time-sharing (see e.g.[12]) between the single-pair protocols, we can achieve every point in the convex hull Conv(A) of A, [76].This provides us with the following result: Proposition 7 In a network described by a graph G with associated undirected graph G and a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ) with weights q 1 , ..., q r it holds which is a linear program.
Let us note again that instead of the weighted sum of rates r i=1 q i R i , we could also maximize a general concave target function f (R 1 , ..., R r ) over a polytope, which would still a convex optimization problem.

D. Multipartite Target States
In this section we present our results on the distribution of multipartite entanglement.Let us consider a set of disjoint users S = {s 1 , ..., s l }, who wish to establish a multipartite target state θ d Xs 1 ...Xs l , such as a Greenberger-Horne-Zeilinger (GHZ) state [46] Φ GHZ,d where σ Ss 1 ...Ss l is an arbitrary state and the unitary U twist is given by The corresponding capacities are defined analogously to V B as where the supremum is over all adaptive (n, , {p e } e∈E ) protocols Λ and k = (k 1 , . . ., k m+1 ) is a vector of outcomes of the m + 1 LOCC rounds in Λ, the averaging is over all those outcomes and ρ If the target is an l party GHZ or private state among users in S, we also use the notation Q S := C Φ GHZ and P S := C γ .As the class of multipartite private states includes GHZ states, the multipartite private capacity is an upper bound on the multipartite quantum capacity.

Upper bounding the capacity
We are now ready to provide our linear-program upper bound.As a special case of Corollary 4 in [24] that for an (n, , {p e } e∈E ) multipartite key generation protocol yielding, among S = {s 1 , ..., s l }, a state ρ where min V S is a minimization over all V S ⊂ V such that there is at least one pair of vertices s i , s j ∈ S with s i ∈ V S and s j ∈ V \ V S .Further, b > 0, g( ) → 0 as → 0. In the Methods section we have shown that min where the r.h.s. is given by the LP ∀i, j > i, {vw} ∈ E : f (ij) vw + f (ij) wv ≤ c ({vw}) (148) ∀i, j > i, ∀{vw} ∈ E : f (ij) vw , f (ij) wv ≥ 0 (149) ∀i, j > i, ∀w ∈ V, w = s i , s j : In the LP given by Supplementary Equations ( 146)-(150) we compute the S-connectivity using by finding the smallest max-flow for any disjoint pairs s i , s j ∈ S. As the direction of the flow does not matter we can w.l.o.g.assume that j > i.We do this by maximizing variable f such that f is a lower bound for the flows between all disjoint pairs s i , s j ∈ S with j > i, as expressed in the constraint given by Supplementary Equation (147).The constraints given by Supplementary Equations ( 148) and (150) are simply the edge capacity and flow conservation constraints, as in the LP given by Supplementary Equations ( 44)- (46), applied to all disjoint pairs s i , s j ∈ S with j > i.
Taking the limit n → ∞ and → 0, we obtain the following: where f S max is given by the LP defined by Supplementary Equations (146).We can, again, include an optimization over all usage frequencies p e , providing where the r.h.s. is given by the linear program defined by Supplementary Equation (146) with added optimization over usage frequencies.
Let us also define even integers F (ijl) = 2mn (ijl) and F vw are feasible solutions of the LP given by Supplementary Equation (146), it holds for any disjoint pair i, j ∈ {1, ..., r} and any edge {vw} ∈ E that Further, for all disjoint i, j ∈ {1...r}, it holds for all w ∈ V with w = s i , s j that where we use the same argument as explained after Supplementary Equation (63).It also holds Hence {F (ij) vw } i,j∈{1...r},i =j,{vw}∈E is a feasible solution of the LP given by Supplementary Equation ( 146) with capacities 2mkN c ({vw}) , providing, for any disjoint i, j ∈ {1, ..., r} a flow of As any integer flow of value F (ijl) corresponds to F (ijl) edge-disjoint paths in G 2mkN c , we can conclude that there are F si→sj edge-disjoint paths for every disjoint pair i, j ∈ {1, ..., r}.Application of Menger's Theorem [77], which is the integer version of the max-flow min-cut theorem, finishes the proof.edge-disjoint S-trees.The Bell states forming an S-tree can be transformed into a qubit GHZ state among all vertices in the set S by means of the following protocol: In a first step all Bell states are merged into a GHZ state among all nodes in the S-tree.This can be done by means of projective measurement and Pauli corrections [20].All the unwanted parties in the GHZ state can be removed by means projective measurements [20], leaving only a GHZ state among the nodes in S. See also a related work by [25].Hence we can obtain the following rate: FIG. 10.Same network as in Supplementary Figure 9 with optimization over usage frequencies.

FIG. 1 .
FIG.1.Example of a quantum network: It consists of quantum channels, repeater stations and end users A, B, . . ., I. In such a network there are many possible communication tasks.Some examples are the distribution of private states, Bell states and Greenberger-Horne-Zeilinger (GHZ) states.The first two are bipartite tasks.We study the implementation of these tasks between a single pair of users, for instance A and I, and between multi-pairs of users in parallel, for instance A and I, C and D and F and H.The last task, the distribution of GHZ states, is a multipartite user scenario, for instance A, B, E, G, I could distill a five-partite GHZ state.

FIG. 2 .
FIG.2.Example of the max-flow min-cut theorem (a) Min-cut: Example of an undirected graph with a source-sink pair (in red).The labels of the edges denote their edge capacities.The edges in dashed lines represent a source-sink cut, i.e. their removal completely disconnects the source from the sink.The capacity of the cut is given by the sum over the edge capacities in the cut, in this case equal to 1, which is the minimum capacity of all source-sink cuts in this network.In other words, the min-cut is equal to 1.Note that the minimizing cut is not unique.(b) Max-flow: By the max-flow min-cut theorem the min-cut is equal to the maximum flow from the source to the sink.Here we have provided an example of a flow from the source to the sink.The labels denote the directed edge flows fe.The flow from the source to the sink achieves the min-cut value of 1.

FIG. 6 .
FIG. 6.Our notation for graphs: (a) Directed graph G, with the edges representing quantum channels.(b) Undirected graph G as defined.(c) Undirected multigraph G , with the edges corresponding to Bell states.For the definitions of G, G and G , see V A.

1 pe.
Hence the state e∈E Φ + e ⊗ mkN pe R ↔ (N e ) can be transformed into e∈E Φ + e ⊗ (m− m)kN peR ↔ (N e ) by removal of Bell pairs.Let us from now on assume that m ≥ m.The resulting state can be interpreted as a network of Bell states, which can be described by the unit-capacity multigraph G (m− m)kN c R ↔ , finishing the proof.Proof.(of Proposition 6) We start with the worst-case scenario.Let N := max i∈{1,...,r} N i , where N i are the numbers of directed paths from s i to t i that exist in G .Let further k, m ∈ N. As shown in the proof of Proposition 2, we can obtain a state |E|-close in trace distance to a network of Bell states e∈E Φ + e ⊗ (m− m)kN peR ↔ (N e ) , by using each channel N e mkN p e times, which can be associated with G (m− m)kN c R ↔ .Here, as in the proof of Proposition 2, we have defined m := max e∈E,pe>0 1 pe .By Lemma 2, for each i ∈ {1...r} concurrently, there exist

(n,k) Xs 1
...Xs l is the final state of Λ for given outcomes k.Again we can optimize over usage frequencies, resulting in C θ (G, {N e } e∈E ) = max pe≥0, e pe=1 C θ {pe} e∈E (G, {N e } e∈E ) .

Corollary 6
In a network described by a graph G with associated undirected graph G it holds in a scenario of a multipartite user group S,P S (G, {N e } e∈E ) ≤ f S max (G , {E sq (N e )} e∈E ),(152)

2 + 1
Proof.(of Proposition 9) Let N := max i,j∈{1,...,r},i =j N ij , where N ij are the numbers of directed paths from s i to s j that exist in G .Let further > 0 and k, m ∈ N. As shown in the proof of Proposition 2, we can obtain a state |E|-close in trace distance to a network of Bell states e∈E Φ + e ⊗ 2(m− m)kN peR ↔ (N e ) , by using each channel N e 2mkN p e times, which corresponds to an undirected unit-capacity multigraph G 2(m− m)kN c R ↔ .By Lemma 4 and equation (38) in the Methods section, with g 1 = 12 and g 2 = |V \S| as in[50],G 2(m− m)kN c R ↔ contains t S G 2(m− m)kN c R ↔ ≥ (m − m)kN f S max G , {c R ↔ ({vw}, p vw , p wv )} {vw}∈E −

t S G 2 ( 16 FIG. 7 . 16 FIG. 8 . 16 FIG. 9 .
FIG.7.Example of a multi-commodity flow instance, maximizing the worst-case flow, the LP given by Supplementary Equations (83)-(86), in a chord network with l = 4 without optimization of the usage frequencies.On the left, one can see the network, with linewidths corresponding to its capacities.The other plots with legend above the plot '[a − b]−flow, x' show the respective edge flows between the pair of users a and b with flow value x, that were obtained in the optimization.Max Worst Case Flow,0.058824 where σ SsSt is an arbitrary state and U twist = ik |ik ik| KsKt ⊗U SsSt is a controlled unitary that 'twists' the entanglement in the subsystem K s K t to a more involved form also including the subsystem S s S t .It has been shown that, by measuring the 'key part' K s K t , while keeping the 'shield part' S s S t away from an eavesdropper Eve, log d bits of a private key can be obtained.The number of ebits or private bits is treated as the figure of merit.We can now define a quantum network capacity Q {pe} e∈E (G, {N e } e∈E ) per time [Q(G, {N e } e∈E ) per total channel use] as the largest rate log d(k)k /n achievable by an adaptive (n, , {p e } e∈E ) protocol such that after n uses the finally obtained state ρ •• ,qr (G, {N e } e∈E ) per total channel use [Q q1,••• ,qr {pe} e∈E (G, {N e } e∈E ) per time] (P q1,••• ,qr (G, {N e } e∈E ) per total channel use [P q1,••• ,qr {pe} e∈E (G, {N e } e∈E ) per time] The corresponding private capacities P total (G, {N e } e∈E ) and P worst (G, {N e } e∈E ) are defined by Ks i Ss i Kt i St i {N e } e∈E ) ≤ min , {c E ({wv}, p vw , p wv )} {wv}∈E ).In a network described by a graph G with associated undirected graph G it holds in a scenario of r user pairs (s 1 , t 1 ), ..., (s r , t r ),P total (G, {N e } e∈E ) ≤ g t (r) f total max (G , {E sq (N e )} e∈E ),(98) vw).As the f Proposition 8In a network described by a graph G with associated undirected graph G it holds for a set S = {s 1 , ..., s l } of usersP S {pe} e∈E (G, {N e } e∈E ) ≤ f S max G , {c Esq ({vw}, p vw , p wv )} {vw}∈E ,