3.1. Quantum Cryptography Applications

Examples of quantum cryptography applications include quantum-based secure communication setup and fast Byzantine negotiation.¶

Secure communication setup:

Refers to secure cryptographic key distribution between two or more end nodes. The most well-known method is referred to as "Quantum Key Distribution (QKD)" [Renner].¶

Fast Byzantine negotiation:

Refers to a quantum-based method for fast agreement in Byzantine negotiations [Ben-Or], for example, to reduce the number of expected communication rounds and, in turn, to achieve faster agreement, in contrast to classical Byzantine negotiations. A quantum-aided Byzantine agreement on quantum repeater networks as proposed in [Taherkhani] includes optimization techniques to greatly reduce the quantum circuit depth and the number of qubits in each node. Quantum-based methods for fast agreement in Byzantine negotiations can be used for improving consensus protocols such as practical Byzantine Fault Tolerance (pBFT) as well as other distributed computing features that use Byzantine negotiations.¶

Quantum money:

Refers to the main security requirement of money is unforgeability. A quantum money scheme aims to exploit the no-cloning property of the unknown quantum states. Though the original idea of quantum money dates back to 1970, these early protocols allow only the issuing bank to verify a quantum banknote. However, the recent protocols such as public key quantum money [Zhandry] allow anyone to verify the banknotes locally.¶

3.2. Quantum Sensing and Metrology Applications

The entanglement, superposition, interference, and squeezing of properties can enhance the sensitivity of the quantum sensors and eventually can outperform the classical strategies. Examples of quantum sensor applications include network clock synchronization, high-sensitivity sensing, etc. These applications mainly leverage a network of entangled quantum sensors (i.e., quantum sensor networks) for high-precision, multiparameter estimation [Proctor].¶

Network clock synchronization:

Refers to a world wide set of high-precision clocks connected by the Quantum Internet to achieve an ultra precise clock signal [Komar] with fundamental precision limits set by quantum theory.¶

High-sensitivity sensing:

Refers to applications that leverage quantum phenomena to achieve reliable nanoscale sensing of physical magnitudes. For example, [Guo] uses an entangled quantum network for measuring the average phase shift among multiple distributed nodes.¶

Interferometric telescopes using quantum information:

Refers to interferometric techniques that are used to combine signals from two or more telescopes to obtain measurements with higher resolution than what could be obtained with either telescope individually. It can make measurements of very small astronomical objects if the telescopes are spread out over a wide area. However, the phase fluctuations and photon loss introduced by the communication channel between the telescopes put a limitation on the baseline lengths of the optical interferometers. This limitation can potentially be avoided using quantum teleportation. In general, by sharing Einstein-Podolsky-Rosen pairs using quantum repeaters, the optical interferometers can communicate photons over long distances, providing arbitrarily long baselines [Gottesman2012].¶

3.3. Quantum Computing Applications

In this section, we include the applications for the quantum computing. It's anticipated that quantum computers as a cloud service will become more available in future. Sometimes, to run such applications in the cloud while preserving the privacy, a client and a server need to exchange qubits (e.g., in blind quantum computation [Fitzsimons] as described below). Therefore, such privacy preserving quantum computing applications require a Quantum Internet to execute.¶

Examples of quantum computing include distributed quantum computing and blind quantum computing, which can enable new types of cloud computing.¶

Distributed quantum computing:

Refers to a collection of small-capacity, remote quantum computers (i.e., each supporting a relatively small number of qubits) that are connected and work together in a coordinated fashion so as to simulate a virtual large capacity quantum computer [Wehner].¶

Blind quantum computing:

Refers to private, or blind, quantum computation, which provides a way for a client to delegate a computation task to one or more remote quantum computers without disclosing the source data to be computed [Fitzsimons].¶

4.1. Secure Communication Setup

In this scenario, two nodes (e.g., quantum node A and quantum node B) need to have secure communications for transmitting confidential information (see Figure 1). For this purpose, they first need to securely share a classic secret cryptographic key (i.e., a sequence of classical bits), which is triggered by an end user with local secure interface to quantum node A. This results in a quantum node A securely establishing a classical secret key with a quantum node B. This is referred to as a "secure communication setup". Note that quantum nodes A and B may be either a bare-bone quantum end node or a full-fledged quantum computer. This application scenario shows that the Quantum Internet can be leveraged to improve the security of Classical Internet applications.¶

One requirement for this secure communication setup process is that it should not be vulnerable to any classical or quantum computing attack. This can be realized using QKD, which is unbreakable in principle. QKD can securely establish a secret key between two quantum nodes, using a classical authentication channel and insecure quantum channel without physically transmitting the key through the network and thus achieving the required security. However, care must be taken to ensure that the QKD system is safe against physical side-channel attacks that can compromise the system. An example of a physical side-channel attack is to surreptitiously inject additional light into the optical devices used in QKD to learn side information about the system such as the polarization. Other specialized physical attacks against QKD also use a classical authentication channel and an insecure quantum channel such as the phase-remapping attack, photon number splitting attack, and decoy state attack [Zhao2018]. QKD can be used for many other cryptographic communications, such as IPsec and Transport Layer Security (TLS), where involved parties need to establish a shared security key, although it usually introduces a high latency.¶

QKD is the most mature feature of quantum information technology and has been commercially released in small-scale and short-distance deployments. More QKD use cases are described in the ETSI document [ETSI-QKD-UseCases]; in addition, interfaces between QKD users and QKD devices are specified in the ETSI document [ETSI-QKD-Interfaces].¶

In general, the prepare-and-measure QKD protocols (e.g., [BB84]) without using entanglement work as follows:¶

1. The quantum node A encodes classical bits to qubits. Basically, the node A generates two random classical bit strings X and Y. Among them, it uses the bit string X to choose the basis and uses Y to choose the state corresponding to the chosen basis. For example, if X=0, then in case of the BB84 protocol, Alice prepares the state in {|0>, |1>}-basis; otherwise, she prepares the state in {|+>, |->}-basis. Similarly, if Y=0, then Alice prepares the qubit as either |0> or |+> (depending on the value of X); and if Y =1, then Alice prepares the qubit as either |1> or |->.¶
2. The quantum node A sends qubits to the quantum node B via a quantum channel.¶
3. The quantum node B receives qubits and measures each of them in one of the two bases at random.¶
4. The quantum node B informs the quantum node A of its choice of bases for each qubit.¶
5. The quantum node A informs the quantum node B which random quantum basis is correct.¶
6. Both nodes discard any measurement bit under different quantum bases, and the remaining bits could be used as the secret key. Before generating the final secret key, there is a post-processing procedure over authenticated classical channels. The classical post-processing part can be subdivided into three steps, namely parameter estimation, error correction, and privacy amplification. In the parameter estimation phase, both Alice and Bob use some of the bits to estimate the channel error. If it is larger than some threshold value, they abort the protocol or otherwise move to the error-correction phase. Basically, if an eavesdropper tries to intercept and read qubits sent from node A to node B, the eavesdropper will be detected due to the entropic uncertainty relation property theorem of quantum mechanics. As a part of the post-processing procedure, both nodes usually also perform information reconciliation [Elkouss] for efficient error correction and/or conduct privacy amplification [Tang] for generating the final information-theoretical secure keys.¶
7. The post-processing procedure needs to be performed over an authenticated classical channel. In other words, the quantum node A and the quantum node B need to authenticate the classical channel to make sure there is no eavesdroppers or on-path attacks, according to certain authentication protocols such as that described in [Kiktenko]. In [Kiktenko], the authenticity of the classical channel is checked at the very end of the post-processing procedure instead of doing it for each classical message exchanged between the quantum node A and the quantum node B.¶

It is worth noting that:¶

1. There are many enhanced QKD protocols based on [BB84]. For example, a series of loopholes have been identified due to the imperfections of measurement devices; there are several solutions to take into account concerning these attacks such as measurement-device-independent QKD [Zheng2019]. These enhanced QKD protocols can work differently than the steps of BB84 protocol [BB84].¶
2. For large-scale QKD, QKD Networks (QKDNs) are required, which can be regarded as a subset of a Quantum Internet. A QKDN may consist of a QKD application layer, a QKD network layer, and a QKD link layer [Qin]. One or multiple trusted QKD relays [Zhang2018] may exist between the quantum node A and the quantum node B, which are connected by a QKDN. Alternatively, a QKDN may rely on entanglement distribution and entanglement-based QKD protocols; as a result, quantum repeaters and/or routers instead of trusted QKD relays are needed for large-scale QKD. Entanglement swapping can be leveraged to realize entanglement distribution.¶
3. QKD provides an information-theoretical way to share secret keys between two parties (i.e., a transmitter and a receiver) in the presence of an eavesdropper. However, this is true in theory, and there is a significant gap between theory and practice. By exploiting the imperfection of the detectors, Eve can gain information about the shared key [Xu]. To avoid such side-channel attacks in [Lo], the researchers provide a QKD protocol called "Measurement Device-Independent (MDI)" QKD that allows two users (a transmitter "Alice" and a receiver "Bob") to communicate with perfect security, even if the (measurement) hardware they are using has been tampered with (e.g., by an eavesdropper) and thus is not trusted. It is achieved by measuring correlations between signals from Alice and Bob, rather than the actual signals themselves.¶
4. QKD protocols based on Continuous Variable QKD (CV-QKD) have recently seen plenty of interest as they only require telecommunications equipment that is readily available and is also in common use industry-wide. This kind of technology is a potentially high-performance technique for secure key distribution over limited distances. The recent demonstration of CV-QKD shows compatibility with classical coherent detection schemes that are widely used for high-bandwidth classical communication systems [Grosshans]. Note that we still do not have a quantum repeater for the continuous variable systems; hence, these kinds of QKD technologies can be used for the short distance communications or trusted relay-based QKD networks.¶
5. Secret sharing can be used to distribute a secret key among multiple nodes by letting each node know a share or a part of the secret key, while no single node can know the entire secret key. The secret key can only be reconstructed via collaboration from a sufficient number of nodes. Quantum Secret Sharing (QSS) typically refers to the following scenario: the secret key to be shared is based on quantum states instead of classical bits. QSS enables splitting and sharing such quantum states among multiple nodes.¶
6. There are some entanglement-based QKD protocols, such as that described in [Treiber], [E91], and [BBM92], which work differently than the above steps. The entanglement-based schemes, where entangled states are prepared externally to the quantum node A and the quantum node B, are not normally considered "prepare and measure" as defined in [Wehner]. Other entanglement-based schemes, where entanglement is generated within the source quantum node, can still be considered "prepare and measure". Send-and-return schemes can still be "prepare and measure" if the information content, from which keys will be derived, is prepared within the quantum node A before being sent to the quantum node B for measurement.¶

As a result, the Quantum Internet in Figure 1 contains quantum channels. And in order to support secure communication setup, especially in large-scale deployment, it also requires entanglement generation and entanglement distribution [QUANTUM-CONNECTION], quantum repeaters and/or routers, and/or trusted QKD relays.¶

+---------------+
|   End User    |
+---------------+
      ^
      | Local Secure Interface
      | (e.g., the same physical hardware
      |  or a local secure network)
      V
+-----------------+     /--------\     +-----------------+
|                 |--->( Quantum  )--->|                 |
|                 |    ( Internet )    |                 |
|     Quantum     |     \--------/     |    Quantum      |
|     Node A      |                    |     Node B      |
|                 |     /--------\     |                 |
|                 |    ( Classical)    |                 |
|                 |<-->( Internet )<-->|                 |
+-----------------+     \--------/     +-----------------+

4.2. Blind Quantum Computing

Blind quantum computing refers to the following scenario:¶

1. A client node with source data delegates the computation of the source data to a remote computation node (i.e., a server).¶
2. Furthermore, the client node does not want to disclose any source data to the remote computation node, which preserves the source data privacy.¶
3. Note that there is no assumption or guarantee that the remote computation node is a trusted entity from the source data privacy perspective.¶

As an example illustrated in Figure 2, a terminal node can be a small quantum computer with limited computation capability compared to a remote quantum computation node (e.g., a remote mainframe quantum computer), but the terminal node needs to run a computation-intensive task (e.g., Shor's factoring algorithm). The terminal node can create individual qubits and send them to the remote quantum computation node. Then, the remote quantum computation node can entangle the qubits, calculate on them, measure them, generate measurement results in classical bits, and return the measurement results to the terminal node. It is noted that those measurement results will look like purely random data to the remote quantum computation node because the initial states of the qubits were chosen in a cryptographically secure fashion.¶

As a new client and server computation model, Blind Quantum Computation (BQC) generally enables the following process:¶

1. The client delegates a computation function to the server.¶
2. The client does not send original qubits to the server but does send transformed qubits to the server.¶
3. The computation function is performed at the server on the transformed qubits to generate temporary result qubits, which could be quantum-circuit-based computation or measurement-based quantum computation. The server sends the temporary result qubits to the client.¶
4. The client receives the temporary result qubits and transforms them to the final result qubits.¶

During this process, the server cannot figure out the original qubits from the transformed qubits. Also, it will not take too much effort on the client side to transform the original qubits to the transformed qubits or transform the temporary result qubits to the final result qubits. One of the very first BQC protocols, such as that described in [Childs], follows this process, although the client needs some basic quantum features such as quantum memory, qubit preparation and measurement, and qubit transmission. Measurement-based quantum computation is out of the scope of this document, and more details about it can be found in [Jozsa2005].¶

It is worth noting that:¶

1. The BQC protocol in [Childs] is a circuit-based BQC model, where the client only performs simple quantum circuit for qubit transformation, while the server performs a sequence of quantum logic gates. Qubits are transmitted back and forth between the client and the server.¶

2. Universal BQC (UBQC) in [Broadbent] is a measurement-based BQC model, which is based on measurement-based quantum computing leveraging entangled states. The principle in UBQC is based on the fact that the quantum teleportation plus a rotated Bell measurement realize a quantum computation, which can be repeated multiple times to realize a sequence of quantum computation. In this approach, the client first prepares transformed qubits and sends them to the server, and the server needs to first prepare entangled states from all received qubits. Then, multiple interaction and measurement rounds happen between the client and the server. For each round:¶

   1. the client computes and sends new measurement instructions or measurement adaptations to the server;¶
   2. the server performs the measurement according to the received measurement instructions to generate measurement results (in qubits or classic bits); and¶
   3. then the client receives the measurement results and transforms them to the final results.¶
3. A hybrid UBQC is proposed in [Zhang2009], where the server performs both quantum circuits like that demonstrated in [Childs] and quantum measurements like that demonstrated in [Broadbent] to reduce the number of required entangled states in [Broadbent]. Also, the client is much simpler than the client in [Childs]. This hybrid BQC is a combination of a circuit-based BQC model and a measurement-based BQC model.¶
4. It is ideal if the client in BQC is a purely classical client, which only needs to interact with the server using classical channels and communications. [Huang] demonstrates such an approach where a classical client leverages two entangled servers to perform BQC with the assumption that both servers cannot communicate with each other; otherwise, the blindness or privacy of the client cannot be guaranteed. The scenario as demonstrated in [Huang] is essentially an example of BQC with multiple servers.¶
5. How to verify that the server will perform what the client requests or expects is an important issue in many BQC protocols, referred to as "verifiable BQC". [Fitzsimons] discusses this issue and compares it in various BQC protocols.¶

In Figure 2, the Quantum Internet contains quantum channels and quantum repeaters and/or routers for long-distance qubits transmission [RFC9340].¶

+----------------+     /--------\     +-------------------+
|                |--->( Quantum  )--->|                   |
|                |    ( Internet )    | Remote Quantum    |
|  Terminal      |     \--------/     | Computation       |
|  Node          |                    | Node              |
|  (e.g., a small|     /--------\     | (e.g., a remote   |
|  quantum       |    ( Classical)    | mainframe         |
|  computer)     |<-->( Internet )<-->| quantum computer) |
+----------------+     \--------/     +-------------------+

4.3. Distributed Quantum Computing

There can be two types of distributed quantum computing [Denchev]:¶

1. Leverage quantum mechanics to enhance classical distributed computing. For example, entangled quantum states can be exploited to improve leader election in classical distributed computing by simply measuring the entangled quantum states at each party (e.g., a node or a device) without introducing any classical communications among distributed parties [Pal]. Normally, pre-shared entanglement first needs to be established among distributed parties, followed by LOCC operations at each party. And it generally does not need to transfer qubits among distributed parties.¶

2. Distribute quantum computing functions to distributed quantum computers. A quantum computing task or function (e.g., quantum gates) is split and distributed to multiple physically separate quantum computers. And it may or may not need to transmit qubits (either inputs or outputs) among those distributed quantum computers. Entangled states will be needed and actually consumed to support such distributed quantum computing tasks. It is worth noting that:¶

   1. Entangled states can be created beforehand and stored or buffered;¶
   2. The rate of entanglement creation will limit the performance of practical Quantum Internet applications including distributed quantum computing, although entangled states could be buffered.¶

   For example, [Gottesman1999] and [Eisert] have demonstrated that a Controlled NOT (CNOT) gate can be realized jointly by and distributed to multiple quantum computers. The rest of this section focuses on this type of distributed quantum computing.¶

As a scenario for the second type of distributed quantum computing, Noisy Intermediate-Scale Quantum (NISQ) computers distributed in different locations are available for sharing. According to the definition in [Preskill], a NISQ computer can only realize a small number of qubits and has limited quantum error correction. This scenario is referred to as "distributed quantum computing" [Caleffi] [Cacciapuoti2020] [Cacciapuoti2019]. This application scenario reflects the vastly increased computing power that quantum computers can bring as a part of the Quantum Internet, in contrast to classical computers in the Classical Internet, in the context of a distributed quantum computing ecosystem [Cuomo]. According to [Cuomo], quantum teleportation enables a new communication paradigm, referred to as "teledata" [VanMeter2006-01], which moves quantum states among qubits to distributed quantum computers. In addition, distributed quantum computation also needs the capability of remotely performing quantum computation on qubits on distributed quantum computers, which can be enabled by the technique called "telegate" [VanMeter2006-02].¶

As an example, a user can leverage these connected NISQ computers to solve highly complex scientific computation problems, such as analysis of chemical interactions for medical drug development [Cao] (see Figure 3). In this case, qubits will be transmitted among connected quantum computers via quantum channels, while the user's execution requests are transmitted to these quantum computers via classical channels for coordination and control purpose. Another example of distributed quantum computing is secure Multi-Party Quantum Computation (MPQC) [Crepeau], which can be regarded as a quantum version of classical secure Multi-Party Computation (MPC). In a secure MPQC protocol, multiple participants jointly perform quantum computation on a set of input quantum states, which are prepared and provided by different participants. One of the primary aims of the secure MPQC is to guarantee that each participant will not know input quantum states provided by other participants. Secure MPQC relies on verifiable quantum secret sharing [Lipinska].¶

For the example shown in Figure 3, we want to move qubits from one NISQ computer to another NISQ computer. For this purpose, quantum teleportation can be leveraged to teleport sensitive data qubits from one quantum computer (A) to another quantum computer (B). Note that Figure 3 does not cover measurement-based distributed quantum computing, where quantum teleportation may not be required. When quantum teleportation is employed, the following steps happen between A and B. In fact, LOCC [Chitambar] operations are conducted at the quantum computers A and B in order to achieve quantum teleportation as illustrated in Figure 3.¶

1. The quantum computer A locally generates some sensitive data qubits to be teleported to the quantum computer B.¶
2. A shared entanglement is established between the quantum computer A and the quantum computer B (i.e., there are two entangled qubits: q1 at A and q2 at B). For example, the quantum computer A can generate two entangled qubits (i.e., q1 and q2) and send q2 to the quantum computer B via quantum communications.¶
3. Then, the quantum computer A performs a Bell measurement of the entangled qubit q1 and the sensitive data qubit.¶
4. The result from this Bell measurement will be encoded in two classical bits, which will be physically transmitted via a classical channel to the quantum computer B.¶
5. Based on the received two classical bits, the quantum computer B modifies the state of the entangled qubit q2 in the way to generate a new qubit identical to the sensitive data qubit at the quantum computer A.¶

In Figure 3, the Quantum Internet contains quantum channels and quantum repeaters and/or routers [RFC9340]. This application scenario needs to support entanglement generation and entanglement distribution (or quantum connection) setup [QUANTUM-CONNECTION] in order to support quantum teleportation.¶

                  +-----------------+
                  |     End User    |
                  |                 |
                  +-----------------+
                           ^
                           | Local Secure Interface
                           | (e.g., the same physical hardware
                           | or a local secure network)
                           |
        +------------------+-------------------+
        |                                      |
        |                                      |
        V                                      V
+----------------+     /--------\     +----------------+
|                |--->( Quantum  )--->|                |
|                |    ( Internet )    |                |
|   Quantum      |     \--------/     |   Quantum      |
|   Computer A   |                    |   Computer B   |
| (e.g., Site #1)|     /--------\     | (e.g., Site #2)|
|                |    ( Classical)    |                |
|                |<-->( Internet )<-->|                |
+----------------+     \--------/     +----------------+

5.1. Operations on Entangled Qubits

Methods for facilitating quantum applications to interact efficiently with entangled qubits are necessary in order for them to trigger distribution of designated entangled qubits to potentially any other quantum node residing in the Quantum Internet. To accomplish this, specific operations must be performed on entangled qubits (e.g., entanglement swapping or entanglement distillation). Quantum nodes may be quantum end nodes, quantum repeaters and/or routers, and/or quantum computers.¶

5.2. Entanglement Distribution

Quantum repeaters and/or routers should support robust and efficient entanglement distribution in order to extend and establish a high-fidelity entanglement connection between two quantum nodes. For achieving this, it is required to first generate an entangled pair on each hop of the path between these two nodes and then perform entanglement-swapping operations at each of the intermediate nodes.¶

5.3. The Need for Classical Channels

Quantum end nodes must send additional information on classical channels to aid in transferring and understanding qubits across quantum repeaters and/or receivers. Examples of such additional information include qubit measurements in secure communication setup (Section 4.1) and Bell measurements in distributed quantum computing (Section 4.3). In addition, qubits are transferred individually and do not have any associated packet header, which can help in transferring the qubit. Any extra information to aid in routing, identification, etc. of the qubit(s) must be sent via classical channels.¶

5.4. Quantum Internet Management

Methods for managing and controlling the Quantum Internet including quantum nodes and their quantum resources are necessary. The resources of a quantum node may include quantum memory, quantum channels, qubits, established quantum connections, etc. Such management methods can be used to monitor the network status of the Quantum Internet, diagnose and identify potential issues (e.g., quantum connections), and configure quantum nodes with new actions and/or policies (e.g., to perform a new entanglement-swapping operation). A new management information model for the Quantum Internet may need to be developed.¶