Fully heterogeneous prepare-and-measure quantum network for the next stage of quantum internet

Fully heterogeneous networking

In previous quantum networks, network nodes are typically required to hold both of transmitter and a detector with strictly limited DoF. In contrast, our network releases the requirement. The nodes only possess one of the transmission or detection. As the mainstream QC systems can be separated into weak coherent transmitter, entanglement transmitter, and single-photon detector, nodes in our network can also be divided into three fundamental types: nodes with weak coherent sources (C-type nodes), with entanglement sources (E-type nodes), and with single-photon detectors (D-type nodes). C and E-type nodes can also be referred to as source-type (S-type) collectively. As listed in Table 1, any two nodes can achieve end-to-end communication by properly selecting their protocol. For instance, a S-type node can share secret keys with a D-type node by P&M-type protocol^{1,35,36,37,38}; two C-type nodes can communicate by executing the MDI-type protocol^40,41,42 with the assistance of D-type nodes; similarly, two D-type nodes can share secret keys by performing the entanglement-based protocols^44,45 with the assistance of E-type nodes (for entanglement distribution), the nodes can also freely select any mainstream DoF to encode their information. Two nodes with different DoFs can perform the quantum tasks by utilizing our DoF converter, which ensures precise and high-fidelity conversion of their DoF to Pol., T.B.P., or Pha.

User nodes with different fundamental types and different DoFs access the network through the topology as shown in Fig. 1. Compared with the previous networks^{22,23,24,25,26,27,28,29,30,31,32}, our network does not require full connection or centralization. User nodes with the same type do not need to be interconnected. The server consists of distributed infrastructure devices and a centralized controller. As a P&M quantum network, the server is considered as part of the channel and therefore do not introduce any additional security assumptions. The server performs path planning and node scheduling based on communication requests and optimal parameters^61,62,63,64. Except for the direct link between S-type and D-type nodes, the server can also provide or borrow E-type or D-type nodes for entanglement distribution or Bell-state measurement (BSM) to assist the EB protocols and MDI-type protocols. These untrusted E-type and D-type nodes can belong to server or inactive user nodes. Especially, some of the D-type nodes cannot perform the BSMs independently. Thus, we propose a joint-BSM to schedule several D-type nodes to complete the BSM collaboratively (see “METHOD” for details). Notably, the BSM serves as part of the MDI-QKD protocol.

Orange, yellow, and light blue cylinders: E, C, and D-type nodes; green cylinders: DoF converters; deep blue cylinders: router; gray arrows: the flow of quantum signals. Text on nodes represents their type and DoF. Only cylinders with a user icon represent user nodes. This indicates that some D-type and E-type nodes belong to the server and can be employed as untrusted relays. A cylinder with a DoF converter icon means the node has its own DoF converters. The quantum router consists of optical switches, splitters, couplers, wavelength division multiplexers, and other components.

With the above schemes and designs, we have realized the hardware heterogeneity, enabling more flexible configurations, broader coverage, and lower costs. However, hardware heterogeneity alone is insufficient to classify our network as fully heterogeneous. To address this, we introduce an SD-P&M-QN architecture to enable software heterogeneity, ensuring both agility and versatility,^33,46, which are also fundamental requirements for the classical internet. Agility^33,34 refers to the resource-efficient replacement of a cryptographic core when security is compromised, while versatility allows nodes to switch tasks without requiring any knowledge of the underlying implementation details³³. Our SD-P&M-QN architecture effectively guarantees these properties by providing a universal platform for real-time information collection and heterogeneous quantum task support. In addition, it incorporates a three-layer architecture with a centralized controller to facilitate quantum protocol switching and global optimization (see “METHOD” for details).

To summarize, our fully heterogeneous networking enables the integration of diverse setups and DoFs, enhancing flexibility, scalability, and performance. At the same time, it supports a variety of quantum tasks and protocols, ensuring agility and versatility. Given the critical role of heterogeneity in the classical Internet, our work is poised to advance the quantum Internet toward the next stage, i.e., the realization of a P&M-QN.

Experimental setup

To demonstrate the superiority of fully heterogeneous networking, we established a five-node quantum communication network, which included one D-type (David) node and four C-type nodes (Alice, Bob, Charlie, Frank). The authentication between the five nodes is realized by the pre-shared secret keys⁶⁵. The four C-type nodes held different modulation systems and encoded quantum states in different DoFs. With the experimental network, we successfully realized the end-to-end quantum tasks among the five heterogeneous nodes without any trusted repeater. We also demonstrated how the DoF converter and orchestration core transferred DoFs, switched quantum protocols, switched quantum tasks, and optimized parameters according to the node type, requirement, hardware, and network resources. Especially, we successfully realized a five-node QBA with two malicious nodes, which is also the first multiple malicious-node QBA experiment in the world.

As illustrated in Fig. 2, each of the four C-type nodes are abstracted to several modules. The coherent pulses were initially generated by the pulse module, which consisted of a CW laser (Wavelength References Clarity-NLL-1542-HP), a LiNbO₃-based phase modulator (PM), and two LiNbO₃-based intensity modulators (IMs). The CW laser, which was frequency-locked to a molecular absorption line at a center wavelength of 1542.8 nm with an accuracy of approximately 10 MHz in the spectral domain, serves as the source. The first IM functioned as a chopper, converting the CW laser into a pulse train with a 200 ps pulse width and 1 GHz repetition rate. The subsequent PM randomized the pulse phase to ensure security. Finally, the second IM applied random modulation to generate several pre-decided intensities for the decoy-state method^66,67,68. The modulators were driven by our electronic system, which consists of AWGs, homemade circuits, and RF-amplifiers.

LD laser diode, PM phase modulator, IM intensity modulator, OS optical switch EVOA electric variable optical attenuator, BS beam splitter, PBS polarization beam splitter, Circ circulator, FM Faraday mirror, PS phase shifter, SPD single-photon detector, EPC electric polarization controller, PC polarization controller, Mod module. Server: the server consists of the manual fiber-link switching and control programs in this experiment, Adap.Mod Adapting module, consisting of the DoF converter and supporting components.

Following the pulse module, the pulse train was fed into the encoding module to encode the quantum states. The main differences lay within this module. Alice employed Pol. modulation^60,69. She first adjusted the Pol. of her pulses to a diagonal Pol. and then fed them into a Sagnac structure via a Pol. beam splitter (PBS). The horizontal and vertical components were split into clockwise and counterclockwise pulses, respectively, in the Sagnac ring and then sequentially propagated through the PM. As a result, the PM independently modulated the pulses and controlled the relative phase between the horizontal and vertical components. Frank held a phase modulation system³¹. He first split one pulse to the superposition of early and late T.B.P. state via an asymmetric Mach-Zehnder interferometer (AMZI) that consisted of two paths with a 500 ps optical path difference. Then, a PM was driven in 2 GHz frequency to modulate the phase difference between the two T.B.P. states. Both Bob and Charlie employed the T.B.P. encoding, but their realizations were different. Bob generated the T.B.P. superposition with an AMZI (500 ps optical path difference) and driven a PM in 2 GHz frequency to modulate the phase difference between the two T.B.P. states. An additional IM was added to eliminate the early-bin or late-bin pulses, thereby modulating the two T.B.P. eigenstates, or to halve the intensity, thereby modulating the superpositions. Different from Bob, Charlie fed his pulses to a Faraday-Michelson interferometer (FMI)⁷⁰ with also a 500 ps optical path difference to split them to the two time-bins and then drove an IM and a PM to modulate the T.B.P. states.

After that, an adapter module consists of our DoF converter and supporting components was employed, allowing nodes to select a path to maintain or transfer their DoF according to circumstances. The selection was realized by a pair of 2 × 1 optical switches (OS). The nodes directed the pulses to pass through a fiber channel to maintain their DoF, or switched the OS to feed the pulses to the DoF converter to transfer the DoF. In this experiment, a passive structure (see “METHOD” for an active structure) was employed for the DoF converter. It has a Pol. port and a T.B.P. port. Alice fed her Pol. state \(a\left\vert H\right\rangle+b{e}^{i\theta }\left\vert V\right\rangle\) to the module from the Pol. port, the \(\left\vert H\right\rangle\) and \(\left\vert V\right\rangle\) components were split into two different paths by a PBS, passed through different delay, and then converged in a coupler to be transferred to the T.B.P. state \(a\left\vert e\right\rangle+b{e}^{i\theta }\left\vert l\right\rangle\) and left the module from the T.B.P. port. Conversely, Bob, Charlie, and Frank fed their T.B.P. or Pha. states to the module from the T.B.P. port, split to the two paths by the BS (reverse of the coupler), pass through different delay, and then converge in the PBS to be transferred to the Pol. state \(a\left\vert H\right\rangle+b{e}^{i\theta }\left\vert V\right\rangle\). An IM following the module was employed to eliminate the excess pulses. Finally, the nodes attenuated their pulse to an optimized mean photon number by their electric variable optical attenuator (EVOA) and sent them to the channel. We emphasize the DoF converter can be employed by the server or nodes. In our experiment, the passive DoF converter has at least 3 dB loss, so we set them at C-type nodes for compensating the loss.

The D-type node David held a typical passive Pol. decoding system⁶⁰. The four homemade InGaAS-based SPDs⁷¹ worked at 1 GHz gated mode and fine-tuned to a 20% detection efficiency and a 10⁻⁶ level dark count rate. When David communicated with other nodes, they performed a P&M protocol. The other four nodes prepared or transferred their states on the Pol. DoF and sent them to David by the quantum channel. David used 50:50 BS and adjusted the two EPCs to realized a balanced basis selection. The four homemade SPDs were employed to measure the \(\left\vert H\right\rangle\), \(\left\vert V\right\rangle\), \(\sqrt{2}(\left\vert H\right\rangle+\left\vert V\right\rangle )/2\), \(\sqrt{2}(\left\vert H\right\rangle -\left\vert V\right\rangle )/2\), respectively. Besides, we indicate that David can also perform the BSM by adjusting the EPC and SPD delay. When the two C-type nodes wanted to establish an end-to-end communication, the server invoked David as an untrusted measurement relay. The two nodes first transferred their states to the same DoF and sent them to David for performing the MDI protocol. In our experiment, Bob-Charlie performed a T.B.P.-based MDI protocol directly. Other pairs performed a Pol.-based MDI protocol. When David assists the T.B.P.-based MDI protocol, he adjusted the delay of SPD1 and SPD3 to detect the early and late bin, respectively, while employing the other two SPDs to assist the Pol. calibration⁷². When Bob assists the Pol. based protocol, he adjusted his EPCs to perform a standard Pol. BSM^40,69,73, in which SPD1, SPD3 detected the \(\left\vert H\right\rangle\) component, and SPD2, SPD4 detected the \(\left\vert V\right\rangle\) component. David publicly announced his measurement results⁴⁰ and the two C-type nodes generated their raw bits according to the announcement.

Alice, Bob, Charlie, Frank, and David were connected to the server with fiber spools of 5, 11, 5, 8, and 25 km, respectively. In our control program, six different C++ classes are constructed — five for individually controlling each node and one for the server. In our experiment, a single process instantiates the six C++ classes, spawning six threads. Five threads emulate user nodes and one thread emulates the server, thereby simulating the distributed network architecture. Based on the requirements and terminal information, the orchestration core selects an appropriate quantum task and protocol according to a predefined rule. The server routed the quantum channel (Micro-electro-mechanical systems can programmatically route the quantum channel. In this setup, we manually switch the node links, which does not affect our conclusions) and informed the nodes of the channel parameters. According to the parameters of terminals and channel, the orchestration core loaded optimized parameters^63,74 (including decoy-state intensities and selection probabilities) from a pre-established optimal-parameter table. After that, the nodes and the server calibrated the phase references, Pol., mean-photon number, and time delay by adjusting their phase shifter (PSs), EPC, EVOA, and circuits. The communication generates secret keys between the two end-to-end nodes, some of the keys could be consumed by the current task, and the remained keys are saved in their pre-established key pools⁷⁵ for further applications.

Experimental results

QKD

QKD is one of the most successful and foundational applications of quantum technology, making it the natural choice for our first demonstration. Here, we demonstrated all possible combinations of end-to-end QKD among the five nodes. Following the aforementioned process, the nodes and server exchanged terminal information, established the quantum channel, selected the protocol, loaded optimal parameters, and calibrated their systems with the assistance of the orchestration core in the SD-P&M-QN architecture. The experimental results are summarized in Fig. 3.

a 3D bar chart to show the secret key length of each node pair. The x and y-axis represent the two nodes. The z-axis denotes the secret key length. b Important experimental parameters and results of each node pair. A: Alice; B: Bob; C: Charlie; D: David; F: Frank; T: time for raw key accumulation; L: fiber length between the two nodes; f: error correction efficiency; l_sift: sifted key length; e_b: bit error rate; l_sec: secret key length.

In accordance with the pre-defined rules in Table 1, the orchestration core selected the BB84-QKD protocol for D-C-type combinations, including Alice-David, Bob-David, Charlie-David, and Frank-David. Since David held a passive Pol. decoder, the other transmitters (except Alice) must convert their DoF to Pol. using the DoF converter before sending their pulses to David. Each pair executed QKD for 2 seconds (2 × 10⁹ rounds) to generate enough raw key bits, mitigating the finite-key-size effect⁶³. The sifted key bits were processed by cascade error correction⁷⁶ and privacy amplification⁷⁷, resulting in about 5.90 × 10⁶, 5.38 × 10⁶, 5.64 × 10⁶, and 4.50 × 10⁶ secret key bits stored in each QKP.

For C-C-type combinations, the orchestration core selected the MDI-QKD protocol, with the server designated David as the untrusted measurement unit to assist communication. For the Alice-Bob, Alice-Charlie, and Alice-Frank pairs, the orchestration core opted for Pol. based MDI-QKD. Bob, Charlie, and Frank converted their DoF to Pol. using their DoF converters. For the Bob-Frank and Charlie-Frank pairs, both nodes transferred their DoF to Pol. via their DoF converters. David adjusted his EPCs to compensate for channel disturbances and performed a Pol.-based BSM. For the Bob-Charlie pair, since both of them utilized the T.B.P. encoder, their orchestration cores directly prepared T.B.P. states, which were sent to David for a T.B.P.-based BSM. David adjusted the gated times of SPD1 and SPD3 to detect early and late time bins, respectively, and optimized his EPCs to achieve high Hong-Ou-Mandel (HOM) visibility. Each C-C-type pair executed QKD for 1000 seconds (10¹² rounds) to counteract the finite-key-size effect. They also processed their raw key bits by the aforementioned error correction and privacy amplification, resulting in 3.94 × 10⁵, 5.66 × 10⁵, 5.46 × 10⁵, 1.11 × 10⁶, 7.30 × 10⁵, and 4.49 × 10⁵ secret key bits stored in the respective QKPs.

QDS

QDS is another important quantum task that ensures integrity, authenticity, and non-repudiation. By leveraging the key resources generated through quantum processes such as QKD and integrating one-time universal hashing and one-time pad operations, QDS extends the computational security of classical digital signatures to information-theoretic security in a three-party quantum scenario. We took two quantum e-commerce processes^78,79 in our heterogeneous network to demonstrate the QDS. In the two demonstrations, Alice was a client who wants to online purchase some products from merchants David and Charlie, respectively.

The first demonstration was the trading between Alice and David. They first randomly designated a node from the network as a third party (TP) to assist the QDS. Without loss of generality, we designated Bob as the TP in the experiment. The Merchant David built two quantum channels with the client Alice and the TP Bob. Then their operation systems invoked the hardware to randomly modulate four Pol. based BB84-states and three optimized intensities⁶³ for distributing non-secret but error-corrected keys (we name them imperfect keys for simplicity). Here, Alice (Bob) and David kept the communication for 2 s and generated raw key bits with an error rate of 1.05% (0.89%). 1.276 × 10⁷ (1.641 × 10⁷) bits of error-corrected keys was generated by the cascade error correction algorithm⁷⁶. The privacy amplification was executed here thus the keys were imperfect.

David prepared a 43 KB contract file C_D and selected two 900-bit imperfect quantum key strings X_A and Y_A (X_B and Y_B) from the error-corrected keys with Alice (Bob). Then he randomly generated an irreducible polynomial and performs the division hashing⁸⁰ on the contract C_D to get the hash value. By utilizing the combined key strings X_D = X_A ⊕ X_B and Y_D= Y_A ⊕ Y_B to perform the one-time pad operation on the coefficient of the polynomial and the hash value, the signature S_D of C_D was obtained. The contract and its signature were first sent to Alice. Alice checked the contract, then transfers C_D, S_D, and her corresponding imperfect key X_A and Y_A to Bob (if she accepted the contract). Bob checked the contract and sent his key strings X_B and Y_B to Alice. Both Alice and Bob independently verified the signature of the contract. Alice paid the money if both of their verification were passed. In our experiment, this group passed the verification after consuming 1800 bit keys. The maximum key generation (ignore the time of data process) and imperfect key consumption of David-Alice (David-Bob) were 6382375 bit/s and 1800 bit/times (8205939 bit/s and 1800 bit/times). The signature rate depends on the keys of a lower key rate, thus, they achieved a signature rate of 3545 times/s (David-Alice has a lower key rate).

In another trade between Alice and Charlie, another QDS protocol were selected. In this protocol, the perfect secret keys were required, thus, they randomly designated a TP (in this experiment, Frank was designated) and then took 53 bit secret key strings X_A and Y_A, X_F and Y_F from the QKP of Alice-Charlie, Frank-Charlie, respectively. Then they used the perfect secret keys to repeat the procedure of signature, transference, and verification similarly to the previous group. This group finally passed the verification after consuming 106 bit keys. The filling rates of the two QKPs were 566.247 bit/s and 729.713 bit/s, respectively, with secret key consumption of 106 bits per transaction. The signature rate depends on the keys of Alice-Charlie, thus achieved a signature rate of 5.34 times/s. The experimental results are shown in Fig. 4.

The blue and red curves represent the simulated signature rate versus fiber length of the first QDS (with imperfect keys) and the second QDS (with secret keys), respectively. Since the QDS refers to two pairs of keys, the signature rate depends on the keys of a lower key rate. The red solid (dash) line represents the case that A-D (B-D) has a lower key rate. The blue solid (dash) line represents A-C (F-C) has a lower key rate. The red and blue stars denote the first and second QDS experiment results, corresponding to the key rates of A-D and A-C, respectively.

QBA

Byzantine agreement aims to enable all nodes in a decentralized network to reach consensus, and it plays a crucial role in applications such as distributed ledger, blockchain, and quality traceability. Compared to classical Byzantine agreement (CBA), QBA^53,54 offers unconditional security and surpasses the 1/3 fault-tolerance bound of CBA, thanks to the multiparty correlations provided by QDS. The general protocol steps of the QBA protocol for arbitrary N network nodes, as well as its communication complexity, consensus rate, and rigorous security proofs, can be found in ref. ⁵³. In this demonstration, we present the distributed ledger based on the recently proposed QBA protocol⁵³, illustrating how users in our network reach consensus on a trading transaction. The trade is recorded by all nodes in the network through QBA, and all honest nodes will reach the same consensus. This consensus can only be disrupted if malicious nodes exceed 1/2 of the network, thereby surpassing the 1/3 fault-tolerance bound of CBA. This is also the first complete QBA experiment to showcase quantum superiority in the presence of multiple malicious nodes.

In this demonstration, we presented two trading transactions in the network. In the first case, Alice, as an honest signer, attempted to record a 0.1 MB trading file, while Charlie and Frank, as malicious nodes, attempted to disrupt the recording process. In the second case, Alice was a malicious signer who wants to cheat other nodes, with Bob as her collaborator. The QBA protocol operates based on the recursion of multicast rounds and QDS. In each multicast round, there was a primary node, and the others acted as backups. The primary sent the file and its signature to the backups, one of which was chosen as the forwarder, while the others became verifiers. The primary, forwarder and one verifier performed a three-party QDS to transmitted the message. The signing was successful only if both the forwarder and verifier accepted the signature. This process repeated until all backups had served as forwarders. Ultimately, there ware 5 broadcasting rounds of the two demonstrations respectively, including 72 round QDS in total, and the consumption of the secure keys in the QKP was shown in Fig. 5.

The blue and red colors emphasize honesty and maliciousness, respectively. The circles represent the user nodes. The thick arrows and thin arrows denote the multicast messages and forward messages, respectively. The depth of the five-node QBA is two. Sub-figure (a) and (b) represent the depth-1 multicast in the two trades, respectively. a depth-1 multicast of the trade one (honest signer). b depth-1 multicast of the trade two (malicious signer). c QDS as the basic unit of a QBA experiment. d depth-2 multicast among the remaining four nodes. There are four multicast rounds in depth-2. We define the four nodes as N_i (i = 0, 1, 2, 3). N₀ is the primary node and N₀= B, C, D, F in the four multicast rounds, respectively. N₁ to N₂ are remained three nodes in each multicast round. e consumption of each QKP in each multicast round (unit: bit). The columns of the table indicate the multicast corresponding to the primary node, and the rows indicate the corresponding QKP.

Quantum conference

Quantum conference is a quantum task for establishing a common secret key with unconditional security between multi-parties. Notably, here we realize the quantum conference by the QKD-based key delivery^55,56 rather than the multiparty agreement^{43,81,82,83,84,85,86}, as this approach offers simpler implementation, higher efficiency, and better compatibility with our network architecture while maintaining information-theoretic security. In our demonstration, David is the sponsor of the meeting. He first generates a quantum random number series by his local quantum random number. Then he independently distributes equal-length symmetric secret keys with all other participants by QKD, encrypts the quantum random number by one-time-pad with the secret keys, and sends it to the corresponding participant by public channel. The participant decrypts the ciphertext using the secret keys to obtain the quantum random number, which is exploited as the conference keys.

In this experiment, David generated 10 Kbit quantum random numbers by our quantum random number generator (QRNG)⁸⁷ with a 1.34 Mbps random number generation rate. Then he extracted 10 Kbit secret keys from each of his four QKPs, encrypted the random number separately with each key, and sent them to the corresponding nodes. Alice, Bob, Charlie, and Frank decrypted the ciphertext with their own secret keys and obtained the 10 Kbit quantum random number as the secret conference keys.