Fully heterogeneous prepare-and-measure quantum network for the next stage of quantum internet

Domain: physics
Published: 2025-12-12
Editorial outcome: minor_revision

Abstract
The quantum internet promises unparalleled capabilities that are provably impossible with the classical internet. However, current quantum networks are often designed with dedicated systems for specified tasks, which hinders the openness and diversity of future quantum internet. To address these limitations, this work proposes a fully heterogeneous quantum network accompanied with several techniques. Our proposal allows users to access the network using any mainstream systems or even partial systems. The network also enables the execution of multiple distinct quantum tasks and provides opportunities for global optimization and cost-efficient design. A five-node quantum network featuring heterogeneous nodes has been implemented, demonstrating the superiority of our proposal through tasks such as quantum key distribution, quantum digital signature, quantum Byzantine agreement, and quantum conference. Notably, the experiment represents the first demonstration of multi-malicious node quantum Byzantine agreement in a quantum network.

Introduction
Quantum information is set to revolutionize information technology, enabling provably impossible capabilities using only classical information. As networking is an inevitable part of the evolution of all information technologies, one important vision for a quantum internet is to provide fundamentally new internet technology that facilitates quantum communication (QC) between any two points on Earth. However, several developmental stages must be navigated before reaching the quantum internet, each presenting its own set of challenges. As of today, significant progress has been made in the initial stage, known as the trusted repeater network. However, this stage cannot provide end-to-end quantum communication services without trusted relays. Efforts are now focused on the next stage, the prepare-and-measure quantum network (P&M-QN), which aims to eliminate the need for a trusted relay.

Although explorations have greatly promoted the second stage, there are still gaps between the demonstrations and practical applications. According to the vision for a fully realized P&M-QN, it must not only retain the properties and advantages of classical networks but also leverage the unique benefits of quantum information. More precisely, in addition to eliminating the need for trusted repeaters, such a network should support a diverse range of devices and accommodate various applications and services. In contrast, the recent explorations face several limitations. Users are required to select their devices, prepare states, and process data in strict accordance with predefined constraints. Moreover, these efforts are typically focused on a single quantum task and often feature fixed, which increases networking costs and hinders scalability.

To realize the vision of a quantum internet, we present a fully heterogeneous network that addresses existing gaps and advances the P&M-QN toward its ultimate form. This heterogeneity is reflected in several key aspects. First, the degrees of freedom (DoF) are heterogeneous. Our presented DoF converter can adapt to nodes with different DoFs, thereby enabling them to access the network with any mainstream modulation schemes, such as polarization (Pol.), time-bin-phase (T.B.P.), or phase (Pha.). Second, the setups are heterogeneous. Our networking allows users to access the network with non-paired and incompatible setups and realize full connection without any trusted nodes. Finally, the execution of protocols and tasks are heterogeneous, allowing users to conduct on-demand switching among various quantum protocols and quantum tasks, such as quantum key distribution (QKD), quantum digital signature (QDS), quantum Byzantine agreement (QBA), and quantum conference. Our network supports centralized control functions by proposing a software-defined prepare-and-measure network (SD-P&M-QN) architecture and provides task selection, protocol selection, and parameter optimization via proposing a dedicated “orchestration core” in the architecture. The server can coordinate nodes with different setup types and DoFs, thereby enabling quantum communication between originally incompatible nodes. Furthermore, the server’s global network view provides opportunities for integrating valuable quantum resources and optimizing the overall network performance, and brings potential advantages of flexibility, agility, optimization, and cost-effectiveness.

Based on the above proposal, we built a five-node heterogeneous network, which consists of a detection node and four source nodes. The detection node holds a typical Pol. measurement unit, and the source nodes each possess one of the common modulation systems, including Pol., T.B.P., and Pha. With this heterogeneous network, we successfully demonstrate multi-protocol switching, multi-DoF switching, and multi-task switching. Four different quantum tasks including QKD, QDS, QBA, and quantum conference, and two different protocols including BB84 and measurement-device-independent (MDI) is demonstrated among the five heterogeneous nodes. In particular, we demonstrate product traceability by our five-node QBA with two malicious nodes. This is also the first multi-malicious-nodes QBA experiment. Our heterogeneous network lays out a blueprint for the final form of the P&M-QN. Similarly, just like the first message was sent over a simple four-node network (Advanced Research Projects Agency Network) in 1969, our experiment outlines the technical process for completing the blueprint.

Results
Fully heterogeneous networking
In previous quantum networks, network nodes are typically required to hold both of transmitter and a detector with strictly limited DoF. In contrast, our network releases the requirement. The nodes only possess one of the transmission or detection. As the mainstream QC systems can be separated into weak coherent transmitter, entanglement transmitter, and single-photon detector, nodes in our network can also be divided into three fundamental types: nodes with weak coherent sources (C-type nodes), with entanglement sources (E-type nodes), and with single-photon detectors (D-type nodes). C and E-type nodes can also be referred to as source-type (S-type) collectively. As listed in Table 1, any two nodes can achieve end-to-end communication by properly selecting their protocol. For instance, a S-type node can share secret keys with a D-type node by P&M-type protocol; two C-type nodes can communicate by executing the MDI-type protocol with the assistance of D-type nodes; similarly, two D-type nodes can share secret keys by performing the entanglement-based protocols with the assistance of E-type nodes (for entanglement distribution), the nodes can also freely select any mainstream DoF to encode their information. Two nodes with different DoFs can perform the quantum tasks by utilizing our DoF converter, which ensures precise and high-fidelity conversion of their DoF to Pol., T.B.P., or Pha.

User nodes with different fundamental types and different DoFs access the network through the topology as shown in Fig. 1. Compared with the previous networks, our network does not require full connection or centralization. User nodes with the same type do not need to be interconnected. The server consists of distributed infrastructure devices and a centralized controller. As a P&M quantum network, the server is considered as part of the channel and therefore do not introduce any additional security assumptions. The server performs path planning and node scheduling based on communication requests and optimal parameters. Except for the direct link between S-type and D-type nodes, the server can also provide or borrow E-type or D-type nodes for entanglement distribution or Bell-state measurement (BSM) to assist the EB protocols and MDI-type protocols. These untrusted E-type and D-type nodes can belong to server or inactive user nodes. Especially, some of the D-type nodes cannot perform the BSMs independently. Thus, we propose a joint-BSM to schedule several D-type nodes to complete the BSM collaboratively (see “METHOD” for details). Notably, the BSM serves as part of the MDI-QKD protocol.

With the above schemes and designs, we have realized the hardware heterogeneity, enabling more flexible configurations, broader coverage, and lower costs. However, hardware heterogeneity alone is insufficient to classify our network as fully heterogeneous. To address this, we introduce an SD-P&M-QN architecture to enable software heterogeneity, ensuring both agility and versatility, which are also fundamental requirements for the classical internet. Agility refers to the resource-efficient replacement of a cryptographic core when security is compromised, while versatility allows nodes to switch tasks without requiring any knowledge of the underlying implementation details. Our SD-P&M-QN architecture effectively guarantees these properties by providing a universal platform for real-time information collection and heterogeneous quantum task support. In addition, it incorporates a three-layer architecture with a centralized controller to facilitate quantum protocol switching and global optimization (see “METHOD” for details).

To summarize, our fully heterogeneous network in enables the integration of diverse setups and DoFs, enhancing flexibility, scalability, and performance. At the same time, it supports a variety of quantum tasks and protocols, ensuring agility and versatility. Given the critical role of heterogeneity in the classical Internet, our work is poised to advance the quantum Internet toward the next stage, i.e., the realization of a P&M-QN.

Experimental setup
To demonstrate the superiority of fully heterogeneous networking, we established a five-node quantum communication network, which included one D-type (David) node and four C-type nodes (Alice, Bob, Charlie, Frank). The authentication between the five nodes is realized by the pre-shared secret keys. The four C-type nodes held different modulation systems and encoded quantum states in different DoFs. With the experimental network, we successfully realized the end-to-end quantum tasks among the five heterogeneous nodes without any trusted repeater. We also demonstrated how the DoF converter and orchestration core transferred DoFs, switched quantum protocols, switched quantum tasks, and optimized parameters according to the node type, requirement, hardware, and network resources. Especially, we successfully realized a five-node QBA with two malicious nodes, which is also the first multiple malicious-node QBA experiment in the world.

As illustrated in Fig. 2, each of the four C-type nodes are abstracted to several modules. The coherent pulses were initially generated by the pulse module, which consisted of a CW laser (Wavelength References Clarity-NLL-1542-HP), a LiNbO3-based phase modulator (PM), and two LiNbO3-based intensity modulators (IMs). The CW laser, which was frequency-locked to a molecular absorption line at a center wavelength of 1542.8 nm with an accuracy of approximately 10 MHz in the spectral domain, serves as the source. The first IM functioned as a chopper, converting the CW laser into a pulse train with a 200 ps pulse width and 1 GHz repetition rate. The subsequent PM randomized the pulse phase to ensure security. Finally, the second IM applied random modulation to generate several pre-decided intensities for the decoy-state method. The modulators were driven by our electronic system, which consists of AWGs, homemade circuits, and RF-amplifiers.

Following the pulse module, the pulse train was fed into the encoding module to encode the quantum states. The main differences lay within this module. Alice employed Pol. modulation. She first adjusted the Pol. of her pulses to a diagonal Pol. and then fed them into a Sagnac structure via a Pol. beamsplitter (PBS). The horizontal and vertical components were split into clockwise and counterclockwise pulses, respectively, in the Sagnac ring and then sequentially propagated through the PM. As a result, the PM independently modulated the pulses and controlled the relative phase between the horizontal and vertical components. Frank held a phase modulation system. He first split one pulse to the superposition of early and late T.B.P. state via an asymmetric Mach-Zehnder interferometer (AMZI) that consisted of two paths with a 500 ps optical path difference. Then, a PM was driven in 2 GHz frequency to modulate the phase difference between the two T.B.P. states. Both Bob and Charlie employed the T.B.P. encoding, but their realizations were different. Bob generated the T.B.P. superposition with an AMZI (500 ps optical path difference) and driven a PM in 2 GHz frequency to modulate the phase difference between the two T.B.P. states. An additional IM was added to eliminate the early-bin or late-bin pulses, thereby modulating the two T.B.P. eigenstates, or to halve the intensity, thereby modulating the superpositions. Different from Bob, Charlie fed his pulses to a Faraday-Michelson interferometer (FMI) with also a 500 ps optical path difference to split them to the two time-bins and then drove an IM and a PM to modulate the T.B.P. states.

After that, an adapter module consists of our DoF converter and supporting components was employed, allowing nodes to select a path to maintain or transfer their DoF according to circumstances. The selection was realized by a pair of 2×1 optical switches (OS). The nodes directed the pulses to pass through a fiber channel to maintain their DoF, or switched the OS to feed the pulses to the DoF converter to transfer the DoF. In this experiment, a passive structure (see “METHOD” for an active structure) was employed for the DoF converter. It has a Pol. port and a T.B.P. port. Alice fed her Pol. state a|H>+beiθ|V> to the module from the Pol. port, the |H> and |V> components were split into two different paths by a PBS, passed through different delay, and then converged in a coupler to be transferred to the T.B.P. state a|e>+beiθ|l> and left the module from the T.B.P. port. Conversely, Bob, Charlie, and Frank fed their T.B.P. or Pha. states to the module from the T.B.P. port, split to the two paths by the BS (reverse of the coupler), pass through different delay, and then converge in the PBS to be transferred to the Pol. state a|H>+beiθ|V>. An IM following the module was employed to eliminate the excess pulses. Finally, the nodes attenuated their pulse to an optimized mean photon number by their electric variable optical attenuator (EVOA) and sent them to the quantum channel. We emphasize the DoF converter can be employed by the server or nodes. In our experiment, the passive DoF converter has at least 3 dB loss, so we set them at C-type nodes for compensating the loss.

The D-type node David held a typical passive Pol. decoding system. The four homemade InGaAS-based SPDs worked at 1 GHz gated mode and fine-tuned to a 20% detection efficiency and a 10−6 level dark count rate. When David communicated with other nodes, they performed a P&M protocol. The other four nodes prepared or transferred their states on the Pol. DoF and sent them to David by the quantum channel. David used 50:50 BS and adjusted the two EPCs to realized a balanced basis selection. The four homemade SPDs were employed to measure the |H>, |V>, 1/sqrt(2)(|H>+|V>), 1/sqrt(2)(|H>-|V>), respectively. Besides, we indicate that David can also perform the BSM by adjusting the EPC and SPD delay. When the two C-type nodes wanted to establish an end-to-end communication, the server invoked David as an untrusted measurement relay. The two nodes first transferred their states to the same DoF and sent them to David for performing the MDI protocol. In our experiment, Bob-Charlie performed a T.B.P.-based MDI protocol directly. Other pairs performed a Pol.-based MDI protocol. When David assists the T.B.P.-based MDI protocol, he adjusted the delay of SPD1 and SPD3 to detect the early and late bin, respectively, while employing the other two SPDs to assist the Pol. calibration. When Bob assists the Pol. based protocol, he adjusted his EPCs to perform a standard Pol. BSM, in which SPD1, SPD3 detected the |H> component, and SPD2, SPD4 detected the |V> component. David publicly announced his measurement results and the two C-type nodes generated their raw bits according to the announcement.

Alice, Bob, Charlie, Frank, and David were connected to the server with fiber spools of 5, 11, 5, 8, and 25 km, respectively. In our control program, six different C++ classes are constructed— five for individually controlling each node and one for the server. In our experiment, a single process instantiates the six C++ classes, spawning six threads. Five threads emulate user nodes and one thread emulates the server, thereby simulating the distributed network architecture. Based on the requirements and terminal information, the orchestration core selects an appropriate quantum task and protocol according to a predefined rule. The server routed the quantum channel (Micro-electro-mechanical systems can programmatically route the quantum channel. In this setup, we manually switch the node links, which does not affect our conclusions) and informed the nodes of the channel parameters. According to the parameters of terminals and channel, the orchestration core loaded optimized parameters (including decoy-state intensities and selection probabilities) from a pre-established optimal-parameter table. After that, the nodes and the server calibrated the phase references, Pol., mean-photon number, and time delay by adjusting their phase shifter (PSs), EPC, EVOA, and circuits. The communication generates secret keys between the two end-to-end nodes, some of the keys could be consumed by the current task, and the remained keys are saved in their pre-established key pools for further applications.

Experimental results
QKD. QKD is one of the most successful and foundational applications of quantum technology, making it the natural choice for our first demonstration. Here, we demonstrated all possible combinations of end-to-end QKD among the five nodes. Following the aforementioned process, the nodes and server exchanged terminal information, established the quantum channel, selected the protocol, loaded optimal parameters, and calibrated their systems with the assistance of the orchestration core in the SD-P&M-QN architecture. The experimental results are summarized in Fig. 3.

In accordance with the pre-defined rules in Table 1, the orchestration core selected the BB84-QKD protocol for D-C-type combinations, including Alice-David, Bob-David, Charlie-David, and Frank-David. Since David held a passive Pol. decoder, the other transmitters (except Alice) must convert their DoF to Pol. using the DoF converter before sending their pulses to David. Each pair executed QKD for 2 seconds (2×109 rounds) to generate enough raw key bits, mitigating the finite-key-size effect. The sifted key bits were processed by cascade error correction and privacy amplification, resulting in about 5.90×106, 5.38×106, 5.64×106, and 4.50×106 secret key bits stored in each QKP.

For C-C-type combinations, the orchestration core selected the MDI-QKD protocol, with the server designated David as an untrusted measurement unit to assist communication. For the Alice-Bob, Alice-Charlie, and Alice-Frank pairs, the orchestration core opted for Pol. based MDI-QKD. Bob, Charlie, and Frank converted their DoF to Pol. using their DoF converters. For the Bob-Frank and Charlie-Frank pairs, both nodes transferred their DoF to Pol. via their DoF converters. David adjusted his EPCs to compensate for channel disturbances and performed a Pol.-based BSM. For the Bob-Charlie pair, since both of them utilized the T.B.P. encoder, their orchestration cores directly prepared T.B.P. states, which were sent to David for a T.B.P.-based BSM. David adjusted the gated times of SPD1 and SPD3 to detect early and late time bins, respectively, and optimized his EPCs to achieve high Hong-Ou-Mandel (HOM) visibility. Each C-C-type pair executed QKD for 1000 seconds (1012 rounds) to counteract the finite-key-size effect. They also processed their raw key bits by the aforementioned error correction and privacy amplification, resulting in 3.94×105, 5.66×105, 5.46×105, 1.11×106, 7.30×105, and 4.49×105 secret key bits stored in the respective QKPs.

QDS. QDS is another important quantum task that ensures integrity, authenticity, and non-repudiation. By leveraging the key resources generated through quantum processes such as QKD and integrating one-time universal hashing and one-time pad operations, QDS extends the computational security of classical digital signatures to information-theoretic security in a three-party quantum scenario. We took two quantum e-commerce processes in our heterogeneous network to demonstrate the QDS. In the two demonstrations, Alice was a client who want to online purchase some products from merchants David and Charlie, respectively.

The first demonstration was the trading between Alice and David. They first randomly designated a node from the network as a third party (TP) to assist the QDS. Without loss of generality, we designated Bob as the TP in the experiment. The Merchant David built two quantum channels with the client Alice and the TP Bob. Then their operation systems invoked the hardware to randomly modulate four Pol. based BB84-states and three optimized intensities for distributing non-secret but error-corrected keys (we name them imperfect keys for simplicity). Here, Alice (Bob) and David kept the communication for 2 s and generated raw key bits with an error rate of 1.05% (0.89%). 1.276×107 (1.641×107) bits of error-corrected keys was generated by the cascade error correction algorithm. The privacy amplification was executed here thus the keys were imperfect.

David prepared a 43 KB contract file CD and selected two 900-bit imperfect quantum key strings XA and YA (XB and YB) from the error-corrected keys with Alice (Bob). Then he randomly generated an irreducible polynomial and performs the division hashing on the contract CD to get the hash value. By utilizing the combined key strings X = XA ⊕ XB and Y = YA ⊕ YB to perform the one-time pad operation on the coefficient of the polynomial and the hash value, the signature S of CD was obtained. The contract and its signature were first sent to Alice. Alice checked the contract, then transfers CD, S, and her corresponding imperfect key XA and YA to Bob (if she accepted the contract). Bob checked the contract and sent his key strings XB and YB to Alice. Both Alice and Bob independently verified the signature of the contract. Alice paid the money if both of their verification were passed. In our experiment, this group passed the verification after consuming 1800 bit keys. The maximum key generation (ignore the time of data process) and imperfect key consumption of David-Alice (David-Bob) were 6382375 bit/s and 1800 bit/times (8205939 bit/s and 1800 bit/times). The signature rate depends on the keys of a lower key rate, thus, they achieved a signature rate of 3545 times/s (David-Alice has a lower key rate).

In another trade between Alice and Charlie, another QDS protocol were selected. In this protocol, the perfect secret keys were required, thus, they randomly designated a TP (in this experiment, Frank was designated) and then took 53 bit secret key strings XA and YA, XF and YF from the QKP of Alice-Charlie, Frank-Charlie, respectively. Then they used the perfect secret keys to repeat the procedure of signature, transference, and verification similarly to the previous group. This group finally passed the verification after consuming 106 bit keys. The filling rates of the two QKPs were 566.247 bit/s and 729.713 bit/s, respectively, with secret key consumption of 106 bits per transaction. The signature rate depends on the keys of Alice-Charlie, thus achieved a signature rate of 5.34 times/s. The experimental results are shown in Fig. 4.

QBA. Byzantine agreement aims to enable all nodes in a decentralized network to reach consensus, and it plays a crucial role in applications such as distributed ledger, blockchain, and quality traceability. Compared to classical Byzantine agreement (CBA), QBA offers unconditional security and surpasses the 1/3 fault-tolerance bound of CBA, thanks to the multiparty correlations provided by QDS. The general protocol steps of the QBA protocol for arbitrary N network nodes, as well as its communication complexity, consensus rate, and rigorous security proofs, can be found in ref. 53. In this demonstration, we present the distributed ledger based on the recently proposed QBA protocol, illustrating how users in our network reach consensus on a trading transaction. The trade is recorded by all nodes in the network through QBA, and all honest nodes will reach the same consensus. This consensus can only be disrupted if malicious nodes exceed 1/2 of the network, thereby surpassing the 1/3 fault-tolerance bound of CBA. This is also the first complete QBA experiment to showcase quantum superiority in the presence of multiple malicious nodes.

In this demonstration, we presented two trading transactions in the network. In the first case, Alice, as an honest signer, attempted to record a 0.1 MB trading file, while Charlie and Frank, as malicious nodes, attempted to disrupt the recording process. In the second case, Alice was a malicious signer who want to cheat other nodes, with Bob as her collaborator. The QBA protocol operates based on the recursion of multicast rounds and QDS. In each multicast round, there was a primary node, and the others acted as backups. The primary sent the file and its signature to the backups, one of which was chosen as the forwarder, while the others became verifiers. The primary, forwarder and one verifier performed a three-party QDS to transmitted the message. The signing was successful only if both the forwarder and verifier accepted the signature. This process repeated until all backups had served as forwarders. Ultimately, there ware 5 broadcasting rounds of the two demonstrations respectively, including 72 round QDS in total, and the consumption of the secure keys in the QKP was shown in Fig. 5.

Quantum conference. Quantum conference is a quantum task for establishing a common secret key with unconditional security between multi-parties. Notably, here we realize the quantum conference by the QKD-based key delivery rather than the multiparty agreement, as this approach offers simpler implementation, higher efficiency, and better compatibility with our network architecture while maintaining information-theoretic security. In our demonstration, David is the sponsor of the meeting. He first generates a quantum random number series by his local quantum random number. Then he independently distributes equal-length symmetric secret keys with all other participants by QKD, encrypts the quantum random number by one-time-pad with the secret keys, and sends it to the corresponding participant by public channel. The participant decrypts the ciphertext using the secret keys to obtain the quantum random number, which is exploited as the conference keys.

In this experiment, David generated 10 Kbit quantum random numbers by our quantum random number generator (QRNG) with a 1.34 Mbps random number generation rate. Then he extracted 10 Kbit secret keys from each of his four QKPs, encrypted the random number separately with each key, and sent them to the corresponding nodes. Alice, Bob, Charlie, and Frank decrypted the ciphertext with their own secret keys and obtained the 10 Kbit quantum random number as the secret conference keys.

Methods
DoF converter for heterogeneous networking
Our heterogeneous structure allows users to access the network with different DoFs, which greatly expand the application scenarios and reduces usage costs. To enable quantum communication between the nodes with different DoFs, we designed a methodology for transforming the DoFs with high fidelity.

The DoF converter consists of a Pol. path conversion module and a path-time converter. Anode can translate its Pol. states to T.B.P. or Pha. states by first sending their Pol. signals into different paths via the Pol.-path converter, and then utilizing the path-time converter to convert different paths into different time bins. In this process, the two orthogonal Pol., without loss of generality, horizontal and vertical, are translated to early and late time bins, with their relative phase converted to the relative phase between the time bins. Similarly, an ode can convert T.B.P. or Pha. information back to Pol. by reversing this process. The two time-bins and their relative phase are then converted to the two Pol. and their relative phase (see Supplementary Material for the detailed physical model with practical imperfections and different physical realizations).

In our experiment, the DoF converter is physically realized via a passive structure. When an ode wants to transfer T.B.P. or Pha. DoF to Pol. DoF, the superposition a|e>+b|l> (b is a complex number) is fed to the DoF converter from the time-bin port. Then the state is transferred to a path superposition. As an additional delay that equals the time difference of the two time bins is added to the up-path, the superposition is represented as 1/sqrt(2)(a|u>+b|d>) + 1/sqrt(2)|+>, where |u> and |d> represent the up and the down-paths respectively, |+> represents the discarded state. After that, the polarization beam splitter transfer the path DoF to the Pol. DoF as 1/sqrt(2)(a|H>+b|V>) + 1/sqrt(2)|+>. The |+> is discarded so the final output state is a|H>+b|V> (We emphasize that since all channel operations are security-preserving, if DoF conversion is performed via the server or other nodes, |+> should be regarded as loss. This incurs a 3 dB reduction in the secret key rate.). In addition, two active structures are introduced in the Supplementary Material. The active converters eliminate the |+> term, thereby exhibiting greater potential. However, the high loss of electro-optical devices limits their current effectiveness.

Joint Bell-state measurement
Our heterogeneous network allows D-type nodes to connect using any form of the regular detection unit. However, most BB84 detection units are incapable of performing BSMs and therefore cannot directly assist with MDI-type protocols. To address this limitation, we propose a joint BSM, enabling the server and multiple D-type nodes to collaboratively perform a BSM. The key idea is enable distributed nodes to each contribute part of their idle detector resources and collectively forming a BSM setup. The signals of the two S-type nodes converge at the server, which provides a BS for the interference. Then the server forwards the two interfered signals to two different assisted nodes. The two nodes collectively form a BSM unit (see Supplementary Information for more details). In MDI-QKD, the joint-BSM model can be easily equivalent to a regular BSM-model. Regarding the channel between server and D-type nodes, the symmetric part (L) can be equivalently interpreted as the channel between the user node and the untrusted measurement node. Besides, the asymmetric part (ΔL) can be regarded equivalently interpreted as an additional detection efficiency η ΔL. So the MDI-QKD with the joint-BSM can be equivalently regarded as a conventional MDI-QKD with non-identical SPDs. As MDI-QKD makes no assumptions about the detection system, asymmetrical detection efficiencies are in fact a prevalent scenario in practical MDI-QKD implementations.

We also experimentally validate the joint BSM. In this experiment, we suppose Bob and Charlie wish to perform MDI-QKD, but David is occupied, the server then recalls two other D-type nodes, George and Henry, to collaboratively perform the BSM. Each of them provides two SPDs, operating in 1 GHz gated mode, to detect the early and late time bins, respectively. Bob and Charlie prepare T.B.P. states to perform a regular T.B.P.-based MDI-QKD. The main difference between the joint and the regular BSM is the interfered signals are detected after passing two different long fiber channels, Which may lead to additional calibration and delay adjustment. In this demonstration, Bob and Charlie accumulated 1012 round in 1000 seconds and reached a 3.31062 secret key length, with a 0.018 error rate.

Software-defined prepare-and-measure network
In this work, we propose an SD-P&M-QN architecture to coordinate nodes and optimize network performance in our fully heterogeneous quantum network (see Supplementary Information for more details). Horizontally, the SD-P&M-QN consists of nodes and a server, where the nodes are heterogeneous and the server contains distributed infrastructure devices (such as a quantum router, DoF converters) and a centralized controller. Vertically, the SD-P&M-QN consists of an application layer, a control layer, and an infrastructure layer, whose functions are listed as follows:

1. Application layer: The user node of this layer facilitates the execution of quantum tasks by acting as a client, which independently submits their requirement to the server. This interaction is handled by an agent, which abstracts the details of the underlying communication process, allowing users to focus solely on their tasks without needing to understand the technical details. For the network, the application layer includes platform management and task management functionalities. Platform management involves network configuration and access authentication, enabling the server to enable or disable specific quantum tasks and controlling user access. Task management involves aggregating user requests, analyzing task requirements, and mapping resources to ensure efficient execution. All user requests are submitted to the server (referred to as the platform), which coordinates and manages the tasks.

2. Control layer: This layer plays a critical role in managing both user-side operations and network-wide functionalities. For user nodes, it provides local control and management, which includes configuring local devices (such as device usage, protocols, and parameter settings) and managing local resources (such as key resources in the quantum key pool (QKP), including storage, lifecycle checks, and usage). For the network, the control layer encompasses resource allocation and routing control. The orchestration core is the key component for software heterogeneity, responsible for resource allocation, protocol selection, and parameter optimization. Specifically, it treats all nodes and network devices as a unified pool of resources, allocating and optimizing them based on the tasks issued by the application layer. This process effectively maps tasks to specific physical devices. Once resources are allocated, the control layer selects appropriate protocols and parameters for each node device and instructs the devices to operate accordingly. Routing control determines the paths through which quantum signals are transmitted, enabling end-to-end quantum communication between any two nodes in the network. Finally, the network hypervisor oversees the status of all nodes and manages network devices, ensuring smooth and efficient network operations. This layer ensures both user-side functionality and network-wide coordination, enabling seamless quantum communication.

3. Infrastructure layer: This layer is the foundational component that supports both user-side operations and network-wide functionalities. For the user terminal, it consists of classical devices, such as synchronization and post-processor. In addition, it includes quantum devices, such as the various types of setups proposed in this work, corresponding to the heterogeneous users. For network infrastructure, this layer comprises classical devices, including networking equipment (such as switches and routers) and centralized controllers, which establish the classical communications and execute SD-P&M-QN control functions. Furthermore, it incorporates quantum devices, such as the DoF converters and quantum routers. This layer ensures the seamless integration of classical and quantum components, providing the necessary support for both node operations and network management.

Peer review rounds
[{"round": 1, "reviewer_comments": {"reviewer_1": "The reply and revision are extensive and satisfactory. I recommend acceptance.", "reviewer_2": "Dear Authors, many thanks for the accurate responses which helped clarify several important\nquestions and improved quality of the manuscript.\nSummarizing my perception before going into details, I think that both architecture and implementation as presented in this\nwork are remarkable. However some claims go significantly beyond the scope of this work and I strongly suggest to be\ncareful with those. These claims should either be completely taken out of the manuscript or else they should at least be\nclearly separated from the technical content. Most of my comments relate to this observation and are listed below. With kind\nregards.\n1) On page 37 of the rebuttal / page 16 of the supplementary / page 10 of the manuscript\nClaims are made in the rebuttal that machine learning could be used to learn about attacks and switch between protocols.\nSuch methods do however not follow any rigorous method of proof, so that a large security issue may result from their\napplication. The manuscript itself does ot claim to use machine learning methods for network monitoring. It only lists\n\"monitoring\" in Fig. 11 on page 10. The supplementary material on page 16 however states\n\"A primary criterion for the orchestration core in selecting an appropriate protocol is hardware security. By leveraging the\nnetwork hypervisor module (as illustrated in Fig. 10), the orchestration core can continuously monitor the network status —\nfor instance, by employing machine learning and pattern recognition techniques to identify potential device attacks [17, 18]. If\nanomalies imply potential detector attacks are detected, then the orchestration core prioritizes MDI-type QKD protocols.\"\nThus, network security is here based on the assumed performance of a further network function, whose functionality is not\nclearly defined. It is highly advisable to make this extremely clear, and define the expected functionality. The performance of\nsuch network function may then be investigated independently. Since machine learning and AI are very hot topics, an\navalanche of false claims may result from the above vague statements.\nI would like to stress at this point that my personal application perspective on QKD is not overly positive, but the whole\nventure with QKD security starts from clear and provable claims, which can eventually lead to stable embodiment. My\nunderstanding of machine learning based approaches is that they lack any fundamental argument of why they should be\nreliable.\n2) Page 41 of the rebuttal\nStatements about agility such as \"Meanwhile, practical QKD devices typically incorporate parameter monitoring capabilities.\nWhen the user (or server) detects that certain devices may be under threat, it can mitigate the risk by requesting (or\nsuggesting) to switch to higher-security protocols\" are a bit vague. Are these things that might be done/published by\nsomeone else, or have they been implemented and are part of this particular scientific work? See also my first comment.\n3) Page 43 of rebuttal\nIn Fig. R11, what is the unit of network scale?\n4) Page 43 of rebuttal, page 2 of manuscript\nThe manuscript mentions cost effectiveness and an argument is made that network upgrades may be realized with fewer\ncomponents compared to previous solutions. Are hardware upgrades meant here?\n5) Rebuttal page 48, page 1 of manuscript\nI am not sure it is a good idea to cite a work ([66] in rebuttal, [64] in manuscrpit) which has not been reviewed yet so\nprominently.\n6) Rebuttal page 51 comment M.12 and page 2 of the manuscript\nThe idea of letting the sdn server handle a multitude of physical properties at all individual links of a network simultaneously\nappears not very realistic for a larger scale network. At the very least, it should be supported by technical assessment of drift\nspeeds, bandwidth of detectors tracking the changes, protocol overhead for the continuous monitoring and latency\nrequirements (if there are any). The manuscript should separeate actual achievements from projections based on the\navailable technology and also from some partially very broad and visionary claims.\n7) Main article, page 1\nAbstract: Please state clearly the physical size (e.g. in square meters) of the implementation.\nKey concept: The way the proposed network is described, I find only users, while the network consists of controller plus\nrouters and converters. I find it hard to convince myself that this type of architecture should eventually be the basis of a\nquantum internet. It reminds me of distributed architectures like firechat, which are important but at the same time not of wide-\nspread use. One reason for that is that users will not share their bandwidth with others if they do not absolutely have to.\nIt also seems unlikely to this reviewer that an architecture where a central controller will be able to manage all the \"user\"\ndevices will scale well. Sticking to the analogy with mobile wireless, the channel conditions of \"users\" would vary drastically\nover time. In the mobile communications area, failed attempts to integrate \"coordinated\" protocols are well known. The\ncoordinated protocols turned out to be optimal only in theory, but were eventually not implemented - very likely because\nthey were extremely costly or even impossible to realize in practice.\nThroughout, it _might_ be better to speak of \"nodes\" rather than \"users\" of the network for the above reason.\n8) Page 2 of manuscript\nThe sentence\n\"Additionally, the network is cost-efficient since the heterogeneous structure allows it to achieve full connectivity and realize\nnetwork Upgrades with fewer components compared to previous solutions.\"\nclaims cost-effectiveness of the proposed approach.\nIt might be a bit early to claim cost-effectiveness as a fact. The main drivers of cost in a network will most certainly change\nover time. Rather write\n\"Additionally, the network provides new opportunities for cost-efficient design, since the heterogeneous structure allows it to\nachieve full connectivity and realize network upgrades with fewer components compared to previous solutions.\n9) Page 5 of manuscript\nthe sentence\n\"...core automatically selects appropriate quantum task and protocol according to a predefined rule. The server automatically\nrouted the quantum channel (Micro-electro mechanical systems can automatically route the quan tum channel. In this setup, we manually switch the user\nlinks, which does not affect our conclusions) and informed the users of the channel parameters\"\nis very unclear to this reviewer. What exactly is meant by \"automatic\" or \"automatically\". This also appears later again and is\nhard to understand. In case the supplementary material clarifies this aspect, could a pointer to the supplementary material be\nset?\n10) Page 5 of manuscript\nIn the sentence \"After that, the users and the server synergistically calibrated the phase references\" it is not clear what is\nmeant by \"synergestically\". There should be a clear description of protocol, a reference to a description in the\nsupplementary, or a reference to another scientific work which describes the protocol.\n11) Page 5 of manuscript\nIn the sentence \"According to the parameters of terminals and channel, the Orchestration core automatically loaded\noptimized parameters [71,80,81,82] (including decoy-state intensities and selection probabilities) from a pre-established\noptimal-parameter table\" I would suggest to be careful with the refereces to machine learning, see my comment on the\ninability of machine learning tools to adequately detect critical system changes.\n12) Page 5 of manuscript\nThe sentence \"In accordance with the established rules, the orchestration core selected the BB84-QKD protocol for D-C type\ncombinations, including Alice-David, Bob-David, Charlie-David, and Frank-David\" suggest that these rules have been\ndefined already at this point. This is not the case. Please clarify.\n13) Page 9 of manuscript\nFigure 6 and Figure 7 seem to display different settings, as the implementation of Fig. 7 should lead to a probabilistic\nimplementation of the protocol in Fig. 6 but the way Fig. 6 is made it appears as if it is fully coherent.\n14) Page 10 of manuscript\n\"Platform management involves ... billing … setting service pricing.\" The way this sentence is phrased generates the\nimpression quantum internet realized following the structure suggested by the authors will be a reality tomorrow. Such\nImpression should be either strongly avoided or else corresponding sentences should all be pushed into one separate part\nof the document with an appropriate heading, or possibly even into a separate publication.", "reviewer_3": "The added discussion on the potential integration of quantum teleportation, QSDC, and TF-QKD in future implementations\neffectively situates the work within the broader roadmap of the quantum internet. This forward-looking perspective not only\nenhances the manuscript’s relevance but also demonstrates that the proposed architecture is inherently extensible to more\nadvanced protocols. Overall, the revisions satisfactorily address the earlier reviewer concerns, enrich the technical\ndescriptions, and broaden the manuscript’s impact. The work represents a solid and meaningful contribution to the\ndevelopment of heterogeneous quantum networks, and I therefore recommend it for publication."}, "author_response": "2\nLIST OF MAIN CHANGES\n• We deleted all machine learning related claims and citations in the main manuscript and\nSupplemental Material. Besides, as implementation security is not important in our work, some\ndiscussionsaccordingtoitareremovedtotheDISCUSSIONsectionasanopenquestion. Addition\nally, when referring to “security”, we emphasized it is “implementation security” or “information\ntheoretic security” when necessary.\n•Thediscussionabout“agility”,“flexible”,and“cost-effectiveness” areremovedtoDISCUSSION.\n• We replaced some “user” with “node”, “user node”, or “terminal” as appropriate throughout\nthe manuscript and Supplemental Material. We also added some sentences and rewrote Fig. 1\nto emphasize that not all nodes are user nodes. (Due to the extensive replacement of the term\n\"user\", we have not highlighted all these modifications in blue to keep the manuscript clean.)\n• Some misleading statements were corrected.\n• FIG. 1 was revised to emphasize that not all nodes are user nodes.\n• FIG. 6 in the original manuscript was unnecessary, so we removed it.\n(C-comment, R-response, M-modification)\nC: Dear Authors, many thanks for the accurate responses which helped clarify several important\nquestions and improved quality of the manuscript.\nSummarizing my perception before going into details, I think that both architecture and imple\nmentation as presented in this work are remarkable. However some claims go significantly beyond\nthe scope of this work and I strongly suggest to be careful with those. These claims should either\nbe completely taken out of the manuscript or else they should at least be clearly separated from the\ntechnical content. Most of my comments relate to this observation and are listed below. With kind\nregards.\nR: Dear Reviewer, we sincerely thank you for your meticulous reading of our manuscript and\nyour invaluable insights. Your valuable comments and profound insights regarding the network\naspects are crucial for enhancing our work. We fully agree with your comments that, although\nsome of the claims in our manuscript do not pertain to our core contributions and conclusions,\nthey\nmust be addressed with great caution to prevent any potential misunderstandings among readers.\nIn the revised version, we have carefully revised the manuscript accordingly. Notably, for clarity in\ncross-referencing, we adopt that the hyperlinked citations with label “R” refer to figures, equations,\nand references in this response letter, while non-hyperlinked ones with label “S” point to the figures,\nequations, and references in the original Supplemental Material, and non-hyperlinked ones without\nany additional label point to the figures, equations, and references in the original main text. Our\npoint-by-point responses and the specific modifications made are detailed below.\nC.1: On page 37 of the rebuttal / page 16 of the supplementary / page 10 of the manuscript\nClaims are made in the rebuttal that machine learning could be used to learn about attacks and\nswitch between protocols. Such methods do not follow any rigorous method of proof, so\nthat a large security issue may result from their application. The manuscript itself does not claim\nto use machine learning methods for network monitoring. It only lists \"monitoring\" in Fig. 11 on\npage 10. The supplementary material on page 16 however states\n\"A primary criterion for the orchestration core in selecting an appropriate protocol is hardware\nsecurity. By leveraging the network hypervisor module (as illustrated in Fig. 10), the orchestration\ncore can continuously monitor the network status — for instance, by employing machine learning\nand pattern recognition techniques to identify potential device attacks [17, 18]. If anomalies im\nply potential detector attacks are detected, then the orchestration core prioritizes MDI-type QKD\nprotocols.\" Thus, network security is here based on the assumed performance of a further network\n4\nfunction, whose functionality is not clearly defined. It is highly advisable to make this extremely\nclear, and define the expected functionality. The performance of such a network function may then\nbe investigated independently. Since machine learning and AI are very hot topics, an avalanche of\nfalse claims may result from the above vague statements.\nI would like to stress at this point that my personal application perspective on QKD is not overly\npositive, but the whole venture with QKD security starts from clear and provable claims, which can\neventually lead to stable embodiment. My understanding of machine learning based approaches is\nthat they lack any fundamental argument of why they should be reliable.\nR.1: Thankyouforyourcomment. Asyouremarked,thisclaimjustreferstoadiscussiononthe\npossiblesuperiorityoftheSDNquantumcommunicationnetwork. Toavoidanymisunderstanding,\nthe relevant discussions were moved to the DISCUSSION section, and any mention of machine\nlearning was removed.\nWe would like to clarify a potential misunderstanding, and we will revise the relevant descrip\ntions in the manuscript accordingly.\nIt is a consensus in the QKD field that the concept of security consists of two layers. The first\nlayer is information-theoretic security (the security independent of computational assumptions)\nagainst any eavesdropping on the channel, while the terminal devices are assumed to be greatly\nprotected. This constitutes the fundamental advantage of QKD over conventional cryptography.\nThe second layer is the implementation security, which should consider the security of the termi\nnal devices. This security should be guaranteed by users themselves. In fact, nearly all secure\ncommunication systems, including QKD, are primarily designed to protect information during\ntransmission. They offer limited protection against an eavesdropper who has already physically\ncompromised the user’s terminal. (We further wish to emphasize that since QKD often models\nthe eavesdropper as all-powerful, research on implementation security correspondingly assumes\nextremely strong attack capabilities, such as a lossless channel, perfect photon-number resolution,\nperfect bypass user isolation, and unresponsive users to dramatic parameter changes. In practice,\nhowever, successfully infiltrating a real-world QKD system and extracting the final key without\nalerting the users is nearly impossible with current technology.) To summarize, against an eaves\ndropperwhohascompromisedtheuser’sdevice, bothclassicalandquantumcryptographicsystems\nare largely ineffective.\nThe “security” claim addressed by this comment specifically pertained to the second layer: im\nplementation security. Our original idea was that the server could, by integrating user information\nand channel monitoring, sense potential intrusions into user devices and alert the users to switch\nprotocols (e.g., suggesting a switch to MDI-QKD upon detecting signs of a detector attack). This\nconcept, inspired by prior work such as Ref. [1], does not compromise QKD’s fundamental ad\nvantage of information-theoretic security for the channel. Rather, it aims to provide potential\nadditional benefit for the implementation security, where undetected device compromises could\n5\npose risks.\nSimilarly, the cited works on machine-learning-based attack detection also operate within the\nimplementation security and do not contradict QKD’s information-theoretic security foundation.\nSince enhancing implementation security is not a core contribution of our work, we removed the\nclaims related to it. A brief discussion on this distinction between security layers will be retained\nin the DISCUSSION section to prevent misinterpretation.\nM.1: We deleted all machine learning related claims and citations. As implementation secu\nrity is not important in our work, some discussions regarding it were moved to the DISCUSSION\nsection as an open question. Additionally, when referring to the “security”, we emphasized it is\n“implementation security” or “information-theoretic security” if necessary. Besides, the relative\nclaims in Supplemental Material is revised as “A primary criterion for selecting an appropriate\nprotocol is node type. For nodes equipped with only a single type of device, the protocol must be se\nlected according to TAB.I in the main text. For instance, D-C-type combinations require P&M-type\nprotocols, while C-C-type combinations require MDI-type protocols. For nodes possessing multiple\ntypes of devices, protocol selection can depend on specific requirements. For example, MDI-type\nprotocols can be immune to potential detector attacks but may have a lower secret key rate compared\nto BB84. Additionally, both P&M-type and MDI-type protocols have various misalignment-tolerant\nvariants, which can be selected based on channel and device conditions (The specific criteria for\nsuch selections is complex, it remains an open question to be refined in future works.”\nC.2: Page 41 of the rebuttal\nClaims about agility such as \"Meanwhile, practical QKD devices typically incorporate parameter\nmonitoring capabilities. When the user (or server) detects that certain devices may be under\nthreat, it can mitigate the risk by requesting (or suggesting) to switch to higher-security protocols\"\nare a bit vague. Are these things that might be done/published by someone else, or have they been\nimplemented and are part of this particular scientific work? See also my first comment.\nR.2: Thank you for this valuable comment. Our description of “agility” comes from the con\ncept in the cited work “Agile and versatile quantum communication: Signatures and secrets” [1]\npublished on Physical Review X. This work introduces the concept of “agile and versatile” quan\ntum devices capable of executing multiple protocols and tasks, allowing them to switch to avoid\npotential attacks. Given that our network architecture also inherently supports multiple protocols\nand tasks, we have adopted this concept. We wish to emphasize that, as clarified in our response\nto Comment R.1, our “agility” only refers to the implementation security against the compromise\nof user devices, and does not concern the fundamental information-theoretic security of the QKD\nprotocols themselves.\nmoved this discussion to the DISCUSSION section in the revised manuscript.\nM.2: The original claims of agility “These features provide the superiority in flexibility and\nagility since the network can dynamically adapt its resource allocation through programmable control\ninterfaces and the multi-protocol support allows users to switch optimal protocols according to the\nchannel condition.” intheINTRODUCTIONwasrevisedasashortsentence“...... brings potential\nadvantages of “flexibility, “agility” [1], “optimization”, and “cost-effectiveness”. Then we added a\nparagraph “The features of our network provide new opportunities to obtain the superiority such\nas ...... “agility” ...... Besides, as discussed in Ref. [33], quantum devices capable of executing\nmultiple protocols and tasks can switch to avoid potential attacks for improving the implementation\nsecurity ......” in DISCUSSION section.\nC.3: Page 43 of rebuttal\nIn Fig. R11, what is the unit of network scale?\nR.3: Thank you for the question, the unit of the network scale is the “node number”.\nM.3: As this figure was created specifically as a supplementary illustration to address the\nquestion from Reviewer #3, it is not part of the manuscript itself. Therefore, no corresponding\nchanges regarding this comment were made in our revised version.\nC.4: Page 43 of rebuttal, page 2 of manuscript\nThe manuscript mentions cost effectiveness and an argument is made that network upgrades\nmay be realized with fewer components compared to previous solutions. Are hardware upgrades\nmeant here?\nR.4: Thank you for this comment. The “upgrades” mentioned here refer to expanding the\nnetwork scale and upgrading an existing network that only supports P&M-type BB84-QKD into\na multi-protocol, multi-task quantum communication network.\nThe“cost-effectiveness” ismainlyreflectedintwoaspects. First, ourmethodmakesitpossibleto\nmerge some existing networks. For example, the Beijing-Shanghai backbone [2] uses polarization\nencoding BB84 protocol, while the Hefei-Chaohu-Wuhu quantum communication network employs\nphase-encoding BB84 protocol [3]. Merging the two networks originally might require replacing\npart of the encoding and decoding equipment, but with our method, network merging can be\nachieved more easily, saving costs (of course, complete network merging still requires further engi\nneering support, but here we provide the physical possibility for merging). On the other hand, by\n7\ntreating the original terminals as \"S-type node\" and \"D-type node\" and changing the connection\nmethod, protocols other than BB84, such as MDI-QKD, can be supported, thereby upgrading the\noriginally all-trusted-node network to one containing untrusted nodes. Since this process in prin\nciple also does not require additional quantum devices (and quantum devices are usually relatively\nexpensive), it can also be called cost-effectiveness.\nThe original manuscript only contained one sentence in this regard, which may not be clear\nenough. However, considering that a detailed discussion of “cost-effectiveness” and “upgrade” in\nthe manuscript would be too lengthy, and they are not our core contribution, we also prefer to\nmove it to the DISCUSSION section and elaborate on it in more detail.\nM.4: According to your comment, we deleted the “cost-effectiveness” and “network upgrades”\nin INTRODUCTION and added a paragraph “The features of our network provide new opportuni\nties to obtain the superiorities such as ...... “cost-effectiveness” ...... Finally, the network could be\ncost-efficient since the heterogeneous structure allows for the integration of existing quantum com\nmunication networks and the upgrade of existing single-function trusted-node quantum networks\nto versatile prepare-and-measure quantum networks without requiring large-scale replacement of\nencoding and decoding equipment......”.\nC.5: Rebuttal page 48, page 1 of manuscript\nI am not sure it is a good idea to cite a work ([66] in rebuttal, [64] in manuscrpit) which has\nnot been reviewed yet so prominently.\nR.5 and M.5: Thank you for your concern. We fully agree with your perspective. Fortu\nnately, this work has already completed the peer-review process and has been formally accepted\nfor publication in Physical Review Applied (see Fig. R1). We believe it will be published shortly.\nFIG. R1. This work has been accepted by Physical Review Applied\n.\nC.6: Rebuttal page 51 comment M.12 and page 2 of the manuscript\nof a network simultaneously appears not very realistic for a larger scale network. At the very least,\nit should be supported by technical assessment of drift speeds, bandwidth of detectors tracking the\nchanges, protocol overhead for the continuous monitoring and latency requirements (if there are\nany). The manuscript should separeate actual achievements from projections based on the available\ntechnology and also from some partially very broad and visionary claims.\nR.6: Thank you for this comment. This concern primarily relates to our discussions on “op\ntimization” and “agility”. As these aspects are not the core contributions of this work, we have\nfollowed your previous suggestion to move the majority of this content to the DISCUSSION section\nto better frame it as prospective and conceptual.\nFurthermore, we would like to clarify a potential misunderstanding regarding the technical\nfeasibility. Your comment “sdn server handle a multitude of physical properties at all individual\nlinks of a network simultaneously appears not very realistic for a larger scale network ...... it\nshould be supported by technical assessment of drift speeds, bandwidth of detectors tracking the\nchanges ...... ” seems to misunderstand that the “optimization” and “agility” require the server\nto perform high-speed and precise tracking of rapidly fluctuating physical parameters across all\nchannels. However, this is not the case in our current conception.\nOur notion of optimization operates on two distinct levels. The first one is the “Network-level\noptimization”: The server allocates network resources to users based on their demands, thereby\noptimizing overall network performance. This concept is well-established and extensively studied\nin SDN, including routing optimization [4], virtual network function optimization [5], resource\nmanagement [6], and etc.\nThe other one is the “QKD parameter optimization”: In practical QKD, users often need to\nadjust parameters (e.g., state probabilities, mean photon numbers) based on factors like detector\nchannel loss, efficiency, and dark counts. As users may pair with different partners over varying\npaths, theserverhastheopportunitytointegratetheglobalnetworkinformationtoquicklysuggest\noptimal or near-optimal parameters, for instance, via a pre-established lookup table. Crucially, as\nweintroducedinDISCUSSION,theserveronlysuggeststheseparametersandthefinaladjustment\nis performed locally by the users themselves. Supported by substantial evidence in the QKD\nfield, as long as users’ modulation faithfully implements the intended operations, a malicious\nserver providing false parameters would only reduce the key rate but would not compromise the\ninformation-theoretic security. These optimal parameters mainly depend on channel loss and\ndetectorcharacteristics[7–10]. Accordingtoourfieldexperimentexperience[3,11,12], thechannel\nloss and detector characteristics are typically quasi-static, which thus do not require frequent\nmeasurement. Consequently, there is no need to do the “high-bandwidth monitor”.\nRegarding the agility [1], as we have discussed in R.2, it considers eavesdroppers using realistic,\navailable technologies to compromise user devices, not the theoretically all-powerful Eve assumed\n9\nin the information-theoretic security. Our concept is as follows: a realistic physical attack, such as\ninserting a measurement device into the channel (which is often necessary for obtaining raw keys\neven if some user devices have been controlled [13, 14]), can induce detectable physical signatures\nsuch as strong Rayleigh backscattering. This monitoring is also a relatively slow process and does\nnot require high-bandwidth equipment.\nAsyounoted, ourdiscussiononimplementationsecurityisintendedasapotentialenhancement.\nTherefore, in accordance with your guidance, we have revised it as an open question for future\nwork within the DISCUSSION section.\nM.6: The relative claims are revised and moved to DISCUSSION.\nC.7: Main article, page 1\nAbstract: Please state clearly the physical size (e.g. in square meters) of the implementation.\nKey concept: The way the proposed network is described, I find only users, while the network\nconsists of controller plus routers and converters. I find it hard to convince myself that this type\nof architecture should eventually be the basis of a quantum internet. It reminds me of distributed\narchitectures like firechat, which are important but at the same time not of wide-spread use. One\nreason for that is that users will not share their bandwidth with others if they do not absolutely\nhave to.\nIt also seems unlikely to this reviewer that an architecture where a central controller will be\nable to manage all the \"user\" devices will scale well. Sticking to the analogy with mobile wireless,\nthe channel conditions of \"users\" would vary drastically over time. In the mobile communications\narea, failed attempts to integrate \"coordinated\" protocols are well known. The coordinated protocols\nturned out to be optimal only in theory, but were eventually not implemented - very likely because\nthey were extremely costly or even impossible to realize in practice.\nThroughout, it might be better to speak of \"nodes\" rather than \"users\" of the network for the\nabove reason.\nR.7: Thank you for the advice. There is a misunderstanding that arose from unclear descrip\ntions in our original manuscript. Please allow us to further explain this from two perspectives.\nFirst, the firechat you mentioned [15] is a distributed network architecture composed solely of user\ndevices without any Internet infrastructure, which is different from our original proposal. Actu\nally, in our proposed architecture, not all sources (C-type nodes & E-type nodes) and detection\nequipment (D-type nodes) are required to be user-owned. Instead, it is necessary to construct ded\nicated infrastructures, including source/detection equipments, routers, converters, and controller,\nfor building a scalable quantum internet. The 5-node experiment in previously FIG. 2 serves as\n10\na prototype that demonstrates the feasibility of the proposed heterogeneous prepare-and-measure\nquantum network. Second, to better illustrate how the proposed architecture can be extended for a\nscalable quantum internet, please refer to the previously FIG. S12 (Fig. R2 in this response letter),\nthe cylindrical elements without user icons represent dedicated infrastructures belonging to a net\nwork operator, including entanglement sources, detectors, or converters, that can be dynamically\nallocated to arbitrary users under the guidance of the controller.\nRegarding the comment “Please state clearly the physical size (e.g. in square meters) of the im\nplementation.”, we guess that you are concerned about the deployability implications of physical\nsize. In practice, at the QKD protocol level, typical QKD systems can operate over distances on\nthe order of a hundred kilometers. At the network control and management level, leading com\nmercial enterprises, such as Microsoft [16] and Google [17], have deployed SDN technology to build\nlarge-scale datacenters operating under latency variations ranging from seconds to microseconds.\nNotably, Microsoft leverages SDN to control inter-datacenter traffic across standard wide-area\nnetworks (WANs) spanning up to 100 kilometers [16]. In principle, a network architecture of this\nkind is entirely feasible for supporting metropolitan area networks and even WANs. If you are\nreferring to the space occupied by the experimental setup, our entire network experiment utilized\ntwo optical tables, each measuring 1.2m × 2.4m. However, considering that QKD experiments\nrarely emphasize the occupied area, highlighting this point in the paper might cause confusion for\nreaders engaged in experimental research.\nRegarding the comment “...... One reason for that is that users will not share their bandwidth\nwith others if they do not absolutely have to.” We would like to provide some additional context\nto address your concern. In classical networks, one fundamental principle involves statistical\nmultiplexing limited network resources [18](Chapter 1.3.2), where bandwidth sharing among users\nis inevitable. This leads to resource competition through end-node congestion control mechanisms\nsuch as TCP, which is a common feature in current Internet architectures. We understand your\nunderlying concern is that users would not share their hardware resources on their devices to\nhelp others’ transmission in classical networks. As we initially explained in R.7, our proposed\narchitecture requires network infrastructures to build a scalable quantum internet in practice. In\nsuch a network, although we believe a full hardware sharing could be beneficial in certain scenarios,\nsuchasprivateQLANsinacademicinstitutionsorquantumdatacenters, wewouldliketohighlight\nthat it does not mandate users to share their hardware resources for others’ tasks. This flexibility\ncan be easily configured on the server, offering an optional feature for the network.\nM.7: Wereplacedsome“user” with“node”, “usernode”, or“terminal” asappropriatethroughout\nthe manuscript and Supplemental Material. We also added a sentence “the server can also provide\nor borrow E-type and D-type nodes for entanglement distribution or Bell-state measurement (BSM)\nto assist the EB protocols and MDI-type protocols. These untrusted E-type and D-type nodes can\nbelong to server or inactive user nodes.” to emphasize that not all nodes are user nodes.\nAdditionally, we rewrote FIG. 1, and revised the caption of FIG. 1 and FIG. S12 to emphasize\nO1 LAQN-1\nP\nP\n1\nP\ni\ni\n+\n+\n1\nP3\nI2\nP4\nO2 …\nI3\n… …\n… O3 LAQN-2 LAQN-i+2\n…\n. …\n… …\n… … . … … … … …\n… . .\n…\nI N OM LAQN-i P P i i -1 P P K K -1 LAQN-X\n(a) Local Area Quantum Network (b) Wide Area QuantumNetwork\nE-type node C-type node D-type node Converter MEMS OS User User with converter Server\nFIG. R2. This figure corresponds to FIG. S12. The cylindrical elements without user icons represent\nthe nodes belongs to the server, including entanglement sources (orange), detectors (blue), or converters\n(green), that can be allocated to users.\nthat some D-type and E-type nodes belong to the server and can be employed as untrusted relays.\nC.8: Page 2 of manuscript\nThe sentence \"Additionally, the network is cost-efficient since the heterogeneous structure allows\nit to achieve full connectivity and realize network Upgrades with fewer components compared to\nprevious solutions.\"\nclaims cost-effectiveness of the proposed approach.\nIt might be a bit early to claim cost-effectiveness as a fact. The main drivers of cost in a\nnetwork will most certainly change over time. Rather write “Additionally, the network provides\nnew opportunities for cost-efficient design, since the heterogeneous structure allows it to achieve full\nconnectivity and realize network upgrades with fewer components compared to previous solutions.”\nR.8 and M.8: Thank you for the valuable comment. We agree that your advised version is\nmuchmorerigorous. Inthenewversion, wemovedthisparttoDISCUSSIONandreviseditas“The\nfeatures of our network provide new opportunities to obtain the superiorities such as ...... “cost\neffectiveness” ...... Finally, the network could be cost-efficient since the heterogeneous structure\nD-type nodes\nDoF conv. Routers\nE.- Pol.\nD.-T.B.P.\nE.-T.B.P\nC.-Pha.\nD.-Pol.\nE.-Pol.\nC.-T.B.P. D.-Pha.\nE.- T.B.P.\nD.-T.B.P.\nC.-Pol.\nE-type node C-type node D-type node DoF conv. Router User User with conv. Controller\nFIG. R3. Revised Fig. 1 (in manuscript).\nallows for the integration of existing quantum communication networks and the upgrade of existing\nsingle-function trusted-node quantum networks to versatile prepare-and-measure quantum networks\nwithout requiring large-scale replacement of encoding and decoding equipment......”. Besides, the\nclaim in ABSTRACT was also revised as ...... and provides opportunities for global optimization\nand cost-efficient design.\nC.9: Page 5 of manuscript\nthe sentence “...core automatically selects appropriate quantum task and protocol according to a\npredefined rule. The server automatically routed the quantum channel (Micro-electro mechanical\nsystems can automatically route the quantum channel. In this setup, we manually switch the user\nlinks, which does not affect our conclusions) and informed the users of the channel parameters”\nis very unclear to this reviewer. What exactly is meant by \"automatic\" or \"automatically\". This\nalso appears later again and is hard to understand. In case the supplementary material clarifies\nthis aspect, could a pointer to the supplementary material be set?\nR.9 and M.9: Thank you for your comment. The term “automatically” here was used in\ncontrastto“manually”. Whatweintendedtoexpressisthattaskselection, parameteroptimization,\nandpathallocationcanbeachievedthroughpre-writtenprogramsandrules,i.e.,programmatically.\nAccording to your comment, we think that using “programmatically” would be more precise in this\ncontext. However, considering that such emphasis may not be necessary, we removed the terms\n\"automatically\" and \"automatic\" entirely in the revised version.\nIn the sentence \"After that, the users and the server synergistically calibrated the phase refer\nences\" it is not clear what is meant by \"synergestically\". There should be a clear description of\nprotocol, a reference to a description in the supplementary, or a reference to another scientific\nwork which describes the protocol.\nR.10 and M.10: Thank you for pointing out this problem. It is a typo, we want to say\n“synergistically”. In QKD systems, the calibration of some parameters, such as the phase reference\nframe and polarization, requires a cooperative effort between the two communicating parties. This\nprocess involves the exchange of classical information (which, we note, does not compromise the\nprotocol’s security). In our experimental setup, classical communication between users is relayed\nthrough the server. This is the context in which we originally described the process as the server\n“synergistically” participates in the calibration of phase references, polarization, etc., by adjusting\ncomponents such as phase shifters, EPCs, circuits, etc.. As “synergistically” is not central to the\ntechnical and may introduce unnecessary ambiguity, we removed it in the revised manuscript.\nC.11: Page 5 of manuscript\nIn the sentence \"According to the parameters of terminals and channel, the Orchestration core\nautomatically loaded optimized parameters [71,80,81,82] (including decoy-state intensities and se\nlection probabilities) from a pre-established optimal-parameter table\" I would suggest to be careful\nwith the references to machine learning, see my comment on the inability of machine learning tools\nto adequately detect critical system changes.\nR.11 and M.11: Thank you for this suggestion. In response, we have removed the two Ref.\n[19, 20] ([81, 82] in the original manuscript), as they pertained to parameter optimization via\nmachine learning. Ref. [9, 21] [71, 80] have been retained, as they correspond to decoy-state\nparameters (state probabilities and mean photon numbers) specifically for the BB84 and MDI\nprotocols implemented in this work.\nFurthermore, we wish to emphasize that the parameter optimization can be realized by many\napproach, such as pre-calculated look-up table, classical optimization algorithms, etc. Besides, as\ndiscussed in R.6, QKD remains secure even if the server acts maliciously and provides false param\neters, as long as the user’s modulation is consistent with their assumptions, the only consequence\nwould be a reduction in the key rate.\nThe sentence \"In accordance with the established rules, the orchestration core selected the BB84-\nQKD protocol for D-C type combinations, including Alice-David, Bob-David, Charlie-David, and\nFrank-David\" suggest that these rules have been defined already at this point. This is not the case.\nPlease clarify.\nR.12: Thankyouforthisvaluablecomment. Werecognizethatouruseoftheword“established”\nwas imprecise, as it can imply a set of standard or universally recognized rules, which was not our\nintended meaning.\nWe aimed to express that the orchestration core selected protocols based on the pre-defined\nrules outlined in TABLE I of our manuscript (Tab. I in this response letter). According to this\ntable, a D-C type user combination should select a P&M-type protocol, for which we selected the\nmost common BB84 protocol as a representative example.\nM.12: To prevent any potential misunderstanding for readers, we have revised “established\nrules” as “pre-defined rules in Tab. I.”\nTABLE I. Protocol selections for different user types.\nuser type C-type user E-type user D-type user\nC-type user MDI-type 1 MDI-type 2 P&M-type 3\nE-type user MDI-type 2 MDI-type 4 P&M-type 5\nD-type user P&M-type 3 P&M-type 5 EB-type 6\n1MDI-typeprotocolswithweakcoherenttransmitter.\n2MDI-typeprotocolswithhybiredsources.\n3ThemostmatureP&Mprotocols,includingdecoy-statebasedBB84,RFI,andLT,et.al.\n4MDItypeprotocolswithheraldedsingle-photonsourceandpassivedecoy-statemethod.\n5P&Mprotocolswithheraldedsingle-photonsourceandpassivedecoy-statemethod.\n6Entanglement-basedprotocols,suchasE91andBBM92protocols.\nC.13: Page 9 of manuscript\nFigure 6 and Figure 7 seem to display different settings, as the implementation of Fig. 7 should\nlead to a probabilistic implementation of the protocol in Fig. 6 but the way Fig. 6 is made it\nappears as if it is fully coherent.\nR.13: Thank you for this comment. As discussed in Sec. V of the Supplemental Material, the\n“probabilistic implementation” can be equivalently treated as a form of physical loss.\nInSec. V.A,wemodeledthepracticalDoFconverters,includingnon-idealpropertiessuchasloss\nand crosstalk. Sec. V.B then presents several specific implementations and their corresponding\nconversion processes. Specifically, FIG. S5 (Fig. R4 in this response) corresponds to FIG. 7\n15\n(Fig. R5 in this response). As shown, compared to the ideal model, the final output includes\nan additional discarded state term, |∅⟩. The two lemmas introduced in Sec. V.A guarantee that\nthis term does not compromise the information-theoretic security and can be interpreted as a\nconversion failure probability of 50%, equivalent to a 3 dB loss.\nGiven that practical devices always exhibit inherent loss, the term |∅⟩ is unavoidable regardless\nof the implementation used to realize our DoF converter. The key distinction is that the |∅⟩ in\nour experiment is actively discarded, and we have proven it is secure, whereas the |∅⟩ from device\nloss usually represents the energy dissipation into other physical forms.\nWe acknowledge that presenting FIG. 6 and FIG. 7 (in original manuscript) side-by-side could\nbe misleading for readers unfamiliar with the practical experimental components. Since the ab\nstraction of the DoF converter is already well-established in Sec. V.A, we removed the original\nFIG. 6 and adjusted the accompanying expression accordingly.\nDelay\nT.B.P.-port Pol.-port\nBS\nPBS\nPZT\nPBS&Delay BS 2\n|𝐻⟩ 𝑢,𝑙 ( 𝑙 + ∅ ) (R1)\nPBS&PZT BS 2\n|𝑉⟩ 𝑑,𝑒 ( 𝑒 + ∅ ) (R1)\n|𝑒⟩ (𝑢 + ∅ ) (𝐻 + ∅ ) (R1)\n2 2\nT.B.P. → Pol.\nBS&PZT 2 BS 2\n|𝑙⟩ ( 𝑑 + ∅ ) ( 𝑉 + ∅ ) (R1)\n2 2\nFIG. R4. Corresponding to FIG. 5 in the Supplemental Material.\nM.13: We removed the original FIG.6 and added a sentence “...... (see Supplemental Material\nfor detailed physical model with practical imperfections and different physical realizations).”\nC.14: Page 10 of manuscript\n\"Platform management involves ... billing ... setting service pricing.\" The way this sentence\nis phrased generates the impression quantum internet realized following the structure suggested\n16\ndelay\nBS\nT.B.P. port PZT PBS Pol. port\nFIG. R5. Corresponding to FIG. 7 in the original manuscript.\nby the authors will be a reality tomorrow. Such impression should be either strongly avoided or\nelse corresponding sentences should all be pushed into one separate part of the document with an\nappropriate heading, or possibly even into a separate publication.\nR.14andM.14: Thankyouforthevaluablecomment. Weacknowledgeit’stooearlytodiscuss\nbilling in the manuscript. We removed it in the revised version. The corresponding sentence was\nrevisedasPlatform management involves network configuration and access authentication, enabling\nthe server to enable or disable specific quantum tasks and controlling user access.\n[R1] S.Richter, M.Thornton, I.Khan, H.Scott, K.Jaksch, U.Vogl, B.Stiller, G.Leuchs, C.Marquardt,\nand N. Korolkova, Physical Review X 11, 011038 (2021).\n[R2] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. Zhang, K. Chen, J. Yin, J.-G. Ren,\nZ. Chen, et al., Nature 589, 214 (2021).\n[R3] S.Wang,W.Chen,Z.-Q.Yin,H.-W.Li,D.-Y.He,Y.-H.Li,Z.Zhou,X.-T.Song,F.-Y.Li,D.Wang,\net al., Optics Express 22, 21739 (2014).\n[R4] J. Xie, F. R. Yu, T. Huang, R. Xie, J. Liu, C. Wang, and Y. Liu, IEEE Communications Surveys\n& Tutorials 21, 393 (2018).\n[R5] J. Pei, P. Hong, M. Pan, J. Liu, and J. Zhou, IEEE Journal on Selected Areas in Communications\n38, 263 (2019).\n[R6] J. Du, C. Jiang, A. Benslimane, S. Guo, and Y. Ren, IEEE/ACM Transactions on Networking 30,\n1613 (2022).\n[R7] X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Physical Review A 72, 012326 (2005).\n[R8] F. Xu, M. Curty, B. Qi, and H.-K. Lo, New Journal of Physics 15, 113007 (2013).\n[R9] W. Wang, F. Xu, and H.-K. Lo, Physical Review X 9, 041012 (2019).\n17\n[R10] X.-J.Huang, F.-Y.Lu, S.Wang, Z.-Q.Yin, Z.-H.Wang, W.Chen, D.-Y.He, G.-J.Fan-Yuan, G.-C.\nGuo, and Z.-F. Han, Physical Review A 106, 062607 (2022).\n[R11] W. Chen, Z.-F. Han, T. Zhang, H. Wen, Z.-Q. Yin, F.-X. Xu, Q.-L. Wu, Y. Liu, Y. Zhang, X.-F.\nMo, et al., IEEE Photonics Technology Letters 21, 575 (2009).\n[R12] S. Wang, W. Chen, Z.-Q. Yin, Y. Zhang, T. Zhang, H.-W. Li, F.-X. Xu, Z. Zhou, Y. Yang, D.-J.\nHuang, et al., Optics Letters 35, 2454 (2010).\n[R13] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, Nature Photonics 4,\n686 (2010).\n[R14] F.-Y. Lu, P. Ye, Z.-H. Wang, S. Wang, Z.-Q. Yin, R. Wang, X.-J. Huang, W. Chen, D.-Y. He, G.-J.\nFan-Yuan, et al., Optica 10, 520 (2023).\n[R15] Wikipedia, Firechat"}, {"round": 2, "reviewer_comments": {"reviewer_2": "Dear authors,\nmany thanks for the careful review. I think all my comments have been addressed. Congratulations on a very nice paper!\n\n======================================================================\nATTACHED REVIEWER REPORT — IMPORTANT\nThe text below is a complete reviewer report submitted as a PDF\nattachment. It appears after the Creative Commons license block.\nAssign it to whichever reviewer wrote 'see pdf' or had no inline text.\n======================================================================\n\nLIST OF MAIN CHANGES\n• The title was revised as “Fully heterogeneous prepare-and-measure quantum network\nfor the next stage of quantum internet” to emphasize current stage of the quantum internet.\n• A paragraph for discussing quantum teleportation, QSDC, and TF-QKD (including\nsome relative references) was added to the DISCUSSION.\n• In the revised main text, we emphasized “the BSM serves as part of the MDI-QKD\nprotocol.” and added a paragraph in METHOD to introduce the equivalence between the\njoint-BSM and the regular-BSM in MDI-QKD.\n•TheQCKAintheoriginalmanuscriptisrevisedasquantum conference with key delivery\nto avoid misleading.\n• In the revised METHOD section, our description of the software-defined prepare-\nand-measure network now includes a dedicated paragraph analyzing the central coordinator’s\nthreat model. The reason why the information-theoretic security of QKD and QBS is server-\nindependent is explained in the added paragraph.\n• A conclusion was added to the revised main text for summarizing.\n• We cited some important works and textbook-level references in the revised version.\n•AnabbreviationstablewasaddedatthebeginningoftherevisedSupplementalMaterial\nfor better readability.\n• We added Sec. V in the revised Supplemental Material to introduce more details about\ntheDoFconverter. Specifically,Sec. V.AintroducesthephysicalmodeloftheDoFconverter,\nSec. V.B introduces three examples for the physical realization, Sec. V.C introduces a\nprogrammable DoF converter, Sec. V.D introduces the experimental test of the converter\nmetrics. Besides, the METHOD for DoF converter in the main text was revised accordingly.\n• We added Sec. VI. DOF CONVERTER in the revised Supplemental Material to intro-\nduce the details about our orchestration core.\n• An additional section (Sec. VII SCALABILITY OF OUR HETEROGENEOUS NET-\nWORK) was added in the revised Supplemental Material to discuss the scaling issue of our\nheterogeneous quantum network. In this section, we proposed a MEMS-OS-based architec-\ntural framework to scale our network to large-scale deployments and discussed a possible\nsolution for large-scale authentication. Besides, “The authentication between the five users\nis realized by the pre-shared secret keys” is emphasized in the revised main text.\n• We added a sentence to emphasize “the authentication between the five users is realized\n3\nby the pre-shared secret keys” in the “Experimental setup” section and briefly introduced the\npossible solution for authentication in large-scale networks in Sec. VII SCALABILITY OF\nOUR HETEROGENEOUS NETWORK in revised Supplemental Material.\n• We supplemented more experimental data for MDI-QKD and BB84-QKD to validate\nthe stability and generalizability. An additional section (Sec. VIII STABILITY TEST) was\nadded to the revised Supplemental Material to show the result.\nIn order to prepare for the future quantum internet, the authors propose to upgrade the\nexisting quantum networks which typically rely on dedicated systems for specific tasks, which\nrestricts the openness and diversity essential for the future quantum internet., to a fully\nheterogeneous quantum network along with a suite of enabling techniques. Typically they\nproposed an network that composed of node with users, source and detectors. The network is\ncalled heterogeneous because they can user all kinds degrees of freedom of quantum states, such\nas polarization, phase, time-bin and so on, and also refers to the facts that various protocols\nsuch as quantum key distribution, quantum data signature and so on can be performed.\nNotably, they demonstrated the multi-malicious node quantum Byzantine agreement in the\nworld for the first time.\nWhile the work is very interesting, it is still rudimentary from the point view of network-\ning, or quantum internet. What has been achieved is an adjustable point-to-point quantum\ntransmission of states. For BB84-QKD, one user must be of the D-type, which is the node\nwith a detector. For those with MDI-QKD, it involves three users, two are the c-type users,\nand one if the d-type, who performs the Bell-basis measurement. However, it is indeed a\nsolid work for a rudimentary quantum internet. I recommend its acceptance after revision.", "reviewer_os": "nprogrammable optical switch.\nInsertion loss Manual (dB) Programmable (dB)\nT.B.P. → Pol. 3.808 4.910\nPol. → T.B.P. 3.835 4.934\nTABLE II. Insertion loss of DoF converter (manual or programmable)\nRegarding the comment “I would like to point out that it reads from the manuscript as if\npart of the network was operated manually to compensate for the loss of the adapter. From\na network perspective, this is a bit of a drawback.”, we would like to clarify that this appears\nto be a misunderstanding, which may have arisen from the sentence “In our experiment,\nthe passive adapter has at least 3 dB loss, so we set them at C-type nodes for compensating\nthe loss” in our original manuscript. We sincerely apologize for the confusion and have now\nprovided more detailed explanations in the revised version to address this point.\nWe must emphasize that the “manual operation” is not for “compensating the loss of\nthe adapter”. We manually adjusted the direction of DoF converters instead of employing\nMEMS-OS just because it does not affect the validity of our core conclusion, while simul-\ntaneously reducing the device’s consumption. The “compensation” comes from the property\nof “Only photons transmitted into the quantum channel are security-relevant [12–14]”. As\nQKD only concerns the mean-photon number that is sent to the channel, all losses at S-type\n12\nuser’s secure zones can be compensated by increasing the source brightness or reducing the\nadjustable attenuation. Detailed security analysis was added to Sec. V. A. Physical Model\nof the DoF Converter in revised Supplemental Material. Notably, our heterogeneous net-\nwork enables users to borrow DoF converters from server or other nodes, but none of them\nare trusted, so the losses introduced by borrowed DoF converters cannot be compensated,\nultimately resulting in a reduced secret key rate.\nRegarding the comment “What is the physical realization of the ‘adapter’? The realization\nof the adapter is important for the work, although such system may not be strictly needed for\nthe realization of a \"quantum Internet\" demonstrator. The choice of material of the adapter\nalso has a clear impact on the reported work and thereby potentially on future technological\nrealizations of the ‘quantum internet’ ”, we introduce three examples of physical realizations\nfor the DoF converter, with one selected for detailed discussion here (the other two physical\nrealizations and more precise models are provided in the revised Supplemental Material (Sec.\nV. B. Physical Realization of the DoF Converter )).\nFig. R2 demonstrates an example of a passive structure DoF converter, which is also the\nadopted structure in our experiment. When a user wants to transfer their time-bin-phase\nor phase DoF to polarization DoF, they input the superposition a|e⟩+b|l⟩ (b is a complex\nnumber) into the adapter from the time-bin port, where |e⟩ and |l⟩ represent the early and\nlate time bin states respectively. Then the state is transferred to a path superposition. As\nan additional delay that equals the time difference between the two time bins is added to\n√ √\nup-path, the superposition is represented as 2(a|u⟩ + b|d⟩) + 2 |∅⟩, where |u⟩ and |d⟩\n2 2\nrepresent the up and the down-paths respectively, |∅⟩ represents the discarded state. After\nthat, the polarization beam splitter transfers the path DoF to the polarization DoF, and the\n√ √\nsuperposition is represented as 2(a|H⟩+b|V⟩)+ 2 |∅⟩. The |∅⟩ is discarded so the final\n2 2\noutput state is a|H⟩ + b|V⟩ (As discussed above, if DoF converter belongs to source type\nuser, |∅⟩ can be compensate, else if is borrowed from server or other nodes, |∅⟩ should be\nregarded as loss, which incurs a 3 dB reduction in the secret key rate.).\nSimilarly, when a user wants to transfer their polarization DoF to time-bin-phase or phase\nDoF,theyinputthepolarizationstatesfromtheoppositeside. Theevolutionofthequantum\nstate is as follows:\n√ √\n2(cid:16) (cid:17) 2\na|H⟩+b|V⟩ → a|u,l⟩+b|d,e⟩ → a|l⟩+b|e⟩ + |∅⟩, (R1)\n2 2\nwhere |∅⟩ is discarded, so the final superposition is represented as a|l⟩+b|e⟩.\nT.B.P.-port Pol.-port\nBS\nPBS\nPZT\nPBS&Delay BS 2\n|𝐻⟩ 𝑢,𝑙 ( 𝑙 + ∅ ) (R1)\nPBS&PZT BS 2\n|𝑉⟩ 𝑑,𝑒 ( 𝑒 + ∅ ) (R1)\n|𝑒⟩ (𝑢 + ∅ ) (𝐻 + ∅ ) (R1)\n2 2\nT.B.P. → Pol.\nBS&PZT 2 BS 2\n|𝑙⟩ ( 𝑑 + ∅ ) ( 𝑉 + ∅ ) (R1)\n2 2\nFIG. R2. Physical realization of the DoF converter in our experiment. BS: beam splitter;\nPZT: piezoelectric-based phase shifter; PBS: polarization beam splitter.\nThe other two physical realizations are illustrated in Fig. R3 and R4 (see revised Supple-\nmental Material Sec. V for more details). The two realizations are based on active modula-\ntion. Compared with the passive structure converter, the active modulation can principally\navoid the 3 dB loss. However, existing high-speed electro-optic modulators typically intro-\nduce additional insertion loss, which partially offsets the advantages of active architectures.\nConsequently, weadoptedpassive-structureDoFconvertersforourexperimentalverification,\nwhile acknowledging that active structures hold greater potential for future development.\nM.1: Corresponding modifications in the revised manuscript:\nWe added Sec. V in the revised Supplemental Material to introduce more details about\ntheDoFconverter. Specifically,Sec. V.AintroducesthephysicalmodeloftheDoFconverter,\nSec. V.B introduces three examples for the physical realization, Sec. V.C introduces a\nprogrammable DoF converter, Sec. V.D introduces the experimental test of the converter\nmetrics. Besides, the METHOD for DoF converter in main text was revised accordingly.\nDelay\nT.B.P.-port Pol.-port\nBS BS PBS\nPZT\n|𝐻⟩ PBS 𝑢 Delay & BS 2 (𝑢,𝑙 + 𝑑,𝑙) PM 2 (𝑢,𝑙 + 𝑑,𝑙) BS 𝑙 (R1)\n2 2\nPol.→ T.B.P.\n|𝑉⟩ PBS 𝑑 PZT & BS 2 (𝑢,𝑒 − 𝑑,𝑒) PM 2 (𝑢,𝑒 + 𝑑,𝑒) BS 𝑙 (R1)\n2 2\n|𝑒⟩ BS 2(𝑢,𝑒 + 𝑑,𝑒) PM 2(𝑢,𝑒 + 𝑑,𝑒) BS 𝑢,𝑒 Delay & PBS |𝐻⟩ (R1)\n2 2\nT.B.P. → Pol.\n|𝑙⟩ BS 2 𝑢,𝑙 + 𝑑,𝑙 PM 2(𝑢,𝑙 − 𝑑,𝑙) BS 𝑑,𝑙 PZT & PBS |𝑉⟩ (R1)\n2 2\nFIG. R3. An example of the DoF converter realizations based on active modulation. BS: beam\nsplitter; PZT: piezoelectric-based phase shifter; PBS: polarization beam splitter. PM: phase mod-\nulator.\nC.2: The description of the joint-BSM lacks some detail\n– is this a full BSM?\n– or is it only measuring one or two Bell states against the remaining ones?\n– the idea of distributing the BSM in the network is very interesting, but does it not\ncontradict the intention of typical protocols involving BSMs?\nFor example, BSMs may be used to extend range when used in quantum repeaters.\nThe implications on range arising from distributed BSMs should therefore be discussed.\nR.2: Thank you for the comment. Before addressing the question, we would first like to\napologize for the unclear expression and clarify that the BSM serves as part of the MDI-\nQKD protocol, rather than a quantum repeater. This work focuses on the realization of a\nsecond stage of the quantum internet, in which the quantum repeater is not supported. In\nthe revised version, more details about the joint-BSM are added to avoid misunderstanding.\nThe MDI-QKD protocol can be viewed as the time-reversed version of the entanglement-\nbased QKD scheme. In the entanglement-based setting, an untrusted third party prepares\nPBS PBS\nPol.-port\nT.B.P.-port\nPZT\nPC PC\nPC\nPM\nPBS\n|𝐻⟩ PBS&Delay 𝑢,𝑙 PBS&PC 𝐷,𝑙 PBS&PM 2 (𝑐𝑤,𝑙 − 𝑐𝑐,𝑙) PBS 𝑙,𝑉 (R1)\n|𝑉⟩ PBS&PZT 𝑑,𝑒 PBS&PC 𝐴,𝑒 PBS&PM 2 (𝑐𝑤,𝑒 − 𝑐𝑐,𝑒) PBS 𝑒,𝑉 (R1)\n2\n|𝑒,𝐷⟩ PBS&PM 2(𝑐𝑤,𝑒 + 𝑐𝑐,𝑒) PBS&PC 𝑒,𝐻 PBS&Delay 𝑢 PBS |𝐻⟩ (R1)\n|𝑙,𝐷⟩ PBS&PM 2(𝑐𝑤,𝑙 − 𝑐𝑐,𝑙) PBS&PC 𝑙,𝑉 PBS&PZT 𝑑 PBS |𝑉⟩ (R1)\nsplitter; PZT: piezoelectric-based phase shifter; PBS: polarization beam splitter. PM: phase mod-\n√ √\nulator. PC: polarization controller; |D⟩ = 2(|H⟩+|V⟩); |A⟩ = 2(|H⟩−|V⟩); |cw⟩ and |cc⟩\n2 2\nrepresent the clockwise and counterclockwise state respectively.\nand distributes Bell states to the users. In contrast, in MDI-QKD, the two users indepen-\ndently prepare quantum states, encode them, and send them to an untrusted server. The\nserver is required to perform a BSM to the received states [15]. If we want to realize a\nquantum repeater in MDI-QKD systems, additional quantum memory is essential. Nev-\nertheless, in current-stage quantum networks, production-ready quantum memory remains\nunsupported. Substantial efforts are still required to achieve practical quantum memory\nimplementations.\nRegarding the comment “Is this a full BSM, or is it only measuring one or two Bell\nstates against the remaining ones?”, while in theory all four Bell states can be used for key\ngeneration without compromising security, it is well known that complete BSM cannot\nbe achieved using only linear optical elements. As a result, practical MDI-QKD\nimplementations typically identify only a subset of Bell states. In our work, we consider two\ncases. Whentheusersencodeorconverttheirquantumstatesintopolarizationencoding, our\nBSM setup is capable of detecting the Bell states |Ψ+⟩ and |Ψ−⟩. The events corresponding\nto the other Bell states, which cannot be measured, are discarded. When the users use\n16\ntime-bin phase encoding, our measurement setup can only detect half of the |Ψ−⟩ events.\nThis is consistent with most current experimental implementations of MDI-QKD.\nRegarding the comment “the idea of distributing the BSM in the network is very inter-\nesting, but does it not contradict the intention of typical protocols involving BSMs?”, the\njoint-BSM is proposed to optimally utilize idle network resources, the model can be\ndescribed as Fig. R5. Regarding the channel between server and D-type nodes, the symmetric\npart (L) can be equivalently interpreted as the channel between the user and the untrusted\nmeasurement node. Besides, the asymmetric part (∆L) can be equivalently interpreted as\nan additional detection efficiency loss η . So the MDI-QKD with the joint-BSM can be\n∆L\nequivalently regarded as a conventional MDI-QKD with non-identical SPDs. As MDI-QKD\nmakes no assumptions about the detection system, asymmetrical detection efficiencies are in\nfact a prevalent scenario in practical MDI-QKD implementations.\nMDI-QKD with Joint BSM Conventional MDI-QKD\nD-type node1 D-type node\nUser 1 𝐿 1 𝐿 𝜂 User 1 𝐿 1 +𝐿 𝜂\nServer 𝜂′ 𝜂′×𝜂 Δ𝐿\nUser 2 𝐿 2 𝐿+Δ𝐿 User 2 𝐿 2 +𝐿\nD-type node2\nFIG. R5. Model of the joint-BSM. The joint-BSM in the right box can be equivalently modeled as\na conventional BSM with non-identical detector efficiencies as shown in the left box. The yellow\nboxes represent the detection module of the D-type users; L , L , L, L+∆L are channel length; η\n1 2\nand η′ are detection efficiency of the two D-type nodes. η denotes the transmission ratio of the\n∆L\nchannel with the ∆L length.\nLastly, we emphasize that our work focuses on the realization of a prepare-and-measure\nquantum network, primarily aimed at implementing QKD and other secure quantum tasks.\nIt does not involve the use of quantum repeaters.\nM.2: In the revised manuscript, we emphasized “the BSM serves as part of the MDI-\nQKD protocol.” and added a paragraph “In MDI-QKD, the joint-BSM model can be easily\nequivalent to a regular BSM-model. As shown in Fig. 9, regarding the channel between server\nand D-type nodes, the symmetric part (L) can be equivalently interpreted as the channel\nbetween the user and the untrusted measurement node. Besides, the asymmetric part (∆L)\ncan be regarded equivalently interpreted as an additional detection efficiency η . So the\n∆L\nwith non-identical SPDs. As MDI-QKD makes no assumptions about the detection system,\nasymmetrical detection efficiencies are in fact a prevalent scenario in practical MDI-QKD\nimplementations.” in the revised METHOD to introduce the equivalence between the joint-\nBSM and the regular-BSM in MDI-QKD.\nC.3: It remained unclear to this reviewer how exactly the \"quantum advantage\" of QBA\nbased on the protocol from [53] is realized.\nAccording to page 4 of the supplementary material, QBA is realized based on QDS. Ac-\ncording to page 3 of the supplementary material, QDS again is realized based on QKD. But\nQKD only produces shared secret keys, and so do methods from (post-quantum) cryptography.\nThe only difference is with regards to the notion of security. It might therefore be unclear\nfor non-experts in QBA (and is unclear for his reviewer), how exactly the benefit in QBA is\nrealized in the current network. It might be very helpful if the manuscript could clarify this.\nIf the answer lies in the redundant management of secure keys, the manuscript could\ndiscuss the possibly resulting reduction in the rate of the protocol. Such clarification could\nalso help to shape the expectations on future networks, and the possible benefits of multi-party\nentanglement.\nFurther, it is unclear whether the hashing procedure described on page 3 of the supplemen-\ntary material might reduce the security notion from information-theoretic to cryptographic.\nIt would be great if the authors could clarify this aspect, as it is of crucial importance but is\nsometimes overlooked.\nR.3: Thank you for your comments on the quantum advantage in QBA. the “quantum\nadvantage” of QBA refers to the information-theoretic security and surpassing the 1/3 fault-\ntolerance bound. Here we introduce it in detail as follows:\nQKD enables two communicating parties to share a secret key string with information-\ntheoretic security. QDS and QBA in our network utilize such secure key resources to achieve\nthe information-theoretic security. Although QDS and QBA can theoretically be imple-\nmented using alternative quantum resources, multiplexing the QKD-based keys can maxi-\nmize the resource utilization rate in our network, reflecting our principle of network resource\nmultiplexing. Additionally, QDS enables the construction of an asymmetric multiparty re-\nlationship among three participants, where the roles of the forwarder and the verifier are\n18\nsymmetric and do not rely on a trusted third party. Building upon QDS as the fundamental\nprimitive, the QBA protocol employs multi-round broadcasting and a recursive loop struc-\nture. Based on a binary tree model, QBA can rigorously prove the existence of a secure\npath, thereby achieving information-theoretic security while also surpassing the classical 1/3\nfault-tolerance bound for Byzantine consensus.\nTo achieve communication tasks with information-theoretic security under current tech-\nnological constraints, it is common practice to minimize the use of quantum resources and\nquantum operations whenever possible. The QBA protocol proposed in [53] exemplifies this\nprinciple by relying solely on the quantum state preparation and measurement operations al-\nready required by QKD. By combining these minimal quantum operations with appropriate\nclassical procedures, the protocol successfully achieves unconditional security for Byzantine\nagreement.\nTo illustrate this point more clearly, consider the example of implementing secure\ncommunication with information-theoretic guarantees. One can first execute a QKD protocol to\nestablish a shared secret key, and then use that key to perform a one-time pad encryption\nof the message. It is important to note that the one-time pad is a purely classical operation,\nbut the overall process achieves information-theoretic security. Therefore, for QDS or QBA\nprotocols, the essential quantum advantage lies in the use of quantum states during the"}, "author_response": ""}]

Decision letter