Review

See allHide authors and affiliations

Science  19 Oct 2018:
Vol. 362, Issue 6412, eaam9288
DOI: 10.1126/science.aam9288

## The stages of a quantum internet

As indispensable as the internet has become in our daily lives, it still has many shortcomings, not least of which is that communication can be intercepted and information stolen. If, however, the internet attained the capability of transmitting quantum information—qubits—many of these security concerns would be addressed. Wehner et al. review what it will take to achieve this so-called quantum internet and propose stages of development that each correspond to increasingly powerful applications. Although a full-blown quantum internet, with functional quantum computers as nodes connected through quantum communication channels, is still some ways away, the first long-range quantum networks are already being planned.

Science, this issue p. eaam9288

## Structured Abstract

### BACKGROUND

The internet has had a revolutionary impact on our world. The vision of a quantum internet is to provide fundamentally new internet technology by enabling quantum communication between any two points on Earth. Such a quantum internet will—in synergy with the “classical” internet that we have today—connect quantum information processors in order to achieve unparalleled capabilities that are provably impossible by using only classical information.

As with any radically new technology, it is hard to predict all uses of the future quantum internet. However, several major applications have already been identified, including secure communication, clock synchronization, extending the baseline of telescopes, secure identification, achieving efficient agreement on distributed data, exponential savings in communication, quantum sensor networks, as well as secure access to remote quantum computers in the cloud.

Central to all these applications is the ability of a quantum internet to transmit quantum bits (qubits) that are fundamentally different than classical bits. Whereas classical bits can take only two values, 0 or 1, qubits can be in a superposition of being 0 and 1 at the same time. Moreover, qubits can be entangled with each other, leading to correlations over large distances that are much stronger than is possible with classical information. Qubits also cannot be copied, and any attempt to do so can be detected. This feature makes qubits well suited for security applications but at the same time makes the transmission of qubits require radically new concepts and technology. Rapid experimental progress in recent years has brought first rudimentary quantum networks within reach, highlighting the timeliness and need for a unified framework for quantum internet researchers.

We define different stages of development toward a full-blown quantum internet. We expect that this classification will be instrumental in guiding and assessing experimental progress as well as stimulating the development of new applications by providing a common language and reference frame for the different scientific and engineering disciplines involved.

More advanced stages are distinguished by a larger amount of functionality, thus supporting ever more sophisticated application protocols. For each stage, we describe some of the application protocols that are already known and that can be realized with the functionality provided in that stage. It is conceivable that a simpler protocol, or better theoretical analysis, may be found in the future that solves the same task but is less demanding in terms of functionality. In parallel to the daunting experimental challenges in making quantum internet a reality, there is thus an opportunity for quantum software developers to design protocols that can realize a task in a stage that can be implemented more easily. We identify relevant parameters for each stage to establish a common language between hardware and software developers. Last, we review technological progress in experimental physics, engineering, and computer science that is required to attain such stages.

### OUTLOOK

Building and scaling quantum networks is a formidable endeavor, requiring sustained and concerted efforts in physics, computer science, and engineering to succeed. The proposed stages of development will facilitate interdisciplinary communication by summarizing what we may actually want to achieve and providing guidelines both to protocol design and software development as well as hardware implementations through experimental physics and engineering. Although it is hard to predict what the exact components of a future quantum internet will be, it is likely that we will see the birth of the first multinode quantum networks in the next few years. This development brings the exciting opportunity to test all the ideas and functionalities that so far only exist on paper and may indeed be the dawn of a future large-scale quantum internet.

## Abstract

The internet—a vast network that enables simultaneous long-range classical communication—has had a revolutionary impact on our world. The vision of a quantum internet is to fundamentally enhance internet technology by enabling quantum communication between any two points on Earth. Such a quantum internet may operate in parallel to the internet that we have today and connect quantum processors in order to achieve capabilities that are provably impossible by using only classical means. Here, we propose stages of development toward a full-blown quantum internet and highlight experimental and theoretical progress needed to attain them.

The purpose of a quantum internet is to enable applications that are fundamentally out of reach for the classical internet. A quantum internet could thereby supplement the internet we have today by using quantum communication, but some researchers go further and believe all communication will eventually be done over quantum channels (1). The best-known application of a quantum internet is quantum key distribution (QKD), which enables two remote network nodes to establish an encryption key whose security relies only on the laws of quantum mechanics. This is impossible with the classical internet. A quantum internet, however, has many other applications (Fig. 1) that bring advantages that are unattainable with a classical network. Such applications include secure access to remote quantum computers (2), more accurate clock synchronization (3), and scientific applications such as combining light from distant telescopes to improve observations (4). As the development of a quantum internet progresses, other useful applications will likely be discovered in the next decade.

Central to all these applications is that a quantum internet enables us to transmit quantum bits (qubits), which are fundamentally different from classical bits. Classical bits can take only two values, 0 or 1, whereas qubits can be in a superposition of 0 and 1 at the same time. Importantly, qubits cannot be copied, and any attempt to do so can be detected. It is this feature that makes qubits naturally well suited for security applications but at the same time makes transmitting qubits over long distances a truly formidable endeavor. Because qubits cannot be copied or amplified, repetition or signal amplification are ruled out as a means to overcome imperfections, and a radically new technological development—such as quantum repeaters—is needed in order to build a quantum internet (Figs. 2 and 3) (5).

We are now at an exciting moment in time, akin to the eve of the classical internet. In late 1969, the first message was sent over the nascent four-node network that was then still referred to as the Advanced Research Projects Agency Network (ARPANET). Recent technological progress (69) now suggests that we may see the first small-scale implementations of quantum networks within the next 5 years.

At first glance, realizing a quantum internet (Fig. 3) may seem even more difficult than building a large-scale quantum computer. After all, we might imagine that in full analogy to the classical internet, the ultimate version of a quantum internet consists of fully fledged quantum computers that can exchange an essentially arbitrary number of qubits. Thankfully, it turns out that many quantum network protocols do not require large quantum computers to be realized; a quantum device with a single qubit at the end point is already sufficient for many applications. What’s more, errors in quantum internet protocols can often be dealt with by using classical rather than quantum error correction, imposing fewer demands on the control and quality of the qubits than is the case for a fully fledged quantum computer. The reason why quantum internet protocols can outperform classical communication with such relatively modest resources is because their advantages rely solely on inherently quantum properties such as quantum entanglement, which can be exploited already with very few qubits. By contrast, a quantum computer must feature more qubits than can be simulated on a classical computer in order to offer a computational advantage. Given the challenges posed by the development of a quantum internet, it is useful to reflect on what capabilities are needed to achieve specific quantum applications and what technology is required to realize them.

Here, we propose stages of development toward a full-blown quantum internet. These stages are functionality driven: Central to their definition is not the difficulty of experimentally achieving them but rather the essential question of what level of complexity is needed to actually enable useful applications. Each stage is interesting in its own right and distinguished by a specific quantum functionality that is sufficient to support a certain class of protocols. To illustrate this, for each stage we give examples of known application protocols in which a quantum internet is already known to bring advantages.

Realizing a quantum internet demands substantial development to realize quantum repeaters as well as end nodes (Figs. 2 and 3). It is clear that in the short term, one may optimize both repeaters and end nodes relatively independently. That is, one can imagine a quantum internet that uses relatively simple end nodes while using repeaters powerful enough to cover larger distances. Similarly, a near-term quantum internet may be optimized for shorter—for example, pan-European—distances, while using much more powerful end nodes capable of realizing a larger set of protocols. Ideally, these designs would ensure forward compatibility to achieve the ultimate goal of a full-blown worldwide quantum internet. Although the quantum repeaters, which enable communication between distant end nodes, need to be able to support the functionality of each stage, an application-centric view makes no other statements regarding their capabilities.

Last, we discuss progress toward implementing a quantum internet, which poses substantial challenges to physics, engineering, and computer science.

## Stages of functionality and applications

Let us formulate the functionality-driven stages of quantum internet development. Each successive stage is distinguished by an increasing amount of functionality, at the expense of increasing experimental difficulty. We say that an experimental implementation has reached a certain stage only if the functionality of that stage and all previous stages (Fig. 4) is available to all the end nodes using the network.

Crucial to the distinction between the stages is that the subsequent stage offers a fundamentally new functionality not available in the previous one rather than simply improving parameters or offering “more of the same” by increasing the number of qubits. For the sake of clarity, the stages and tests described below target systems that prepare and transmit qubits, but it is also possible to phrase both in terms of qudits (higher-dimensional quantum systems) or continuous variables. For each stage, we describe some of the application protocols that are already known and that can be realized with the functionality provided in that stage (Table 1). It is conceivable that a simpler protocol, or better theoretical analysis, may be found in the future that solves the same task but is less demanding in terms of functionality. In parallel to the daunting experimental challenges in making quantum internet a reality, there is thus a challenge for quantum software developers to design protocols that can realize a task in a stage that can be implemented more easily. We identify relevant parameters for each stage to establish a common language between hardware and software developers. These parameters can be estimated by using a series of simple tests, allowing us to certify the performance of an experimental implementation in attaining a specific stage, as well as the performance of protocols depending on these parameters. So far, most application protocols have only been analyzed for perfect parameters. As such, the exact requirements of many application protocols on these parameters have not yet been determined and deserve future investigation. Although functionality-driven stages make demands on the communication links and quantum repeaters, it will not be important in this section how these links are realized; they may be realized by direct transmission in fiber, by being relayed by any kind of quantum repeater, or even by means of teleportation using preshared entanglement. What matters is that these links can be used to generate the necessary quantum states for a specific stage.

Table 1 Formal definitions of the stages, parameters for protocol design, and classification of known protocols.

Higher stages include all functionality available at the previous ones. It is an open question to determine necessary and sufficient conditions for these parameters to realize general protocols. In the future, quantum network programmers may be able to find protocols for the same tasks that can be realized with lower stages of a quantum internet. It is an interesting open question what minimum stage is required in order to realize a specific task.

View this table:
Box 1

### Performance of quantum internet protocols.

A general quantum internet protocol is composed of a series of operations consisting of state preparation, transmission, unitary operations, and measurements. In reality, each of these operations is noisy, so instead of executing a sequence of ℓ ideal operations , we are executing the real (noisy) protocol . To assess the performance of the real protocol execution, it is sufficient to estimate the diamond norm distance (20)

where D(τ, σ) is the well-known trace distance (18) that determines how well two states τ and σ can be distinguished by any physical process, and S denotes the system that the protocol acts on which may be part of a larger system SE. Because is (unlike the fidelity) a metric, it is straightforward to show that having estimated individual errors allows an estimate of the overall error as

For unitary operations and projective measurements, the diamond norm distance is directly related to the average gate fidelity (111). If the ideal operation simply aims to prepare a state Φ, and the real operation prepares , then the diamond norm distance satisfies , where F is the fidelity. Evidently, the end-user—who desires to run application protocols—should be able to perform tests that give confidence for any possible operation instead of having to test the exact unitaries and measurements in any conceivable protocol.

### Trusted repeater networks

The first stage differs substantially from the others in the sense that it does not allow the end-to-end transmission of qubits. Nevertheless, from a technological perspective, trusted repeater networks can form an interesting stepping stone toward a quantum internet, spurring infrastructure deployment and engineering developments; depending on the underlying technology, trusted repeaters (10) can be upgraded to true quantum repeaters later on.

Specifically, a trusted repeater network (sometimes called a trusted node network) has at least two end nodes and a sequence of short distance links that connect nearby intermediary repeater nodes. Each pair of adjacent nodes uses QKD (1113) to exchange encryption keys. These pairwise keys allow the end nodes to generate their own key, provided that all intermediary nodes are trusted (14). A first step toward upgrading such networks could be measurement device–independent QKD (1517), which is a QKD protocol that is secure even with untrusted measurement devices that can be implemented with standard optical components and sources (17); this protocol already incorporates some useful ingredients for later stages, such as two-photon Bell measurements.

### Prepare and measure networks

This stage is the first to offer end-to-end quantum functionality. It enables end-to-end QKD without the need to trust intermediary repeater nodes and already allows a host of protocols for other interesting tasks. Informally, this stage allows any node to prepare a one-qubit state and transmit the resulting state to any other node, which then measures it (definition is provided in Table 1). Transmission and measurement are allowed to be post-selected; that is, a signal that the qubit is lost may be generated instead. For instance, the receiving node is allowed to ignore nondetection events and conclude that such qubits are lost. If the sender can prepare an entangled state of two qubits, then this stage also includes the special case in which the sender transmits the first and second qubit to two different nodes in the network (or to another node and itself). Such entanglement distribution is then also post-selected.

Such a post-selected prepare-and-measure functionality is not equivalent to transmitting arbitrary qubits across the network (18). The task of transmitting arbitrary qubits demands the ability to transfer an unknown state (which the sender does not know how to prepare) deterministically to the receiver—that is, no post-selection on detection events is allowed.

The classical reader may wonder what is the use of transmitting qubits at all if there is a procedure for the sender to prepare the state . After all, we might imagine that the sender simply sends classical instructions for this procedure to the receiver, who then prepares the qubit itself. The difference between such a classical protocol and sending different quantum states directly is that in the latter case, an eavesdropper, or indeed the receiver, cannot make a copy of without disturbing the quantum state. This means that attempts to gain information from by an eavesdropper may be detected, enabling QKD.

#### Application protocols

This stage is already sufficient to realize protocols for many interesting cryptographic tasks, as long as the probability of loss (p) and the inaccuracies in transmission (εT) and measurement (εM) (Table 1) are sufficiently low. The most famous of such tasks is QKD, which provides a solution to the task of generating a secure encryption key between two distant end nodes (Alice and Bob) (1113). QKD is secure even if the eavesdropper trying to learn the key has access to an arbitrarily large quantum computer with which to attack the protocol, and remains secure at any point in the future, even if such a quantum computer becomes available later on. This is provably impossible when using classical communication. The BB84 QKD (11) protocol can be realized by using only single-qubit preparations and measurements tolerating some amount of post-selection p (19). For known protocols in this stage, εT + εM ≤ 0.11 is sufficient and can be estimated by testing for only a small number of states (20). In practice, single-qubit preparation can be replaced with attenuated laser pulses, using also decoy-state BB84 to guarantee security (21). QKD is commercially available at short distances by using standard telecom fibers (22), and a variety of protocols are known [(23), survey].

Another class of protocols in this stage is in the domain of two-party cryptography. Here, there is no eavesdropper, but rather Alice and Bob themselves do not trust each other. An example of such a task is secure identification, in which Alice (a potentially impersonating user) may wish to identify herself to Bob (a potentially malicious server or automated teller machine) without revealing her authentication credentials (24, 25). It is known that even by using quantum communication, such tasks cannot be implemented securely without imposing assumptions on the power of the adversary (2628). Classical protocols rely on computational assumptions, whose security against an attacker who holds a quantum computer is unclear. Nevertheless, it is possible to achieve provable security for all such relevant tasks by sending more qubits than the adversary can store easily within a short time frame, which is known as the bounded (29) or more generally noisy-storage model (30, 31). This assumption only needs to hold during the execution of the protocol, and security is preserved into the future even if the adversary later obtains a better quantum memory. There exist protocols for which it is sufficient to prepare and measure single qubits, in which the sufficient values of p, εM, εT (Table 1) depend on the storage assumption (32).

Other known protocols in this stage include position verification (33); weakened forms of two-party cryptographic tasks that can form building blocks, such as imperfect bit commitments (34); and coin-flipping (35). Here, the requirements in terms of p, εM, and εT have not been analyzed yet; no task exists for which a full set of necessary and sufficient conditions on these parameters is known.

### Entanglement distribution networks

The third stage allows the end-to-end creation of quantum entanglement in a deterministic or heralded fashion, as well as local measurements. The end nodes require no quantum memory for this stage (Table 1).

The term “deterministic entanglement generation” refers to the fact that the process succeeds with (near) unit probability. Heralding is a slightly weaker form of deterministic entanglement generation in which we signal the successful generation of entanglement with an event that is independent of the (immediate) measurement of the entangled qubits themselves. Here, the generation of entanglement is deterministic, conditioned on such a successful heralding signal. Specifically, this prohibits post-selecting on detection events when measuring the entangled qubits. We remark that this stage also includes networks that allow the generation of multipartite entangled states, followed by immediate measurements, but no memory. However, the generation of multipartite entanglement is not required to attain this stage.

#### Application protocols

The main advance over the previous stage is that this stage allows the realization of device-independent protocols, in which the quantum devices are largely untrusted. Specifically, the concept of device independence (36, 37) models the end nodes as black boxes, to which we can give classical instructions to perform specific measurements and receive the resulting measurement outcomes. No guarantees are given about the actual quantum state or measurements performed by the device, where the device may even be constructed by the adversary. The classical software used to control such quantum devices is trusted, and it is assumed that the quantum device merely exhibits input/output behavior. In particular, devices can record their inputs and outputs (38) but cannot transmit the key back to the adversary. The coordination allowed by entanglement now also in principle allows players to “cheat” an online bridge game (39).

Low errors in preparation (εP) and measurement (εM) as εP + εM ≤ 0.057 (Table 1) are sufficient to ensure the implementability of device-independent QKD (36), in which necessary and sufficient conditions for the parameters to implement general tasks in this stage are unknown.

### Quantum memory networks

The fourth stage is distinguished by the capability of the end nodes to have local memory while simultaneously allowing universal local control (Table 1). This allows the implementation of much more complex protocols that require temporary storage of a quantum state during further quantum or classical communication. Examples include protocols for solving distributed systems tasks. This stage also implies the ability to perform entanglement distillation and generate multipartite entangled states from bipartite entanglement by exploiting the ability for local memory and control. A crucial difference between this stage and the previous one is that we are now able to transfer unknown qubits from one network node to another—for example, by performing deterministic teleportation. This capability is not guaranteed in the previous stage: Technology that can be used to deterministically relay qubits over long distances by means of large-scale quantum error correction implies the technological capability of realizing a good local quantum memory. We emphasize that a quantum memory network does not require operations to be performed with an accuracy that would be above threshold for fault-tolerant computation.

An important parameter in application protocols is the number of communication rounds k (Table 1), the number of times information is sent back and forth between two end nodes during the course of the protocol. In order to realize useful application protocols, the storage time t thus needs to be compared with the communication time in the network instead of an absolute time. This means that networks of nodes that are far apart do in fact need to exhibit longer memory times in order to attain this stage, and the quality of the memory is time dependent. That this time t is related to the maximum time that it takes any two nodes to communicate is because a stage is attained only if the functionality is available to any two nodes in the network, even the two that are farthest apart.

#### Application protocols

The availability of quantum memories and the deterministic transmission of qubits opens up many new protocols in this stage. We start with cryptographic tasks: To allow clients to make use of these computers securely—that is, without revealing the nature or outcome of their computation—it is possible to perform secure assisted quantum computation (40), or blind quantum computation (2, 41). Here, a simple quantum device capable of preparing and measuring single qubits is sufficient to perform a computation on a large-scale quantum computer so that the quantum computer cannot gain information about the program and result. That we need one large-scale quantum computer does not imply that a quantum computing network (the highest stage) is required to run such protocols; we only need a quantum internet that allows a client to communicate with the computing server. A network attains a specific stage only if the functionality is available to all nodes.

Other cryptographic tasks in this domain are tools such as protocols for the sharing of classical (42) or quantum (43) secrets, including verifiable secret-sharing schemes (44) and anonymous transmissions (45). Evidently, the number of qubits determines the size of the secrets or qubits transmitted, but no fault tolerance is in principle required.

This stage also opens the door to interesting applications outside the domain of cryptography. For example, proposals exist for exploiting long-distance entanglement to extend the baseline of telescopes (4), for basic forms of leader election (46), and for improving the synchronization of clocks (3). Depending on the demands made on such synchronization, the proposed protocols could be realized with quantum memory or few-qubit fault-tolerant networks.

Necessary and sufficient parameter requirements for solving the above mentioned tasks are not yet known in general. It is also conceivable that an improved analysis considering whether deterministic qubit delivery is really necessary, or whether maybe post-selected transmission of qubits is enough, can push some of the protocols above to a lower stage. Initial results for blind quantum computation indicates that this might indeed be the case (47).

### Few-qubit fault-tolerant networks

The next stage differs by demanding that the local operations can be performed fault-tolerantly, which is considerably more challenging. Fault tolerance is not necessary for many known quantum internet protocols, but fault-tolerant operations being available would allow the execution of local quantum computation of high circuit depth as well as an (in theory) arbitrary extension of storage times to execute protocols with an arbitrary number of rounds of communication.

The term “few qubits” here refers to the fact that the number of qubits available is still small enough so that the end nodes themselves can be simulated effectively on a classical computer. This does not imply that the entire network can be simulated efficiently or that there would exist equivalent classical protocols; the effects of entanglement cannot generally be replicated classically.

Here, we are only interested in the performance of the fault-tolerant scheme, not how it is realized. Fault tolerance implies that all error parameters (Table 1) of a quantum memory network can be made negligible by adding more resources. As a guideline to relevant experimental parameters, we refer to works in distributed quantum computing (48).

#### Application protocols

Having access to fault-tolerant gates allows higher-accuracy clock synchronization (3) and protocols that require many rounds of communication and high circuit depth to be useful. This includes distributed quantum computing as well as applications for full-scale quantum computing networks, restricted to few qubits. This could be of great practical interest, especially for applications in the domain of distributed systems, but as with the implementation of quantum algorithms on quantum computers, the power of having only a limited number of qubits at our disposal is an important subject of investigation.

### Quantum computing networks

The final stage consists of quantum computers that can arbitrarily exchange quantum communication. In some sense, it breaks with our paradigm that the next stage is not “more of the same.” However, in this case, we really do gain a new ability: finding solutions to computational problems that can no longer be found efficiently on classical computers.

#### Application protocols

It is clear that this ultimate stage of a quantum internet allows in principle all protocols to be realized. Small-scale versions of the protocols below can also be realized in the few-qubit fault-tolerant stage, and further development may yield more sophisticated protocols and analysis that places them in lower stages.

First, we again focus on cryptography. In this stage, it is possible to perform coin flipping with an arbitrarily small bias (49, 50). We can also solve genuinely quantum tasks, such as secure multiparty quantum computation, which forms an extension of classical secure function evaluation to the quantum regime. Classically, this means that node j holds an input string xj, and all n nodes jointly want to compute y = f(x1, ..., xn). The goal is that malicious nodes cannot infer anything more about the inputs xj of the honest nodes than they can by observing the output y. An example of such a problem is secure voting, in which xj ∈ {0, 1} corresponds to the choice one of two possible candidates, and f is the majority function. The quantum version of this primitive (51) allows each party to hold a quantum state as input, and the parties jointly wish to compute a quantum operation U.

Next, we focus on distributed systems, which are formed when several computing devices are connected, sometimes colloquially referred to as a cloud. Many challenges arise in the coordination and control of such systems that may be less familiar to a physicist. As a very simple example, consider a bank transaction being recorded redundantly on several backup servers. If one or more of the backup servers fail during the update, then they may later show inconsistent data (for example, $1 million versus$0). Tool protocols for achieving consensus between processors are widely deployed in practice—for example, in Google’s Chubby system (52). Outside the domain of the internet itself, examples include the reliability in smart grids, flight control systems, and sensor arrays.

Last, this stage allows distributed computational tasks to be solved by transmitting in some cases even exponentially fewer (58) qubits than classical bits. A notable example is fingerprinting (59). However, these protocols generally require a large number of qubits at each end node to achieve a substantial advantage. Specific variants of such protocols with energy constraints can also be realized at lower stages (60). Last, the presence of entanglement also brings new security issues for existing classical protocols (61), requiring new insights and analysis.

## Implementation status and challenges

The current experimental status of long-distance quantum networks is at the lowest stage—trusted-repeater networks—with several commercial systems for QKD on the market. The first extended trusted repeater networks have already been implemented over metropolitan distances (6265), and a long-distance implementation has recently been completed (66). The hardware required at the lowest stage (mainly light sources, optical links, and detectors) has been described in detail in previous literature (14, 23). Realizing the first stage with end-to-end quantum functionality—prepare-and-measure networks—over long distances demands the use of quantum repeaters to bridge long distances via intermediate qubit storage or error correction, as well as routers to forward the quantum state to the desired node. Several recent experiments have demonstrated elements belonging to this and higher stages at short distances, suggesting that higher-functionality networks are within reach. To put these experiments into the right perspective, we briefly summarize the main requirements for three types of quantum internet hardware.

### Photonic communication channels

Photonic channels establish quantum links between the distant repeater stations and between the end nodes. Two types of photonic channels can be distinguished: free-space channels [potentially via satellites (67, 68)] and fiber-based channels. Each has its own advantages and disadvantages, and a future quantum internet—similar to the current classical internet—may use a combination of them. We require these channels to exhibit minimal photon loss and decoherence. The effect of photon loss on fidelity can in general be dealt with by photon-heralding protocols, but photon loss unavoidably affects the communication rate across the network. For photons in the telecom frequency bands, loss in fibers can be as low as 0.2 dB/km. Decoherence can in general be overcome through entanglement distillation (6971), which requires additional levels of qubit processing. Last, the bandwidth of the channels is of practical importance; multiplexing in frequency, time, spatial, and/or polarization degrees of freedom allows for increases of the communication rates.

### End nodes

For the quantum internet to reach its full potential, the end nodes need to meet the following requirements.

(i) Robust storage of quantum states during the time needed to establish entanglement between end nodes. This robustness must persist under quantum operations performed on the end node.

(ii) High-fidelity processing of quantum information within the node. For the more advanced tasks, multiple qubits will be required, making the end nodes similar to small-scale quantum computers.

(iii) Compatibility with photonic communication hardware: efficient interface to light at the relevant wavelength (telecom bands for fiber-based networks).

Several experimental platforms are currently being pursued for the end nodes. Each of these combines well-controlled matter-based qubits with a quantum optical interface via internal electronic transitions. The generation of photon-mediated entanglement between distant matter qubits has been achieved with trapped ions (72), atoms (73, 74), nitrogen-vacancy (N-V) centers in diamond (75), and semiconductor quantum dots (76, 77) over distances up to 1.3 km (78). By using measurement-based schemes with heralding, high-fidelity entangled states could be created in these experiments, even though substantial photon loss was present. The major challenge in extending these point-to-point entangled links into true networks is the robust storage of quantum states. The intrinsic coherence times of most above-mentioned platforms are very long (for instance, more than a second for ions and N-V centers). However, cross-talk caused by unwanted couplings or imperfect individual addressability can severely affect the coherence of a memory qubit under operations on another qubit in the same node (79, 80).

A promising approach is to use different types of qubits within a node. For instance, trapping different species of ions allows for individual addressing of the ions via their different electronic transition frequencies (8183). In a similar fashion, carbon-13 nuclear spins near a diamond N-V center provide a robust register of memory qubits that do not interact with the laser control fields on the N-V electron spin (84). In a very recent experiment, such hybrid network nodes enabled the generation of two remote entangled states on which entanglement distillation could then be performed (85). If several of such robust memories can be successfully integrated into a multiqubit network node, the highest stages of the quantum internet may come into reach.

Another challenge for most of the above systems is that these do not intrinsically couple to light in the telecom band. To fulfill requirement (iii), wavelength conversion at the single-photon level can be used. Pioneering experiments using nonlinear optics (86, 87) have already demonstrated the feasibility of such conversion; the current challenge is to realize a robust and high-efficiency (say, >50%) converter that exhibits a high signal-to-noise ratio (say, >100).

As an alternative to the above systems with intrinsic optical interface, the end nodes could be formed from a quantum processor with qubit frequencies in the microwave domain, such as a superconducting qubit circuit, in combination with a microwave-to-optical conversion process. The physics of such a conversion—for instance, by use of mechanical resonators (88, 89) or atomic transitions (90)—is currently being investigated in many laboratories.

### Quantum repeater requirements

Quantum repeater stations need to improve the rate of photonic qubit transfer. The requirements for quantum repeaters are similar to but less strict than for the end nodes. In particular, depending on the exact architecture [(91), review], the storage of quantum states may only be required for the time needed to establish entanglement between the nearest active nodes; this storage time can deviate substantially from that required for the end nodes. Also, the qubit processing capabilities required are limited, and therefore systems different from the ones above can be considered. As a prime example, an ensemble of atoms and ions either in gas phase or in a solid can be used as an on-demand quantum memory (92). If the memory can herald the arrival of a photon and store the photon’s quantum state, photon loss can be efficiently mitigated. Storage and on-demand retrieval have already been achieved (9396), although efficiencies are still to be improved. Such memories also allow for multiplexing within a single device. Furthermore, they are compatible with current-day down-conversion sources for entangled photon pairs. Current challenges are to combine heralding and on-demand high-efficiency retrieval with long coherence times.

A radically different approach to quantum repeaters has emerged in recent years in which the quantum state of interest is encoded in multiple photons so that error correction performed at the repeater stations can erase errors caused by photon loss and decoherence during transmission (97100). The main advantage of such a scheme is that the classical two-way communication of standard repeater schemes (necessary to convey the heralding signal of whether or not the photons arrived at the stations) becomes obsolete. The communication rates of these schemes are therefore potentially much higher. However, the experimental demands seem daunting at present; for encoding the qubit, the near-deterministic generation of a many-photon cluster state is required, which is far beyond the state of the art (101). Furthermore, because these schemes require quantum error correction, they will only work if the error thresholds associated with the desired transmission qualities are met, thus placing more stringent requirements on the control and readout fidelities within the repeater nodes. That being said, theory research (102) in this direction is likely to yield more insights, and experimental progress may bring such schemes closer to reality in the future.

Last, the end nodes that are currently being developed may also function themselves as repeaters.

### Network stack requirements

In order to enable widespread use and application development, it is essential to develop methods that allow quantum protocols to connect to the underlying hardware implementation transparently and to make fast and reactive decisions for generating entanglement in the network in order to mitigate limited qubit lifetimes (Fig. 5). Classically, this is achieved by a series of layered protocols such as the Transmission Control Protocol/Internet Protocol (TCP/IP) (103) that provide an abstraction that ultimately allows application protocols to exchange data between two end nodes without having to know any details on how this connection is actually realized. No such network stack presently exists for a quantum internet, and only some basic elements have been noted (104). As a trivial example on why a new stack is required for a quantum network, the first novel feature is a mapping between classical control information (header) and the underlying qubits. By contrast, classically a header and data may be nicely combined in one piece of data to be transmitted. Another example is the use of error detection at the link layer of the classical network stack that does not easily translate to a realistic quantum network. Clearly, error detection can theoretically be realized by using quantum error-correcting codes, but this method may be prohibitively expensive in practice, and other methods (105) may be more suitable. These are just two simple examples of the challenges involved in designing such a network stack, calling for substantial development.

Although it is hard to predict what the exact physical components of a future quantum internet will be, it is likely that we will see the birth of the first multinode quantum networks in the next few years. This development brings the exciting opportunity to test all the ideas and functionalities that so far only exist on paper and may indeed be the dawn of a future large-scale quantum internet.

## References and Notes

Acknowledgments: We thank J. Borregaard, E. Diamanti, D. Englund, R. A. Friedman, T. Northup, I. Kerenidis, W. Tittel, and all members of the Quantum Internet Alliance collaboration for feedback on earlier versions of this document. Funding: D.E. and S.W. are funded by an ERC Starting Grant (S.W.) and an NWO VIDI Grant (S.W.). R.H. is funded by an ERC Consolidator Grant and an NWO VICI Grant. R.H. and S.W. are also supported by the NWO Zwaartekracht Grant QSC. D.E., R.H., and S.W. are also funded by the EU H2020 FETFLAG Quantum Internet Alliance. Competing interests: There are no competing interests.